From fc1479dfd9cac27041fec998dec0615826b85beb Mon Sep 17 00:00:00 2001 From: MSVSphere Packaging Team Date: Thu, 13 Jun 2024 03:30:47 +0300 Subject: [PATCH] import NetworkManager-libreswan-1.2.18-3.el9_4 --- .NetworkManager-libreswan.metadata | 2 +- .gitignore | 2 +- ...d-authby-and-ipsec-interface-support.patch | 433 ----------------- ...es-add-support-for-leftmodecfgclient.patch | 79 +++ ...-new-API-to-send-configuration-to-NM.patch | 137 ++++++ .../0002-support-missing-features-ipv4.patch | 448 ------------------ ...nd-IPv4-config-if-mode-config-client.patch | 72 +++ ...g-refcounting-in-D-Bus-handler-for-C.patch | 67 +++ ...es-support-type-hostaddrfamily-clien.patch | 91 ++++ SOURCES/0006-add-support-leftsubnet.patch | 71 +++ SOURCES/0007-add-rightcert-property.patch | 107 +++++ SPECS/NetworkManager-libreswan.spec | 50 +- 12 files changed, 662 insertions(+), 897 deletions(-) delete mode 100644 SOURCES/0001-add-dpd-authby-and-ipsec-interface-support.patch create mode 100644 SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch create mode 100644 SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch delete mode 100644 SOURCES/0002-support-missing-features-ipv4.patch create mode 100644 SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch create mode 100644 SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch create mode 100644 SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch create mode 100644 SOURCES/0006-add-support-leftsubnet.patch create mode 100644 SOURCES/0007-add-rightcert-property.patch diff --git a/.NetworkManager-libreswan.metadata b/.NetworkManager-libreswan.metadata index 3075cf7..5f9e2f2 100644 --- a/.NetworkManager-libreswan.metadata +++ b/.NetworkManager-libreswan.metadata @@ -1 +1 @@ -705a4dded50d26bd005bb68ea851f79453ea4252 SOURCES/NetworkManager-libreswan-1.2.14.tar.xz +a57014f8a1c360546cb7fed5231efd7cfbf85bf3 SOURCES/NetworkManager-libreswan-1.2.18.tar.xz diff --git a/.gitignore b/.gitignore index c680b5d..ccdf14f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/NetworkManager-libreswan-1.2.14.tar.xz +SOURCES/NetworkManager-libreswan-1.2.18.tar.xz diff --git a/SOURCES/0001-add-dpd-authby-and-ipsec-interface-support.patch b/SOURCES/0001-add-dpd-authby-and-ipsec-interface-support.patch deleted file mode 100644 index 5b03683..0000000 --- a/SOURCES/0001-add-dpd-authby-and-ipsec-interface-support.patch +++ /dev/null @@ -1,433 +0,0 @@ -From 357fc7227f6e219e4e55fd29e347ce1f21369518 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Thu, 23 Nov 2023 14:13:59 +0100 -Subject: [PATCH 1/4] service,properties: support DPD parameters - -Add support for parameters related to Dead Peer Detection (DPD), a -mechanism to check for reachability of IKE peers. - -(cherry picked from commit 6c35e460d393e73c478c7e885e875ea8c4918133) ---- - man/nm-settings-libreswan.5.in | 21 ++++++++++++++++++++- - properties/nm-libreswan-editor-plugin.c | 6 ++++++ - shared/nm-service-defines.h | 2 ++ - shared/utils.c | 13 +++++++++++++ - src/nm-libreswan-service.c | 4 +++- - 5 files changed, 44 insertions(+), 2 deletions(-) - -diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in -index 0188432..1bb304e 100644 ---- a/man/nm-settings-libreswan.5.in -+++ b/man/nm-settings-libreswan.5.in -@@ -85,7 +85,26 @@ ignored. - ignored. - .TP - .I "dpdtimeout" --ignored. -+the length of time that we will idle without hearing back from our peer. After -+this period has elapsed with no response and no traffic, we will declare the -+peer dead, and remove the SA. Set value bigger than dpddelay to enable. If -+dpdtimeout is set, dpddelay also needs to be set. Must be a number optionally -+followed by a time unit: 's' (seconds), 'm' (minutes), 'h', (hours) or 'd' -+(days); if the unit is not specified, it defaults to seconds. Corresponds to the -+Libreswan parameter of the same name. -+.TP -+.I "dpddelay" -+the delay between Dead Peer Detection (IKEv1 RFC 3706) or IKEv2 Liveness -+keepalives that are sent for this connection. Must be a number optionally -+followed by a time unit: 's' (seconds), 'm' (minutes), 'h', (hours) or 'd' -+(days); if the unit is not specified, it defaults to seconds. Corresponds to the -+Libreswan parameter of the same name. -+.TP -+.I "dpdaction" -+When a DPD enabled peer is declared dead, what action should be taken. "hold" -+(default) means the eroute will be put into %hold status, while "clear" means -+the eroute and SA with both be cleared. "restart" means that ALL SAs to the dead -+peer will renegotiated. Corresponds to the Libreswan parameter of the same name. - .TP - .I "ike" - allowed ciphers to be negotiatied to establish the IKE SAs. Corresponds to the -diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c -index 9a2399a..c4247f2 100644 ---- a/properties/nm-libreswan-editor-plugin.c -+++ b/properties/nm-libreswan-editor-plugin.c -@@ -198,6 +198,12 @@ import_from_file (NMVpnEditorPlugin *self, - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_FRAGMENTATION, &str[14]); - else if (g_str_has_prefix (str, "mobike=")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_MOBIKE, &str[7]); -+ else if (g_str_has_prefix (str, "dpddelay=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDDELAY, &str[9]); -+ else if (g_str_has_prefix (str, "dpdtimeout=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT, &str[11]); -+ else if (g_str_has_prefix (str, "dpdaction=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]); - else if (g_str_has_prefix (str, "rightsubnet=")) { - if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); -diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h -index a01a00f..c613fb7 100644 ---- a/shared/nm-service-defines.h -+++ b/shared/nm-service-defines.h -@@ -52,6 +52,8 @@ - #define NM_LIBRESWAN_KEY_PFS "pfs" - #define NM_LIBRESWAN_KEY_PFSGROUP "pfsgroup" - #define NM_LIBRESWAN_KEY_DPDTIMEOUT "dpdtimeout" -+#define NM_LIBRESWAN_KEY_DPDDELAY "dpddelay" -+#define NM_LIBRESWAN_KEY_DPDACTION "dpdaction" - #define NM_LIBRESWAN_KEY_IKE "ike" - #define NM_LIBRESWAN_KEY_ESP "esp" - #define NM_LIBRESWAN_KEY_IKELIFETIME "ikelifetime" -diff --git a/shared/utils.c b/shared/utils.c -index acb237f..5f71624 100644 ---- a/shared/utils.c -+++ b/shared/utils.c -@@ -118,6 +118,7 @@ nm_libreswan_config_write (gint fd, - const char *fragmentation; - const char *mobike; - const char *pfs; -+ const char *item; - gboolean is_ikev2 = FALSE; - - g_return_val_if_fail (fd > 0, FALSE); -@@ -297,6 +298,18 @@ nm_libreswan_config_write (gint fd, - if (mobike && strlen (mobike)) - WRITE_CHECK (fd, debug_write_fcn, error, " mobike=%s", mobike); - -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDDELAY); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " dpddelay=%s", item); -+ -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " dpdtimeout=%s", item); -+ -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " dpdaction=%s", item); -+ - WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes"); - - WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add"); -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index 3541125..bee47f3 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -260,7 +260,9 @@ static ValidProperty valid_properties[] = { - { NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_PFS, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_PFSGROUP, G_TYPE_STRING, 0, 0 }, -- { NM_LIBRESWAN_KEY_DPDTIMEOUT, G_TYPE_INT, 0, 86400 }, -+ { NM_LIBRESWAN_KEY_DPDACTION, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_DPDDELAY, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_DPDTIMEOUT, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_IKE, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_ESP, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_IKELIFETIME, G_TYPE_STRING, 0, 0 }, --- -2.43.0 - - -From 8f6bdd745d2d9fa61f6d82929984bbf7411e4632 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Fri, 24 Nov 2023 16:27:18 +0100 -Subject: [PATCH 2/4] service,properties: support the "ipsec-interface" option - -Introduce a new option "ipsec-interface" to create a XFRM virtual -interface for "Routing based VPNs" (as opposed to "Policy based -VPNs"). - -(cherry picked from commit f5e8bf1ebe17d13c49780647973dd742f40f112c) ---- - man/nm-settings-libreswan.5.in | 7 +++++++ - properties/nm-libreswan-editor-plugin.c | 2 ++ - shared/nm-service-defines.h | 1 + - shared/utils.c | 4 ++++ - src/nm-libreswan-service.c | 11 +++++++++-- - 5 files changed, 23 insertions(+), 2 deletions(-) - -diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in -index 1bb304e..59ac4ee 100644 ---- a/man/nm-settings-libreswan.5.in -+++ b/man/nm-settings-libreswan.5.in -@@ -153,6 +153,13 @@ Matches the Libreswan parameter of the same name. - Allowed values are: 'yes' and 'no'. - Matches the Libreswan parameter of the same name. - .TP -+.I "ipsec-interface" -+If set, create or use an existing virtual interface ipsecXXX for "Routing based -+VPNs" (as opposed to "Policy based VPNs"). Valid options are 'yes', 'no' or a -+number. When using a number, the IPsec interface created and/or used will use -+that number as part of the interface name. Corresponds to the Libreswan -+parameter of the same name. -+.TP - .I "pskinputmodes" - where the 'pskvalue' can be retrieved. Used internally by the plugin. Allowed values are: 'unused', 'save', 'ask'. - .TP -diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c -index c4247f2..0b3e36d 100644 ---- a/properties/nm-libreswan-editor-plugin.c -+++ b/properties/nm-libreswan-editor-plugin.c -@@ -204,6 +204,8 @@ import_from_file (NMVpnEditorPlugin *self, - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDTIMEOUT, &str[11]); - else if (g_str_has_prefix (str, "dpdaction=")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]); -+ else if (g_str_has_prefix (str, "ipsec-interface=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]); - else if (g_str_has_prefix (str, "rightsubnet=")) { - if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); -diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h -index c613fb7..78193f2 100644 ---- a/shared/nm-service-defines.h -+++ b/shared/nm-service-defines.h -@@ -65,6 +65,7 @@ - #define NM_LIBRESWAN_KEY_REKEY "rekey" - #define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation" - #define NM_LIBRESWAN_KEY_MOBIKE "mobike" -+#define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface" - - #define NM_LIBRESWAN_IKEV2_NO "no" - #define NM_LIBRESWAN_IKEV2_NEVER "never" -diff --git a/shared/utils.c b/shared/utils.c -index 5f71624..a1a1c77 100644 ---- a/shared/utils.c -+++ b/shared/utils.c -@@ -310,6 +310,10 @@ nm_libreswan_config_write (gint fd, - if (item && strlen (item)) - WRITE_CHECK (fd, debug_write_fcn, error, " dpdaction=%s", item); - -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item); -+ - WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes"); - - WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add"); -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index bee47f3..0b6db91 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -274,6 +274,7 @@ static ValidProperty valid_properties[] = { - { NM_LIBRESWAN_KEY_REKEY, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 }, - /* Ignored option for internal use */ - { NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 }, - { NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 }, -@@ -1252,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object, - gboolean success = FALSE; - guint i; - const char *verb; -+ const char *virt_if; - - _LOGI ("Configuration from the helper received."); - -@@ -1274,9 +1276,14 @@ handle_callback (NMDBusLibreswanHelper *object, - - /* - * Tunnel device -- * Indicate that this plugin doesn't use tun/tap device - */ -- val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE); -+ virt_if = lookup_string (env, "PLUTO_VIRT_INTERFACE"); -+ if (virt_if && !nm_streq (virt_if, "NULL")) { -+ val = g_variant_new_string (virt_if); -+ } else { -+ val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE); -+ } -+ - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val); - - /* IP address */ --- -2.43.0 - - -From 11061213f6f52373470af11d0b00c24b8670f356 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Tue, 28 Nov 2023 11:59:05 +0100 -Subject: [PATCH 3/4] service: ignore next hop in routed mode - -In routed mode, the traffic needs to be sent directly over the -interface without a gateway. - -(cherry picked from commit aa14380637a3de20ce9a59abc8b927368b1ab926) ---- - src/nm-libreswan-service.c | 24 ++++++++++++++++++------ - 1 file changed, 18 insertions(+), 6 deletions(-) - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index 0b6db91..93beec0 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -1197,7 +1197,7 @@ _take_route (GPtrArray *routes, GVariant *new, gboolean alive) - } - - static void --handle_route (GPtrArray *routes, GVariant *env, gboolean alive) -+handle_route (GPtrArray *routes, GVariant *env, gboolean alive, gboolean is_xfrmi) - { - GVariantBuilder builder; - const gchar *net, *mask, *next_hop, *my_sourceip; -@@ -1210,9 +1210,13 @@ handle_route (GPtrArray *routes, GVariant *env, gboolean alive) - next_hop = lookup_string (env, "PLUTO_NEXT_HOP"); - my_sourceip = lookup_string (env, "PLUTO_MY_SOURCEIP"); - -+ - if (!net || !mask || !next_hop || !my_sourceip) - return; - -+ if (is_xfrmi) -+ next_hop = "0.0.0.0"; -+ - if (g_strcmp0 (net, "0.0.0.0") == 0 && g_strcmp0 (mask, "0")) { - g_variant_builder_init (&builder, G_VARIANT_TYPE ("au")); - g_variant_builder_add_value (&builder, addr4_to_gvariant ("0.0.0.0")); -@@ -1254,6 +1258,7 @@ handle_callback (NMDBusLibreswanHelper *object, - guint i; - const char *verb; - const char *virt_if; -+ gboolean is_xfrmi = FALSE; - - _LOGI ("Configuration from the helper received."); - -@@ -1332,16 +1337,23 @@ handle_callback (NMDBusLibreswanHelper *object, - if (val) - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val); - -+ /* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */ -+ is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes"); - -- val = addr4_to_gvariant (lookup_string (env, "PLUTO_NEXT_HOP")); -- if (val) -- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY, val); -+ if (is_xfrmi) { -+ /* The traffic needs to be sent directly over the interface without a gateway. -+ * Ignore the next hop. */ -+ } else { -+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_NEXT_HOP")); -+ if (val) -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_INT_GATEWAY, val); -+ } - - /* This route */ - if (g_strcmp0 (verb, "route-client") == 0 || g_strcmp0 (verb, "route-host")) -- handle_route (priv->routes, env, TRUE); -+ handle_route (priv->routes, env, TRUE, is_xfrmi); - else if (g_strcmp0 (verb, "unroute-client") == 0 || g_strcmp0 (verb, "unroute-host")) -- handle_route (priv->routes, env, FALSE); -+ handle_route (priv->routes, env, FALSE, is_xfrmi); - - /* Routes */ - g_variant_builder_init (&builder, G_VARIANT_TYPE ("aau")); --- -2.43.0 - - -From b5faeba110bd1145d7e0210267e36b054c419c54 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Thu, 30 Nov 2023 16:45:15 +0100 -Subject: [PATCH 4/4] service,properties: support the "authby" option - -Add support for the "authby" option, used to specify the mutual -authentication mechanism. - -(cherry picked from commit 320b9daa2369cf2f76504544dc071911e2802421) ---- - man/nm-settings-libreswan.5.in | 4 ++++ - properties/nm-libreswan-editor-plugin.c | 2 ++ - shared/nm-service-defines.h | 1 + - shared/utils.c | 9 +++++++-- - src/nm-libreswan-service.c | 1 + - 5 files changed, 15 insertions(+), 2 deletions(-) - -diff --git a/man/nm-settings-libreswan.5.in b/man/nm-settings-libreswan.5.in -index 59ac4ee..956fdd0 100644 ---- a/man/nm-settings-libreswan.5.in -+++ b/man/nm-settings-libreswan.5.in -@@ -56,6 +56,10 @@ parameter of the same name. - specifies the remote's public key for RSA authentication. - When the 'leftcert' key is defined a default value of "%cert" is assumed. - .TP -+.I "authby" -+How the two security gateways should authenticate each other. Corresponds to the -+Libreswan parameter of the same name. -+.TP - .I "left" - contains the local address that should be used during IKE negotiation. If not specified, the value - "%defaultroute" is assumed. Corresponds to the Libreswan parameter of the same name. -diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c -index 0b3e36d..5222b6a 100644 ---- a/properties/nm-libreswan-editor-plugin.c -+++ b/properties/nm-libreswan-editor-plugin.c -@@ -206,6 +206,8 @@ import_from_file (NMVpnEditorPlugin *self, - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_DPDACTION, &str[10]); - else if (g_str_has_prefix (str, "ipsec-interface=")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]); -+ else if (g_str_has_prefix (str, "authby=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]); - else if (g_str_has_prefix (str, "rightsubnet=")) { - if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); -diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h -index 78193f2..3fdf2ef 100644 ---- a/shared/nm-service-defines.h -+++ b/shared/nm-service-defines.h -@@ -41,6 +41,7 @@ - #define NM_LIBRESWAN_KEY_LEFTID "leftid" - #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" - #define NM_LIBRESWAN_KEY_LEFTCERT "leftcert" -+#define NM_LIBRESWAN_KEY_AUTHBY "authby" - #define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue" - #define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes" - #define NM_LIBRESWAN_KEY_LEFTXAUTHUSER "leftxauthusername" -diff --git a/shared/utils.c b/shared/utils.c -index a1a1c77..c49727c 100644 ---- a/shared/utils.c -+++ b/shared/utils.c -@@ -110,6 +110,7 @@ nm_libreswan_config_write (gint fd, - const char *leftcert; - const char *leftrsasigkey; - const char *rightrsasigkey; -+ const char *authby; - const char *remote_network; - const char *ikev2 = NULL; - const char *rightid; -@@ -164,6 +165,7 @@ nm_libreswan_config_write (gint fd, - leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); - rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); - leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT); -+ authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY); - if (leftcert && strlen (leftcert)) { - WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert); - if (!leftrsasigkey) -@@ -175,8 +177,11 @@ nm_libreswan_config_write (gint fd, - WRITE_CHECK (fd, debug_write_fcn, error, " leftrsasigkey=%s", leftrsasigkey); - if (rightrsasigkey && strlen (rightrsasigkey)) - WRITE_CHECK (fd, debug_write_fcn, error, " rightrsasigkey=%s", rightrsasigkey); -- if ( !(leftrsasigkey && strlen (leftrsasigkey)) -- && !(rightrsasigkey && strlen (rightrsasigkey))) { -+ -+ if (authby && strlen (authby)) { -+ WRITE_CHECK (fd, debug_write_fcn, error, " authby=%s", authby); -+ } else if ( !(leftrsasigkey && strlen (leftrsasigkey)) -+ && !(rightrsasigkey && strlen (rightrsasigkey))) { - WRITE_CHECK (fd, debug_write_fcn, error, " authby=secret"); - } - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index 93beec0..ae04fa4 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = { - { NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_PFS, G_TYPE_STRING, 0, 0 }, --- -2.43.0 - diff --git a/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch b/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch new file mode 100644 index 0000000..f66bf0f --- /dev/null +++ b/SOURCES/0001-service-properties-add-support-for-leftmodecfgclient.patch @@ -0,0 +1,79 @@ +From 0f0b2d375901e302e8a619e3911321f511b52885 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Tue, 9 Jan 2024 23:30:42 +0100 +Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient + +Previously the plugin always set leftmodecfgclient=yes, which is used +for roaming clients to obtain a dynamic IP. In a server-to-server +scenario we don't want that option; allow omitting it by passing +leftmodecfgclient=no. It's somehow confusing that the new option has +the opposite default value than Libreswan, but that's the only way to +keep backwards compatibility for existing configurations. +--- + properties/nm-libreswan-dialog.ui | 26 +++++++++++++++++++++++++ + properties/nm-libreswan-editor-plugin.c | 2 ++ + properties/nm-libreswan-editor.c | 9 +++++++++ + shared/nm-service-defines.h | 1 + + shared/utils.c | 8 +++++++- + src/nm-libreswan-service.c | 1 + + 6 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index b5c0d9e..89243cc 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); + else if (g_str_has_prefix (str, "leftcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); ++ else if (nm_streq0 (str, "leftmodecfgclient=no")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); + else if (g_str_has_prefix (str, "pfs=no")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no"); + else if (g_str_has_prefix (str, "cisco-unity=yes")) +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 3fdf2ef..14170ad 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -41,6 +41,7 @@ + #define NM_LIBRESWAN_KEY_LEFTID "leftid" + #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" + #define NM_LIBRESWAN_KEY_LEFTCERT "leftcert" ++#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient" + #define NM_LIBRESWAN_KEY_AUTHBY "authby" + #define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue" + #define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes" +diff --git a/shared/utils.c b/shared/utils.c +index cbc117c..0bac9e6 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd, + else + WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute"); + +- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT); ++ if (nm_streq0 (item, "no")) { ++ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no"); ++ } else { ++ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); ++ } ++ + if (leftupdown_script) + WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script); + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index fc470a6..874f767 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 }, +-- +2.43.0 + diff --git a/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch b/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch new file mode 100644 index 0000000..6c4d2d9 --- /dev/null +++ b/SOURCES/0002-service-use-new-API-to-send-configuration-to-NM.patch @@ -0,0 +1,137 @@ +From 09ee8838162cb6ea097375fb7d8b698566bb1c4d Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Wed, 10 Jan 2024 09:29:50 +0100 +Subject: [PATCH 2/5] service: use new API to send configuration to NM + +Instead of emitting the "Ip4Config" signal that contains both generic +and IPv4 configurations, use the more recent API and send two signals: +"Config" for the generic configuration and "Ip4Config" for IPv4 +configuration. + +In this way, it will be possible in the next commit to return no IPv4 +configuration at all. +--- + src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++------------- + 1 file changed, 40 insertions(+), 21 deletions(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 874f767..2aca78f 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object, + goto out; + } + ++ /* First build and send the generic config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); + +- /* Right peer (or Gateway) */ +- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); +- if (val) +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); +- else { +- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)"); +- goto out; +- } ++ /* ++ * Enabled address families ++ */ ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); + + /* + * Tunnel device +@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object, + } else { + val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE); + } ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val); ++ ++ /* Banner */ ++ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val); ++ ++ /* Right peer (or Gateway) */ ++ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val); ++ else { ++ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); ++ goto out; ++ } ++ ++ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), ++ g_variant_builder_end (&config)); + +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val); ++ /* Then build and send the IPv4 config */ ++ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); ++ ++ /* Right peer (or Gateway) */ ++ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); ++ if (val) ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); ++ else { ++ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); ++ goto out; ++ } + + /* IP address */ + val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP")); + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val); + else { +- _LOGW ("IP4 Address"); ++ _LOGW ("IP4 Address is missing"); + goto out; + } + +@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val); + else { +- _LOGW ("IP4 PTP Address"); ++ _LOGW ("IP4 PTP Address is missing"); + goto out; + } + +@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val); + +- + /* Default domain */ + val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE); + if (!val) { +@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object, + if (val) + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val); + +- /* Banner */ +- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); +- if (val) +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val); +- + /* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */ + is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes"); + +@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object, + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE)); + + success = TRUE; ++ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), ++ g_variant_builder_end (&config)); + + out: +- if (success) { +- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), +- g_variant_builder_end (&config)); +- } else { ++ if (!success) { + connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL, + NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED); + } +-- +2.43.0 + diff --git a/SOURCES/0002-support-missing-features-ipv4.patch b/SOURCES/0002-support-missing-features-ipv4.patch deleted file mode 100644 index cd3973d..0000000 --- a/SOURCES/0002-support-missing-features-ipv4.patch +++ /dev/null @@ -1,448 +0,0 @@ -From 946e336d6075bb0448b0a8cb110acc29d0633353 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Tue, 9 Jan 2024 23:30:42 +0100 -Subject: [PATCH 1/5] service,properties: add support for leftmodecfgclient - -Previously the plugin always set leftmodecfgclient=yes, which is used -for roaming clients to obtain a dynamic IP. In a server-to-server -scenario we don't want that option; allow omitting it by passing -leftmodecfgclient=no. It's somehow confusing that the new option has -the opposite default value than Libreswan, but that's the only way to -keep backwards compatibility for existing configurations. ---- - properties/nm-libreswan-editor-plugin.c | 2 ++ - shared/nm-service-defines.h | 1 + - shared/utils.c | 8 +++++++- - src/nm-libreswan-service.c | 1 + - 4 files changed, 11 insertions(+), 1 deletion(-) - -diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c -index 5222b6a..a482cd3 100644 ---- a/properties/nm-libreswan-editor-plugin.c -+++ b/properties/nm-libreswan-editor-plugin.c -@@ -186,6 +186,8 @@ import_from_file (NMVpnEditorPlugin *self, - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); - else if (g_str_has_prefix (str, "leftcert=")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); -+ else if (nm_streq0 (str, "leftmodecfgclient=no")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); - else if (g_str_has_prefix (str, "pfs=no")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_PFS, "no"); - else if (g_str_has_prefix (str, "cisco-unity=yes")) -diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h -index 3fdf2ef..14170ad 100644 ---- a/shared/nm-service-defines.h -+++ b/shared/nm-service-defines.h -@@ -41,6 +41,7 @@ - #define NM_LIBRESWAN_KEY_LEFTID "leftid" - #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" - #define NM_LIBRESWAN_KEY_LEFTCERT "leftcert" -+#define NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT "leftmodecfgclient" - #define NM_LIBRESWAN_KEY_AUTHBY "authby" - #define NM_LIBRESWAN_KEY_PSK_VALUE "pskvalue" - #define NM_LIBRESWAN_KEY_PSK_INPUT_MODES "pskinputmodes" -diff --git a/shared/utils.c b/shared/utils.c -index c49727c..c3147c6 100644 ---- a/shared/utils.c -+++ b/shared/utils.c -@@ -191,7 +191,13 @@ nm_libreswan_config_write (gint fd, - else - WRITE_CHECK (fd, debug_write_fcn, error, " left=%%defaultroute"); - -- WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT); -+ if (nm_streq0 (item, "no")) { -+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=no"); -+ } else { -+ WRITE_CHECK (fd, debug_write_fcn, error, " leftmodecfgclient=yes"); -+ } -+ - if (leftupdown_script) - WRITE_CHECK (fd, debug_write_fcn, error, " leftupdown=%s", leftupdown_script); - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index ae04fa4..78ce40d 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -256,6 +256,7 @@ static ValidProperty valid_properties[] = { - { NM_LIBRESWAN_KEY_LEFTUSERNAME, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_LEFTRSASIGKEY, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_LEFTCERT, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_AUTHBY, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_DOMAIN, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_DHGROUP, G_TYPE_STRING, 0, 0 }, --- -2.43.0 - - -From 13ee17d179fdd63005cb28d5548facf7fb1b21ea Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Wed, 10 Jan 2024 09:29:50 +0100 -Subject: [PATCH 2/5] service: use new API to send configuration to NM - -Instead of emitting the "Ip4Config" signal that contains both generic -and IPv4 configurations, use the more recent API and send two signals: -"Config" for the generic configuration and "Ip4Config" for IPv4 -configuration. - -In this way, it will be possible in the next commit to return no IPv4 -configuration at all. ---- - src/nm-libreswan-service.c | 61 +++++++++++++++++++++++++------------- - 1 file changed, 40 insertions(+), 21 deletions(-) - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index 78ce40d..496fd08 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -1270,16 +1270,14 @@ handle_callback (NMDBusLibreswanHelper *object, - goto out; - } - -+ /* First build and send the generic config */ - g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); - -- /* Right peer (or Gateway) */ -- val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); -- if (val) -- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); -- else { -- _LOGW ("IPsec/Pluto Right Peer (VPN Gateway)"); -- goto out; -- } -+ /* -+ * Enabled address families -+ */ -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); - - /* - * Tunnel device -@@ -1290,15 +1288,43 @@ handle_callback (NMDBusLibreswanHelper *object, - } else { - val = g_variant_new_string (NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV_NONE); - } -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_TUNDEV, val); -+ -+ /* Banner */ -+ val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); -+ if (val) -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_BANNER, val); -+ -+ /* Right peer (or Gateway) */ -+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); -+ if (val) -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY, val); -+ else { -+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); -+ goto out; -+ } -+ -+ nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), -+ g_variant_builder_end (&config)); - -- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, val); -+ /* Then build and send the IPv4 config */ -+ g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); -+ -+ /* Right peer (or Gateway) */ -+ val = addr4_to_gvariant (lookup_string (env, "PLUTO_PEER")); -+ if (val) -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_GATEWAY, val); -+ else { -+ _LOGW ("IPsec/Pluto Right Peer (VPN Gateway) is missing"); -+ goto out; -+ } - - /* IP address */ - val = addr4_to_gvariant (lookup_string (env, "PLUTO_MY_SOURCEIP")); - if (val) - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_ADDRESS, val); - else { -- _LOGW ("IP4 Address"); -+ _LOGW ("IP4 Address is missing"); - goto out; - } - -@@ -1307,7 +1333,7 @@ handle_callback (NMDBusLibreswanHelper *object, - if (val) - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_PTP, val); - else { -- _LOGW ("IP4 PTP Address"); -+ _LOGW ("IP4 PTP Address is missing"); - goto out; - } - -@@ -1324,7 +1350,6 @@ handle_callback (NMDBusLibreswanHelper *object, - if (val) - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DNS, val); - -- - /* Default domain */ - val = str_to_gvariant (lookup_string (env, "PLUTO_CISCO_DOMAIN_INFO"), TRUE); - if (!val) { -@@ -1334,11 +1359,6 @@ handle_callback (NMDBusLibreswanHelper *object, - if (val) - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_DOMAIN, val); - -- /* Banner */ -- val = str_to_gvariant (lookup_string (env, "PLUTO_PEER_BANNER"), TRUE); -- if (val) -- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, val); -- - /* Indicates whether the VPN is using a XFRM interface (via option ipsec-interface=) */ - is_xfrmi = nm_streq0 (lookup_string (env, "PLUTO_XFRMI_ROUTE"), "yes"); - -@@ -1369,12 +1389,11 @@ handle_callback (NMDBusLibreswanHelper *object, - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_NEVER_DEFAULT, g_variant_new_boolean (TRUE)); - - success = TRUE; -+ nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), -+ g_variant_builder_end (&config)); - - out: -- if (success) { -- nm_vpn_service_plugin_set_ip4_config (NM_VPN_SERVICE_PLUGIN (user_data), -- g_variant_builder_end (&config)); -- } else { -+ if (!success) { - connect_failed (NM_LIBRESWAN_PLUGIN (user_data), NULL, - NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED); - } --- -2.43.0 - - -From 407c7b4a765a1a9da179f66aa8b9952958b7ecd2 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Wed, 10 Jan 2024 09:31:48 +0100 -Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is - disabled - -If the mode config client is disabled (i.e. in server-to-server -scenario) we are not going to receive a dynamic IP. The IP address -already configured on the existing interface is enough. ---- - src/nm-libreswan-service.c | 20 +++++++++++++++++++- - 1 file changed, 19 insertions(+), 1 deletion(-) - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index 496fd08..c3db36b 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object, - gpointer user_data) - { - NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data); -+ NMSettingVpn *s_vpn; - GVariantBuilder config; - GVariantBuilder builder; - GVariant *val; -@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object, - guint i; - const char *verb; - const char *virt_if; -+ const char *str; - gboolean is_xfrmi = FALSE; -+ gboolean has_ip4; - - _LOGI ("Configuration from the helper received."); - -@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object, - /* First build and send the generic config */ - g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); - -+ if ( priv->connection -+ && (s_vpn = nm_connection_get_setting_vpn (priv->connection)) -+ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT)) -+ && nm_streq (str, "no")) { -+ has_ip4 = FALSE; -+ } else { -+ has_ip4 = TRUE; -+ } -+ -+ _LOGD ("Configuration has IPv4: %d", has_ip4); -+ - /* - * Enabled address families - */ -- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); -+ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4)); - g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); - - /* -@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object, - - nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), - g_variant_builder_end (&config)); -+ if (!has_ip4) { -+ success = TRUE; -+ goto out; -+ } - - /* Then build and send the IPv4 config */ - g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); --- -2.43.0 - - -From 39cee967cbfff6a916a75627aad780596369ff44 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Sat, 13 Jan 2024 18:10:02 +0100 -Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for - Callback() - -The Callback() D-Bus method is handled via a GDBus-generated skeleton -code in nm-libreswan-helper-service-dbus.c, function -_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function -emits signal "handle-callback" to let the program handle the incoming -method. As documented in the GDoc comments, the signal handler must -return TRUE if it handles the call. - -``` - /** - * NMDBusLibreswanHelper::handle-callback: - * @object: A #NMDBusLibreswanHelper. - * @invocation: A #GDBusMethodInvocation. - * @arg_environment: Argument passed by remote caller. - - * Signal emitted when a remote caller is invoking the Callback() - D-Bus method. - - * If a signal handler returns %TRUE, it means the signal handler - will handle the invocation (e.g. take a reference to @invocation - and eventually call nmdbus_libreswan_helper_complete_callback() - or e.g. g_dbus_method_invocation_return_error() on it) and no - other signal handlers will run. If no signal handler handles the - invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned. - - * Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the - invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or - %FALSE to let other signal handlers run. - */ -``` - -At the moment, in case of error the handler first calls -nmdbus_libreswan_helper_complete_callback() which decreases the -refcount of "invocation", and then returns FALSE which tells the -skeleton code to return an error, also unreferencing the -invocation. This causes a crash. - -Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only -available since GLib 2.68 (while we target 2.36), just return TRUE. - -Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper') ---- - src/nm-libreswan-service.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index c3db36b..f6b8549 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -1417,7 +1417,8 @@ out: - } - - nmdbus_libreswan_helper_complete_callback (object, invocation); -- return success; -+ -+ return TRUE; - } - - /****************************************************************/ --- -2.43.0 - - -From 225d7aa27cdaf6448f6fe0ccd264fc57a0b41b32 Mon Sep 17 00:00:00 2001 -From: Beniamino Galvani -Date: Mon, 15 Jan 2024 13:23:45 +0100 -Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily, - clientaddrfamily - -Add support for: - - type - - hostaddrfamily - - clientaddrfamily - -Since those are very advanced options, don't implement the GUI part -for now. ---- - properties/nm-libreswan-editor-plugin.c | 6 ++++++ - shared/nm-service-defines.h | 3 +++ - shared/utils.c | 12 ++++++++++++ - src/nm-libreswan-service.c | 3 +++ - 4 files changed, 24 insertions(+) - -diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c -index a482cd3..6a4c1a4 100644 ---- a/properties/nm-libreswan-editor-plugin.c -+++ b/properties/nm-libreswan-editor-plugin.c -@@ -210,6 +210,12 @@ import_from_file (NMVpnEditorPlugin *self, - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]); - else if (g_str_has_prefix (str, "authby=")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]); -+ else if (g_str_has_prefix (str, "type=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type=")); -+ else if (g_str_has_prefix (str, "hostaddrfamily=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily=")); -+ else if (g_str_has_prefix (str, "clientaddrfamily=")) -+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily=")); - else if (g_str_has_prefix (str, "rightsubnet=")) { - if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) - nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); -diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h -index 14170ad..95e19d4 100644 ---- a/shared/nm-service-defines.h -+++ b/shared/nm-service-defines.h -@@ -68,6 +68,9 @@ - #define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation" - #define NM_LIBRESWAN_KEY_MOBIKE "mobike" - #define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface" -+#define NM_LIBRESWAN_KEY_TYPE "type" -+#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily" -+#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily" - - #define NM_LIBRESWAN_IKEV2_NO "no" - #define NM_LIBRESWAN_IKEV2_NEVER "never" -diff --git a/shared/utils.c b/shared/utils.c -index c3147c6..e6f8b5b 100644 ---- a/shared/utils.c -+++ b/shared/utils.c -@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd, - if (item && strlen (item)) - WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item); - -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item); -+ -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item); -+ -+ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY); -+ if (item && strlen (item)) -+ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item); -+ - WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes"); - - WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add"); -diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c -index f6b8549..18b19d7 100644 ---- a/src/nm-libreswan-service.c -+++ b/src/nm-libreswan-service.c -@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = { - { NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 }, - { NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 }, -+ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 }, - /* Ignored option for internal use */ - { NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 }, - { NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 }, --- -2.43.0 - diff --git a/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch b/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch new file mode 100644 index 0000000..11d8fcc --- /dev/null +++ b/SOURCES/0003-service-don-t-send-IPv4-config-if-mode-config-client.patch @@ -0,0 +1,72 @@ +From 74ec0f7dc18939dd4a5992584527ab044b284fc0 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Wed, 10 Jan 2024 09:31:48 +0100 +Subject: [PATCH 3/5] service: don't send IPv4 config if mode config client is + disabled + +If the mode config client is disabled (i.e. in server-to-server +scenario) we are not going to receive a dynamic IP. The IP address +already configured on the existing interface is enough. +--- + src/nm-libreswan-service.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 2aca78f..12cf6f2 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1253,6 +1253,7 @@ handle_callback (NMDBusLibreswanHelper *object, + gpointer user_data) + { + NMLibreswanPluginPrivate *priv = NM_LIBRESWAN_PLUGIN_GET_PRIVATE (user_data); ++ NMSettingVpn *s_vpn; + GVariantBuilder config; + GVariantBuilder builder; + GVariant *val; +@@ -1260,7 +1261,9 @@ handle_callback (NMDBusLibreswanHelper *object, + guint i; + const char *verb; + const char *virt_if; ++ const char *str; + gboolean is_xfrmi = FALSE; ++ gboolean has_ip4; + + _LOGI ("Configuration from the helper received."); + +@@ -1273,10 +1276,21 @@ handle_callback (NMDBusLibreswanHelper *object, + /* First build and send the generic config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); + ++ if ( priv->connection ++ && (s_vpn = nm_connection_get_setting_vpn (priv->connection)) ++ && (str = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT)) ++ && nm_streq (str, "no")) { ++ has_ip4 = FALSE; ++ } else { ++ has_ip4 = TRUE; ++ } ++ ++ _LOGD ("Configuration has IPv4: %d", has_ip4); ++ + /* + * Enabled address families + */ +- g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (TRUE)); ++ g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP4, g_variant_new_boolean (has_ip4)); + g_variant_builder_add (&config, "{sv}", NM_VPN_PLUGIN_CONFIG_HAS_IP6, g_variant_new_boolean (FALSE)); + + /* +@@ -1306,6 +1320,10 @@ handle_callback (NMDBusLibreswanHelper *object, + + nm_vpn_service_plugin_set_config (NM_VPN_SERVICE_PLUGIN (user_data), + g_variant_builder_end (&config)); ++ if (!has_ip4) { ++ success = TRUE; ++ goto out; ++ } + + /* Then build and send the IPv4 config */ + g_variant_builder_init (&config, G_VARIANT_TYPE_VARDICT); +-- +2.43.0 + diff --git a/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch b/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch new file mode 100644 index 0000000..d0a3624 --- /dev/null +++ b/SOURCES/0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch @@ -0,0 +1,67 @@ +From 8ceb901719acac3778e1d76779d9c14289185157 Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Sat, 13 Jan 2024 18:10:02 +0100 +Subject: [PATCH 4/5] service: fix wrong refcounting in D-Bus handler for + Callback() + +The Callback() D-Bus method is handled via a GDBus-generated skeleton +code in nm-libreswan-helper-service-dbus.c, function +_nmdbus_libreswan_helper_skeleton_handle_method_call(). The function +emits signal "handle-callback" to let the program handle the incoming +method. As documented in the GDoc comments, the signal handler must +return TRUE if it handles the call. + +``` + /** + * NMDBusLibreswanHelper::handle-callback: + * @object: A #NMDBusLibreswanHelper. + * @invocation: A #GDBusMethodInvocation. + * @arg_environment: Argument passed by remote caller. + + * Signal emitted when a remote caller is invoking the Callback() + D-Bus method. + + * If a signal handler returns %TRUE, it means the signal handler + will handle the invocation (e.g. take a reference to @invocation + and eventually call nmdbus_libreswan_helper_complete_callback() + or e.g. g_dbus_method_invocation_return_error() on it) and no + other signal handlers will run. If no signal handler handles the + invocation, the %G_DBUS_ERROR_UNKNOWN_METHOD error is returned. + + * Returns: %G_DBUS_METHOD_INVOCATION_HANDLED or %TRUE if the + invocation was handled, %G_DBUS_METHOD_INVOCATION_UNHANDLED or + %FALSE to let other signal handlers run. + */ +``` + +At the moment, in case of error the handler first calls +nmdbus_libreswan_helper_complete_callback() which decreases the +refcount of "invocation", and then returns FALSE which tells the +skeleton code to return an error, also unreferencing the +invocation. This causes a crash. + +Since the G_DBUS_METHOD_INVOCATION_HANDLED alias for TRUE is only +available since GLib 2.68 (while we target 2.36), just return TRUE. + +Fixes: acb9eb9de50b ('service: process the configuration in the service, not the helper') +--- + src/nm-libreswan-service.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 12cf6f2..0d5c4b8 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -1417,7 +1417,8 @@ out: + } + + nmdbus_libreswan_helper_complete_callback (object, invocation); +- return success; ++ ++ return TRUE; + } + + /****************************************************************/ +-- +2.43.0 + diff --git a/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch b/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch new file mode 100644 index 0000000..d54e26b --- /dev/null +++ b/SOURCES/0005-service-properties-support-type-hostaddrfamily-clien.patch @@ -0,0 +1,91 @@ +From b4ba2add64bd9d362fe2e66748f23449f072216b Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Mon, 15 Jan 2024 13:23:45 +0100 +Subject: [PATCH 5/5] service,properties: support type, hostaddrfamily, + clientaddrfamily + +Add support for: + - type + - hostaddrfamily + - clientaddrfamily + +Since those are very advanced options, don't implement the GUI part +for now. +--- + properties/nm-libreswan-editor-plugin.c | 6 ++++++ + shared/nm-service-defines.h | 3 +++ + shared/utils.c | 12 ++++++++++++ + src/nm-libreswan-service.c | 3 +++ + 4 files changed, 24 insertions(+) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index 89243cc..fe85c81 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -206,6 +206,12 @@ import_from_file (NMVpnEditorPlugin *self, + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_IPSEC_INTERFACE, &str[16]); + else if (g_str_has_prefix (str, "authby=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY, &str[7]); ++ else if (g_str_has_prefix (str, "type=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE, str + NM_STRLEN("type=")); ++ else if (g_str_has_prefix (str, "hostaddrfamily=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY, str + NM_STRLEN("hostaddrfamily=")); ++ else if (g_str_has_prefix (str, "clientaddrfamily=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, str + NM_STRLEN("clientaddrfamily=")); + else if (g_str_has_prefix (str, "rightsubnet=")) { + if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 14170ad..95e19d4 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -68,6 +68,9 @@ + #define NM_LIBRESWAN_KEY_FRAGMENTATION "fragmentation" + #define NM_LIBRESWAN_KEY_MOBIKE "mobike" + #define NM_LIBRESWAN_KEY_IPSEC_INTERFACE "ipsec-interface" ++#define NM_LIBRESWAN_KEY_TYPE "type" ++#define NM_LIBRESWAN_KEY_HOSTADDRFAMILY "hostaddrfamily" ++#define NM_LIBRESWAN_KEY_CLIENTADDRFAMILY "clientaddrfamily" + + #define NM_LIBRESWAN_IKEV2_NO "no" + #define NM_LIBRESWAN_IKEV2_NEVER "never" +diff --git a/shared/utils.c b/shared/utils.c +index 0bac9e6..9e616f8 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -325,6 +325,18 @@ nm_libreswan_config_write (gint fd, + if (item && strlen (item)) + WRITE_CHECK (fd, debug_write_fcn, error, " ipsec-interface=%s", item); + ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_TYPE); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " type=%s", item); ++ ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_HOSTADDRFAMILY); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " hostaddrfamily=%s", item); ++ ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_CLIENTADDRFAMILY); ++ if (item && strlen (item)) ++ WRITE_CHECK (fd, debug_write_fcn, error, " clientaddrfamily=%s", item); ++ + WRITE_CHECK (fd, debug_write_fcn, error, " nm-configured=yes"); + + WRITE_CHECK_NEWLINE (fd, trailing_newline, debug_write_fcn, error, " auto=add"); +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 0d5c4b8..7e96230 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -277,6 +277,9 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_FRAGMENTATION, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_MOBIKE, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_IPSEC_INTERFACE, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_TYPE, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_HOSTADDRFAMILY, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_CLIENTADDRFAMILY, G_TYPE_STRING, 0, 0 }, + /* Ignored option for internal use */ + { NM_LIBRESWAN_KEY_PSK_INPUT_MODES, G_TYPE_NONE, 0, 0 }, + { NM_LIBRESWAN_KEY_XAUTH_PASSWORD_INPUT_MODES, G_TYPE_NONE, 0, 0 }, +-- +2.43.0 + diff --git a/SOURCES/0006-add-support-leftsubnet.patch b/SOURCES/0006-add-support-leftsubnet.patch new file mode 100644 index 0000000..d8310c1 --- /dev/null +++ b/SOURCES/0006-add-support-leftsubnet.patch @@ -0,0 +1,71 @@ +From 2045cdf3dec79ae7d7b03ca7a081b8c444e242ef Mon Sep 17 00:00:00 2001 +From: Beniamino Galvani +Date: Wed, 10 Apr 2024 13:23:56 +0200 +Subject: [PATCH] service,properties: support "leftsubnet" + +https://gitlab.gnome.org/GNOME/NetworkManager-libreswan/-/merge_requests/30 +--- + properties/nm-libreswan-dialog.ui | 42 ++++++++++++++++++++----- + properties/nm-libreswan-editor-plugin.c | 2 ++ + properties/nm-libreswan-editor.c | 12 +++++++ + shared/nm-service-defines.h | 1 + + shared/utils.c | 5 +++ + src/nm-libreswan-service.c | 1 + + 6 files changed, 56 insertions(+), 7 deletions(-) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index fe85c81..bb1685d 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -215,6 +215,8 @@ import_from_file (NMVpnEditorPlugin *self, + else if (g_str_has_prefix (str, "rightsubnet=")) { + if (!g_str_has_prefix (str, "rightsubnet=0.0.0.0/0")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_REMOTENETWORK, &str[12]); ++ } else if (g_str_has_prefix (str, "leftsubnet=")) { ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK, str + NM_STRLEN("leftsubnet=")); + } else if (g_str_has_prefix (str, "leftrsasigkey=")) { + if (str[14] != '%') + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY, &str[14]); +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 95e19d4..96e5c71 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -62,6 +62,7 @@ + #define NM_LIBRESWAN_KEY_SALIFETIME "salifetime" + #define NM_LIBRESWAN_KEY_VENDOR "vendor" + #define NM_LIBRESWAN_KEY_REMOTENETWORK "rightsubnet" ++#define NM_LIBRESWAN_KEY_LOCALNETWORK "leftsubnet" + #define NM_LIBRESWAN_KEY_IKEV2 "ikev2" + #define NM_LIBRESWAN_KEY_NARROWING "narrowing" + #define NM_LIBRESWAN_KEY_REKEY "rekey" +diff --git a/shared/utils.c b/shared/utils.c +index 9e616f8..926d12d 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -222,6 +222,11 @@ nm_libreswan_config_write (gint fd, + WRITE_CHECK (fd, debug_write_fcn, error, " rightsubnet=%s", + remote_network); + ++ item = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LOCALNETWORK); ++ if (item) { ++ WRITE_CHECK (fd, debug_write_fcn, error, " leftsubnet=%s", item); ++ } ++ + if (!is_ikev2) { + /* When IKEv1 is in place, we enforce XAUTH: so, use IKE version + * also to check if XAUTH conf options should be passed to Libreswan. +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 7e96230..88c07d7 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -271,6 +271,7 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_SALIFETIME, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_VENDOR, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_REMOTENETWORK, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_LOCALNETWORK, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_IKEV2, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_NARROWING, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_REKEY, G_TYPE_STRING, 0, 0 }, +-- +2.44.0 + diff --git a/SOURCES/0007-add-rightcert-property.patch b/SOURCES/0007-add-rightcert-property.patch new file mode 100644 index 0000000..6c4e8dc --- /dev/null +++ b/SOURCES/0007-add-rightcert-property.patch @@ -0,0 +1,107 @@ +0001-properties-service-suppor-rightcert-configuration.patch +0002-properties-add-Remote-certificate-field-to-the-dialo.patch +From a980e399694c0a9887d98f1e0f0f24a201cb29c7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= +Date: Mon, 15 Apr 2024 10:42:08 +0200 +Subject: [PATCH 1/2] properties, service: suppor rightcert configuration + +This configuration allows to specify a certificate from the NSS database +to identify the remote, instead of pulling it. + +(cherry picked from commit 2684233fd1c65c221d1f18c9d5b779c616c6d091) +--- + properties/nm-libreswan-editor-plugin.c | 2 ++ + shared/nm-service-defines.h | 1 + + shared/utils.c | 7 +++++++ + src/nm-libreswan-service.c | 8 ++++++-- + 4 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c +index bb1685d..fe473d1 100644 +--- a/properties/nm-libreswan-editor-plugin.c ++++ b/properties/nm-libreswan-editor-plugin.c +@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); + else if (g_str_has_prefix (str, "leftcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); ++ else if (g_str_has_prefix (str, "rightcert=")) ++ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]); + else if (nm_streq0 (str, "leftmodecfgclient=no")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); + else if (g_str_has_prefix (str, "pfs=no")) +diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h +index 96e5c71..167b837 100644 +--- a/shared/nm-service-defines.h ++++ b/shared/nm-service-defines.h +@@ -37,6 +37,7 @@ + #define NM_LIBRESWAN_KEY_RIGHT "right" + #define NM_LIBRESWAN_KEY_RIGHTID "rightid" + #define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey" ++#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert" + #define NM_LIBRESWAN_KEY_LEFT "left" + #define NM_LIBRESWAN_KEY_LEFTID "leftid" + #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" +diff --git a/shared/utils.c b/shared/utils.c +index 926d12d..5e19316 100644 +--- a/shared/utils.c ++++ b/shared/utils.c +@@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd, + const char *left; + const char *leftid; + const char *leftcert; ++ const char *rightcert; + const char *leftrsasigkey; + const char *rightrsasigkey; + const char *authby; +@@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd, + leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); + rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); + leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT); ++ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); + authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY); ++ if (rightcert && strlen (rightcert)) { ++ WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert); ++ if (!rightrsasigkey) ++ rightrsasigkey = "%cert"; ++ } + if (leftcert && strlen (leftcert)) { + WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert); + if (!leftrsasigkey) +diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c +index 88c07d7..516eaac 100644 +--- a/src/nm-libreswan-service.c ++++ b/src/nm-libreswan-service.c +@@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = { + { NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 }, ++ { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 }, +@@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin, + NMSettingVpn *s_vpn; + const char *leftcert; + const char *leftrsasigkey; ++ const char *rightcert; + const char *rightrsasigkey; + const char *pw_type; + +@@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin, + if (leftcert) + goto xauth_check; + +- /* If authentication is done through rsasigkeys, only the public keys are required */ ++ /* If authentication is done through rsasigkeys, only the public keys are required. ++ * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */ + leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); + rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); +- if (leftrsasigkey && rightrsasigkey) ++ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); ++ if (leftrsasigkey && (rightrsasigkey || rightcert)) + goto xauth_check; + + pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES); +-- +2.44.0 + diff --git a/SPECS/NetworkManager-libreswan.spec b/SPECS/NetworkManager-libreswan.spec index 9a0e08c..8f2a72d 100644 --- a/SPECS/NetworkManager-libreswan.spec +++ b/SPECS/NetworkManager-libreswan.spec @@ -3,9 +3,14 @@ %else %bcond_with libnm_glib %endif +%if 0%{?fedora} < 36 && 0%{?rhel} < 10 +%bcond_with gtk4 +%else +%bcond_without gtk4 +%endif -%global real_version 1.2.14 -%global rpm_version 1.2.14 +%global real_version 1.2.18 +%global rpm_version 1.2.18 %global release_version 3 %global real_version_major %(printf '%s' '%{real_version}' | sed -n 's/^\\([1-9][0-9]*\\.[1-9][0-9]*\\)\\.[1-9][0-9]*$/\\1/p') @@ -22,8 +27,13 @@ License: GPLv2+ URL: http://www.gnome.org/projects/NetworkManager/ Source0: https://download.gnome.org/sources/NetworkManager-libreswan/%{real_version_major}/%{name}-%{real_version}.tar.xz -Patch1: 0001-add-dpd-authby-and-ipsec-interface-support.patch -Patch2: 0002-support-missing-features-ipv4.patch +Patch1: 0001-service-properties-add-support-for-leftmodecfgclient.patch +Patch2: 0002-service-use-new-API-to-send-configuration-to-NM.patch +Patch3: 0003-service-don-t-send-IPv4-config-if-mode-config-client.patch +Patch4: 0004-service-fix-wrong-refcounting-in-D-Bus-handler-for-C.patch +Patch5: 0005-service-properties-support-type-hostaddrfamily-clien.patch +Patch6: 0006-add-support-leftsubnet.patch +Patch7: 0007-add-rightcert-property.patch BuildRequires: make BuildRequires: gcc @@ -40,6 +50,10 @@ BuildRequires: NetworkManager-glib-devel >= %{nm_version} BuildRequires: libnm-gtk-devel >= %{nma_version} %endif +%if %with gtk4 +BuildRequires: libnma-gtk4-devel +%endif + Requires: NetworkManager >= %{nm_version} Requires: dbus Requires: /usr/sbin/ipsec @@ -78,6 +92,9 @@ the libreswan server with NetworkManager (GNOME files). %build %configure \ --disable-static \ +%if %with gtk4 + --with-gtk4 \ +%endif %if %without libnm_glib --without-libnm-glib \ %endif @@ -99,31 +116,36 @@ rm -f %{buildroot}%{_libdir}/NetworkManager/lib*.la %{_libexecdir}/nm-libreswan-service %{_libexecdir}/nm-libreswan-service-helper %{_mandir}/man5/nm-settings-libreswan.5.gz -%doc AUTHORS ChangeLog NEWS +%doc AUTHORS NEWS %license COPYING %files -n NetworkManager-libreswan-gnome %{_libexecdir}/nm-libreswan-auth-dialog %{_libdir}/NetworkManager/libnm-vpn-plugin-libreswan-editor.so -%dir %{_datadir}/gnome-vpn-properties/libreswan -%{_datadir}/gnome-vpn-properties/libreswan/nm-libreswan-dialog.ui -%{_datadir}/appdata/network-manager-libreswan.metainfo.xml +%{_metainfodir}/network-manager-libreswan.metainfo.xml %if %with libnm_glib %{_libdir}/NetworkManager/libnm-*-properties.so %{_sysconfdir}/NetworkManager/VPN/nm-libreswan-service.name %endif +%if %with gtk4 +%{_libdir}/NetworkManager/libnm-gtk4-vpn-plugin-libreswan-editor.so +%endif %changelog -* Wed Jan 17 2024 Fernando Fernandez Mancera - 1.2.14-3 -- Support point-to-point IPSec tunnel (RHEL-20952) -- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-20952) -- Support configuring IPSec mode with 'type' (RHEL-20952) +* Tue May 07 2024 Fernando Fernandez Mancera - 1.2.18-3 +- Support leftsubnet property (RHEL-33376) +- Support rightcert property (RHEL-33372) + +* Wed Jan 17 2024 Fernando Fernandez Mancera - 1.2.18-2 +- Support point-to-point IPSec tunnel (RHEL-20690) +- Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221) +- Support configuring IPSec mode with 'type' (RHEL-21554) -* Mon Dec 18 2023 Fernando Fernandez Mancera - 1.2.14-2 -- Add DPD, ipsec-interface and authby support. RHEL-19225 +* Fri Dec 15 2023 Fernando Fernandez Mancera - 1.2.18-1 +- Update to 1.2.18 release * Mon Aug 09 2021 Mohan Boddu - 1.2.14-1.3 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags