src/charon-nm/nm/nm_service.c

   1 /*
   2  * Copyright (C) 2017 Lubomir Rintel
   3  *
   4  * Copyright (C) 2013-2020 Tobias Brunner
   5  * Copyright (C) 2008-2009 Martin Willi
   6  * HSR Hochschule fuer Technik Rapperswil
   7  *
   8  * This program is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2 of the License, or (at your
  11  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  12  *
  13  * This program is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  15  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16  * for more details.
  17  */
  18
  19 #include "nm_service.h"
  20
  21 #include <daemon.h>
  22 #include <networking/host.h>
  23 #include <utils/identification.h>
  24 #include <config/peer_cfg.h>
  25 #include <credentials/certificates/x509.h>
  26
  27 #include <stdio.h>
  28
  29 /**
  30  * Private data of NMStrongswanPlugin
  31  */
  32 typedef struct {
  33         /* implements bus listener interface */
  34         listener_t listener;
  35         /* IKE_SA we are listening on */
  36         ike_sa_t *ike_sa;
  37         /* backref to public plugin */
  38         NMVpnServicePlugin *plugin;
  39         /* credentials to use for authentication */
  40         nm_creds_t *creds;
  41         /* attribute handler for DNS/NBNS server information */
  42         nm_handler_t *handler;
  43         /* name of the connection */
  44         char *name;
  45 } NMStrongswanPluginPrivate;
  46
  47 G_DEFINE_TYPE_WITH_PRIVATE(NMStrongswanPlugin, nm_strongswan_plugin, NM_TYPE_VPN_SERVICE_PLUGIN)
  48
  49 #define NM_STRONGSWAN_PLUGIN_GET_PRIVATE(o) \
  50                         ((NMStrongswanPluginPrivate*) \
  51                                 nm_strongswan_plugin_get_instance_private (o))
  52
  53 /**
  54  * Convert an address chunk to a GValue
  55  */
  56 static GVariant *addr_to_variant(chunk_t addr)
  57 {
  58         GVariantBuilder builder;
  59         int i;
  60
  61         switch (addr.len)
  62         {
  63                 case 4:
  64                         return g_variant_new_uint32 (*(uint32_t*)addr.ptr);
  65                 case 16:
  66                         g_variant_builder_init (&builder, G_VARIANT_TYPE ("ay"));
  67                         for (i = 0; i < addr.len; i++)
  68                         {
  69                                 g_variant_builder_add (&builder, "y", addr.ptr[i]);
  70
  71                         }
  72                         return g_variant_builder_end (&builder);
  73                 default:
  74                         return NULL;
  75         }
  76 }
  77
  78 /**
  79  * Convert a host to a GValue
  80  */
  81 static GVariant *host_to_variant(host_t *host)
  82 {
  83         return addr_to_variant(host->get_address(host));
  84 }
  85
  86 /**
  87  * Convert enumerated handler chunks to a GValue
  88  */
  89 static GVariant* handler_to_variant(nm_handler_t *handler, char *variant_type,
  90                                                          configuration_attribute_type_t type)
  91 {
  92         GVariantBuilder builder;
  93         enumerator_t *enumerator;
  94         chunk_t *chunk;
  95
  96         g_variant_builder_init (&builder, G_VARIANT_TYPE (variant_type));
  97
  98         enumerator = handler->create_enumerator(handler, type);
  99         while (enumerator->enumerate(enumerator, &chunk))
 100         {
 101                 g_variant_builder_add_value (&builder, addr_to_variant(*chunk));
 102         }
 103         enumerator->destroy(enumerator);
 104
 105         return g_variant_builder_end (&builder);
 106 }
 107
 108 /**
 109  * Signal IP config to NM, set connection as established
 110  */
 111 static void signal_ip_config(NMVpnServicePlugin *plugin,
 112                                                          ike_sa_t *ike_sa, child_sa_t *child_sa)
 113 {
 114         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 115         NMStrongswanPluginPrivate *priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub);
 116         GVariantBuilder builder, ip4builder, ip6builder;
 117         GVariant *ip4config, *ip6config;
 118         enumerator_t *enumerator;
 119         host_t *me, *other, *vip4 = NULL, *vip6 = NULL;
 120         nm_handler_t *handler;
 121
 122         g_variant_builder_init (&builder, G_VARIANT_TYPE_VARDICT);
 123         g_variant_builder_init (&ip4builder, G_VARIANT_TYPE_VARDICT);
 124         g_variant_builder_init (&ip6builder, G_VARIANT_TYPE_VARDICT);
 125
 126         handler = priv->handler;
 127
 128         /* NM apparently requires to know the gateway */
 129         other = ike_sa->get_other_host(ike_sa);
 130         g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY,
 131                                host_to_variant(other));
 132
 133         /* pass the first virtual IPs we got or use the physical IP */
 134         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, TRUE);
 135         while (enumerator->enumerate(enumerator, &me))
 136         {
 137                 switch (me->get_family(me))
 138                 {
 139                         case AF_INET:
 140                                 if (!vip4)
 141                                 {
 142                                         vip4 = me;
 143                                 }
 144                                 break;
 145                         case AF_INET6:
 146                                 if (!vip6)
 147                                 {
 148                                         vip6 = me;
 149                                 }
 150                                 break;
 151                 }
 152         }
 153         enumerator->destroy(enumerator);
 154         if (!vip4 && !vip6)
 155         {
 156                 me = ike_sa->get_my_host(ike_sa);
 157                 switch (me->get_family(me))
 158                 {
 159                         case AF_INET:
 160                                 vip4 = me;
 161                                 break;
 162                         case AF_INET6:
 163                                 vip6 = me;
 164                                 break;
 165                 }
 166         }
 167
 168         if (vip4)
 169         {
 170                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS,
 171                                                            host_to_variant(vip4));
 172                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PREFIX,
 173                                                            g_variant_new_uint32 (vip4->get_address(vip4).len * 8));
 174
 175                 /* prevent NM from changing the default route. we set our own route in our
 176                  * own routing table
 177                  */
 178                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT,
 179                                                            g_variant_new_boolean (TRUE));
 180
 181                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS,
 182                                                            handler_to_variant(handler, "au", INTERNAL_IP4_DNS));
 183
 184                 g_variant_builder_add (&ip4builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NBNS,
 185                                                            handler_to_variant(handler, "au", INTERNAL_IP4_NBNS));
 186         }
 187
 188         if (vip6)
 189         {
 190                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_ADDRESS,
 191                                                            host_to_variant(vip6));
 192                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_PREFIX,
 193                                                            g_variant_new_uint32 (vip6->get_address(vip6).len * 8));
 194                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_NEVER_DEFAULT,
 195                                                            g_variant_new_boolean (TRUE));
 196                 g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_DNS,
 197                                                            handler_to_variant(handler, "aay", INTERNAL_IP6_DNS));
 198                 /* NM_VPN_PLUGIN_IP6_CONFIG_NBNS is not defined */
 199         }
 200
 201         ip4config = g_variant_builder_end (&ip4builder);
 202         if (g_variant_n_children (ip4config))
 203         {
 204                 g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4,
 205                                                            g_variant_new_boolean (TRUE));
 206         }
 207         else
 208         {
 209                 g_variant_unref (ip4config);
 210                 ip4config = NULL;
 211         }
 212
 213         ip6config = g_variant_builder_end (&ip6builder);
 214         if (g_variant_n_children (ip6config))
 215         {
 216                 g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6,
 217                                                            g_variant_new_boolean (TRUE));
 218         }
 219         else
 220         {
 221                 g_variant_unref (ip6config);
 222                 ip6config = NULL;
 223         }
 224
 225         handler->reset(handler);
 226
 227         nm_vpn_service_plugin_set_config (plugin, g_variant_builder_end (&builder));
 228         if (ip4config)
 229         {
 230                 nm_vpn_service_plugin_set_ip4_config (plugin, ip4config);
 231         }
 232         if (ip6config)
 233         {
 234                 nm_vpn_service_plugin_set_ip6_config (plugin, ip6config);
 235         }
 236 }
 237
 238 /**
 239  * signal failure to NM, connecting failed
 240  */
 241 static void signal_failure(NMVpnServicePlugin *plugin, NMVpnPluginFailure failure)
 242 {
 243         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 244         nm_handler_t *handler = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub)->handler;
 245
 246         handler->reset(handler);
 247
 248         nm_vpn_service_plugin_failure(plugin, failure);
 249 }
 250
 251 METHOD(listener_t, ike_state_change, bool,
 252         NMStrongswanPluginPrivate *this, ike_sa_t *ike_sa, ike_sa_state_t state)
 253 {
 254         if (this->ike_sa == ike_sa && state == IKE_DESTROYING)
 255         {
 256                 signal_failure(this->plugin, NM_VPN_PLUGIN_FAILURE_LOGIN_FAILED);
 257         }
 258         return TRUE;
 259 }
 260
 261 METHOD(listener_t, child_state_change, bool,
 262         NMStrongswanPluginPrivate *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
 263         child_sa_state_t state)
 264 {
 265         if (this->ike_sa == ike_sa && state == CHILD_DESTROYING)
 266         {
 267                 signal_failure(this->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 268         }
 269         return TRUE;
 270 }
 271
 272 METHOD(listener_t, ike_rekey, bool,
 273         NMStrongswanPluginPrivate *this, ike_sa_t *old, ike_sa_t *new)
 274 {
 275         if (this->ike_sa == old)
 276         {       /* follow a rekeyed IKE_SA */
 277                 this->ike_sa = new;
 278         }
 279         return TRUE;
 280 }
 281
 282 METHOD(listener_t, ike_reestablish_pre, bool,
 283         NMStrongswanPluginPrivate *this, ike_sa_t *old, ike_sa_t *new)
 284 {
 285         if (this->ike_sa == old)
 286         {       /* ignore child state changes during redirects etc. (task migration) */
 287                 this->listener.child_state_change = NULL;
 288         }
 289         return TRUE;
 290 }
 291
 292 METHOD(listener_t, ike_reestablish_post, bool,
 293         NMStrongswanPluginPrivate *this, ike_sa_t *old, ike_sa_t *new,
 294         bool initiated)
 295 {
 296         if (this->ike_sa == old && initiated)
 297         {       /* if we get redirected during IKE_AUTH we just migrate to the new SA */
 298                 this->ike_sa = new;
 299                 /* re-register hooks to detect initiation failures */
 300                 this->listener.ike_state_change = _ike_state_change;
 301                 this->listener.child_state_change = _child_state_change;
 302         }
 303         return TRUE;
 304 }
 305
 306 METHOD(listener_t, child_updown, bool,
 307         NMStrongswanPluginPrivate *this, ike_sa_t *ike_sa, child_sa_t *child_sa,
 308         bool up)
 309 {
 310         if (this->ike_sa == ike_sa)
 311         {
 312                 if (up)
 313                 {       /* disable initiate-failure-detection hooks */
 314                         this->listener.ike_state_change = NULL;
 315                         this->listener.child_state_change = NULL;
 316                         signal_ip_config(this->plugin, ike_sa, child_sa);
 317                 }
 318                 else
 319                 {
 320                         if (ike_sa->has_condition(ike_sa, COND_REAUTHENTICATING))
 321                         {       /* we ignore this during reauthentication */
 322                                 return TRUE;
 323                         }
 324                         signal_failure(this->plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
 325                 }
 326         }
 327         return TRUE;
 328 }
 329
 330 /**
 331  * Find a certificate for which we have a private key on a smartcard
 332  */
 333 static identification_t *find_smartcard_key(NMStrongswanPluginPrivate *priv,
 334                                                                                         char *pin)
 335 {
 336         enumerator_t *enumerator, *sans;
 337         identification_t *id = NULL;
 338         certificate_t *cert;
 339         x509_t *x509;
 340         private_key_t *key;
 341         chunk_t keyid;
 342
 343         enumerator = lib->credmgr->create_cert_enumerator(lib->credmgr,
 344                                                                                         CERT_X509, KEY_ANY, NULL, FALSE);
 345         while (enumerator->enumerate(enumerator, &cert))
 346         {
 347                 x509 = (x509_t*)cert;
 348
 349                 /* there might be a lot of certificates, filter them by usage */
 350                 if ((x509->get_flags(x509) & X509_CLIENT_AUTH) &&
 351                         !(x509->get_flags(x509) & X509_CA))
 352                 {
 353                         keyid = x509->get_subjectKeyIdentifier(x509);
 354                         if (keyid.ptr)
 355                         {
 356                                 /* try to find a private key by the certificate keyid */
 357                                 priv->creds->set_pin(priv->creds, keyid, pin);
 358                                 key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 359                                                                 KEY_ANY, BUILD_PKCS11_KEYID, keyid, BUILD_END);
 360                                 if (key)
 361                                 {
 362                                         /* prefer a more convenient subjectAltName */
 363                                         sans = x509->create_subjectAltName_enumerator(x509);
 364                                         if (!sans->enumerate(sans, &id))
 365                                         {
 366                                                 id = cert->get_subject(cert);
 367                                         }
 368                                         id = id->clone(id);
 369                                         sans->destroy(sans);
 370
 371                                         DBG1(DBG_CFG, "using smartcard certificate '%Y'", id);
 372                                         priv->creds->set_cert_and_key(priv->creds,
 373                                                                                                   cert->get_ref(cert), key);
 374                                         break;
 375                                 }
 376                         }
 377                 }
 378         }
 379         enumerator->destroy(enumerator);
 380         return id;
 381 }
 382
 383 /**
 384  * Add a client auth config for certificate authentication
 385  */
 386 static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
 387                                                           NMSettingVpn *vpn, peer_cfg_t *peer_cfg,
 388                                                           GError **err)
 389 {
 390         identification_t *id = NULL;
 391         certificate_t *cert = NULL;
 392         auth_cfg_t *auth;
 393         const char *str, *method, *cert_source;
 394
 395         method = nm_setting_vpn_get_data_item(vpn, "method");
 396         cert_source = nm_setting_vpn_get_data_item(vpn, "cert-source") ?: method;
 397
 398         if (streq(cert_source, "smartcard"))
 399         {
 400                 char *pin;
 401
 402                 pin = (char*)nm_setting_vpn_get_secret(vpn, "password");
 403                 if (pin)
 404                 {
 405                         id = find_smartcard_key(priv, pin);
 406                 }
 407                 if (!id)
 408                 {
 409                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 410                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 411                                                 "No usable smartcard certificate found.");
 412                         return FALSE;
 413                 }
 414         }
 415         /* ... or certificate/private key authentication */
 416         else if ((str = nm_setting_vpn_get_data_item(vpn, "usercert")))
 417         {
 418                 public_key_t *public;
 419                 private_key_t *private = NULL;
 420
 421                 bool agent = streq(cert_source, "agent");
 422
 423                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 424                                                                   BUILD_FROM_FILE, str, BUILD_END);
 425                 if (!cert)
 426                 {
 427                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 428                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 429                                                 "Loading peer certificate failed.");
 430                         return FALSE;
 431                 }
 432                 /* try agent */
 433                 str = nm_setting_vpn_get_secret(vpn, "agent");
 434                 if (agent && str)
 435                 {
 436                         public = cert->get_public_key(cert);
 437                         if (public)
 438                         {
 439                                 private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 440                                                                                          public->get_type(public),
 441                                                                                          BUILD_AGENT_SOCKET, str,
 442                                                                                          BUILD_PUBLIC_KEY, public,
 443                                                                                          BUILD_END);
 444                                 public->destroy(public);
 445                         }
 446                         if (!private)
 447                         {
 448                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 449                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 450                                                         "Connecting to SSH agent failed.");
 451                         }
 452                 }
 453                 /* ... or key file */
 454                 str = nm_setting_vpn_get_data_item(vpn, "userkey");
 455                 if (!agent && str)
 456                 {
 457                         char *secret;
 458
 459                         secret = (char*)nm_setting_vpn_get_secret(vpn, "password");
 460                         if (secret)
 461                         {
 462                                 priv->creds->set_key_password(priv->creds, secret);
 463                         }
 464                         private = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 465                                                                         KEY_ANY, BUILD_FROM_FILE, str, BUILD_END);
 466                         if (!private)
 467                         {
 468                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 469                                                         NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 470                                                         "Loading private key failed.");
 471                         }
 472                 }
 473                 if (private)
 474                 {
 475                         id = cert->get_subject(cert);
 476                         id = id->clone(id);
 477                         priv->creds->set_cert_and_key(priv->creds, cert, private);
 478                 }
 479                 else
 480                 {
 481                         DESTROY_IF(cert);
 482                         return FALSE;
 483                 }
 484         }
 485         else
 486         {
 487                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 488                                         "Certificate is missing.");
 489                 return FALSE;
 490         }
 491
 492         auth = auth_cfg_create();
 493         if (streq(method, "eap-tls"))
 494         {
 495                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_EAP);
 496                 auth->add(auth, AUTH_RULE_EAP_TYPE, EAP_TLS);
 497                 auth->add(auth, AUTH_RULE_AAA_IDENTITY,
 498                                   identification_create_from_string("%any"));
 499         }
 500         else
 501         {
 502                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 503         }
 504         if (cert)
 505         {
 506                 auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert->get_ref(cert));
 507         }
 508         str = nm_setting_vpn_get_data_item(vpn, "local-identity");
 509         if (str)
 510         {
 511                 identification_t *local_id;
 512
 513                 local_id = identification_create_from_string((char*)str);
 514                 if (local_id)
 515                 {
 516                         id->destroy(id);
 517                         id = local_id;
 518                 }
 519         }
 520         auth->add(auth, AUTH_RULE_IDENTITY, id);
 521         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 522         return TRUE;
 523 }
 524
 525 /**
 526  * Add a client auth config for username/password authentication
 527  */
 528 static bool add_auth_cfg_pw(NMStrongswanPluginPrivate *priv,
 529                                                         NMSettingVpn *vpn, peer_cfg_t *peer_cfg,
 530                                                         GError **err)
 531 {
 532         identification_t *user = NULL, *id = NULL;
 533         auth_cfg_t *auth;
 534         const char *str, *method;
 535
 536         method = nm_setting_vpn_get_data_item(vpn, "method");
 537
 538         str = nm_setting_vpn_get_data_item(vpn, "user");
 539         if (str)
 540         {
 541                 user = identification_create_from_string((char*)str);
 542         }
 543         else
 544         {
 545                 user = identification_create_from_string("%any");
 546         }
 547         str = nm_setting_vpn_get_data_item(vpn, "local-identity");
 548         if (str)
 549         {
 550                 id = identification_create_from_string((char*)str);
 551         }
 552         else
 553         {
 554                 id = user->clone(user);
 555         }
 556         str = nm_setting_vpn_get_secret(vpn, "password");
 557         if (streq(method, "psk"))
 558         {
 559                 if (strlen(str) < 20)
 560                 {
 561                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 562                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 563                                                 "Pre-shared key is too short.");
 564                         user->destroy(user);
 565                         id->destroy(id);
 566                         return FALSE;
 567                 }
 568                 priv->creds->set_username_password(priv->creds, id, (char*)str);
 569         }
 570         else
 571         {
 572                 priv->creds->set_username_password(priv->creds, user, (char*)str);
 573         }
 574
 575         auth = auth_cfg_create();
 576         auth->add(auth, AUTH_RULE_AUTH_CLASS,
 577                           streq(method, "psk") ? AUTH_CLASS_PSK : AUTH_CLASS_EAP);
 578         /* in case EAP-PEAP or EAP-TTLS is used we currently accept any identity */
 579         auth->add(auth, AUTH_RULE_AAA_IDENTITY,
 580                           identification_create_from_string("%any"));
 581         auth->add(auth, AUTH_RULE_EAP_IDENTITY, user);
 582         auth->add(auth, AUTH_RULE_IDENTITY, id);
 583         peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
 584         return TRUE;
 585 }
 586
 587 /**
 588  * Connect function called from NM via DBUS
 589  */
 590 static gboolean connect_(NMVpnServicePlugin *plugin, NMConnection *connection,
 591                                                  GError **err)
 592 {
 593         NMStrongswanPlugin *pub = (NMStrongswanPlugin*)plugin;
 594         NMStrongswanPluginPrivate *priv;
 595         NMSettingConnection *conn;
 596         NMSettingVpn *vpn;
 597         enumerator_t *enumerator;
 598         identification_t *gateway = NULL;
 599         const char *str, *method;
 600         bool virtual, proposal;
 601         proposal_t *prop;
 602         ike_cfg_t *ike_cfg;
 603         peer_cfg_t *peer_cfg;
 604         child_cfg_t *child_cfg;
 605         traffic_selector_t *ts;
 606         ike_sa_t *ike_sa;
 607         auth_cfg_t *auth;
 608         auth_class_t auth_class = AUTH_CLASS_EAP;
 609         certificate_t *cert = NULL;
 610         x509_t *x509;
 611         bool loose_gateway_id = FALSE;
 612         ike_cfg_create_t ike = {
 613                 .version = IKEV2,
 614                 .local = "%any",
 615                 .local_port = charon->socket->get_port(charon->socket, FALSE),
 616                 .remote_port = IKEV2_UDP_PORT,
 617                 .fragmentation = FRAGMENTATION_YES,
 618         };
 619         peer_cfg_create_t peer = {
 620                 .cert_policy = CERT_SEND_IF_ASKED,
 621                 .unique = UNIQUE_REPLACE,
 622                 .keyingtries = 1,
 623                 .rekey_time = 36000, /* 10h */
 624                 .jitter_time = 600, /* 10min */
 625                 .over_time = 600, /* 10min */
 626         };
 627         child_cfg_create_t child = {
 628                 .lifetime = {
 629                         .time = {
 630                                 .life = 10800 /* 3h */,
 631                                 .rekey = 10200 /* 2h50min */,
 632                                 .jitter = 300 /* 5min */
 633                         },
 634                 },
 635                 .mode = MODE_TUNNEL,
 636         };
 637
 638         /**
 639          * Read parameters
 640          */
 641         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(pub);
 642         conn = NM_SETTING_CONNECTION(nm_connection_get_setting(connection,
 643                                                                                                 NM_TYPE_SETTING_CONNECTION));
 644         vpn = NM_SETTING_VPN(nm_connection_get_setting(connection,
 645                                                                                                 NM_TYPE_SETTING_VPN));
 646         if (priv->name)
 647         {
 648                 free(priv->name);
 649         }
 650         priv->name = strdup(nm_setting_connection_get_id(conn));
 651         DBG1(DBG_CFG, "received initiate for NetworkManager connection %s",
 652                  priv->name);
 653         DBG4(DBG_CFG, "%s",
 654                  nm_setting_to_string(NM_SETTING(vpn)));
 655         ike.remote = (char*)nm_setting_vpn_get_data_item(vpn, "address");
 656         if (!ike.remote || !*ike.remote)
 657         {
 658                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 659                                         "Gateway address missing.");
 660                 return FALSE;
 661         }
 662         str = nm_setting_vpn_get_data_item(vpn, "server-port");
 663         if (str && strlen(str))
 664         {
 665                 ike.remote_port = settings_value_as_int((char*)str, ike.remote_port);
 666         }
 667         str = nm_setting_vpn_get_data_item(vpn, "virtual");
 668         virtual = streq(str, "yes");
 669         str = nm_setting_vpn_get_data_item(vpn, "encap");
 670         ike.force_encap = streq(str, "yes");
 671         str = nm_setting_vpn_get_data_item(vpn, "ipcomp");
 672         child.options |= streq(str, "yes") ? OPT_IPCOMP : 0;
 673
 674         /**
 675          * Register credentials
 676          */
 677         priv->creds->clear(priv->creds);
 678
 679         /* gateway/CA cert */
 680         str = nm_setting_vpn_get_data_item(vpn, "certificate");
 681         if (str)
 682         {
 683                 cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 684                                                                   BUILD_FROM_FILE, str, BUILD_END);
 685                 if (!cert)
 686                 {
 687                         g_set_error(err, NM_VPN_PLUGIN_ERROR,
 688                                                 NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 689                                                 "Loading gateway certificate failed.");
 690                         return FALSE;
 691                 }
 692                 priv->creds->add_certificate(priv->creds, cert);
 693         }
 694         else
 695         {
 696                 /* no certificate defined, fall back to system-wide CA certificates */
 697                 priv->creds->load_ca_dir(priv->creds, lib->settings->get_str(
 698                                                                  lib->settings, "charon-nm.ca_dir", NM_CA_DIR));
 699         }
 700
 701         str = nm_setting_vpn_get_data_item(vpn, "remote-identity");
 702         if (str)
 703         {
 704                 gateway = identification_create_from_string((char*)str);
 705         }
 706         else if (cert)
 707         {
 708                 x509 = (x509_t*)cert;
 709                 if (!(x509->get_flags(x509) & X509_CA))
 710                 {       /* for server certificates, we use the subject as identity */
 711                         gateway = cert->get_subject(cert);
 712                         gateway = gateway->clone(gateway);
 713                 }
 714         }
 715         if (!gateway || gateway->get_type(gateway) == ID_ANY)
 716         {
 717                 /* if the user configured a CA certificate (or an invalid identity),
 718                  * we use the IP/hostname of the server */
 719                 gateway = identification_create_from_string(ike.remote);
 720                 loose_gateway_id = TRUE;
 721         }
 722         DBG1(DBG_CFG, "using gateway identity '%Y'", gateway);
 723
 724         /**
 725          * Set up configurations
 726          */
 727         ike_cfg = ike_cfg_create(&ike);
 728
 729         str = nm_setting_vpn_get_data_item(vpn, "proposal");
 730         proposal = streq(str, "yes");
 731         str = nm_setting_vpn_get_data_item(vpn, "ike");
 732         if (proposal && str && strlen(str))
 733         {
 734                 enumerator = enumerator_create_token(str, ";", "");
 735                 while (enumerator->enumerate(enumerator, &str))
 736                 {
 737                         prop = proposal_create_from_string(PROTO_IKE, str);
 738                         if (!prop)
 739                         {
 740                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 741                                                         NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 742                                                         "Invalid IKE proposal.");
 743                                 enumerator->destroy(enumerator);
 744                                 ike_cfg->destroy(ike_cfg);
 745                                 gateway->destroy(gateway);
 746                                 return FALSE;
 747                         }
 748                         ike_cfg->add_proposal(ike_cfg, prop);
 749                 }
 750                 enumerator->destroy(enumerator);
 751         }
 752         else
 753         {
 754                 ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 755                 ike_cfg->add_proposal(ike_cfg, proposal_create_default_aead(PROTO_IKE));
 756         }
 757
 758         peer_cfg = peer_cfg_create(priv->name, ike_cfg, &peer);
 759         if (virtual)
 760         {
 761                 peer_cfg->add_virtual_ip(peer_cfg, host_create_any(AF_INET));
 762                 peer_cfg->add_virtual_ip(peer_cfg, host_create_any(AF_INET6));
 763         }
 764
 765         method = nm_setting_vpn_get_data_item(vpn, "method");
 766         if (streq(method, "cert") ||
 767                 streq(method, "eap-tls") ||
 768                 streq(method, "key") ||
 769                 streq(method, "agent") ||
 770                 streq(method, "smartcard"))
 771         {
 772                 if (!add_auth_cfg_cert (priv, vpn, peer_cfg, err))
 773                 {
 774                         peer_cfg->destroy(peer_cfg);
 775                         ike_cfg->destroy(ike_cfg);
 776                         gateway->destroy(gateway);
 777                         return FALSE;
 778                 }
 779         }
 780         else if (streq(method, "eap") ||
 781                          streq(method, "psk"))
 782         {
 783                 if (!add_auth_cfg_pw(priv, vpn, peer_cfg, err))
 784                 {
 785                         peer_cfg->destroy(peer_cfg);
 786                         ike_cfg->destroy(ike_cfg);
 787                         gateway->destroy(gateway);
 788                         return FALSE;
 789                 }
 790         }
 791         else
 792         {
 793                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
 794                                         "Configuration parameters missing.");
 795                 peer_cfg->destroy(peer_cfg);
 796                 ike_cfg->destroy(ike_cfg);
 797                 gateway->destroy(gateway);
 798                 return FALSE;
 799         }
 800
 801         auth = auth_cfg_create();
 802         if (auth_class == AUTH_CLASS_PSK)
 803         {
 804                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);
 805         }
 806         else
 807         {
 808                 auth->add(auth, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PUBKEY);
 809         }
 810         auth->add(auth, AUTH_RULE_IDENTITY, gateway);
 811         auth->add(auth, AUTH_RULE_IDENTITY_LOOSE, loose_gateway_id);
 812         peer_cfg->add_auth_cfg(peer_cfg, auth, FALSE);
 813
 814         child_cfg = child_cfg_create(priv->name, &child);
 815         str = nm_setting_vpn_get_data_item(vpn, "esp");
 816         if (proposal && str && strlen(str))
 817         {
 818                 enumerator = enumerator_create_token(str, ";", "");
 819                 while (enumerator->enumerate(enumerator, &str))
 820                 {
 821                         prop = proposal_create_from_string(PROTO_ESP, str);
 822                         if (!prop)
 823                         {
 824                                 g_set_error(err, NM_VPN_PLUGIN_ERROR,
 825                                                         NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 826                                                         "Invalid ESP proposal.");
 827                                 enumerator->destroy(enumerator);
 828                                 child_cfg->destroy(child_cfg);
 829                                 peer_cfg->destroy(peer_cfg);
 830                                 return FALSE;
 831                         }
 832                         child_cfg->add_proposal(child_cfg, prop);
 833                 }
 834                 enumerator->destroy(enumerator);
 835         }
 836         else
 837         {
 838                 child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 839                 child_cfg->add_proposal(child_cfg, proposal_create_default_aead(PROTO_ESP));
 840         }
 841         ts = traffic_selector_create_dynamic(0, 0, 65535);
 842         child_cfg->add_traffic_selector(child_cfg, TRUE, ts);
 843         ts = traffic_selector_create_from_cidr("0.0.0.0/0", 0, 0, 65535);
 844         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 845         ts = traffic_selector_create_from_cidr("::/0", 0, 0, 65535);
 846         child_cfg->add_traffic_selector(child_cfg, FALSE, ts);
 847         peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 848
 849         /**
 850          * Prepare IKE_SA
 851          */
 852         ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 853                                                                                                                 peer_cfg);
 854         if (!ike_sa)
 855         {
 856                 peer_cfg->destroy(peer_cfg);
 857                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 858                                         "IKE version not supported.");
 859                 return FALSE;
 860         }
 861         if (!ike_sa->get_peer_cfg(ike_sa))
 862         {
 863                 ike_sa->set_peer_cfg(ike_sa, peer_cfg);
 864         }
 865         peer_cfg->destroy(peer_cfg);
 866
 867         /**
 868          * Register listener, enable  initiate-failure-detection hooks
 869          */
 870         priv->ike_sa = ike_sa;
 871         priv->listener.ike_state_change = _ike_state_change;
 872         priv->listener.child_state_change = _child_state_change;
 873
 874         /**
 875          * Initiate
 876          */
 877         child_cfg->get_ref(child_cfg);
 878         if (ike_sa->initiate(ike_sa, child_cfg, 0, NULL, NULL) != SUCCESS)
 879         {
 880                 charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 881
 882                 g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
 883                                         "Initiating failed.");
 884                 return FALSE;
 885         }
 886         charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
 887         return TRUE;
 888 }
 889
 890 /**
 891  * NeedSecrets called from NM via DBUS
 892  */
 893 static gboolean need_secrets(NMVpnServicePlugin *plugin, NMConnection *connection,
 894                                                          const char **setting_name, GError **error)
 895 {
 896         NMSettingVpn *settings;
 897         const char *method, *cert_source, *path;
 898         bool need_secret = FALSE;
 899
 900         settings = NM_SETTING_VPN(nm_connection_get_setting(connection,
 901                                                                                                                 NM_TYPE_SETTING_VPN));
 902         method = nm_setting_vpn_get_data_item(settings, "method");
 903         if (method)
 904         {
 905                 if (streq(method, "cert") ||
 906                         streq(method, "eap-tls") ||
 907                         streq(method, "key") ||
 908                         streq(method, "agent") ||
 909                         streq(method, "smartcard"))
 910                 {
 911                         cert_source = nm_setting_vpn_get_data_item(settings, "cert-source");
 912                         if (!cert_source)
 913                         {
 914                                 cert_source = method;
 915                         }
 916                         if (streq(cert_source, "agent"))
 917                         {
 918                                 need_secret = !nm_setting_vpn_get_secret(settings, "agent");
 919                         }
 920                         else if (streq(cert_source, "smartcard"))
 921                         {
 922                                 need_secret = !nm_setting_vpn_get_secret(settings, "password");
 923                         }
 924                         else
 925                         {
 926                                 need_secret = TRUE;
 927                                 path = nm_setting_vpn_get_data_item(settings, "userkey");
 928                                 if (path)
 929                                 {
 930                                         private_key_t *key;
 931
 932                                         /* try to load/decrypt the private key */
 933                                         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY,
 934                                                                         KEY_ANY, BUILD_FROM_FILE, path, BUILD_END);
 935                                         if (key)
 936                                         {
 937                                                 key->destroy(key);
 938                                                 need_secret = FALSE;
 939                                         }
 940                                         else if (nm_setting_vpn_get_secret(settings, "password"))
 941                                         {
 942                                                 need_secret = FALSE;
 943                                         }
 944                                 }
 945                         }
 946                 }
 947                 else if (streq(method, "eap") ||
 948                                  streq(method, "psk"))
 949                 {
 950                         need_secret = !nm_setting_vpn_get_secret(settings, "password");
 951                 }
 952         }
 953         *setting_name = NM_SETTING_VPN_SETTING_NAME;
 954         return need_secret;
 955 }
 956
 957 /**
 958  * The actual disconnection
 959  */
 960 static gboolean do_disconnect(gpointer plugin)
 961 {
 962         NMStrongswanPluginPrivate *priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
 963         enumerator_t *enumerator;
 964         ike_sa_t *ike_sa;
 965         u_int id;
 966
 967         /* our ike_sa pointer might be invalid, lookup sa */
 968         enumerator = charon->controller->create_ike_sa_enumerator(
 969                                                                                                         charon->controller, TRUE);
 970         while (enumerator->enumerate(enumerator, &ike_sa))
 971         {
 972                 if (priv->ike_sa == ike_sa)
 973                 {
 974                         id = ike_sa->get_unique_id(ike_sa);
 975                         enumerator->destroy(enumerator);
 976                         charon->controller->terminate_ike(charon->controller, id, FALSE,
 977                                                                                           controller_cb_empty, NULL, 0);
 978                         return FALSE;
 979                 }
 980         }
 981         enumerator->destroy(enumerator);
 982
 983         g_debug("Connection not found.");
 984         return FALSE;
 985 }
 986
 987 /**
 988  * Disconnect called from NM via DBUS
 989  */
 990 static gboolean disconnect(NMVpnServicePlugin *plugin, GError **err)
 991 {
 992         /* enqueue the actual disconnection, because we may be called in
 993          * response to a listener_t callback and the SA enumeration would
 994          * possibly deadlock. */
 995         g_idle_add(do_disconnect, plugin);
 996
 997         return TRUE;
 998 }
 999
1000 /**
1001  * Initializer
1002  */
1003 static void nm_strongswan_plugin_init(NMStrongswanPlugin *plugin)
1004 {
1005         NMStrongswanPluginPrivate *priv;
1006
1007         priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
1008         priv->plugin = NM_VPN_SERVICE_PLUGIN(plugin);
1009         memset(&priv->listener, 0, sizeof(listener_t));
1010         priv->listener.child_updown = _child_updown;
1011         priv->listener.ike_rekey = _ike_rekey;
1012         priv->listener.ike_reestablish_pre = _ike_reestablish_pre;
1013         priv->listener.ike_reestablish_post = _ike_reestablish_post;
1014         charon->bus->add_listener(charon->bus, &priv->listener);
1015         priv->name = NULL;
1016 }
1017
1018 /**
1019  * Class constructor
1020  */
1021 static void nm_strongswan_plugin_class_init(
1022                                                                         NMStrongswanPluginClass *strongswan_class)
1023 {
1024         NMVpnServicePluginClass *parent_class = NM_VPN_SERVICE_PLUGIN_CLASS(strongswan_class);
1025
1026         parent_class->connect = connect_;
1027         parent_class->need_secrets = need_secrets;
1028         parent_class->disconnect = disconnect;
1029 }
1030
1031 /**
1032  * Object constructor
1033  */
1034 NMStrongswanPlugin *nm_strongswan_plugin_new(nm_creds_t *creds,
1035                                                                                          nm_handler_t *handler)
1036 {
1037         GError *error = NULL;
1038
1039         NMStrongswanPlugin *plugin = (NMStrongswanPlugin *)g_initable_new (
1040                                         NM_TYPE_STRONGSWAN_PLUGIN,
1041                                         NULL,
1042                                         &error,
1043                                         NM_VPN_SERVICE_PLUGIN_DBUS_SERVICE_NAME, NM_DBUS_SERVICE_STRONGSWAN,
1044                                         NULL);
1045
1046         if (plugin)
1047         {
1048                 NMStrongswanPluginPrivate *priv;
1049
1050                 /* the rest of the initialization happened in _init above */
1051                 priv = NM_STRONGSWAN_PLUGIN_GET_PRIVATE(plugin);
1052                 priv->creds = creds;
1053                 priv->handler = handler;
1054         }
1055         else
1056         {
1057                 g_warning ("Failed to initialize a plugin instance: %s", error->message);
1058                 g_error_free (error);
1059         }
1060
1061         return plugin;
1062 }