// SPDX-License-Identifier: GPL-2.0+

/*

 * Copyright (C) 2005 - 2013 Red Hat, Inc.

 * Copyright (C) 2006 - 2008 Novell, Inc.

 */

#include "nm-default.h"

#include "nm-vpn-connection.h"

#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <stdlib.h>

#include <unistd.h>

#include <syslog.h>

#include <linux/rtnetlink.h>

#include "nm-proxy-config.h"

#include "nm-ip4-config.h"

#include "nm-ip6-config.h"

#include "platform/nm-platform.h"

#include "nm-active-connection.h"

#include "NetworkManagerUtils.h"

#include "settings/nm-settings-connection.h"

#include "nm-dispatcher.h"

#include "nm-netns.h"

#include "settings/nm-agent-manager.h"

#include "nm-core-internal.h"

#include "nm-pacrunner-manager.h"

#include "nm-firewall-manager.h"

#include "nm-config.h"

#include "nm-vpn-plugin-info.h"

#include "nm-vpn-manager.h"

#include "dns/nm-dns-manager.h"

typedef enum {

	/* Only system secrets */

	SECRETS_REQ_SYSTEM = 0,

	/* All existing secrets including agent secrets */

	SECRETS_REQ_EXISTING = 1,

	/* New secrets required; ask an agent */

	SECRETS_REQ_NEW = 2,

	/* Plugin requests secrets interactively */

	SECRETS_REQ_INTERACTIVE = 3,

	/* Placeholder for bounds checking */

	SECRETS_REQ_LAST

} SecretsReq;

/* Internal VPN states, private to NMVpnConnection */

typedef enum {

	STATE_UNKNOWN = 0,

	STATE_WAITING,

	STATE_PREPARE,

	STATE_NEED_AUTH,

	STATE_CONNECT,

	STATE_IP_CONFIG_GET,

	STATE_PRE_UP,

	STATE_ACTIVATED,

	STATE_DEACTIVATING,

	STATE_DISCONNECTED,

	STATE_FAILED,

} VpnState;

enum {

	INTERNAL_STATE_CHANGED,

	INTERNAL_RETRY_AFTER_FAILURE,

	LAST_SIGNAL

};

static guint signals[LAST_SIGNAL] = { 0 };

NM_GOBJECT_PROPERTIES_DEFINE (NMVpnConnection,

	PROP_VPN_STATE,

	PROP_BANNER,

#define PROP_IP4_CONFIG 2000

#define PROP_IP6_CONFIG 2001

#define PROP_MASTER     2002

);

typedef struct {

	gboolean service_can_persist;

	gboolean connection_can_persist;

	NMSettingsConnectionCallId *secrets_id;

	SecretsReq secrets_idx;

	char *username;

	VpnState vpn_state;

	NMDispatcherCallId *dispatcher_id;

	NMActiveConnectionStateReason failure_reason;

	NMVpnServiceState service_state;

	guint start_timeout;

	gboolean service_running;

	NMVpnPluginInfo *plugin_info;

	char *bus_name;

	NMFirewallManagerCallId *fw_call;

	NMNetns *netns;

	GPtrArray *ip4_dev_route_blacklist;

	GDBusProxy *proxy;

	GCancellable *cancellable;

	GVariant *connect_hash;

	guint connect_timeout;

	NMProxyConfig *proxy_config;

	NMPacrunnerConfId *pacrunner_conf_id;

	gboolean has_ip4;

	NMIP4Config *ip4_config;

	guint32 ip4_internal_gw;

	guint32 ip4_external_gw;

	gboolean has_ip6;

	NMIP6Config *ip6_config;

	/* These config instances are passed on to NMDevice and modified by NMDevice.

	 * This pointer is only useful for nm_device_replace_vpn4_config() to clear the

	 * previous configuration. Consider these instances to be owned by NMDevice. */

	NMIP4Config *last_device_ip4_config;

	NMIP6Config *last_device_ip6_config;

	struct in6_addr *ip6_internal_gw;

	struct in6_addr *ip6_external_gw;

	char *ip_iface;

	int ip_ifindex;

	char *banner;

	guint32 mtu;

} NMVpnConnectionPrivate;

struct _NMVpnConnection {

	NMActiveConnection parent;

	NMVpnConnectionPrivate _priv;

};

struct _NMVpnConnectionClass {

	NMActiveConnectionClass parent;

};

G_DEFINE_TYPE (NMVpnConnection, nm_vpn_connection, NM_TYPE_ACTIVE_CONNECTION)

#define NM_VPN_CONNECTION_GET_PRIVATE(self) _NM_GET_PRIVATE(self, NMVpnConnection, NM_IS_VPN_CONNECTION, NMActiveConnection)

/*****************************************************************************/

static const NMDBusInterfaceInfoExtended interface_info_vpn_connection;

static const GDBusSignalInfo signal_info_vpn_state_changed;

static NMSettingsConnection *_get_settings_connection (NMVpnConnection *self,

                                                       gboolean allow_missing);

static void get_secrets (NMVpnConnection *self,

                         SecretsReq secrets_idx,

                         const char *const*hints);

static guint32 get_route_table (NMVpnConnection *self, int addr_family, gboolean fallback_main);

static void plugin_interactive_secrets_required (NMVpnConnection *self,

                                                 const char *message,

                                                 const char *const*secrets);

static void _set_vpn_state (NMVpnConnection *self,

                            VpnState vpn_state,

                            NMActiveConnectionStateReason reason,

                            gboolean quitting);

/*****************************************************************************/

#define _NMLOG_DOMAIN      LOGD_VPN

#define _NMLOG_PREFIX_NAME "vpn-connection"

#define __NMLOG_prefix_buf_len 128

static const char *

__LOG_create_prefix (char *buf, NMVpnConnection *self, NMSettingsConnection *con)

{

	NMVpnConnectionPrivate *priv;

	const char *id;

	if (!self)

		return _NMLOG_PREFIX_NAME;

	priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	id = con ? nm_settings_connection_get_id (con) : NULL;

	g_snprintf (buf, __NMLOG_prefix_buf_len,

	            "%s["

	            "%p"       /*self*/

	            "%s%s"     /*con-uuid*/

	            "%s%s%s%s" /*con-id*/

	            ",%d"      /*ifindex*/

	            "%s%s%s" /*iface*/

	            "]",

	            _NMLOG_PREFIX_NAME,

	            self,

	            con ? "," : "--", con ? (nm_settings_connection_get_uuid (con) ?: "??") : "",

	            con ? "," : "", NM_PRINT_FMT_QUOTED (id, "\"", id, "\"", con ? "??" : ""),

	            priv->ip_ifindex,

	            NM_PRINT_FMT_QUOTED (priv->ip_iface, ":(", priv->ip_iface, ")", "")

	            );

	return buf;

}

#define _NMLOG(level, ...) \

    G_STMT_START { \

        const NMLogLevel _level = (level); \

        NMSettingsConnection *_con = (self) ? _get_settings_connection (self, TRUE) : NULL; \

        \

        if (nm_logging_enabled (_level, _NMLOG_DOMAIN)) { \

            char __prefix[__NMLOG_prefix_buf_len]; \

            \

            _nm_log (_level, _NMLOG_DOMAIN, 0, \

                     (self) ? NM_VPN_CONNECTION_GET_PRIVATE (self)->ip_iface : NULL, \

                     (_con) ? nm_settings_connection_get_uuid (_con) : NULL, \

                     "%s: " _NM_UTILS_MACRO_FIRST (__VA_ARGS__), \

                     __LOG_create_prefix (__prefix, (self), _con) \

                     _NM_UTILS_MACRO_REST (__VA_ARGS__)); \

        } \

    } G_STMT_END

/*****************************************************************************/

static void

cancel_get_secrets (NMVpnConnection *self)

{

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	if (priv->secrets_id) {

		nm_settings_connection_cancel_secrets (_get_settings_connection (self, FALSE),

		                                       priv->secrets_id);

		g_warn_if_fail (!priv->secrets_id);

		priv->secrets_id = NULL;

	}

}

static NMVpnConnectionState

_state_to_nm_vpn_state (VpnState state)

{

	switch (state) {

	case STATE_WAITING:

	case STATE_PREPARE:

		return NM_VPN_CONNECTION_STATE_PREPARE;

	case STATE_NEED_AUTH:

		return NM_VPN_CONNECTION_STATE_NEED_AUTH;

	case STATE_CONNECT:

		return NM_VPN_CONNECTION_STATE_CONNECT;

	case STATE_IP_CONFIG_GET:

	case STATE_PRE_UP:

		return NM_VPN_CONNECTION_STATE_IP_CONFIG_GET;

	case STATE_ACTIVATED:

		return NM_VPN_CONNECTION_STATE_ACTIVATED;

	case STATE_DEACTIVATING: {

		/* Map DEACTIVATING to ACTIVATED to preserve external API behavior,

		 * since our API has no DEACTIVATING state of its own.  Since this can

		 * take some time, and the VPN isn't actually disconnected until it

		 * hits the DISCONNECTED state, to clients it should still appear

		 * connected.

		 */

		return NM_VPN_CONNECTION_STATE_ACTIVATED;

	}

	case STATE_DISCONNECTED:

		return NM_VPN_CONNECTION_STATE_DISCONNECTED;

	case STATE_FAILED:

		return NM_VPN_CONNECTION_STATE_FAILED;

	default:

		return NM_VPN_CONNECTION_STATE_UNKNOWN;

	}

}

static NMActiveConnectionState

_state_to_ac_state (VpnState vpn_state)

{

	/* Set the NMActiveConnection state based on VPN state */

	switch (vpn_state) {

	case STATE_WAITING:

	case STATE_PREPARE:

	case STATE_NEED_AUTH:

	case STATE_CONNECT:

	case STATE_IP_CONFIG_GET:

	case STATE_PRE_UP:

		return NM_ACTIVE_CONNECTION_STATE_ACTIVATING;

	case STATE_ACTIVATED:

		return NM_ACTIVE_CONNECTION_STATE_ACTIVATED;

	case STATE_DEACTIVATING:

		return NM_ACTIVE_CONNECTION_STATE_DEACTIVATING;

	case STATE_DISCONNECTED:

	case STATE_FAILED:

		return NM_ACTIVE_CONNECTION_STATE_DEACTIVATED;

	default:

		break;

	}

	return NM_ACTIVE_CONNECTION_STATE_UNKNOWN;

}

static NMSettingsConnection *

_get_settings_connection (NMVpnConnection *self, gboolean allow_missing)

{

	NMSettingsConnection *con;

	/* Currently we operate on the assumption, that the settings-connection

	 * never changes after it is set (though initially, it might be unset).

	 * Later we might want to change that, but then we need fixes here too. */

	con = _nm_active_connection_get_settings_connection (NM_ACTIVE_CONNECTION (self));

	if (!con && !allow_missing)

		g_return_val_if_reached (NULL);

	return con;

}

static NMConnection *

_get_applied_connection (NMVpnConnection *connection)

{

	NMConnection *con;

	con = nm_active_connection_get_applied_connection (NM_ACTIVE_CONNECTION (connection));

	g_return_val_if_fail (con, NULL);

	return con;

}

static void

disconnect_cb (GDBusProxy *proxy, GAsyncResult *result, gpointer user_data)

{

	GVariant *variant;

	variant = g_dbus_proxy_call_finish (proxy, result, NULL);

	if (variant)

		g_variant_unref (variant);

	g_object_unref (user_data);

}

static void

fw_call_cleanup (NMVpnConnection *self)

{

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	if (priv->fw_call) {

		nm_firewall_manager_cancel_call (priv->fw_call);

		g_warn_if_fail (!priv->fw_call);

		priv->fw_call = NULL;

	}

}

static void

remove_parent_device_config (NMVpnConnection *connection, NMDevice *device)

{

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (connection);

	if (priv->last_device_ip4_config) {

		nm_device_replace_vpn4_config (device, priv->last_device_ip4_config, NULL);

		g_clear_object (&priv->last_device_ip4_config);

	}

	if (priv->last_device_ip6_config) {

		nm_device_replace_vpn6_config (device, priv->last_device_ip6_config, NULL);

		g_clear_object (&priv->last_device_ip6_config);

	}

}

static void

vpn_cleanup (NMVpnConnection *self, NMDevice *parent_dev)

{

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	if (priv->ip_ifindex) {

		NMPlatform *platform = nm_netns_get_platform (priv->netns);

		nm_platform_link_set_down (platform, priv->ip_ifindex);

		nm_platform_ip_route_flush (platform, AF_UNSPEC, priv->ip_ifindex);

		nm_platform_ip_address_flush (platform, AF_UNSPEC, priv->ip_ifindex);

	}

	remove_parent_device_config (self, parent_dev);

	/* Remove zone from firewall */

	if (priv->ip_iface) {

		nm_firewall_manager_remove_from_zone (nm_firewall_manager_get (),

		                                      priv->ip_iface,

		                                      NULL,

		                                      NULL,

		                                      NULL);

	}

	/* Cancel pending firewall call */

	fw_call_cleanup (self);

	g_free (priv->banner);

	priv->banner = NULL;

	g_free (priv->ip_iface);

	priv->ip_iface = NULL;

	priv->ip_ifindex = 0;

	g_free (priv->bus_name);

	priv->bus_name = NULL;

	/* Clear out connection secrets to ensure that the settings service

	 * gets asked for them next time the connection is activated.

	 */

	nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (self));

}

static void

dispatcher_pre_down_done (NMDispatcherCallId *call_id, gpointer user_data)

{

	NMVpnConnection *self = NM_VPN_CONNECTION (user_data);

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	nm_assert (call_id);

	nm_assert (priv->dispatcher_id == call_id);

	priv->dispatcher_id = NULL;

	_set_vpn_state (self, STATE_DISCONNECTED, NM_ACTIVE_CONNECTION_STATE_REASON_USER_DISCONNECTED, FALSE);

}

static void

dispatcher_pre_up_done (NMDispatcherCallId *call_id, gpointer user_data)

{

	NMVpnConnection *self = NM_VPN_CONNECTION (user_data);

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	nm_assert (call_id);

	nm_assert (priv->dispatcher_id == call_id);

	priv->dispatcher_id = NULL;

	_set_vpn_state (self, STATE_ACTIVATED, NM_ACTIVE_CONNECTION_STATE_REASON_NONE, FALSE);

}

static void

dispatcher_cleanup (NMVpnConnection *self)

{

	NMVpnConnectionPrivate *priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	if (priv->dispatcher_id)

		nm_dispatcher_call_cancel (g_steal_pointer (&priv->dispatcher_id));

}

static void

_set_vpn_state (NMVpnConnection *self,

                VpnState vpn_state,

                NMActiveConnectionStateReason reason,

                gboolean quitting)

{

	NMVpnConnectionPrivate *priv;

	VpnState old_vpn_state;

	NMVpnConnectionState new_external_state, old_external_state;

	NMDevice *parent_dev = nm_active_connection_get_device (NM_ACTIVE_CONNECTION (self));

	NMConnection *applied;

	g_return_if_fail (NM_IS_VPN_CONNECTION (self));

	priv = NM_VPN_CONNECTION_GET_PRIVATE (self);

	if (vpn_state == priv->vpn_state)

		return;

	old_vpn_state = priv->vpn_state;

	priv->vpn_state = vpn_state;

	/* The device gets destroyed by active connection when it enters

	 * the deactivated state, so we need to ref it for usage below.

	 */

	if (parent_dev)

		g_object_ref (parent_dev);

	/* Update active connection base class state */

	nm_active_connection_set_state (NM_ACTIVE_CONNECTION (self),

	                                _state_to_ac_state (vpn_state),

	                                reason);

	/* Clear any in-progress secrets request */

	cancel_get_secrets (self);

	dispatcher_cleanup (self);

	/* The connection gets destroyed by the VPN manager when it enters the

	 * disconnected/failed state, but we need to keep it around for a bit

	 * to send out signals and handle the dispatcher.  So ref it.

	 */

	g_object_ref (self);

	old_external_state = _state_to_nm_vpn_state (old_vpn_state);

	new_external_state = _state_to_nm_vpn_state (priv->vpn_state);

	if (new_external_state != old_external_state) {

		nm_dbus_object_emit_signal (NM_DBUS_OBJECT (self),

		                            &interface_info_vpn_connection,

		                            &signal_info_vpn_state_changed,

		                            "(uu)",

		                            (guint32) new_external_state,

		                            (guint32) reason);

		g_signal_emit (self, signals[INTERNAL_STATE_CHANGED], 0,

		               new_external_state,

		               old_external_state,

		               reason);

		_notify (self, PROP_VPN_STATE);

	}

	switch (vpn_state) {

	case STATE_NEED_AUTH:

		/* Do nothing; not part of 'default' because we don't want to touch

		 * priv->secrets_req as NEED_AUTH is re-entered during interactive

		 * secrets.

		 */

		break;

	case STATE_PRE_UP:

		if (!nm_dispatcher_call_vpn (NM_DISPATCHER_ACTION_VPN_PRE_UP,

		                             _get_settings_connection (self, FALSE),

		                             _get_applied_connection (self),

		                             parent_dev,

		                             priv->ip_iface,

		                             priv->proxy_config,

		                             priv->ip4_config,

		                             priv->ip6_config,

		                             dispatcher_pre_up_done,

		                             self,

		                             &priv->dispatcher_id)) {

			/* Just proceed on errors */

			dispatcher_pre_up_done (0, self);

		}

		break;

	case STATE_ACTIVATED:

		applied = _get_applied_connection (self);

		/* Secrets no longer needed now that we're connected */

		nm_active_connection_clear_secrets (NM_ACTIVE_CONNECTION (self));

		/* Let dispatcher scripts know we're up and running */

		nm_dispatcher_call_vpn (NM_DISPATCHER_ACTION_VPN_UP,

		                        _get_settings_connection (self, FALSE),

		                        applied,

		                        parent_dev,

		                        priv->ip_iface,

		                        priv->proxy_config,

		                        priv->ip4_config,

		                        priv->ip6_config,

		                        NULL,

		                        NULL,

		                        NULL);

		if (priv->proxy_config) {

			nm_pacrunner_manager_remove_clear (&priv->pacrunner_conf_id);

			priv->pacrunner_conf_id = nm_pacrunner_manager_add (nm_pacrunner_manager_get (),

			                                                    priv->proxy_config,

			                                                    priv->ip_iface,

			                                                    priv->ip4_config,

			                                                    priv->ip6_config);

		}

		break;

	case STATE_DEACTIVATING:

		applied = _get_applied_connection (self);

		if (quitting) {

			nm_dispatcher_call_vpn_sync (NM_DISPATCHER_ACTION_VPN_PRE_DOWN,

			                             _get_settings_connection (self, FALSE),

			                             applied,

			                             parent_dev,

			                             priv->ip_iface,

			                             priv->proxy_config,

			                             priv->ip4_config,

			                             priv->ip6_config);

		} else {

			if (!nm_dispatcher_call_vpn (NM_DISPATCHER_ACTION_VPN_PRE_DOWN,

			                             _get_settings_connection (self, FALSE),

			                             applied,

			                             parent_dev,

			                             priv->ip_iface,

			                             priv->proxy_config,

			                             priv->ip4_config,

			                             priv->ip6_config,

			                             dispatcher_pre_down_done,

			                             self,

			                             &priv->dispatcher_id)) {

				/* Just proceed on errors */

				dispatcher_pre_down_done (0, self);

			}

		}

		nm_pacrunner_manager_remove_clear (&priv->pacrunner_conf_id);

		break;

	case STATE_FAILED:

	case STATE_DISCONNECTED:

		if (   old_vpn_state >= STATE_ACTIVATED

		    && old_vpn_state <= STATE_DEACTIVATING) {

			/* Let dispatcher scripts know we're about to go down */

			if (quitting) {

				nm_dispatcher_call_vpn_sync (NM_DISPATCHER_ACTION_VPN_DOWN,

				                             _get_settings_connection (self, FALSE),

				                             _get_applied_connection (self),

				                             parent_dev,

				                             priv->ip_iface,

				                             NULL,

				                             NULL,

				                             NULL);

			} else {

				nm_dispatcher_call_vpn (NM_DISPATCHER_ACTION_VPN_DOWN,

				                        _get_settings_connection (self, FALSE),

				                        _get_applied_connection (self),

				                        parent_dev,

				                        priv->ip_iface,

				                        NULL,

				                        NULL,

				                        NULL,

				                        NULL,

				                        NULL,

				                        NULL);

			}

		}

		/* Tear down and clean up the connection */

		if (priv->proxy) {

			g_dbus_proxy_call (priv->proxy,

			                   "Disconnect",

			                   NULL,

			                   G_DBUS_CALL_FLAGS_NONE,

			                   -1,

			                   priv->cancellable,

			                   (GAsyncReadyCallback) disconnect_cb,

			                   g_object_ref (self));

		}

		vpn_cleanup (self, parent_dev);

		/* fall-through */

	default:

		priv->secrets_idx = SECRETS_REQ_SYSTEM;

		break;

	}

	g_object_unref (self);

	if (parent_dev)

		g_object_unref (parent_dev);

}

static gboolean

_service_and_connection_can_persist (NMVpnConnection *self)

{

	return NM_VPN_CONNECTION_GET_PRIVATE (self)->connection_can_persist &&

	       NM_VPN_CONNECTION_GET_PRIVATE (self)->service_can_persist;

}

static gboolean

_connection_only_can_persist (NMVpnConnection *self)

{

	return NM_VPN_CONNECTION_GET_PRIVATE (self)->connection_can_persist &&

	       !NM_VPN_CONNECTION_GET_PRIVATE (self)->service_can_persist;

}

static void

device_state_changed (NMActiveConnection *active,

                      NMDevice *device,

                      NMDeviceState new_state,

                      NMDeviceState old_state)

{

	if (_service_and_connection_can_persist (NM_VPN_CONNECTION (active))) {

		if (new_state <= NM_DEVICE_STATE_DISCONNECTED ||

		    new_state == NM_DEVICE_STATE_FAILED) {

			nm_active_connection_set_device (active, NULL);

		}

		return;

	}

	if (new_state <= NM_DEVICE_STATE_DISCONNECTED) {

		_set_vpn_state (NM_VPN_CONNECTION (active),

		                STATE_DISCONNECTED,

		                NM_ACTIVE_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED,

		                FALSE);

	} else if (new_state == NM_DEVICE_STATE_FAILED) {

		_set_vpn_state (NM_VPN_CONNECTION (active),

		                STATE_FAILED,

		                NM_ACTIVE_CONNECTION_STATE_REASON_DEVICE_DISCONNECTED,

		                FALSE);

	}

	/* FIXME: map device DEACTIVATING state to VPN DEACTIVATING state and

	 * block device deactivation on VPN deactivation.

	 */

}

static void

add_ip4_vpn_gateway_route (NMIP4Config *config,

                           NMDevice *parent_device,

                           in_addr_t vpn_gw,

                           NMPlatform *platform)

{

	guint32 parent_gw = 0;

	gboolean has_parent_gw = FALSE;

	NMPlatformIP4Route route;

	int ifindex;

	guint32 route_metric;

	nm_auto_nmpobj const NMPObject *route_resolved = NULL;

	g_return_if_fail (NM_IS_IP4_CONFIG (config));

	g_return_if_fail (NM_IS_DEVICE (parent_device));

	g_return_if_fail (vpn_gw != 0);

	ifindex = nm_ip4_config_get_ifindex (config);

	nm_assert (ifindex > 0);

	nm_assert (ifindex == nm_device_get_ip_ifindex (parent_device));

	/* Ask kernel how to reach @vpn_gw. We can only inject the route in

	 * @parent_device, so whatever we resolve, it can only be on @ifindex. */

	if (nm_platform_ip_route_get (platform,

	                              AF_INET,

	                              &vpn_gw,

	                              ifindex,

	                              (NMPObject **) &route_resolved) >= 0) {

		const NMPlatformIP4Route *r = NMP_OBJECT_CAST_IP4_ROUTE (route_resolved);

		if (r->ifindex == ifindex) {

			const NMPObject *obj;

			/* `ip route get` always resolves the route, even if the destination is unreachable.

			 * In which case, it pretends the destination is directly reachable.

			 *

			 * So, only accept direct routes if @vpn_gw is a private network

			 * or if the parent device also has a direct default route */

			if (nm_platform_route_table_is_main (r->table_coerced)) {

				if (r->gateway) {

					parent_gw = r->gateway;

					has_parent_gw = TRUE;

				} else if (nm_utils_ip_is_site_local (AF_INET, &vpn_gw)) {

					has_parent_gw = TRUE;

				} else if (   (obj = nm_device_get_best_default_route (parent_device, AF_INET))

				           && !NMP_OBJECT_CAST_IP4_ROUTE (obj)->gateway) {

					has_parent_gw = TRUE;

				}

			}

		}

	}

	if (!has_parent_gw)

		return;

	route_metric = nm_device_get_route_metric (parent_device, AF_INET);

	memset (&route, 0, sizeof (route));

	route.ifindex = ifindex;

	route.network = vpn_gw;

	route.plen = 32;

	route.gateway = parent_gw;

	route.rt_source = NM_IP_CONFIG_SOURCE_VPN;

	route.metric = route_metric;

	nm_ip4_config_add_route (config, &route, NULL);

	if (parent_gw) {

		/* Ensure there's a route to the parent device's gateway through the

		 * parent device, since if the VPN claims the default route and the VPN

		 * routes include a subnet that matches the parent device's subnet,

		 * the parent device's gateway would get routed through the VPN and fail.

		 */

		memset (&route, 0, sizeof (route));

		route.network = parent_gw;

		route.plen = 32;

		route.rt_source = NM_IP_CONFIG_SOURCE_VPN;

		route.metric = route_metric;

		nm_ip4_config_add_route (config, &route, NULL);

	}

}

static void

add_ip6_vpn_gateway_route (NMIP6Config *config,

                           NMDevice *parent_device,

                           const struct in6_addr *vpn_gw,

                           NMPlatform *platform)

{

	const struct in6_addr *parent_gw = NULL;

	gboolean has_parent_gw = FALSE;

	NMPlatformIP6Route route;

	int ifindex;

	guint32 route_metric;

	nm_auto_nmpobj const NMPObject *route_resolved = NULL;

	g_return_if_fail (NM_IS_IP6_CONFIG (config));

	g_return_if_fail (NM_IS_DEVICE (parent_device));

	g_return_if_fail (vpn_gw != NULL);

	ifindex = nm_ip6_config_get_ifindex (config);

	nm_assert (ifindex > 0);

	nm_assert (ifindex == nm_device_get_ip_ifindex (parent_device));

	/* Ask kernel how to reach @vpn_gw. We can only inject the route in

	 * @parent_device, so whatever we resolve, it can only be on @ifindex. */

	if (nm_platform_ip_route_get (platform,

	                              AF_INET6,

	                              vpn_gw,

	                              ifindex,

	                              (NMPObject **) &route_resolved) >= 0) {

		const NMPlatformIP6Route *r = NMP_OBJECT_CAST_IP6_ROUTE (route_resolved);

		if (r->ifindex == ifindex) {

			const NMPObject *obj;

			/* `ip route get` always resolves the route, even if the destination is unreachable.

			 * In which case, it pretends the destination is directly reachable.

			 *

			 * So, only accept direct routes if @vpn_gw is a private network

			 * or if the parent device also has a direct default route */

			if (nm_platform_route_table_is_main (r->table_coerced)) {

				if (!IN6_IS_ADDR_UNSPECIFIED (&r->gateway)) {

					parent_gw = &r->gateway;

					has_parent_gw = TRUE;

				} else if (nm_utils_ip_is_site_local (AF_INET6, &vpn_gw)) {

					has_parent_gw = TRUE;

				} else if (   (obj = nm_device_get_best_default_route (parent_device, AF_INET6))

				           && IN6_IS_ADDR_UNSPECIFIED (&NMP_OBJECT_CAST_IP6_ROUTE (obj)->gateway)) {

					has_parent_gw = TRUE;

				}

			}

		}

	}

	if (!has_parent_gw)

		return;

	route_metric = nm_device_get_route_metric (parent_device, AF_INET6);

	memset (&route, 0, sizeof (route));

	route.ifindex = ifindex;

	route.network = *vpn_gw;

	route.plen = 128;

	if (parent_gw)

		route.gateway = *parent_gw;

	route.rt_source = NM_IP_CONFIG_SOURCE_VPN;

	route.metric = route_metric;

	nm_ip6_config_add_route (config, &route, NULL);

	/* Ensure there's a route to the parent device's gateway through the

	 * parent device, since if the VPN claims the default route and the VPN

	 * routes include a subnet that matches the parent device's subnet,

	 * the parent device's gateway would get routed through the VPN and fail.

	 */

	if (parent_gw && !IN6_IS_ADDR_UNSPECIFIED (parent_gw)) {

		memset (&route, 0, sizeof (route));

		route.network = *parent_gw;

		route.plen = 128;

		route.rt_source = NM_IP_CONFIG_SOURCE_VPN;

		route.metric = route_metric;

		nm_ip6_config_add_route (config, &route, NULL);

	}

}

NMVpnConnection *

nm_vpn_connection_new (NMSettingsConnection *settings_connection,

                       NMDevice *parent_device,

                       const char *specific_object,

                       NMActivationReason activation_reason,

                       NMActivationStateFlags initial_state_flags,

                       NMAuthSubject *subject)

{

	g_return_val_if_fail (!settings_connection || NM_IS_SETTINGS_CONNECTION (settings_connection), NULL);

	g_return_val_if_fail (NM_IS_DEVICE (parent_device), NULL);

	g_return_val_if_fail (specific_object, NULL);

	return (NMVpnConnection *) g_object_new (NM_TYPE_VPN_CONNECTION,

	                                         NM_ACTIVE_CONNECTION_INT_SETTINGS_CONNECTION, settings_connection,

	                                         NM_ACTIVE_CONNECTION_INT_DEVICE, parent_device,

	                                         NM_ACTIVE_CONNECTION_SPECIFIC_OBJECT, specific_object,

	                                         NM_ACTIVE_CONNECTION_INT_SUBJECT, subject,

	                                         NM_ACTIVE_CONNECTION_INT_ACTIVATION_REASON, activation_reason,

	                                         NM_ACTIVE_CONNECTION_VPN, TRUE,

	                                         NM_ACTIVE_CONNECTION_STATE_FLAGS, (guint) initial_state_flags,

	                                         NULL);

}

const char *

nm_vpn_connection_get_service (NMVpnConnection *self)

{

	NMSettingVpn *s_vpn;

	s_vpn = nm_connection_get_setting_vpn (_get_applied_connection (self));

	return nm_setting_vpn_get_service_type (s_vpn);

}

static

NM_UTILS_LOOKUP_STR_DEFINE (_vpn_plugin_failure_to_string, NMVpnPluginFailure,

	NM_UTILS_LOOKUP_DEFAULT (NULL),

	NM_UTILS_LOOKUP_STR_ITEM (NM_VPN_PLUGIN_FAILURE_LOGIN_FAILED,   "login-failed"),

	NM_UTILS_LOOKUP_STR_ITEM (NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED, "connect-failed"),

	NM_UTILS_LOOKUP_STR_ITEM (NM_VPN_PLUGIN_FAILURE_BAD_IP_CONFIG,  "bad-ip-config"),