Wireguard SetDevice call blocks

[dtoubelis]

I'm trying to set up wireguard interface and I'm running into an issue with call being blocked at retrieving results. Here is sample code:

      
       let (connection, mut handle, _) = genetlink::new_connection().map_err(|err| {
            error!("{err}");
            Error::InternalError
        })?;
        let _ = tokio::spawn(connection);

        let nlas = vec![
            WgDeviceAttrs::IfName(self.name.clone()),
            WgDeviceAttrs::PrivateKey(self.priv_key.expect("failed to unwrap private key")),
            WgDeviceAttrs::ListenPort(self.listen_port),
            WgDeviceAttrs::Fwmark(self.fwmark),
            WgDeviceAttrs::Flags(WGDEVICE_F_REPLACE_PEERS),
        ];

        let genlmsg: GenlMessage<Wireguard> = GenlMessage::from_payload(Wireguard {
            cmd: WireguardCmd::SetDevice,
            nlas,
        });
        let mut nlmsg = NetlinkMessage::from(genlmsg);
        nlmsg.header.flags = NLM_F_REQUEST;

        // this call does not return any error if application does not have necessary capabilities
        let mut res = handle.request(nlmsg).await.map_err(|err| {
            debug!("{err}");
            Error::InternalError
        })?;

        // this call blocks if there is no error
        let _result = res.try_next().await.map_err(|err| {
            debug!("{err}");
            Error::InternalError
        })?;

According to netlink documentation only NLM_F_REQUEST flag supposed to be supplied and the kernel is not expected to return result. Which is fine but I still want to catch any permission errors.

Here are some observations:

• If application does not have sufficient permissions - request() call goes not return any error. When I check result with either
  res.try_next() or res.next() call it returns permission error, which is reasonably okay.
• However, when application is executed with elevated permissions, no error is expected but res.try_next() or res.next() calls block indefinitely.
• I also noticed, that if I don't wait for the result - the device is not set up. It only gets set up when application blocks and then terminated.

I think most likely I'm doing something wrong but it also feels that it may be a bug in genetlink. Any thoughts?

[dtoubelis]

I've figured it out - instead of:

nlmsg.header.flags = NLM_F_REQUEST;

I needed to do

nlmsg.header.flags = NLM_F_REQUEST | NLM_F_ACK;

This page provided the clue - https://docs.kernel.org/userspace-api/netlink/intro.html

...and this PR contains a full example #9