diff --git a/src/charon-nm/Makefile.am b/src/charon-nm/Makefile.am index 6ab7f27c5..5c1591bab 100644 --- a/src/charon-nm/Makefile.am +++ b/src/charon-nm/Makefile.am @@ -22,3 +22,6 @@ charon_nm_LDADD = \ $(top_builddir)/src/libstrongswan/libstrongswan.la \ $(top_builddir)/src/libcharon/libcharon.la \ -lm $(PTHREADLIB) $(ATOMICLIB) $(DLLIB) ${nm_LIBS} + +dbusservicedir = $(sysconfdir)/dbus-1/system.d +dbusservice_DATA = nm-strongswan-service.conf diff --git a/src/frontends/gnome/nm-strongswan-service.conf b/src/charon-nm/nm-strongswan-service.conf similarity index 89% rename from src/frontends/gnome/nm-strongswan-service.conf rename to src/charon-nm/nm-strongswan-service.conf index dccc19af9..a630f3407 100644 --- a/src/frontends/gnome/nm-strongswan-service.conf +++ b/src/charon-nm/nm-strongswan-service.conf @@ -10,7 +10,6 @@ - diff --git a/src/frontends/gnome/Makefile.am b/src/frontends/gnome/Makefile.am index 6ea29e0b4..12fa6cfb2 100644 --- a/src/frontends/gnome/Makefile.am +++ b/src/frontends/gnome/Makefile.am @@ -2,10 +2,7 @@ AUTOMAKE_OPTIONS = foreign SUBDIRS = properties auth-dialog po -dbusservicedir = $(sysconfdir)/dbus-1/system.d -dbusservice_DATA = nm-strongswan-service.conf - -nmvpnservicedir = $(sysconfdir)/NetworkManager/VPN +nmvpnservicedir = $(prefix)/lib/NetworkManager/VPN nmvpnservice_DATA = nm-strongswan-service.name @INTLTOOL_DESKTOP_RULE@ @@ -15,20 +12,35 @@ appdata_DATA = $(appdata_in_files:.xml.in=.xml) appdata_in_files = NetworkManager-strongswan.appdata.xml.in @INTLTOOL_XML_RULE@ +# Install a file with full path to plugins for an old gnome-shell +# https://bugzilla.gnome.org/show_bug.cgi?id=693590 +install-data-hook: + mkdir -p $(DESTDIR)$(sysconfdir)/NetworkManager/VPN + sed -e "1s|^|# This file is obsoleted by a file in $(NM_VPN_SERVICE_DIR)\n\n|" \ + -e 's|[@]NM_LIBEXECDIR[@]|$(nm_libexecdir)|g' \ + -e 's|[@]NM_PLUGINDIR[@]|$(nm_plugindir)|g' \ + -e 's|[@]CHARON[@]|$(charon)|' \ + <$(srcdir)/nm-strongswan-service.name.in \ + >$(DESTDIR)$(sysconfdir)/NetworkManager/VPN/nm-strongswan-service.name + +uninstall-hook: + rm -f $(DESTDIR)$(sysconfdir)/NetworkManager/VPN/nm-strongswan-service.name + nm-strongswan-service.name: $(srcdir)/nm-strongswan-service.name.in $(AM_V_GEN) \ - sed -e 's|[@]LIBEXECDIR[@]|$(libexecdir)|' \ + sed -e 's|[@]NM_LIBEXECDIR[@]|$(nm_libexecdir)|' \ + -e 's|[@]NM_PLUGINDIR[@]/|$(nm_plugindir_abs)|g' \ -e 's|[@]CHARON[@]|$(charon)|' $< >$@ -EXTRA_DIST = nm-strongswan-service.name.in \ - $(dbusservice_DATA) \ +EXTRA_DIST = \ + nm-strongswan-service.name.in \ $(appdata_in_files) \ $(appdata_DATA) \ intltool-extract.in \ intltool-merge.in \ intltool-update.in -CLEANFILES = $(nmvpnservice_DATA) $(appdata_DATA) *~ +CLEANFILES = $(appdata_DATA) *~ DISTCLEANFILES = intltool-extract intltool-merge intltool-update ACLOCAL_AMFLAGS = -I m4 diff --git a/src/frontends/gnome/auth-dialog/Makefile.am b/src/frontends/gnome/auth-dialog/Makefile.am index c91c6249c..9c9f7d6a0 100644 --- a/src/frontends/gnome/auth-dialog/Makefile.am +++ b/src/frontends/gnome/auth-dialog/Makefile.am @@ -1,10 +1,9 @@ -libexec_PROGRAMS = nm-strongswan-auth-dialog +nm_libexec_PROGRAMS = nm-strongswan-auth-dialog nm_strongswan_auth_dialog_CPPFLAGS = \ - $(GTHREAD_CFLAGS) \ $(GTK_CFLAGS) \ $(LIBGNOMEUI_CFLAGS) \ - $(GNOMEKEYRING_CFLAGS) \ + $(LIBSECRET_CFLAGS) \ $(NETWORK_MANAGER_CFLAGS) \ $(NM_UTILS_CFLAGS) \ -DG_DISABLE_DEPRECATED \ @@ -18,6 +17,5 @@ nm_strongswan_auth_dialog_SOURCES = \ nm_strongswan_auth_dialog_LDADD = \ $(GTK_LIBS) \ $(LIBGNOMEUI_LIBS) \ - $(GNOMEKEYRING_LIBS) \ + $(LIBSECRET_LIBS) \ $(NM_UTILS_LIBS) - diff --git a/src/frontends/gnome/auth-dialog/main.c b/src/frontends/gnome/auth-dialog/main.c index b9fd886d5..3d5d84390 100644 --- a/src/frontends/gnome/auth-dialog/main.c +++ b/src/frontends/gnome/auth-dialog/main.c @@ -22,7 +22,7 @@ #include #include #include -#include +#include #include #include #include @@ -31,35 +31,6 @@ #define NM_DBUS_SERVICE_STRONGSWAN "org.freedesktop.NetworkManager.strongswan" -/** - * lookup a password in the keyring - */ -static char *lookup_password(char *name, char *service) -{ - GList *list; - GList *iter; - char *pass = NULL; - - if (gnome_keyring_find_network_password_sync(g_get_user_name(), NULL, name, - NULL, service, NULL, 0, &list) != GNOME_KEYRING_RESULT_OK) - { - return NULL; - } - - for (iter = list; iter; iter = iter->next) - { - GnomeKeyringNetworkPasswordData *data = iter->data; - - if (strcmp(data->object, "password") == 0 && data->password) - { - pass = g_strdup(data->password); - break; - } - } - gnome_keyring_network_password_list_free(list); - return pass; -} - /** * Wait for quit input */ @@ -118,7 +89,7 @@ int main (int argc, char *argv[]) gchar *name = NULL, *uuid = NULL, *service = NULL, *keyring = NULL, *pass; GOptionContext *context; char *agent, *type; - guint32 itemid, minlen = 0; + guint32 minlen = 0; GtkWidget *dialog; GOptionEntry entries[] = { { "reprompt", 'r', 0, G_OPTION_ARG_NONE, &retry, "Reprompt for passwords", NULL}, @@ -162,7 +133,12 @@ int main (int argc, char *argv[]) if (!strcmp(type, "eap") || !strcmp(type, "key") || !strcmp(type, "psk") || !strcmp(type, "smartcard")) { - pass = lookup_password(name, service); + pass = secret_password_lookup_sync(SECRET_SCHEMA_COMPAT_NETWORK, NULL, NULL, + "user", g_get_user_name(), + "server", name, + "protocol", service, + NULL); + if ((!pass || retry) && allow_interaction) { if (!strcmp(type, "eap")) @@ -216,12 +192,15 @@ too_short_retry: case GNOME_PASSWORD_DIALOG_REMEMBER_NOTHING: break; case GNOME_PASSWORD_DIALOG_REMEMBER_SESSION: - keyring = "session"; + keyring = SECRET_COLLECTION_SESSION; /* FALL */ case GNOME_PASSWORD_DIALOG_REMEMBER_FOREVER: - if (gnome_keyring_set_network_password_sync(keyring, - g_get_user_name(), NULL, name, "password", service, NULL, 0, - pass, &itemid) != GNOME_KEYRING_RESULT_OK) + if (!secret_password_store_sync(SECRET_SCHEMA_COMPAT_NETWORK, + keyring, "", pass, NULL, NULL, + "user", g_get_user_name(), + "server", name, + "protocol", service, + NULL)) { g_warning ("storing password in keyring failed"); } @@ -231,6 +210,7 @@ too_short_retry: if (pass) { printf("password\n%s\n", pass); + g_free(pass); } } else diff --git a/src/frontends/gnome/configure.ac b/src/frontends/gnome/configure.ac index 047772d94..a2e3beef3 100644 --- a/src/frontends/gnome/configure.ac +++ b/src/frontends/gnome/configure.ac @@ -1,6 +1,6 @@ AC_PREREQ(2.52) -AC_INIT(NetworkManager-strongswan, 1.3.1, martin@strongswan.org, NetworkManager-strongswan) +AC_INIT(NetworkManager-strongswan, 1.3.2, martin@strongswan.org, NetworkManager-strongswan) AM_INIT_AUTOMAKE([subdir-objects]) AM_MAINTAINER_MODE @@ -14,6 +14,7 @@ AC_PROG_CC AM_PROG_CC_C_O AC_PROG_INSTALL AC_PROG_LIBTOOL +PKG_PROG_PKG_CONFIG dnl dnl Required headers @@ -42,32 +43,13 @@ AC_DEFINE_UNQUOTED(GETTEXT_PACKAGE,"$GETTEXT_PACKAGE", [Gettext package]) IT_PROG_INTLTOOL([0.35]) AM_GLIB_GNU_GETTEXT -PKG_CHECK_MODULES(GTHREAD, gthread-2.0) -AC_SUBST(GTHREAD_CFLAGS) -AC_SUBST(GTHREAD_LIBS) - -PKG_CHECK_MODULES(DBUS, dbus-glib-1 >= 0.30) -AC_SUBST(DBUS_CFLAGS) -AC_SUBST(DBUS_LIBS) - PKG_CHECK_MODULES(GTK, gtk+-2.0 >= 2.6) -AC_SUBST(GTK_CFLAGS) -AC_SUBST(GTK_LIBS) - PKG_CHECK_MODULES(LIBGNOMEUI, libgnomeui-2.0) -AC_SUBST(LIBGNOMEUI_CFLAGS) -AC_SUBST(LIBGNOMEUI_LIBS) - -PKG_CHECK_MODULES(GNOMEKEYRING, gnome-keyring-1) -AC_SUBST(GNOMEKEYRING_CFLAGS) -AC_SUBST(GNOMEKEYRING_LIBS) - +PKG_CHECK_MODULES(LIBSECRET, libsecret-1) PKG_CHECK_EXISTS([libnm-glib], [PKG_CHECK_MODULES(NM_UTILS, NetworkManager >= 0.9.0 libnm-util libnm-glib libnm-glib-vpn)], [PKG_CHECK_MODULES(NM_UTILS, NetworkManager >= 0.9.0 libnm-util libnm_glib libnm_glib_vpn)] ) -AC_SUBST(NM_UTILS_CFLAGS) -AC_SUBST(NM_UTILS_LIBS) AC_ARG_WITH( [charon], @@ -75,6 +57,17 @@ AC_ARG_WITH( [AC_SUBST(charon, "$withval")], [AC_SUBST(charon, "${libexecdir}/ipsec/charon-nm")] ) +AC_ARG_ENABLE( + [nm-absolute-paths], + AS_HELP_STRING([--enable-nm-absolute-paths],[use absolute paths for NM plugins in the .name file]) +) + +nm_libexecdir=$($PKG_CONFIG --variable=libgnome_serverdir NetworkManager) +AC_SUBST(nm_libexecdir) +nm_plugindir=$($PKG_CONFIG --variable=plugindir NetworkManager) +AC_SUBST(nm_plugindir) +test x"$enable_nm_absolute_paths" = x"yes" && nm_plugindir_abs="$(nm_plugindir)/" +AC_SUBST(nm_plugindir_abs) NM_COMPILER_WARNINGS diff --git a/src/frontends/gnome/debian/control b/src/frontends/gnome/debian/control index 4ab004c8b..be60bcf14 100644 --- a/src/frontends/gnome/debian/control +++ b/src/frontends/gnome/debian/control @@ -8,8 +8,8 @@ Build-Depends: cdbs, libnm-util-dev (>= 0.9), libnm-glib-dev (>= 0.9), libnm-glib-vpn-dev (>= 0.9), - libdbus-glib-1-dev, libgnomeui-dev, + libsecret-1-dev, automake, gnome-common, Standards-Version: 3.8.3 diff --git a/src/frontends/gnome/nm-strongswan-service.name.in b/src/frontends/gnome/nm-strongswan-service.name.in index 4120e55ae..eb64a22ff 100644 --- a/src/frontends/gnome/nm-strongswan-service.name.in +++ b/src/frontends/gnome/nm-strongswan-service.name.in @@ -4,5 +4,5 @@ service=org.freedesktop.NetworkManager.strongswan program=@CHARON@ [GNOME] -auth-dialog=@LIBEXECDIR@/nm-strongswan-auth-dialog -properties=libnm-strongswan-properties +auth-dialog=@NM_LIBEXECDIR@/nm-strongswan-auth-dialog +properties=@NM_PLUGINDIR@/libnm-strongswan-properties diff --git a/src/frontends/gnome/properties/Makefile.am b/src/frontends/gnome/properties/Makefile.am index 1b7fbb9a1..66f2d5124 100644 --- a/src/frontends/gnome/properties/Makefile.am +++ b/src/frontends/gnome/properties/Makefile.am @@ -1,5 +1,4 @@ -plugindir = $(libdir)/NetworkManager -plugin_LTLIBRARIES = libnm-strongswan-properties.la +nm_plugin_LTLIBRARIES = libnm-strongswan-properties.la libnm_strongswan_properties_la_SOURCES = \ nm-strongswan.c \ diff --git a/src/frontends/gnome/properties/nm-strongswan-dialog.ui b/src/frontends/gnome/properties/nm-strongswan-dialog.ui index c90b64542..6aea549fb 100644 --- a/src/frontends/gnome/properties/nm-strongswan-dialog.ui +++ b/src/frontends/gnome/properties/nm-strongswan-dialog.ui @@ -1,113 +1,24 @@ - + + True False - window1 + start + 12 + 16 - + True False - start - 12 - 16 + 6 - + True False - 6 - - - True - False - 0 - <b>Gateway</b> - True - - - False - False - 0 - - - - - True - False - 12 - - - True - False - 2 - 2 - 6 - 6 - - - True - False - 0 - _Address: - True - address-entry - - - GTK_FILL - - - - - - True - True - True - An IP address or hostname the Gateway can be contacted. - - - 1 - 2 - - - - - - True - False - 0 - C_ertificate: - True - certificate-button - - - 1 - 2 - GTK_FILL - - - - - - True - False - Gateway or CA certificate to use for gateway authentication. If none is specified, pre-installed CA certificates are used. - - - 1 - 2 - 1 - 2 - - - - - - - True - True - 1 - - + 0 + <b>Gateway</b> + True False @@ -116,264 +27,347 @@ - + True False - 6 + 12 - + True False - 0 - <b>Client</b> - True - - - False - False - 0 - - - - - True - False - 12 + 2 + 2 + 6 + 6 - + True False - 4 - 2 - 6 - 6 - - - True - False - Private key to use for client authentication. This key has to match the certificates public key and may be encrypted. - - - 1 - 2 - 3 - 4 - - - - - True - False - 0 - Private _key: - True - userkey-button - - - 3 - 4 - GTK_FILL - - - - - - True - False - 0 - Au_thentication: - True - - - GTK_FILL - - - - - - True - False - 0 - _Username: - True - user-entry - - - 1 - 2 - GTK_FILL - - - - - - True - True - True - The username (identity) to use for authentication against the gateway. - - - 1 - 2 - 1 - 2 - - - - - - True - False - 0 - Ce_rtificate: - True - usercert-button - - - 2 - 3 - GTK_FILL - - - - - - True - False - Client certificate to use for client authentication. - - - 1 - 2 - 2 - 3 - - - - - True - False - - - 1 - 2 - - + 0 + _Address: + True + address-entry + + GTK_FILL + + + + + + True + True + True + An IP address or hostname the Gateway can be contacted. + + + 1 + 2 + + + + + + True + False + 0 + C_ertificate: + True + certificate-button + + + 1 + 2 + GTK_FILL + + + + + + True + False + Gateway or CA certificate to use for gateway authentication. If none is specified, pre-installed CA certificates are used. + + + 1 + 2 + 1 + 2 + - - True - True - 1 - + + True + True + 1 + + + + + False + False + 0 + + + + + True + False + 6 + + + True + False + 0 + <b>Client</b> + True + False False - 1 + 0 - + True False - 6 + 12 - + True False - 0 - <b>Options</b> - True - - - False - False - 0 - - - - - True - False - 12 + 4 + 2 + 6 + 6 - + True False - - - Request an _inner IP address - True - True - False - True - The Gateway may provide addresses from a pool to use for communication in the Gateways network. Check to request such an address. - False - True - True - - - True - True - 0 - - - - - En_force UDP encapsulation - True - True - False - True - Some firewalls block ESP traffic. Enforcing UDP capsulation even if no NAT situation is detected might help in such cases. - False - True - True - - - True - True - 1 - - - - - Use IP c_ompression - True - True - False - True - IPComp compresses raw IP packets before they get encrypted. This saves some bandwidth, but uses more processing power. - False - True - True - - - True - True - 2 - - + Private key to use for client authentication. This key has to match the certificates public key and may be encrypted. + + 1 + 2 + 3 + 4 + + + + + True + False + 0 + Private _key: + True + userkey-button + + + 3 + 4 + GTK_FILL + + + + + + True + False + 0 + Au_thentication: + True + + + GTK_FILL + + + + + + True + False + 0 + _Username: + True + user-entry + + + 1 + 2 + GTK_FILL + + + + + + True + True + True + The username (identity) to use for authentication against the gateway. + + + 1 + 2 + 1 + 2 + + + + + + True + False + 0 + Ce_rtificate: + True + usercert-button + + + 2 + 3 + GTK_FILL + + + + + + True + False + Client certificate to use for client authentication. + + + 1 + 2 + 2 + 3 + + + + + True + False + + + 1 + 2 + - - True - True - 1 - - False + True True - 2 + 1 + + False + False + 1 + + + + + True + False + 6 + + + True + False + 0 + <b>Options</b> + True + + + False + False + 0 + + + + + True + False + 12 + + + True + False + + + Request an _inner IP address + True + True + False + True + The Gateway may provide addresses from a pool to use for communication in the Gateways network. Check to request such an address. + False + True + True + + + True + True + 0 + + + + + En_force UDP encapsulation + True + True + False + True + Some firewalls block ESP traffic. Enforcing UDP capsulation even if no NAT situation is detected might help in such cases. + False + True + True + + + True + True + 1 + + + + + Use IP c_ompression + True + True + False + True + IPComp compresses raw IP packets before they get encrypted. This saves some bandwidth, but uses more processing power. + False + True + True + + + True + True + 2 + + + + + + + True + True + 1 + + + + + False + True + 2 +