123251a76792762447038dcac970d798f3898515
[strongswan.git] / src / charon / plugins / nm / nm_service.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include <nm-setting-vpn.h>
19 #include "nm_service.h"
20
21 #include <daemon.h>
22 #include <utils/host.h>
23 #include <utils/identification.h>
24 #include <config/peer_cfg.h>
25
26 #include <stdio.h>
27
28 #define CONFIG_NAME "NetworkManager"
29
30 G_DEFINE_TYPE(NMStrongswanPlugin, nm_strongswan_plugin, NM_TYPE_VPN_PLUGIN)
31
32 /**
33 * Private data of NMStrongswanPlugin
34 */
35 typedef struct {
36 bus_listener_t listener;
37 ike_sa_t *ike_sa;
38 NMVPNPlugin *plugin;
39 nm_creds_t *creds;
40 } NMStrongswanPluginPrivate;
41
42 #define NM_STRONGSWAN_PLUGIN_GET_PRIVATE(o) \
43 (G_TYPE_INSTANCE_GET_PRIVATE ((o), \
44 NM_TYPE_STRONGSWAN_PLUGIN, NMStrongswanPluginPrivate))
45
46 /**
47 * convert a traffic selector address range to subnet and its mask.
48 */
49 static u_int ts2subnet(traffic_selector_t* ts, u_int8_t *mask)
50 {
51 /* there is no way to do this cleanly, as the address range may
52 * be anything else but a subnet. We use from_addr as subnet
53 * and try to calculate a usable subnet mask.
54 */
55 int byte, bit, net;
56 bool found = FALSE;
57 chunk_t from, to;
58 size_t size = (ts->get_type(ts) == TS_IPV4_ADDR_RANGE) ? 4 : 16;
59
60 from = ts->get_from_address(ts);
61 to = ts->get_to_address(ts);
62
63 *mask = (size * 8);
64 /* go trough all bits of the addresses, beginning in the front.
65 * as long as they are equal, the subnet gets larger
66 */
67 for (byte = 0; byte < size; byte++)
68 {
69 for (bit = 7; bit >= 0; bit--)
70 {
71 if ((1<<bit & from.ptr[byte]) != (1<<bit & to.ptr[byte]))
72 {
73 *mask = ((7 - bit) + (byte * 8));
74 found = TRUE;
75 break;
76 }
77 }
78 if (found)
79 {
80 break;
81 }
82 }
83 net = *(u_int32_t*)from.ptr;
84 chunk_free(&from);
85 chunk_free(&to);
86 return net;
87 }
88
89 /**
90 * signal IPv4 config to NM, set connection as established
91 */
92 static void signal_ipv4_config(NMVPNPlugin *plugin, child_sa_t *child_sa)
93 {
94 linked_list_t *list;
95 traffic_selector_t *ts = NULL;
96 enumerator_t *enumerator;
97
98 list = child_sa->get_traffic_selectors(child_sa, FALSE);
99 enumerator = list->create_enumerator(list);
100 while (enumerator->enumerate(enumerator, &ts))
101 {
102 GValue *val;
103 GHashTable *config;
104 u_int8_t mask;
105
106 config = g_hash_table_new(g_str_hash, g_str_equal);
107
108 val = g_slice_new0(GValue);
109 g_value_init(val, G_TYPE_UINT);
110 g_value_set_uint(val, ts2subnet(ts, &mask));
111 g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
112
113 val = g_slice_new0(GValue);
114 g_value_init(val, G_TYPE_UINT);
115 g_value_set_uint(val, mask);
116 g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_PREFIX, val);
117
118 nm_vpn_plugin_set_ip4_config(plugin, config);
119 }
120 enumerator->destroy(enumerator);
121 }
122
123 /**
124 * Bus listen function to wait for SA establishing
125 */
126 bool listen_bus(bus_listener_t *listener, signal_t signal, level_t level,
127 int thread, ike_sa_t *ike_sa, void *data,
128 char* format, va_list args)
129 {
130 NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
131
132 if (private->ike_sa == ike_sa)
133 {
134 switch (signal)
135 {
136 case CHD_UP_SUCCESS:
137 if (data)
138 {
139 signal_ipv4_config(private->plugin, (child_sa_t*)data);
140 return FALSE;
141 }
142 /* FALL */
143 case IKE_UP_FAILED:
144 case CHD_UP_FAILED:
145 nm_vpn_plugin_failure(private->plugin,
146 NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
147 /* TODO: NM does not react on this failure!? So additionaly
148 * reset state */
149 nm_vpn_plugin_set_state(private->plugin,
150 NM_VPN_SERVICE_STATE_STOPPED);
151 return FALSE;
152 default:
153 break;
154 }
155 }
156 return TRUE;
157 }
158
159 /**
160 * Connect function called from NM via DBUS
161 */
162 static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
163 GError **err)
164 {
165 nm_creds_t *creds;
166 NMSettingVPN *settings;
167 identification_t *user = NULL;
168 char *address, *str;
169 bool virtual, encap, ipcomp;
170 ike_cfg_t *ike_cfg;
171 peer_cfg_t *peer_cfg;
172 child_cfg_t *child_cfg;
173 traffic_selector_t *ts;
174 ike_sa_t *ike_sa;
175
176 /**
177 * Read parameters
178 */
179 settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
180 NM_TYPE_SETTING_VPN));
181
182 DBG1(DBG_CFG, "received NetworkManager connection: %s",
183 nm_setting_to_string(NM_SETTING(settings)));
184 str = g_hash_table_lookup(settings->data, "user");
185 if (!str)
186 {
187 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
188 "Username missing.");
189 return FALSE;
190 }
191 user = identification_create_from_string(str);
192 if (!user)
193 { /* fallback to ID_KEY_ID for non-qualified usernames */
194 user = identification_create_from_encoding(ID_KEY_ID,
195 chunk_create(str, strlen(str)));
196 }
197 address = g_hash_table_lookup(settings->data, "address");
198 if (!address || !*address)
199 {
200 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
201 "Gateway address missing.");
202 return FALSE;
203 }
204 str = g_hash_table_lookup(settings->data, "virtual");
205 virtual = str && streq(str, "yes");
206 str = g_hash_table_lookup(settings->data, "encap");
207 encap = str && streq(str, "yes");
208 str = g_hash_table_lookup(settings->data, "ipcomp");
209 ipcomp = str && streq(str, "yes");
210
211 /**
212 * Register credentials
213 */
214 creds = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->creds;
215
216 str = g_hash_table_lookup(settings->data, "certificate");
217 if (str)
218 {
219 certificate_t *cert;
220
221 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
222 BUILD_FROM_FILE, str, BUILD_END);
223 creds->set_certificate(creds, cert);
224 }
225 str = g_hash_table_lookup(settings->data, "password");
226 if (str)
227 {
228 creds->set_password(creds, str);
229 }
230
231 /**
232 * Set up configurations
233 */
234 ike_cfg = ike_cfg_create(TRUE, encap, "0.0.0.0", address);
235 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
236 peer_cfg = peer_cfg_create(CONFIG_NAME, 2, ike_cfg, user,
237 identification_create_from_encoding(ID_ANY, chunk_empty),
238 CERT_SEND_IF_ASKED, UNIQUE_REPLACE, CONF_AUTH_PSK,
239 0, 0, 1, /* EAP method, vendor, keyingtries */
240 18000, 0, /* rekey 5h, reauth none */
241 600, 600, /* jitter, over 10min */
242 TRUE, 0, /* mobike, DPD */
243 virtual ? host_create_from_string("0.0.0.0", 0) : NULL,
244 NULL, FALSE, NULL, NULL); /* pool, mediation */
245 child_cfg = child_cfg_create(CONFIG_NAME,
246 3600, 3000, /* lifetime 1h, rekey 50min */
247 300, /* jitter 5min */
248 NULL, TRUE, MODE_TUNNEL, /* updown, hostaccess */
249 ACTION_NONE, ACTION_NONE, ipcomp);
250 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
251 ts = traffic_selector_create_dynamic(0, 0, 65535);
252 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
253 ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
254 "0.0.0.0", 0,
255 "255.255.255.255", 65535);
256 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
257 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
258
259 /**
260 * Start to initiate
261 */
262 ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
263 peer_cfg);
264 if (!ike_sa->get_peer_cfg(ike_sa))
265 {
266 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
267 }
268 else
269 {
270 peer_cfg->destroy(peer_cfg);
271 }
272 if (ike_sa->initiate(ike_sa, child_cfg) != SUCCESS)
273 {
274 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
275
276 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
277 "Initiating failed.");
278 return FALSE;
279 }
280
281 /**
282 * Register listener
283 */
284 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->ike_sa = ike_sa;
285 charon->bus->add_listener(charon->bus,
286 &NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->listener);
287 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
288 return TRUE;
289 }
290
291 /**
292 * NeedSecrets called from NM via DBUS
293 */
294 static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
295 char **setting_name, GError **error)
296 {
297 NMSettingVPN *settings;
298
299 settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
300 NM_TYPE_SETTING_VPN));
301 if (!g_hash_table_lookup(settings->data, "password"))
302 {
303 *setting_name = NM_SETTING_VPN_SETTING_NAME;
304 return TRUE;
305 }
306 return FALSE;
307 }
308
309 /**
310 * Disconnect called from NM via DBUS
311 */
312 static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
313 {
314 enumerator_t *enumerator;
315 ike_sa_t *ike_sa;
316 u_int id;
317
318 enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
319 while (enumerator->enumerate(enumerator, &ike_sa))
320 {
321 if (streq(CONFIG_NAME, ike_sa->get_name(ike_sa)))
322 {
323 id = ike_sa->get_unique_id(ike_sa);
324 enumerator->destroy(enumerator);
325 charon->controller->terminate_ike(charon->controller, id,
326 controller_cb_empty, NULL);
327 return TRUE;
328 }
329 }
330 enumerator->destroy(enumerator);
331 return FALSE;
332 }
333
334 /**
335 * Initializer
336 */
337 static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
338 {
339 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->plugin = NM_VPN_PLUGIN(plugin);
340 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->listener.signal = listen_bus;
341 }
342
343 /**
344 * Class constructor
345 */
346 static void nm_strongswan_plugin_class_init(
347 NMStrongswanPluginClass *strongswan_class)
348 {
349 NMVPNPluginClass *parent_class = NM_VPN_PLUGIN_CLASS(strongswan_class);
350
351 g_type_class_add_private(G_OBJECT_CLASS(strongswan_class),
352 sizeof(NMStrongswanPluginPrivate));
353 parent_class->connect = connect_;
354 parent_class->need_secrets = need_secrets;
355 parent_class->disconnect = disconnect;
356 }
357
358 /**
359 * Object constructor
360 */
361 NMStrongswanPlugin *nm_strongswan_plugin_new(nm_creds_t *creds)
362 {
363 NMStrongswanPlugin *plugin = (NMStrongswanPlugin *)g_object_new (
364 NM_TYPE_STRONGSWAN_PLUGIN,
365 NM_VPN_PLUGIN_DBUS_SERVICE_NAME, NM_DBUS_SERVICE_STRONGSWAN,
366 NULL);
367
368 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->creds = creds;
369
370 return plugin;
371 }
372