Wireguard Support through WSL Kernel

[rg9400]

Is your feature request related to a problem? Please describe.
Wireguard support is limited in WSL because the kernel does not have Connmark support, even though the newest versions of the kernel that WSL 2 is now using should be compatible with WG.

Describe the solution you'd like
The flag CONFIG_NETFILTER_XT_MATCH_CONNMARK should be enabled when building the kernel. No other change should be needed

Describe alternatives you've considered
Using a custom kernel, but that seems overkill for basic support that native distros have.

[Trolldemorted]

Any idea if we could convice microsoft to solve this issue in the near future? Would testing the flag and creating a PR speed things up?

[rg9400]

I am already using a custom kernel with the flag enabled - https://github.com/nathanchance/WSL2-Linux-Kernel

There is no issue in enabling this flag, someone just needs to get this to Microsoft's notice because I doubt they even saw this issue.

[Trolldemorted]

Did you try to create a PR at https://github.com/microsoft/WSL2-Linux-Kernel/ ?

[rg9400]

No I am unsure of how to do so. I was going to leave it to someone else. I assume it's as easy as enabling the flag, but not sure the contributing guidelines and stuff. Would appreciate if you did it if you feel comfortable making that change

[sarim]

WSL2-Linux-Kernel repo does not accept pull requests. Feature requests are supposed to be in this repo.

For future me and googlers, I changed these configs to make wireguard work @ d489414

5c5
< CONFIG_CC_VERSION_TEXT="x86_64-msft-linux-gcc (GCC) 9.3.0"
---
> CONFIG_CC_VERSION_TEXT="gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0"
10a11,12
> CONFIG_CC_CAN_LINK=y
> CONFIG_CC_CAN_LINK_STATIC=y
747d748
< # CONFIG_GCC_PLUGINS is not set
1071c1072
< # CONFIG_NETFILTER_XT_CONNMARK is not set
---
> CONFIG_NETFILTER_XT_CONNMARK=y
1113c1114
< # CONFIG_NETFILTER_XT_MATCH_CONNMARK is not set
---
> CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
3210a3212
> CONFIG_CRYPTO_ECC=y
3212c3214
< # CONFIG_CRYPTO_ECRDSA is not set
---
> CONFIG_CRYPTO_ECRDSA=y
3284c3286
< # CONFIG_CRYPTO_STREEBOG is not set
---
> CONFIG_CRYPTO_STREEBOG=y

[rg9400]

This is pending for over a year and seems to be a pretty low effort fix. Any way to get some visibility to the WSL maintainers to at least hear their thoughts on enabling these flags?

[rg9400]

Ben Hillis (@benhillis) apologies for the ping, but was trying to get this low-effort feature request to your attention since it had been pending without any official comment for a while. Would greatly appreciate any insight you may have on if this change can be made in a future kernel update. Thanks!

[rg9400]

Blue (@OneBlue) apologies for the ping, but this request to enable proper Wireguard support in WSL through enabling a simple flag when building the kernel has been open for 2 years without any official comment. Seems like a low effort fix with lots of utility, and I noticed a similar update you just released which involved a minor update to improve compatibility #10671. If this is not as straightforward, we would appreciate some guidance from the official devs on why

[lbux]

I can't seem to be able to find the flags anymore. Were they renamed or are they hidden in some menu that I need to expand? I can compile with them added manually to the .config file, but then WSL2 does not load. I'm an absolute beginner when it comes to anything to do with kernels, but it seems ridiculous that I've had to spend hours trying to do odd workarounds just to unsuccessfully get wireguard support.

Edit: Finally ended up fixing it. I just stripped it down to

CONFIG_NETFILTER_XT_MATCH_CONNMARK=y

CONFIG_NETFILTER_XT_CONNMARK=y

which was the bare minimum I needed and it worked. The configs dont seem to be present using make menuconfig so I took Microsoft's wsl-config in the /Microsoft folder and set the flags to y in order for it to work.

[leavyli]

In my case, the error “/dev/fd/63:5:68-81: Error: Could not process rule: No such file or directory” occurred. Additional settings for CONFIG_NFT_FIB_IPV{4,6} are required. Reference link: https://gitlab.com/postmarketOS/pmaports/-/merge_requests/2357

[soredake]

Kelsey Steele (@kelsey-steele) Hi! I've seen that you've fixed #8302, can you look at this issue too, please?