src/charon-nm/nm/nm_service.c

   1 /*
   2  * Copyright (C) 2008-2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <nm-setting-vpn.h>
  17 #include <nm-setting-connection.h>
  18 #include "nm_service.h"
  19
  20 #include <daemon.h>
  21 #include <utils/host.h>
  22 #include <utils/identification.h>
  23 #include <config/peer_cfg.h>
  24 #include <credentials/certificates/x509.h>
  25
  26 #include <stdio.h>
  27
  28 G_DEFINE_TYPE(NMStrongswanPlugin, nm_strongswan_plugin, NM_TYPE_VPN_PLUGIN)
  29
  30 /**
  31  * Private data of NMStrongswanPlugin
  32  */
  33 typedef struct {
  34         /* implements bus listener interface */
  35         listener_t listener;
  36         /* IKE_SA we are listening on */
  37         ike_sa_t *ike_sa;
  38         /* backref to public plugin */
  39         NMVPNPlugin *plugin;
  40         /* credentials to use for authentication */
  41         nm_creds_t *creds;
  42         /* attribute handler for DNS/NBNS server information */
  43         nm_handler_t *handler;
  44         /* name of the connection */
  45         char *name;
  46 } NMStrongswanPluginPrivate;
  47
  48 #define NM_STRONGSWAN_PLUGIN_GET_PRIVATE(o) \
  49                         (G_TYPE_INSTANCE_GET_PRIVATE ((o), \
  50                                 NM_TYPE_STRONGSWAN_PLUGIN, NMStrongswanPluginPrivate))
  51
  52 /**
  53  * convert enumerated handler chunks to a UINT_ARRAY GValue
  54  */
  55 static GValue* handler_to_val(nm_handler_t *handler,
  56                                                          configuration_attribute_type_t type)
  57 {
  58         GValue *val;
  59         GArray *array;
  60         enumerator_t *enumerator;
  61         chunk_t chunk;
  62
  63         enumerator = handler->create_enumerator(handler, type);
  64         array = g_array_new (FALSE, TRUE, sizeof (guint32));
  65         while (enumerator->enumerate(enumerator, &chunk))
  66         {
  67                 g_array_append_val (array, *(u_int32_t*)chunk.ptr);
  68         }
  69         enumerator->destroy(enumerator);
  70         val = g_slice_new0 (GValue);
  71         g_value_init (val, DBUS_TYPE_G_UINT_ARRAY);
  72         g_value_set_boxed (val, array);
  73
  74         return val;
  75 }
  76
  77 /**
  78  * signal IPv4 config to NM, set connection as established
  79  */
  80 static void signal_ipv4_config(NMVPNPlugin *plugin,
  81                                                            ike_sa_t *ike_sa, child_sa_t *child_sa)
  82 {
  83         GValue *val;
  84         GHashTable *config;
  85         host_t *me;
  86         nm_handler_t *handler;
  87
  88         config = g_hash_table_new(g_str_hash, g_str_equal);
  89         me = ike_sa->get_my_host(ike_sa);
  90         handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->handler;
  91
  92         /* NM requires a tundev, but netkey does not use one. Passing the physical
  93          * interface does not work, as NM fiddles around with it. Passing the
  94          * loopback seems to work, though... */
  95         val = g_slice_new0 (GValue);
  96         g_value_init (val, G_TYPE_STRING);
  97         g_value_set_string (val, "lo");
  98         g_hash_table_insert (config, NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
  99
 100         val = g_slice_new0(GValue);
 101         g_value_init(val, G_TYPE_UINT);
 102         g_value_set_uint(val, *(u_int32_t*)me->get_address(me).ptr);
 103         g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
 104
 105         val = g_slice_new0(GValue);
 106         g_value_init(val, G_TYPE_UINT);
 107         g_value_set_uint(val, me->get_address(me).len * 8);
 108         g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_PREFIX, val);
 109
 110         val = handler_to_val(handler, INTERNAL_IP4_DNS);
 111         g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
 112
 113         val = handler_to_val(handler, INTERNAL_IP4_NBNS);
 114         g_hash_table_insert(config, NM_VPN_PLUGIN_IP4_CONFIG_NBNS, val);
 115
 116         handler->reset(handler);
 117
 118         nm_vpn_plugin_set_ip4_config(plugin, config);
 119 }
 120
 121 /**
 122  * signal failure to NM, connecting failed
 123  */
 124 static void signal_failure(NMVPNPlugin *plugin, NMVPNPluginFailure failure)
 125 {
 126         nm_handler_t *handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin)->handler;
 127
 128         handler->reset(handler);
 129
 130         /* TODO: NM does not handle this failure!? */
 131         nm_vpn_plugin_failure(plugin, failure);
 132         nm_vpn_plugin_set_state(plugin, NM_VPN_SERVICE_STATE_STOPPED);
 133 }
 134
 135 /**
 136  * Implementation of listener_t.ike_state_change
 137  */
 138 static bool ike_state_change(listener_t *listener, ike_sa_t *ike_sa,
 139                                                          ike_sa_state_t state)
 140 {
 141         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 142
 143         if (private->ike_sa == ike_sa && state == IKE_DESTROYING)
 144         {
 145                 signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_LOGIN_FAILED);
 146                 return FALSE;
 147         }
 148         return TRUE;
 149 }
 150
 151 /**
 152  * Implementation of listener_t.child_state_change
 153  */
 154 static bool child_state_change(listener_t *listener, ike_sa_t *ike_sa,
 155                                                            child_sa_t *child_sa, child_sa_state_t state)
 156 {
 157         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 158
 159         if (private->ike_sa == ike_sa && state == CHILD_DESTROYING)
 160         {
 161                 signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 162                 return FALSE;
 163         }
 164         return TRUE;
 165 }
 166
 167 /**
 168  * Implementation of listener_t.child_updown
 169  */
 170 static bool child_updown(listener_t *listener, ike_sa_t *ike_sa,
 171                                                  child_sa_t *child_sa, bool up)
 172 {
 173         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 174
 175         if (private->ike_sa == ike_sa)
 176         {
 177                 if (up)
 178                 {       /* disable initiate-failure-detection hooks */
 179                         private->listener.ike_state_change = NULL;
 180                         private->listener.child_state_change = NULL;
 181                         signal_ipv4_config(private->plugin, ike_sa, child_sa);
 182                 }
 183                 else
 184                 {
 185                         signal_failure(private->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 186                         return FALSE;
 187                 }
 188         }
 189         return TRUE;
 190 }
 191
 192 /**
 193  * Implementation of listener_t.ike_rekey
 194  */
 195 static bool ike_rekey(listener_t *listener, ike_sa_t *old, ike_sa_t *new)
 196 {
 197         NMStrongswanPluginPrivate *private = (NMStrongswanPluginPrivate*)listener;
 198
 199         if (private->ike_sa == old)
 200         {       /* follow a rekeyed IKE_SA */
 201                 private->ike_sa = new;
 202         }
 203         return TRUE;
 204 }
 205
 206 /**
 207  * Find a certificate for which we have a private key on a smartcard
 208  */
 209 static identification_t *find_smartcard_key(NMStrongswanPluginPrivate *priv,
 210                                                                                         char *pin)
 211 {
 212         enumerator_t *enumerator, *sans;
 213         identification_t *id = NULL;
 214         certificate_t *cert;
 215         x509_t *x509;
 216         private_key_t *key;
 217         chunk_t keyid;
 218
 219         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 220                                                                                         CERT_X509, KEY_ANY, NULL, FALSE);
 221         while (enumerator->enumerate(enumerator, &cert))
 222         {
 223                 x509 = (x509_t*)cert;
 224
 225                 /* there might be a lot of certificates, filter them by usage */
 226                 if ((x509->get_flags(x509) & X509_CLIENT_AUTH) &&
 227                         !(x509->get_flags(x509) & X509_CA))
 228                 {
 229                         keyid = x509->get_subjectKeyIdentifier(x509);
 230                         if (keyid.ptr)
 231                         {
 232                                 /* try to find a private key by the certificate keyid */
 233                                 priv->creds->set_pin(priv->creds, keyid, pin);
 234                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 235                                                                 KEY_ANY, BUILD_PKCS11_KEYID, keyid, BUILD_END);
 236                                 if (key)
 237                                 {
 238                                         /* prefer a more convenient subjectAltName */
 239                                         sans = x509->create_subjectAltName_enumerator(x509);
 240                                         if (!sans->enumerate(sans, &id))
 241                                         {
 242                                                 id = cert->get_subject(cert);
 243                                         }
 244                                         id = id->clone(id);
 245                                         sans->destroy(sans);
 246
 247                                         DBG1(DBG_CFG, "using smartcard certificate '%Y'", id);
 248                                         priv->creds->set_cert_and_key(priv->creds,
 249                                                                                                   cert->get_ref(cert), key);
 250                                         break;
 251                                 }
 252                         }
 253                 }
 254         }
 255         enumerator->destroy(enumerator);
 256         return id;
 257 }
 258
 259 /**
 260  * Connect function called from NM via DBUS
 261  */
 262 static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
 263                                                  GError **err)
 264 {
 265         NMStrongswanPluginPrivate *priv;
 266         NMSettingConnection *conn;
 267         NMSettingVPN *vpn;
 268         identification_t *user = NULL, *gateway = NULL;
 269         const char *address, *str;
 270         bool virtual, encap, ipcomp;
 271         ike_cfg_t *ike_cfg;
 272         peer_cfg_t *peer_cfg;
 273         child_cfg_t *child_cfg;
 274         traffic_selector_t *ts;
 275         ike_sa_t *ike_sa;
 276         auth_cfg_t *auth;
 277         auth_class_t auth_class = AUTH_CLASS_EAP;
 278         certificate_t *cert = NULL;
 279         x509_t *x509;
 280         bool agent = FALSE, smartcard = FALSE;
 281         lifetime_cfg_t lifetime = {
 282                 .time = {
 283                         .life = 10800 /* 3h */,
 284                         .rekey = 10200 /* 2h50min */,
 285                         .jitter = 300 /* 5min */
 286                 }
 287         };
 288
 289         /**
 290          * Read parameters
 291          */
 292         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 293         conn = NM_SETTING_CONNECTION(nm_connection_get_setting(connection,
 294                                                                                                 NM_TYPE_SETTING_CONNECTION));
 295         vpn = NM_SETTING_VPN(nm_connection_get_setting(connection,
 296                                                                                                 NM_TYPE_SETTING_VPN));
 297         if (priv->name)
 298         {
 299                 free(priv->name);
 300         }
 301         priv->name = strdup(nm_setting_connection_get_id(conn));
 302         DBG1(DBG_CFG, "received initiate for NetworkManager connection %s",
 303                  priv->name);
 304         DBG4(DBG_CFG, "%s",
 305                  nm_setting_to_string(NM_SETTING(vpn)));
 306         address = nm_setting_vpn_get_data_item(vpn, "address");
 307         if (!address || !*address)
 308         {
 309                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 310                                         "Gateway address missing.");
 311                 return FALSE;
 312         }
 313         str = nm_setting_vpn_get_data_item(vpn, "virtual");
 314         virtual = str && streq(str, "yes");
 315         str = nm_setting_vpn_get_data_item(vpn, "encap");
 316         encap = str && streq(str, "yes");
 317         str = nm_setting_vpn_get_data_item(vpn, "ipcomp");
 318         ipcomp = str && streq(str, "yes");
 319         str = nm_setting_vpn_get_data_item(vpn, "method");
 320         if (str)
 321         {
 322                 if (streq(str, "psk"))
 323                 {
 324                         auth_class = AUTH_CLASS_PSK;
 325                 }
 326                 else if (streq(str, "agent"))
 327                 {
 328                         auth_class = AUTH_CLASS_PUBKEY;
 329                         agent = TRUE;
 330                 }
 331                 else if (streq(str, "key"))
 332                 {
 333                         auth_class = AUTH_CLASS_PUBKEY;
 334                 }
 335                 else if (streq(str, "smartcard"))
 336                 {
 337                         auth_class = AUTH_CLASS_PUBKEY;
 338                         smartcard = TRUE;
 339                 }
 340         }
 341
 342         /**
 343          * Register credentials
 344          */
 345         priv->creds->clear(priv->creds);
 346
 347         /* gateway/CA cert */
 348         str = nm_setting_vpn_get_data_item(vpn, "certificate");
 349         if (str)
 350         {
 351                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 352                                                                   BUILD_FROM_FILE, str, BUILD_END);
 353                 if (!cert)
 354                 {
 355                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 356                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 357                                                 "Loading gateway certificate failed.");
 358                         return FALSE;
 359                 }
 360                 priv->creds->add_certificate(priv->creds, cert);
 361
 362                 x509 = (x509_t*)cert;
 363                 if (!(x509->get_flags(x509) & X509_CA))
 364                 {       /* For a gateway certificate, we use the cert subject as identity. */
 365                         gateway = cert->get_subject(cert);
 366                         gateway = gateway->clone(gateway);
 367                         DBG1(DBG_CFG, "using gateway certificate, identity '%Y'", gateway);
 368                 }
 369         }
 370         else
 371         {
 372                 /* no certificate defined, fall back to system-wide CA certificates */
 373                 priv->creds->load_ca_dir(priv->creds, NM_CA_DIR);
 374         }
 375         if (!gateway)
 376         {
 377                 /* If the user configured a CA certificate, we use the IP/DNS
 378                  * of the gateway as its identity. This identity will be used for
 379                  * certificate lookup and requires the configured IP/DNS to be
 380                  * included in the gateway certificate. */
 381                 gateway = identification_create_from_string((char*)address);
 382                 DBG1(DBG_CFG, "using CA certificate, gateway identity '%Y'", gateway);
 383         }
 384
 385         if (auth_class == AUTH_CLASS_EAP)
 386         {
 387                 /* username/password authentication ... */
 388                 str = nm_setting_vpn_get_data_item(vpn, "user");
 389                 if (str)
 390                 {
 391                         user = identification_create_from_string((char*)str);
 392                         str = nm_setting_vpn_get_secret(vpn, "password");
 393                         priv->creds->set_username_password(priv->creds, user, (char*)str);
 394                 }
 395         }
 396
 397         if (auth_class == AUTH_CLASS_PUBKEY)
 398         {
 399                 if (smartcard)
 400                 {
 401                         char *pin;
 402
 403                         pin = (char*)nm_setting_vpn_get_secret(vpn, "password");
 404                         if (pin)
 405                         {
 406                                 user = find_smartcard_key(priv, pin);
 407                         }
 408                         if (!user)
 409                         {
 410                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 411                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 412                                                         "no usable smartcard certificate found.");
 413                                 gateway->destroy(gateway);
 414                                 return FALSE;
 415                         }
 416                 }
 417                 /* ... or certificate/private key authenitcation */
 418                 else if ((str = nm_setting_vpn_get_data_item(vpn, "usercert")))
 419                 {
 420                         public_key_t *public;
 421                         private_key_t *private = NULL;
 422
 423                         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 424                                                                           BUILD_FROM_FILE, str, BUILD_END);
 425                         if (!cert)
 426                         {
 427                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 428                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 429                                                         "Loading peer certificate failed.");
 430                                 gateway->destroy(gateway);
 431                                 return FALSE;
 432                         }
 433                         /* try agent */
 434                         str = nm_setting_vpn_get_secret(vpn, "agent");
 435                         if (agent && str)
 436                         {
 437                                 public = cert->get_public_key(cert);
 438                                 if (public)
 439                                 {
 440                                         private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 441                                                                                                  public->get_type(public),
 442                                                                                                  BUILD_AGENT_SOCKET, str,
 443                                                                                                  BUILD_PUBLIC_KEY, public,
 444                                                                                                  BUILD_END);
 445                                         public->destroy(public);
 446                                 }
 447                                 if (!private)
 448                                 {
 449                                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 450                                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 451                                                                 "Connecting to SSH agent failed.");
 452                                 }
 453                         }
 454                         /* ... or key file */
 455                         str = nm_setting_vpn_get_data_item(vpn, "userkey");
 456                         if (!agent && str)
 457                         {
 458                                 char *secret;
 459
 460                                 secret = (char*)nm_setting_vpn_get_secret(vpn, "password");
 461                                 if (secret)
 462                                 {
 463                                         priv->creds->set_key_password(priv->creds, secret);
 464                                 }
 465                                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 466                                                                 KEY_RSA, BUILD_FROM_FILE, str, BUILD_END);
 467                                 if (!private)
 468                                 {
 469                                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 470                                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 471                                                                 "Loading private key failed.");
 472                                 }
 473                         }
 474                         if (private)
 475                         {
 476                                 user = cert->get_subject(cert);
 477                                 user = user->clone(user);
 478                                 priv->creds->set_cert_and_key(priv->creds, cert, private);
 479                         }
 480                         else
 481                         {
 482                                 DESTROY_IF(cert);
 483                                 gateway->destroy(gateway);
 484                                 return FALSE;
 485                         }
 486                 }
 487         }
 488
 489         if (!user)
 490         {
 491                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 492                                         "Configuration parameters missing.");
 493                 gateway->destroy(gateway);
 494                 return FALSE;
 495         }
 496
 497         /**
 498          * Set up configurations
 499          */
 500         ike_cfg = ike_cfg_create(TRUE, encap, "0.0.0.0", FALSE,
 501                                                          charon->socket->get_port(charon->socket, FALSE),
 502                                                         (char*)address, FALSE, IKEV2_UDP_PORT);
 503         ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 504         peer_cfg = peer_cfg_create(priv->name, IKEV2, ike_cfg,
 505                                         CERT_SEND_IF_ASKED, UNIQUE_REPLACE, 1, /* keyingtries */
 506                                         36000, 0, /* rekey 10h, reauth none */
 507                                         600, 600, /* jitter, over 10min */
 508                                         TRUE, FALSE, /* mobike, aggressive */
 509                                         0, 0, /* DPD delay, timeout */
 510                                         virtual ? host_create_from_string("0.0.0.0", 0) : NULL,
 511                                         NULL, FALSE, NULL, NULL); /* pool, mediation */
 512         auth = auth_cfg_create();
 513         auth->add(auth, AUTH_RULE_AUTH_CLASS, auth_class);
 514         auth->add(auth, AUTH_RULE_IDENTITY, user);
 515         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 516         auth = auth_cfg_create();
 517         auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 518         auth->add(auth, AUTH_RULE_IDENTITY, gateway);
 519         peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 520
 521         child_cfg = child_cfg_create(priv->name, &lifetime,
 522                                                                  NULL, TRUE, MODE_TUNNEL, /* updown, hostaccess */
 523                                                                  ACTION_NONE, ACTION_NONE, ACTION_NONE, ipcomp,
 524                                                                  0, 0, NULL, NULL, 0);
 525         child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 526         ts = traffic_selector_create_dynamic(0, 0, 65535);
 527         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 528         ts = traffic_selector_create_from_string(0, TS_IPV4_ADDR_RANGE,
 529                                                                                          "0.0.0.0", 0,
 530                                                                                          "255.255.255.255", 65535);
 531         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 532         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 533
 534         /**
 535          * Prepare IKE_SA
 536          */
 537         ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 538                                                                                                                 peer_cfg);
 539         if (!ike_sa)
 540         {
 541                 peer_cfg->destroy(peer_cfg);
 542                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 543                                         "IKE version not supported.");
 544                 return FALSE;
 545         }
 546         if (!ike_sa->get_peer_cfg(ike_sa))
 547         {
 548                 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
 549         }
 550         peer_cfg->destroy(peer_cfg);
 551
 552         /**
 553          * Register listener, enable  initiate-failure-detection hooks
 554          */
 555         priv->ike_sa = ike_sa;
 556         priv->listener.ike_state_change = ike_state_change;
 557         priv->listener.child_state_change = child_state_change;
 558         charon->bus->add_listener(charon->bus, &priv->listener);
 559
 560         /**
 561          * Initiate
 562          */
 563         child_cfg->get_ref(child_cfg);
 564         if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
 565         {
 566                 charon->bus->remove_listener(charon->bus, &priv->listener);
 567                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 568
 569                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 570                                         "Initiating failed.");
 571                 return FALSE;
 572         }
 573         charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 574         return TRUE;
 575 }
 576
 577 /**
 578  * NeedSecrets called from NM via DBUS
 579  */
 580 static gboolean need_secrets(NMVPNPlugin *plugin, NMConnection *connection,
 581                                                          char **setting_name, GError **error)
 582 {
 583         NMSettingVPN *settings;
 584         const char *method, *path;
 585
 586         settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
 587                                                                                                                 NM_TYPE_SETTING_VPN));
 588         method = nm_setting_vpn_get_data_item(settings, "method");
 589         if (method)
 590         {
 591                 if (streq(method, "eap"))
 592                 {
 593                         if (nm_setting_vpn_get_secret(settings, "password"))
 594                         {
 595                                 return FALSE;
 596                         }
 597                 }
 598                 else if (streq(method, "agent"))
 599                 {
 600                         if (nm_setting_vpn_get_secret(settings, "agent"))
 601                         {
 602                                 return FALSE;
 603                         }
 604                 }
 605                 else if (streq(method, "key"))
 606                 {
 607                         path = nm_setting_vpn_get_data_item(settings, "userkey");
 608                         if (path)
 609                         {
 610                                 private_key_t *key;
 611
 612                                 /* try to load/decrypt the private key */
 613                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 614                                                                 KEY_RSA, BUILD_FROM_FILE, path, BUILD_END);
 615                                 if (key)
 616                                 {
 617                                         key->destroy(key);
 618                                         return FALSE;
 619                                 }
 620                         }
 621                 }
 622                 else if streq(method, "smartcard")
 623                 {
 624                         if (nm_setting_vpn_get_secret(settings, "password"))
 625                         {
 626                                 return FALSE;
 627                         }
 628                 }
 629         }
 630         *setting_name = NM_SETTING_VPN_SETTING_NAME;
 631         return TRUE;
 632 }
 633
 634 /**
 635  * Disconnect called from NM via DBUS
 636  */
 637 static gboolean disconnect(NMVPNPlugin *plugin, GError **err)
 638 {
 639         NMStrongswanPluginPrivate *priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 640         enumerator_t *enumerator;
 641         ike_sa_t *ike_sa;
 642         u_int id;
 643
 644         /* our ike_sa pointer might be invalid, lookup sa */
 645         enumerator = charon->controller->create_ike_sa_enumerator(
 646                                                                                                         charon->controller, TRUE);
 647         while (enumerator->enumerate(enumerator, &ike_sa))
 648         {
 649                 if (priv->ike_sa == ike_sa)
 650                 {
 651                         id = ike_sa->get_unique_id(ike_sa);
 652                         enumerator->destroy(enumerator);
 653                         charon->controller->terminate_ike(charon->controller, id,
 654                                                                                           controller_cb_empty, NULL, 0);
 655                         return TRUE;
 656                 }
 657         }
 658         enumerator->destroy(enumerator);
 659
 660         g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_GENERAL,
 661                                 "Connection not found.");
 662         return FALSE;
 663 }
 664
 665 /**
 666  * Initializer
 667  */
 668 static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
 669 {
 670         NMStrongswanPluginPrivate *priv;
 671
 672         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 673         priv->plugin = NM_VPN_PLUGIN(plugin);
 674         memset(&priv->listener, 0, sizeof(listener_t));
 675         priv->listener.child_updown = child_updown;
 676         priv->listener.ike_rekey = ike_rekey;
 677 }
 678
 679 /**
 680  * Class constructor
 681  */
 682 static void nm_strongswan_plugin_class_init(
 683                                                                         NMStrongswanPluginClass *strongswan_class)
 684 {
 685         NMVPNPluginClass *parent_class = NM_VPN_PLUGIN_CLASS(strongswan_class);
 686
 687         g_type_class_add_private(G_OBJECT_CLASS(strongswan_class),
 688                                                          sizeof(NMStrongswanPluginPrivate));
 689         parent_class->connect = connect_;
 690         parent_class->need_secrets = need_secrets;
 691         parent_class->disconnect = disconnect;
 692 }
 693
 694 /**
 695  * Object constructor
 696  */
 697 NMStrongswanPlugin *nm_strongswan_plugin_new(nm_creds_t *creds,
 698                                                                                          nm_handler_t *handler)
 699 {
 700         NMStrongswanPlugin *plugin = (NMStrongswanPlugin *)g_object_new (
 701                                         NM_TYPE_STRONGSWAN_PLUGIN,
 702                                         NM_VPN_PLUGIN_DBUS_SERVICE_NAME, NM_DBUS_SERVICE_STRONGSWAN,
 703                                         NULL);
 704         if (plugin)
 705         {
 706                 NMStrongswanPluginPrivate *priv;
 707
 708                 priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 709                 priv->creds = creds;
 710                 priv->handler = handler;
 711                 priv->name = NULL;
 712         }
 713         return plugin;
 714 }
 715