Things That Might Be Accomplished

There are various things that need to be done. Below is an non-comprehensive list of interesting projects in no particular order. Some don't really matter at all; others are critically important. If you're interested in working on any of these, please write an email to the WireGuard development team.

Lock-free Multi-producer Multi-consumer Queue / Ring Buffer

Currently the queueing code uses ptr_ring.h, which is a ring buffer that uses spinlocks. This does not scale well to tons of CPUs. It would be useful to replace this with a lock-free data structure that can be both read and written from multiple CPUs at once.

CPU Auto-scaling

In the current multicore algorithm, all CPUs are started for packet processing. However, it would be more efficient to scale these up and scale these down, depending on load, dynamically. This would need to take into account NUMA.

Packet Locality

While WireGuard does multicore encryption, maintaining some sort of packet-cpu locality would be useful.

Generic Receive Offload

struct udp_tunnel_sock_cfg has two members that we don't currently use -- gro_receive and gro_complete. Wiring these up to get groups of packets and then adjusting receive.c to iterate through NULL-terminated packet lists like send.c would deliver significant performance benefits.

Trie Endianness

The trie in routingtable.c currently stores IPs in big endian form and indexes into it byte-by-byte. It would be more efficient to store this in the CPUs native word size.

Resizable Hashtables

Rather than using a few large hashtables as we currently do in hashtables.c, it would be useful to port to struct rhashtable or something similar so that hashtables can dynamically resize.

Per-peer PMTU

Use path-MTU to use the optimal splitting per-peer endpoint, instead of having a single MTU per-interface.

Testing Infrastructure

The test infrastructure works great, but it could use more tests to examine more code paths. Separately, some tests that explore packets per second, latency, and buffer bloat issues would be quite handy.

QEMU Infrastructure

Currently the QEMU makefile builds for the native system, either Aarch64 or x86(_64). It would be extremely useful to be able to cross compile and also build a cross compilation toolchain.

Onion Routing

Related to the above, determine a strategy for routing WireGuard packets inside the same WireGuard device.

Android App

The Android application has been started but has quite a bit of work to do.

Integration into Network Managers

Integrate WireGuard's Netlink API -- uapi/wireguard.h -- into various network management tools, such as systemd-networkd, NetworkManager, and so forth.

Integration into Routing Daemons

Routing daemons need to be extended to take into account WireGuard's notion of AllowedIPs. It is somewhat important to have this be a separate notion, because it forces such daemons to consider the implications of changing routes based on differing trust models.

Mesh Networking Tools

It is possible to build a mesh network out of WireGuard using WireGuard as the building block. Write a tool that builds meshes and has peers discover each other, taking into account important authentication and trust properties.

Timer Documentation

Better document the WireGuard state machine and required logic to obtain maximal security properties and interoperability. This task will require a complete understanding of the WireGuard paper, the Noise protocol, and the kernel C codebase.

Performance Improvements

There are many low-hanging fruits. Take your pick from the basket.

There needs to be a way of marking an struct sk_buff as "zero on free", so that we can securely zero out key information after passing it to userspace. This will involve patching the upstream kernel.

fq_codel Integration

In order to combat buffer bloat, WireGuard could benefit from integrating the fq_codel algorithm and kernel-library, for managing packet queues and parallelism. There is much related work in the kernel to base this on; in particular, many wireless drivers take the same technique using the same library.

Dynamic Queue Limits

Closely related to the above, struct dql could be used for controlling queue lengths, rather than hard coding sane values.

Exponential Backoff and Dynamic Timers

The timer state machine could benefit from being dynamic, in order to deal with extremely high latency networks, such as between Earth and the Moon. This project is likely too big to undertake at the present moment, but will be curious for investigating in the future.

Crypto API Integration

WireGuard currently uses its own crypto primitives. Moving to the Crypto API will require some work, both to WireGuard and more so to the kernel's crypto API.

Routing Table Improvements

The not_oif patch would be extremely helpful to complete. Here is the initial LKML thread. Implementation should be straightforward and indeed would be quite helpful. Pair not_oif with a setsockopt SO_NOTIF and this would solve all sorts of general Linux networking issues.

Accelerated Primitives

Add more accelerated primitives for crypto functions on new platforms or improve existing ones.

Lock Auditing

Does WireGuard make correct use of locking contexts? Are there any races?

Buffer Auditing

Are functions such as skb_prepare_header correct?

IPv6 Flowinfo, TTL, etc

Figure out what to do with IPv6 Flowinfo, TTL, and other interesting header fields.

Error Counters

A simple unsigned long for each error event, accessible to userspace, would be a useful aid for debugging.

Unaligned Accesses and Cache Lines

Audit the entire send and receive path to squelch any remaining unaligned accesses or accesses that cross cache lines.

Userspace Implementations

Work on the userspace implementation in Go, Rust, or another safe language, and obtain full compatibility with the WireGuard module. At the moment the Go implementation is furthest along, but could use some development.


The WireGuard project needs guides, howtos, in depth explanations, expanded man pages, blog posts, and every other type of guide for users, novice and expert alike.

Code Formatting

Due to various pathologies, the WireGuard codebase has very long lines. Clean things up in order to fit the Linux Kernel style guidelines. This task will be left until the final stages before submitting to mainline and not before.