3 /* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR MIT)
5 * Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
10 * The below enums and macros are for interfacing with WireGuard, using generic
11 * netlink, with family WG_GENL_NAME and version WG_GENL_VERSION. It defines two
12 * methods: get and set. Note that while they share many common attributes, these
13 * two functions actually accept a slightly different set of inputs and outputs.
18 * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command should contain
19 * one but not both of:
21 * WGDEVICE_A_IFINDEX: NLA_U32
22 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
24 * The kernel will then return several messages (NLM_F_MULTI) containing the following
25 * tree of nested items:
27 * WGDEVICE_A_IFINDEX: NLA_U32
28 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
29 * WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN
30 * WGDEVICE_A_PUBLIC_KEY: len WG_KEY_LEN
31 * WGDEVICE_A_LISTEN_PORT: NLA_U16
32 * WGDEVICE_A_FWMARK: NLA_U32
33 * WGDEVICE_A_PEERS: NLA_NESTED
35 * WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
36 * WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN
37 * WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
38 * WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16
39 * WGPEER_A_LAST_HANDSHAKE_TIME: struct timespec
40 * WGPEER_A_RX_BYTES: NLA_U64
41 * WGPEER_A_TX_BYTES: NLA_U64
42 * WGPEER_A_ALLOWEDIPS: NLA_NESTED
44 * WGALLOWEDIP_A_FAMILY: NLA_U16
45 * WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
46 * WGALLOWEDIP_A_CIDR_MASK: NLA_U8
56 * It is possible that all of the allowed IPs of a single peer will not
57 * fit within a single netlink message. In that case, the same peer will
58 * be written in the following message, except it will only contain
59 * WGPEER_A_PUBLIC_KEY and WGPEER_A_ALLOWEDIPS. This may occur several
60 * times in a row for the same peer. It is then up to the receiver to
61 * coalesce adjacent peers. Likewise, it is possible that all peers will
62 * not fit within a single message. So, subsequent peers will be sent
63 * in following messages, except those will only contain WGDEVICE_A_IFNAME
64 * and WGDEVICE_A_PEERS. It is then up to the receiver to coalesce these
65 * messages to form the complete list of peers.
67 * Since this is an NLA_F_DUMP command, the final message will always be
68 * NLMSG_DONE, even if an error occurs. However, this NLMSG_DONE message
69 * contains an integer error code. It is either zero or a negative error
70 * code corresponding to the errno.
75 * May only be called via NLM_F_REQUEST. The command should contain the following
76 * tree of nested items, containing one but not both of WGDEVICE_A_IFINDEX
77 * and WGDEVICE_A_IFNAME:
79 * WGDEVICE_A_IFINDEX: NLA_U32
80 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
81 * WGDEVICE_A_FLAGS: NLA_U32, 0 or WGDEVICE_F_REPLACE_PEERS if all current
82 * peers should be removed prior to adding the list below.
83 * WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN, all zeros to remove
84 * WGDEVICE_A_LISTEN_PORT: NLA_U16, 0 to choose randomly
85 * WGDEVICE_A_FWMARK: NLA_U32, 0 to disable
86 * WGDEVICE_A_PEERS: NLA_NESTED
88 * WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
89 * WGPEER_A_FLAGS: NLA_U32, 0 and/or WGPEER_F_REMOVE_ME if the specified peer
90 * should be removed rather than added/updated and/or
91 * WGPEER_F_REPLACE_ALLOWEDIPS if all current allowed IPs of
92 * this peer should be removed prior to adding the list below.
93 * WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN, all zeros to remove
94 * WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
95 * WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16, 0 to disable
96 * WGPEER_A_ALLOWEDIPS: NLA_NESTED
98 * WGALLOWEDIP_A_FAMILY: NLA_U16
99 * WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
100 * WGALLOWEDIP_A_CIDR_MASK: NLA_U8
110 * It is possible that the amount of configuration data exceeds that of
111 * the maximum message length accepted by the kernel. In that case,
112 * several messages should be sent one after another, with each
113 * successive one filling in information not contained in the prior. Note
114 * that if WGDEVICE_F_REPLACE_PEERS is specified in the first message, it
115 * probably should not be specified in fragments that come after, so that
116 * the list of peers is only cleared the first time but appened after.
117 * Likewise for peers, if WGPEER_F_REPLACE_ALLOWEDIPS is specified in the
118 * first message of a peer, it likely should not be specified in subsequent
121 * If an error occurs, NLMSG_ERROR will reply containing an errno.
124 #define WG_GENL_NAME "wireguard"
125 #define WG_GENL_VERSION 1
127 #define WG_KEY_LEN 32
134 #define WG_CMD_MAX (__WG_CMD_MAX - 1)
137 WGDEVICE_F_REPLACE_PEERS
= 1U << 0
139 enum wgdevice_attribute
{
143 WGDEVICE_A_PRIVATE_KEY
,
144 WGDEVICE_A_PUBLIC_KEY
,
146 WGDEVICE_A_LISTEN_PORT
,
151 #define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)
154 WGPEER_F_REMOVE_ME
= 1U << 0,
155 WGPEER_F_REPLACE_ALLOWEDIPS
= 1U << 1
157 enum wgpeer_attribute
{
160 WGPEER_A_PRESHARED_KEY
,
163 WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL
,
164 WGPEER_A_LAST_HANDSHAKE_TIME
,
170 #define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
172 enum wgallowedip_attribute
{
173 WGALLOWEDIP_A_UNSPEC
,
174 WGALLOWEDIP_A_FAMILY
,
175 WGALLOWEDIP_A_IPADDR
,
176 WGALLOWEDIP_A_CIDR_MASK
,
179 #define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)