denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit 'nm-client-id'

Browse Source 
Makes the client's IKE identity configurable in the NM GUI.  For PSK
authentication the identity is now configured via that new field
and not the username anymore (old configs still work and are migrated
when edited).  The client identity now also defaults to the IP address
if not configured when using EAP/PSK.

Fixes #2581.
This commit is contained in:
Tobias Brunner
2020-02-14 14:47:34 +01:00
parent 571769fe50 d57d5f510d
commit c41419fa2e
5 changed files with 163 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-nm/nm/nm_creds.c
+1 -1
View File
@@ -285,7 +285,7 @@ METHOD(credential_set_t, create_shared_enumerator, enumerator_t*,
{
goto no_secret;
}
if (me && !me->equals(me, this->user))
if (me && !me->matches(me, this->user))
{
goto no_secret;
}
src/charon-nm/nm/nm_service.c
+49 -16
View File
@@ -387,7 +387,7 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
NMSettingVpn *vpn, peer_cfg_t *peer_cfg,
GError **err)
{
identification_t *user = NULL;
identification_t *id = NULL;
certificate_t *cert = NULL;
auth_cfg_t *auth;
const char *str, *method, *cert_source;
@@ -402,13 +402,13 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
pin = (char*)nm_setting_vpn_get_secret(vpn, "password");
if (pin)
{
user = find_smartcard_key(priv, pin);
id = find_smartcard_key(priv, pin);
}
if (!user)
if (!id)
{
g_set_error(err, NM_VPN_PLUGIN_ERROR,
NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
"no usable smartcard certificate found.");
"No usable smartcard certificate found.");
return FALSE;
}
}
@@ -472,8 +472,8 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
}
if (private)
{
user = cert->get_subject(cert);
user = user->clone(user);
id = cert->get_subject(cert);
id = id->clone(id);
priv->creds->set_cert_and_key(priv->creds, cert, private);
}
else
@@ -482,6 +482,12 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
return FALSE;
}
}
else
{
g_set_error(err, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
"Certificate is missing.");
return FALSE;
}
auth = auth_cfg_create();
if (streq(method, "eap-tls"))
@@ -499,7 +505,19 @@ static bool add_auth_cfg_cert(NMStrongswanPluginPrivate *priv,
{
auth->add(auth, AUTH_RULE_SUBJECT_CERT, cert->get_ref(cert));
}
auth->add(auth, AUTH_RULE_IDENTITY, user);
str = nm_setting_vpn_get_data_item(vpn, "local-identity");
if (str)
{
identification_t *local_id;
local_id = identification_create_from_string((char*)str);
if (local_id)
{
id->destroy(id);
id = local_id;
}
}
auth->add(auth, AUTH_RULE_IDENTITY, id);
peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
return TRUE;
}
@@ -511,7 +529,7 @@ static bool add_auth_cfg_pw(NMStrongswanPluginPrivate *priv,
NMSettingVpn *vpn, peer_cfg_t *peer_cfg,
GError **err)
{
identification_t *user = NULL;
identification_t *user = NULL, *id = NULL;
auth_cfg_t *auth;
const char *str, *method;
@@ -521,23 +539,37 @@ static bool add_auth_cfg_pw(NMStrongswanPluginPrivate *priv,
if (str)
{
user = identification_create_from_string((char*)str);
str = nm_setting_vpn_get_secret(vpn, "password");
if (streq(method, "psk") && strlen(str) < 20)
}
else
{
user = identification_create_from_string("%any");
}
str = nm_setting_vpn_get_data_item(vpn, "local-identity");
if (str)
{
id = identification_create_from_string((char*)str);
}
else
{
id = user->clone(user);
}
str = nm_setting_vpn_get_secret(vpn, "password");
if (streq(method, "psk"))
{
if (strlen(str) < 20)
{
g_set_error(err, NM_VPN_PLUGIN_ERROR,
NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
"Pre-shared key is too short.");
user->destroy(user);
id->destroy(id);
return FALSE;
}
priv->creds->set_username_password(priv->creds, user, (char*)str);
priv->creds->set_username_password(priv->creds, id, (char*)str);
}
else
{
g_set_error(err, NM_VPN_PLUGIN_ERROR,
NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
"Username is missing.");
return FALSE;
priv->creds->set_username_password(priv->creds, user, (char*)str);
}
auth = auth_cfg_create();
@@ -546,7 +578,8 @@ static bool add_auth_cfg_pw(NMStrongswanPluginPrivate *priv,
/* in case EAP-PEAP or EAP-TTLS is used we currently accept any identity */
auth->add(auth, AUTH_RULE_AAA_IDENTITY,
identification_create_from_string("%any"));
auth->add(auth, AUTH_RULE_IDENTITY, user);
auth->add(auth, AUTH_RULE_EAP_IDENTITY, user);
auth->add(auth, AUTH_RULE_IDENTITY, id);
peer_cfg->add_auth_cfg(peer_cfg, auth, TRUE);
return TRUE;
}
src/frontends/gnome/po/de.po
+42 -22
View File
@@ -8,7 +8,7 @@ msgid ""
msgstr ""
"Project-Id-Version: NetworkManager-strongswan\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2020-02-07 16:59+0100\n"
"POT-Creation-Date: 2020-02-12 12:06+0100\n"
"PO-Revision-Date: 2019-12-18 17:10+0100\n"
"Last-Translator: Tobias Brunner\n"
"Language-Team: de <[email protected]>\n"
@@ -25,31 +25,31 @@ msgstr "IPsec/IKEv2 (strongswan)"
msgid "IPsec with the IKEv2 key exchange protocol."
msgstr "IPsec mit dem IKEv2 Protokoll."
#: ../properties/nm-strongswan.c:335
#: ../properties/nm-strongswan.c:366
msgid "EAP (Username/Password)"
msgstr "EAP (Benutzername/Passwort)"
#: ../properties/nm-strongswan.c:336
#: ../properties/nm-strongswan.c:367
msgid "Certificate"
msgstr "Zertifikat"
#: ../properties/nm-strongswan.c:337
#: ../properties/nm-strongswan.c:368
msgid "EAP-TLS"
msgstr "EAP-TLS"
#: ../properties/nm-strongswan.c:338
#: ../properties/nm-strongswan.c:369
msgid "Pre-shared key"
msgstr "Pre-shared Key"
#: ../properties/nm-strongswan.c:365
#: ../properties/nm-strongswan.c:395
msgid "Certificate/private key"
msgstr "Zertifikat/Privater Schlüssel"
#: ../properties/nm-strongswan.c:366
#: ../properties/nm-strongswan.c:396
msgid "Certificate/ssh-agent"
msgstr "Zertifikat/ssh-agent"
#: ../properties/nm-strongswan.c:367
#: ../properties/nm-strongswan.c:397
msgid "Smartcard"
msgstr "Smartcard"
@@ -148,8 +148,10 @@ msgid "_Username:"
msgstr "_Benutzername:"
#: ../properties/nm-strongswan-dialog.ui.h:20
msgid "The username (identity) to use for authentication against the server."
msgstr "Benutzername/Identität für die Authentisierung gegenüber dem Server."
msgid ""
"The username (EAP identity) to use for authentication against the server."
msgstr ""
"Benutzername/EAP-Identität für die Authentisierung gegenüber dem Server."
#: ../properties/nm-strongswan-dialog.ui.h:21
msgid "_Password:"
@@ -172,14 +174,32 @@ msgid "_Show password"
msgstr "Passwort _anzeigen"
#: ../properties/nm-strongswan-dialog.ui.h:25
msgid "I_dentity:"
msgstr "I_dentität:"
#: ../properties/nm-strongswan-dialog.ui.h:26
msgid ""
"Defaults to the username (EAP), the client certificate's subject DN "
"(certificate/EAP-TLS), or the IP address (PSK). Custom values may be used if "
"expected/required by the server."
msgstr ""
"Standardwert ist der Benutzername (EAP), die Inhaber-Identität des "
"Zertifikats (Zertifikat/EAP-TLS) oder die IP-Adresse (PSK). Eigene Werte "
"können verwendet werden, falls der Server diese erwartet/benötigt."
#: ../properties/nm-strongswan-dialog.ui.h:27
msgid "(Defaults to username, certificate subject or IP address)"
msgstr "(Standardwert ist der Benutzername, die Zertifikats-ID oder die IP)"
#: ../properties/nm-strongswan-dialog.ui.h:28
msgid "<b>Options</b>"
msgstr "<b>Optionen</b>"
#: ../properties/nm-strongswan-dialog.ui.h:26
#: ../properties/nm-strongswan-dialog.ui.h:29
msgid "Request an _inner IP address"
msgstr "_Innere IP-Adresse beziehen"
#: ../properties/nm-strongswan-dialog.ui.h:27
#: ../properties/nm-strongswan-dialog.ui.h:30
msgid ""
"The server may provide addresses from a pool to use for communication in the "
"VPN. Check to request such an address."
@@ -188,11 +208,11 @@ msgstr ""
"Kommunikation im dahinterliegenden Netz verwenden kann. Aktivieren, um eine "
"solche Adresse zu beziehen."
#: ../properties/nm-strongswan-dialog.ui.h:28
#: ../properties/nm-strongswan-dialog.ui.h:31
msgid "En_force UDP encapsulation"
msgstr "Erzwingen einer zusätzlichen Einbettung der Datenpakete in _UDP"
#: ../properties/nm-strongswan-dialog.ui.h:29
#: ../properties/nm-strongswan-dialog.ui.h:32
msgid ""
"Some firewalls block ESP traffic. Enforcing UDP capsulation even if no NAT "
"situation is detected might help in such cases."
@@ -201,11 +221,11 @@ msgstr ""
"erzwingen einer zustzlichen Einbettung in UDP, auch wenn kein NAT-Router "
"detektiert wurde, kann in solchen Situationen hilfreich sein."
#: ../properties/nm-strongswan-dialog.ui.h:30
#: ../properties/nm-strongswan-dialog.ui.h:33
msgid "Use IP c_ompression"
msgstr "IP-Pakete k_omprimieren"
#: ../properties/nm-strongswan-dialog.ui.h:31
#: ../properties/nm-strongswan-dialog.ui.h:34
msgid ""
"IPComp compresses raw IP packets before they get encrypted. This saves some "
"bandwidth, but uses more processing power."
@@ -213,27 +233,27 @@ msgstr ""
"IPComp komprimiert IP-Pakete, bevor sie verschlüsselt werden. Diese Option "
"kann Bandbreite sparen, benötigt jedoch zusätzliche Rechenleistung."
#: ../properties/nm-strongswan-dialog.ui.h:32
#: ../properties/nm-strongswan-dialog.ui.h:35
msgid "<b>Cipher proposals</b>"
msgstr "<b>Algorithmen</b>"
#: ../properties/nm-strongswan-dialog.ui.h:33
#: ../properties/nm-strongswan-dialog.ui.h:36
msgid "_Enable custom proposals"
msgstr "_Eigene Algorithmen verwenden"
#: ../properties/nm-strongswan-dialog.ui.h:34
#: ../properties/nm-strongswan-dialog.ui.h:37
msgid "_IKE:"
msgstr "_IKE:"
#: ../properties/nm-strongswan-dialog.ui.h:35
#: ../properties/nm-strongswan-dialog.ui.h:38
msgid "A list of proposals for IKE separated by \";\""
msgstr "Eine Liste von Proposals für IKE getrennt mit \";\""
#: ../properties/nm-strongswan-dialog.ui.h:36
#: ../properties/nm-strongswan-dialog.ui.h:39
msgid "_ESP:"
msgstr "_ESP:"
#: ../properties/nm-strongswan-dialog.ui.h:37
#: ../properties/nm-strongswan-dialog.ui.h:40
msgid "A list of proposals for ESP separated by \";\""
msgstr "Eine Liste von Proposals für ESP getrennt mit \";\""
src/frontends/gnome/properties/nm-strongswan-dialog.ui
+34 -6
View File
@@ -298,21 +298,21 @@
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">4</property>
<property name="top_attach">5</property>
</packing>
</child>
<child>
<object class="GtkEntry" id="user-entry">
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="tooltip_text" translatable="yes">The username (identity) to use for authentication against the server.</property>
<property name="tooltip_text" translatable="yes">The username (EAP identity) to use for authentication against the server.</property>
<property name="hexpand">True</property>
<property name="primary_icon_activatable">False</property>
<property name="secondary_icon_activatable">False</property>
</object>
<packing>
<property name="left_attach">1</property>
<property name="top_attach">4</property>
<property name="top_attach">5</property>
</packing>
</child>
<child>
@@ -325,7 +325,7 @@
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">5</property>
<property name="top_attach">6</property>
</packing>
</child>
<child>
@@ -341,7 +341,7 @@
</object>
<packing>
<property name="left_attach">1</property>
<property name="top_attach">5</property>
<property name="top_attach">6</property>
</packing>
</child>
<child>
@@ -356,7 +356,35 @@
</object>
<packing>
<property name="left_attach">1</property>
<property name="top_attach">6</property>
<property name="top_attach">7</property>
</packing>
</child>
<child>
<object class="GtkLabel" id="local-identity-label">
<property name="visible">True</property>
<property name="can_focus">False</property>
<property name="label" translatable="yes">I_dentity:</property>
<property name="use_underline">True</property>
<property name="xalign">0</property>
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">4</property>
</packing>
</child>
<child>
<object class="GtkEntry" id="local-identity-entry">
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="tooltip_text" translatable="yes">Defaults to the username (EAP), the client certificate's subject DN (certificate/EAP-TLS), or the IP address (PSK). Custom values may be used if expected/required by the server.</property>
<property name="hexpand">True</property>
<property name="primary_icon_activatable">False</property>
<property name="secondary_icon_activatable">False</property>
<property name="placeholder_text" translatable="yes">(Defaults to username, certificate subject or IP address)</property>
</object>
<packing>
<property name="left_attach">1</property>
<property name="top_attach">4</property>
</packing>
</child>
<child>
src/frontends/gnome/properties/nm-strongswan.c
+37 -14
View File
@@ -146,10 +146,14 @@ check_validity (StrongswanPluginUiWidget *self, GError **error)
return TRUE;
}
static void update_user_pass_fields (StrongswanPluginUiWidgetPrivate *priv, gboolean enabled)
static void update_user_field (StrongswanPluginUiWidgetPrivate *priv, gboolean enabled)
{
gtk_widget_set_sensitive (GTK_WIDGET (gtk_builder_get_object (priv->builder, "user-label")), enabled);
gtk_widget_set_sensitive (GTK_WIDGET (gtk_builder_get_object (priv->builder, "user-entry")), enabled);
}
static void update_pass_field (StrongswanPluginUiWidgetPrivate *priv, gboolean enabled)
{
gtk_widget_set_sensitive (GTK_WIDGET (gtk_builder_get_object (priv->builder, "passwd-show")), enabled);
gtk_widget_set_sensitive (GTK_WIDGET (gtk_builder_get_object (priv->builder, "passwd-label")), enabled);
gtk_widget_set_sensitive (GTK_WIDGET (gtk_builder_get_object (priv->builder, "passwd-entry")), enabled);
@@ -193,15 +197,21 @@ static void update_sensitive (StrongswanPluginUiWidgetPrivate *priv)
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 0);
/* FALL */
case 0:
case 3:
update_user_pass_fields (priv, TRUE);
update_user_field (priv, TRUE);
update_pass_field (priv, TRUE);
update_cert_fields (priv, FALSE);
break;
case 1:
case 2:
update_user_pass_fields (priv, FALSE);
update_user_field (priv, FALSE);
update_pass_field (priv, FALSE);
update_cert_fields (priv, TRUE);
break;
case 3:
update_user_field (priv, FALSE);
update_pass_field (priv, TRUE);
update_cert_fields (priv, FALSE);
break;
}
}
@@ -292,6 +302,9 @@ init_plugin_ui (StrongswanPluginUiWidget *self, NMConnection *connection, GError
const char *value, *method;
settings = NM_SETTING_VPN(nm_connection_get_setting(connection, NM_TYPE_SETTING_VPN));
method = nm_setting_vpn_get_data_item (settings, "method");
widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "address-entry"));
value = nm_setting_vpn_get_data_item (settings, "address");
if (value)
@@ -316,9 +329,19 @@ init_plugin_ui (StrongswanPluginUiWidget *self, NMConnection *connection, GError
gtk_entry_set_text (GTK_ENTRY (widget), value);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (settings_changed_cb), self);
widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "local-identity-entry"));
value = nm_setting_vpn_get_data_item (settings, "local-identity");
/* fallback to the username for old PSK configs */
if (!value && method && g_strcmp0 (method, "psk") == 0)
value = nm_setting_vpn_get_data_item (settings, "user");
if (value)
gtk_entry_set_text (GTK_ENTRY (widget), value);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (settings_changed_cb), self);
widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "user-entry"));
value = nm_setting_vpn_get_data_item (settings, "user");
if (value)
/* PSK auth now uses local identity, see above */
if (value && method && g_strcmp0 (method, "psk") != 0)
gtk_entry_set_text (GTK_ENTRY (widget), value);
g_signal_connect (G_OBJECT (widget), "changed", G_CALLBACK (settings_changed_cb), self);
@@ -336,22 +359,21 @@ init_plugin_ui (StrongswanPluginUiWidget *self, NMConnection *connection, GError
gtk_combo_box_text_append_text (GTK_COMBO_BOX_TEXT (widget), _("Certificate"));
gtk_combo_box_text_append_text (GTK_COMBO_BOX_TEXT (widget), _("EAP-TLS"));
gtk_combo_box_text_append_text (GTK_COMBO_BOX_TEXT (widget), _("Pre-shared key"));
method = value = nm_setting_vpn_get_data_item (settings, "method");
if (value) {
if (g_strcmp0 (value, "eap") == 0) {
if (method) {
if (g_strcmp0 (method, "eap") == 0) {
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 0);
}
if (g_strcmp0 (value, "cert") == 0 ||
g_strcmp0 (value, "key") == 0 ||
g_strcmp0 (value, "agent") == 0 ||
g_strcmp0 (value, "smartcard") == 0)
if (g_strcmp0 (method, "cert") == 0 ||
g_strcmp0 (method, "key") == 0 ||
g_strcmp0 (method, "agent") == 0 ||
g_strcmp0 (method, "smartcard") == 0)
{
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 1);
}
if (g_strcmp0 (value, "eap-tls") == 0) {
if (g_strcmp0 (method, "eap-tls") == 0) {
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 2);
}
if (g_strcmp0 (value, "psk") == 0) {
if (g_strcmp0 (method, "psk") == 0) {
gtk_combo_box_set_active (GTK_COMBO_BOX (widget), 3);
}
}
@@ -583,6 +605,7 @@ update_connection (NMVpnEditor *iface,
save_file_chooser (settings, priv->builder, "certificate-button", "certificate");
save_entry (settings, priv->builder, "remote-identity-entry", "remote-identity");
save_entry (settings, priv->builder, "server-port-entry", "server-port");
save_entry (settings, priv->builder, "local-identity-entry", "local-identity");
widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "method-combo"));
switch (gtk_combo_box_get_active (GTK_COMBO_BOX (widget)))