System and method for supporting wireguard devices in port sharing and IP binding

Abstract

The present application relates to the technical field of computer network security and network communications, and to a system and method for supporting WireGuard devices in port sharing and IP binding, the method specifically comprising: S1, a WireGuard driver providing a Netlink interface for a management tool or application to configure an IP address and SO_REUSEPORT; creating a UDP Socket according to a configured monitoring port, configuring unique identifiers WNI for WireGuard devices, and mutually associating the multiple WireGuard devices with the UDP Socket; a sender sending an encrypted and encapsulated packet to a peer end via the UDP socket; and, upon receiving the packet from the UDP Socket, a receiver acquiring a WireGuard device from the UDP Socket, and delivering to the WireGuard device the packet to be decapsulated and decrypted. The present application solves problems in the prior art that ports are wasted and are prone to conflict with other applications or services.

Description

A system and method supporting port sharing and IP binding of WireGuard devices

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 202311712699X, filed on December 13, 2023, entitled “A system and method supporting port sharing and IP binding of WireGuard devices,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present invention relates to the fields of computer network security and network communication technology, and is a system and method for supporting port sharing and IP binding of WireGuard devices. Background Art

[0004] WireGuard is a modern, high-performance, and secure VPN protocol. Compared to traditional VPN protocols such as OpenVPN and IPsec, WireGuard offers the following advantages: High Performance: WireGuard utilizes the latest encryption algorithms and a more lightweight protocol design, resulting in higher performance and lower latency. This allows WireGuard to excel on high-speed networks and low-power devices. Security: WireGuard utilizes cutting-edge encryption algorithms (such as ChaCha20, Poly1305, and Curve25519), along with multiple security measures (such as integrity checks and key rotation) to ensure the security and reliability of VPN connections. Furthermore, the WireGuard protocol's simple design avoids many security vulnerabilities. Ease of Use: WireGuard's simple design and minimal implementation code make it easy to deploy and maintain. WireGuard also provides a set of easy-to-use command-line tools and APIs, making it easy to create and manage VPN connections. Cross-Platform Support: WireGuard supports multiple operating systems, including Linux, Windows, macOS, iOS, and Android, and can run on a wide variety of devices, including embedded devices, routers, and servers.

[0005] Among the existing disclosed invention technologies, the patent with application publication number CN114285697A discloses a multi-network single-entry VPN system based on WireGuard and OpenVPN. The system is as follows: users access the system through a single entry through OpenVPN, and create tunnels at the third layer of the network through Wireguard to connect different networks. User traffic is transmitted to the VPN gateway through the tun0 network interface of OpenVPN through the SSL secure tunnel, and data packets are filtered and forwarded to the network interface of Wireguard through nftables. Data is sent to the destination network through the tunnel, and enterprise-level users are authenticated and access rights are controlled through the Lightweight Directory Access Protocol LDAP protocol.

[0006] For example, the patent application publication number CN115225493A discloses a configuration generation of networking nodes based on Wireguard. The UI platform in the Wireguard network responds to the maintenance personnel's operation of updating the topology structure of the networking nodes in the Wireguard network in the operation interface to obtain the change result and carry the change result to initiate a change request to the central control server; the central control server calls the target configuration generation strategy corresponding to the change type and determines at least one target networking node in the Wireguard network associated with the change result, and generates the latest Wireguard configuration information and sends it to at least one target networking node respectively, so that each of the target networking nodes updates its own Wireguard configuration information according to the latest Wireguard configuration information.

[0007] The WireGuard protocol in the above patent is an end-to-end connection implemented through the UDP protocol. A WireGuard device will create two UDP sockets (IPv4 and IPv6). The listening port of the UDP socket can be specified, or the kernel can randomly select an available port. The listening address (IP address) is an arbitrary address (i.e., an all-0 address, 0.0.0.0 for IPv4 and :: for IPv6), which has the problems described in the background technology. Summary of the Invention

[0008] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract and title of this application to avoid obscuring the purpose of this section, the abstract and the title of the invention, and such simplifications or omissions should not be used to limit the scope of the present invention.

[0009] The current WireGuard protocol implements an end-to-end connection via the UDP protocol. A WireGuard device creates two UDP sockets (IPv4 and IPv6). The listening port for the UDP socket can be specified, or the kernel can randomly select an available port. The listening address (IP address) is an arbitrary address (i.e., an all-zero address, 0.0.0.0 for IPv4 and :: for IPv6). This leads to two problems:

[0010] 1. As more WireGuard devices are created on a server, they occupy more and more UDP ports. Since the maximum number of available UDP ports is 65535, this limits the number of WireGuard devices that can be created on a server to 65535 (not considering network namespace scenarios). Furthermore, since each WireGuard device requires its own UDP port, UDP ports must be managed carefully to avoid conflicts that could cause devices to malfunction, increasing management complexity. Furthermore, having too many ports can make security policies difficult to set, requiring specific configuration for each port.

[0011] 2. WireGuard devices listen on arbitrary addresses and do not enable port reuse (SO_REUSEPORT). Therefore, other applications cannot listen on the ports monitored by the WireGuard device. For example, if the WireGuard device is configured to listen on port 12345, other applications cannot listen on UDP port 12345 on any IP address. This affects the availability of other applications or services.

[0012] The technical problems to be solved by the present invention are the following three problems in the prior art:

[0013] 1. Support port sharing of WireGuard devices. Multiple WireGuard devices share the same listening port, that is, support multiple WireGuard devices to create only two UDP sockets (IPv4 and IPv6), saving ports.

[0014] 2. Support IP binding of WireGuard devices, that is, support WireGuard devices to monitor a specific IP address in addition to any address, such as 127.0.0.1 (IPv4) and 2001::1 (IPv6), etc., to avoid conflicts with other applications or services.

[0015] 3. Support SO_REUSEPORT (port reuse) on UDP sockets created by WireGuard devices. This allows WireGuard devices and other applications / services to listen on the same port at the same time when both have SO_REUSEPORT enabled, with one listening on any address and the other listening on a specific IP address. For example, WireGuard listens on 127.0.0.1:12345 and the gateway service listens on 0.0.0.0:12345.

[0016] To achieve the above objectives, the present invention provides a method for supporting port sharing and IP binding of WireGuard devices, comprising the following steps:

[0017] S1: The WireGuard driver provides a Netlink interface for management tools or applications to configure IP addresses and SO_REUSEPORT;

[0018] S2: Create a UDP socket based on the configured listening port, configure a unique identifier (WNI) for the WireGuard device, and associate multiple WireGuard devices with the UDP socket.

[0019] S3: The sender sends the encrypted and encapsulated message to the peer end through the UDP socket;

[0020] S4: When the receiver receives the message on the UDP socket, it obtains the WirigGuard device from the UDP socket and delivers the message to the WirigGuard device for decapsulation and decryption.

[0021] Specifically, in S1, the IP address includes: specific IPv4 and IPv6 listening addresses, combined with port sharing, to support multiple WireGuard devices using the same UDP socket.

[0022] Specifically, S1 includes the following specific steps:

[0023] S11: Perform uniqueness confirmation to ensure that the WNI of the WireGuard device with the same IP address is unique.

[0024] S12: Use the configured IP address when creating a UDP socket through the WireGuard driver;

[0025] S13: Determine the device status. The WireGuard driver provides a Netlink interface to the management tool or application to configure the WireGuard device to determine whether SO_REUSEPORT is enabled.

[0026] Specifically, in S13, the device status is DOWN.

[0027] Specifically, in S13, determining whether SO_REUSEPORT is enabled includes: when the WireGuard driver creates a UDP socket, determining the enabling status of SO_REUSEPORT; if the status is enabled, calling the setsockop interface to set SO_REUSEPORT.

[0028] Specifically, in S2, the UDP socket can be bound to specific IPv4 and IPv6 addresses.

[0029] Specifically, in S2, the unique identifier of the WireGuard device includes: WireGuard Network Identifier (WNI), wherein the configuration steps of the WNI are as follows:

[0030] S21: Add a structure, wg_sock, pointing to a UDP socket, and a hash table, where the hash table contains WireGuard devices sharing the same port (socket); (called wg_device);

[0031] S22: Use wg_sock as a bridge to make wg_device and sock point to wg_sock;

[0032] S23: Find the device through the socket or find the socket through the device to achieve the mutual association of multiple WireGuard devices and UDP sockets.

[0033] Specifically, in S3, the sender includes: encapsulating the WNI in the header of the WireGuard message, and using the lower 16 bits of the Reserved field of the WireGuard protocol header to carry the WNI.

[0034] Specifically, the receiver includes: parsing the lower 16 bits of the Reserved field in the WireGuard protocol header, obtaining the WNI, and then obtaining the corresponding WireGuard device according to the WNI.

[0035] In addition, the present invention provides a system that supports port sharing and IP binding of WireGuard devices, including the following modules:

[0036] Configuration module, association module, message sending module, message receiving module;

[0037] The configuration module is driven by WireGuard to provide a Netlink interface to the management tool or application to configure the IP address and SO_REUSEPORT;

[0038] The association module creates a UDP socket according to the configured listening port, configures a unique identifier WNI for the WireGuard device, and associates multiple WireGuard devices and UDP sockets with each other;

[0039] The message sending module is used by the sender to send the encrypted and encapsulated message to the other end through the UDP socket;

[0040] The message receiving module is used for the receiver to obtain the WirigGuard device from the UDP socket when the UDP socket receives the message, and deliver the message to the WirigGuard device for decapsulation and decryption processing.

[0041] Compared with the prior art, the technical effects of the present invention are as follows:

[0042] 1. This invention supports multiple WireGuard devices using the same listening port, which can save a large number of UDP ports, avoid the situation where other applications or services have no ports available, and reduce the complexity of management. On the other hand, it also reduces the complexity of port opening security policy configuration.

[0043] 2. The present invention supports binding WireGuard devices to specific IP addresses, thereby preventing other applications or services from being unable to monitor the same port on a specific IP address due to the WireGuard device being bound to an arbitrary address.

[0044] 3. The present invention 3. supports setting the SO_REUSEPORT (port reuse) attribute of the WireGuard device, which allows the WireGuard device and other applications or services to monitor the same port, and one of them uses an arbitrary address and the other uses a specific address to meet business needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without any creative work.

[0046] FIG1 is a flow chart of a method for supporting port sharing and IP binding of WireGuard devices according to the present invention;

[0047] FIG2 is a schematic diagram of the first 4 bytes of a WireGuard protocol message header according to the present invention;

[0048] FIG3 is a schematic diagram of the relationship between a socket and a WireGuard device according to the present invention;

[0049] FIG4 is a schematic diagram of a system structure supporting port sharing and IP binding of WireGuard devices according to the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0051] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0052] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0053] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0054] Example 1:

[0055] As shown in FIG1 , a method for supporting port sharing and IP binding of WireGuard devices according to an embodiment of the present invention includes the following specific steps:

[0056] S1: The WireGuard driver provides a Netlink interface for management tools or applications to configure IP addresses and SO_REUSEPORT;

[0057] In S1, the IP address includes: specific IPv4 and IPv6 listening addresses, combined with port sharing, to support multiple WireGuard devices using the same UDP socket.

[0058] S1 includes the following specific steps:

[0059] S11: Perform uniqueness confirmation to ensure that the WNI of the WireGuard device with the same IP address is unique.

[0060] S12: Use the configured IP address when creating a UDP socket through the WireGuard driver;

[0061] S13: Determine the device status. The WireGuard driver provides a Netlink interface to the management tool or application to configure the WireGuard device to determine whether SO_REUSEPORT is enabled.

[0062] Wherein, in S13, the device state is DOWN state;

[0063] In S13, determining whether SO_REUSEPORT is enabled includes: when the WireGuard driver creates a UDP socket, determining the enabling state of SO_REUSEPORT, and if the state is enabled, calling the setsockop interface to set SO_REUSEPORT.

[0064] S2: Create a UDP socket based on the configured listening port, configure a unique identifier (WNI) for the WireGuard device, and associate multiple WireGuard devices with the UDP socket.

[0065] Among them, in S2, the UDP socket can be bound to specific IPv4 and IPv6 addresses.

[0066] In S2, the unique identifier of the WireGuard device includes: WireGuard Network Identifier (WNI), wherein the configuration steps of the WNI are as follows:

[0067] S21: Add a structure, wg_sock, pointing to a UDP socket, and a hash table, where the hash table contains WireGuard devices sharing the same port (socket); (called wg_device);

[0068] S22: Use wg_sock as a bridge to make wg_device and sock point to wg_sock;

[0069] S23: Find the device through the socket or find the socket through the device to achieve the mutual association of multiple WireGuard devices and UDP sockets.

[0070] S3: The sender sends the encrypted and encapsulated message to the peer end through the UDP socket;

[0071] As shown in FIG4 , in S3 , the sender includes: encapsulating the WNI in the header of the WireGuard message, and using the lower 16 bits of the Reserved field of the WireGuard protocol header to carry the WNI.

[0072] S4: When the receiver receives the message on the UDP socket, it obtains the WirigGuard device from the UDP socket and delivers the message to the WirigGuard device for decapsulation and decryption.

[0073] The receiver includes: parsing the lower 16 bits of the Reserved field in the WireGuard protocol header, obtaining the WNI, and then obtaining the corresponding WireGuard device according to the WNI.

[0074] Example 2:

[0075] As shown in Figures 2, 3, and 4, a system supporting port sharing and IP binding of WireGuard devices according to an embodiment of the present invention includes:

[0076] The following is a specific embodiment of the present invention, which is applied in a security acceleration scenario (such as zero trust combined with CDN acceleration), and is described using FIG4 as an example diagram:

[0077] 1. This embodiment supports multi-tenancy. Tenants are distinguished by WNI. Different tenants have different WNI configurations for their WireGuard interfaces. For example, Tenant 1 has WNI 1 and Tenant 2 has WNI 2. This allows multiple tenants to access the same port, such as port 6666 in the figure. Tenants can be placed in the NetworkNamespace.

[0078] 2. Edge nodes may be connected to multiple back-to-origin nodes. This means that different back-to-origin nodes will be selected for tenants based on the link and the back-to-origin node's quality of service. Furthermore, there may be acceleration nodes (also known as relay nodes) between edge nodes and back-to-origin nodes.

[0079] 3. Each tenant on the edge node creates multiple WireGuard interfaces (the number of which is related to the number of back-to-source nodes). For example, with two back-to-source nodes, three WireGuard interfaces are created (e.g., wg1-0, wg1-1, and wg1-2 for tenant 1). One interface serves as client access, and all tenants are configured with the same listening port (e.g., 6666). The other two interfaces serve as interconnections with the back-to-source nodes, and different interfaces are configured with different listening ports (e.g., 8888 and 9999). This way, the number of UDP ports required is independent of the number of tenants, significantly reducing the number of ports.

[0080] 4. The back-to-source node is similar to the edge node. WNI is used to distinguish tenants. Different tenants use the same UDP port to communicate with the edge node.

[0081] 5. Taking tenant 1 as an example, the complete user access process is described as follows:

[0082] (1) The client initiates a request. When the client encapsulates the WireGuard message, it carries a WNI of 1 and a UDP destination port of 6666.

[0083] (2) The message arrives at the edge node, is processed by the kernel protocol stack, and is then processed by the UDP socket with port number 6666. The WNI is parsed as 1, and the message is searched for wg1-0 according to the WNI (see Figure 2). Therefore, it is delivered to wg1-0 for processing. The WireGuard driver performs decapsulation and decryption of the message, and then continues to deliver it to the kernel protocol stack for processing. The application (such as a security gateway or CDN gateway) performs security or data related processing, and then routes it to the corresponding WireGuard interface for forwarding based on the selected back-to-source node, such as the wg1-1 interface.

[0084] (3) After the message is routed to the wg1-1 interface, the wg1-1 interface will encrypt and encapsulate the message, where WNI is set to 1, the outer UDP destination port is 8888, and the UDP socket with port 8888 is used to send the message back to the source node.

[0085] (4) After the source node receives the message, it is also first processed by the UDP socket with port 8888. After parsing the WNI, it finds the WireGuard interface based on the WNI and delivers it to the corresponding interface for processing. The WireGuard driver then decrypts and encapsulates the message and delivers it to the kernel protocol stack for further processing. Finally, the application collects the data and resends it to the source station for processing.

[0086] (5) The response message from the source station also passes through the back-to-source node, then the edge node, and finally reaches the client.

[0087] 6. As needed, you can configure the listening address for the WireGuard interface. If you use the same socket, you need to configure the same listening address. You can also enable SO_REUSEPORT (port reuse).

[0088] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0089] It should be understood that determining B based on A does not mean determining B based solely on A. B can also be determined based on A and / or other information.

[0090] The above embodiments can be implemented in whole or in part through software, hardware, firmware, or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the processes or functions according to the embodiments of the present invention are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired network or / and a wireless network. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0091] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0092] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0093] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only one type. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0094] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0095] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0096] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0097] In summary, compared with the prior art, the technical effects of the present invention are as follows:

[0098] 1. This invention supports multiple WireGuard devices using the same listening port, which can save a large number of UDP ports, avoid the situation where other applications or services have no ports available, and reduce the complexity of management. On the other hand, it also reduces the complexity of port opening security policy configuration.

[0099] 2. The present invention supports binding WireGuard devices to specific IP addresses, thereby preventing other applications or services from being unable to monitor the same port on a specific IP address due to the WireGuard device being bound to an arbitrary address.

[0100] 3. The present invention 3. supports setting the SO_REUSEPORT (port reuse) attribute of the WireGuard device, which allows the WireGuard device and other applications or services to monitor the same port, and one of them uses an arbitrary address and the other uses a specific address to meet business needs.

[0101] The basic principles, main features, and advantages of the present invention are shown and described above. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions are merely illustrative of the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed in the present invention is defined by the appended claims and their equivalents.

[0102] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0103] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for supporting port sharing and IP binding for WireGuard devices, characterized by: The method comprises the following specific steps: S1: The WireGuard driver provides a Netlink interface for management tools or applications to configure IP addresses and SO_REUSEPORT; S2: Create a UDP socket based on the configured listening port, configure a unique identifier (WNI) for the WireGuard device, and associate multiple WireGuard devices with the UDP socket. S3: The sender sends the encrypted and encapsulated message to the peer end through the UDP socket; S4: When the receiver receives the message on the UDP socket, it obtains the WirigGuard device from the UDP socket and delivers the message to the WirigGuard device for decapsulation and decryption.

2. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: In S1, the IP address includes: specific IPv4 and IPv6 listening addresses, shared in combination with the port.

3. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: S1 includes the following specific steps: S11: Perform uniqueness confirmation to ensure that the WNI of the WireGuard device with the same IP address is unique. S12: Use the configured IP address when creating a UDP socket through the WireGuard driver; S13: Determine the device status. The WireGuard driver provides a Netlink interface to the management tool or application to configure the WireGuard device to determine whether SO_REUSEPORT is enabled.

4. A method for supporting port sharing and IP binding of WireGuard devices according to claim 3, characterized in that: In S13, the device status is DOWN.

5. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: In S13, determining whether SO_REUSEPORT is enabled includes: when the WireGuard driver creates a UDP socket, determining the enabling state of SO_REUSEPORT, and if the state is enabled, calling the setsockop interface to set SO_REUSEPORT.

6. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: In S2, the UDP socket can be bound to specific IPv4 and IPv6 addresses.

7. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: In S2, the unique identifier of the WireGuard device includes: WireGuard Network Identifier (WNI), wherein the configuration steps of the WNI are as follows: S21: Add a structure, wg_sock pointing to a UDP socket, and a hash table, where the hash table contains WireGuard devices that share the same port. S22: Use wg_sock as a bridge to make wg_device and sock point to wg_sock; S23: Find the device through the socket or find the socket through the device to achieve the mutual association of multiple WireGuard devices and UDP sockets.

8. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: In S3, the sender includes: encapsulating the WNI in the header of the WireGuard message, and using the lower 16 bits of the Reserved field of the WireGuard protocol header to carry the WNI.

9. A method for supporting port sharing and IP binding of WireGuard devices according to claim 1, characterized in that: The receiver includes: parsing the lower 16 bits of the Reserved field in the WireGuard protocol header, obtaining the WNI, and then obtaining the corresponding WireGuard device according to the WNI.

10. A system supporting port sharing and IP binding of WireGuard devices, which is implemented based on a method for supporting port sharing and IP binding of WireGuard devices as claimed in any one of claims 1 to 9, characterized in that: The system includes the following modules: Configuration module, association module, message sending module, message receiving module; The configuration module is driven by WireGuard to provide a Netlink interface to the management tool or application to configure the IP address and SO_REUSEPORT; The association module creates a UDP socket according to the configured listening port, configures a unique identifier WNI for the WireGuard device, and associates multiple WireGuard devices and UDP sockets with each other; The message sending module is used by the sender to send the encrypted and encapsulated message to the other end through the UDP socket; The message receiving module is used for the receiver to obtain the WirigGuard device from the UDP socket when the UDP socket receives the message, and deliver the message to the WirigGuard device for decapsulation and decryption processing.

Images