denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented NetworkManager certificate/private key authentication using ssh-agent

Browse Source
This commit is contained in:
Martin Willi
2008-09-04 08:40:37 +00:00
parent 994ed35312
commit aff26a62c3
8 changed files with 456 additions and 170 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/nm/gnome/auth-dialog/Makefile.am
+1
View File
@@ -6,6 +6,7 @@ nm_strongswan_auth_dialog_CPPFLAGS = \
$(LIBGNOMEUI_CFLAGS) \
$(GNOMEKEYRING_CFLAGS) \
$(NETWORK_MANAGER_CFLAGS) \
$(NM_UTILS_CFLAGS) \
-DICONDIR=\""$(datadir)/pixmaps"\" \
-DGLADEDIR=\""$(gladedir)"\" \
-DBINDIR=\""$(bindir)"\" \
src/charon/plugins/nm/gnome/auth-dialog/main.c
+88 -35
View File
@@ -26,10 +26,17 @@
#include <gtk/gtk.h>
#include <gnome-keyring.h>
#include <libgnomeui/libgnomeui.h>
#include <gconf/gconf-client.h>
#include <nm-vpn-plugin.h>
#include <nm-setting-vpn.h>
#include <nm-setting-connection.h>
#define NM_DBUS_SERVICE_STRONGSWAN "org.freedesktop.NetworkManager.strongswan"
#define NM_DBUS_SERVICE_STRONGSWAN "org.freedesktop.NetworkManager.strongswan"
static char *lookup(char *name, char *service)
/**
* lookup a password in the keyring
*/
static char *lookup_password(char *name, char *service)
{
GList *list;
GList *iter;
@@ -55,6 +62,29 @@ static char *lookup(char *name, char *service)
return pass;
}
/**
* check if this connection needs a password
*/
static gboolean need_password(char *id)
{
GConfClient *client;
char *key, *str;
gboolean need_password = FALSE;
client = gconf_client_get_default();
key = g_strdup_printf("/system/networking/connections/%s/%s/%s",
id, NM_SETTING_VPN_SETTING_NAME, "method");
str = gconf_client_get_string(client, key, NULL);
if (str && !strcmp(str, "eap"))
{
need_password = TRUE;
}
g_free(str);
g_free(key);
g_object_unref(client);
return need_password;
}
int main (int argc, char *argv[])
{
static gboolean retry = FALSE;
@@ -62,7 +92,7 @@ int main (int argc, char *argv[])
GOptionContext *context;
GnomeProgram *program = NULL;
int exit_status = 1;
char buf;
char buf, *agent;
guint32 itemid;
GtkWidget *dialog;
GOptionEntry entries[] = {
@@ -91,8 +121,8 @@ int main (int argc, char *argv[])
fprintf (stderr, "Have to supply ID, name, and service\n");
g_object_unref (program);
return 1;
}
}
if (strcmp(service, NM_DBUS_SERVICE_STRONGSWAN) != 0)
{
fprintf(stderr, "This dialog only works with the '%s' service\n",
@@ -101,43 +131,66 @@ int main (int argc, char *argv[])
return 1;
}
pass = lookup(name, service);
if (!pass || retry)
if (need_password(id))
{
dialog = gnome_password_dialog_new(_("VPN password required"),
_("Password required to establish VPN connection:"),
NULL, NULL, TRUE);
gnome_password_dialog_set_show_remember(GNOME_PASSWORD_DIALOG(dialog), TRUE);
gnome_password_dialog_set_show_username(GNOME_PASSWORD_DIALOG(dialog), FALSE);
if (pass)
pass = lookup_password(name, service);
if (!pass || retry)
{
gnome_password_dialog_set_password(GNOME_PASSWORD_DIALOG(dialog), pass);
dialog = gnome_password_dialog_new(_("VPN password required"),
_("Password required to establish VPN connection:"),
NULL, NULL, TRUE);
gnome_password_dialog_set_show_remember(GNOME_PASSWORD_DIALOG(dialog), TRUE);
gnome_password_dialog_set_show_username(GNOME_PASSWORD_DIALOG(dialog), FALSE);
if (pass)
{
gnome_password_dialog_set_password(GNOME_PASSWORD_DIALOG(dialog), pass);
}
if (!gnome_password_dialog_run_and_block(GNOME_PASSWORD_DIALOG(dialog)))
{
g_object_unref (program);
return 1;
}
pass = gnome_password_dialog_get_password(GNOME_PASSWORD_DIALOG(dialog));
switch (gnome_password_dialog_get_remember(GNOME_PASSWORD_DIALOG(dialog)))
{
case GNOME_PASSWORD_DIALOG_REMEMBER_NOTHING:
break;
case GNOME_PASSWORD_DIALOG_REMEMBER_SESSION:
keyring = "session";
/* FALL */
case GNOME_PASSWORD_DIALOG_REMEMBER_FOREVER:
if (gnome_keyring_set_network_password_sync(keyring,
g_get_user_name(), NULL, name, "password", service, NULL, 0,
pass, &itemid) != GNOME_KEYRING_RESULT_OK)
{
g_warning ("storing password in keyring failed");
}
break;
}
}
if (!gnome_password_dialog_run_and_block(GNOME_PASSWORD_DIALOG(dialog)))
printf("password\n%s\n", pass);
}
else
{
agent = getenv("SSH_AUTH_SOCK");
if (agent)
{
g_object_unref (program);
printf("agent\n%s\n", agent);
}
else
{
GtkWidget *dialog;
dialog = gtk_message_dialog_new(NULL, 0, GTK_MESSAGE_ERROR,
GTK_BUTTONS_OK,
_("Configuration uses ssh-agent for authentication, "
"but ssh-agent is not running!"));
gtk_dialog_run (GTK_DIALOG (dialog));
gtk_widget_destroy (dialog);
return 1;
}
pass = gnome_password_dialog_get_password(GNOME_PASSWORD_DIALOG(dialog));
switch (gnome_password_dialog_get_remember(GNOME_PASSWORD_DIALOG(dialog)))
{
case GNOME_PASSWORD_DIALOG_REMEMBER_NOTHING:
break;
case GNOME_PASSWORD_DIALOG_REMEMBER_SESSION:
keyring = "session";
/* FALL */
case GNOME_PASSWORD_DIALOG_REMEMBER_FOREVER:
if (gnome_keyring_set_network_password_sync(keyring,
g_get_user_name(), NULL, name, "password", service, NULL, 0,
pass, &itemid) != GNOME_KEYRING_RESULT_OK)
{
g_warning ("storing password in keyring failed");
}
break;
}
}
printf("password\n%s\n", pass);
printf("\n\n");
/* flush output, wait for input */
fflush(stdout);
src/charon/plugins/nm/gnome/properties/nm-strongswan-dialog.glade
+73 -46
View File
@@ -37,14 +37,28 @@
<property name="column_spacing">6</property>
<property name="row_spacing">6</property>
<child>
<widget class="GtkLabel" id="address-label">
<widget class="GtkFileChooserButton" id="certificate-button">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">_Address:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">address-entry</property>
<property name="tooltip_text">Gateway certificate to use for gateway authentication.</property>
</widget>
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
</packing>
</child>
<child>
<widget class="GtkLabel" id="certificate-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">C_ertificate:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">certificate-button</property>
</widget>
<packing>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
@@ -63,32 +77,18 @@
</packing>
</child>
<child>
<widget class="GtkLabel" id="certificate-label">
<widget class="GtkLabel" id="address-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">_Certificate:</property>
<property name="label" translatable="yes">_Address:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">certificate-button</property>
<property name="mnemonic_widget">address-entry</property>
</widget>
<packing>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
</child>
<child>
<widget class="GtkFileChooserButton" id="certificate-button">
<property name="visible">True</property>
<property name="tooltip_text">Gateway certificate to use for gateway authentication.</property>
</widget>
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
</packing>
</child>
</widget>
</child>
</widget>
@@ -102,14 +102,14 @@
</packing>
</child>
<child>
<widget class="GtkVBox" id="authentication-vbox">
<widget class="GtkVBox" id="client-vbox">
<property name="visible">True</property>
<property name="spacing">6</property>
<child>
<widget class="GtkLabel" id="authentication-label">
<widget class="GtkLabel" id="client-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">&lt;b&gt;Authentication&lt;/b&gt;</property>
<property name="label" translatable="yes">&lt;b&gt;Client&lt;/b&gt;</property>
<property name="use_markup">True</property>
</widget>
<packing>
@@ -118,16 +118,43 @@
</packing>
</child>
<child>
<widget class="GtkAlignment" id="authentication-aligement">
<widget class="GtkAlignment" id="client-aligement">
<property name="visible">True</property>
<property name="left_padding">12</property>
<child>
<widget class="GtkTable" id="authentication-table">
<widget class="GtkTable" id="client-table">
<property name="visible">True</property>
<property name="n_rows">2</property>
<property name="n_rows">3</property>
<property name="n_columns">2</property>
<property name="column_spacing">6</property>
<property name="row_spacing">6</property>
<child>
<widget class="GtkFileChooserButton" id="usercert-button">
<property name="visible">True</property>
<property name="tooltip_text">Client certificate to use for client authentication.</property>
</widget>
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">2</property>
<property name="bottom_attach">3</property>
</packing>
</child>
<child>
<widget class="GtkLabel" id="usercert-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">Ce_rtificate:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">usercert-button</property>
</widget>
<packing>
<property name="top_attach">2</property>
<property name="bottom_attach">3</property>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
</child>
<child>
<widget class="GtkEntry" id="user-entry">
<property name="visible">True</property>
@@ -138,6 +165,23 @@
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
<property name="y_options"></property>
</packing>
</child>
<child>
<widget class="GtkLabel" id="user-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">_Username:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">user-entry</property>
</widget>
<packing>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
</child>
@@ -145,13 +189,11 @@
<widget class="GtkLabel" id="method-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">_Method:</property>
<property name="label" translatable="yes">Au_thentication:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">method-combo</property>
</widget>
<packing>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
@@ -166,21 +208,6 @@
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">1</property>
<property name="bottom_attach">2</property>
</packing>
</child>
<child>
<widget class="GtkLabel" id="user-label">
<property name="visible">True</property>
<property name="xalign">0</property>
<property name="label" translatable="yes">_Username:</property>
<property name="use_underline">True</property>
<property name="mnemonic_widget">user-entry</property>
</widget>
<packing>
<property name="x_options">GTK_FILL</property>
<property name="y_options"></property>
</packing>
</child>
</widget>
src/charon/plugins/nm/gnome/properties/nm-strongswan.c
+72 -54
View File
@@ -119,26 +119,38 @@ check_validity (StrongswanPluginUiWidget *self, GError **error)
"address");
return FALSE;
}
widget = glade_xml_get_widget (priv->xml, "user-entry");
str = (char *) gtk_entry_get_text (GTK_ENTRY (widget));
if (!str || !strlen (str)) {
g_set_error (error,
STRONGSWAN_PLUGIN_UI_ERROR,
STRONGSWAN_PLUGIN_UI_ERROR_INVALID_PROPERTY,
"user");
return FALSE;
}
return TRUE;
}
static void
stuff_changed_cb (GtkWidget *widget, gpointer user_data)
settings_changed_cb (GtkWidget *widget, gpointer user_data)
{
g_signal_emit_by_name (STRONGSWAN_PLUGIN_UI_WIDGET (user_data), "changed");
}
static void
method_changed_cb (GtkWidget *widget, gpointer user_data)
{
StrongswanPluginUiWidget *self = STRONGSWAN_PLUGIN_UI_WIDGET (user_data);
StrongswanPluginUiWidgetPrivate *priv = STRONGSWAN_PLUGIN_UI_WIDGET_GET_PRIVATE (self);
if (gtk_combo_box_get_active (GTK_COMBO_BOX (widget)) == 0)
{
gtk_widget_show (glade_xml_get_widget (priv->xml, "usercert-label"));
gtk_widget_show (glade_xml_get_widget (priv->xml, "usercert-button"));
gtk_widget_hide (glade_xml_get_widget (priv->xml, "user-label"));
gtk_widget_hide (glade_xml_get_widget (priv->xml, "user-entry"));
}
else
{
gtk_widget_hide (glade_xml_get_widget (priv->xml, "usercert-label"));
gtk_widget_hide (glade_xml_get_widget (priv->xml, "usercert-button"));
gtk_widget_show (glade_xml_get_widget (priv->xml, "user-label"));
gtk_widget_show (glade_xml_get_widget (priv->xml, "user-entry"));
}
g_signal_emit_by_name (STRONGSWAN_PLUGIN_UI_WIDGET (user_data), "changed");
}
static gboolean
init_plugin_ui (StrongswanPluginUiWidget *self, NMConnection *connection, GError **error)
{
@@ -149,83 +161,87 @@ init_plugin_ui (StrongswanPluginUiWidget *self, NMConnection *connection, GError
gboolean active;
settings = NM_SETTING_VPN(nm_connection_get_setting(connection, NM_TYPE_SETTING_VPN));
if (!settings)
return FALSE;
widget = glade_xml_get_widget (priv->xml, "address-entry");
if (!widget)
return FALSE;
value = g_hash_table_lookup (settings->data, "address");
if (value)
gtk_entry_set_text (GTK_ENTRY (widget), value);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "certificate-button");
if (!widget)
return FALSE;
value = g_hash_table_lookup (settings->data, "certificate");
if (value)
gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (widget), value);
g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "user-label");
gtk_widget_set_no_show_all (widget, TRUE);
widget = glade_xml_get_widget (priv->xml, "user-entry");
if (!widget)
return FALSE;
gtk_widget_set_no_show_all (widget, TRUE);
value = g_hash_table_lookup (settings->data, "user");
if (value)
gtk_entry_set_text (GTK_ENTRY (widget), value);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "method-combo");
if (!widget)
return FALSE;
gtk_combo_box_append_text (GTK_COMBO_BOX (widget), _("Certificate/ssh-agent"));
gtk_combo_box_append_text (GTK_COMBO_BOX (widget), _("EAP"));
/* TODO: PSK is disabled until we have the possibility to enforce strong
* secrets.
gtk_combo_box_append_text (GTK_COMBO_BOX (widget), _("Preshared Key")); */
value = g_hash_table_lookup (settings->data, "method");
if (value) {
if (g_strcasecmp (value, "eap") == 0) {
if (g_strcasecmp (value, "agent") == 0) {
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 0);
}
if (g_strcasecmp (value, "psk") == 0) {
if (g_strcasecmp (value, "eap") == 0) {
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 1);
}
}
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (method_changed_cb), self);
if (gtk_combo_box_get_active (GTK_COMBO_BOX (widget)) == -1)
{ /* default to EAP */
{
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 0);
}
}
if (gtk_combo_box_get_active (GTK_COMBO_BOX (widget)) != 0)
{
gtk_widget_hide (glade_xml_get_widget (priv->xml, "usercert-label"));
gtk_widget_hide (glade_xml_get_widget (priv->xml, "usercert-button"));
}
else
{
gtk_widget_hide (glade_xml_get_widget (priv->xml, "user-label"));
gtk_widget_hide (glade_xml_get_widget (priv->xml, "user-entry"));
}
widget = glade_xml_get_widget (priv->xml, "usercert-label");
gtk_widget_set_no_show_all (widget, TRUE);
widget = glade_xml_get_widget (priv->xml, "usercert-button");
gtk_widget_set_no_show_all (widget, TRUE);
value = g_hash_table_lookup (settings->data, "usercert");
if (value)
gtk_file_chooser_set_filename (GTK_FILE_CHOOSER (widget), value);
g_signal_connect (G_OBJECT (widget), "selection-changed", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "virtual-check");
if (!widget)
return FALSE;
value = g_hash_table_lookup (settings->data, "virtual");
if (value && strcmp(value, "yes") == 0)
{
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(widget), TRUE);
}
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "encap-check");
if (!widget)
return FALSE;
value = g_hash_table_lookup (settings->data, "encap");
if (value && strcmp(value, "yes") == 0)
{
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(widget), TRUE);
}
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (settings_changed_cb), self);
widget = glade_xml_get_widget (priv->xml, "ipcomp-check");
if (!widget)
return FALSE;
value = g_hash_table_lookup (settings->data, "ipcomp");
if (value && strcmp(value, "yes") == 0)
{
gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(widget), TRUE);
}
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (stuff_changed_cb), self);
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (settings_changed_cb), self);
return TRUE;
}
@@ -270,24 +286,26 @@ update_connection (NMVpnPluginUiWidgetInterface *iface,
if (str) {
g_hash_table_insert (settings->data, g_strdup ("certificate"), g_strdup(str));
}
widget = glade_xml_get_widget (priv->xml, "user-entry");
str = (char *) gtk_entry_get_text (GTK_ENTRY (widget));
if (str && strlen (str)) {
g_hash_table_insert (settings->data, g_strdup ("user"), g_strdup(str));
}
widget = glade_xml_get_widget (priv->xml, "method-combo");
switch (gtk_combo_box_get_active (GTK_COMBO_BOX (widget)))
{
case 0:
default:
str = "eap";
widget = glade_xml_get_widget (priv->xml, "usercert-button");
str = (char *) gtk_file_chooser_get_filename (GTK_FILE_CHOOSER (widget));
if (str) {
g_hash_table_insert (settings->data, g_strdup ("usercert"), g_strdup(str));
}
str = "agent";
break;
case 1:
str = "psk";
break;
case 2:
str = "pubkey";
widget = glade_xml_get_widget (priv->xml, "user-entry");
str = (char *) gtk_entry_get_text (GTK_ENTRY (widget));
if (str && strlen (str)) {
g_hash_table_insert (settings->data, g_strdup ("user"), g_strdup(str));
}
str = "eap";
break;
}
g_hash_table_insert (settings->data, g_strdup ("method"), g_strdup(str));