d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wg.4: Add some enhancements

Browse Source 
- add a SPDX-License-Identifier
- rename the title of the man page
- use better grammar in some places
- reword 'IPs' to 'IP addresses'
- add a missing word in the AUTHORS section
- use '.An -nosplit' in the AUTHORS section
- Xr ipsec and ovpn

Reviewed by:	pauamma, mhorne
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D37205
This commit is contained in:
Gordon Bergling 2022-10-30 13:59:37 +01:00
parent 514df63539
commit 19c03f4ab0
1 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
share/man/man4/wg.4
View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: BSD-2-Clause-FreeBSD
.\"
.\" Copyright (c) 2020 Gordon Bergling <gbe@FreeBSD.org> .\" Copyright (c) 2020 Gordon Bergling <gbe@FreeBSD.org>
.\" .\"
.\" Redistribution and use in source and binary forms, with or without .\" Redistribution and use in source and binary forms, with or without
@ -23,12 +25,12 @@
.\" .\"
.\" $FreeBSD$ .\" $FreeBSD$
.\" .\"
.Dd October 28, 2022 .Dd October 30, 2022
.Dt WG 4 .Dt WG 4
.Os .Os
.Sh NAME .Sh NAME
.Nm wg .Nm wg
.Nd "WireGuard - pseudo-device" .Nd "WireGuard protocol driver"
.Sh SYNOPSIS .Sh SYNOPSIS
To load the driver as a module at boot time, place the following line in To load the driver as a module at boot time, place the following line in
.Xr loader.conf 5 : .Xr loader.conf 5 :
@ -44,7 +46,7 @@ protocol.
.Pp .Pp
A A
.Nm .Nm
interface recognises one or more peers, establishes a secure tunnel with interface recognizes one or more peers, establishes a secure tunnel with
each on demand, and tracks each peer's UDP endpoint for exchanging encrypted each on demand, and tracks each peer's UDP endpoint for exchanging encrypted
traffic with. traffic with.
.Pp .Pp
@ -72,17 +74,17 @@ interface with its own private key and with the public keys of its peers.
In addition to the public keys, each peer pair may be configured with a In addition to the public keys, each peer pair may be configured with a
unique pre-shared symmetric key. unique pre-shared symmetric key.
This is used in their handshake to guard against future compromise of the This is used in their handshake to guard against future compromise of the
peers' encrypted tunnel if a quantum-computational attack on their peers' encrypted tunnel if an attack on their
Diffie-Hellman exchange becomes feasible. Diffie-Hellman exchange becomes feasible.
It is optional, but recommended. It is optional, but recommended.
.It Allowed IPs .It Allowed IP addresses
A single A single
.Nm .Nm
interface may maintain concurrent tunnels connecting diverse networks. interface may maintain concurrent tunnels connecting diverse networks.
The interface therefore implements rudimentary routing and reverse-path The interface therefore implements rudimentary routing and reverse-path
filtering functions for its tunneled traffic. filtering functions for its tunneled traffic.
These functions reference a set of allowed IP ranges configured against These functions reference a set of allowed IP address ranges configured
each peer. against each peer.
.Pp .Pp
The interface will route outbound tunneled traffic to the peer configured The interface will route outbound tunneled traffic to the peer configured
with the most specific matching allowed IP address range, or drop it with the most specific matching allowed IP address range, or drop it
@ -95,11 +97,11 @@ That is, tunneled traffic routed to a given peer cannot return through
another peer of the same another peer of the same
.Nm .Nm
interface. interface.
This ensures that peers cannot spoof another's traffic. This ensures that peers cannot spoof one another's traffic.
.It Handshake .It Handshake
Two peers handshake to mutually authenticate each other and to Two peers handshake to mutually authenticate each other and to
establish a shared series of secret ephemeral encryption keys. establish a shared series of secret ephemeral encryption keys.
Any peer may initiate a handshake. Either peer may initiate a handshake.
Handshakes occur only when there is traffic to send, and recur every Handshakes occur only when there is traffic to send, and recur every
two minutes during transfers. two minutes during transfers.
.It Connectionless .It Connectionless
@ -181,7 +183,9 @@ is not assigned to the allowed IPs of Peer X.
.Sh SEE ALSO .Sh SEE ALSO
.Xr inet 4 , .Xr inet 4 ,
.Xr ip 4 , .Xr ip 4 ,
.Xr ipsec 4 ,
.Xr netintro 4 , .Xr netintro 4 ,
.Xr ovpn 4 ,
.Xr ipf 5 , .Xr ipf 5 ,
.Xr pf.conf 5 , .Xr pf.conf 5 ,
.Xr ifconfig 8 , .Xr ifconfig 8 ,
@ -197,9 +201,10 @@ The
device driver first appeared in device driver first appeared in
.Fx 14.0 . .Fx 14.0 .
.Sh AUTHORS .Sh AUTHORS
.An -nosplit
The The
.Nm .Nm
device driver written by device driver was written by
.An Jason A. Donenfeld Aq Mt Jason@zx2c4.com , .An Jason A. Donenfeld Aq Mt Jason@zx2c4.com ,
.An Matt Dunwoodie Aq Mt ncon@nconroy.net , .An Matt Dunwoodie Aq Mt ncon@nconroy.net ,
and and