From 2684233fd1c65c221d1f18c9d5b779c616c6d091 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= Date: Mon, 15 Apr 2024 10:42:08 +0200 Subject: [PATCH 1/2] properties, service: suppor rightcert configuration This configuration allows to specify a certificate from the NSS database to identify the remote, instead of pulling it. --- properties/nm-libreswan-editor-plugin.c | 2 ++ shared/nm-service-defines.h | 1 + shared/utils.c | 7 +++++++ src/nm-libreswan-service.c | 8 ++++++-- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c index bb1685d..fe473d1 100644 --- a/properties/nm-libreswan-editor-plugin.c +++ b/properties/nm-libreswan-editor-plugin.c @@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); else if (g_str_has_prefix (str, "leftcert=")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); + else if (g_str_has_prefix (str, "rightcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]); else if (nm_streq0 (str, "leftmodecfgclient=no")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); else if (g_str_has_prefix (str, "pfs=no")) diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h index 96e5c71..167b837 100644 --- a/shared/nm-service-defines.h +++ b/shared/nm-service-defines.h @@ -37,6 +37,7 @@ #define NM_LIBRESWAN_KEY_RIGHT "right" #define NM_LIBRESWAN_KEY_RIGHTID "rightid" #define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey" +#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert" #define NM_LIBRESWAN_KEY_LEFT "left" #define NM_LIBRESWAN_KEY_LEFTID "leftid" #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" diff --git a/shared/utils.c b/shared/utils.c index 926d12d..5e19316 100644 --- a/shared/utils.c +++ b/shared/utils.c @@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd, const char *left; const char *leftid; const char *leftcert; + const char *rightcert; const char *leftrsasigkey; const char *rightrsasigkey; const char *authby; @@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd, leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT); + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY); + if (rightcert && strlen (rightcert)) { + WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert); + if (!rightrsasigkey) + rightrsasigkey = "%cert"; + } if (leftcert && strlen (leftcert)) { WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert); if (!leftrsasigkey) diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c index 88c07d7..516eaac 100644 --- a/src/nm-libreswan-service.c +++ b/src/nm-libreswan-service.c @@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = { { NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 }, @@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin, NMSettingVpn *s_vpn; const char *leftcert; const char *leftrsasigkey; + const char *rightcert; const char *rightrsasigkey; const char *pw_type; @@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin, if (leftcert) goto xauth_check; - /* If authentication is done through rsasigkeys, only the public keys are required */ + /* If authentication is done through rsasigkeys, only the public keys are required. + * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */ leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); - if (leftrsasigkey && rightrsasigkey) + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); + if (leftrsasigkey && (rightrsasigkey || rightcert)) goto xauth_check; pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES); -- GitLab From 36563f81c248ac5a18029118b1e913cdf87a1ee3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= Date: Mon, 15 Apr 2024 12:16:28 +0200 Subject: [PATCH 2/2] properties: add "Remote certificate" field to the dialog It fills the rightcert configuration. --- properties/nm-libreswan-dialog.ui | 52 +++++++++++++++++++++++++++++++ properties/nm-libreswan-editor.c | 10 ++++++ 2 files changed, 62 insertions(+) diff --git a/properties/nm-libreswan-dialog.ui b/properties/nm-libreswan-dialog.ui index 0aeced0..b682895 100644 --- a/properties/nm-libreswan-dialog.ui +++ b/properties/nm-libreswan-dialog.ui @@ -1172,6 +1172,58 @@ config: authby <value> + + + True + False + Authentication + 6 + 0 + + + + + + False + True + + + + + + True + False + 6 + 6 + + + True + False + Remote certificate name + True + remote_cert_entry + 1 + + + 0 + 0 + + + + + True + True + If set, specify the name of the certificate from the NSS database to authenticate the remote + ● + True + + + 1 + 0 + + + + diff --git a/properties/nm-libreswan-editor.c b/properties/nm-libreswan-editor.c index e536315..b03d2fe 100644 --- a/properties/nm-libreswan-editor.c +++ b/properties/nm-libreswan-editor.c @@ -399,6 +399,7 @@ populate_adv_dialog (LibreswanEditor *self) populate_widget (self, "ipsec_interface_entry", NM_LIBRESWAN_KEY_IPSEC_INTERFACE, NULL, NULL); populate_widget (self, "authby_entry", NM_LIBRESWAN_KEY_AUTHBY, NULL, NULL); populate_widget (self, "disable_modecfgclient_checkbutton", NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, NULL, "no"); + populate_widget (self, "remote_cert_entry", NM_LIBRESWAN_KEY_RIGHTCERT, NULL, NULL); } static gboolean @@ -496,6 +497,7 @@ init_editor_plugin (LibreswanEditor *self, hook_stuff_changed_cb (self, "ipsec_interface_entry"); hook_stuff_changed_cb (self, "authby_entry"); hook_stuff_changed_cb (self, "disable_modecfgclient_checkbutton"); + hook_stuff_changed_cb (self, "remote_cert_entry"); priv->advanced_dialog = GTK_WIDGET (gtk_builder_get_object (priv->builder, "libreswan-advanced-dialog")); g_return_val_if_fail (priv->advanced_dialog != NULL, FALSE); @@ -679,6 +681,14 @@ update_adv_settings (LibreswanEditor *self, NMSettingVpn *s_vpn) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); else nm_setting_vpn_remove_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT); + + /* Remote certificate */ + widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "remote_cert_entry")); + str = gtk_editable_get_text (GTK_EDITABLE (widget)); + if (str && *str) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, str); + else + nm_setting_vpn_remove_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); } static gboolean -- GitLab