xref: /openbmc/linux/drivers/net/wireguard/netlink.c (revision 6dc6657d)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  */
5 
6 #include "netlink.h"
7 #include "device.h"
8 #include "peer.h"
9 #include "socket.h"
10 #include "queueing.h"
11 #include "messages.h"
12 
13 #include <uapi/linux/wireguard.h>
14 
15 #include <linux/if.h>
16 #include <net/genetlink.h>
17 #include <net/sock.h>
18 #include <crypto/algapi.h>
19 
20 static struct genl_family genl_family;
21 
22 static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
23 	[WGDEVICE_A_IFINDEX]		= { .type = NLA_U32 },
24 	[WGDEVICE_A_IFNAME]		= { .type = NLA_NUL_STRING, .len = IFNAMSIZ - 1 },
25 	[WGDEVICE_A_PRIVATE_KEY]	= NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
26 	[WGDEVICE_A_PUBLIC_KEY]		= NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
27 	[WGDEVICE_A_FLAGS]		= { .type = NLA_U32 },
28 	[WGDEVICE_A_LISTEN_PORT]	= { .type = NLA_U16 },
29 	[WGDEVICE_A_FWMARK]		= { .type = NLA_U32 },
30 	[WGDEVICE_A_PEERS]		= { .type = NLA_NESTED }
31 };
32 
33 static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
34 	[WGPEER_A_PUBLIC_KEY]				= NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
35 	[WGPEER_A_PRESHARED_KEY]			= NLA_POLICY_EXACT_LEN(NOISE_SYMMETRIC_KEY_LEN),
36 	[WGPEER_A_FLAGS]				= { .type = NLA_U32 },
37 	[WGPEER_A_ENDPOINT]				= NLA_POLICY_MIN_LEN(sizeof(struct sockaddr)),
38 	[WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL]	= { .type = NLA_U16 },
39 	[WGPEER_A_LAST_HANDSHAKE_TIME]			= NLA_POLICY_EXACT_LEN(sizeof(struct __kernel_timespec)),
40 	[WGPEER_A_RX_BYTES]				= { .type = NLA_U64 },
41 	[WGPEER_A_TX_BYTES]				= { .type = NLA_U64 },
42 	[WGPEER_A_ALLOWEDIPS]				= { .type = NLA_NESTED },
43 	[WGPEER_A_PROTOCOL_VERSION]			= { .type = NLA_U32 }
44 };
45 
46 static const struct nla_policy allowedip_policy[WGALLOWEDIP_A_MAX + 1] = {
47 	[WGALLOWEDIP_A_FAMILY]		= { .type = NLA_U16 },
48 	[WGALLOWEDIP_A_IPADDR]		= NLA_POLICY_MIN_LEN(sizeof(struct in_addr)),
49 	[WGALLOWEDIP_A_CIDR_MASK]	= { .type = NLA_U8 }
50 };
51 
52 static struct wg_device *lookup_interface(struct nlattr **attrs,
53 					  struct sk_buff *skb)
54 {
55 	struct net_device *dev = NULL;
56 
57 	if (!attrs[WGDEVICE_A_IFINDEX] == !attrs[WGDEVICE_A_IFNAME])
58 		return ERR_PTR(-EBADR);
59 	if (attrs[WGDEVICE_A_IFINDEX])
60 		dev = dev_get_by_index(sock_net(skb->sk),
61 				       nla_get_u32(attrs[WGDEVICE_A_IFINDEX]));
62 	else if (attrs[WGDEVICE_A_IFNAME])
63 		dev = dev_get_by_name(sock_net(skb->sk),
64 				      nla_data(attrs[WGDEVICE_A_IFNAME]));
65 	if (!dev)
66 		return ERR_PTR(-ENODEV);
67 	if (!dev->rtnl_link_ops || !dev->rtnl_link_ops->kind ||
68 	    strcmp(dev->rtnl_link_ops->kind, KBUILD_MODNAME)) {
69 		dev_put(dev);
70 		return ERR_PTR(-EOPNOTSUPP);
71 	}
72 	return netdev_priv(dev);
73 }
74 
75 static int get_allowedips(struct sk_buff *skb, const u8 *ip, u8 cidr,
76 			  int family)
77 {
78 	struct nlattr *allowedip_nest;
79 
80 	allowedip_nest = nla_nest_start(skb, 0);
81 	if (!allowedip_nest)
82 		return -EMSGSIZE;
83 
84 	if (nla_put_u8(skb, WGALLOWEDIP_A_CIDR_MASK, cidr) ||
85 	    nla_put_u16(skb, WGALLOWEDIP_A_FAMILY, family) ||
86 	    nla_put(skb, WGALLOWEDIP_A_IPADDR, family == AF_INET6 ?
87 		    sizeof(struct in6_addr) : sizeof(struct in_addr), ip)) {
88 		nla_nest_cancel(skb, allowedip_nest);
89 		return -EMSGSIZE;
90 	}
91 
92 	nla_nest_end(skb, allowedip_nest);
93 	return 0;
94 }
95 
96 struct dump_ctx {
97 	struct wg_device *wg;
98 	struct wg_peer *next_peer;
99 	u64 allowedips_seq;
100 	struct allowedips_node *next_allowedip;
101 };
102 
103 #define DUMP_CTX(cb) ((struct dump_ctx *)(cb)->args)
104 
105 static int
106 get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx)
107 {
108 
109 	struct nlattr *allowedips_nest, *peer_nest = nla_nest_start(skb, 0);
110 	struct allowedips_node *allowedips_node = ctx->next_allowedip;
111 	bool fail;
112 
113 	if (!peer_nest)
114 		return -EMSGSIZE;
115 
116 	down_read(&peer->handshake.lock);
117 	fail = nla_put(skb, WGPEER_A_PUBLIC_KEY, NOISE_PUBLIC_KEY_LEN,
118 		       peer->handshake.remote_static);
119 	up_read(&peer->handshake.lock);
120 	if (fail)
121 		goto err;
122 
123 	if (!allowedips_node) {
124 		const struct __kernel_timespec last_handshake = {
125 			.tv_sec = peer->walltime_last_handshake.tv_sec,
126 			.tv_nsec = peer->walltime_last_handshake.tv_nsec
127 		};
128 
129 		down_read(&peer->handshake.lock);
130 		fail = nla_put(skb, WGPEER_A_PRESHARED_KEY,
131 			       NOISE_SYMMETRIC_KEY_LEN,
132 			       peer->handshake.preshared_key);
133 		up_read(&peer->handshake.lock);
134 		if (fail)
135 			goto err;
136 
137 		if (nla_put(skb, WGPEER_A_LAST_HANDSHAKE_TIME,
138 			    sizeof(last_handshake), &last_handshake) ||
139 		    nla_put_u16(skb, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL,
140 				peer->persistent_keepalive_interval) ||
141 		    nla_put_u64_64bit(skb, WGPEER_A_TX_BYTES, peer->tx_bytes,
142 				      WGPEER_A_UNSPEC) ||
143 		    nla_put_u64_64bit(skb, WGPEER_A_RX_BYTES, peer->rx_bytes,
144 				      WGPEER_A_UNSPEC) ||
145 		    nla_put_u32(skb, WGPEER_A_PROTOCOL_VERSION, 1))
146 			goto err;
147 
148 		read_lock_bh(&peer->endpoint_lock);
149 		if (peer->endpoint.addr.sa_family == AF_INET)
150 			fail = nla_put(skb, WGPEER_A_ENDPOINT,
151 				       sizeof(peer->endpoint.addr4),
152 				       &peer->endpoint.addr4);
153 		else if (peer->endpoint.addr.sa_family == AF_INET6)
154 			fail = nla_put(skb, WGPEER_A_ENDPOINT,
155 				       sizeof(peer->endpoint.addr6),
156 				       &peer->endpoint.addr6);
157 		read_unlock_bh(&peer->endpoint_lock);
158 		if (fail)
159 			goto err;
160 		allowedips_node =
161 			list_first_entry_or_null(&peer->allowedips_list,
162 					struct allowedips_node, peer_list);
163 	}
164 	if (!allowedips_node)
165 		goto no_allowedips;
166 	if (!ctx->allowedips_seq)
167 		ctx->allowedips_seq = peer->device->peer_allowedips.seq;
168 	else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq)
169 		goto no_allowedips;
170 
171 	allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS);
172 	if (!allowedips_nest)
173 		goto err;
174 
175 	list_for_each_entry_from(allowedips_node, &peer->allowedips_list,
176 				 peer_list) {
177 		u8 cidr, ip[16] __aligned(__alignof(u64));
178 		int family;
179 
180 		family = wg_allowedips_read_node(allowedips_node, ip, &cidr);
181 		if (get_allowedips(skb, ip, cidr, family)) {
182 			nla_nest_end(skb, allowedips_nest);
183 			nla_nest_end(skb, peer_nest);
184 			ctx->next_allowedip = allowedips_node;
185 			return -EMSGSIZE;
186 		}
187 	}
188 	nla_nest_end(skb, allowedips_nest);
189 no_allowedips:
190 	nla_nest_end(skb, peer_nest);
191 	ctx->next_allowedip = NULL;
192 	ctx->allowedips_seq = 0;
193 	return 0;
194 err:
195 	nla_nest_cancel(skb, peer_nest);
196 	return -EMSGSIZE;
197 }
198 
199 static int wg_get_device_start(struct netlink_callback *cb)
200 {
201 	struct wg_device *wg;
202 
203 	wg = lookup_interface(genl_dumpit_info(cb)->attrs, cb->skb);
204 	if (IS_ERR(wg))
205 		return PTR_ERR(wg);
206 	DUMP_CTX(cb)->wg = wg;
207 	return 0;
208 }
209 
210 static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb)
211 {
212 	struct wg_peer *peer, *next_peer_cursor;
213 	struct dump_ctx *ctx = DUMP_CTX(cb);
214 	struct wg_device *wg = ctx->wg;
215 	struct nlattr *peers_nest;
216 	int ret = -EMSGSIZE;
217 	bool done = true;
218 	void *hdr;
219 
220 	rtnl_lock();
221 	mutex_lock(&wg->device_update_lock);
222 	cb->seq = wg->device_update_gen;
223 	next_peer_cursor = ctx->next_peer;
224 
225 	hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
226 			  &genl_family, NLM_F_MULTI, WG_CMD_GET_DEVICE);
227 	if (!hdr)
228 		goto out;
229 	genl_dump_check_consistent(cb, hdr);
230 
231 	if (!ctx->next_peer) {
232 		if (nla_put_u16(skb, WGDEVICE_A_LISTEN_PORT,
233 				wg->incoming_port) ||
234 		    nla_put_u32(skb, WGDEVICE_A_FWMARK, wg->fwmark) ||
235 		    nla_put_u32(skb, WGDEVICE_A_IFINDEX, wg->dev->ifindex) ||
236 		    nla_put_string(skb, WGDEVICE_A_IFNAME, wg->dev->name))
237 			goto out;
238 
239 		down_read(&wg->static_identity.lock);
240 		if (wg->static_identity.has_identity) {
241 			if (nla_put(skb, WGDEVICE_A_PRIVATE_KEY,
242 				    NOISE_PUBLIC_KEY_LEN,
243 				    wg->static_identity.static_private) ||
244 			    nla_put(skb, WGDEVICE_A_PUBLIC_KEY,
245 				    NOISE_PUBLIC_KEY_LEN,
246 				    wg->static_identity.static_public)) {
247 				up_read(&wg->static_identity.lock);
248 				goto out;
249 			}
250 		}
251 		up_read(&wg->static_identity.lock);
252 	}
253 
254 	peers_nest = nla_nest_start(skb, WGDEVICE_A_PEERS);
255 	if (!peers_nest)
256 		goto out;
257 	ret = 0;
258 	/* If the last cursor was removed via list_del_init in peer_remove, then
259 	 * we just treat this the same as there being no more peers left. The
260 	 * reason is that seq_nr should indicate to userspace that this isn't a
261 	 * coherent dump anyway, so they'll try again.
262 	 */
263 	if (list_empty(&wg->peer_list) ||
264 	    (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) {
265 		nla_nest_cancel(skb, peers_nest);
266 		goto out;
267 	}
268 	lockdep_assert_held(&wg->device_update_lock);
269 	peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list);
270 	list_for_each_entry_continue(peer, &wg->peer_list, peer_list) {
271 		if (get_peer(peer, skb, ctx)) {
272 			done = false;
273 			break;
274 		}
275 		next_peer_cursor = peer;
276 	}
277 	nla_nest_end(skb, peers_nest);
278 
279 out:
280 	if (!ret && !done && next_peer_cursor)
281 		wg_peer_get(next_peer_cursor);
282 	wg_peer_put(ctx->next_peer);
283 	mutex_unlock(&wg->device_update_lock);
284 	rtnl_unlock();
285 
286 	if (ret) {
287 		genlmsg_cancel(skb, hdr);
288 		return ret;
289 	}
290 	genlmsg_end(skb, hdr);
291 	if (done) {
292 		ctx->next_peer = NULL;
293 		return 0;
294 	}
295 	ctx->next_peer = next_peer_cursor;
296 	return skb->len;
297 
298 	/* At this point, we can't really deal ourselves with safely zeroing out
299 	 * the private key material after usage. This will need an additional API
300 	 * in the kernel for marking skbs as zero_on_free.
301 	 */
302 }
303 
304 static int wg_get_device_done(struct netlink_callback *cb)
305 {
306 	struct dump_ctx *ctx = DUMP_CTX(cb);
307 
308 	if (ctx->wg)
309 		dev_put(ctx->wg->dev);
310 	wg_peer_put(ctx->next_peer);
311 	return 0;
312 }
313 
314 static int set_port(struct wg_device *wg, u16 port)
315 {
316 	struct wg_peer *peer;
317 
318 	if (wg->incoming_port == port)
319 		return 0;
320 	list_for_each_entry(peer, &wg->peer_list, peer_list)
321 		wg_socket_clear_peer_endpoint_src(peer);
322 	if (!netif_running(wg->dev)) {
323 		wg->incoming_port = port;
324 		return 0;
325 	}
326 	return wg_socket_init(wg, port);
327 }
328 
329 static int set_allowedip(struct wg_peer *peer, struct nlattr **attrs)
330 {
331 	int ret = -EINVAL;
332 	u16 family;
333 	u8 cidr;
334 
335 	if (!attrs[WGALLOWEDIP_A_FAMILY] || !attrs[WGALLOWEDIP_A_IPADDR] ||
336 	    !attrs[WGALLOWEDIP_A_CIDR_MASK])
337 		return ret;
338 	family = nla_get_u16(attrs[WGALLOWEDIP_A_FAMILY]);
339 	cidr = nla_get_u8(attrs[WGALLOWEDIP_A_CIDR_MASK]);
340 
341 	if (family == AF_INET && cidr <= 32 &&
342 	    nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in_addr))
343 		ret = wg_allowedips_insert_v4(
344 			&peer->device->peer_allowedips,
345 			nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer,
346 			&peer->device->device_update_lock);
347 	else if (family == AF_INET6 && cidr <= 128 &&
348 		 nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in6_addr))
349 		ret = wg_allowedips_insert_v6(
350 			&peer->device->peer_allowedips,
351 			nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer,
352 			&peer->device->device_update_lock);
353 
354 	return ret;
355 }
356 
357 static int set_peer(struct wg_device *wg, struct nlattr **attrs)
358 {
359 	u8 *public_key = NULL, *preshared_key = NULL;
360 	struct wg_peer *peer = NULL;
361 	u32 flags = 0;
362 	int ret;
363 
364 	ret = -EINVAL;
365 	if (attrs[WGPEER_A_PUBLIC_KEY] &&
366 	    nla_len(attrs[WGPEER_A_PUBLIC_KEY]) == NOISE_PUBLIC_KEY_LEN)
367 		public_key = nla_data(attrs[WGPEER_A_PUBLIC_KEY]);
368 	else
369 		goto out;
370 	if (attrs[WGPEER_A_PRESHARED_KEY] &&
371 	    nla_len(attrs[WGPEER_A_PRESHARED_KEY]) == NOISE_SYMMETRIC_KEY_LEN)
372 		preshared_key = nla_data(attrs[WGPEER_A_PRESHARED_KEY]);
373 
374 	if (attrs[WGPEER_A_FLAGS])
375 		flags = nla_get_u32(attrs[WGPEER_A_FLAGS]);
376 	ret = -EOPNOTSUPP;
377 	if (flags & ~__WGPEER_F_ALL)
378 		goto out;
379 
380 	ret = -EPFNOSUPPORT;
381 	if (attrs[WGPEER_A_PROTOCOL_VERSION]) {
382 		if (nla_get_u32(attrs[WGPEER_A_PROTOCOL_VERSION]) != 1)
383 			goto out;
384 	}
385 
386 	peer = wg_pubkey_hashtable_lookup(wg->peer_hashtable,
387 					  nla_data(attrs[WGPEER_A_PUBLIC_KEY]));
388 	ret = 0;
389 	if (!peer) { /* Peer doesn't exist yet. Add a new one. */
390 		if (flags & (WGPEER_F_REMOVE_ME | WGPEER_F_UPDATE_ONLY))
391 			goto out;
392 
393 		/* The peer is new, so there aren't allowed IPs to remove. */
394 		flags &= ~WGPEER_F_REPLACE_ALLOWEDIPS;
395 
396 		down_read(&wg->static_identity.lock);
397 		if (wg->static_identity.has_identity &&
398 		    !memcmp(nla_data(attrs[WGPEER_A_PUBLIC_KEY]),
399 			    wg->static_identity.static_public,
400 			    NOISE_PUBLIC_KEY_LEN)) {
401 			/* We silently ignore peers that have the same public
402 			 * key as the device. The reason we do it silently is
403 			 * that we'd like for people to be able to reuse the
404 			 * same set of API calls across peers.
405 			 */
406 			up_read(&wg->static_identity.lock);
407 			ret = 0;
408 			goto out;
409 		}
410 		up_read(&wg->static_identity.lock);
411 
412 		peer = wg_peer_create(wg, public_key, preshared_key);
413 		if (IS_ERR(peer)) {
414 			ret = PTR_ERR(peer);
415 			peer = NULL;
416 			goto out;
417 		}
418 		/* Take additional reference, as though we've just been
419 		 * looked up.
420 		 */
421 		wg_peer_get(peer);
422 	}
423 
424 	if (flags & WGPEER_F_REMOVE_ME) {
425 		wg_peer_remove(peer);
426 		goto out;
427 	}
428 
429 	if (preshared_key) {
430 		down_write(&peer->handshake.lock);
431 		memcpy(&peer->handshake.preshared_key, preshared_key,
432 		       NOISE_SYMMETRIC_KEY_LEN);
433 		up_write(&peer->handshake.lock);
434 	}
435 
436 	if (attrs[WGPEER_A_ENDPOINT]) {
437 		struct sockaddr *addr = nla_data(attrs[WGPEER_A_ENDPOINT]);
438 		size_t len = nla_len(attrs[WGPEER_A_ENDPOINT]);
439 		struct endpoint endpoint = { { { 0 } } };
440 
441 		if (len == sizeof(struct sockaddr_in) && addr->sa_family == AF_INET) {
442 			endpoint.addr4 = *(struct sockaddr_in *)addr;
443 			wg_socket_set_peer_endpoint(peer, &endpoint);
444 		} else if (len == sizeof(struct sockaddr_in6) && addr->sa_family == AF_INET6) {
445 			endpoint.addr6 = *(struct sockaddr_in6 *)addr;
446 			wg_socket_set_peer_endpoint(peer, &endpoint);
447 		}
448 	}
449 
450 	if (flags & WGPEER_F_REPLACE_ALLOWEDIPS)
451 		wg_allowedips_remove_by_peer(&wg->peer_allowedips, peer,
452 					     &wg->device_update_lock);
453 
454 	if (attrs[WGPEER_A_ALLOWEDIPS]) {
455 		struct nlattr *attr, *allowedip[WGALLOWEDIP_A_MAX + 1];
456 		int rem;
457 
458 		nla_for_each_nested(attr, attrs[WGPEER_A_ALLOWEDIPS], rem) {
459 			ret = nla_parse_nested(allowedip, WGALLOWEDIP_A_MAX,
460 					       attr, allowedip_policy, NULL);
461 			if (ret < 0)
462 				goto out;
463 			ret = set_allowedip(peer, allowedip);
464 			if (ret < 0)
465 				goto out;
466 		}
467 	}
468 
469 	if (attrs[WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL]) {
470 		const u16 persistent_keepalive_interval = nla_get_u16(
471 				attrs[WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL]);
472 		const bool send_keepalive =
473 			!peer->persistent_keepalive_interval &&
474 			persistent_keepalive_interval &&
475 			netif_running(wg->dev);
476 
477 		peer->persistent_keepalive_interval = persistent_keepalive_interval;
478 		if (send_keepalive)
479 			wg_packet_send_keepalive(peer);
480 	}
481 
482 	if (netif_running(wg->dev))
483 		wg_packet_send_staged_packets(peer);
484 
485 out:
486 	wg_peer_put(peer);
487 	if (attrs[WGPEER_A_PRESHARED_KEY])
488 		memzero_explicit(nla_data(attrs[WGPEER_A_PRESHARED_KEY]),
489 				 nla_len(attrs[WGPEER_A_PRESHARED_KEY]));
490 	return ret;
491 }
492 
493 static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
494 {
495 	struct wg_device *wg = lookup_interface(info->attrs, skb);
496 	u32 flags = 0;
497 	int ret;
498 
499 	if (IS_ERR(wg)) {
500 		ret = PTR_ERR(wg);
501 		goto out_nodev;
502 	}
503 
504 	rtnl_lock();
505 	mutex_lock(&wg->device_update_lock);
506 
507 	if (info->attrs[WGDEVICE_A_FLAGS])
508 		flags = nla_get_u32(info->attrs[WGDEVICE_A_FLAGS]);
509 	ret = -EOPNOTSUPP;
510 	if (flags & ~__WGDEVICE_F_ALL)
511 		goto out;
512 
513 	if (info->attrs[WGDEVICE_A_LISTEN_PORT] || info->attrs[WGDEVICE_A_FWMARK]) {
514 		struct net *net;
515 		rcu_read_lock();
516 		net = rcu_dereference(wg->creating_net);
517 		ret = !net || !ns_capable(net->user_ns, CAP_NET_ADMIN) ? -EPERM : 0;
518 		rcu_read_unlock();
519 		if (ret)
520 			goto out;
521 	}
522 
523 	++wg->device_update_gen;
524 
525 	if (info->attrs[WGDEVICE_A_FWMARK]) {
526 		struct wg_peer *peer;
527 
528 		wg->fwmark = nla_get_u32(info->attrs[WGDEVICE_A_FWMARK]);
529 		list_for_each_entry(peer, &wg->peer_list, peer_list)
530 			wg_socket_clear_peer_endpoint_src(peer);
531 	}
532 
533 	if (info->attrs[WGDEVICE_A_LISTEN_PORT]) {
534 		ret = set_port(wg,
535 			nla_get_u16(info->attrs[WGDEVICE_A_LISTEN_PORT]));
536 		if (ret)
537 			goto out;
538 	}
539 
540 	if (flags & WGDEVICE_F_REPLACE_PEERS)
541 		wg_peer_remove_all(wg);
542 
543 	if (info->attrs[WGDEVICE_A_PRIVATE_KEY] &&
544 	    nla_len(info->attrs[WGDEVICE_A_PRIVATE_KEY]) ==
545 		    NOISE_PUBLIC_KEY_LEN) {
546 		u8 *private_key = nla_data(info->attrs[WGDEVICE_A_PRIVATE_KEY]);
547 		u8 public_key[NOISE_PUBLIC_KEY_LEN];
548 		struct wg_peer *peer, *temp;
549 		bool send_staged_packets;
550 
551 		if (!crypto_memneq(wg->static_identity.static_private,
552 				   private_key, NOISE_PUBLIC_KEY_LEN))
553 			goto skip_set_private_key;
554 
555 		/* We remove before setting, to prevent race, which means doing
556 		 * two 25519-genpub ops.
557 		 */
558 		if (curve25519_generate_public(public_key, private_key)) {
559 			peer = wg_pubkey_hashtable_lookup(wg->peer_hashtable,
560 							  public_key);
561 			if (peer) {
562 				wg_peer_put(peer);
563 				wg_peer_remove(peer);
564 			}
565 		}
566 
567 		down_write(&wg->static_identity.lock);
568 		send_staged_packets = !wg->static_identity.has_identity && netif_running(wg->dev);
569 		wg_noise_set_static_identity_private_key(&wg->static_identity, private_key);
570 		send_staged_packets = send_staged_packets && wg->static_identity.has_identity;
571 
572 		wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
573 		list_for_each_entry_safe(peer, temp, &wg->peer_list, peer_list) {
574 			wg_noise_precompute_static_static(peer);
575 			wg_noise_expire_current_peer_keypairs(peer);
576 			if (send_staged_packets)
577 				wg_packet_send_staged_packets(peer);
578 		}
579 		up_write(&wg->static_identity.lock);
580 	}
581 skip_set_private_key:
582 
583 	if (info->attrs[WGDEVICE_A_PEERS]) {
584 		struct nlattr *attr, *peer[WGPEER_A_MAX + 1];
585 		int rem;
586 
587 		nla_for_each_nested(attr, info->attrs[WGDEVICE_A_PEERS], rem) {
588 			ret = nla_parse_nested(peer, WGPEER_A_MAX, attr,
589 					       peer_policy, NULL);
590 			if (ret < 0)
591 				goto out;
592 			ret = set_peer(wg, peer);
593 			if (ret < 0)
594 				goto out;
595 		}
596 	}
597 	ret = 0;
598 
599 out:
600 	mutex_unlock(&wg->device_update_lock);
601 	rtnl_unlock();
602 	dev_put(wg->dev);
603 out_nodev:
604 	if (info->attrs[WGDEVICE_A_PRIVATE_KEY])
605 		memzero_explicit(nla_data(info->attrs[WGDEVICE_A_PRIVATE_KEY]),
606 				 nla_len(info->attrs[WGDEVICE_A_PRIVATE_KEY]));
607 	return ret;
608 }
609 
610 static const struct genl_ops genl_ops[] = {
611 	{
612 		.cmd = WG_CMD_GET_DEVICE,
613 		.start = wg_get_device_start,
614 		.dumpit = wg_get_device_dump,
615 		.done = wg_get_device_done,
616 		.flags = GENL_UNS_ADMIN_PERM
617 	}, {
618 		.cmd = WG_CMD_SET_DEVICE,
619 		.doit = wg_set_device,
620 		.flags = GENL_UNS_ADMIN_PERM
621 	}
622 };
623 
624 static struct genl_family genl_family __ro_after_init = {
625 	.ops = genl_ops,
626 	.n_ops = ARRAY_SIZE(genl_ops),
627 	.resv_start_op = WG_CMD_SET_DEVICE + 1,
628 	.name = WG_GENL_NAME,
629 	.version = WG_GENL_VERSION,
630 	.maxattr = WGDEVICE_A_MAX,
631 	.module = THIS_MODULE,
632 	.policy = device_policy,
633 	.netnsok = true
634 };
635 
636 int __init wg_genetlink_init(void)
637 {
638 	return genl_register_family(&genl_family);
639 }
640 
641 void __exit wg_genetlink_uninit(void)
642 {
643 	genl_unregister_family(&genl_family);
644 }
645