updated nm plugin to NetworkManager API changes
[strongswan.git] / src / charon / plugins / nm / nm_service.c
1 /*
2 * Copyright (C) 2008 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 *
15 * $Id$
16 */
17
18 #include <nm-setting-vpn.h>
19 #include "nm_service.h"
20
21 #include <daemon.h>
22 #include <utils/host.h>
23 #include <utils/identification.h>
24 #include <config/peer_cfg.h>
25
26 #include <stdio.h>
27
28 #define CONFIG_NAME "NetworkManager"
29
30 G_DEFINE_TYPE(NMStrongswanPlugin, nm_strongswan_plugin, NM_TYPE_VPN_PLUGIN)
31
32 /**
33 * Private data of NMStrongswanPlugin
34 */
35 typedef struct {
36 bus_listener_t listener;
37 ike_sa_t *ike_sa;
38 NMVPNPlugin *plugin;
39 } NMStrongswanPluginPrivate;
40
41 #define NM_STRONGSWAN_PLUGIN_GET_PRIVATE(o) \
42 (G_TYPE_INSTANCE_GET_PRIVATE ((o), \
43 NM_TYPE_STRONGSWAN_PLUGIN, NMStrongswanPluginPrivate))
44
45 /**
46 * convert a traffic selector address range to subnet and its mask.
47 */
48 static u_int ts2subnet(traffic_selector_t* ts, u_int8_t *mask)
49 {
50 /* there is no way to do this cleanly, as the address range may
51 * be anything else but a subnet. We use from_addr as subnet
52 * and try to calculate a usable subnet mask.
53 */
54 int byte, bit, net;
55 bool found = FALSE;
56 chunk_t from, to;
57 size_t size = (ts->get_type(ts) == TS_IPV4_ADDR_RANGE) ? 4 : 16;
58
59 from = ts->get_from_address(ts);
60 to = ts->get_to_address(ts);
61
62 *mask = (size * 8);
63 /* go trough all bits of the addresses, beginning in the front.
64 * as long as they are equal, the subnet gets larger
65 */
66 for (byte = 0; byte < size; byte++)
67 {
68 for (bit = 7; bit >= 0; bit--)
69 {
70 if ((1<<bit & from.ptr[byte]) != (1<<bit & to.ptr[byte]))
71 {
72 *mask = ((7 - bit) + (byte * 8));
73 found = TRUE;
74 break;
75 }
76 }
77 if (found)
78 {
79 break;
80 }
81 }
82 net = *(u_int32_t*)from.ptr;
83 chunk_free(&from);
84 chunk_free(&to);
85 return net;
86 }
87
88 /**
89 * signal IPv4 config to NM, set connection as established
90 */
91 static void signal_ipv4_config(NMVPNPlugin *plugin, child_sa_t *child_sa)
92 {
93 linked_list_t *list;
94 traffic_selector_t *ts = NULL;
95 enumerator_t *enumerator;
96
97 list = child_sa->get_traffic_selectors(child_sa, FALSE);
98 enumerator = list->create_enumerator(list);
99 while (enumerator->enumerate(enumerator, &ts))
100 {
101 GValue *val;
102 GHashTable *config;
103 u_int8_t mask;
104
105 config = g_hash_table_new(g_str_hash, g_str_equal);
106
107 val = g_slice_new0(GValue);
108 g_value_init(val, G_TYPE_UINT);
109 g_value_set_uint(val, ts2subnet(ts, &mask));
110 g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
111
112 val = g_slice_new0(GValue);
113 g_value_init(val, G_TYPE_UINT);
114 g_value_set_uint(val, mask);
115 g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_PREFIX, val);
116
117 nm_vpn_plugin_set_ip4_config(plugin, config);
118 }
119 enumerator->destroy(enumerator);
120 }
121
122 /**
123 * Bus listen function to wait for SA establishing
124 */
125 bool listen_bus(bus_listener_t *listener, signal_t signal, level_t level,
126 int thread, ike_sa_t *ike_sa, void *data,
127 char* format, va_list args)
128 {
129 NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
130
131 if (private->ike_sa == ike_sa)
132 {
133 switch (signal)
134 {
135 case CHD_UP_SUCCESS:
136 if (data)
137 {
138 signal_ipv4_config(private->plugin, (child_sa_t*)data);
139 return FALSE;
140 }
141 /* FALL */
142 case IKE_UP_FAILED:
143 case CHD_UP_FAILED:
144 nm_vpn_plugin_failure(private->plugin,
145 NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
146 /* TODO: NM does not react on this failure!? So additionaly
147 * reset state */
148 nm_vpn_plugin_set_state(private->plugin,
149 NM_VPN_SERVICE_STATE_STOPPED);
150 return FALSE;
151 default:
152 break;
153 }
154 }
155 return TRUE;
156 }
157
158 /**
159 * Connect function called from NM via DBUS
160 */
161 static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
162 GError **err)
163 {
164 NMSettingVPN *settings;
165 identification_t *user = NULL;
166 char *address, *str;
167 bool virtual, encap, ipcomp;
168 ike_cfg_t *ike_cfg;
169 peer_cfg_t *peer_cfg;
170 child_cfg_t *child_cfg;
171 traffic_selector_t *ts;
172 ike_sa_t *ike_sa;
173
174 /**
175 * Read parameters
176 */
177 settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
178 NM_TYPE_SETTING_VPN));
179
180 DBG2(DBG_CFG, "received NetworkManager connection: %s",
181 nm_setting_to_string(NM_SETTING(settings)));
182 str = g_hash_table_lookup(settings->data, "user");
183 if (!str)
184 {
185 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
186 "Username missing.");
187 return FALSE;
188 }
189 user = identification_create_from_string(str);
190 if (!user)
191 { /* fallback to ID_KEY_ID for non-qualified usernames */
192 user = identification_create_from_encoding(ID_KEY_ID,
193 chunk_create(str, strlen(str)));
194 }
195 address = g_hash_table_lookup(settings->data, "address");
196 if (!address || !*address)
197 {
198 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
199 "Gateway address missing.");
200 return FALSE;
201 }
202 str = g_hash_table_lookup(settings->data, "virtual");
203 virtual = str && streq(str, "yes");
204 str = g_hash_table_lookup(settings->data, "encap");
205 encap = str && streq(str, "yes");
206 str = g_hash_table_lookup(settings->data, "ipcomp");
207 ipcomp = str && streq(str, "yes");
208
209 /**
210 * Set up configurations
211 */
212 ike_cfg = ike_cfg_create(TRUE, encap, "0.0.0.0", address);
213 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
214 peer_cfg = peer_cfg_create(CONFIG_NAME, 2, ike_cfg, user,
215 identification_create_from_encoding(ID_ANY, chunk_empty),
216 CERT_SEND_IF_ASKED, UNIQUE_REPLACE, CONF_AUTH_PUBKEY,
217 0, 0, 1, /* EAP method, vendor, keyingtries */
218 18000, 0, /* rekey 5h, reauth none */
219 600, 600, /* jitter, over 10min */
220 TRUE, 0, /* mobike, DPD */
221 virtual ? host_create_from_string("0.0.0.0", 0) : NULL,
222 NULL, FALSE, NULL, NULL); /* pool, mediation */
223 child_cfg = child_cfg_create(CONFIG_NAME,
224 3600, 3000, /* lifetime 1h, rekey 50min */
225 300, /* jitter 5min */
226 NULL, TRUE, MODE_TUNNEL, /* updown, hostaccess */
227 ACTION_NONE, ACTION_NONE, ipcomp);
228 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
229 ts = traffic_selector_create_dynamic(0, 0, 65535);
230 child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
231 ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
232 "0.0.0.0", 0,
233 "255.255.255.255", 65535);
234 child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
235 peer_cfg->add_child_cfg(peer_cfg, child_cfg);
236
237 /**
238 * Start to initiate
239 */
240 ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
241 peer_cfg);
242 if (!ike_sa->get_peer_cfg(ike_sa))
243 {
244 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
245 }
246 else
247 {
248 peer_cfg->destroy(peer_cfg);
249 }
250 if (ike_sa->initiate(ike_sa, child_cfg) != SUCCESS)
251 {
252 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
253
254 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
255 "Initiating failed.");
256 return FALSE;
257 }
258
259 /**
260 * Register listener
261 */
262 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->ike_sa = ike_sa;
263 charon->bus->add_listener(charon->bus,
264 &NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->listener);
265 charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
266 return TRUE;
267 }
268
269 /**
270 * NeedSecrets called from NM via DBUS
271 */
272 static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
273 char **setting_name, GError **error)
274 {
275 return FALSE;
276 }
277
278 /**
279 * Disconnect called from NM via DBUS
280 */
281 static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
282 {
283 enumerator_t *enumerator;
284 ike_sa_t *ike_sa;
285 u_int id;
286
287 enumerator = charon->controller->create_ike_sa_enumerator(charon->controller);
288 while (enumerator->enumerate(enumerator, &ike_sa))
289 {
290 if (streq(CONFIG_NAME, ike_sa->get_name(ike_sa)))
291 {
292 id = ike_sa->get_unique_id(ike_sa);
293 enumerator->destroy(enumerator);
294 charon->controller->terminate_ike(charon->controller, id,
295 controller_cb_empty, NULL);
296 return TRUE;
297 }
298 }
299 enumerator->destroy(enumerator);
300 return FALSE;
301 }
302
303 /**
304 * Initializer
305 */
306 static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
307 {
308 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->plugin = NM_VPN_PLUGIN(plugin);
309 NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->listener.signal = listen_bus;
310 }
311
312 /**
313 * Class constructor
314 */
315 static void nm_strongswan_plugin_class_init(
316 NMStrongswanPluginClass *strongswan_class)
317 {
318 NMVPNPluginClass *parent_class = NM_VPN_PLUGIN_CLASS(strongswan_class);
319
320 g_type_class_add_private(G_OBJECT_CLASS(strongswan_class),
321 sizeof(NMStrongswanPluginPrivate));
322 parent_class->connect = connect_;
323 parent_class->need_secrets = need_secrets;
324 parent_class->disconnect = disconnect;
325 }
326
327 /**
328 * Object constructor
329 */
330 NMStrongswanPlugin *nm_strongswan_plugin_new(void)
331 {
332 return (NMStrongswanPlugin *)g_object_new (
333 NM_TYPE_STRONGSWAN_PLUGIN, NM_VPN_PLUGIN_DBUS_SERVICE_NAME,
334 NM_DBUS_SERVICE_STRONGSWAN, NULL);
335 }
336