Re: [WireGuard] OpenWRT package for wireguard

[Baptiste Jonglez <baptiste@bitsofnetworks.org>]

[-- Attachment #1: Type: text/plain, Size: 3220 bytes --]

On Mon, Jul 04, 2016 at 09:48:38AM +0200, Baptiste Jonglez wrote:
> Here is the package finally:
> 
>   https://github.com/openwrt/packages/blob/master/net/wireguard/Makefile
> 
> The built packages should be available in the snapshots quite soon, e.g.:
> 
> - wireguard-tools: https://downloads.lede-project.org/snapshots/packages/mips_34kc/packages/
> - kmod-wireguard: https://downloads.lede-project.org/snapshots/targets/ar71xx/generic/packages/

For reference, here is the size of wireguard and its dependencies for
ar71xx, taken from the snapshots above:

 2.4 KB  kmod-udptunnel6_4.4.14-1_mips_34kc.ipk
 2.7 KB  kmod-udptunnel4_4.4.14-1_mips_34kc.ipk
 6.2 KB  kmod-ipt-hashlimit_4.4.14-1_mips_34kc.ipk
 6.2 KB  libmnl_1.0.3-2_mips_34kc.ipk
  19 KB  wireguard-tools_0.0.20160630-1_mips_34kc.ipk
  59 KB  kmod-wireguard_4.4.14+0.0.20160630-1_mips_34kc.ipk
  95 KB  total

That's really not bad!  It largely fits in any small router with 4 MB of
flash.

As a comparison, here is the size for fastd:

  12 KB  kmod-tun_4.4.14-1_mips_34kc.ipk
  15 KB  libjson-c_0.12-1_mips_34kc.ipk
  53 KB  fastd_18-1_mips_34kc.ipk
  79 KB  total

fastd, which is "optimized on small code size and few dependencies", is
indeed a bit smaller.  Also note that libjson-c is already there by
default on OpenWRT/LEDE, so the real additional size of fastd is only 65 KB.

Openvpn with polarssl takes between 3 and 4 times as much space as wireguard:

  12 KB  kmod-tun_4.4.14-1_mips_34kc.ipk
  33 KB  liblzo_2.09-1_mips_34kc.ipk
 141 KB  libpolarssl_1.3.16-2_mips_34kc.ipk
 138 KB  openvpn-polarssl_2.3.11-2_mips_34kc.ipk
 323 KB  total

Of course, the openssl variant for openvpn is really much bigger:

  12 KB  kmod-tun_4.4.14-1_mips_34kc.ipk
  33 KB  liblzo_2.09-1_mips_34kc.ipk
 719 KB  libopenssl_1.0.2h-1_mips_34kc.ipk
 141 KB  openvpn-openssl_2.3.11-2_mips_34kc.ipk
 904 KB  total

Here is the size for tinc (only available with openssl):

  12 KB  kmod-tun_4.4.14-1_mips_34kc.ipk
  33 KB  liblzo_2.09-1_mips_34kc.ipk
 719 KB  libopenssl_1.0.2h-1_mips_34kc.ipk
  60 KB  tinc_1.0.28-1_mips_34kc.ipk
 823 KB  total


So, now, the remaining question is: what is the performance of wireguard
on such small devices?

> If you are running a recent snapshot version of Lede, this should be
> enough if you have a compatible kernel:
> 
>   opkg install wireguard-tools kmod-wireguard
> 
> If you want build it yourself, you need this patch for proper dependency
> handling, it has been included in Lede two days ago:
> 
>   https://git.lede-project.org/?p=source.git;a=commit;h=1d15a96b29dcd0947690951a7c36aead79a27129
> 
> One final note: there is no "multi-threaded" support for now, sorry Jason.
> So, if you run this on your super modern 128-cores router, don't expect
> exceptional performance :)  Well, you could always hack your kernel config
> to enable CONFIG_PADATA and CONFIG_SMP before building wireguard.
> 
> Other than that, feedback on the packages is welcome!
> 
> Baptiste



> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> http://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]