Skip to content

N
NetworkManager-l2tp
Commit 419cc77f authored by CeRiAl's avatar CeRiAl
Browse files
Options

Global: Add UI options for certificate-based authentication, fix 

generation of ipsec.conf and ipsec.secrets
parent c907a25b
Show whitespace changes
Inline Side-by-side
Showing with 166 additions and 36 deletions
properties/import-export.c
View file @ 419cc77f
...@@ -66,8 +66,10 @@ user = my_login (str) ...@@ -66,8 +66,10 @@ user = my_login (str)
gateway = 192.168.0.1 (str) gateway = 192.168.0.1 (str)
ipsec-enabled = true (bool) ipsec-enabled = true (bool)
ipsec-group-name = GroupVPN (str) ipsec-group-name = my_group (str)
ipsec-psk = my_psk (str) ???? ipsec-psk = my_psk (str) ????
ipsec-rsa = my_rsa (str) ????
ipsec-rsa-pw = my_rsa_pw (str) ????
ipsec-gateway-id = my_gateway (str) ipsec-gateway-id = my_gateway (str)
[ipv4] [ipv4]
...@@ -111,6 +113,8 @@ static VpnImportExportProperty vpn_properties[] = { ...@@ -111,6 +113,8 @@ static VpnImportExportProperty vpn_properties[] = {
{ NM_L2TP_KEY_IPSEC_GATEWAY_ID, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_GATEWAY_ID, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_GROUP_NAME, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_GROUP_NAME, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_PSK, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_PSK, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_RSA, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_RSA_PW, G_TYPE_STRING, FALSE },
{ NULL, G_TYPE_NONE, FALSE } { NULL, G_TYPE_NONE, FALSE }
}; };
......
properties/ipsec-dialog.c
View file @ 419cc77f
...@@ -46,6 +46,8 @@ static const char *ipsec_keys[] = { ...@@ -46,6 +46,8 @@ static const char *ipsec_keys[] = {
NM_L2TP_KEY_IPSEC_GROUP_NAME, NM_L2TP_KEY_IPSEC_GROUP_NAME,
NM_L2TP_KEY_IPSEC_GATEWAY_ID, NM_L2TP_KEY_IPSEC_GATEWAY_ID,
NM_L2TP_KEY_IPSEC_PSK, NM_L2TP_KEY_IPSEC_PSK,
NM_L2TP_KEY_IPSEC_RSA,
NM_L2TP_KEY_IPSEC_RSA_PW,
NULL NULL
}; };
...@@ -87,6 +89,12 @@ handle_enable_changed (GtkWidget *check, gboolean is_init, GtkBuilder *builder) ...@@ -87,6 +89,12 @@ handle_enable_changed (GtkWidget *check, gboolean is_init, GtkBuilder *builder)
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_psk")); widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_psk"));
gtk_widget_set_sensitive (widget, enabledp); gtk_widget_set_sensitive (widget, enabledp);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa"));
gtk_widget_set_sensitive (widget, enabledp);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa_pw"));
gtk_widget_set_sensitive (widget, enabledp);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_gateway_id")); widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_gateway_id"));
gtk_widget_set_sensitive (widget, enabledp); gtk_widget_set_sensitive (widget, enabledp);
...@@ -143,7 +151,7 @@ ipsec_dialog_new (GHashTable *hash) ...@@ -143,7 +151,7 @@ ipsec_dialog_new (GHashTable *hash)
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_group_name")); widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_group_name"));
value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_GROUP_NAME); value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_GROUP_NAME);
if (!value) value="GroupVPN"; if (!value) value="";
gtk_entry_set_text(GTK_ENTRY(widget), value); gtk_entry_set_text(GTK_ENTRY(widget), value);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_gateway_id")); widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_gateway_id"));
...@@ -154,6 +162,14 @@ ipsec_dialog_new (GHashTable *hash) ...@@ -154,6 +162,14 @@ ipsec_dialog_new (GHashTable *hash)
if((value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_PSK))) if((value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_PSK)))
gtk_entry_set_text(GTK_ENTRY(widget), value); gtk_entry_set_text(GTK_ENTRY(widget), value);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa"));
if((value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_RSA)))
gtk_entry_set_text(GTK_ENTRY(widget), value);
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa_pw"));
if((value = g_hash_table_lookup (hash, NM_L2TP_KEY_IPSEC_RSA_PW)))
gtk_entry_set_text(GTK_ENTRY(widget), value);
widget = GTK_WIDGET (gtk_builder_get_object (builder,"ipsec_enable")); widget = GTK_WIDGET (gtk_builder_get_object (builder,"ipsec_enable"));
handle_enable_changed (widget, TRUE, builder); handle_enable_changed (widget, TRUE, builder);
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (enable_toggled_cb), builder); g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (enable_toggled_cb), builder);
...@@ -196,6 +212,14 @@ ipsec_dialog_new_hash_from_dialog (GtkWidget *dialog, GError **error) ...@@ -196,6 +212,14 @@ ipsec_dialog_new_hash_from_dialog (GtkWidget *dialog, GError **error)
g_hash_table_insert(hash, g_strdup(NM_L2TP_KEY_IPSEC_PSK), g_hash_table_insert(hash, g_strdup(NM_L2TP_KEY_IPSEC_PSK),
g_strdup(gtk_entry_get_text(GTK_ENTRY(widget)))); g_strdup(gtk_entry_get_text(GTK_ENTRY(widget))));
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa"));
g_hash_table_insert(hash, g_strdup(NM_L2TP_KEY_IPSEC_RSA),
g_strdup(gtk_entry_get_text(GTK_ENTRY(widget))));
widget = GTK_WIDGET (gtk_builder_get_object (builder, "ipsec_rsa_pw"));
g_hash_table_insert(hash, g_strdup(NM_L2TP_KEY_IPSEC_RSA_PW),
g_strdup(gtk_entry_get_text(GTK_ENTRY(widget))));
return hash; return hash;
} }
properties/nm-l2tp-dialog.ui
View file @ 419cc77f
...@@ -537,7 +537,7 @@ config: lcp-echo-failure and lcp-echo-interval</property> ...@@ -537,7 +537,7 @@ config: lcp-echo-failure and lcp-echo-interval</property>
<object class="GtkTable" id="table1"> <object class="GtkTable" id="table1">
<property name="visible">True</property> <property name="visible">True</property>
<property name="can_focus">False</property> <property name="can_focus">False</property>
<property name="n_rows">3</property> <property name="n_rows">5</property>
<property name="n_columns">2</property> <property name="n_columns">2</property>
<child> <child>
<object class="GtkLabel" id="label4"> <object class="GtkLabel" id="label4">
...@@ -576,6 +576,32 @@ config: lcp-echo-failure and lcp-echo-interval</property> ...@@ -576,6 +576,32 @@ config: lcp-echo-failure and lcp-echo-interval</property>
<property name="y_options"></property> <property name="y_options"></property>
</packing> </packing>
</child> </child>
<child>
<object class="GtkLabel" id="label32">
<property name="visible">True</property>
<property name="can_focus">False</property>
<property name="label" translatable="yes">Private key file:</property>
<property name="justify">right</property>
</object>
<packing>
<property name="top_attach">3</property>
<property name="bottom_attach">4</property>
<property name="y_options"></property>
</packing>
</child>
<child>
<object class="GtkLabel" id="label33">
<property name="visible">True</property>
<property name="can_focus">False</property>
<property name="label" translatable="yes">Private key passphrase:</property>
<property name="justify">right</property>
</object>
<packing>
<property name="top_attach">4</property>
<property name="bottom_attach">5</property>
<property name="y_options"></property>
</packing>
</child>
<child> <child>
<object class="GtkEntry" id="ipsec_group_name"> <object class="GtkEntry" id="ipsec_group_name">
<property name="visible">True</property> <property name="visible">True</property>
...@@ -623,6 +649,39 @@ config: lcp-echo-failure and lcp-echo-interval</property> ...@@ -623,6 +649,39 @@ config: lcp-echo-failure and lcp-echo-interval</property>
<property name="y_options"></property> <property name="y_options"></property>
</packing> </packing>
</child> </child>
<child>
<object class="GtkEntry" id="ipsec_rsa">
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="invisible_char">●</property>
<property name="primary_icon_activatable">False</property>
<property name="secondary_icon_activatable">False</property>
</object>
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">3</property>
<property name="bottom_attach">4</property>
<property name="y_options"></property>
</packing>
</child>
<child>
<object class="GtkEntry" id="ipsec_rsa_pw">
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="visibility">False</property>
<property name="invisible_char">●</property>
<property name="primary_icon_activatable">False</property>
<property name="secondary_icon_activatable">False</property>
</object>
<packing>
<property name="left_attach">1</property>
<property name="right_attach">2</property>
<property name="top_attach">4</property>
<property name="bottom_attach">5</property>
<property name="y_options"></property>
</packing>
</child>
</object> </object>
<packing> <packing>
<property name="expand">True</property> <property name="expand">True</property>
......
src/nm-l2tp-service.c
View file @ 419cc77f
...@@ -381,6 +381,8 @@ static ValidProperty valid_properties[] = { ...@@ -381,6 +381,8 @@ static ValidProperty valid_properties[] = {
{ NM_L2TP_KEY_IPSEC_GATEWAY_ID, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_GATEWAY_ID, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_GROUP_NAME, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_GROUP_NAME, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_PSK, G_TYPE_STRING, FALSE }, { NM_L2TP_KEY_IPSEC_PSK, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_RSA, G_TYPE_STRING, FALSE },
{ NM_L2TP_KEY_IPSEC_RSA_PW, G_TYPE_STRING, FALSE },
{ NULL, G_TYPE_NONE, FALSE } { NULL, G_TYPE_NONE, FALSE }
}; };
...@@ -423,6 +425,23 @@ validate_ipsec_id (const char *id) ...@@ -423,6 +425,23 @@ validate_ipsec_id (const char *id)
return TRUE; return TRUE;
} }
static gboolean
validate_ipsec_gw_id (const char *id)
{
const char *p = id;
if (!id || !*id) return TRUE;
/* Ensure it's a valid gateway-id */
p = id;
while (*p) {
if (!isalnum (*p) && (*p != '_') && (*p != '-') && (*p != '.') && (*p != ',') && (*p != '=') && (*p != ' ') && (*p != '@'))
return FALSE;
p++;
}
return TRUE;
}
typedef struct ValidateInfo { typedef struct ValidateInfo {
ValidProperty *table; ValidProperty *table;
GError **error; GError **error;
...@@ -458,6 +477,12 @@ validate_one_property (const char *key, const char *value, gpointer user_data) ...@@ -458,6 +477,12 @@ validate_one_property (const char *key, const char *value, gpointer user_data)
if (!strcmp (prop.name, NM_L2TP_KEY_IPSEC_PSK)) if (!strcmp (prop.name, NM_L2TP_KEY_IPSEC_PSK))
return; /* valid */ return; /* valid */
if (!strcmp (prop.name, NM_L2TP_KEY_IPSEC_RSA))
return; /* valid */
if (!strcmp (prop.name, NM_L2TP_KEY_IPSEC_RSA_PW))
return; /* valid */
if ( !strcmp (prop.name, NM_L2TP_KEY_GATEWAY) if ( !strcmp (prop.name, NM_L2TP_KEY_GATEWAY)
&& !validate_gateway (value)) { && !validate_gateway (value)) {
g_set_error (info->error, g_set_error (info->error,
...@@ -477,7 +502,7 @@ validate_one_property (const char *key, const char *value, gpointer user_data) ...@@ -477,7 +502,7 @@ validate_one_property (const char *key, const char *value, gpointer user_data)
return; return;
} }
if ( !strcmp (prop.name, NM_L2TP_KEY_IPSEC_GATEWAY_ID) if ( !strcmp (prop.name, NM_L2TP_KEY_IPSEC_GATEWAY_ID)
&& !validate_ipsec_id (value)) { && !validate_ipsec_gw_id (value)) {
g_set_error (info->error, g_set_error (info->error,
NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR,
NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
...@@ -485,6 +510,7 @@ validate_one_property (const char *key, const char *value, gpointer user_data) ...@@ -485,6 +510,7 @@ validate_one_property (const char *key, const char *value, gpointer user_data)
key); key);
return; return;
} }
/* no break */
case G_TYPE_UINT: case G_TYPE_UINT:
errno = 0; errno = 0;
tmp = strtol (value, NULL, 10); tmp = strtol (value, NULL, 10);
...@@ -902,18 +928,35 @@ nm_l2tp_start_ipsec(NML2tpPlugin *plugin, ...@@ -902,18 +928,35 @@ nm_l2tp_start_ipsec(NML2tpPlugin *plugin,
rename(tmp_secrets, "/etc/ipsec.secrets"); rename(tmp_secrets, "/etc/ipsec.secrets");
return nm_l2tp_ipsec_error(error, "Could not write /etc/ipsec.secrets file."); return nm_l2tp_ipsec_error(error, "Could not write /etc/ipsec.secrets file.");
} }
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GROUP_NAME); value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GROUP_NAME);
fprintf(fp, "%s%s ",value?"@":"", value?value:"%any"); if(value) {
fprintf(fp, "@%s", value);
}
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GATEWAY_ID); value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_GATEWAY);
fprintf(fp, "%s%s ",value?"@":"", value?value:"%any"); fprintf(fp, "%s%s",value?"@":"", value?value:"%any");
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_PSK); value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_PSK);
if(!value)value=""; if(value) {
fprintf(fp, ": PSK \"%s\"\n",value); fprintf(fp, " : PSK \"%s\"",value);
}
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_RSA);
if(value) {
fprintf(fp, " : RSA \"%s\"",value);
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_RSA_PW);
if(value) {
fprintf(fp, " \"%s\"",value);
}
}
fprintf(fp, "\n");
fclose(fp); fclose(fp);
close(fd); close(fd);
/* Wait a sec */
sleep(1);
sys = system(PATH_PREFIX " ipsec secrets"); sys = system(PATH_PREFIX " ipsec secrets");
if (!sys) { if (!sys) {
sprintf(cmdbuf, PATH_PREFIX " ipsec auto " sprintf(cmdbuf, PATH_PREFIX " ipsec auto "
...@@ -1101,37 +1144,34 @@ nm_l2tp_config_write (NML2tpPlugin *plugin, ...@@ -1101,37 +1144,34 @@ nm_l2tp_config_write (NML2tpPlugin *plugin,
if (ipsec_fd == -1) { if (ipsec_fd == -1) {
return nm_l2tp_ipsec_error(error, "Could not write ipsec config."); return nm_l2tp_ipsec_error(error, "Could not write ipsec config.");
} }
write_config_option (ipsec_fd, "version 2.0\n"
"config setup\n" write_config_option (ipsec_fd, "version 2.0\n\n");
" nat_traversal=yes\n" write_config_option (ipsec_fd, "config setup\n"
" force_keepalive=yes\n" " plutodebug=none\n"
" protostack=netkey\n" " strictcrlpolicy=no\n"
" keep_alive=60\n" " nat_traversal=yes\n"
"\n"); " interfaces=%%defaultroute\n"
" oe=off\n"
" protostack=netkey\n\n");
write_config_option (ipsec_fd, "conn %%default\n"
" keyingtries=3\n"
" pfs=no\n"
" rekey=yes\n"
" type=transport\n"
" left=%%defaultroute\n"
" leftprotoport=17/1701\n"
" rightprotoport=17/1701\n\n");
write_config_option (ipsec_fd, "conn nm-ipsec-l2tp-%d\n", pid); write_config_option (ipsec_fd, "conn nm-ipsec-l2tp-%d\n", pid);
write_config_option (ipsec_fd, write_config_option (ipsec_fd,
" auto=add\n" " authby=rsasig\n");
" type=transport\n" value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_RSA);
" auth=esp\n" if(value) write_config_option (ipsec_fd, " leftcert=\"%s\"\n", value);
" pfs=no\n" value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_GATEWAY);
" authby=secret\n" if(value) write_config_option (ipsec_fd, " right=%s\n", value);
" keyingtries=0\n"
" left=%%defaultroute\n"
" leftprotoport=udp/l2tp\n"
" rightprotoport=udp/l2tp\n");
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GROUP_NAME);
if(value)write_config_option (ipsec_fd, " leftid=@%s\n", value);
/* value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_GATEWAY); */
write_config_option (ipsec_fd, " right=%s\n", priv->saddr);
value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GATEWAY_ID); value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GATEWAY_ID);
if(value)write_config_option (ipsec_fd, " rightid=@%s\n", value); if(value) write_config_option (ipsec_fd, " rightid=\"%s\"\n", value);
write_config_option (ipsec_fd, write_config_option (ipsec_fd,
" esp=3des-sha1\n" " auto=add\n\n");
" keyexchange=ike\n"
" ike=3des-sha1-modp1024\n"
" aggrmode=no\n"
" forceencaps=yes\n");
filename = g_strdup_printf ("/var/run/nm-xl2tpd.conf.%d", pid); filename = g_strdup_printf ("/var/run/nm-xl2tpd.conf.%d", pid);
...@@ -1143,6 +1183,7 @@ nm_l2tp_config_write (NML2tpPlugin *plugin, ...@@ -1143,6 +1183,7 @@ nm_l2tp_config_write (NML2tpPlugin *plugin,
return nm_l2tp_ipsec_error(error, "Could not write xl2tpd config."); return nm_l2tp_ipsec_error(error, "Could not write xl2tpd config.");
} }
filename = g_strdup_printf ("/var/run/nm-ppp-options.xl2tpd.%d", pid); filename = g_strdup_printf ("/var/run/nm-ppp-options.xl2tpd.%d", pid);
pppopt_fd = open (filename, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR); pppopt_fd = open (filename, O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
g_free (filename); g_free (filename);
......
src/nm-l2tp-service.h
View file @ 419cc77f
...@@ -72,6 +72,8 @@ ...@@ -72,6 +72,8 @@
#define NM_L2TP_KEY_IPSEC_GATEWAY_ID "ipsec-gateway-id" #define NM_L2TP_KEY_IPSEC_GATEWAY_ID "ipsec-gateway-id"
#define NM_L2TP_KEY_IPSEC_GROUP_NAME "ipsec-group-name" #define NM_L2TP_KEY_IPSEC_GROUP_NAME "ipsec-group-name"
#define NM_L2TP_KEY_IPSEC_PSK "ipsec-psk" #define NM_L2TP_KEY_IPSEC_PSK "ipsec-psk"
#define NM_L2TP_KEY_IPSEC_RSA "ipsec-rsa"
#define NM_L2TP_KEY_IPSEC_RSA_PW "ipsec-rsa-pw"
typedef struct { typedef struct {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment