This project is a C implementation of the WireGuard® protocol intended to be used with the lwIP IP stack
There is a desire to use secure communication in smaller embedded devices to communicate with off-premises devices; WireGuard® seems perfect for this task due to its small code base and secure nature
This project tackles the problem of using WireGuard® on embedded systems in that it is:
The code is split into four main portions
The supplied cryptographic routines are written entirely in C and are not optimised for any particular platform. These work and use little memory but will probably be slow on your platform.
You probably want to swap out the suplied versions for optimised C or assembly versions or those available throught the O/S or crypto libraries on your platform. Simply edit the crypto.h header file to point at the routines you want to use.
The crypto routines supplied are:
You will need to implement a platform file that provides four functions
(note error checking omitted)
#include "wireguardif.h"
static struct netif wg_netif_struct = {0};
static struct netif *wg_netif = NULL;
static uint8_t wireguard_peer_index = WIREGUARDIF_INVALID_INDEX;
static void wireguard_setup() {
struct wireguard_interface wg;
struct wireguardif_peer peer;
ip_addr_t ipaddr = IPADDR4_INIT_BYTES(192, 168, 40, 10);
ip_addr_t netmask = IPADDR4_INIT_BYTES(255, 255, 255, 0);
ip_addr_t gateway = IPADDR4_INIT_BYTES(192, 168, 40, 1);
// Setup the WireGuard device structure
wg.private_key = "8BU1giso23adjCk93dnpLJnK788bRAtpZxs8d+Jo+Vg=";
wg.listen_port = 51820;
wg.bind_netif = NULL;
// Register the new WireGuard network interface with lwIP
wg_netif = netif_add(&wg_netif_struct, &ipaddr, &netmask, &gateway, &wg, &wireguardif_init, &ip_input);
// Mark the interface as administratively up, link up flag is set automatically when peer connects
netif_set_up(wg_netif);
// Initialise the first WireGuard peer structure
wireguardif_peer_init(&peer);
peer.public_key = "cDfetaDFWnbxts2Pbz4vFYreikPEEVhTlV/sniIEBjo=";
peer.preshared_key = NULL;
// Allow all IPs through tunnel
peer.allowed_ip = IPADDR4_INIT_BYTES(0, 0, 0, 0);
peer.allowed_mask = IPADDR4_INIT_BYTES(0, 0, 0, 0);
// If we know the endpoint's address can add here
peer.endpoint_ip = IPADDR4_INIT_BYTES(10, 0, 0, 12);
peer.endport_port = 12345;
// Register the new WireGuard peer with the netwok interface
wireguardif_add_peer(wg_netif, &peer, &wireguard_peer_index);
if ((wireguard_peer_index != WIREGUARDIF_INVALID_INDEX) && !ip_addr_isany(&peer.endpoint_ip)) {
// Start outbound connection to peer
wireguardif_connect(wg_net, wireguard_peer_index);
}
}
WireGuard® was created and developed by Jason A. Donenfeld. "WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld. See https://www.wireguard.com/ for more information
This project is not approved, sponsored or affiliated with WireGuard or with the community.
The code is copyrighted under BSD 3 clause Copyright (c) 2021 Daniel Hope (www.floorsense.nz)
See LICENSE for details
Daniel Hope at Smartalock