1 /* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR MIT */
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  *
5  * Documentation
6  * =============
7  *
8  * The below enums and macros are for interfacing with WireGuard, using generic
9  * netlink, with family WG_GENL_NAME and version WG_GENL_VERSION. It defines two
10  * methods: get and set. Note that while they share many common attributes,
11  * these two functions actually accept a slightly different set of inputs and
12  * outputs.
13  *
14  * WG_CMD_GET_DEVICE
15  * -----------------
16  *
17  * May only be called via NLM_F_REQUEST | NLM_F_DUMP. The command should contain
18  * one but not both of:
19  *
20  *    WGDEVICE_A_IFINDEX: NLA_U32
21  *    WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
22  *
23  * The kernel will then return several messages (NLM_F_MULTI) containing the
24  * following tree of nested items:
25  *
26  *    WGDEVICE_A_IFINDEX: NLA_U32
27  *    WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
28  *    WGDEVICE_A_PRIVATE_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
29  *    WGDEVICE_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
30  *    WGDEVICE_A_LISTEN_PORT: NLA_U16
31  *    WGDEVICE_A_FWMARK: NLA_U32
32  *    WGDEVICE_A_PEERS: NLA_NESTED
33  *        0: NLA_NESTED
34  *            WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
35  *            WGPEER_A_PRESHARED_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
36  *            WGPEER_A_ENDPOINT: NLA_MIN_LEN(struct sockaddr), struct sockaddr_in or struct sockaddr_in6
37  *            WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16
38  *            WGPEER_A_LAST_HANDSHAKE_TIME: NLA_EXACT_LEN, struct __kernel_timespec
39  *            WGPEER_A_RX_BYTES: NLA_U64
40  *            WGPEER_A_TX_BYTES: NLA_U64
41  *            WGPEER_A_ALLOWEDIPS: NLA_NESTED
42  *                0: NLA_NESTED
43  *                    WGALLOWEDIP_A_FAMILY: NLA_U16
44  *                    WGALLOWEDIP_A_IPADDR: NLA_MIN_LEN(struct in_addr), struct in_addr or struct in6_addr
45  *                    WGALLOWEDIP_A_CIDR_MASK: NLA_U8
46  *                0: NLA_NESTED
47  *                    ...
48  *                0: NLA_NESTED
49  *                    ...
50  *                ...
51  *            WGPEER_A_PROTOCOL_VERSION: NLA_U32
52  *        0: NLA_NESTED
53  *            ...
54  *        ...
55  *
56  * It is possible that all of the allowed IPs of a single peer will not
57  * fit within a single netlink message. In that case, the same peer will
58  * be written in the following message, except it will only contain
59  * WGPEER_A_PUBLIC_KEY and WGPEER_A_ALLOWEDIPS. This may occur several
60  * times in a row for the same peer. It is then up to the receiver to
61  * coalesce adjacent peers. Likewise, it is possible that all peers will
62  * not fit within a single message. So, subsequent peers will be sent
63  * in following messages, except those will only contain WGDEVICE_A_IFNAME
64  * and WGDEVICE_A_PEERS. It is then up to the receiver to coalesce these
65  * messages to form the complete list of peers.
66  *
67  * Since this is an NLA_F_DUMP command, the final message will always be
68  * NLMSG_DONE, even if an error occurs. However, this NLMSG_DONE message
69  * contains an integer error code. It is either zero or a negative error
70  * code corresponding to the errno.
71  *
72  * WG_CMD_SET_DEVICE
73  * -----------------
74  *
75  * May only be called via NLM_F_REQUEST. The command should contain the
76  * following tree of nested items, containing one but not both of
77  * WGDEVICE_A_IFINDEX and WGDEVICE_A_IFNAME:
78  *
79  *    WGDEVICE_A_IFINDEX: NLA_U32
80  *    WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMSIZ - 1
81  *    WGDEVICE_A_FLAGS: NLA_U32, 0 or WGDEVICE_F_REPLACE_PEERS if all current
82  *                      peers should be removed prior to adding the list below.
83  *    WGDEVICE_A_PRIVATE_KEY: len WG_KEY_LEN, all zeros to remove
84  *    WGDEVICE_A_LISTEN_PORT: NLA_U16, 0 to choose randomly
85  *    WGDEVICE_A_FWMARK: NLA_U32, 0 to disable
86  *    WGDEVICE_A_PEERS: NLA_NESTED
87  *        0: NLA_NESTED
88  *            WGPEER_A_PUBLIC_KEY: len WG_KEY_LEN
89  *            WGPEER_A_FLAGS: NLA_U32, 0 and/or WGPEER_F_REMOVE_ME if the
90  *                            specified peer should not exist at the end of the
91  *                            operation, rather than added/updated and/or
92  *                            WGPEER_F_REPLACE_ALLOWEDIPS if all current allowed
93  *                            IPs of this peer should be removed prior to adding
94  *                            the list below and/or WGPEER_F_UPDATE_ONLY if the
95  *                            peer should only be set if it already exists.
96  *            WGPEER_A_PRESHARED_KEY: len WG_KEY_LEN, all zeros to remove
97  *            WGPEER_A_ENDPOINT: struct sockaddr_in or struct sockaddr_in6
98  *            WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL: NLA_U16, 0 to disable
99  *            WGPEER_A_ALLOWEDIPS: NLA_NESTED
100  *                0: NLA_NESTED
101  *                    WGALLOWEDIP_A_FAMILY: NLA_U16
102  *                    WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
103  *                    WGALLOWEDIP_A_CIDR_MASK: NLA_U8
104  *                0: NLA_NESTED
105  *                    ...
106  *                0: NLA_NESTED
107  *                    ...
108  *                ...
109  *            WGPEER_A_PROTOCOL_VERSION: NLA_U32, should not be set or used at
110  *                                       all by most users of this API, as the
111  *                                       most recent protocol will be used when
112  *                                       this is unset. Otherwise, must be set
113  *                                       to 1.
114  *        0: NLA_NESTED
115  *            ...
116  *        ...
117  *
118  * It is possible that the amount of configuration data exceeds that of
119  * the maximum message length accepted by the kernel. In that case, several
120  * messages should be sent one after another, with each successive one
121  * filling in information not contained in the prior. Note that if
122  * WGDEVICE_F_REPLACE_PEERS is specified in the first message, it probably
123  * should not be specified in fragments that come after, so that the list
124  * of peers is only cleared the first time but appended after. Likewise for
125  * peers, if WGPEER_F_REPLACE_ALLOWEDIPS is specified in the first message
126  * of a peer, it likely should not be specified in subsequent fragments.
127  *
128  * If an error occurs, NLMSG_ERROR will reply containing an errno.
129  */
130 
131 #ifndef _WG_UAPI_WIREGUARD_H
132 #define _WG_UAPI_WIREGUARD_H
133 
134 #define WG_GENL_NAME "wireguard"
135 #define WG_GENL_VERSION 1
136 
137 #define WG_KEY_LEN 32
138 
139 enum wg_cmd {
140 	WG_CMD_GET_DEVICE,
141 	WG_CMD_SET_DEVICE,
142 	__WG_CMD_MAX
143 };
144 #define WG_CMD_MAX (__WG_CMD_MAX - 1)
145 
146 enum wgdevice_flag {
147 	WGDEVICE_F_REPLACE_PEERS = 1U << 0,
148 	__WGDEVICE_F_ALL = WGDEVICE_F_REPLACE_PEERS
149 };
150 enum wgdevice_attribute {
151 	WGDEVICE_A_UNSPEC,
152 	WGDEVICE_A_IFINDEX,
153 	WGDEVICE_A_IFNAME,
154 	WGDEVICE_A_PRIVATE_KEY,
155 	WGDEVICE_A_PUBLIC_KEY,
156 	WGDEVICE_A_FLAGS,
157 	WGDEVICE_A_LISTEN_PORT,
158 	WGDEVICE_A_FWMARK,
159 	WGDEVICE_A_PEERS,
160 	__WGDEVICE_A_LAST
161 };
162 #define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)
163 
164 enum wgpeer_flag {
165 	WGPEER_F_REMOVE_ME = 1U << 0,
166 	WGPEER_F_REPLACE_ALLOWEDIPS = 1U << 1,
167 	WGPEER_F_UPDATE_ONLY = 1U << 2,
168 	__WGPEER_F_ALL = WGPEER_F_REMOVE_ME | WGPEER_F_REPLACE_ALLOWEDIPS |
169 			 WGPEER_F_UPDATE_ONLY
170 };
171 enum wgpeer_attribute {
172 	WGPEER_A_UNSPEC,
173 	WGPEER_A_PUBLIC_KEY,
174 	WGPEER_A_PRESHARED_KEY,
175 	WGPEER_A_FLAGS,
176 	WGPEER_A_ENDPOINT,
177 	WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
178 	WGPEER_A_LAST_HANDSHAKE_TIME,
179 	WGPEER_A_RX_BYTES,
180 	WGPEER_A_TX_BYTES,
181 	WGPEER_A_ALLOWEDIPS,
182 	WGPEER_A_PROTOCOL_VERSION,
183 	__WGPEER_A_LAST
184 };
185 #define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
186 
187 enum wgallowedip_attribute {
188 	WGALLOWEDIP_A_UNSPEC,
189 	WGALLOWEDIP_A_FAMILY,
190 	WGALLOWEDIP_A_IPADDR,
191 	WGALLOWEDIP_A_CIDR_MASK,
192 	__WGALLOWEDIP_A_LAST
193 };
194 #define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)
195 
196 #endif /* _WG_UAPI_WIREGUARD_H */
197