Wireguard VPN support

[jukkar]

This is initial Wireguard VPN support. Part of the implementation is ported from wireguard-lwip project.
Some discussion about this can be found in #63722

Some of the commits in this PR might be sent separately to review.

[jukkar]

• Updated to latest main
• Fixed compilation issues
• Added VPN support to echo-client and http-server sample applications

[jukkar]

• Documentation added
• VPN statistics support added

[jukkar]

• manifest update for net-tools
• allowed ip address list fixes
• shell print allowed ips and endpoint
• more statistics collection

[zephyrbot]

The following west manifest projects have changed revision in this Pull Request:

Name	Old Revision	New Revision	Diff

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

[jukkar]

• housekeeping timer works now
• keepalive timer is working and can be set from application

[jukkar]

• updated to latest main
• fixed Zephyr initiated handshake issues
• CI fixes

[jukkar]

• Fixing merge conflicts, no other changes

[ceolin]

@ceolin couple of notes

• As there was no PSA support for some of these algorithms, I thought that isolating the implementations to Wireguard lib would avoid any possible issues for people using these for other parts of the code. That is why they were placed to the directory they are in this PR.

Yes, that was indeed good. Most of these algorithms are already available in the PSA / mbedTLS, the only one I saw that is definitely not there is blake2s. So why having duplicated functionality ?

• As the implementations of these algorithms are several years old and seems to be used in other projects too, I would think they are more or less working properly. Probably they work better than any other fresh re-implementation.

Not necessarily, specially in cryptography. Some of these implementation state that they should not be used in production that they have alpha quality, which is very problematic at least.

• Could security team provide implementations for the missing features, as the security team has probably the best knowledge of this domain?

For sure, we started conversation with mbedTLS / PSA folks regarding missing algorithm. Obviously since this involves another project the timeline can vary. Can we change it to use PSA for what is available and work together in a temporary solution for the missing bits ? We can't simply import another cryptography implementation to Zephyr that is not properly maintained.

[jukkar]

Most of these algorithms are already available in the PSA / mbedTLS, the only one I saw that is definitely not there is blake2s. So why having duplicated functionality ?

I did not want to have part of the code use PSA/mbedTLS and some part use the internal implementation. But I could consider porting the code to use the PSA and leave the blake implementation as is if that would be acceptable.

[jukkar]

Hi, as it might take some time before PSA has support for Wireguard needed crypto, I created an external module for the Wireguard support. This way people can try it more easily and give feedback to make it work better. The module can be found here https://github.com/jukkar/zephyr-wireguard. The module contain a demo of the usage and configuration with native_sim board. Note that you would need Zephyr version (4.1.99+), specifically from commit 8e90817 ("net: shell: iface: Print VPN public key") or later to use it.

[github-actions]

This pull request has been marked as stale because it has been open (more than) 60 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this pull request will automatically be closed in 14 days. Note, that you can always re-open a closed pull request at any time.