[thirdparty/systemd.git] / src / shared / wireguard-netlink.h

#pragma once

/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR MIT)
 *
 * Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 *
 * Documentation
 * =============
 *
 * The below enums and macros are for interfacing with WireGuard, using generic
 * netlink, with family WG_GENL_NAME and version WG_GENL_VERSION. It defines two
 * methods: get and set. Note that while they share many common attributes, these
 * two functions actually accept a slightly different set of inputs and outputs.
 *
 * WG_CMD_GET_DEVICE
 * -----------------
 *
 * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command should contain
 * one but not both of:
 *
 *	WGDEVICE_A_IFINDEX: NLA_U32
 *	WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
 *
 * The kernel will then return several messages (NLM_F_MULTI) containing the following
 * tree of nested items:
 *
 *	WGDEVICE_A_IFINDEX: NLA_U32
 *	WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
 *	WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN
 *	WGDEVICE_A_PUBLIC_KEY: len WG_KEY_LEN
 *	WGDEVICE_A_LISTEN_PORT: NLA_U16
 *	WGDEVICE_A_FWMARK: NLA_U32
 *	WGDEVICE_A_PEERS: NLA_NESTED
 *		0: NLA_NESTED
 *			WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
 *			WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN
 *			WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
 *			WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16
 *			WGPEER_A_LAST_HANDSHAKE_TIME: struct timespec
 *			WGPEER_A_RX_BYTES: NLA_U64
 *			WGPEER_A_TX_BYTES: NLA_U64
 *			WGPEER_A_ALLOWEDIPS: NLA_NESTED
 *				0: NLA_NESTED
 *					WGALLOWEDIP_A_FAMILY: NLA_U16
 *					WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
 *					WGALLOWEDIP_A_CIDR_MASK: NLA_U8
 *				1: NLA_NESTED
 *					...
 *				2: NLA_NESTED
 *					...
 *				...
 *		1: NLA_NESTED
 *			...
 *		...
 *
 * It is possible that all of the allowed IPs of a single peer will not
 * fit within a single netlink message. In that case, the same peer will
 * be written in the following message, except it will only contain
 * WGPEER_A_PUBLIC_KEY and WGPEER_A_ALLOWEDIPS. This may occur several
 * times in a row for the same peer. It is then up to the receiver to
 * coalesce adjacent peers. Likewise, it is possible that all peers will
 * not fit within a single message. So, subsequent peers will be sent
 * in following messages, except those will only contain WGDEVICE_A_IFNAME
 * and WGDEVICE_A_PEERS. It is then up to the receiver to coalesce these
 * messages to form the complete list of peers.
 *
 * Since this is an NLA_F_DUMP command, the final message will always be
 * NLMSG_DONE, even if an error occurs. However, this NLMSG_DONE message
 * contains an integer error code. It is either zero or a negative error
 * code corresponding to the errno.
 *
 * WG_CMD_SET_DEVICE
 * -----------------
 *
 * May only be called via NLM_F_REQUEST. The command should contain the following
 * tree of nested items, containing one but not both of WGDEVICE_A_IFINDEX
 * and WGDEVICE_A_IFNAME:
 *
 *	WGDEVICE_A_IFINDEX: NLA_U32
 *	WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
 *	WGDEVICE_A_FLAGS: NLA_U32, 0 or WGDEVICE_F_REPLACE_PEERS if all current
 *			  peers should be removed prior to adding the list below.
 *	WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN, all zeros to remove
 *	WGDEVICE_A_LISTEN_PORT: NLA_U16, 0 to choose randomly
 *	WGDEVICE_A_FWMARK: NLA_U32, 0 to disable
 *	WGDEVICE_A_PEERS: NLA_NESTED
 *		0: NLA_NESTED
 *			WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
 *			WGPEER_A_FLAGS: NLA_U32, 0 and/or WGPEER_F_REMOVE_ME if the specified peer
 *					should be removed rather than added/updated and/or
 *					WGPEER_F_REPLACE_ALLOWEDIPS if all current allowed IPs of
 *					this peer should be removed prior to adding the list below.
 *			WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN, all zeros to remove
 *			WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
 *			WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16, 0 to disable
 *			WGPEER_A_ALLOWEDIPS: NLA_NESTED
 *				0: NLA_NESTED
 *					WGALLOWEDIP_A_FAMILY: NLA_U16
 *					WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
 *					WGALLOWEDIP_A_CIDR_MASK: NLA_U8
 *				1: NLA_NESTED
 *					...
 *				2: NLA_NESTED
 *					...
 *				...
 *		1: NLA_NESTED
 *			...
 *		...
 *
 * It is possible that the amount of configuration data exceeds that of
 * the maximum message length accepted by the kernel. In that case,
 * several messages should be sent one after another, with each
 * successive one filling in information not contained in the prior. Note
 * that if WGDEVICE_F_REPLACE_PEERS is specified in the first message, it
 * probably should not be specified in fragments that come after, so that
 * the list of peers is only cleared the first time but appened after.
 * Likewise for peers, if WGPEER_F_REPLACE_ALLOWEDIPS is specified in the
 * first message of a peer, it likely should not be specified in subsequent
 * fragments.
 *
 * If an error occurs, NLMSG_ERROR will reply containing an errno.
 */

#define WG_GENL_NAME "wireguard"
#define WG_GENL_VERSION 1

#define WG_KEY_LEN 32

enum wg_cmd {
        WG_CMD_GET_DEVICE,
        WG_CMD_SET_DEVICE,
        __WG_CMD_MAX
};
#define WG_CMD_MAX (__WG_CMD_MAX - 1)

enum wgdevice_flag {
 WGDEVICE_F_REPLACE_PEERS = 1U << 0
};
enum wgdevice_attribute {
        WGDEVICE_A_UNSPEC,
        WGDEVICE_A_IFINDEX,
        WGDEVICE_A_IFNAME,
        WGDEVICE_A_PRIVATE_KEY,
        WGDEVICE_A_PUBLIC_KEY,
        WGDEVICE_A_FLAGS,
        WGDEVICE_A_LISTEN_PORT,
        WGDEVICE_A_FWMARK,
        WGDEVICE_A_PEERS,
        __WGDEVICE_A_LAST
};
#define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)

enum wgpeer_flag {
        WGPEER_F_REMOVE_ME = 1U << 0,
        WGPEER_F_REPLACE_ALLOWEDIPS = 1U << 1
};
enum wgpeer_attribute {
        WGPEER_A_UNSPEC,
        WGPEER_A_PUBLIC_KEY,
        WGPEER_A_PRESHARED_KEY,
        WGPEER_A_FLAGS,
        WGPEER_A_ENDPOINT,
        WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
        WGPEER_A_LAST_HANDSHAKE_TIME,
        WGPEER_A_RX_BYTES,
        WGPEER_A_TX_BYTES,
        WGPEER_A_ALLOWEDIPS,
        __WGPEER_A_LAST
};
#define WGPEER_A_MAX (__WGPEER_A_LAST - 1)

enum wgallowedip_attribute {
        WGALLOWEDIP_A_UNSPEC,
        WGALLOWEDIP_A_FAMILY,
        WGALLOWEDIP_A_IPADDR,
        WGALLOWEDIP_A_CIDR_MASK,
        __WGALLOWEDIP_A_LAST
};
#define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)
Commit	Line	Data
e5719363 JT	1	#pragma once
	2
	3	/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR MIT)
	4	*
	5	* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
	6	*
	7	* Documentation
	8	* =============
	9	*
	10	* The below enums and macros are for interfacing with WireGuard, using generic
	11	* netlink, with family WG_GENL_NAME and version WG_GENL_VERSION. It defines two
	12	* methods: get and set. Note that while they share many common attributes, these
	13	* two functions actually accept a slightly different set of inputs and outputs.
	14	*
	15	* WG_CMD_GET_DEVICE
	16	* -----------------
	17	*
	18	* May only be called via NLM_F_REQUEST \| NLM_F_DUMP. The command should contain
	19	* one but not both of:
	20	*
	21	* WGDEVICE_A_IFINDEX: NLA_U32
	22	* WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
	23	*
	24	* The kernel will then return several messages (NLM_F_MULTI) containing the following
	25	* tree of nested items:
	26	*
	27	* WGDEVICE_A_IFINDEX: NLA_U32
	28	* WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
	29	* WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN
	30	* WGDEVICE_A_PUBLIC_KEY: len WG_KEY_LEN
	31	* WGDEVICE_A_LISTEN_PORT: NLA_U16
	32	* WGDEVICE_A_FWMARK: NLA_U32
	33	* WGDEVICE_A_PEERS: NLA_NESTED
	34	* 0: NLA_NESTED
	35	* WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
	36	* WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN
	37	* WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
	38	* WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16
	39	* WGPEER_A_LAST_HANDSHAKE_TIME: struct timespec
	40	* WGPEER_A_RX_BYTES: NLA_U64
	41	* WGPEER_A_TX_BYTES: NLA_U64
	42	* WGPEER_A_ALLOWEDIPS: NLA_NESTED
	43	* 0: NLA_NESTED
	44	* WGALLOWEDIP_A_FAMILY: NLA_U16
	45	* WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
	46	* WGALLOWEDIP_A_CIDR_MASK: NLA_U8
	47	* 1: NLA_NESTED
	48	* ...
	49	* 2: NLA_NESTED
	50	* ...
	51	* ...
	52	* 1: NLA_NESTED
	53	* ...
	54	* ...
	55	*
	56	* It is possible that all of the allowed IPs of a single peer will not
	57	* fit within a single netlink message. In that case, the same peer will
	58	* be written in the following message, except it will only contain
	59	* WGPEER_A_PUBLIC_KEY and WGPEER_A_ALLOWEDIPS. This may occur several
	60	* times in a row for the same peer. It is then up to the receiver to
	61	* coalesce adjacent peers. Likewise, it is possible that all peers will
	62	* not fit within a single message. So, subsequent peers will be sent
	63	* in following messages, except those will only contain WGDEVICE_A_IFNAME
	64	* and WGDEVICE_A_PEERS. It is then up to the receiver to coalesce these
65	* messages to form the complete list of peers.
66	*
67	* Since this is an NLA_F_DUMP command, the final message will always be
68	* NLMSG_DONE, even if an error occurs. However, this NLMSG_DONE message
69	* contains an integer error code. It is either zero or a negative error
70	* code corresponding to the errno.
71	*
72	* WG_CMD_SET_DEVICE
73	* -----------------
74	*
75	* May only be called via NLM_F_REQUEST. The command should contain the following
76	* tree of nested items, containing one but not both of WGDEVICE_A_IFINDEX
77	* and WGDEVICE_A_IFNAME:
78	*
79	* WGDEVICE_A_IFINDEX: NLA_U32
80	* WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
81	* WGDEVICE_A_FLAGS: NLA_U32, 0 or WGDEVICE_F_REPLACE_PEERS if all current
82	* peers should be removed prior to adding the list below.
83	* WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN, all zeros to remove
84	* WGDEVICE_A_LISTEN_PORT: NLA_U16, 0 to choose randomly
85	* WGDEVICE_A_FWMARK: NLA_U32, 0 to disable
86	* WGDEVICE_A_PEERS: NLA_NESTED
87	* 0: NLA_NESTED
88	* WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
89	* WGPEER_A_FLAGS: NLA_U32, 0 and/or WGPEER_F_REMOVE_ME if the specified peer
90	* should be removed rather than added/updated and/or
91	* WGPEER_F_REPLACE_ALLOWEDIPS if all current allowed IPs of
92	* this peer should be removed prior to adding the list below.
93	* WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN, all zeros to remove
94	* WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
95	* WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16, 0 to disable
96	* WGPEER_A_ALLOWEDIPS: NLA_NESTED
97	* 0: NLA_NESTED
98	* WGALLOWEDIP_A_FAMILY: NLA_U16
99	* WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
100	* WGALLOWEDIP_A_CIDR_MASK: NLA_U8
101	* 1: NLA_NESTED
102	* ...
103	* 2: NLA_NESTED
104	* ...
105	* ...
106	* 1: NLA_NESTED
107	* ...
108	* ...
109	*
110	* It is possible that the amount of configuration data exceeds that of
111	* the maximum message length accepted by the kernel. In that case,
112	* several messages should be sent one after another, with each
113	* successive one filling in information not contained in the prior. Note
114	* that if WGDEVICE_F_REPLACE_PEERS is specified in the first message, it
115	* probably should not be specified in fragments that come after, so that
116	* the list of peers is only cleared the first time but appened after.
117	* Likewise for peers, if WGPEER_F_REPLACE_ALLOWEDIPS is specified in the
118	* first message of a peer, it likely should not be specified in subsequent
119	* fragments.
120	*
121	* If an error occurs, NLMSG_ERROR will reply containing an errno.
122	*/
123
124	#define WG_GENL_NAME "wireguard"
125	#define WG_GENL_VERSION 1
126
127	#define WG_KEY_LEN 32
128
129	enum wg_cmd {
130	WG_CMD_GET_DEVICE,
131	WG_CMD_SET_DEVICE,
132	__WG_CMD_MAX
133	};
134	#define WG_CMD_MAX (__WG_CMD_MAX - 1)
135
136	enum wgdevice_flag {
137	WGDEVICE_F_REPLACE_PEERS = 1U << 0
138	};
139	enum wgdevice_attribute {
140	WGDEVICE_A_UNSPEC,
141	WGDEVICE_A_IFINDEX,
142	WGDEVICE_A_IFNAME,
143	WGDEVICE_A_PRIVATE_KEY,
144	WGDEVICE_A_PUBLIC_KEY,
145	WGDEVICE_A_FLAGS,
146	WGDEVICE_A_LISTEN_PORT,
147	WGDEVICE_A_FWMARK,
148	WGDEVICE_A_PEERS,
149	__WGDEVICE_A_LAST
150	};
151	#define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)
152
153	enum wgpeer_flag {
154	WGPEER_F_REMOVE_ME = 1U << 0,
155	WGPEER_F_REPLACE_ALLOWEDIPS = 1U << 1
156	};
157	enum wgpeer_attribute {
158	WGPEER_A_UNSPEC,
159	WGPEER_A_PUBLIC_KEY,
160	WGPEER_A_PRESHARED_KEY,
161	WGPEER_A_FLAGS,
162	WGPEER_A_ENDPOINT,
163	WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
164	WGPEER_A_LAST_HANDSHAKE_TIME,
165	WGPEER_A_RX_BYTES,
166	WGPEER_A_TX_BYTES,
167	WGPEER_A_ALLOWEDIPS,
168	__WGPEER_A_LAST
169	};
170	#define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
171
172	enum wgallowedip_attribute {
173	WGALLOWEDIP_A_UNSPEC,
174	WGALLOWEDIP_A_FAMILY,
175	WGALLOWEDIP_A_IPADDR,
176	WGALLOWEDIP_A_CIDR_MASK,
177	__WGALLOWEDIP_A_LAST
178	};
179	#define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)