You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
108 lines
5.0 KiB
108 lines
5.0 KiB
0001-properties-service-suppor-rightcert-configuration.patch
|
|
0002-properties-add-Remote-certificate-field-to-the-dialo.patch
|
|
From a980e399694c0a9887d98f1e0f0f24a201cb29c7 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
|
|
Date: Mon, 15 Apr 2024 10:42:08 +0200
|
|
Subject: [PATCH 1/2] properties, service: suppor rightcert configuration
|
|
|
|
This configuration allows to specify a certificate from the NSS database
|
|
to identify the remote, instead of pulling it.
|
|
|
|
(cherry picked from commit 2684233fd1c65c221d1f18c9d5b779c616c6d091)
|
|
---
|
|
properties/nm-libreswan-editor-plugin.c | 2 ++
|
|
shared/nm-service-defines.h | 1 +
|
|
shared/utils.c | 7 +++++++
|
|
src/nm-libreswan-service.c | 8 ++++++--
|
|
4 files changed, 16 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
|
|
index bb1685d..fe473d1 100644
|
|
--- a/properties/nm-libreswan-editor-plugin.c
|
|
+++ b/properties/nm-libreswan-editor-plugin.c
|
|
@@ -182,6 +182,8 @@ import_from_file (NMVpnEditorPlugin *self,
|
|
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTUSERNAME, &str[13]);
|
|
else if (g_str_has_prefix (str, "leftcert="))
|
|
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT, &str[9]);
|
|
+ else if (g_str_has_prefix (str, "rightcert="))
|
|
+ nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT, &str[10]);
|
|
else if (nm_streq0 (str, "leftmodecfgclient=no"))
|
|
nm_setting_vpn_add_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTMODECFGCLIENT, "no");
|
|
else if (g_str_has_prefix (str, "pfs=no"))
|
|
diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
|
|
index 96e5c71..167b837 100644
|
|
--- a/shared/nm-service-defines.h
|
|
+++ b/shared/nm-service-defines.h
|
|
@@ -37,6 +37,7 @@
|
|
#define NM_LIBRESWAN_KEY_RIGHT "right"
|
|
#define NM_LIBRESWAN_KEY_RIGHTID "rightid"
|
|
#define NM_LIBRESWAN_KEY_RIGHTRSASIGKEY "rightrsasigkey"
|
|
+#define NM_LIBRESWAN_KEY_RIGHTCERT "rightcert"
|
|
#define NM_LIBRESWAN_KEY_LEFT "left"
|
|
#define NM_LIBRESWAN_KEY_LEFTID "leftid"
|
|
#define NM_LIBRESWAN_KEY_LEFTRSASIGKEY "leftrsasigkey"
|
|
diff --git a/shared/utils.c b/shared/utils.c
|
|
index 926d12d..5e19316 100644
|
|
--- a/shared/utils.c
|
|
+++ b/shared/utils.c
|
|
@@ -108,6 +108,7 @@ nm_libreswan_config_write (gint fd,
|
|
const char *left;
|
|
const char *leftid;
|
|
const char *leftcert;
|
|
+ const char *rightcert;
|
|
const char *leftrsasigkey;
|
|
const char *rightrsasigkey;
|
|
const char *authby;
|
|
@@ -165,7 +166,13 @@ nm_libreswan_config_write (gint fd,
|
|
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
|
|
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
|
|
leftcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTCERT);
|
|
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
|
|
authby = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_AUTHBY);
|
|
+ if (rightcert && strlen (rightcert)) {
|
|
+ WRITE_CHECK (fd, debug_write_fcn, error, " rightcert=%s", rightcert);
|
|
+ if (!rightrsasigkey)
|
|
+ rightrsasigkey = "%cert";
|
|
+ }
|
|
if (leftcert && strlen (leftcert)) {
|
|
WRITE_CHECK (fd, debug_write_fcn, error, " leftcert=%s", leftcert);
|
|
if (!leftrsasigkey)
|
|
diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
|
|
index 88c07d7..516eaac 100644
|
|
--- a/src/nm-libreswan-service.c
|
|
+++ b/src/nm-libreswan-service.c
|
|
@@ -250,6 +250,7 @@ static ValidProperty valid_properties[] = {
|
|
{ NM_LIBRESWAN_KEY_RIGHT, G_TYPE_STRING, 0, 0 },
|
|
{ NM_LIBRESWAN_KEY_RIGHTID, G_TYPE_STRING, 0, 0 },
|
|
{ NM_LIBRESWAN_KEY_RIGHTRSASIGKEY, G_TYPE_STRING, 0, 0 },
|
|
+ { NM_LIBRESWAN_KEY_RIGHTCERT, G_TYPE_STRING, 0, 0 },
|
|
{ NM_LIBRESWAN_KEY_LEFT, G_TYPE_STRING, 0, 0 },
|
|
{ NM_LIBRESWAN_KEY_LEFTID, G_TYPE_STRING, 0, 0 },
|
|
{ NM_LIBRESWAN_KEY_LEFTXAUTHUSER, G_TYPE_STRING, 0, 0 },
|
|
@@ -1801,6 +1802,7 @@ real_need_secrets (NMVpnServicePlugin *plugin,
|
|
NMSettingVpn *s_vpn;
|
|
const char *leftcert;
|
|
const char *leftrsasigkey;
|
|
+ const char *rightcert;
|
|
const char *rightrsasigkey;
|
|
const char *pw_type;
|
|
|
|
@@ -1821,10 +1823,12 @@ real_need_secrets (NMVpnServicePlugin *plugin,
|
|
if (leftcert)
|
|
goto xauth_check;
|
|
|
|
- /* If authentication is done through rsasigkeys, only the public keys are required */
|
|
+ /* If authentication is done through rsasigkeys, only the public keys are required.
|
|
+ * If rightcert is specified, rightrsasigkey is assumed to be '%cert' */
|
|
leftrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_LEFTRSASIGKEY);
|
|
rightrsasigkey = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTRSASIGKEY);
|
|
- if (leftrsasigkey && rightrsasigkey)
|
|
+ rightcert = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_RIGHTCERT);
|
|
+ if (leftrsasigkey && (rightrsasigkey || rightcert))
|
|
goto xauth_check;
|
|
|
|
pw_type = nm_setting_vpn_get_data_item (s_vpn, NM_LIBRESWAN_KEY_PSK_INPUT_MODES);
|
|
--
|
|
2.44.0
|
|
|