rpms
/
NetworkManager-libreswan
21
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

import NetworkManager-libreswan-1.2.18-3.el9_4

Browse Source
c9 imports/c9/NetworkManager-libreswan-1.2.18-3.el9_4
MSVSphere Packaging Team 7 months ago
parent 5ce3066b75
commit fc1479dfd9
12 changed files with 662 additions and 897 deletions
Show Stats Download Patch File Download Diff File

2
.NetworkManager-libreswan.metadata
Unescape View File

@ -1 +1 @@
705a4dded50d26bd005bb68ea851f79453ea4252 SOURCES/NetworkManager-libreswan-1.2.14.tar.xz
a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

2
.gitignore vendored
Unescape View File

@ -1 +1 @@
SOURCES/NetworkManager-libreswan-1.2.14.tar.xz
SOURCES/NetworkManager-libreswan-1.2.18.tar.xz

433
SOURCES/0001-add-dpd-authby-and-ipsec-interface-support.patch
Unescape View File

@ -1,433 +0,0 @@
From 357fc7227f6e219e4e55fd29e347ce1f21369518 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Thu, 23 Nov 2023 14:13:59 +0100
Subject: [PATCH 1/4] service,properties: support DPD parameters
Add support for parameters related to Dead Peer Detection (DPD), a
mechanism to check for reachability of IKE peers.
(cherry picked from commit 6c35e460d393e73c478c7e885e875ea8c4918133)
---
man/nm-settings-libreswan.5.in | 21 ++++++++++++++++++++-
properties/nm-libreswan-editor-plugin.c | 6 ++++++
shared/nm-service-defines.h | 2 ++
shared/utils.c | 13 +++++++++++++
src/nm-libreswan-service.c | 4 +++-
5 files changed, 44 insertions(+), 2 deletions(-)
diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in
index 0188432..1bb304e 100644
--- a/man/nm-settings-libreswan.5.in
+++ b/man/nm-settings-libreswan.5.in
@@ -85,7 +85,26 @@ ignored.
ignored.
.TP
.I "dpdtimeout"
-ignored.
+the length of time that we will idle without hearing back from our peer. After
+this period has elapsed with no response and no traffic, we will declare the
+peer dead, and remove the SA. Set value bigger than dpddelay to enable. If
+dpdtimeout is set, dpddelay also needs to be set. Must be a number optionally
+followed by a time unit: 's' (seconds), 'm' (minutes), 'h', (hours) or 'd'
+(days); if the unit is not specified, it defaults to seconds. Corresponds to the
+Libreswan parameter of the same name.
+.TP
+.I "dpddelay"
+the delay between Dead Peer Detection (IKEv1 RFC 3706) or IKEv2 Liveness
+keepalives that are sent for this connection. Must be a number optionally
+followed by a time unit: 's' (seconds), 'm' (minutes), 'h', (hours) or 'd'
+(days); if the unit is not specified, it defaults to seconds. Corresponds to the
+Libreswan parameter of the same name.
+.TP
+.I "dpdaction"
+When a DPD enabled peer is declared dead, what action should be taken. "hold"
+(default) means the eroute will be put into %hold status, while "clear" means
+the eroute and SA with both be cleared. "restart" means that ALL SAs to the dead
+peer will renegotiated. Corresponds to the Libreswan parameter of the same name.
.TP
.I "ike"
allowed ciphers to be negotiatied to establish the IKE SAs. Corresponds to the
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 9a2399a..c4247f2 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -198,6 +198,12 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_FRAGMENTATION, &str[14]);
else if (g_str_has_prefix (str, "mobike="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_MOBIKE, &str[7]);
+ else if (g_str_has_prefix (str, "dpddelay="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDDELAY, &str[9]);
+ else if (g_str_has_prefix (str, "dpdtimeout="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT, &str[11]);
+ else if (g_str_has_prefix (str, "dpdaction="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]);
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index a01a00f..c613fb7 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -52,6 +52,8 @@
#define NM_LIBRESWAN_KEY_PFS "pfs"
#define NM_LIBRESWAN_KEY_PFSGROUP "pfsgroup"
#define NM_LIBRESWAN_KEY_DPDTIMEOUT "dpdtimeout"
+#define NM_LIBRESWAN_KEY_DPDDELAY "dpddelay"
+#define NM_LIBRESWAN_KEY_DPDACTION "dpdaction"
#define NM_LIBRESWAN_KEY_IKE "ike"
#define NM_LIBRESWAN_KEY_ESP "esp"
#define NM_LIBRESWAN_KEY_IKELIFETIME "ikelifetime"
diff --git a/shared/utils.c b/shared/utils.c
index acb237f..5f71624 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -118,6 +118,7 @@ nm_libreswan_config_write (gint fd,
const char *fragmentation;
const char *mobike;
const char *pfs;
+ const char *item;
gboolean is_ikev2 = FALSE;
g_return_val_if_fail (fd > 0, FALSE);
@@ -297,6 +298,18 @@ nm_libreswan_config_write (gint fd,
if (mobike && strlen (mobike))
WRITE_CHECK (fd, debug_write_fcn, error, " mobike=%s", mobike);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDDELAY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " dpddelay=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " dpdtimeout=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " dpdaction=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 3541125..bee47f3 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -260,7 +260,9 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_PFS, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_PFSGROUP, G_TYPE_STRING, 0, 0 },
- { NM_LIBRESWAN_KEY_DPDTIMEOUT, G_TYPE_INT, 0, 86400 },
+ { NM_LIBRESWAN_KEY_DPDACTION, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_DPDDELAY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_DPDTIMEOUT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IKE, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_ESP, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IKELIFETIME, G_TYPE_STRING, 0, 0 },
--
2.43.0
From 8f6bdd745d2d9fa61f6d82929984bbf7411e4632 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Fri, 24 Nov 2023 16:27:18 +0100
Subject: [PATCH 2/4] service,properties: support the "ipsec-interface" option
Introduce a new option "ipsec-interface" to create a XFRM virtual
interface for "Routing based VPNs" (as opposed to "Policy based
VPNs").
(cherry picked from commit f5e8bf1ebe17d13c49780647973dd742f40f112c)
---
man/nm-settings-libreswan.5.in | 7 +++++++
properties/nm-libreswan-editor-plugin.c | 2 ++
shared/nm-service-defines.h | 1 +
shared/utils.c | 4 ++++
src/nm-libreswan-service.c | 11 +++++++++--
5 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in
index 1bb304e..59ac4ee 100644
--- a/man/nm-settings-libreswan.5.in
+++ b/man/nm-settings-libreswan.5.in
@@ -153,6 +153,13 @@ Matches the Libreswan parameter of the same name.
Allowed values are: 'yes' and 'no'.
Matches the Libreswan parameter of the same name.
.TP
+.I "ipsec-interface"
+If set, create or use an existing virtual interface ipsecXXX for "Routing based
+VPNs" (as opposed to "Policy based VPNs"). Valid options are 'yes', 'no' or a
+number. When using a number, the IPsec interface created and/or used will use
+that number as part of the interface name. Corresponds to the Libreswan
+parameter of the same name.
+.TP
.I "pskinputmodes"
where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'.
.TP
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index c4247f2..0b3e36d 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -204,6 +204,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT, &str[11]);
else if (g_str_has_prefix (str, "dpdaction="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]);
+ else if (g_str_has_prefix (str, "ipsec-interface="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index c613fb7..78193f2 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -65,6 +65,7 @@
#define NM_LIBRESWAN_KEY_REKEY "rekey"
#define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation"
#define NM_LIBRESWAN_KEY_MOBIKE "mobike"
+#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface"
#define NM_LIBRESWAN_IKEV2_NO "no"
#define NM_LIBRESWAN_IKEV2_NEVER "never"
diff --git a/shared/utils.c b/shared/utils.c
index 5f71624..a1a1c77 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -310,6 +310,10 @@ nm_libreswan_config_write (gint fd,
if (item && strlen (item))
WRITE_CHECK (fd, debug_write_fcn, error, " dpdaction=%s", item);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index bee47f3..0b6db91 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -274,6 +274,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_REKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 },
/* Ignored option for internal use */
{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 },
{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
@@ -1252,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
gboolean success = FALSE;
guint i;
const char *verb;
+ const char *virt_if;
_LOGI ("Configuration from the helper received.");
@@ -1274,9 +1276,14 @@ handle_callback (NMDBusLibreswanHelper *object,
/*
* Tunnel device
- * Indicate that this plugin doesn't use tun/tap device
*/
- val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
+ virt_if = lookup_string (env, "PLUTO_VIRT_INTERFACE");
+ if (virt_if && !nm_streq (virt_if, "NULL")) {
+ val = g_variant_new_string (virt_if);
+ } else {
+ val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
+ }
+
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
/* IP address */
--
2.43.0
From 11061213f6f52373470af11d0b00c24b8670f356 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 28 Nov 2023 11:59:05 +0100
Subject: [PATCH 3/4] service: ignore next hop in routed mode
In routed mode, the traffic needs to be sent directly over the
interface without a gateway.
(cherry picked from commit aa14380637a3de20ce9a59abc8b927368b1ab926)
---
src/nm-libreswan-service.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 0b6db91..93beec0 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1197,7 +1197,7 @@ _take_route (GPtrArray *routes, GVariant *new, gboolean alive)
}
static void
-handle_route (GPtrArray *routes, GVariant *env, gboolean alive)
+handle_route (GPtrArray *routes, GVariant *env, gboolean alive, gboolean is_xfrmi)
{
GVariantBuilder builder;
const gchar *net, *mask, *next_hop, *my_sourceip;
@@ -1210,9 +1210,13 @@ handle_route (GPtrArray *routes, GVariant *env, gboolean alive)
next_hop = lookup_string (env, "PLUTO_NEXT_HOP");
my_sourceip = lookup_string (env, "PLUTO_MY_SOURCEIP");
+
if (!net || !mask || !next_hop || !my_sourceip)
return;
+ if (is_xfrmi)
+ next_hop = "0.0.0.0";
+
if (g_strcmp0 (net, "0.0.0.0") == 0 && g_strcmp0 (mask, "0")) {
g_variant_builder_init (&builder, G_VARIANT_TYPE ("au"));
g_variant_builder_add_value (&builder, addr4_to_gvariant ("0.0.0.0"));
@@ -1254,6 +1258,7 @@ handle_callback (NMDBusLibreswanHelper *object,
guint i;
const char *verb;
const char *virt_if;
+ gboolean is_xfrmi = FALSE;
_LOGI ("Configuration from the helper received.");
@@ -1332,16 +1337,23 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
+ /* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
+ is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
- val = addr4_to_gvariant (lookup_string (env, "PLUTO_NEXT_HOP"));
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY, val);
+ if (is_xfrmi) {
+ /* The traffic needs to be sent directly over the interface without a gateway.
+ * Ignore the next hop. */
+ } else {
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_NEXT_HOP"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY, val);
+ }
/* This route */
if (g_strcmp0 (verb, "route-client") == 0 || g_strcmp0 (verb, "route-host"))
- handle_route (priv->routes, env, TRUE);
+ handle_route (priv->routes, env, TRUE, is_xfrmi);
else if (g_strcmp0 (verb, "unroute-client") == 0 || g_strcmp0 (verb, "unroute-host"))
- handle_route (priv->routes, env, FALSE);
+ handle_route (priv->routes, env, FALSE, is_xfrmi);
/* Routes */
g_variant_builder_init (&builder, G_VARIANT_TYPE ("aau"));
--
2.43.0
From b5faeba110bd1145d7e0210267e36b054c419c54 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Thu, 30 Nov 2023 16:45:15 +0100
Subject: [PATCH 4/4] service,properties: support the "authby" option
Add support for the "authby" option, used to specify the mutual
authentication mechanism.
(cherry picked from commit 320b9daa2369cf2f76504544dc071911e2802421)
---
man/nm-settings-libreswan.5.in | 4 ++++
properties/nm-libreswan-editor-plugin.c | 2 ++
shared/nm-service-defines.h | 1 +
shared/utils.c | 9 +++++++--
src/nm-libreswan-service.c | 1 +
5 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in
index 59ac4ee..956fdd0 100644
--- a/man/nm-settings-libreswan.5.in
+++ b/man/nm-settings-libreswan.5.in
@@ -56,6 +56,10 @@ parameter of the same name.
specifies the remote's public key for RSA authentication.
When the 'leftcert' key is defined a default value of "%cert" is assumed.
.TP
+.I "authby"
+How the two security gateways should authenticate each other. Corresponds to the
+Libreswan parameter of the same name.
+.TP
.I "left"
contains the local address that should be used during IKE negotiation. If not specified, the value
"%defaultroute" is assumed. Corresponds to the Libreswan parameter of the same name.
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 0b3e36d..5222b6a 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -206,6 +206,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]);
else if (g_str_has_prefix (str, "ipsec-interface="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
+ else if (g_str_has_prefix (str, "authby="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 78193f2..3fdf2ef 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -41,6 +41,7 @@
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
#define NM_LIBRESWAN_KEY_LEFTCERT "leftcert"
+#define NM_LIBRESWAN_KEY_AUTHBY "authby"
#define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue"
#define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes"
#define NM_LIBRESWAN_KEY_LEFTXAUTHUSER "leftxauthusername"
diff --git a/shared/utils.c b/shared/utils.c
index a1a1c77..c49727c 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -110,6 +110,7 @@ nm_libreswan_config_write (gint fd,
const char *leftcert;
const char *leftrsasigkey;
const char *rightrsasigkey;
+ const char *authby;
const char *remote_network;
const char *ikev2 = NULL;
const char *rightid;
@@ -164,6 +165,7 @@ nm_libreswan_config_write (gint fd,
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT);
+ authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY);
if (leftcert && strlen (leftcert)) {
WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert);
if (!leftrsasigkey)
@@ -175,8 +177,11 @@ nm_libreswan_config_write (gint fd,
WRITE_CHECK (fd, debug_write_fcn, error, " leftrsasigkey=%s", leftrsasigkey);
if (rightrsasigkey && strlen (rightrsasigkey))
WRITE_CHECK (fd, debug_write_fcn, error, " rightrsasigkey=%s", rightrsasigkey);
- if ( !(leftrsasigkey && strlen (leftrsasigkey))
- && !(rightrsasigkey && strlen (rightrsasigkey))) {
+
+ if (authby && strlen (authby)) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " authby=%s", authby);
+ } else if ( !(leftrsasigkey && strlen (leftrsasigkey))
+ && !(rightrsasigkey && strlen (rightrsasigkey))) {
WRITE_CHECK (fd, debug_write_fcn, error, " authby=secret");
}
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 93beec0..ae04fa4 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_PFS, G_TYPE_STRING, 0, 0 },
--
2.43.0

79
SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch
Unescape View File

@ -0,0 +1,79 @@
From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 9 Jan 2024 23:30:42 +0100
Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient
Previously the plugin always set leftmodecfgclient=yes, which is used
for roaming clients to obtain a dynamic IP. In a server-to-server
scenario we don't want that option; allow omitting it by passing
leftmodecfgclient=no. It's somehow confusing that the new option has
the opposite default value than Libreswan, but that's the only way to
keep backwards compatibility for existing configurations.
---
properties/nm-libreswan-dialog.ui | 26 +++++++++++++++++++++++++
properties/nm-libreswan-editor-plugin.c | 2 ++
properties/nm-libreswan-editor.c | 9 +++++++++
shared/nm-service-defines.h | 1 +
shared/utils.c | 8 +++++++-
src/nm-libreswan-service.c | 1 +
6 files changed, 46 insertions(+), 1 deletion(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index b5c0d9e..89243cc 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (nm_streq0 (str, "leftmodecfgclient=no"))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no");
else if (g_str_has_prefix (str, "cisco-unity=yes"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 3fdf2ef..14170ad 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -41,6 +41,7 @@
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
#define NM_LIBRESWAN_KEY_LEFTCERT "leftcert"
+#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient"
#define NM_LIBRESWAN_KEY_AUTHBY "authby"
#define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue"
#define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes"
diff --git a/shared/utils.c b/shared/utils.c
index cbc117c..0bac9e6 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd,
else
WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute");
- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
+ if (nm_streq0 (item, "no")) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no");
+ } else {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ }
+
if (leftupdown_script)
WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script);
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index fc470a6..874f767 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
--
2.43.0

137
SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch
Unescape View File

@ -0,0 +1,137 @@
From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:29:50 +0100
Subject: [PATCH 2/5] service: use new API to send configuration to NM
Instead of emitting the "Ip4Config" signal that contains both generic
and IPv4 configurations, use the more recent API and send two signals:
"Config" for the generic configuration and "Ip4Config" for IPv4
configuration.
In this way, it will be possible in the next commit to return no IPv4
configuration at all.
---
src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 874f767..2aca78f 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object,
goto out;
}
+ /* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
- /* Right peer (or Gateway) */
- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
- else {
- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)");
- goto out;
- }
+ /*
+ * Enabled address families
+ */
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
* Tunnel device
@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object,
} else {
val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
}
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val);
+
+ /* Banner */
+ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
+
+ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
+ /* Then build and send the IPv4 config */
+ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
/* IP address */
val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP"));
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
else {
- _LOGW ("IP4 Address");
+ _LOGW ("IP4 Address is missing");
goto out;
}
@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val);
else {
- _LOGW ("IP4 PTP Address");
+ _LOGW ("IP4 PTP Address is missing");
goto out;
}
@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
-
/* Default domain */
val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE);
if (!val) {
@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val);
- /* Banner */
- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
-
/* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object,
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE));
success = TRUE;
+ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
out:
- if (success) {
- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
- g_variant_builder_end (&config));
- } else {
+ if (!success) {
connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL,
NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
}
--
2.43.0

448
SOURCES/0002-support-missing-features-ipv4.patch
Unescape View File

@ -1,448 +0,0 @@
From 946e336d6075bb0448b0a8cb110acc29d0633353 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Tue, 9 Jan 2024 23:30:42 +0100
Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient
Previously the plugin always set leftmodecfgclient=yes, which is used
for roaming clients to obtain a dynamic IP. In a server-to-server
scenario we don't want that option; allow omitting it by passing
leftmodecfgclient=no. It's somehow confusing that the new option has
the opposite default value than Libreswan, but that's the only way to
keep backwards compatibility for existing configurations.
---
properties/nm-libreswan-editor-plugin.c | 2 ++
shared/nm-service-defines.h | 1 +
shared/utils.c | 8 +++++++-
src/nm-libreswan-service.c | 1 +
4 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 5222b6a..a482cd3 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -186,6 +186,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (nm_streq0 (str, "leftmodecfgclient=no"))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no");
else if (g_str_has_prefix (str, "cisco-unity=yes"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 3fdf2ef..14170ad 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -41,6 +41,7 @@
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
#define NM_LIBRESWAN_KEY_LEFTCERT "leftcert"
+#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient"
#define NM_LIBRESWAN_KEY_AUTHBY "authby"
#define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue"
#define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes"
diff --git a/shared/utils.c b/shared/utils.c
index c49727c..c3147c6 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd,
else
WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute");
- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT);
+ if (nm_streq0 (item, "no")) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no");
+ } else {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes");
+ }
+
if (leftupdown_script)
WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script);
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index ae04fa4..78ce40d 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 },
--
2.43.0
From 13ee17d179fdd63005cb28d5548facf7fb1b21ea Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:29:50 +0100
Subject: [PATCH 2/5] service: use new API to send configuration to NM
Instead of emitting the "Ip4Config" signal that contains both generic
and IPv4 configurations, use the more recent API and send two signals:
"Config" for the generic configuration and "Ip4Config" for IPv4
configuration.
In this way, it will be possible in the next commit to return no IPv4
configuration at all.
---
src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 78ce40d..496fd08 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object,
goto out;
}
+ /* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
- /* Right peer (or Gateway) */
- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
- else {
- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)");
- goto out;
- }
+ /*
+ * Enabled address families
+ */
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
* Tunnel device
@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object,
} else {
val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE);
}
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val);
+
+ /* Banner */
+ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
+
+ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val);
+ /* Then build and send the IPv4 config */
+ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+
+ /* Right peer (or Gateway) */
+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER"));
+ if (val)
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val);
+ else {
+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing");
+ goto out;
+ }
/* IP address */
val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP"));
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val);
else {
- _LOGW ("IP4 Address");
+ _LOGW ("IP4 Address is missing");
goto out;
}
@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val);
else {
- _LOGW ("IP4 PTP Address");
+ _LOGW ("IP4 PTP Address is missing");
goto out;
}
@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val);
-
/* Default domain */
val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE);
if (!val) {
@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object,
if (val)
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val);
- /* Banner */
- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE);
- if (val)
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val);
-
/* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */
is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes");
@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object,
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE));
success = TRUE;
+ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
+ g_variant_builder_end (&config));
out:
- if (success) {
- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data),
- g_variant_builder_end (&config));
- } else {
+ if (!success) {
connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL,
NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
}
--
2.43.0
From 407c7b4a765a1a9da179f66aa8b9952958b7ecd2 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:31:48 +0100
Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is
disabled
If the mode config client is disabled (i.e. in server-to-server
scenario) we are not going to receive a dynamic IP. The IP address
already configured on the existing interface is enough.
---
src/nm-libreswan-service.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 496fd08..c3db36b 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
gpointer user_data)
{
NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data);
+ NMSettingVpn *s_vpn;
GVariantBuilder config;
GVariantBuilder builder;
GVariant *val;
@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object,
guint i;
const char *verb;
const char *virt_if;
+ const char *str;
gboolean is_xfrmi = FALSE;
+ gboolean has_ip4;
_LOGI ("Configuration from the helper received.");
@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object,
/* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ if ( priv->connection
+ && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
+ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
+ && nm_streq (str, "no")) {
+ has_ip4 = FALSE;
+ } else {
+ has_ip4 = TRUE;
+ }
+
+ _LOGD ("Configuration has IPv4: %d", has_ip4);
+
/*
* Enabled address families
*/
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4));
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object,
nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
g_variant_builder_end (&config));
+ if (!has_ip4) {
+ success = TRUE;
+ goto out;
+ }
/* Then build and send the IPv4 config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
--
2.43.0
From 39cee967cbfff6a916a75627aad780596369ff44 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Sat, 13 Jan 2024 18:10:02 +0100
Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for
Callback()
The Callback() D-Bus method is handled via a GDBus-generated skeleton
code in nm-libreswan-helper-service-dbus.c, function
_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function
emits signal "handle-callback" to let the program handle the incoming
method. As documented in the GDoc comments, the signal handler must
return TRUE if it handles the call.
```
/**
* NMDBusLibreswanHelper::handle-callback:
* @object: A #NMDBusLibreswanHelper.
* @invocation: A #GDBusMethodInvocation.
* @arg_environment: Argument passed by remote caller.
* Signal emitted when a remote caller is invoking the Callback()
D-Bus method.
* If a signal handler returns %TRUE, it means the signal handler
will handle the invocation (e.g. take a reference to @invocation
and eventually call nmdbus_libreswan_helper_complete_callback()
or e.g. g_dbus_method_invocation_return_error() on it) and no
other signal handlers will run. If no signal handler handles the
invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned.
* Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the
invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or
%FALSE to let other signal handlers run.
*/
```
At the moment, in case of error the handler first calls
nmdbus_libreswan_helper_complete_callback() which decreases the
refcount of "invocation", and then returns FALSE which tells the
skeleton code to return an error, also unreferencing the
invocation. This causes a crash.
Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
available since GLib 2.68 (while we target 2.36), just return TRUE.
Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
---
src/nm-libreswan-service.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index c3db36b..f6b8549 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1417,7 +1417,8 @@ out:
}
nmdbus_libreswan_helper_complete_callback (object, invocation);
- return success;
+
+ return TRUE;
}
/****************************************************************/
--
2.43.0
From 225d7aa27cdaf6448f6fe0ccd264fc57a0b41b32 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Mon, 15 Jan 2024 13:23:45 +0100
Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily,
clientaddrfamily
Add support for:
- type
- hostaddrfamily
- clientaddrfamily
Since those are very advanced options, don't implement the GUI part
for now.
---
properties/nm-libreswan-editor-plugin.c | 6 ++++++
shared/nm-service-defines.h | 3 +++
shared/utils.c | 12 ++++++++++++
src/nm-libreswan-service.c | 3 +++
4 files changed, 24 insertions(+)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index a482cd3..6a4c1a4 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -210,6 +210,12 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
else if (g_str_has_prefix (str, "authby="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
+ else if (g_str_has_prefix (str, "type="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type="));
+ else if (g_str_has_prefix (str, "hostaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily="));
+ else if (g_str_has_prefix (str, "clientaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily="));
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 14170ad..95e19d4 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -68,6 +68,9 @@
#define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation"
#define NM_LIBRESWAN_KEY_MOBIKE "mobike"
#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface"
+#define NM_LIBRESWAN_KEY_TYPE "type"
+#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily"
+#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily"
#define NM_LIBRESWAN_IKEV2_NO "no"
#define NM_LIBRESWAN_IKEV2_NEVER "never"
diff --git a/shared/utils.c b/shared/utils.c
index c3147c6..e6f8b5b 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd,
if (item && strlen (item))
WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index f6b8549..18b19d7 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 },
/* Ignored option for internal use */
{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 },
{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
--
2.43.0

72
SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
Unescape View File

@ -0,0 +1,72 @@
From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Jan 2024 09:31:48 +0100
Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is
disabled
If the mode config client is disabled (i.e. in server-to-server
scenario) we are not going to receive a dynamic IP. The IP address
already configured on the existing interface is enough.
---
src/nm-libreswan-service.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 2aca78f..12cf6f2 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object,
gpointer user_data)
{
NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data);
+ NMSettingVpn *s_vpn;
GVariantBuilder config;
GVariantBuilder builder;
GVariant *val;
@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object,
guint i;
const char *verb;
const char *virt_if;
+ const char *str;
gboolean is_xfrmi = FALSE;
+ gboolean has_ip4;
_LOGI ("Configuration from the helper received.");
@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object,
/* First build and send the generic config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
+ if ( priv->connection
+ && (s_vpn = nm_connection_get_setting_vpn (priv->connection))
+ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT))
+ && nm_streq (str, "no")) {
+ has_ip4 = FALSE;
+ } else {
+ has_ip4 = TRUE;
+ }
+
+ _LOGD ("Configuration has IPv4: %d", has_ip4);
+
/*
* Enabled address families
*/
- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE));
+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4));
g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE));
/*
@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object,
nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data),
g_variant_builder_end (&config));
+ if (!has_ip4) {
+ success = TRUE;
+ goto out;
+ }
/* Then build and send the IPv4 config */
g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT);
--
2.43.0

67
SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Unescape View File

@ -0,0 +1,67 @@
From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Sat, 13 Jan 2024 18:10:02 +0100
Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for
Callback()
The Callback() D-Bus method is handled via a GDBus-generated skeleton
code in nm-libreswan-helper-service-dbus.c, function
_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function
emits signal "handle-callback" to let the program handle the incoming
method. As documented in the GDoc comments, the signal handler must
return TRUE if it handles the call.
```
/**
* NMDBusLibreswanHelper::handle-callback:
* @object: A #NMDBusLibreswanHelper.
* @invocation: A #GDBusMethodInvocation.
* @arg_environment: Argument passed by remote caller.
* Signal emitted when a remote caller is invoking the Callback()
D-Bus method.
* If a signal handler returns %TRUE, it means the signal handler
will handle the invocation (e.g. take a reference to @invocation
and eventually call nmdbus_libreswan_helper_complete_callback()
or e.g. g_dbus_method_invocation_return_error() on it) and no
other signal handlers will run. If no signal handler handles the
invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned.
* Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the
invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or
%FALSE to let other signal handlers run.
*/
```
At the moment, in case of error the handler first calls
nmdbus_libreswan_helper_complete_callback() which decreases the
refcount of "invocation", and then returns FALSE which tells the
skeleton code to return an error, also unreferencing the
invocation. This causes a crash.
Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only
available since GLib 2.68 (while we target 2.36), just return TRUE.
Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper')
---
src/nm-libreswan-service.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 12cf6f2..0d5c4b8 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -1417,7 +1417,8 @@ out:
}
nmdbus_libreswan_helper_complete_callback (object, invocation);
- return success;
+
+ return TRUE;
}
/****************************************************************/
--
2.43.0

91
SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch
Unescape View File

@ -0,0 +1,91 @@
From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Mon, 15 Jan 2024 13:23:45 +0100
Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily,
clientaddrfamily
Add support for:
- type
- hostaddrfamily
- clientaddrfamily
Since those are very advanced options, don't implement the GUI part
for now.
---
properties/nm-libreswan-editor-plugin.c | 6 ++++++
shared/nm-service-defines.h | 3 +++
shared/utils.c | 12 ++++++++++++
src/nm-libreswan-service.c | 3 +++
4 files changed, 24 insertions(+)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index 89243cc..fe85c81 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]);
else if (g_str_has_prefix (str, "authby="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]);
+ else if (g_str_has_prefix (str, "type="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type="));
+ else if (g_str_has_prefix (str, "hostaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily="));
+ else if (g_str_has_prefix (str, "clientaddrfamily="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily="));
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 14170ad..95e19d4 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -68,6 +68,9 @@
#define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation"
#define NM_LIBRESWAN_KEY_MOBIKE "mobike"
#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface"
+#define NM_LIBRESWAN_KEY_TYPE "type"
+#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily"
+#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily"
#define NM_LIBRESWAN_IKEV2_NO "no"
#define NM_LIBRESWAN_IKEV2_NEVER "never"
diff --git a/shared/utils.c b/shared/utils.c
index 0bac9e6..9e616f8 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd,
if (item && strlen (item))
WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item);
+
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY);
+ if (item && strlen (item))
+ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item);
+
WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes");
WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add");
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 0d5c4b8..7e96230 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 },
/* Ignored option for internal use */
{ NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 },
{ NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 },
--
2.43.0

71
SOURCES/0006-add-support-leftsubnet.patch
Unescape View File

@ -0,0 +1,71 @@
From 2045cdf3dec79ae7d7b03ca7a081b8c444e242ef Mon Sep 17 00:00:00 2001
From: Beniamino Galvani <bgalvani@redhat.com>
Date: Wed, 10 Apr 2024 13:23:56 +0200
Subject: [PATCH] service,properties: support "leftsubnet"
https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/merge_requests/30
---
properties/nm-libreswan-dialog.ui | 42 ++++++++++++++++++++-----
properties/nm-libreswan-editor-plugin.c | 2 ++
properties/nm-libreswan-editor.c | 12 +++++++
shared/nm-service-defines.h | 1 +
shared/utils.c | 5 +++
src/nm-libreswan-service.c | 1 +
6 files changed, 56 insertions(+), 7 deletions(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index fe85c81..bb1685d 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -215,6 +215,8 @@ import_from_file (NMVpnEditorPlugin *self,
else if (g_str_has_prefix (str, "rightsubnet=")) {
if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]);
+ } else if (g_str_has_prefix (str, "leftsubnet=")) {
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK, str + NM_STRLEN("leftsubnet="));
} else if (g_str_has_prefix (str, "leftrsasigkey=")) {
if (str[14] != '%')
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY, &str[14]);
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 95e19d4..96e5c71 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -62,6 +62,7 @@
#define NM_LIBRESWAN_KEY_SALIFETIME "salifetime"
#define NM_LIBRESWAN_KEY_VENDOR "vendor"
#define NM_LIBRESWAN_KEY_REMOTENETWORK "rightsubnet"
+#define NM_LIBRESWAN_KEY_LOCALNETWORK "leftsubnet"
#define NM_LIBRESWAN_KEY_IKEV2 "ikev2"
#define NM_LIBRESWAN_KEY_NARROWING "narrowing"
#define NM_LIBRESWAN_KEY_REKEY "rekey"
diff --git a/shared/utils.c b/shared/utils.c
index 9e616f8..926d12d 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -222,6 +222,11 @@ nm_libreswan_config_write (gint fd,
WRITE_CHECK (fd, debug_write_fcn, error, " rightsubnet=%s",
remote_network);
+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK);
+ if (item) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " leftsubnet=%s", item);
+ }
+
if (!is_ikev2) {
/* When IKEv1 is in place, we enforce XAUTH: so, use IKE version
* also to check if XAUTH conf options should be passed to Libreswan.
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 7e96230..88c07d7 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -271,6 +271,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_SALIFETIME, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_VENDOR, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_REMOTENETWORK, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_LOCALNETWORK, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_IKEV2, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_NARROWING, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_REKEY, G_TYPE_STRING, 0, 0 },
--
2.44.0

107
SOURCES/0007-add-rightcert-property.patch
Unescape View File

@ -0,0 +1,107 @@
0001-properties-service-suppor-rightcert-configuration.patch
0002-properties-add-Remote-certificate-field-to-the-dialo.patch
From a980e399694c0a9887d98f1e0f0f24a201cb29c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
Date: Mon, 15 Apr 2024 10:42:08 +0200
Subject: [PATCH 1/2] properties, service: suppor rightcert configuration
This configuration allows to specify a certificate from the NSS database
to identify the remote, instead of pulling it.
(cherry picked from commit 2684233fd1c65c221d1f18c9d5b779c616c6d091)
---
properties/nm-libreswan-editor-plugin.c | 2 ++
shared/nm-service-defines.h | 1 +
shared/utils.c | 7 +++++++
src/nm-libreswan-service.c | 8 ++++++--
4 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
index bb1685d..fe473d1 100644
--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
else if (g_str_has_prefix (str, "leftcert="))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
+ else if (g_str_has_prefix (str, "rightcert="))
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]);
else if (nm_streq0 (str, "leftmodecfgclient=no"))
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
else if (g_str_has_prefix (str, "pfs=no"))
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
index 96e5c71..167b837 100644
--- a/shared/nm-service-defines.h
+++ b/shared/nm-service-defines.h
@@ -37,6 +37,7 @@
#define NM_LIBRESWAN_KEY_RIGHT "right"
#define NM_LIBRESWAN_KEY_RIGHTID "rightid"
#define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey"
+#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert"
#define NM_LIBRESWAN_KEY_LEFT "left"
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
diff --git a/shared/utils.c b/shared/utils.c
index 926d12d..5e19316 100644
--- a/shared/utils.c
+++ b/shared/utils.c
@@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd,
const char *left;
const char *leftid;
const char *leftcert;
+ const char *rightcert;
const char *leftrsasigkey;
const char *rightrsasigkey;
const char *authby;
@@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd,
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT);
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY);
+ if (rightcert && strlen (rightcert)) {
+ WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert);
+ if (!rightrsasigkey)
+ rightrsasigkey = "%cert";
+ }
if (leftcert && strlen (leftcert)) {
WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert);
if (!leftrsasigkey)
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
index 88c07d7..516eaac 100644
--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
@@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = {
{ NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 },
+ { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 },
{ NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 },
@@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin,
NMSettingVpn *s_vpn;
const char *leftcert;
const char *leftrsasigkey;
+ const char *rightcert;
const char *rightrsasigkey;
const char *pw_type;
@@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin,
if (leftcert)
goto xauth_check;
- /* If authentication is done through rsasigkeys, only the public keys are required */
+ /* If authentication is done through rsasigkeys, only the public keys are required.
+ * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
- if (leftrsasigkey && rightrsasigkey)
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
+ if (leftrsasigkey && (rightrsasigkey || rightcert))
goto xauth_check;
pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES);
--
2.44.0

50
SPECS/NetworkManager-libreswan.spec
Unescape View File

@ -3,9 +3,14 @@
%else
%bcond_with libnm_glib
%endif
%if 0%{?fedora} < 36 && 0%{?rhel} < 10
%bcond_with gtk4
%else
%bcond_without gtk4
%endif
%global real_version 1.2.14
%global rpm_version 1.2.14
%global real_version 1.2.18
%global rpm_version 1.2.18
%global release_version 3
%global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p')
@ -22,8 +27,13 @@ License: GPLv2+
URL: http://www.gnome.org/projects/NetworkManager/
Source0: https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz
Patch1: 0001-add-dpd-authby-and-ipsec-interface-support.patch
Patch2: 0002-support-missing-features-ipv4.patch
Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch
Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch
Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch
Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch
Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch
Patch6: 0006-add-support-leftsubnet.patch
Patch7: 0007-add-rightcert-property.patch
BuildRequires: make
BuildRequires: gcc
@ -40,6 +50,10 @@ BuildRequires: NetworkManager-glib-devel >= %{nm_version}
BuildRequires: libnm-gtk-devel >= %{nma_version}
%endif
%if %with gtk4
BuildRequires: libnma-gtk4-devel
%endif
Requires: NetworkManager >= %{nm_version}
Requires: dbus
Requires: /usr/sbin/ipsec
@ -78,6 +92,9 @@ the libreswan server with NetworkManager (GNOME files).
%build
%configure \
--disable-static \
%if %with gtk4
--with-gtk4 \
%endif
%if %without libnm_glib
--without-libnm-glib \
%endif
@ -99,31 +116,36 @@ rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la
%{_libexecdir}/nm-libreswan-service
%{_libexecdir}/nm-libreswan-service-helper
%{_mandir}/man5/nm-settings-libreswan.5.gz
%doc AUTHORS ChangeLog NEWS
%doc AUTHORS NEWS
%license COPYING
%files -n NetworkManager-libreswan-gnome
%{_libexecdir}/nm-libreswan-auth-dialog
%{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so
%dir %{_datadir}/gnome-vpn-properties/libreswan
%{_datadir}/gnome-vpn-properties/libreswan/nm-libreswan-dialog.ui
%{_datadir}/appdata/network-manager-libreswan.metainfo.xml
%{_metainfodir}/network-manager-libreswan.metainfo.xml
%if %with libnm_glib
%{_libdir}/NetworkManager/libnm-*-properties.so
%{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name
%endif
%if %with gtk4
%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so
%endif
%changelog
* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.14-3
- Support point-to-point IPSec tunnel (RHEL-20952)
- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-20952)
- Support configuring IPSec mode with 'type' (RHEL-20952)
* Tue May 07 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-3
- Support leftsubnet property (RHEL-33376)
- Support rightcert property (RHEL-33372)
* Wed Jan 17 2024 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
- Support point-to-point IPSec tunnel (RHEL-20690)
- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
- Support configuring IPSec mode with 'type' (RHEL-21554)
* Mon Dec 18 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.14-2
- Add DPD, ipsec-interface and authby support. RHEL-19225
* Fri Dec 15 2023 Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-1
- Update to 1.2.18 release
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.2.14-1.3
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

Write Preview
Loading…
Cancel
Save