wireguard.h

Go to the documentation of this file.

 
/*
 * Copyright (c) 2026 Nordic Semiconductor ASA
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
#ifndef ZEPHYR_INCLUDE_NET_WG_H_
#define ZEPHYR_INCLUDE_NET_WG_H_

 
#include <sys/types.h>
#include <zephyr/types.h>
#include <zephyr/net/socket.h>
 
#ifdef __cplusplus
extern "C" {
#endif

 
#if defined(CONFIG_WIREGUARD)
#define WIREGUARD_INTERFACE CONFIG_WIREGUARD_INTERFACE
#else
#define WIREGUARD_INTERFACE ""
#endif
 
#if defined(CONFIG_WIREGUARD_MAX_SRC_IPS)
#define WIREGUARD_MAX_SRC_IPS CONFIG_WIREGUARD_MAX_SRC_IPS
#else
#define WIREGUARD_MAX_SRC_IPS 1
#endif


#define WIREGUARD_TIMESTAMP_LEN (sizeof(uint64_t) + sizeof(uint32_t))

struct wireguard_allowed_ip {
        struct net_addr addr;
        uint8_t mask_len;
        bool is_valid : 1;
};

struct wireguard_peer_config {
        const char *public_key;

        const uint8_t *preshared_key;

        uint8_t timestamp[WIREGUARD_TIMESTAMP_LEN];

        struct net_sockaddr_storage endpoint_ip;

        struct wireguard_allowed_ip allowed_ip[WIREGUARD_MAX_SRC_IPS];

        int keepalive_interval;
};

struct net_stats_vpn {
        uint32_t keepalive_rx;
        uint32_t keepalive_tx;
        uint32_t invalid_keepalive;
        uint32_t handshake_init_rx;
        uint32_t handshake_init_tx;
        uint32_t handshake_resp_rx;
        uint32_t handshake_resp_tx;
        uint32_t invalid_handshake;
        uint32_t peer_not_found;
        uint32_t key_expired;
        uint32_t invalid_packet;
        uint32_t invalid_key;
        uint32_t invalid_mic;
        uint32_t invalid_packet_len;
        uint32_t invalid_cookie;
        uint32_t invalid_mac1;
        uint32_t invalid_mac2;
        uint32_t decrypt_failed;
        uint32_t drop_rx;
        uint32_t drop_tx;
        uint32_t alloc_failed;
        uint32_t invalid_ip_version;
        uint32_t invalid_ip_family;
        uint32_t denied_ip;
        uint32_t replay_error;
        uint32_t valid_rx;
        uint32_t valid_tx;
};

struct net_event_vpn_peer {
        uint32_t id;
        const char *public_key;
        struct net_sockaddr *endpoint;
        struct wireguard_allowed_ip *allowed_ip[WIREGUARD_MAX_SRC_IPS + 1];
        int keepalive_interval;
};

int wireguard_peer_add(struct wireguard_peer_config *peer_config,
                       struct net_if **peer_iface);

int wireguard_peer_remove(int peer_id);

int wireguard_peer_keepalive(int peer_id);

int wireguard_get_current_time(uint64_t *seconds, uint32_t *nanoseconds);
 
#ifdef __cplusplus
}
#endif

 
#endif /* ZEPHYR_INCLUDE_NET_WG_H_ */