master
1/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR MIT */
2/*
3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 *
5 * Documentation
6 * =============
7 *
8 * The below enums and macros are for interfacing with WireGuard, using generic
9 * netlink, with family WG_GENL_NAME and version WG_GENL_VERSION. It defines two
10 * methods: get and set. Note that while they share many common attributes,
11 * these two functions actually accept a slightly different set of inputs and
12 * outputs.
13 *
14 * WG_CMD_GET_DEVICE
15 * -----------------
16 *
17 * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command should contain
18 * one but not both of:
19 *
20 * WGDEVICE_A_IFINDEX: NLA_U32
21 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
22 *
23 * The kernel will then return several messages (NLM_F_MULTI) containing the
24 * following tree of nested items:
25 *
26 * WGDEVICE_A_IFINDEX: NLA_U32
27 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
28 * WGDEVICE_A_PRIVATE_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
29 * WGDEVICE_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
30 * WGDEVICE_A_LISTEN_PORT: NLA_U16
31 * WGDEVICE_A_FWMARK: NLA_U32
32 * WGDEVICE_A_PEERS: NLA_NESTED
33 * 0: NLA_NESTED
34 * WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
35 * WGPEER_A_PRESHARED_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
36 * WGPEER_A_ENDPOINT: NLA_MIN_LEN(struct sockaddr), struct sockaddr_in or struct sockaddr_in6
37 * WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16
38 * WGPEER_A_LAST_HANDSHAKE_TIME: NLA_EXACT_LEN, struct __kernel_timespec
39 * WGPEER_A_RX_BYTES: NLA_U64
40 * WGPEER_A_TX_BYTES: NLA_U64
41 * WGPEER_A_ALLOWEDIPS: NLA_NESTED
42 * 0: NLA_NESTED
43 * WGALLOWEDIP_A_FAMILY: NLA_U16
44 * WGALLOWEDIP_A_IPADDR: NLA_MIN_LEN(struct in_addr), struct in_addr or struct in6_addr
45 * WGALLOWEDIP_A_CIDR_MASK: NLA_U8
46 * 0: NLA_NESTED
47 * ...
48 * 0: NLA_NESTED
49 * ...
50 * ...
51 * WGPEER_A_PROTOCOL_VERSION: NLA_U32
52 * 0: NLA_NESTED
53 * ...
54 * ...
55 *
56 * It is possible that all of the allowed IPs of a single peer will not
57 * fit within a single netlink message. In that case, the same peer will
58 * be written in the following message, except it will only contain
59 * WGPEER_A_PUBLIC_KEY and WGPEER_A_ALLOWEDIPS. This may occur several
60 * times in a row for the same peer. It is then up to the receiver to
61 * coalesce adjacent peers. Likewise, it is possible that all peers will
62 * not fit within a single message. So, subsequent peers will be sent
63 * in following messages, except those will only contain WGDEVICE_A_IFNAME
64 * and WGDEVICE_A_PEERS. It is then up to the receiver to coalesce these
65 * messages to form the complete list of peers.
66 *
67 * Since this is an NLA_F_DUMP command, the final message will always be
68 * NLMSG_DONE, even if an error occurs. However, this NLMSG_DONE message
69 * contains an integer error code. It is either zero or a negative error
70 * code corresponding to the errno.
71 *
72 * WG_CMD_SET_DEVICE
73 * -----------------
74 *
75 * May only be called via NLM_F_REQUEST. The command should contain the
76 * following tree of nested items, containing one but not both of
77 * WGDEVICE_A_IFINDEX and WGDEVICE_A_IFNAME:
78 *
79 * WGDEVICE_A_IFINDEX: NLA_U32
80 * WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
81 * WGDEVICE_A_FLAGS: NLA_U32, 0 or WGDEVICE_F_REPLACE_PEERS if all current
82 * peers should be removed prior to adding the list below.
83 * WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN, all zeros to remove
84 * WGDEVICE_A_LISTEN_PORT: NLA_U16, 0 to choose randomly
85 * WGDEVICE_A_FWMARK: NLA_U32, 0 to disable
86 * WGDEVICE_A_PEERS: NLA_NESTED
87 * 0: NLA_NESTED
88 * WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
89 * WGPEER_A_FLAGS: NLA_U32, 0 and/or WGPEER_F_REMOVE_ME if the
90 * specified peer should not exist at the end of the
91 * operation, rather than added/updated and/or
92 * WGPEER_F_REPLACE_ALLOWEDIPS if all current allowed
93 * IPs of this peer should be removed prior to adding
94 * the list below and/or WGPEER_F_UPDATE_ONLY if the
95 * peer should only be set if it already exists.
96 * WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN, all zeros to remove
97 * WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
98 * WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16, 0 to disable
99 * WGPEER_A_ALLOWEDIPS: NLA_NESTED
100 * 0: NLA_NESTED
101 * WGALLOWEDIP_A_FAMILY: NLA_U16
102 * WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
103 * WGALLOWEDIP_A_CIDR_MASK: NLA_U8
104 * WGALLOWEDIP_A_FLAGS: NLA_U32, WGALLOWEDIP_F_REMOVE_ME if
105 * the specified IP should be removed;
106 * otherwise, this IP will be added if
107 * it is not already present.
108 * 0: NLA_NESTED
109 * ...
110 * 0: NLA_NESTED
111 * ...
112 * ...
113 * WGPEER_A_PROTOCOL_VERSION: NLA_U32, should not be set or used at
114 * all by most users of this API, as the
115 * most recent protocol will be used when
116 * this is unset. Otherwise, must be set
117 * to 1.
118 * 0: NLA_NESTED
119 * ...
120 * ...
121 *
122 * It is possible that the amount of configuration data exceeds that of
123 * the maximum message length accepted by the kernel. In that case, several
124 * messages should be sent one after another, with each successive one
125 * filling in information not contained in the prior. Note that if
126 * WGDEVICE_F_REPLACE_PEERS is specified in the first message, it probably
127 * should not be specified in fragments that come after, so that the list
128 * of peers is only cleared the first time but appended after. Likewise for
129 * peers, if WGPEER_F_REPLACE_ALLOWEDIPS is specified in the first message
130 * of a peer, it likely should not be specified in subsequent fragments.
131 *
132 * If an error occurs, NLMSG_ERROR will reply containing an errno.
133 */
134
135#ifndef _WG_UAPI_WIREGUARD_H
136#define _WG_UAPI_WIREGUARD_H
137
138#define WG_GENL_NAME "wireguard"
139#define WG_GENL_VERSION 1
140
141#define WG_KEY_LEN 32
142
143enum wg_cmd {
144 WG_CMD_GET_DEVICE,
145 WG_CMD_SET_DEVICE,
146 __WG_CMD_MAX
147};
148#define WG_CMD_MAX (__WG_CMD_MAX - 1)
149
150enum wgdevice_flag {
151 WGDEVICE_F_REPLACE_PEERS = 1U << 0,
152 __WGDEVICE_F_ALL = WGDEVICE_F_REPLACE_PEERS
153};
154enum wgdevice_attribute {
155 WGDEVICE_A_UNSPEC,
156 WGDEVICE_A_IFINDEX,
157 WGDEVICE_A_IFNAME,
158 WGDEVICE_A_PRIVATE_KEY,
159 WGDEVICE_A_PUBLIC_KEY,
160 WGDEVICE_A_FLAGS,
161 WGDEVICE_A_LISTEN_PORT,
162 WGDEVICE_A_FWMARK,
163 WGDEVICE_A_PEERS,
164 __WGDEVICE_A_LAST
165};
166#define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)
167
168enum wgpeer_flag {
169 WGPEER_F_REMOVE_ME = 1U << 0,
170 WGPEER_F_REPLACE_ALLOWEDIPS = 1U << 1,
171 WGPEER_F_UPDATE_ONLY = 1U << 2,
172 __WGPEER_F_ALL = WGPEER_F_REMOVE_ME | WGPEER_F_REPLACE_ALLOWEDIPS |
173 WGPEER_F_UPDATE_ONLY
174};
175enum wgpeer_attribute {
176 WGPEER_A_UNSPEC,
177 WGPEER_A_PUBLIC_KEY,
178 WGPEER_A_PRESHARED_KEY,
179 WGPEER_A_FLAGS,
180 WGPEER_A_ENDPOINT,
181 WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
182 WGPEER_A_LAST_HANDSHAKE_TIME,
183 WGPEER_A_RX_BYTES,
184 WGPEER_A_TX_BYTES,
185 WGPEER_A_ALLOWEDIPS,
186 WGPEER_A_PROTOCOL_VERSION,
187 __WGPEER_A_LAST
188};
189#define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
190
191enum wgallowedip_flag {
192 WGALLOWEDIP_F_REMOVE_ME = 1U << 0,
193 __WGALLOWEDIP_F_ALL = WGALLOWEDIP_F_REMOVE_ME
194};
195enum wgallowedip_attribute {
196 WGALLOWEDIP_A_UNSPEC,
197 WGALLOWEDIP_A_FAMILY,
198 WGALLOWEDIP_A_IPADDR,
199 WGALLOWEDIP_A_CIDR_MASK,
200 WGALLOWEDIP_A_FLAGS,
201 __WGALLOWEDIP_A_LAST
202};
203#define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)
204
205#endif /* _WG_UAPI_WIREGUARD_H */