src/charon-nm/nm/nm_service.c

   1 /*
   2  * Copyright (C) 2017 Lubomir Rintel
   3  *
   4  * Copyright (C) 2013-2019 Tobias Brunner
   5  * Copyright (C) 2008-2009 Martin Willi
   6  * HSR Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "nm_service.h"
  20
  21 #include <daemon.h>
  22 #include <networking/host.h>
  23 #include <utils/identification.h>
  24 #include <config/peer_cfg.h>
  25 #include <credentials/certificates/x509.h>
  26
  27 #include <stdio.h>
  28
  29 /**
  30  * Private data of NMStrongswanPlugin
  31  */
  32 typedef struct {
  33         /* implements bus listener interface */
  34         listener_t listener;
  35         /* IKE_SA we are listening on */
  36         ike_sa_t *ike_sa;
  37         /* backref to public plugin */
  38         NMVpnServicePlugin *plugin;
  39         /* credentials to use for authentication */
  40         nm_creds_t *creds;
  41         /* attribute handler for DNS/NBNS server information */
  42         nm_handler_t *handler;
  43         /* name of the connection */
  44         char *name;
  45 } NMStrongswanPluginPrivate;
  46
  47 G_DEFINE_TYPE_WITH_PRIVATE(NMStrongswanPlugin, nm_strongswan_plugin, NM_TYPE_VPN_SERVICE_PLUGIN)
  48
  49 #define NM_STRONGSWAN_PLUGIN_GET_PRIVATE(o) \
  50                         ((NMStrongswanPluginPrivate*) \
  51                                 nm_strongswan_plugin_get_instance_private (o))
  52
  53 /**
  54  * Convert an address chunk to a GValue
  55  */
  56 static GVariant *addr_to_variant(chunk_t addr)
  57 {
  58         GVariantBuilder builder;
  59         int i;
  60
  61         switch (addr.len)
  62         {
  63                 case 4:
  64                         return g_variant_new_uint32 (*(uint32_t*)addr.ptr);
  65                 case 16:
  66                         g_variant_builder_init (&builder, G_VARIANT_TYPE ("ay"));
  67                         for (i = 0; i < addr.len; i++)
  68                         {
  69                                 g_variant_builder_add (&builder, "y", addr.ptr[i]);
  70
  71                         }
  72                         return g_variant_builder_end (&builder);
  73                 default:
  74                         return NULL;
  75         }
  76 }
  77
  78 /**
  79  * Convert a host to a GValue
  80  */
  81 static GVariant *host_to_variant(host_t *host)
  82 {
  83         return addr_to_variant(host->get_address(host));
  84 }
  85
  86 /**
  87  * Convert enumerated handler chunks to a GValue
  88  */
  89 static GVariant* handler_to_variant(nm_handler_t *handler, char *variant_type,
  90                                                          configuration_attribute_type_t type)
  91 {
  92         GVariantBuilder builder;
  93         enumerator_t *enumerator;
  94         chunk_t *chunk;
  95
  96         g_variant_builder_init (&builder, G_VARIANT_TYPE (variant_type));
  97
  98         enumerator = handler->create_enumerator(handler, type);
  99         while (enumerator->enumerate(enumerator, &chunk))
 100         {
 101                 g_variant_builder_add_value (&builder, addr_to_variant(*chunk));
 102         }
 103         enumerator->destroy(enumerator);
 104
 105         return g_variant_builder_end (&builder);
 106 }
 107
 108 /**
 109  * Signal IP config to NM, set connection as established
 110  */
 111 static void signal_ip_config(NMVpnServicePlugin *plugin,
 112                                                          ike_sa_t *ike_sa, child_sa_t *child_sa)
 113 {
 114         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 115         NMStrongswanPluginPrivate *priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub);
 116         GVariantBuilder builder, ip4builder, ip6builder;
 117         GVariant *ip4config, *ip6config;
 118         enumerator_t *enumerator;
 119         host_t *me, *other, *vip4 = NULL, *vip6 = NULL;
 120         nm_handler_t *handler;
 121
 122         g_variant_builder_init (&builder, G_VARIANT_TYPE_VARDICT);
 123         g_variant_builder_init (&ip4builder, G_VARIANT_TYPE_VARDICT);
 124         g_variant_builder_init (&ip6builder, G_VARIANT_TYPE_VARDICT);
 125
 126         handler = priv->handler;
 127
 128         /* NM apparently requires to know the gateway */
 129         other = ike_sa->get_other_host(ike_sa);
 130         g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY,
 131                                host_to_variant(other));
 132
 133         /* pass the first virtual IPs we got or use the physical IP */
 134         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, TRUE);
 135         while (enumerator->enumerate(enumerator, &me))
 136         {
 137                 switch (me->get_family(me))
 138                 {
 139                         case AF_INET:
 140                                 if (!vip4)
 141                                 {
 142                                         vip4 = me;
 143                                 }
 144                                 break;
 145                         case AF_INET6:
 146                                 if (!vip6)
 147                                 {
 148                                         vip6 = me;
 149                                 }
 150                                 break;
 151                 }
 152         }
 153         enumerator->destroy(enumerator);
 154         if (!vip4 && !vip6)
 155         {
 156                 me = ike_sa->get_my_host(ike_sa);
 157                 switch (me->get_family(me))
 158                 {
 159                         case AF_INET:
 160                                 vip4 = me;
 161                                 break;
 162                         case AF_INET6:
 163                                 vip6 = me;
 164                                 break;
 165                 }
 166         }
 167
 168         if (vip4)
 169         {
 170                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS,
 171                                                            host_to_variant(vip4));
 172                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PREFIX,
 173                                                            g_variant_new_uint32 (vip4->get_address(vip4).len * 8));
 174
 175                 /* prevent NM from changing the default route. we set our own route in our
 176                  * own routing table
 177                  */
 178                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT,
 179                                                            g_variant_new_boolean (TRUE));
 180
 181                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS,
 182                                                            handler_to_variant(handler, "au", INTERNAL_IP4_DNS));
 183
 184                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NBNS,
 185                                                            handler_to_variant(handler, "au", INTERNAL_IP4_NBNS));
 186         }
 187
 188         if (vip6)
 189         {
 190                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_ADDRESS,
 191                                                            host_to_variant(vip6));
 192                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_PREFIX,
 193                                                            g_variant_new_uint32 (vip6->get_address(vip6).len * 8));
 194                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_NEVER_DEFAULT,
 195                                                            g_variant_new_boolean (TRUE));
 196                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_DNS,
 197                                                            handler_to_variant(handler, "aay", INTERNAL_IP6_DNS));
 198                 /* NM_VPN_PLUGIN_IP6_CONFIG_NBNS is not defined */
 199         }
 200
 201         ip4config = g_variant_builder_end (&ip4builder);
 202         if (g_variant_n_children (ip4config))
 203         {
 204                 g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4,
 205                                                            g_variant_new_boolean (TRUE));
 206         }
 207         else
 208         {
 209                 g_variant_unref (ip4config);
 210                 ip4config = NULL;
 211         }
 212
 213         ip6config = g_variant_builder_end (&ip6builder);
 214         if (g_variant_n_children (ip6config))
 215         {
 216                 g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6,
 217                                                            g_variant_new_boolean (TRUE));
 218         }
 219         else
 220         {
 221                 g_variant_unref (ip6config);
 222                 ip6config = NULL;
 223         }
 224
 225         handler->reset(handler);
 226
 227         nm_vpn_service_plugin_set_config (plugin, g_variant_builder_end (&builder));
 228         if (ip4config)
 229         {
 230                 nm_vpn_service_plugin_set_ip4_config (plugin, ip4config);
 231         }
 232         if (ip6config)
 233         {
 234                 nm_vpn_service_plugin_set_ip6_config (plugin, ip6config);
 235         }
 236 }
 237
 238 /**
 239  * signal failure to NM, connecting failed
 240  */
 241 static void signal_failure(NMVpnServicePlugin *plugin, NMVpnPluginFailure failure)
 242 {
 243         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 244         nm_handler_t *handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub)->handler;
 245
 246         handler->reset(handler);
 247
 248         nm_vpn_service_plugin_failure(plugin, failure);
 249 }
 250
 251 /**
 252  * Implementation of listener_t.ike_state_change
 253  */
 254 static bool ike_state_change(listener_t *listener, ike_sa_t *ike_sa,
 255                                                          ike_sa_state_t state)
 256 {
 257         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 258
 259         if (private->ike_sa == ike_sa && state == IKE_DESTROYING)
 260         {
 261                 signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_LOGIN_FAILED);
 262                 return FALSE;
 263         }
 264         return TRUE;
 265 }
 266
 267 /**
 268  * Implementation of listener_t.child_state_change
 269  */
 270 static bool child_state_change(listener_t *listener, ike_sa_t *ike_sa,
 271                                                            child_sa_t *child_sa, child_sa_state_t state)
 272 {
 273         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 274
 275         if (private->ike_sa == ike_sa && state == CHILD_DESTROYING)
 276         {
 277                 signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 278                 return FALSE;
 279         }
 280         return TRUE;
 281 }
 282
 283 /**
 284  * Implementation of listener_t.child_updown
 285  */
 286 static bool child_updown(listener_t *listener, ike_sa_t *ike_sa,
 287                                                  child_sa_t *child_sa, bool up)
 288 {
 289         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 290
 291         if (private->ike_sa == ike_sa)
 292         {
 293                 if (up)
 294                 {       /* disable initiate-failure-detection hooks */
 295                         private->listener.ike_state_change = NULL;
 296                         private->listener.child_state_change = NULL;
 297                         signal_ip_config(private->plugin, ike_sa, child_sa);
 298                 }
 299                 else
 300                 {
 301                         signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 302                         return FALSE;
 303                 }
 304         }
 305         return TRUE;
 306 }
 307
 308 /**
 309  * Implementation of listener_t.ike_rekey
 310  */
 311 static bool ike_rekey(listener_t *listener, ike_sa_t *old, ike_sa_t *new)
 312 {
 313         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 314
 315         if (private->ike_sa == old)
 316         {       /* follow a rekeyed IKE_SA */
 317                 private->ike_sa = new;
 318         }
 319         return TRUE;
 320 }
 321
 322 /**
 323  * Find a certificate for which we have a private key on a smartcard
 324  */
 325 static identification_t *find_smartcard_key(NMStrongswanPluginPrivate *priv,
 326                                                                                         char *pin)
 327 {
 328         enumerator_t *enumerator, *sans;
 329         identification_t *id = NULL;
 330         certificate_t *cert;
 331         x509_t *x509;
 332         private_key_t *key;
 333         chunk_t keyid;
 334
 335         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 336                                                                                         CERT_X509, KEY_ANY, NULL, FALSE);
 337         while (enumerator->enumerate(enumerator, &cert))
 338         {
 339                 x509 = (x509_t*)cert;
 340
 341                 /* there might be a lot of certificates, filter them by usage */
 342                 if ((x509->get_flags(x509) & X509_CLIENT_AUTH) &&
 343                         !(x509->get_flags(x509) & X509_CA))
 344                 {
 345                         keyid = x509->get_subjectKeyIdentifier(x509);
 346                         if (keyid.ptr)
 347                         {
 348                                 /* try to find a private key by the certificate keyid */
 349                                 priv->creds->set_pin(priv->creds, keyid, pin);
 350                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 351                                                                 KEY_ANY, BUILD_PKCS11_KEYID, keyid, BUILD_END);
 352                                 if (key)
 353                                 {
 354                                         /* prefer a more convenient subjectAltName */
 355                                         sans = x509->create_subjectAltName_enumerator(x509);
 356                                         if (!sans->enumerate(sans, &id))
 357                                         {
 358                                                 id = cert->get_subject(cert);
 359                                         }
 360                                         id = id->clone(id);
 361                                         sans->destroy(sans);
 362
 363                                         DBG1(DBG_CFG, "using smartcard certificate '%Y'", id);
 364                                         priv->creds->set_cert_and_key(priv->creds,
 365                                                                                                   cert->get_ref(cert), key);
 366                                         break;
 367                                 }
 368                         }
 369                 }
 370         }
 371         enumerator->destroy(enumerator);
 372         return id;
 373 }
 374
 375 /**
 376  * Connect function called from NM via DBUS
 377  */
 378 static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
 379                                                  GError **err)
 380 {
 381         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 382         NMStrongswanPluginPrivate *priv;
 383         NMSettingConnection *conn;
 384         NMSettingVpn *vpn;
 385         enumerator_t *enumerator;
 386         identification_t *user = NULL, *gateway = NULL;
 387         const char *str;
 388         bool virtual, proposal;
 389         proposal_t *prop;
 390         ike_cfg_t *ike_cfg;
 391         peer_cfg_t *peer_cfg;
 392         child_cfg_t *child_cfg;
 393         traffic_selector_t *ts;
 394         ike_sa_t *ike_sa;
 395         auth_cfg_t *auth;
 396         auth_class_t auth_class = AUTH_CLASS_EAP;
 397         certificate_t *cert = NULL;
 398         x509_t *x509;
 399         bool agent = FALSE, smartcard = FALSE, loose_gateway_id = FALSE;
 400         ike_cfg_create_t ike = {
 401                 .version = IKEV2,
 402                 .local = "%any",
 403                 .local_port = charon->socket->get_port(charon->socket, FALSE),
 404                 .remote_port = IKEV2_UDP_PORT,
 405                 .fragmentation = FRAGMENTATION_YES,
 406         };
 407         peer_cfg_create_t peer = {
 408                 .cert_policy = CERT_SEND_IF_ASKED,
 409                 .unique = UNIQUE_REPLACE,
 410                 .keyingtries = 1,
 411                 .rekey_time = 36000, /* 10h */
 412                 .jitter_time = 600, /* 10min */
 413                 .over_time = 600, /* 10min */
 414         };
 415         child_cfg_create_t child = {
 416                 .lifetime = {
 417                         .time = {
 418                                 .life = 10800 /* 3h */,
 419                                 .rekey = 10200 /* 2h50min */,
 420                                 .jitter = 300 /* 5min */
 421                         },
 422                 },
 423                 .mode = MODE_TUNNEL,
 424         };
 425
 426         /**
 427          * Read parameters
 428          */
 429         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub);
 430         conn = NM_SETTING_CONNECTION(nm_connection_get_setting(connection,
 431                                                                                                 NM_TYPE_SETTING_CONNECTION));
 432         vpn = NM_SETTING_VPN(nm_connection_get_setting(connection,
 433                                                                                                 NM_TYPE_SETTING_VPN));
 434         if (priv->name)
 435         {
 436                 free(priv->name);
 437         }
 438         priv->name = strdup(nm_setting_connection_get_id(conn));
 439         DBG1(DBG_CFG, "received initiate for NetworkManager connection %s",
 440                  priv->name);
 441         DBG4(DBG_CFG, "%s",
 442                  nm_setting_to_string(NM_SETTING(vpn)));
 443         ike.remote = (char*)nm_setting_vpn_get_data_item(vpn, "address");
 444         if (!ike.remote || !*ike.remote)
 445         {
 446                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 447                                         "Gateway address missing.");
 448                 return FALSE;
 449         }
 450         str = nm_setting_vpn_get_data_item(vpn, "virtual");
 451         virtual = streq(str, "yes");
 452         str = nm_setting_vpn_get_data_item(vpn, "encap");
 453         ike.force_encap = streq(str, "yes");
 454         str = nm_setting_vpn_get_data_item(vpn, "ipcomp");
 455         child.options |= streq(str, "yes") ? OPT_IPCOMP : 0;
 456         str = nm_setting_vpn_get_data_item(vpn, "method");
 457         if (streq(str, "psk"))
 458         {
 459                 auth_class = AUTH_CLASS_PSK;
 460         }
 461         else if (streq(str, "agent"))
 462         {
 463                 auth_class = AUTH_CLASS_PUBKEY;
 464                 agent = TRUE;
 465         }
 466         else if (streq(str, "key"))
 467         {
 468                 auth_class = AUTH_CLASS_PUBKEY;
 469         }
 470         else if (streq(str, "smartcard"))
 471         {
 472                 auth_class = AUTH_CLASS_PUBKEY;
 473                 smartcard = TRUE;
 474         }
 475
 476         /**
 477          * Register credentials
 478          */
 479         priv->creds->clear(priv->creds);
 480
 481         /* gateway/CA cert */
 482         str = nm_setting_vpn_get_data_item(vpn, "certificate");
 483         if (str)
 484         {
 485                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 486                                                                   BUILD_FROM_FILE, str, BUILD_END);
 487                 if (!cert)
 488                 {
 489                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 490                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 491                                                 "Loading gateway certificate failed.");
 492                         return FALSE;
 493                 }
 494                 priv->creds->add_certificate(priv->creds, cert);
 495
 496                 x509 = (x509_t*)cert;
 497                 if (!(x509->get_flags(x509) & X509_CA))
 498                 {       /* For a gateway certificate, we use the cert subject as identity. */
 499                         gateway = cert->get_subject(cert);
 500                         gateway = gateway->clone(gateway);
 501                         DBG1(DBG_CFG, "using gateway certificate, identity '%Y'", gateway);
 502                 }
 503         }
 504         else
 505         {
 506                 /* no certificate defined, fall back to system-wide CA certificates */
 507                 priv->creds->load_ca_dir(priv->creds, lib->settings->get_str(
 508                                                                  lib->settings, "charon-nm.ca_dir", NM_CA_DIR));
 509         }
 510         if (!gateway)
 511         {
 512                 /* If the user configured a CA certificate, we use the IP/DNS
 513                  * of the gateway as its identity. This identity will be used for
 514                  * certificate lookup and requires the configured IP/DNS to be
 515                  * included in the gateway certificate. */
 516                 gateway = identification_create_from_string(ike.remote);
 517                 DBG1(DBG_CFG, "using CA certificate, gateway identity '%Y'", gateway);
 518                 loose_gateway_id = TRUE;
 519         }
 520
 521         if (auth_class == AUTH_CLASS_EAP ||
 522                 auth_class == AUTH_CLASS_PSK)
 523         {
 524                 /* username/password or PSK authentication ... */
 525                 str = nm_setting_vpn_get_data_item(vpn, "user");
 526                 if (str)
 527                 {
 528                         user = identification_create_from_string((char*)str);
 529                         str = nm_setting_vpn_get_secret(vpn, "password");
 530                         if (auth_class == AUTH_CLASS_PSK &&
 531                                 strlen(str) < 20)
 532                         {
 533                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 534                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 535                                                         "pre-shared key is too short.");
 536                                 gateway->destroy(gateway);
 537                                 user->destroy(user);
 538                                 return FALSE;
 539                         }
 540                         priv->creds->set_username_password(priv->creds, user, (char*)str);
 541                 }
 542         }
 543
 544         if (auth_class == AUTH_CLASS_PUBKEY)
 545         {
 546                 if (smartcard)
 547                 {
 548                         char *pin;
 549
 550                         pin = (char*)nm_setting_vpn_get_secret(vpn, "password");
 551                         if (pin)
 552                         {
 553                                 user = find_smartcard_key(priv, pin);
 554                         }
 555                         if (!user)
 556                         {
 557                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 558                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 559                                                         "no usable smartcard certificate found.");
 560                                 gateway->destroy(gateway);
 561                                 return FALSE;
 562                         }
 563                 }
 564                 /* ... or certificate/private key authenitcation */
 565                 else if ((str = nm_setting_vpn_get_data_item(vpn, "usercert")))
 566                 {
 567                         public_key_t *public;
 568                         private_key_t *private = NULL;
 569
 570                         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 571                                                                           BUILD_FROM_FILE, str, BUILD_END);
 572                         if (!cert)
 573                         {
 574                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 575                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 576                                                         "Loading peer certificate failed.");
 577                                 gateway->destroy(gateway);
 578                                 return FALSE;
 579                         }
 580                         /* try agent */
 581                         str = nm_setting_vpn_get_secret(vpn, "agent");
 582                         if (agent && str)
 583                         {
 584                                 public = cert->get_public_key(cert);
 585                                 if (public)
 586                                 {
 587                                         private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 588                                                                                                  public->get_type(public),
 589                                                                                                  BUILD_AGENT_SOCKET, str,
 590                                                                                                  BUILD_PUBLIC_KEY, public,
 591                                                                                                  BUILD_END);
 592                                         public->destroy(public);
 593                                 }
 594                                 if (!private)
 595                                 {
 596                                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 597                                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 598                                                                 "Connecting to SSH agent failed.");
 599                                 }
 600                         }
 601                         /* ... or key file */
 602                         str = nm_setting_vpn_get_data_item(vpn, "userkey");
 603                         if (!agent && str)
 604                         {
 605                                 char *secret;
 606
 607                                 secret = (char*)nm_setting_vpn_get_secret(vpn, "password");
 608                                 if (secret)
 609                                 {
 610                                         priv->creds->set_key_password(priv->creds, secret);
 611                                 }
 612                                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 613                                                                 KEY_ANY, BUILD_FROM_FILE, str, BUILD_END);
 614                                 if (!private)
 615                                 {
 616                                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 617                                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 618                                                                 "Loading private key failed.");
 619                                 }
 620                         }
 621                         if (private)
 622                         {
 623                                 user = cert->get_subject(cert);
 624                                 user = user->clone(user);
 625                                 priv->creds->set_cert_and_key(priv->creds, cert, private);
 626                         }
 627                         else
 628                         {
 629                                 DESTROY_IF(cert);
 630                                 gateway->destroy(gateway);
 631                                 return FALSE;
 632                         }
 633                 }
 634         }
 635
 636         if (!user)
 637         {
 638                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 639                                         "Configuration parameters missing.");
 640                 gateway->destroy(gateway);
 641                 return FALSE;
 642         }
 643
 644         /**
 645          * Set up configurations
 646          */
 647         ike_cfg = ike_cfg_create(&ike);
 648
 649         str = nm_setting_vpn_get_data_item(vpn, "proposal");
 650         proposal = streq(str, "yes");
 651         str = nm_setting_vpn_get_data_item(vpn, "ike");
 652         if (proposal && str && strlen(str))
 653         {
 654                 enumerator = enumerator_create_token(str, ";", "");
 655                 while (enumerator->enumerate(enumerator, &str))
 656                 {
 657                         prop = proposal_create_from_string(PROTO_IKE, str);
 658                         if (!prop)
 659                         {
 660                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 661                                                         NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 662                                                         "Invalid IKE proposal.");
 663                                 enumerator->destroy(enumerator);
 664                                 ike_cfg->destroy(ike_cfg);
 665                                 gateway->destroy(gateway);
 666                                 user->destroy(user);
 667                                 return FALSE;
 668                         }
 669                         ike_cfg->add_proposal(ike_cfg, prop);
 670                 }
 671                 enumerator->destroy(enumerator);
 672         }
 673         else
 674         {
 675                 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 676                 ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
 677         }
 678
 679         peer_cfg = peer_cfg_create(priv->name, ike_cfg, &peer);
 680         if (virtual)
 681         {
 682                 peer_cfg->add_virtual_ip(peer_cfg, host_create_any(AF_INET));
 683                 peer_cfg->add_virtual_ip(peer_cfg, host_create_any(AF_INET6));
 684         }
 685         auth = auth_cfg_create();
 686         auth->add(auth, AUTH_RULE_AUTH_CLASS, auth_class);
 687         auth->add(auth, AUTH_RULE_IDENTITY, user);
 688         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 689         auth = auth_cfg_create();
 690         if (auth_class == AUTH_CLASS_PSK)
 691         {
 692                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
 693         }
 694         else
 695         {
 696                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 697         }
 698         auth->add(auth, AUTH_RULE_IDENTITY, gateway);
 699         auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, loose_gateway_id);
 700         peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 701
 702         child_cfg = child_cfg_create(priv->name, &child);
 703         str = nm_setting_vpn_get_data_item(vpn, "esp");
 704         if (proposal && str && strlen(str))
 705         {
 706                 enumerator = enumerator_create_token(str, ";", "");
 707                 while (enumerator->enumerate(enumerator, &str))
 708                 {
 709                         prop = proposal_create_from_string(PROTO_ESP, str);
 710                         if (!prop)
 711                         {
 712                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 713                                                         NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 714                                                         "Invalid ESP proposal.");
 715                                 enumerator->destroy(enumerator);
 716                                 child_cfg->destroy(child_cfg);
 717                                 peer_cfg->destroy(peer_cfg);
 718                                 return FALSE;
 719                         }
 720                         child_cfg->add_proposal(child_cfg, prop);
 721                 }
 722                 enumerator->destroy(enumerator);
 723         }
 724         else
 725         {
 726                 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 727                 child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
 728         }
 729         ts = traffic_selector_create_dynamic(0, 0, 65535);
 730         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 731         ts = traffic_selector_create_from_cidr("0.0.0.0/0", 0, 0, 65535);
 732         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 733         ts = traffic_selector_create_from_cidr("::/0", 0, 0, 65535);
 734         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 735         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 736
 737         /**
 738          * Prepare IKE_SA
 739          */
 740         ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 741                                                                                                                 peer_cfg);
 742         if (!ike_sa)
 743         {
 744                 peer_cfg->destroy(peer_cfg);
 745                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 746                                         "IKE version not supported.");
 747                 return FALSE;
 748         }
 749         if (!ike_sa->get_peer_cfg(ike_sa))
 750         {
 751                 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
 752         }
 753         peer_cfg->destroy(peer_cfg);
 754
 755         /**
 756          * Register listener, enable  initiate-failure-detection hooks
 757          */
 758         priv->ike_sa = ike_sa;
 759         priv->listener.ike_state_change = ike_state_change;
 760         priv->listener.child_state_change = child_state_change;
 761         charon->bus->add_listener(charon->bus, &priv->listener);
 762
 763         /**
 764          * Initiate
 765          */
 766         child_cfg->get_ref(child_cfg);
 767         if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
 768         {
 769                 charon->bus->remove_listener(charon->bus, &priv->listener);
 770                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 771
 772                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 773                                         "Initiating failed.");
 774                 return FALSE;
 775         }
 776         charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 777         return TRUE;
 778 }
 779
 780 /**
 781  * NeedSecrets called from NM via DBUS
 782  */
 783 static gboolean need_secrets(NMVpnServicePlugin *plugin, NMConnection *connection,
 784                                                          const char **setting_name, GError **error)
 785 {
 786         NMSettingVpn *settings;
 787         const char *method, *path;
 788
 789         settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
 790                                                                                                                 NM_TYPE_SETTING_VPN));
 791         method = nm_setting_vpn_get_data_item(settings, "method");
 792         if (method)
 793         {
 794                 if (streq(method, "eap") || streq(method, "psk"))
 795                 {
 796                         if (nm_setting_vpn_get_secret(settings, "password"))
 797                         {
 798                                 return FALSE;
 799                         }
 800                 }
 801                 else if (streq(method, "agent"))
 802                 {
 803                         if (nm_setting_vpn_get_secret(settings, "agent"))
 804                         {
 805                                 return FALSE;
 806                         }
 807                 }
 808                 else if (streq(method, "key"))
 809                 {
 810                         path = nm_setting_vpn_get_data_item(settings, "userkey");
 811                         if (path)
 812                         {
 813                                 private_key_t *key;
 814
 815                                 /* try to load/decrypt the private key */
 816                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 817                                                                 KEY_ANY, BUILD_FROM_FILE, path, BUILD_END);
 818                                 if (key)
 819                                 {
 820                                         key->destroy(key);
 821                                         return FALSE;
 822                                 }
 823                                 else if (nm_setting_vpn_get_secret(settings, "password"))
 824                                 {
 825                                         return FALSE;
 826                                 }
 827                         }
 828                 }
 829                 else if (streq(method, "smartcard"))
 830                 {
 831                         if (nm_setting_vpn_get_secret(settings, "password"))
 832                         {
 833                                 return FALSE;
 834                         }
 835                 }
 836         }
 837         *setting_name = NM_SETTING_VPN_SETTING_NAME;
 838         return TRUE;
 839 }
 840
 841 /**
 842  * The actual disconnection
 843  */
 844 static gboolean do_disconnect(gpointer plugin)
 845 {
 846         NMStrongswanPluginPrivate *priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 847         enumerator_t *enumerator;
 848         ike_sa_t *ike_sa;
 849         u_int id;
 850
 851         /* our ike_sa pointer might be invalid, lookup sa */
 852         enumerator = charon->controller->create_ike_sa_enumerator(
 853                                                                                                         charon->controller, TRUE);
 854         while (enumerator->enumerate(enumerator, &ike_sa))
 855         {
 856                 if (priv->ike_sa == ike_sa)
 857                 {
 858                         id = ike_sa->get_unique_id(ike_sa);
 859                         enumerator->destroy(enumerator);
 860                         charon->controller->terminate_ike(charon->controller, id, FALSE,
 861                                                                                           controller_cb_empty, NULL, 0);
 862                         return FALSE;
 863                 }
 864         }
 865         enumerator->destroy(enumerator);
 866
 867         g_debug("Connection not found.");
 868         return FALSE;
 869 }
 870
 871 /**
 872  * Disconnect called from NM via DBUS
 873  */
 874 static gboolean disconnect(NMVpnServicePlugin *plugin, GError **err)
 875 {
 876         /* enqueue the actual disconnection, because we may be called in
 877          * response to a listener_t callback and the SA enumeration would
 878          * possibly deadlock. */
 879         g_idle_add(do_disconnect, plugin);
 880
 881         return TRUE;
 882 }
 883
 884 /**
 885  * Initializer
 886  */
 887 static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
 888 {
 889         NMStrongswanPluginPrivate *priv;
 890
 891         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 892         priv->plugin = NM_VPN_SERVICE_PLUGIN(plugin);
 893         memset(&priv->listener, 0, sizeof(listener_t));
 894         priv->listener.child_updown = child_updown;
 895         priv->listener.ike_rekey = ike_rekey;
 896         priv->name = NULL;
 897 }
 898
 899 /**
 900  * Class constructor
 901  */
 902 static void nm_strongswan_plugin_class_init(
 903                                                                         NMStrongswanPluginClass *strongswan_class)
 904 {
 905         NMVpnServicePluginClass *parent_class = NM_VPN_SERVICE_PLUGIN_CLASS(strongswan_class);
 906
 907         parent_class->connect = connect_;
 908         parent_class->need_secrets = need_secrets;
 909         parent_class->disconnect = disconnect;
 910 }
 911
 912 /**
 913  * Object constructor
 914  */
 915 NMStrongswanPlugin *nm_strongswan_plugin_new(nm_creds_t *creds,
 916                                                                                          nm_handler_t *handler)
 917 {
 918         GError *error = NULL;
 919
 920         NMStrongswanPlugin *plugin = (NMStrongswanPlugin *)g_initable_new (
 921                                         NM_TYPE_STRONGSWAN_PLUGIN,
 922                                         NULL,
 923                                         &error,
 924                                         NM_VPN_SERVICE_PLUGIN_DBUS_SERVICE_NAME, NM_DBUS_SERVICE_STRONGSWAN,
 925                                         NULL);
 926
 927         if (plugin)
 928         {
 929                 NMStrongswanPluginPrivate *priv;
 930
 931                 /* the rest of the initialization happened in _init above */
 932                 priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 933                 priv->creds = creds;
 934                 priv->handler = handler;
 935         }
 936         else
 937         {
 938                 g_warning ("Failed to initialize a plugin instance: %s", error->message);
 939                 g_error_free (error);
 940         }
 941
 942         return plugin;
 943 }