{"id":13639324,"url":"https://github.com/smartalock/wireguard-lwip","last_synced_at":"2025-04-19T22:32:15.021Z","repository":{"id":41287358,"uuid":"330684585","full_name":"smartalock/wireguard-lwip","owner":"smartalock","description":"WireGuard Implementation for lwIP","archived":false,"fork":false,"pushed_at":"2022-11-14T10:58:25.000Z","size":100,"stargazers_count":190,"open_issues_count":8,"forks_count":27,"subscribers_count":19,"default_branch":"main","last_synced_at":"2024-08-03T01:14:28.577Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/smartalock.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-01-18T14:04:02.000Z","updated_at":"2024-07-27T14:25:34.000Z","dependencies_parsed_at":"2023-01-22T10:30:23.007Z","dependency_job_id":null,"html_url":"https://github.com/smartalock/wireguard-lwip","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smartalock%2Fwireguard-lwip","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smartalock%2Fwireguard-lwip/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smartalock%2Fwireguard-lwip/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/smartalock%2Fwireguard-lwip/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/smartalock","download_url":"https://codeload.github.com/smartalock/wireguard-lwip/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223810367,"owners_count":17206751,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:00:59.595Z","updated_at":"2024-11-09T09:30:51.096Z","avatar_url":"https://github.com/smartalock.png","language":"C","funding_links":[],"categories":["Projects"],"sub_categories":["Alternative Implementations"],"readme":"# WireGuard Implementation for lwIP\n\nThis project is a C implementation of the [WireGuard\u0026reg;](https://www.wireguard.com/) protocol intended to be used with the [lwIP IP stack](https://www.nongnu.org/lwip/)\n\n# Motivation\n\nThere is a desire to use secure communication in smaller embedded devices to communicate with off-premises devices; WireGuard\u0026reg; seems perfect for this task due to its small code base and secure nature\n\nThis project tackles the problem of using WireGuard\u0026reg; on embedded systems in that it is:\n- malloc-free so fits into a fixed RAM size\n- written entirely in C\n- has low memory requirements in terms of stack size, flash storage and RAM\n- compatible with the popular lwIP IP stack\n\n# Code Layout\n\nThe code is split into four main portions\n\n- wireguard.c contains the bulk of the WireGuard\u0026reg; protocol code and is not specific to any particular IP stack\n- wireguardif.c contains the lwIP integration code and makes a netif network interface and handles periodic tasks such as keepalive/expiration timers\n- wireguard-platform.h contains the definition of the four functions to be implemented per platform (a sample implementation is given in wireguard-platform.sample)\n- crypto code (see below)\n\n## Crypto Code\n\nThe supplied cryptographic routines are written entirely in C and are not optimised for any particular platform. These work and use little memory but will probably be slow on your platform.\n\nYou probably want to swap out the suplied versions for optimised C or assembly versions or those available throught the O/S or crypto libraries on your platform. Simply edit the crypto.h header file to point at the routines you want to use.\n\nThe crypto routines supplied are:\n- BLAKE2S - adapted from the implementation in the RFC itself at https://tools.ietf.org/html/rfc7693\n- CHACHA20 - adapted from code at https://cr.yp.to/streamciphers/timings/estreambench/submissions/salsa20/chacha8/ref/chacha.c\n- HCHACHA20 - implemented from scratch following description here https://tools.ietf.org/id/draft-arciszewski-xchacha-02.html\n- POLY1305 - taken from https://github.com/floodyberry/poly1305-donna\n- CHACHA20POLY1305 - implemented from scratch following description here https://tools.ietf.org/html/rfc7539\n- AEAD_XChaCha20_Poly1305 - implemented from scratch following description here https://tools.ietf.org/id/draft-arciszewski-xchacha-02.html\n- X25519 - taken from STROBE project at https://sourceforge.net/p/strobe, in addition there is a version optimised for Cortex-M0 processors which requires very little stack taken from https://munacl.cryptojedi.org/curve25519-cortexm0.shtml\n\n# Integrating into your platform\n\nYou will need to implement a platform file that provides four functions\n- a monotonic counter used for calculating time differences - e.g. sys_now() from lwIP\n- a tain64n timestamp function, although there are workarounds if you don't have access to a realtime clock\n- an indication of whether the system is currently under load and should generate cookie reply messages\n- a good random number generator\n\n# lwIP Code Example\n(note error checking omitted)\n\n    #include \"wireguardif.h\"\n    \n    static struct netif wg_netif_struct = {0};\n    static struct netif *wg_netif = NULL;\n    static uint8_t wireguard_peer_index = WIREGUARDIF_INVALID_INDEX;\n\n    static void wireguard_setup() {\n    \tstruct wireguard_interface wg;\n    \tstruct wireguardif_peer peer;\n    \tip_addr_t ipaddr = IPADDR4_INIT_BYTES(192, 168, 40, 10);\n    \tip_addr_t netmask = IPADDR4_INIT_BYTES(255, 255, 255, 0);\n    \tip_addr_t gateway = IPADDR4_INIT_BYTES(192, 168, 40, 1);\n\n    \t// Setup the WireGuard device structure\n    \twg.private_key = \"8BU1giso23adjCk93dnpLJnK788bRAtpZxs8d+Jo+Vg=\";\n    \twg.listen_port = 51820;\n    \twg.bind_netif = NULL;\n\n    \t// Register the new WireGuard network interface with lwIP\n    \twg_netif = netif_add(\u0026wg_netif_struct, \u0026ipaddr, \u0026netmask, \u0026gateway, \u0026wg, \u0026wireguardif_init, \u0026ip_input);\n\n    \t// Mark the interface as administratively up, link up flag is set automatically when peer connects\n    \tnetif_set_up(wg_netif);\n\n    \t// Initialise the first WireGuard peer structure\n    \twireguardif_peer_init(\u0026peer);\n    \tpeer.public_key = \"cDfetaDFWnbxts2Pbz4vFYreikPEEVhTlV/sniIEBjo=\";\n    \tpeer.preshared_key = NULL;\n    \t// Allow all IPs through tunnel\n    \tpeer.allowed_ip = IPADDR4_INIT_BYTES(0, 0, 0, 0);\n    \tpeer.allowed_mask = IPADDR4_INIT_BYTES(0, 0, 0, 0);\n\n    \t// If we know the endpoint's address can add here\n    \tpeer.endpoint_ip = IPADDR4_INIT_BYTES(10, 0, 0, 12);\n    \tpeer.endport_port = 12345;\n\n    \t// Register the new WireGuard peer with the netwok interface\n    \twireguardif_add_peer(wg_netif, \u0026peer, \u0026wireguard_peer_index);\n\n    \tif ((wireguard_peer_index != WIREGUARDIF_INVALID_INDEX) \u0026\u0026 !ip_addr_isany(\u0026peer.endpoint_ip)) {\n    \t\t// Start outbound connection to peer\n    \t\twireguardif_connect(wg_net, wireguard_peer_index);\n    \t}\n    }\n\n\n# More Information\n\nWireGuard\u0026reg; was created and developed by Jason A. Donenfeld. \"WireGuard\" and the \"WireGuard\" logo are registered trademarks of Jason A. Donenfeld. See https://www.wireguard.com/ for more information\n\nThis project is not approved, sponsored or affiliated with WireGuard or with the community.\n\n- The whitepaper https://www.wireguard.com/papers/wireguard.pdf\n- The Wikipedia page https://en.wikipedia.org/wiki/WireGuard \n\n# License\n\nThe code is copyrighted under BSD 3 clause Copyright (c) 2021 Daniel Hope (www.floorsense.nz)\n\nSee LICENSE for details\n\n# Contact\n\nDaniel Hope at Smartalock\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmartalock%2Fwireguard-lwip","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsmartalock%2Fwireguard-lwip","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsmartalock%2Fwireguard-lwip/lists"}