5 * Copyright (C) 2010-2014 BMW Car IT GmbH.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
32 #include <linux/if_tun.h>
36 #define CONNMAN_API_SUBJECT_TO_CHANGE
37 #include <connman/plugin.h>
38 #include <connman/log.h>
39 #include <connman/task.h>
40 #include <connman/dbus.h>
41 #include <connman/ipconfig.h>
43 #include "../vpn-provider.h"
47 #define ARRAY_SIZE(a) (sizeof(a)/sizeof(a[0]))
49 static DBusConnection *connection;
56 { "Host", "--remote", 1 },
57 { "OpenVPN.CACert", "--ca", 1 },
58 { "OpenVPN.Cert", "--cert", 1 },
59 { "OpenVPN.Key", "--key", 1 },
60 { "OpenVPN.MTU", "--mtu", 1 },
61 { "OpenVPN.NSCertType", "--ns-cert-type", 1 },
62 { "OpenVPN.Proto", "--proto", 1 },
63 { "OpenVPN.Port", "--port", 1 },
64 { "OpenVPN.AuthUserPass", "--auth-user-pass", 1 },
65 { "OpenVPN.AskPass", "--askpass", 1 },
66 { "OpenVPN.AuthNoCache", "--auth-nocache", 0 },
67 { "OpenVPN.TLSRemote", "--tls-remote", 1 },
68 { "OpenVPN.TLSAuth", NULL, 1 },
69 { "OpenVPN.TLSAuthDir", NULL, 1 },
70 { "OpenVPN.Cipher", "--cipher", 1 },
71 { "OpenVPN.Auth", "--auth", 1 },
72 { "OpenVPN.CompLZO", "--comp-lzo", 0 },
73 { "OpenVPN.RemoteCertTls", "--remote-cert-tls", 1 },
74 { "OpenVPN.ConfigFile", "--config", 1 },
75 { "OpenVPN.DeviceType", NULL, 1 },
76 { "OpenVPN.Verb", "--verb", 1 },
79 struct nameserver_entry {
84 static struct nameserver_entry *ov_append_dns_entries(const char *key,
87 struct nameserver_entry *entry = NULL;
90 if (!g_str_has_prefix(key, "foreign_option_"))
93 options = g_strsplit(value, " ", 3);
95 !strcmp(options[0], "dhcp-option") &&
97 !strcmp(options[1], "DNS") &&
100 entry = g_try_new(struct nameserver_entry, 1);
104 entry->nameserver = g_strdup(options[2]);
105 entry->id = atoi(key + 15); /* foreign_option_XXX */
113 static char *ov_get_domain_name(const char *key, const char *value)
118 if (!g_str_has_prefix(key, "foreign_option_"))
121 options = g_strsplit(value, " ", 3);
123 !strcmp(options[0], "dhcp-option") &&
125 !strcmp(options[1], "DOMAIN") &&
128 domain = g_strdup(options[2]);
136 static gint cmp_ns(gconstpointer a, gconstpointer b)
138 struct nameserver_entry *entry_a = (struct nameserver_entry *)a;
139 struct nameserver_entry *entry_b = (struct nameserver_entry *)b;
141 if (entry_a->id < entry_b->id)
144 if (entry_a->id > entry_b->id)
150 static void free_ns_entry(gpointer data)
152 struct nameserver_entry *entry = data;
154 g_free(entry->nameserver);
158 static int ov_notify(DBusMessage *msg, struct vpn_provider *provider)
160 DBusMessageIter iter, dict;
161 const char *reason, *key, *value;
162 char *address = NULL, *gateway = NULL, *peer = NULL, *netmask = NULL;
163 struct connman_ipaddress *ipaddress;
164 GSList *nameserver_list = NULL;
166 dbus_message_iter_init(msg, &iter);
168 dbus_message_iter_get_basic(&iter, &reason);
169 dbus_message_iter_next(&iter);
172 connman_error("No provider found");
173 return VPN_STATE_FAILURE;
176 if (strcmp(reason, "up"))
177 return VPN_STATE_DISCONNECT;
179 dbus_message_iter_recurse(&iter, &dict);
181 while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) {
182 struct nameserver_entry *ns_entry = NULL;
183 DBusMessageIter entry;
185 dbus_message_iter_recurse(&dict, &entry);
186 dbus_message_iter_get_basic(&entry, &key);
187 dbus_message_iter_next(&entry);
188 dbus_message_iter_get_basic(&entry, &value);
190 DBG("%s = %s", key, value);
192 if (!strcmp(key, "trusted_ip"))
193 gateway = g_strdup(value);
195 if (!strcmp(key, "ifconfig_local"))
196 address = g_strdup(value);
198 if (!strcmp(key, "ifconfig_netmask"))
199 netmask = g_strdup(value);
201 if (!strcmp(key, "ifconfig_remote"))
202 peer = g_strdup(value);
204 if (g_str_has_prefix(key, "route_"))
205 vpn_provider_append_route(provider, key, value);
207 if ((ns_entry = ov_append_dns_entries(key, value)))
208 nameserver_list = g_slist_prepend(nameserver_list,
211 char *domain = ov_get_domain_name(key, value);
213 vpn_provider_set_domain(provider, domain);
218 dbus_message_iter_next(&dict);
221 ipaddress = connman_ipaddress_alloc(AF_INET);
223 g_slist_free_full(nameserver_list, free_ns_entry);
229 return VPN_STATE_FAILURE;
232 connman_ipaddress_set_ipv4(ipaddress, address, netmask, gateway);
233 connman_ipaddress_set_peer(ipaddress, peer);
234 vpn_provider_set_ipaddress(provider, ipaddress);
236 if (nameserver_list) {
237 char *nameservers = NULL;
240 nameserver_list = g_slist_sort(nameserver_list, cmp_ns);
241 for (tmp = nameserver_list; tmp;
242 tmp = g_slist_next(tmp)) {
243 struct nameserver_entry *ns = tmp->data;
246 nameservers = g_strdup(ns->nameserver);
249 str = g_strjoin(" ", nameservers,
250 ns->nameserver, NULL);
256 g_slist_free_full(nameserver_list, free_ns_entry);
258 vpn_provider_set_nameservers(provider, nameservers);
267 connman_ipaddress_free(ipaddress);
269 return VPN_STATE_CONNECT;
272 static int ov_save(struct vpn_provider *provider, GKeyFile *keyfile)
277 for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
278 if (strncmp(ov_options[i].cm_opt, "OpenVPN.", 8) == 0) {
279 option = vpn_provider_get_string(provider,
280 ov_options[i].cm_opt);
284 g_key_file_set_string(keyfile,
285 vpn_provider_get_save_group(provider),
286 ov_options[i].cm_opt, option);
292 static int task_append_config_data(struct vpn_provider *provider,
293 struct connman_task *task)
298 for (i = 0; i < (int)ARRAY_SIZE(ov_options); i++) {
299 if (!ov_options[i].ov_opt)
302 option = vpn_provider_get_string(provider,
303 ov_options[i].cm_opt);
307 if (connman_task_add_argument(task,
308 ov_options[i].ov_opt,
309 ov_options[i].has_value ? option : NULL) < 0) {
317 static gboolean can_read_data(GIOChannel *chan,
318 GIOCondition cond, gpointer data)
320 void (*cbf)(const char *format, ...) = data;
324 if (cond & (G_IO_NVAL | G_IO_ERR | G_IO_HUP))
327 g_io_channel_read_line(chan, &str, &size, NULL, NULL);
334 static int setup_log_read(int stdout_fd, int stderr_fd)
339 chan = g_io_channel_unix_new(stdout_fd);
340 g_io_channel_set_close_on_unref(chan, TRUE);
341 watch = g_io_add_watch(chan, G_IO_IN | G_IO_NVAL | G_IO_ERR | G_IO_HUP,
342 can_read_data, connman_debug);
343 g_io_channel_unref(chan);
348 chan = g_io_channel_unix_new(stderr_fd);
349 g_io_channel_set_close_on_unref(chan, TRUE);
350 watch = g_io_add_watch(chan, G_IO_IN | G_IO_NVAL | G_IO_ERR | G_IO_HUP,
351 can_read_data, connman_error);
352 g_io_channel_unref(chan);
354 return watch == 0? -EIO : 0;
357 static int ov_connect(struct vpn_provider *provider,
358 struct connman_task *task, const char *if_name,
359 vpn_provider_connect_cb_t cb, const char *dbus_sender,
363 int stdout_fd, stderr_fd;
366 option = vpn_provider_get_string(provider, "Host");
368 connman_error("Host not set; cannot enable VPN");
372 task_append_config_data(provider, task);
374 option = vpn_provider_get_string(provider, "OpenVPN.ConfigFile");
377 * Set some default options if user has no config file.
379 option = vpn_provider_get_string(provider, "OpenVPN.TLSAuth");
381 connman_task_add_argument(task, "--tls-auth", option);
382 option = vpn_provider_get_string(provider,
383 "OpenVPN.TLSAuthDir");
385 connman_task_add_argument(task, option, NULL);
388 connman_task_add_argument(task, "--nobind", NULL);
389 connman_task_add_argument(task, "--persist-key", NULL);
390 connman_task_add_argument(task, "--client", NULL);
393 connman_task_add_argument(task, "--script-security", "2");
395 connman_task_add_argument(task, "--up",
396 SCRIPTDIR "/openvpn-script");
397 connman_task_add_argument(task, "--up-restart", NULL);
399 connman_task_add_argument(task, "--setenv", NULL);
400 connman_task_add_argument(task, "CONNMAN_BUSNAME",
401 dbus_bus_get_unique_name(connection));
403 connman_task_add_argument(task, "--setenv", NULL);
404 connman_task_add_argument(task, "CONNMAN_INTERFACE",
405 CONNMAN_TASK_INTERFACE);
407 connman_task_add_argument(task, "--setenv", NULL);
408 connman_task_add_argument(task, "CONNMAN_PATH",
409 connman_task_get_path(task));
411 connman_task_add_argument(task, "--dev", if_name);
412 option = vpn_provider_get_string(provider, "OpenVPN.DeviceType");
414 connman_task_add_argument(task, "--dev-type", option);
417 * Default to tun for backwards compatibility.
419 connman_task_add_argument(task, "--dev-type", "tun");
422 connman_task_add_argument(task, "--persist-tun", NULL);
424 connman_task_add_argument(task, "--route-noexec", NULL);
425 connman_task_add_argument(task, "--ifconfig-noexec", NULL);
428 * Disable client restarts because we can't handle this at the
429 * moment. The problem is that when OpenVPN decides to switch
430 * from CONNECTED state to RECONNECTING and then to RESOLVE,
431 * it is not possible to do a DNS lookup. The DNS server is
432 * not accessable through the tunnel anymore and so we end up
433 * trying to resolve the OpenVPN servers address.
435 connman_task_add_argument(task, "--ping-restart", "0");
437 err = connman_task_run(task, vpn_died, provider,
438 NULL, &stdout_fd, &stderr_fd);
440 connman_error("openvpn failed to start");
445 err = setup_log_read(stdout_fd, stderr_fd);
448 cb(provider, user_data, err);
453 static int ov_device_flags(struct vpn_provider *provider)
457 option = vpn_provider_get_string(provider, "OpenVPN.DeviceType");
462 if (g_str_equal(option, "tap")) {
466 if (!g_str_equal(option, "tun")) {
467 connman_warn("bad OpenVPN.DeviceType value, falling back to tun");
473 static int ov_route_env_parse(struct vpn_provider *provider, const char *key,
474 int *family, unsigned long *idx, enum vpn_provider_route_type *type)
479 if (g_str_has_prefix(key, "route_network_")) {
480 start = key + strlen("route_network_");
481 *type = VPN_PROVIDER_ROUTE_TYPE_ADDR;
482 } else if (g_str_has_prefix(key, "route_netmask_")) {
483 start = key + strlen("route_netmask_");
484 *type = VPN_PROVIDER_ROUTE_TYPE_MASK;
485 } else if (g_str_has_prefix(key, "route_gateway_")) {
486 start = key + strlen("route_gateway_");
487 *type = VPN_PROVIDER_ROUTE_TYPE_GW;
492 *idx = g_ascii_strtoull(start, &end, 10);
497 static struct vpn_driver vpn_driver = {
499 .connect = ov_connect,
501 .device_flags = ov_device_flags,
502 .route_env_parse = ov_route_env_parse,
505 static int openvpn_init(void)
507 connection = connman_dbus_get_connection();
509 return vpn_register("openvpn", &vpn_driver, OPENVPN);
512 static void openvpn_exit(void)
514 vpn_unregister("openvpn");
516 dbus_connection_unref(connection);
519 CONNMAN_PLUGIN_DEFINE(openvpn, "OpenVPN plugin", VERSION,
520 CONNMAN_PLUGIN_PRIORITY_DEFAULT, openvpn_init, openvpn_exit)