diff options
| -rw-r--r-- | Makefile.plugins | 21 | ||||
| -rwxr-xr-x | bootstrap-configure | 1 | ||||
| -rw-r--r-- | configure.ac | 17 | ||||
| -rw-r--r-- | plugins/openconnect.c | 425 | ||||
| -rw-r--r-- | scripts/openconnect-script.c | 130 |
5 files changed, 594 insertions, 0 deletions
diff --git a/Makefile.plugins b/Makefile.plugins index d774720f..052a24d6 100644 --- a/Makefile.plugins +++ b/Makefile.plugins @@ -151,6 +151,21 @@ plugins_resolvconf_la_LDFLAGS = $(plugin_ldflags) endif endif +if OPENCONNECT +if OPENCONNECT_BUILTIN +builtin_modules += openconnect +builtin_sources += plugins/openconnect.c +builtin_cflags += -DOPENCONNECT=\"@OPENCONNECT@\" +else +plugin_LTLIBRARIES += plugins/openconnect.la +plugin_objects += $(plugins_openconnect_la_OBJECTS) +plugins_openconnect_la_CFLAGS = $(plugin_cflags) -DOPENCONNECT=\"@OPENCONNECT@\" \ + -DSTATEDIR=\""$(statedir)"\" \ + -DSCRIPTDIR=\""$(build_scriptdir)"\" +plugins_openconnect_la_LDFLAGS = $(plugin_ldflags) +endif +endif + if DNSPROXY if DNSPROXY_BUILTIN builtin_modules += dnsproxy @@ -214,6 +229,12 @@ script_PROGRAMS += scripts/udhcpc-script scripts_udhcpc_script_LDADD = @DBUS_LIBS@ endif +if OPENCONNECT +script_PROGRAMS += scripts/openconnect-script + +scripts_openconnect_script_LDADD = @DBUS_LIBS@ +endif + if DHCLIENT script_DATA += scripts/dhclient.conf script_PROGRAMS += scripts/dhclient-script diff --git a/bootstrap-configure b/bootstrap-configure index c6ae4eb0..aa3c6ff5 100755 --- a/bootstrap-configure +++ b/bootstrap-configure @@ -23,6 +23,7 @@ fi --enable-ofono=builtin \ --enable-udhcp=builtin \ --enable-dhclient=builtin \ + --enable-openconnect=buildin \ --enable-resolvconf=builtin \ --enable-dnsproxy=builtin \ --enable-hso=builtin \ diff --git a/configure.ac b/configure.ac index b7e443c0..1dc71848 100644 --- a/configure.ac +++ b/configure.ac @@ -143,6 +143,23 @@ fi AM_CONDITIONAL(RESOLVCONF, test "${enable_resolvconf}" != "no") AM_CONDITIONAL(RESOLVCONF_BUILTIN, test "${enable_resolvconf}" = "builtin") +AC_ARG_WITH(openconnect, AC_HELP_STRING([--with-openconnect=PROGRAM], + [specify location of openconnect binary]), [path_openconnect=${withval}]) + +AC_ARG_ENABLE(openconnect, + AC_HELP_STRING([--enable-openconnect], [enable openconnect support]), + [enable_openconnect=${enableval}], [enable_openconnect="no"]) +if (test "${enable_openconnect}" != "no"); then + if (test -z "${path_openconnect}"); then + AC_PATH_PROG(OPENCONNECT, [openconnect], [], $PATH:/sbin:/usr/sbin) + else + OPENCONNECT="${path_openconnect}" + AC_SUBST(OPENCONNECT) + fi +fi +AM_CONDITIONAL(OPENCONNECT, test "${enable_openconnect}" != "no") +AM_CONDITIONAL(OPENCONNECT_BUILTIN, test "${enable_openconnect}" = "builtin") + AC_ARG_ENABLE(loopback, AC_HELP_STRING([--enable-loopback], [enable loopback support]), [enable_loopback=${enableval}], [enable_loopback="no"]) diff --git a/plugins/openconnect.c b/plugins/openconnect.c new file mode 100644 index 00000000..40acd82e --- /dev/null +++ b/plugins/openconnect.c @@ -0,0 +1,425 @@ +/* + * + * Connection Manager + * + * Copyright (C) 2007-2009 Intel Corporation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + * + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <string.h> +#include <fcntl.h> +#include <unistd.h> +#include <sys/stat.h> +#include <sys/wait.h> +#include <stdio.h> +#include <errno.h> +#include <sys/ioctl.h> +#include <linux/if_tun.h> +#include <net/if.h> +#include <stdint.h> + +#include <glib/garray.h> +#include <glib/gerror.h> +#include <glib/gmain.h> +#include <glib/gspawn.h> + +#define CONNMAN_API_SUBJECT_TO_CHANGE +#include <connman/plugin.h> +#include <connman/device.h> +#include <connman/element.h> +#include <connman/provider.h> +#include <connman/log.h> +#include <connman/element.h> +#include <connman/rtnl.h> +#include <connman/task.h> + +#include "inet.h" + +struct oc_data { + char *if_name; + unsigned flags; + unsigned int watch; + struct connman_task *task; +}; + +static int kill_tun(char *tun_name) +{ + struct ifreq ifr; + int fd, err; + + memset(&ifr, 0, sizeof(ifr)); + ifr.ifr_flags = IFF_TUN | IFF_NO_PI; + sprintf(ifr.ifr_name, tun_name); + + fd = open("/dev/net/tun", O_RDWR); + if (fd < 0) { + err = -errno; + connman_error("Failed to open /dev/net/tun to device %s: %s", + tun_name, strerror(errno)); + return err; + } + + if (ioctl(fd, TUNSETIFF, (void *)&ifr)) { + err = -errno; + connman_error("Failed to TUNSETIFF for device %s to it: %s", + tun_name, strerror(errno)); + close(fd); + return err; + } + + if (ioctl(fd, TUNSETPERSIST, 0)) { + err = -errno; + connman_error("Failed to set tun device %s nonpersistent: %s", + tun_name, strerror(errno)); + close(fd); + return err; + } + close(fd); + DBG("Killed tun device %s", tun_name); + return 0; +} + +static void openconnect_died(struct connman_task *task, void *user_data) +{ + struct connman_provider *provider = user_data; + struct oc_data *data = connman_provider_get_data(provider); + + DBG("provider %p data %p", provider, data); + + if (!data) + goto oc_exit; + + kill_tun(data->if_name); + connman_provider_set_data(provider, NULL); + connman_rtnl_remove_watch(data->watch); + g_free(data); + + oc_exit: + connman_provider_set_connected(provider, FALSE); + connman_provider_set_index(provider, -1); + connman_provider_unref(provider); + connman_task_destroy(task); +} + +static void vpn_newlink(unsigned flags, unsigned change, void *user_data) +{ + struct connman_provider *provider = user_data; + struct oc_data *data = connman_provider_get_data(provider); + + if ((data->flags & IFF_UP) != (flags & IFF_UP)) { + if (flags & IFF_UP) + connman_provider_set_connected(provider, TRUE); + } + data->flags = flags; +} + +static void openconnect_task_notify(struct connman_task *task, + DBusMessage *msg, void *user_data) +{ + DBusMessageIter iter, dict; + struct connman_provider *provider = user_data; + struct oc_data *data; + const char *reason, *key, *value; + const char *domain = NULL; + int index; + + dbus_message_iter_init(msg, &iter); + + dbus_message_iter_get_basic(&iter, &reason); + dbus_message_iter_next(&iter); + + if (!provider) { + connman_error("No provider found"); + return; + } + + data = connman_provider_get_data(provider); + if (!data) { + DBG("provider %p no data", provider); + return; + } + + if (strcmp(reason, "connect")) { + connman_provider_set_connected(provider, FALSE); + return; + } + + domain = connman_provider_get_string(provider, "VPN.Domain"); + + dbus_message_iter_recurse(&iter, &dict); + + while (dbus_message_iter_get_arg_type(&dict) == DBUS_TYPE_DICT_ENTRY) { + DBusMessageIter entry; + + dbus_message_iter_recurse(&dict, &entry); + dbus_message_iter_get_basic(&entry, &key); + dbus_message_iter_next(&entry); + dbus_message_iter_get_basic(&entry, &value); + + if (strcmp(key, "CISCO_CSTP_OPTIONS")) + DBG("%s = %s", key, value); + + if (!strcmp(key, "VPNGATEWAY")) + connman_provider_set_string(provider, "Gateway", value); + + if (!strcmp(key, "INTERNAL_IP4_ADDRESS")) + connman_provider_set_string(provider, "Address", value); + + if (!strcmp(key, "INTERNAL_IP4_NETMASK")) + connman_provider_set_string(provider, "Netmask", value); + + if (!strcmp(key, "INTERNAL_IP4_DNS")) + connman_provider_set_string(provider, "DNS", value); + + if (domain == NULL && !strcmp(key, "CISCO_DEF_DOMAIN")) + domain = value; + + dbus_message_iter_next(&dict); + } + + index = connman_provider_get_index(provider); + connman_provider_set_string(provider, "Domain", domain); + data->watch = connman_rtnl_add_newlink_watch(index, + vpn_newlink, provider); + + connman_inet_ifup(index); +} + +static int oc_connect(struct connman_provider *provider) +{ + struct oc_data *data = connman_provider_get_data(provider); + struct ifreq ifr; + int oc_fd, fd, i, index; + const char *vpnhost, *vpncookie, *cafile, *mtu; + int ret = 0; + + if (data != NULL) + return -EISCONN; + + data = g_try_new0(struct oc_data, 1); + if (data == NULL) + return -ENOMEM; + + data->watch = 0; + data->flags = 0; + data->task = NULL; + + connman_provider_set_data(provider, data); + + vpnhost = connman_provider_get_string(provider, "OpenConnect.Host"); + if (!vpnhost) { + connman_error("OpenConnect.Host not set; cannot enable VPN"); + ret = -EINVAL; + goto exist_err; + } + + vpncookie = connman_provider_get_string(provider, "OpenConnect.Cookie"); + if (!vpncookie) { + connman_error("OpenConnect.Cookie not set; cannot enable VPN"); + ret = -EINVAL; + goto exist_err; + } + + cafile = connman_provider_get_string(provider, "OpenConnect.CACert"); + mtu = connman_provider_get_string(provider, "VPN.MTU"); + + fd = open("/dev/net/tun", O_RDWR); + if (fd < 0) { + i = -errno; + connman_error("Failed to open /dev/net/tun: %s", + strerror(errno)); + ret = i; + goto exist_err; + } + + memset(&ifr, 0, sizeof(ifr)); + ifr.ifr_flags = IFF_TUN | IFF_NO_PI; + + for (i = 0; i < 256; i++) { + sprintf(ifr.ifr_name, "vpn%d", i); + + if (!ioctl(fd, TUNSETIFF, (void *)&ifr)) + break; + } + + if (i == 256) { + connman_error("Failed to find available tun device"); + close(fd); + ret = -ENODEV; + goto exist_err; + } + + data->if_name = (char *)g_strdup(ifr.ifr_name); + if (!data->if_name) { + ret = -ENOMEM; + goto exist_err; + } + + if (ioctl(fd, TUNSETPERSIST, 1)) { + i = -errno; + connman_error("Failed to set tun persistent: %s", + strerror(errno)); + close(fd); + ret = i; + goto exist_err; + } + + close(fd); + + index = connman_inet_ifindex(data->if_name); + if (index < 0) { + connman_error("Failed to get tun ifindex"); + kill_tun(data->if_name); + ret = -EIO; + goto exist_err; + } + connman_provider_set_index(provider, index); + + data->task = connman_task_create(OPENCONNECT); + + if (data->task == NULL) { + ret = -ENOMEM; + kill_tun(data->if_name); + goto exist_err; + } + + if (connman_task_set_notify(data->task, "notify", + openconnect_task_notify, provider)) { + ret = -ENOMEM; + kill_tun(data->if_name); + connman_task_destroy(data->task); + data->task = NULL; + goto exist_err; + } + + if (cafile) + connman_task_add_argument(data->task, "--cafile", + (char *)cafile); + if (mtu) + connman_task_add_argument(data->task, "--mtu", (char *)mtu); + + connman_task_add_argument(data->task, "--syslog", NULL); + connman_task_add_argument(data->task, "--cookie-on-stdin", NULL); + + connman_task_add_argument(data->task, "--script", + SCRIPTDIR "/openconnect-script"); + + connman_task_add_argument(data->task, "--interface", data->if_name); + + connman_task_add_argument(data->task, (char *)vpnhost, NULL); + + ret = connman_task_run(data->task, openconnect_died, provider, + &oc_fd, NULL, NULL); + if (ret) { + connman_error("Openconnect failed to start"); + kill_tun(data->if_name); + ret = -EIO; + connman_task_destroy(data->task); + data->task = NULL; + goto exist_err; + } + + DBG("openconnect started with dev %s", data->if_name); + + if (write(oc_fd, vpncookie, strlen(vpncookie)) != + (ssize_t)strlen(vpncookie) || + write(oc_fd, "\n", 1) != 1) { + connman_error("openconnect failed to take cookie on stdin"); + connman_provider_set_data(provider, NULL); + connman_task_stop(data->task); + ret = -EIO; + goto exist_err; + } + + connman_provider_ref(provider); + return -EINPROGRESS; + + exist_err: + connman_provider_set_index(provider, -1); + connman_provider_set_data(provider, NULL); + g_free(data); + + return ret; +} + +static int oc_probe(struct connman_provider *provider) +{ + return 0; +} + +static int oc_disconnect(struct connman_provider *provider) +{ + struct oc_data *data = connman_provider_get_data(provider); + + DBG("disconnect provider %p:", provider); + + if (data == NULL) + return 0; + + if (data->watch != 0) + connman_rtnl_remove_watch(data->watch); + + data->watch = 0; + connman_task_stop(data->task); + + return 0; +} + +static int oc_remove(struct connman_provider *provider) +{ + struct oc_data *data; + + data = connman_provider_get_data(provider); + connman_provider_set_data(provider, NULL); + if (data == NULL) + return 0; + + if (data->watch != 0) + connman_rtnl_remove_watch(data->watch); + data->watch = 0; + connman_task_stop(data->task); + + g_usleep(G_USEC_PER_SEC); + kill_tun(data->if_name); + return 0; +} + +static struct connman_provider_driver provider_driver = { + .name = "openconnect", + .disconnect = oc_disconnect, + .connect = oc_connect, + .probe = oc_probe, + .remove = oc_remove, +}; + +static int openconnect_init(void) +{ + connman_provider_driver_register(&provider_driver); + + return 0; +} + +static void openconnect_exit(void) +{ + connman_provider_driver_unregister(&provider_driver); +} + +CONNMAN_PLUGIN_DEFINE(openconnect, "OpenConnect VPN plugin", VERSION, + CONNMAN_PLUGIN_PRIORITY_DEFAULT, openconnect_init, openconnect_exit) diff --git a/scripts/openconnect-script.c b/scripts/openconnect-script.c new file mode 100644 index 00000000..a04c9f46 --- /dev/null +++ b/scripts/openconnect-script.c @@ -0,0 +1,130 @@ +/* + * + * Connection Manager + * + * Copyright (C) 2007-2009 Intel Corporation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + * + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include <dbus/dbus.h> + +extern char **environ; + +static void append(DBusMessageIter *dict, const char *pattern) +{ + DBusMessageIter entry; + const char *key, *value; + char *delim; + + delim = strchr(pattern, '='); + *delim = '\0'; + + key = pattern; + value = delim + 1; + + /* We clean the environment before invoking openconnect, but + might as well still filter out the few things that get + added that we're not interested in */ + if (!strcmp(key, "PWD") || !strcmp(key, "_") || + !strcmp(key, "SHLVL") || !strcmp(key, "connman_busname") || + !strcmp(key, "connman_network")) + return; + + dbus_message_iter_open_container(dict, DBUS_TYPE_DICT_ENTRY, + NULL, &entry); + + dbus_message_iter_append_basic(&entry, DBUS_TYPE_STRING, &key); + + dbus_message_iter_append_basic(&entry, DBUS_TYPE_STRING, &value); + + dbus_message_iter_close_container(dict, &entry); +} + +int main(int argc, char *argv[]) +{ + DBusConnection *conn; + DBusError error; + DBusMessage *msg; + DBusMessageIter iter, dict; + char **envp, *busname, *reason, *interface, *path; + + busname = getenv("CONNMAN_BUSNAME"); + interface = getenv("CONNMAN_INTERFACE"); + path = getenv("CONNMAN_PATH"); + + reason = getenv("reason"); + + if (!busname || !interface || !path || !reason) { + fprintf(stderr, "Required environment variables not set\n"); + return 1; + } + dbus_error_init(&error); + + conn = dbus_bus_get(DBUS_BUS_SYSTEM, &error); + if (conn == NULL) { + if (dbus_error_is_set(&error) == TRUE) { + fprintf(stderr, "%s\n", error.message); + dbus_error_free(&error); + } else + fprintf(stderr, "Failed to get on system bus\n"); + return 0; + } + + msg = dbus_message_new_method_call(busname, path, + interface, "notify"); + if (msg == NULL) { + dbus_connection_unref(conn); + fprintf(stderr, "Failed to allocate method call\n"); + return 0; + } + + dbus_message_set_no_reply(msg, TRUE); + + dbus_message_append_args(msg, + DBUS_TYPE_STRING, &reason, + DBUS_TYPE_INVALID); + + dbus_message_iter_init_append(msg, &iter); + + dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, + DBUS_DICT_ENTRY_BEGIN_CHAR_AS_STRING + DBUS_TYPE_STRING_AS_STRING DBUS_TYPE_STRING_AS_STRING + DBUS_DICT_ENTRY_END_CHAR_AS_STRING, &dict); + + for (envp = environ; envp && *envp; envp++) + append(&dict, *envp); + + dbus_message_iter_close_container(&iter, &dict); + + if (dbus_connection_send(conn, msg, NULL) == FALSE) + fprintf(stderr, "Failed to send message\n"); + + dbus_connection_flush(conn); + + dbus_message_unref(msg); + + dbus_connection_unref(conn); + + return 0; +} |