vpn/plugins/wireguard.c

   1 /*
   2  *  ConnMan VPN daemon
   3  *
   4  *  Copyright (C) 2019  Daniel Wagner. All rights reserved.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License version 2 as
   8  *  published by the Free Software Foundation.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  18  */
  19
  20 #ifdef HAVE_CONFIG_H
  21 #include <config.h>
  22 #endif
  23
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <errno.h>
  27 #include <unistd.h>
  28 #include <net/if.h>
  29 #include <arpa/inet.h>
  30 #include <sys/types.h>
  31 #include <sys/socket.h>
  32 #include <netdb.h>
  33
  34 #include <glib.h>
  35
  36 #define CONNMAN_API_SUBJECT_TO_CHANGE
  37 #include <connman/plugin.h>
  38 #include <connman/log.h>
  39 #include <connman/task.h>
  40 #include <connman/ipconfig.h>
  41 #include <connman/inet.h>
  42 #include <connman/dbus.h>
  43 #include <connman/setting.h>
  44 #include <connman/vpn-dbus.h>
  45
  46 #include "../vpn-provider.h"
  47 #include "../vpn.h"
  48
  49 #include "vpn.h"
  50 #include "wireguard.h"
  51
  52 #define DNS_RERESOLVE_TIMEOUT 20
  53
  54 struct wireguard_info {
  55         struct wg_device device;
  56         struct wg_peer peer;
  57         char *endpoint_fqdn;
  58         char *port;
  59         int reresolve_id;
  60 };
  61
  62 struct sockaddr_u {
  63         union {
  64                 struct sockaddr sa;
  65                 struct sockaddr_in sin;
  66                 struct sockaddr_in6 sin6;
  67         };
  68 };
  69
  70 static int parse_key(const char *str, wg_key key)
  71 {
  72         unsigned char *buf;
  73         size_t len;
  74
  75         buf = g_base64_decode(str, &len);
  76
  77         if (len != 32) {
  78                 g_free(buf);
  79                 return -EINVAL;
  80         }
  81
  82         memcpy(key, buf, 32);
  83
  84         g_free(buf);
  85         return 0;
  86 }
  87
  88 static int parse_allowed_ips(const char *allowed_ips, wg_peer *peer)
  89 {
  90         struct wg_allowedip *curaip, *allowedip;
  91         char buf[INET6_ADDRSTRLEN];
  92         char **tokens, **toks;
  93         char *send;
  94         int i;
  95
  96         curaip = NULL;
  97         tokens = g_strsplit(allowed_ips, ", ", -1);
  98         for (i = 0; tokens[i]; i++) {
  99                 toks = g_strsplit(tokens[i], "/", -1);
 100                 if (g_strv_length(toks) != 2) {
 101                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 102                         g_strfreev(toks);
 103                         continue;
 104                 }
 105
 106                 allowedip = g_malloc0(sizeof(*allowedip));
 107
 108                 if (inet_pton(AF_INET, toks[0], buf) == 1) {
 109                         allowedip->family = AF_INET;
 110                         memcpy(&allowedip->ip4, buf, sizeof(allowedip->ip4));
 111                 } else if (inet_pton(AF_INET6, toks[0], buf) == 1) {
 112                         allowedip->family = AF_INET6;
 113                         memcpy(&allowedip->ip6, buf, sizeof(allowedip->ip6));
 114                 } else {
 115                         DBG("Ignore AllowedIPs value %s", tokens[i]);
 116                         g_free(allowedip);
 117                         g_strfreev(toks);
 118                         continue;
 119                 }
 120
 121                 allowedip->cidr = g_ascii_strtoull(toks[1], &send, 10);
 122
 123                 if (!curaip)
 124                         peer->first_allowedip = allowedip;
 125                 else
 126                         curaip->next_allowedip = allowedip;
 127
 128                 curaip = allowedip;
 129         }
 130
 131         peer->last_allowedip = curaip;
 132         g_strfreev(tokens);
 133
 134         return 0;
 135 }
 136
 137 static int parse_endpoint(const char *host, const char *port, struct sockaddr_u *addr)
 138 {
 139         struct addrinfo hints;
 140         struct addrinfo *result, *rp;
 141         int sk;
 142
 143         memset(&hints, 0, sizeof(struct addrinfo));
 144         hints.ai_family = AF_UNSPEC;
 145         hints.ai_socktype = SOCK_DGRAM;
 146         hints.ai_flags = 0;
 147         hints.ai_protocol = 0;
 148
 149         if (getaddrinfo(host, port, &hints, &result) < 0) {
 150                 DBG("Failed to resolve host address");
 151                 return -EINVAL;
 152         }
 153
 154         for (rp = result; rp; rp = rp->ai_next) {
 155                 sk = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
 156                 if (sk < 0)
 157                         continue;
 158                 if (connect(sk, rp->ai_addr, rp->ai_addrlen) != -1) {
 159                         /* success */
 160                         close(sk);
 161                         break;
 162                 }
 163
 164                 close(sk);
 165         }
 166
 167         if (!rp) {
 168                 freeaddrinfo(result);
 169                 return -EINVAL;
 170         }
 171
 172         memcpy(addr, rp->ai_addr, rp->ai_addrlen);
 173         freeaddrinfo(result);
 174
 175         return 0;
 176 }
 177
 178 static int parse_address(const char *address, const char *gateway,
 179                 struct connman_ipaddress **ipaddress)
 180 {
 181         char buf[INET6_ADDRSTRLEN];
 182         unsigned char prefixlen;
 183         char **tokens;
 184         char *end, *netmask;
 185         int err;
 186
 187         tokens = g_strsplit(address, "/", -1);
 188         if (g_strv_length(tokens) != 2) {
 189                 g_strfreev(tokens);
 190                 return -EINVAL;
 191         }
 192
 193         prefixlen = g_ascii_strtoull(tokens[1], &end, 10);
 194
 195         if (inet_pton(AF_INET, tokens[0], buf) == 1) {
 196                 netmask = g_strdup_printf("%d.%d.%d.%d",
 197                                 ((0xffffffff << (32 - prefixlen)) >> 24) & 0xff,
 198                                 ((0xffffffff << (32 - prefixlen)) >> 16) & 0xff,
 199                                 ((0xffffffff << (32 - prefixlen)) >> 8) & 0xff,
 200                                 ((0xffffffff << (32 - prefixlen)) >> 0) & 0xff);
 201
 202                 *ipaddress = connman_ipaddress_alloc(AF_INET);
 203                 err = connman_ipaddress_set_ipv4(*ipaddress, tokens[0],
 204                                                 netmask, gateway);
 205                 g_free(netmask);
 206         } else if (inet_pton(AF_INET6, tokens[0], buf) == 1) {
 207                 *ipaddress = connman_ipaddress_alloc(AF_INET6);
 208                 err = connman_ipaddress_set_ipv6(*ipaddress, tokens[0],
 209                                                 prefixlen, gateway);
 210         } else {
 211                 DBG("Invalid Wireguard.Address value");
 212                 err = -EINVAL;
 213         }
 214
 215         g_strfreev(tokens);
 216         if (err)
 217                 connman_ipaddress_free(*ipaddress);
 218
 219         return err;
 220 }
 221
 222 struct ifname_data {
 223         char *ifname;
 224         bool found;
 225 };
 226
 227 static void ifname_check_cb(int index, void *user_data)
 228 {
 229         struct ifname_data *data = (struct ifname_data *)user_data;
 230         char *ifname;
 231
 232         ifname = connman_inet_ifname(index);
 233
 234         if (!g_strcmp0(ifname, data->ifname))
 235                 data->found = true;
 236 }
 237
 238 static char *get_ifname(void)
 239 {
 240         struct ifname_data data;
 241         int i;
 242
 243         for (i = 0; i < 256; i++) {
 244                 data.ifname = g_strdup_printf("wg%d", i);
 245                 data.found = false;
 246                 vpn_ipconfig_foreach(ifname_check_cb, &data);
 247
 248                 if (!data.found)
 249                         return data.ifname;
 250
 251                 g_free(data.ifname);
 252         }
 253
 254         return NULL;
 255 }
 256
 257 static bool sockaddr_cmp_addr(struct sockaddr_u *a, struct sockaddr_u *b)
 258 {
 259         if (a->sa.sa_family != b->sa.sa_family)
 260                 return false;
 261
 262         if (a->sa.sa_family == AF_INET)
 263                 return !memcmp(&a->sin, &b->sin, sizeof(struct sockaddr_in));
 264         else if (a->sa.sa_family == AF_INET6)
 265                 return !memcmp(a->sin6.sin6_addr.s6_addr,
 266                                 b->sin6.sin6_addr.s6_addr,
 267                                 sizeof(a->sin6.sin6_addr.s6_addr));
 268
 269         return false;
 270 }
 271
 272 static gboolean wg_dns_reresolve_cb(gpointer user_data)
 273 {
 274         struct wireguard_info *info = user_data;
 275         struct sockaddr_u addr;
 276         int err;
 277
 278         DBG("");
 279
 280         err = parse_endpoint(info->endpoint_fqdn,
 281                         info->port, &addr);
 282         if (err)
 283                 return TRUE;
 284
 285         if (sockaddr_cmp_addr(&addr,
 286                         (struct sockaddr_u *)&info->peer.endpoint.addr))
 287                 return TRUE;
 288
 289         if (addr.sa.sa_family == AF_INET)
 290                 memcpy(&info->peer.endpoint.addr, &addr.sin,
 291                         sizeof(info->peer.endpoint.addr4));
 292         else
 293                 memcpy(&info->peer.endpoint.addr, &addr.sin6,
 294                         sizeof(info->peer.endpoint.addr6));
 295
 296         DBG("Endpoint address has changed, udpate WireGuard device");
 297         err = wg_set_device(&info->device);
 298         if (err)
 299                 DBG("Failed to update Endpoint address for WireGuard device %s",
 300                         info->device.name);
 301
 302         return TRUE;
 303 }
 304
 305 static int wg_connect(struct vpn_provider *provider,
 306                         struct connman_task *task, const char *if_name,
 307                         vpn_provider_connect_cb_t cb,
 308                         const char *dbus_sender, void *user_data)
 309 {
 310         struct connman_ipaddress *ipaddress = NULL;
 311         struct wireguard_info *info;
 312         const char *option, *gateway;
 313         char *ifname;
 314         int err = -EINVAL;
 315
 316         info = g_malloc0(sizeof(struct wireguard_info));
 317         info->peer.flags = WGPEER_HAS_PUBLIC_KEY | WGPEER_REPLACE_ALLOWEDIPS;
 318         info->device.flags = WGDEVICE_HAS_PRIVATE_KEY;
 319         info->device.first_peer = &info->peer;
 320         info->device.last_peer = &info->peer;
 321
 322         vpn_provider_set_plugin_data(provider, info);
 323
 324         option = vpn_provider_get_string(provider, "WireGuard.ListenPort");
 325         if (option) {
 326                 char *end;
 327                 info->device.listen_port = g_ascii_strtoull(option, &end, 10);
 328                 info->device.flags |= WGDEVICE_HAS_LISTEN_PORT;
 329         }
 330
 331         option = vpn_provider_get_string(provider, "WireGuard.DNS");
 332         if (option) {
 333                 err = vpn_provider_set_nameservers(provider, option);
 334                 if (err)
 335                         goto done;
 336         }
 337
 338         option = vpn_provider_get_string(provider, "WireGuard.PrivateKey");
 339         if (!option) {
 340                 DBG("WireGuard.PrivateKey is missing");
 341                 goto done;
 342         }
 343         err = parse_key(option, info->device.private_key);
 344         if (err)
 345                 goto done;
 346
 347         option = vpn_provider_get_string(provider, "WireGuard.PublicKey");
 348         if (!option) {
 349                 DBG("WireGuard.PublicKey is missing");
 350                 goto done;
 351         }
 352         err = parse_key(option, info->peer.public_key);
 353         if (err)
 354                 goto done;
 355
 356         option = vpn_provider_get_string(provider, "WireGuard.PresharedKey");
 357         if (option) {
 358                 info->peer.flags |= WGPEER_HAS_PRESHARED_KEY;
 359                 err = parse_key(option, info->peer.preshared_key);
 360                 if (err)
 361                         goto done;
 362         }
 363
 364         option = vpn_provider_get_string(provider, "WireGuard.AllowedIPs");
 365         if (!option) {
 366                 DBG("WireGuard.AllowedIPs is missing");
 367                 goto done;
 368         }
 369         err = parse_allowed_ips(option, &info->peer);
 370         if (err)
 371                 goto done;
 372
 373         option = vpn_provider_get_string(provider,
 374                                         "WireGuard.PersistentKeepalive");
 375         if (option) {
 376                 char *end;
 377                 info->peer.persistent_keepalive_interval =
 378                         g_ascii_strtoull(option, &end, 10);
 379                 info->peer.flags |= WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL;
 380         }
 381
 382         option = vpn_provider_get_string(provider, "WireGuard.EndpointPort");
 383         if (!option)
 384                 option = "51820";
 385
 386         gateway = vpn_provider_get_string(provider, "Host");
 387         err = parse_endpoint(gateway, option,
 388                         (struct sockaddr_u *)&info->peer.endpoint.addr);
 389         if (err)
 390                 goto done;
 391
 392         info->endpoint_fqdn = g_strdup(gateway);
 393         info->port = g_strdup(option);
 394
 395         option = vpn_provider_get_string(provider, "WireGuard.Address");
 396         if (!option) {
 397                 DBG("Missing WireGuard.Address configuration");
 398                 goto done;
 399         }
 400         err = parse_address(option, gateway, &ipaddress);
 401         if (err)
 402                 goto done;
 403
 404         ifname = get_ifname();
 405         if (!ifname) {
 406                 DBG("Failed to find an usable device name");
 407                 err = -ENOENT;
 408                 goto done;
 409         }
 410         stpncpy(info->device.name, ifname, sizeof(info->device.name));
 411         g_free(ifname);
 412
 413         err = wg_add_device(info->device.name);
 414         if (err) {
 415                 DBG("Failed to creating WireGuard device %s", info->device.name);
 416                 goto done;
 417         }
 418
 419         err = wg_set_device(&info->device);
 420         if (err) {
 421                 DBG("Failed to configure WireGuard device %s", info->device.name);
 422                 wg_del_device(info->device.name);
 423         }
 424
 425         vpn_set_ifname(provider, info->device.name);
 426         if (ipaddress)
 427                 vpn_provider_set_ipaddress(provider, ipaddress);
 428
 429 done:
 430         if (cb)
 431                 cb(provider, user_data, err);
 432
 433         connman_ipaddress_free(ipaddress);
 434
 435         if (!err)
 436                 info->reresolve_id =
 437                         g_timeout_add_seconds(DNS_RERESOLVE_TIMEOUT,
 438                                                 wg_dns_reresolve_cb, info);
 439
 440         return err;
 441 }
 442
 443 static void wg_disconnect(struct vpn_provider *provider)
 444 {
 445         struct wireguard_info *info;
 446
 447         info = vpn_provider_get_plugin_data(provider);
 448         if (!info)
 449                 return;
 450
 451         if (info->reresolve_id > 0)
 452                 g_source_remove(info->reresolve_id);
 453
 454         vpn_provider_set_plugin_data(provider, NULL);
 455
 456         wg_del_device(info->device.name);
 457
 458         g_free(info->endpoint_fqdn);
 459         g_free(info->port);
 460         g_free(info);
 461 }
 462
 463 static struct vpn_driver vpn_driver = {
 464         .flags          = VPN_FLAG_NO_TUN | VPN_FLAG_NO_DAEMON,
 465         .connect        = wg_connect,
 466         .disconnect     = wg_disconnect,
 467 };
 468
 469 static int wg_init(void)
 470 {
 471         return vpn_register("wireguard", &vpn_driver, NULL);
 472 }
 473
 474 static void wg_exit(void)
 475 {
 476         vpn_unregister("wireguard");
 477 }
 478
 479 CONNMAN_PLUGIN_DEFINE(wireguard, "WireGuard VPN plugin", VERSION,
 480         CONNMAN_PLUGIN_PRIORITY_DEFAULT, wg_init, wg_exit)