vpn/plugins/wireguard.c

   1 /*
   2  *  ConnMan VPN daemon
   3  *
   4  *  Copyright (C) 2019  Daniel Wagner. All rights reserved.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License version 2 as
   8  *  published by the Free Software Foundation.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  18  */
  19
  20 #ifdef HAVE_CONFIG_H
  21 #include <config.h>
  22 #endif
  23
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <net/if.h>
  29 #include <arpa/inet.h>
  30 #include <sys/types.h>
  31 #include <sys/socket.h>
  32 #include <netdb.h>
  33
  34 #include <glib.h>
  35
  36 #define CONNMAN_API_SUBJECT_TO_CHANGE
  37 #include <connman/plugin.h>
  38 #include <connman/log.h>
  39 #include <connman/task.h>
  40 #include <connman/ipconfig.h>
  41 #include <connman/inet.h>
  42 #include <connman/dbus.h>
  43 #include <connman/setting.h>
  44 #include <connman/vpn-dbus.h>
  45
  46 #include "../vpn-provider.h"
  47 #include "../vpn.h"
  48
  49 #include "vpn.h"
  50 #include "wireguard.h"
  51
  52 #define DNS_RERESOLVE_TIMEOUT 20
  53 #if defined TIZEN_EXT
  54 #define ADD_ALLOWED_IP_ROUTE_TIMEOUT 2
  55 #endif /* TIZEN_EXT */
  56
  57 struct wireguard_info {
  58         struct wg_device device;
  59         struct wg_peer peer;
  60         char *endpoint_fqdn;
  61         char *port;
  62         int reresolve_id;
  63 #if defined TIZEN_EXT
  64         int allowed_ip_route_id;
  65 #endif /* TIZEN_EXT */
  66 };
  67
  68 struct sockaddr_u {
  69         union {
  70                 struct sockaddr sa;
  71                 struct sockaddr_in sin;
  72                 struct sockaddr_in6 sin6;
  73         };
  74 };
  75
  76 static int parse_key(const char *str, wg_key key)
  77 {
  78         unsigned char *buf;
  79         size_t len;
  80
  81         buf = g_base64_decode(str, &len);
  82
  83         if (len != 32) {
  84                 g_free(buf);
  85                 return -EINVAL;
  86         }
  87
  88         memcpy(key, buf, 32);
  89
  90         g_free(buf);
  91         return 0;
  92 }
  93
  94 static int parse_allowed_ips(const char *allowed_ips, wg_peer *peer)
  95 {
  96         struct wg_allowedip *curaip, *allowedip;
  97         char buf[INET6_ADDRSTRLEN];
  98         char **tokens, **toks;
  99         char *send;
 100         int i;
 101
 102         curaip = NULL;
 103 #if defined TIZEN_EXT
 104         /**
 105          * Note: At API level we donot check Wireguard specific configurations,
 106          * User can provide any space separated string for IP.
 107          * Ideally it should be using "10.0.0.2/32, 10.0.0.3/32"
 108          * However there can be cases like "10.0.0.2/32,10.0.0.3/32"
 109          *
 110          * So we need to parse the allowed_ips configuration properly.
 111          */
 112         tokens = g_strsplit(allowed_ips, ",", -1);
 113 #else
 114         tokens = g_strsplit(allowed_ips, ", ", -1);
 115 #endif
 116         for (i = 0; tokens[i]; i++) {
 117 #if defined TIZEN_EXT
 118                 int len = strlen(tokens[i]);
 119                 char *ptr = tokens[i];
 120                 int j = -1;
 121
 122                 //skip forward spaces
 123                 while (++j < len && ptr[j] == ' ')
 124                         ;// Do Nothing
 125
 126                 if (!ptr[j])
 127                         continue;
 128
 129                 toks = g_strsplit(ptr + j, "/", -1);
 130                 if (g_strv_length(toks) != 2) {
 131                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 132                         g_strfreev(toks);
 133                         continue;
 134                 }
 135
 136                 DBG("Parsed AllowedIPs [%s]", ptr + j);
 137 #else
 138
 139                 toks = g_strsplit(tokens[i], "/", -1);
 140                 if (g_strv_length(toks) != 2) {
 141                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 142                         g_strfreev(toks);
 143                         continue;
 144                 }
 145 #endif
 146
 147                 allowedip = g_malloc0(sizeof(*allowedip));
 148
 149                 if (inet_pton(AF_INET, toks[0], buf) == 1) {
 150                         allowedip->family = AF_INET;
 151                         memcpy(&allowedip->ip4, buf, sizeof(allowedip->ip4));
 152                 } else if (inet_pton(AF_INET6, toks[0], buf) == 1) {
 153                         allowedip->family = AF_INET6;
 154                         memcpy(&allowedip->ip6, buf, sizeof(allowedip->ip6));
 155                 } else {
 156 #if defined TIZEN_EXT
 157                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 158 #else
 159                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 160 #endif
 161                         g_free(allowedip);
 162                         g_strfreev(toks);
 163                         continue;
 164                 }
 165
 166                 allowedip->cidr = g_ascii_strtoull(toks[1], &send, 10);
 167
 168                 if (!curaip)
 169                         peer->first_allowedip = allowedip;
 170                 else
 171                         curaip->next_allowedip = allowedip;
 172
 173                 curaip = allowedip;
 174 #if defined TIZEN_EXT
 175                 g_strfreev(toks);
 176 #endif
 177         }
 178
 179         peer->last_allowedip = curaip;
 180         g_strfreev(tokens);
 181
 182         return 0;
 183 }
 184
 185 static int parse_endpoint(const char *host, const char *port, struct sockaddr_u *addr)
 186 {
 187         struct addrinfo hints;
 188         struct addrinfo *result, *rp;
 189         int sk;
 190
 191         memset(&hints, 0, sizeof(struct addrinfo));
 192         hints.ai_family = AF_UNSPEC;
 193         hints.ai_socktype = SOCK_DGRAM;
 194         hints.ai_flags = 0;
 195         hints.ai_protocol = 0;
 196
 197         if (getaddrinfo(host, port, &hints, &result) < 0) {
 198                 DBG("Failed to resolve host address");
 199                 return -EINVAL;
 200         }
 201
 202         for (rp = result; rp; rp = rp->ai_next) {
 203                 sk = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
 204                 if (sk < 0)
 205                         continue;
 206                 if (connect(sk, rp->ai_addr, rp->ai_addrlen) != -1) {
 207                         /* success */
 208                         close(sk);
 209                         break;
 210                 }
 211
 212                 close(sk);
 213         }
 214
 215         if (!rp) {
 216                 freeaddrinfo(result);
 217                 return -EINVAL;
 218         }
 219
 220         memcpy(addr, rp->ai_addr, rp->ai_addrlen);
 221         freeaddrinfo(result);
 222
 223         return 0;
 224 }
 225
 226 static int parse_address(const char *address, const char *gateway,
 227                 struct connman_ipaddress **ipaddress)
 228 {
 229         char buf[INET6_ADDRSTRLEN];
 230         unsigned char prefixlen;
 231         char **tokens;
 232         char *end, *netmask;
 233         int err;
 234
 235         tokens = g_strsplit(address, "/", -1);
 236         if (g_strv_length(tokens) != 2) {
 237                 g_strfreev(tokens);
 238                 return -EINVAL;
 239         }
 240
 241         prefixlen = g_ascii_strtoull(tokens[1], &end, 10);
 242
 243         if (inet_pton(AF_INET, tokens[0], buf) == 1) {
 244                 netmask = g_strdup_printf("%d.%d.%d.%d",
 245                                 ((0xffffffff << (32 - prefixlen)) >> 24) & 0xff,
 246                                 ((0xffffffff << (32 - prefixlen)) >> 16) & 0xff,
 247                                 ((0xffffffff << (32 - prefixlen)) >> 8) & 0xff,
 248                                 ((0xffffffff << (32 - prefixlen)) >> 0) & 0xff);
 249
 250                 *ipaddress = connman_ipaddress_alloc(AF_INET);
 251                 err = connman_ipaddress_set_ipv4(*ipaddress, tokens[0],
 252                                                 netmask, gateway);
 253                 g_free(netmask);
 254         } else if (inet_pton(AF_INET6, tokens[0], buf) == 1) {
 255                 *ipaddress = connman_ipaddress_alloc(AF_INET6);
 256                 err = connman_ipaddress_set_ipv6(*ipaddress, tokens[0],
 257                                                 prefixlen, gateway);
 258         } else {
 259                 DBG("Invalid Wireguard.Address value");
 260                 err = -EINVAL;
 261         }
 262
 263         g_strfreev(tokens);
 264         if (err)
 265                 connman_ipaddress_free(*ipaddress);
 266
 267         return err;
 268 }
 269
 270 struct ifname_data {
 271         char *ifname;
 272         bool found;
 273 };
 274
 275 static void ifname_check_cb(int index, void *user_data)
 276 {
 277         struct ifname_data *data = (struct ifname_data *)user_data;
 278         char *ifname;
 279
 280         ifname = connman_inet_ifname(index);
 281
 282         if (!g_strcmp0(ifname, data->ifname))
 283                 data->found = true;
 284 }
 285
 286 static char *get_ifname(void)
 287 {
 288         struct ifname_data data;
 289         int i;
 290
 291         for (i = 0; i < 256; i++) {
 292                 data.ifname = g_strdup_printf("wg%d", i);
 293                 data.found = false;
 294                 vpn_ipconfig_foreach(ifname_check_cb, &data);
 295
 296                 if (!data.found)
 297                         return data.ifname;
 298
 299                 g_free(data.ifname);
 300         }
 301
 302         return NULL;
 303 }
 304
 305 static bool sockaddr_cmp_addr(struct sockaddr_u *a, struct sockaddr_u *b)
 306 {
 307         if (a->sa.sa_family != b->sa.sa_family)
 308                 return false;
 309
 310         if (a->sa.sa_family == AF_INET)
 311                 return !memcmp(&a->sin, &b->sin, sizeof(struct sockaddr_in));
 312         else if (a->sa.sa_family == AF_INET6)
 313                 return !memcmp(a->sin6.sin6_addr.s6_addr,
 314                                 b->sin6.sin6_addr.s6_addr,
 315                                 sizeof(a->sin6.sin6_addr.s6_addr));
 316
 317         return false;
 318 }
 319
 320 #if defined TIZEN_EXT
 321 #include <unistd.h>
 322 #include <sys/types.h>
 323 #include <sys/wait.h>
 324 #include <stdio.h>
 325
 326 #define MAX_SIZE_ERROR_BUFFER 256
 327 #define MAX_CMD_SIZE 80
 328
 329 typedef struct {
 330         struct vpn_provider *provider;
 331         struct wireguard_info *info;
 332 } wg_allowed_ip_route_cb_data_s;
 333
 334 static int wg_execute_cmd(const char *format, ...)
 335 {
 336         int status = 0;
 337         int rv = 0;
 338         char cmd[MAX_CMD_SIZE] = { 0, };
 339         char error_buf[MAX_SIZE_ERROR_BUFFER] = {0, };
 340         pid_t pid = 0;
 341         va_list va_ptr;
 342         gchar **args = NULL;
 343
 344         va_start(va_ptr, format);
 345         vsnprintf(cmd, (unsigned int) MAX_CMD_SIZE, format, va_ptr);
 346         va_end(va_ptr);
 347
 348         if (strlen(cmd) == 0)
 349                 return -EIO;
 350
 351         DBG("command: %s", cmd);
 352
 353         args = g_strsplit_set(cmd, " ", -1);
 354
 355         errno = 0;
 356         if (!(pid = fork())) {
 357                 DBG("pid(%d), ppid (%d)", getpid(), getppid());
 358
 359                 errno = 0;
 360                 if (execv(args[0], args) == -1) {
 361                         DBG("Fail to execute command (%s)",
 362                                         strerror_r(errno, error_buf, MAX_SIZE_ERROR_BUFFER));
 363                         g_strfreev(args);
 364                         exit(1);
 365                 }
 366         } else if (pid > 0) {
 367                 if (waitpid(pid, &status, 0) == -1)
 368                         DBG("wait pid (%u) status (%d)", pid, status);
 369
 370                 if (WIFEXITED(status)) {
 371                         rv = WEXITSTATUS(status);
 372                         DBG("exited, status=%d", rv);
 373
 374                 } else if (WIFSIGNALED(status)) {
 375                         DBG("killed by signal %d", WTERMSIG(status));
 376
 377                 } else if (WIFSTOPPED(status)) {
 378                         DBG("stopped by signal %d", WSTOPSIG(status));
 379
 380                 } else if (WIFCONTINUED(status)) {
 381                         DBG("continued");
 382                 }
 383
 384                 g_strfreev(args);
 385                 return rv;
 386         }
 387
 388         DBG("failed to fork(%s)", strerror_r(errno, error_buf, MAX_SIZE_ERROR_BUFFER));
 389         g_strfreev(args);
 390
 391         return -EIO;
 392 }
 393
 394 static gboolean wg_add_allowed_ip_route_cb(gpointer user_data)
 395 {
 396         wg_allowed_ip_route_cb_data_s *cb_data = user_data;
 397         const char *allowed_ips;
 398         char **tokens = NULL;
 399         char **toks = NULL;
 400         int i;
 401
 402         DBG("");
 403
 404         allowed_ips = vpn_provider_get_string(cb_data->provider, "WireGuard.AllowedIPs");
 405         if (!allowed_ips) {
 406                 DBG("WireGuard.AllowedIPs is missing");
 407                 goto done;
 408         }
 409
 410         tokens = g_strsplit(allowed_ips, ",", -1);
 411         if (g_strv_length(tokens) == 0)
 412                 goto done;
 413
 414         for (i = 0; tokens[i]; i++) {
 415                 int len = strlen(tokens[i]);
 416                 char *ptr = tokens[i];
 417                 int j = -1;
 418
 419                 //skip forward spaces
 420                 while (++j < len && ptr[j] == ' ')
 421                         ;// Do Nothing
 422
 423                 if (!ptr[j])
 424                         continue;
 425
 426                 toks = g_strsplit(ptr + j, "/", -1);
 427                 if (g_strv_length(toks) != 2) {
 428                         DBG("Ignore AllowedIPs value [%s]", ptr + j);
 429                         g_strfreev(toks);
 430                         continue;
 431                 }
 432                 g_strfreev(toks);
 433
 434                 DBG("Allowed IP: [%s], Device Name: [%s]", ptr + j, cb_data->info->device.name);
 435
 436                 // TODO: Remove system call to add route entry present in wg_execute_cmd()
 437                 if (!g_strcmp0("0.0.0.0/0", ptr + j)) {
 438                         // TODO: Update default route because user wants all data to be routed from wg0,
 439                         // when 0.0.0.0/0 is passed in allowed ips list.
 440                         // Should we replace the default route?
 441                         // If yes, then how to recover default route when wg0 tunnel is removed.
 442                 } else {
 443                         wg_execute_cmd("/usr/sbin/ip route add %s dev %s", ptr + j, cb_data->info->device.name);
 444                 }
 445         }
 446
 447 done:
 448         if (tokens)
 449                 g_strfreev(tokens);
 450
 451         free(cb_data);
 452
 453         return FALSE;
 454 }
 455 #endif /* TIZEN_EXT */
 456
 457 static gboolean wg_dns_reresolve_cb(gpointer user_data)
 458 {
 459         struct wireguard_info *info = user_data;
 460         struct sockaddr_u addr;
 461         int err;
 462
 463         DBG("");
 464
 465         err = parse_endpoint(info->endpoint_fqdn,
 466                         info->port, &addr);
 467         if (err)
 468                 return TRUE;
 469
 470         if (sockaddr_cmp_addr(&addr,
 471                         (struct sockaddr_u *)&info->peer.endpoint.addr))
 472                 return TRUE;
 473
 474         if (addr.sa.sa_family == AF_INET)
 475                 memcpy(&info->peer.endpoint.addr, &addr.sin,
 476                         sizeof(info->peer.endpoint.addr4));
 477         else
 478                 memcpy(&info->peer.endpoint.addr, &addr.sin6,
 479                         sizeof(info->peer.endpoint.addr6));
 480
 481         DBG("Endpoint address has changed, udpate WireGuard device");
 482         err = wg_set_device(&info->device);
 483         if (err)
 484                 DBG("Failed to update Endpoint address for WireGuard device %s",
 485                         info->device.name);
 486
 487         return TRUE;
 488 }
 489
 490 static int wg_connect(struct vpn_provider *provider,
 491                         struct connman_task *task, const char *if_name,
 492                         vpn_provider_connect_cb_t cb,
 493                         const char *dbus_sender, void *user_data)
 494 {
 495         struct connman_ipaddress *ipaddress = NULL;
 496         struct wireguard_info *info;
 497         const char *option, *gateway;
 498         char *ifname;
 499         int err = -EINVAL;
 500
 501         info = g_malloc0(sizeof(struct wireguard_info));
 502         info->peer.flags = WGPEER_HAS_PUBLIC_KEY | WGPEER_REPLACE_ALLOWEDIPS;
 503         info->device.flags = WGDEVICE_HAS_PRIVATE_KEY;
 504         info->device.first_peer = &info->peer;
 505         info->device.last_peer = &info->peer;
 506
 507         vpn_provider_set_plugin_data(provider, info);
 508
 509         option = vpn_provider_get_string(provider, "WireGuard.ListenPort");
 510         if (option) {
 511                 char *end;
 512                 info->device.listen_port = g_ascii_strtoull(option, &end, 10);
 513                 info->device.flags |= WGDEVICE_HAS_LISTEN_PORT;
 514         }
 515
 516         option = vpn_provider_get_string(provider, "WireGuard.DNS");
 517         if (option) {
 518                 err = vpn_provider_set_nameservers(provider, option);
 519                 if (err)
 520                         goto done;
 521         }
 522
 523         option = vpn_provider_get_string(provider, "WireGuard.PrivateKey");
 524         if (!option) {
 525                 DBG("WireGuard.PrivateKey is missing");
 526                 goto done;
 527         }
 528         err = parse_key(option, info->device.private_key);
 529         if (err)
 530                 goto done;
 531
 532         option = vpn_provider_get_string(provider, "WireGuard.PublicKey");
 533         if (!option) {
 534                 DBG("WireGuard.PublicKey is missing");
 535                 goto done;
 536         }
 537         err = parse_key(option, info->peer.public_key);
 538         if (err)
 539                 goto done;
 540
 541         option = vpn_provider_get_string(provider, "WireGuard.PresharedKey");
 542         if (option) {
 543                 info->peer.flags |= WGPEER_HAS_PRESHARED_KEY;
 544                 err = parse_key(option, info->peer.preshared_key);
 545                 if (err)
 546                         goto done;
 547         }
 548
 549         option = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 550         if (!option) {
 551                 DBG("WireGuard.AllowedIPs is missing");
 552                 goto done;
 553         }
 554         err = parse_allowed_ips(option, &info->peer);
 555         if (err)
 556                 goto done;
 557
 558         option = vpn_provider_get_string(provider,
 559                                         "WireGuard.PersistentKeepalive");
 560         if (option) {
 561                 char *end;
 562                 info->peer.persistent_keepalive_interval =
 563                         g_ascii_strtoull(option, &end, 10);
 564                 info->peer.flags |= WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL;
 565         }
 566
 567         option = vpn_provider_get_string(provider, "WireGuard.EndpointPort");
 568         if (!option)
 569                 option = "51820";
 570
 571         gateway = vpn_provider_get_string(provider, "Host");
 572         err = parse_endpoint(gateway, option,
 573                         (struct sockaddr_u *)&info->peer.endpoint.addr);
 574         if (err)
 575                 goto done;
 576
 577         info->endpoint_fqdn = g_strdup(gateway);
 578         info->port = g_strdup(option);
 579
 580         option = vpn_provider_get_string(provider, "WireGuard.Address");
 581         if (!option) {
 582                 DBG("Missing WireGuard.Address configuration");
 583                 goto done;
 584         }
 585         err = parse_address(option, gateway, &ipaddress);
 586         if (err)
 587                 goto done;
 588
 589         ifname = get_ifname();
 590         if (!ifname) {
 591                 DBG("Failed to find an usable device name");
 592                 err = -ENOENT;
 593                 goto done;
 594         }
 595         stpncpy(info->device.name, ifname, sizeof(info->device.name) - 1);
 596         g_free(ifname);
 597
 598         err = wg_add_device(info->device.name);
 599         if (err) {
 600                 DBG("Failed to creating WireGuard device %s", info->device.name);
 601                 goto done;
 602         }
 603
 604         err = wg_set_device(&info->device);
 605         if (err) {
 606                 DBG("Failed to configure WireGuard device %s", info->device.name);
 607                 wg_del_device(info->device.name);
 608         }
 609
 610         vpn_set_ifname(provider, info->device.name);
 611         if (ipaddress)
 612                 vpn_provider_set_ipaddress(provider, ipaddress);
 613
 614 done:
 615         if (cb)
 616                 cb(provider, user_data, err);
 617
 618         connman_ipaddress_free(ipaddress);
 619
 620 #if defined TIZEN_EXT
 621         if (!err) {
 622                 const char *allowed_ips = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 623                 if (allowed_ips) {
 624                         wg_allowed_ip_route_cb_data_s *cb_data =
 625                                 (wg_allowed_ip_route_cb_data_s *) calloc(1, sizeof(wg_allowed_ip_route_cb_data_s));
 626                         if (cb_data) {
 627                                 cb_data->provider = provider;
 628                                 cb_data->info = info;
 629
 630                                 info->allowed_ip_route_id =
 631                                         g_timeout_add_seconds(ADD_ALLOWED_IP_ROUTE_TIMEOUT,
 632                                                         wg_add_allowed_ip_route_cb, cb_data);
 633                         }
 634                 }
 635         }
 636 #endif /* TIZEN_EXT */
 637
 638         if (!err)
 639                 info->reresolve_id =
 640                         g_timeout_add_seconds(DNS_RERESOLVE_TIMEOUT,
 641                                                 wg_dns_reresolve_cb, info);
 642
 643         return err;
 644 }
 645
 646 static void wg_disconnect(struct vpn_provider *provider)
 647 {
 648         struct wireguard_info *info;
 649
 650         info = vpn_provider_get_plugin_data(provider);
 651         if (!info)
 652                 return;
 653
 654 #if defined TIZEN_EXT
 655         if (info->allowed_ip_route_id > 0)
 656                 g_source_remove(info->allowed_ip_route_id);
 657 #endif /* TIZEN_EXT */
 658
 659         if (info->reresolve_id > 0)
 660                 g_source_remove(info->reresolve_id);
 661
 662         vpn_provider_set_plugin_data(provider, NULL);
 663
 664         wg_del_device(info->device.name);
 665
 666         g_free(info->endpoint_fqdn);
 667         g_free(info->port);
 668         g_free(info);
 669 }
 670
 671 #if defined TIZEN_EXT
 672 static int wg_save(struct vpn_provider *provider, GKeyFile *keyfile)
 673 {
 674         const char *option;
 675
 676         DBG("");
 677
 678         /*
 679          * The client/own device listen port.
 680          */
 681         option = vpn_provider_get_string(provider, "WireGuard.ListenPort");
 682         if (option)
 683                 g_key_file_set_string(keyfile,
 684                                 vpn_provider_get_save_group(provider),
 685                                 "WireGuard.ListenPort",
 686                                 option);
 687
 688         /*
 689          * comma separated DNS.
 690          */
 691         option = vpn_provider_get_string(provider, "WireGuard.DNS");
 692         if (option)
 693                 g_key_file_set_string(keyfile,
 694                                 vpn_provider_get_save_group(provider),
 695                                 "WireGuard.DNS",
 696                                 option);
 697
 698         /*
 699          * The client private key.
 700          */
 701         option = vpn_provider_get_string(provider, "WireGuard.PrivateKey");
 702         if (option)
 703                 g_key_file_set_string(keyfile,
 704                                 vpn_provider_get_save_group(provider),
 705                                 "WireGuard.PrivateKey",
 706                                 option);
 707
 708         /*
 709          * The server public key.
 710          */
 711         option = vpn_provider_get_string(provider, "WireGuard.PublicKey");
 712         if (option)
 713                 g_key_file_set_string(keyfile,
 714                                 vpn_provider_get_save_group(provider),
 715                                 "WireGuard.PublicKey",
 716                                 option);
 717
 718         /*
 719          * The preshared key.
 720          */
 721         option = vpn_provider_get_string(provider, "WireGuard.PresharedKey");
 722         if (option)
 723                 g_key_file_set_string(keyfile,
 724                                 vpn_provider_get_save_group(provider),
 725                                 "WireGuard.PresharedKey",
 726                                 option);
 727
 728         /*
 729          * Subnets accessed via VPN tunnel, 0.0.0.0/0 routes all traffic.
 730          */
 731         option = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 732         if (option)
 733                 g_key_file_set_string(keyfile,
 734                                 vpn_provider_get_save_group(provider),
 735                                 "WireGuard.AllowedIPs",
 736                                 option);
 737
 738         /*
 739          * The time in seconds to emit periodic keep alive message.
 740          */
 741         option = vpn_provider_get_string(provider, "WireGuard.PersistentKeepalive");
 742         if (option)
 743                 g_key_file_set_string(keyfile,
 744                                 vpn_provider_get_save_group(provider),
 745                                 "WireGuard.PersistentKeepalive",
 746                                 option);
 747
 748         /*
 749          * The server listen port, default: 51820
 750          */
 751         option = vpn_provider_get_string(provider, "WireGuard.EndpointPort");
 752         if (option)
 753                 g_key_file_set_string(keyfile,
 754                                 vpn_provider_get_save_group(provider),
 755                                 "WireGuard.EndpointPort",
 756                                 option);
 757
 758         /*
 759          * Save Address: The internal IP of the client node
 760          */
 761         option = vpn_provider_get_string(provider, "WireGuard.Address");
 762         if (option)
 763                 g_key_file_set_string(keyfile,
 764                                 vpn_provider_get_save_group(provider),
 765                                 "WireGuard.Address",
 766                                 option);
 767
 768         return 0;
 769 }
 770 #endif
 771
 772 static struct vpn_driver vpn_driver = {
 773         .flags          = VPN_FLAG_NO_TUN | VPN_FLAG_NO_DAEMON,
 774         .connect        = wg_connect,
 775         .disconnect     = wg_disconnect,
 776 #if defined TIZEN_EXT
 777         .save           = wg_save,
 778 #endif
 779 };
 780
 781 static int wg_init(void)
 782 {
 783         return vpn_register("wireguard", &vpn_driver, NULL);
 784 }
 785
 786 static void wg_exit(void)
 787 {
 788         vpn_unregister("wireguard");
 789 }
 790
 791 CONNMAN_PLUGIN_DEFINE(wireguard, "WireGuard VPN plugin", VERSION,
 792         CONNMAN_PLUGIN_PRIORITY_DEFAULT, wg_init, wg_exit)