vpn/plugins/wireguard.c

   1 /*
   2  *  ConnMan VPN daemon
   3  *
   4  *  Copyright (C) 2019  Daniel Wagner. All rights reserved.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License version 2 as
   8  *  published by the Free Software Foundation.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  18  */
  19
  20 #ifdef HAVE_CONFIG_H
  21 #include <config.h>
  22 #endif
  23
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <net/if.h>
  29 #include <arpa/inet.h>
  30 #include <sys/types.h>
  31 #include <sys/socket.h>
  32 #include <netdb.h>
  33
  34 #include <glib.h>
  35
  36 #define CONNMAN_API_SUBJECT_TO_CHANGE
  37 #include <connman/plugin.h>
  38 #include <connman/log.h>
  39 #include <connman/task.h>
  40 #include <connman/ipconfig.h>
  41 #include <connman/inet.h>
  42 #include <connman/dbus.h>
  43 #include <connman/setting.h>
  44 #include <connman/vpn-dbus.h>
  45
  46 #include "../vpn-provider.h"
  47 #include "../vpn.h"
  48
  49 #include "vpn.h"
  50 #include "wireguard.h"
  51
  52 #define DNS_RERESOLVE_TIMEOUT 20
  53 #if defined TIZEN_EXT
  54 #define ADD_ALLOWED_IP_ROUTE_TIMEOUT 2
  55 #endif /* TIZEN_EXT */
  56
  57 struct wireguard_info {
  58         struct wg_device device;
  59         struct wg_peer peer;
  60         char *endpoint_fqdn;
  61         char *port;
  62         int reresolve_id;
  63 #if defined TIZEN_EXT
  64         int allowed_ip_route_id;
  65 #endif /* TIZEN_EXT */
  66 };
  67
  68 struct sockaddr_u {
  69         union {
  70                 struct sockaddr sa;
  71                 struct sockaddr_in sin;
  72                 struct sockaddr_in6 sin6;
  73         };
  74 };
  75
  76 static int parse_key(const char *str, wg_key key)
  77 {
  78         unsigned char *buf;
  79         size_t len;
  80
  81         buf = g_base64_decode(str, &len);
  82
  83         if (len != 32) {
  84                 g_free(buf);
  85                 return -EINVAL;
  86         }
  87
  88         memcpy(key, buf, 32);
  89
  90         g_free(buf);
  91         return 0;
  92 }
  93
  94 static int parse_allowed_ips(const char *allowed_ips, wg_peer *peer)
  95 {
  96         struct wg_allowedip *curaip, *allowedip;
  97         char buf[INET6_ADDRSTRLEN];
  98         char **tokens, **toks;
  99         char *send;
 100         int i;
 101
 102         curaip = NULL;
 103 #if defined TIZEN_EXT
 104         /**
 105          * Note: At API level we donot check Wireguard specific configurations,
 106          * User can provide any space separated string for IP.
 107          * Ideally it should be using "10.0.0.2/32, 10.0.0.3/32"
 108          * However there can be cases like "10.0.0.2/32,10.0.0.3/32"
 109          *
 110          * So we need to parse the allowed_ips configuration properly.
 111          */
 112         tokens = g_strsplit(allowed_ips, ",", -1);
 113 #else
 114         tokens = g_strsplit(allowed_ips, ", ", -1);
 115 #endif
 116         for (i = 0; tokens[i]; i++) {
 117 #if defined TIZEN_EXT
 118                 int len = strlen(tokens[i]);
 119                 char *ptr = tokens[i];
 120                 int j = -1;
 121
 122                 //skip forward spaces
 123                 while (++j < len && ptr[j] == ' ')
 124                         ;// Do Nothing
 125
 126                 if (!ptr[j])
 127                         continue;
 128
 129                 toks = g_strsplit(ptr + j, "/", -1);
 130                 if (g_strv_length(toks) != 2) {
 131                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 132                         g_strfreev(toks);
 133                         continue;
 134                 }
 135
 136                 DBG("Parsed AllowedIPs [%s]", ptr + j);
 137 #else
 138
 139                 toks = g_strsplit(tokens[i], "/", -1);
 140                 if (g_strv_length(toks) != 2) {
 141                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 142                         g_strfreev(toks);
 143                         continue;
 144                 }
 145 #endif
 146
 147                 allowedip = g_malloc0(sizeof(*allowedip));
 148
 149                 if (inet_pton(AF_INET, toks[0], buf) == 1) {
 150                         allowedip->family = AF_INET;
 151                         memcpy(&allowedip->ip4, buf, sizeof(allowedip->ip4));
 152                 } else if (inet_pton(AF_INET6, toks[0], buf) == 1) {
 153                         allowedip->family = AF_INET6;
 154                         memcpy(&allowedip->ip6, buf, sizeof(allowedip->ip6));
 155                 } else {
 156 #if defined TIZEN_EXT
 157                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 158 #else
 159                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 160 #endif
 161                         g_free(allowedip);
 162                         g_strfreev(toks);
 163                         continue;
 164                 }
 165
 166                 allowedip->cidr = g_ascii_strtoull(toks[1], &send, 10);
 167
 168                 if (!curaip)
 169                         peer->first_allowedip = allowedip;
 170                 else
 171                         curaip->next_allowedip = allowedip;
 172
 173                 curaip = allowedip;
 174         }
 175
 176         peer->last_allowedip = curaip;
 177         g_strfreev(tokens);
 178
 179         return 0;
 180 }
 181
 182 static int parse_endpoint(const char *host, const char *port, struct sockaddr_u *addr)
 183 {
 184         struct addrinfo hints;
 185         struct addrinfo *result, *rp;
 186         int sk;
 187
 188         memset(&hints, 0, sizeof(struct addrinfo));
 189         hints.ai_family = AF_UNSPEC;
 190         hints.ai_socktype = SOCK_DGRAM;
 191         hints.ai_flags = 0;
 192         hints.ai_protocol = 0;
 193
 194         if (getaddrinfo(host, port, &hints, &result) < 0) {
 195                 DBG("Failed to resolve host address");
 196                 return -EINVAL;
 197         }
 198
 199         for (rp = result; rp; rp = rp->ai_next) {
 200                 sk = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
 201                 if (sk < 0)
 202                         continue;
 203                 if (connect(sk, rp->ai_addr, rp->ai_addrlen) != -1) {
 204                         /* success */
 205                         close(sk);
 206                         break;
 207                 }
 208
 209                 close(sk);
 210         }
 211
 212         if (!rp) {
 213                 freeaddrinfo(result);
 214                 return -EINVAL;
 215         }
 216
 217         memcpy(addr, rp->ai_addr, rp->ai_addrlen);
 218         freeaddrinfo(result);
 219
 220         return 0;
 221 }
 222
 223 static int parse_address(const char *address, const char *gateway,
 224                 struct connman_ipaddress **ipaddress)
 225 {
 226         char buf[INET6_ADDRSTRLEN];
 227         unsigned char prefixlen;
 228         char **tokens;
 229         char *end, *netmask;
 230         int err;
 231
 232         tokens = g_strsplit(address, "/", -1);
 233         if (g_strv_length(tokens) != 2) {
 234                 g_strfreev(tokens);
 235                 return -EINVAL;
 236         }
 237
 238         prefixlen = g_ascii_strtoull(tokens[1], &end, 10);
 239
 240         if (inet_pton(AF_INET, tokens[0], buf) == 1) {
 241                 netmask = g_strdup_printf("%d.%d.%d.%d",
 242                                 ((0xffffffff << (32 - prefixlen)) >> 24) & 0xff,
 243                                 ((0xffffffff << (32 - prefixlen)) >> 16) & 0xff,
 244                                 ((0xffffffff << (32 - prefixlen)) >> 8) & 0xff,
 245                                 ((0xffffffff << (32 - prefixlen)) >> 0) & 0xff);
 246
 247                 *ipaddress = connman_ipaddress_alloc(AF_INET);
 248                 err = connman_ipaddress_set_ipv4(*ipaddress, tokens[0],
 249                                                 netmask, gateway);
 250                 g_free(netmask);
 251         } else if (inet_pton(AF_INET6, tokens[0], buf) == 1) {
 252                 *ipaddress = connman_ipaddress_alloc(AF_INET6);
 253                 err = connman_ipaddress_set_ipv6(*ipaddress, tokens[0],
 254                                                 prefixlen, gateway);
 255         } else {
 256                 DBG("Invalid Wireguard.Address value");
 257                 err = -EINVAL;
 258         }
 259
 260         g_strfreev(tokens);
 261         if (err)
 262                 connman_ipaddress_free(*ipaddress);
 263
 264         return err;
 265 }
 266
 267 struct ifname_data {
 268         char *ifname;
 269         bool found;
 270 };
 271
 272 static void ifname_check_cb(int index, void *user_data)
 273 {
 274         struct ifname_data *data = (struct ifname_data *)user_data;
 275         char *ifname;
 276
 277         ifname = connman_inet_ifname(index);
 278
 279         if (!g_strcmp0(ifname, data->ifname))
 280                 data->found = true;
 281 }
 282
 283 static char *get_ifname(void)
 284 {
 285         struct ifname_data data;
 286         int i;
 287
 288         for (i = 0; i < 256; i++) {
 289                 data.ifname = g_strdup_printf("wg%d", i);
 290                 data.found = false;
 291                 vpn_ipconfig_foreach(ifname_check_cb, &data);
 292
 293                 if (!data.found)
 294                         return data.ifname;
 295
 296                 g_free(data.ifname);
 297         }
 298
 299         return NULL;
 300 }
 301
 302 static bool sockaddr_cmp_addr(struct sockaddr_u *a, struct sockaddr_u *b)
 303 {
 304         if (a->sa.sa_family != b->sa.sa_family)
 305                 return false;
 306
 307         if (a->sa.sa_family == AF_INET)
 308                 return !memcmp(&a->sin, &b->sin, sizeof(struct sockaddr_in));
 309         else if (a->sa.sa_family == AF_INET6)
 310                 return !memcmp(a->sin6.sin6_addr.s6_addr,
 311                                 b->sin6.sin6_addr.s6_addr,
 312                                 sizeof(a->sin6.sin6_addr.s6_addr));
 313
 314         return false;
 315 }
 316
 317 #if defined TIZEN_EXT
 318 #include <unistd.h>
 319 #include <sys/types.h>
 320 #include <sys/wait.h>
 321 #include <stdio.h>
 322
 323 #define MAX_SIZE_ERROR_BUFFER 256
 324 #define MAX_CMD_SIZE 80
 325
 326 typedef struct {
 327         struct vpn_provider *provider;
 328         struct wireguard_info *info;
 329 } wg_allowed_ip_route_cb_data_s;
 330
 331 static int wg_execute_cmd(const char *format, ...)
 332 {
 333         int status = 0;
 334         int rv = 0;
 335         char cmd[MAX_CMD_SIZE] = { 0, };
 336         char error_buf[MAX_SIZE_ERROR_BUFFER] = {0, };
 337         pid_t pid = 0;
 338         va_list va_ptr;
 339         gchar **args = NULL;
 340
 341         va_start(va_ptr, format);
 342         vsnprintf(cmd, (unsigned int) MAX_CMD_SIZE, format, va_ptr);
 343         va_end(va_ptr);
 344
 345         if (strlen(cmd) == 0)
 346                 return -EIO;
 347
 348         DBG("command: %s", cmd);
 349
 350         args = g_strsplit_set(cmd, " ", -1);
 351
 352         errno = 0;
 353         if (!(pid = fork())) {
 354                 DBG("pid(%d), ppid (%d)", getpid(), getppid());
 355
 356                 errno = 0;
 357                 if (execv(args[0], args) == -1) {
 358                         DBG("Fail to execute command (%s)",
 359                                         strerror_r(errno, error_buf, MAX_SIZE_ERROR_BUFFER));
 360                         g_strfreev(args);
 361                         exit(1);
 362                 }
 363         } else if (pid > 0) {
 364                 if (waitpid(pid, &status, 0) == -1)
 365                         DBG("wait pid (%u) status (%d)", pid, status);
 366
 367                 if (WIFEXITED(status)) {
 368                         rv = WEXITSTATUS(status);
 369                         DBG("exited, status=%d", rv);
 370
 371                 } else if (WIFSIGNALED(status)) {
 372                         DBG("killed by signal %d", WTERMSIG(status));
 373
 374                 } else if (WIFSTOPPED(status)) {
 375                         DBG("stopped by signal %d", WSTOPSIG(status));
 376
 377                 } else if (WIFCONTINUED(status)) {
 378                         DBG("continued");
 379                 }
 380
 381                 g_strfreev(args);
 382                 return rv;
 383         }
 384
 385         DBG("failed to fork(%s)", strerror_r(errno, error_buf, MAX_SIZE_ERROR_BUFFER));
 386         g_strfreev(args);
 387
 388         return -EIO;
 389 }
 390
 391 static gboolean wg_add_allowed_ip_route_cb(gpointer user_data)
 392 {
 393         wg_allowed_ip_route_cb_data_s *cb_data = user_data;
 394         const char *allowed_ips;
 395         char **tokens = NULL;
 396         char **toks = NULL;
 397         int i;
 398
 399         DBG("");
 400
 401         allowed_ips = vpn_provider_get_string(cb_data->provider, "WireGuard.AllowedIPs");
 402         if (!allowed_ips) {
 403                 DBG("WireGuard.AllowedIPs is missing");
 404                 goto done;
 405         }
 406
 407         tokens = g_strsplit(allowed_ips, ",", -1);
 408         if (g_strv_length(tokens) == 0)
 409                 goto done;
 410
 411         for (i = 0; tokens[i]; i++) {
 412                 int len = strlen(tokens[i]);
 413                 char *ptr = tokens[i];
 414                 int j = -1;
 415
 416                 //skip forward spaces
 417                 while (++j < len && ptr[j] == ' ')
 418                         ;// Do Nothing
 419
 420                 if (!ptr[j])
 421                         continue;
 422
 423                 toks = g_strsplit(ptr + j, "/", -1);
 424                 if (g_strv_length(toks) != 2) {
 425                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 426                         g_strfreev(toks);
 427                         continue;
 428                 }
 429                 g_strfreev(toks);
 430
 431                 DBG("Allowed IP: [%s], Device Name: [%s]", ptr + j, cb_data->info->device.name);
 432
 433                 // TODO: Remove system call to add route entry present in wg_execute_cmd()
 434                 if (!g_strcmp0("0.0.0.0/0", ptr + j)) {
 435                         // TODO: Update default route because user wants all data to be routed from wg0,
 436                         // when 0.0.0.0/0 is passed in allowed ips list.
 437                         // Should we replace the default route?
 438                         // If yes, then how to recover default route when wg0 tunnel is removed.
 439                 } else {
 440                         wg_execute_cmd("/usr/sbin/ip route add %s dev %s", ptr + j, cb_data->info->device.name);
 441                 }
 442         }
 443
 444 done:
 445         if (tokens)
 446                 g_strfreev(tokens);
 447
 448         free(cb_data);
 449
 450         return FALSE;
 451 }
 452 #endif /* TIZEN_EXT */
 453
 454 static gboolean wg_dns_reresolve_cb(gpointer user_data)
 455 {
 456         struct wireguard_info *info = user_data;
 457         struct sockaddr_u addr;
 458         int err;
 459
 460         DBG("");
 461
 462         err = parse_endpoint(info->endpoint_fqdn,
 463                         info->port, &addr);
 464         if (err)
 465                 return TRUE;
 466
 467         if (sockaddr_cmp_addr(&addr,
 468                         (struct sockaddr_u *)&info->peer.endpoint.addr))
 469                 return TRUE;
 470
 471         if (addr.sa.sa_family == AF_INET)
 472                 memcpy(&info->peer.endpoint.addr, &addr.sin,
 473                         sizeof(info->peer.endpoint.addr4));
 474         else
 475                 memcpy(&info->peer.endpoint.addr, &addr.sin6,
 476                         sizeof(info->peer.endpoint.addr6));
 477
 478         DBG("Endpoint address has changed, udpate WireGuard device");
 479         err = wg_set_device(&info->device);
 480         if (err)
 481                 DBG("Failed to update Endpoint address for WireGuard device %s",
 482                         info->device.name);
 483
 484         return TRUE;
 485 }
 486
 487 static int wg_connect(struct vpn_provider *provider,
 488                         struct connman_task *task, const char *if_name,
 489                         vpn_provider_connect_cb_t cb,
 490                         const char *dbus_sender, void *user_data)
 491 {
 492         struct connman_ipaddress *ipaddress = NULL;
 493         struct wireguard_info *info;
 494         const char *option, *gateway;
 495         char *ifname;
 496         int err = -EINVAL;
 497
 498         info = g_malloc0(sizeof(struct wireguard_info));
 499         info->peer.flags = WGPEER_HAS_PUBLIC_KEY | WGPEER_REPLACE_ALLOWEDIPS;
 500         info->device.flags = WGDEVICE_HAS_PRIVATE_KEY;
 501         info->device.first_peer = &info->peer;
 502         info->device.last_peer = &info->peer;
 503
 504         vpn_provider_set_plugin_data(provider, info);
 505
 506         option = vpn_provider_get_string(provider, "WireGuard.ListenPort");
 507         if (option) {
 508                 char *end;
 509                 info->device.listen_port = g_ascii_strtoull(option, &end, 10);
 510                 info->device.flags |= WGDEVICE_HAS_LISTEN_PORT;
 511         }
 512
 513         option = vpn_provider_get_string(provider, "WireGuard.DNS");
 514         if (option) {
 515                 err = vpn_provider_set_nameservers(provider, option);
 516                 if (err)
 517                         goto done;
 518         }
 519
 520         option = vpn_provider_get_string(provider, "WireGuard.PrivateKey");
 521         if (!option) {
 522                 DBG("WireGuard.PrivateKey is missing");
 523                 goto done;
 524         }
 525         err = parse_key(option, info->device.private_key);
 526         if (err)
 527                 goto done;
 528
 529         option = vpn_provider_get_string(provider, "WireGuard.PublicKey");
 530         if (!option) {
 531                 DBG("WireGuard.PublicKey is missing");
 532                 goto done;
 533         }
 534         err = parse_key(option, info->peer.public_key);
 535         if (err)
 536                 goto done;
 537
 538         option = vpn_provider_get_string(provider, "WireGuard.PresharedKey");
 539         if (option) {
 540                 info->peer.flags |= WGPEER_HAS_PRESHARED_KEY;
 541                 err = parse_key(option, info->peer.preshared_key);
 542                 if (err)
 543                         goto done;
 544         }
 545
 546         option = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 547         if (!option) {
 548                 DBG("WireGuard.AllowedIPs is missing");
 549                 goto done;
 550         }
 551         err = parse_allowed_ips(option, &info->peer);
 552         if (err)
 553                 goto done;
 554
 555         option = vpn_provider_get_string(provider,
 556                                         "WireGuard.PersistentKeepalive");
 557         if (option) {
 558                 char *end;
 559                 info->peer.persistent_keepalive_interval =
 560                         g_ascii_strtoull(option, &end, 10);
 561                 info->peer.flags |= WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL;
 562         }
 563
 564         option = vpn_provider_get_string(provider, "WireGuard.EndpointPort");
 565         if (!option)
 566                 option = "51820";
 567
 568         gateway = vpn_provider_get_string(provider, "Host");
 569         err = parse_endpoint(gateway, option,
 570                         (struct sockaddr_u *)&info->peer.endpoint.addr);
 571         if (err)
 572                 goto done;
 573
 574         info->endpoint_fqdn = g_strdup(gateway);
 575         info->port = g_strdup(option);
 576
 577         option = vpn_provider_get_string(provider, "WireGuard.Address");
 578         if (!option) {
 579                 DBG("Missing WireGuard.Address configuration");
 580                 goto done;
 581         }
 582         err = parse_address(option, gateway, &ipaddress);
 583         if (err)
 584                 goto done;
 585
 586         ifname = get_ifname();
 587         if (!ifname) {
 588                 DBG("Failed to find an usable device name");
 589                 err = -ENOENT;
 590                 goto done;
 591         }
 592         stpncpy(info->device.name, ifname, sizeof(info->device.name) - 1);
 593         g_free(ifname);
 594
 595         err = wg_add_device(info->device.name);
 596         if (err) {
 597                 DBG("Failed to creating WireGuard device %s", info->device.name);
 598                 goto done;
 599         }
 600
 601         err = wg_set_device(&info->device);
 602         if (err) {
 603                 DBG("Failed to configure WireGuard device %s", info->device.name);
 604                 wg_del_device(info->device.name);
 605         }
 606
 607         vpn_set_ifname(provider, info->device.name);
 608         if (ipaddress)
 609                 vpn_provider_set_ipaddress(provider, ipaddress);
 610
 611 done:
 612         if (cb)
 613                 cb(provider, user_data, err);
 614
 615         connman_ipaddress_free(ipaddress);
 616
 617 #if defined TIZEN_EXT
 618         if (!err) {
 619                 const char *allowed_ips = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 620                 if (allowed_ips) {
 621                         wg_allowed_ip_route_cb_data_s *cb_data =
 622                                 (wg_allowed_ip_route_cb_data_s *) calloc(1, sizeof(wg_allowed_ip_route_cb_data_s));
 623                         if (cb_data) {
 624                                 cb_data->provider = provider;
 625                                 cb_data->info = info;
 626
 627                                 info->allowed_ip_route_id =
 628                                         g_timeout_add_seconds(ADD_ALLOWED_IP_ROUTE_TIMEOUT,
 629                                                         wg_add_allowed_ip_route_cb, cb_data);
 630                         }
 631                 }
 632         }
 633 #endif /* TIZEN_EXT */
 634
 635         if (!err)
 636                 info->reresolve_id =
 637                         g_timeout_add_seconds(DNS_RERESOLVE_TIMEOUT,
 638                                                 wg_dns_reresolve_cb, info);
 639
 640         return err;
 641 }
 642
 643 static void wg_disconnect(struct vpn_provider *provider)
 644 {
 645         struct wireguard_info *info;
 646
 647         info = vpn_provider_get_plugin_data(provider);
 648         if (!info)
 649                 return;
 650
 651 #if defined TIZEN_EXT
 652         if (info->allowed_ip_route_id > 0)
 653                 g_source_remove(info->allowed_ip_route_id);
 654 #endif /* TIZEN_EXT */
 655
 656         if (info->reresolve_id > 0)
 657                 g_source_remove(info->reresolve_id);
 658
 659         vpn_provider_set_plugin_data(provider, NULL);
 660
 661         wg_del_device(info->device.name);
 662
 663         g_free(info->endpoint_fqdn);
 664         g_free(info->port);
 665         g_free(info);
 666 }
 667
 668 #if defined TIZEN_EXT
 669 static int wg_save(struct vpn_provider *provider, GKeyFile *keyfile)
 670 {
 671         const char *option;
 672
 673         DBG("");
 674
 675         /*
 676          * The client/own device listen port.
 677          */
 678         option = vpn_provider_get_string(provider, "WireGuard.ListenPort");
 679         if (option)
 680                 g_key_file_set_string(keyfile,
 681                                 vpn_provider_get_save_group(provider),
 682                                 "WireGuard.ListenPort",
 683                                 option);
 684
 685         /*
 686          * comma separated DNS.
 687          */
 688         option = vpn_provider_get_string(provider, "WireGuard.DNS");
 689         if (option)
 690                 g_key_file_set_string(keyfile,
 691                                 vpn_provider_get_save_group(provider),
 692                                 "WireGuard.DNS",
 693                                 option);
 694
 695         /*
 696          * The client private key.
 697          */
 698         option = vpn_provider_get_string(provider, "WireGuard.PrivateKey");
 699         if (option)
 700                 g_key_file_set_string(keyfile,
 701                                 vpn_provider_get_save_group(provider),
 702                                 "WireGuard.PrivateKey",
 703                                 option);
 704
 705         /*
 706          * The server public key.
 707          */
 708         option = vpn_provider_get_string(provider, "WireGuard.PublicKey");
 709         if (option)
 710                 g_key_file_set_string(keyfile,
 711                                 vpn_provider_get_save_group(provider),
 712                                 "WireGuard.PublicKey",
 713                                 option);
 714
 715         /*
 716          * The preshared key.
 717          */
 718         option = vpn_provider_get_string(provider, "WireGuard.PresharedKey");
 719         if (option)
 720                 g_key_file_set_string(keyfile,
 721                                 vpn_provider_get_save_group(provider),
 722                                 "WireGuard.PresharedKey",
 723                                 option);
 724
 725         /*
 726          * Subnets accessed via VPN tunnel, 0.0.0.0/0 routes all traffic.
 727          */
 728         option = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 729         if (option)
 730                 g_key_file_set_string(keyfile,
 731                                 vpn_provider_get_save_group(provider),
 732                                 "WireGuard.AllowedIPs",
 733                                 option);
 734
 735         /*
 736          * The time in seconds to emit periodic keep alive message.
 737          */
 738         option = vpn_provider_get_string(provider, "WireGuard.PersistentKeepalive");
 739         if (option)
 740                 g_key_file_set_string(keyfile,
 741                                 vpn_provider_get_save_group(provider),
 742                                 "WireGuard.PersistentKeepalive",
 743                                 option);
 744
 745         /*
 746          * The server listen port, default: 51820
 747          */
 748         option = vpn_provider_get_string(provider, "WireGuard.EndpointPort");
 749         if (option)
 750                 g_key_file_set_string(keyfile,
 751                                 vpn_provider_get_save_group(provider),
 752                                 "WireGuard.EndpointPort",
 753                                 option);
 754
 755         /*
 756          * Save Address: The internal IP of the client node
 757          */
 758         option = vpn_provider_get_string(provider, "WireGuard.Address");
 759         if (option)
 760                 g_key_file_set_string(keyfile,
 761                                 vpn_provider_get_save_group(provider),
 762                                 "WireGuard.Address",
 763                                 option);
 764
 765         return 0;
 766 }
 767 #endif
 768
 769 static struct vpn_driver vpn_driver = {
 770         .flags          = VPN_FLAG_NO_TUN | VPN_FLAG_NO_DAEMON,
 771         .connect        = wg_connect,
 772         .disconnect     = wg_disconnect,
 773 #if defined TIZEN_EXT
 774         .save           = wg_save,
 775 #endif
 776 };
 777
 778 static int wg_init(void)
 779 {
 780         return vpn_register("wireguard", &vpn_driver, NULL);
 781 }
 782
 783 static void wg_exit(void)
 784 {
 785         vpn_unregister("wireguard");
 786 }
 787
 788 CONNMAN_PLUGIN_DEFINE(wireguard, "WireGuard VPN plugin", VERSION,
 789         CONNMAN_PLUGIN_PRIORITY_DEFAULT, wg_init, wg_exit)