diff --git a/properties/nm-libreswan-dialog.ui b/properties/nm-libreswan-dialog.ui index 0aeced044d4e5260a5ac2c0a60d64f2941589b92..b68289504e203f86bbb65475f5f91fa60cd36422 100644 --- a/properties/nm-libreswan-dialog.ui +++ b/properties/nm-libreswan-dialog.ui @@ -1172,6 +1172,58 @@ config: authby <value> + + + True + False + Authentication + 6 + 0 + + + + + + False + True + + + + + + True + False + 6 + 6 + + + True + False + Remote certificate name + True + remote_cert_entry + 1 + + + 0 + 0 + + + + + True + True + If set, specify the name of the certificate from the NSS database to authenticate the remote + ● + True + + + 1 + 0 + + + + diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c index bb1685df9df91ecbe8dab099d1a2a1341a6c8105..fe473d186e36b1730eefb93284f7b30147ec44f9 100644 --- a/properties/nm-libreswan-editor-plugin.c +++ b/properties/nm-libreswan-editor-plugin.c @@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); else if (g_str_has_prefix (str, "leftcert=")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); + else if (g_str_has_prefix (str, "rightcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]); else if (nm_streq0 (str, "leftmodecfgclient=no")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); else if (g_str_has_prefix (str, "pfs=no")) diff --git a/properties/nm-libreswan-editor.c b/properties/nm-libreswan-editor.c index e5363159dc8777f604b8da8b32e6a88243ef5c4a..b03d2fe91fdef52f47d9cb5ea20b9195ddfa8d03 100644 --- a/properties/nm-libreswan-editor.c +++ b/properties/nm-libreswan-editor.c @@ -399,6 +399,7 @@ populate_adv_dialog (LibreswanEditor *self) populate_widget (self, "ipsec_interface_entry", NM_LIBRESWAN_KEY_IPSEC_INTERFACE, NULL, NULL); populate_widget (self, "authby_entry", NM_LIBRESWAN_KEY_AUTHBY, NULL, NULL); populate_widget (self, "disable_modecfgclient_checkbutton", NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, NULL, "no"); + populate_widget (self, "remote_cert_entry", NM_LIBRESWAN_KEY_RIGHTCERT, NULL, NULL); } static gboolean @@ -496,6 +497,7 @@ init_editor_plugin (LibreswanEditor *self, hook_stuff_changed_cb (self, "ipsec_interface_entry"); hook_stuff_changed_cb (self, "authby_entry"); hook_stuff_changed_cb (self, "disable_modecfgclient_checkbutton"); + hook_stuff_changed_cb (self, "remote_cert_entry"); priv->advanced_dialog = GTK_WIDGET (gtk_builder_get_object (priv->builder, "libreswan-advanced-dialog")); g_return_val_if_fail (priv->advanced_dialog != NULL, FALSE); @@ -679,6 +681,14 @@ update_adv_settings (LibreswanEditor *self, NMSettingVpn *s_vpn) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); else nm_setting_vpn_remove_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT); + + /* Remote certificate */ + widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "remote_cert_entry")); + str = gtk_editable_get_text (GTK_EDITABLE (widget)); + if (str && *str) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, str); + else + nm_setting_vpn_remove_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); } static gboolean diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h index 96e5c71b19b4a61a55a754c2313a8d1ccbce0b71..167b837e03f82c84f3b1aa111d035abcb39672e0 100644 --- a/shared/nm-service-defines.h +++ b/shared/nm-service-defines.h @@ -37,6 +37,7 @@ #define NM_LIBRESWAN_KEY_RIGHT "right" #define NM_LIBRESWAN_KEY_RIGHTID "rightid" #define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey" +#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert" #define NM_LIBRESWAN_KEY_LEFT "left" #define NM_LIBRESWAN_KEY_LEFTID "leftid" #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" diff --git a/shared/utils.c b/shared/utils.c index 926d12d97442ce5e101867134945d68473dce8f4..5e19316cb73ebc06bec4c7d58f0aae332e9e4e18 100644 --- a/shared/utils.c +++ b/shared/utils.c @@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd, const char *left; const char *leftid; const char *leftcert; + const char *rightcert; const char *leftrsasigkey; const char *rightrsasigkey; const char *authby; @@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd, leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT); + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY); + if (rightcert && strlen (rightcert)) { + WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert); + if (!rightrsasigkey) + rightrsasigkey = "%cert"; + } if (leftcert && strlen (leftcert)) { WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert); if (!leftrsasigkey) diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c index 88c07d7860db7387a0357f2f3b65b299822595b4..516eaac2c5b3e3b769f344d54d96eaf856a499d7 100644 --- a/src/nm-libreswan-service.c +++ b/src/nm-libreswan-service.c @@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = { { NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 }, @@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin, NMSettingVpn *s_vpn; const char *leftcert; const char *leftrsasigkey; + const char *rightcert; const char *rightrsasigkey; const char *pw_type; @@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin, if (leftcert) goto xauth_check; - /* If authentication is done through rsasigkeys, only the public keys are required */ + /* If authentication is done through rsasigkeys, only the public keys are required. + * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */ leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); - if (leftrsasigkey && rightrsasigkey) + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); + if (leftrsasigkey && (rightrsasigkey || rightcert)) goto xauth_check; pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES);