0001-properties-service-suppor-rightcert-configuration.patch 0002-properties-add-Remote-certificate-field-to-the-dialo.patch From a980e399694c0a9887d98f1e0f0f24a201cb29c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= Date: Mon, 15 Apr 2024 10:42:08 +0200 Subject: [PATCH 1/2] properties, service: suppor rightcert configuration This configuration allows to specify a certificate from the NSS database to identify the remote, instead of pulling it. (cherry picked from commit 2684233fd1c65c221d1f18c9d5b779c616c6d091) --- properties/nm-libreswan-editor-plugin.c | 2 ++ shared/nm-service-defines.h | 1 + shared/utils.c | 7 +++++++ src/nm-libreswan-service.c | 8 ++++++-- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c index bb1685d..fe473d1 100644 --- a/properties/nm-libreswan-editor-plugin.c +++ b/properties/nm-libreswan-editor-plugin.c @@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self, nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]); else if (g_str_has_prefix (str, "leftcert=")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]); + else if (g_str_has_prefix (str, "rightcert=")) + nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]); else if (nm_streq0 (str, "leftmodecfgclient=no")) nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no"); else if (g_str_has_prefix (str, "pfs=no")) diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h index 96e5c71..167b837 100644 --- a/shared/nm-service-defines.h +++ b/shared/nm-service-defines.h @@ -37,6 +37,7 @@ #define NM_LIBRESWAN_KEY_RIGHT "right" #define NM_LIBRESWAN_KEY_RIGHTID "rightid" #define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey" +#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert" #define NM_LIBRESWAN_KEY_LEFT "left" #define NM_LIBRESWAN_KEY_LEFTID "leftid" #define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey" diff --git a/shared/utils.c b/shared/utils.c index 926d12d..5e19316 100644 --- a/shared/utils.c +++ b/shared/utils.c @@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd, const char *left; const char *leftid; const char *leftcert; + const char *rightcert; const char *leftrsasigkey; const char *rightrsasigkey; const char *authby; @@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd, leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT); + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY); + if (rightcert && strlen (rightcert)) { + WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert); + if (!rightrsasigkey) + rightrsasigkey = "%cert"; + } if (leftcert && strlen (leftcert)) { WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert); if (!leftrsasigkey) diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c index 88c07d7..516eaac 100644 --- a/src/nm-libreswan-service.c +++ b/src/nm-libreswan-service.c @@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = { { NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 }, + { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 }, { NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 }, @@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin, NMSettingVpn *s_vpn; const char *leftcert; const char *leftrsasigkey; + const char *rightcert; const char *rightrsasigkey; const char *pw_type; @@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin, if (leftcert) goto xauth_check; - /* If authentication is done through rsasigkeys, only the public keys are required */ + /* If authentication is done through rsasigkeys, only the public keys are required. + * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */ leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY); rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY); - if (leftrsasigkey && rightrsasigkey) + rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT); + if (leftrsasigkey && (rightrsasigkey || rightcert)) goto xauth_check; pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES); -- 2.44.0