Differential D27764 Diff 76731 vpn/l2tp/l2tpipsecwidget.cpp

Changeset View

Standalone View

View Options

vpn/l2tp/l2tpipsecwidget.cpp

1/* 1​/*
2 Copyright 2013 Jan Grulich <jgrulich@redhat.com> 2​ Copyright 2013 Jan Grulich <jgrulich@redhat.com>
3​ Copyright 2020 Douglas Kosovic <doug@uq.edu.au>
3 4​
4 This library is free software; you can redistribute it and/or 5​ This library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public 6​ modify it under the terms of the GNU Lesser General Public
Context not available.
18 License along with this library. If not, see <http://www.gnu.org/licenses/>. 19​ License along with this library. If not, see <http://www.gnu.org/licenses/>.
19*/ 20​*/
20 21​
22​#include <QProcess>
23​#include <QStandardPaths>
21#include "l2tpipsecwidget.h" 24​#include "l2tpipsecwidget.h"
22#include "ui_l2tpipsec.h" 25​#include "ui_l2tpipsec.h"
23#include "nm-l2tp-service.h" 26​#include "nm-l2tp-service.h"
Context not available.
25#include <KLocalizedString> 28​#include <KLocalizedString>
26#include <KAcceleratorManager> 29​#include <KAcceleratorManager>
27 30​
31​#define DEFAULT_IPSEC_STRONGSWAN_IKELIFETIME_HOURS 3
32​#define DEFAULT_IPSEC_STRONGSWAN_LIFETIME_HOURS 1
33​
34​#define DEFAULT_IPSEC_LIBRESWAN_IKELIFETIME_HOURS 1
35​#define DEFAULT_IPSEC_LIBRESWAN_SALIFETIME_HOURS 8
36​
28L2tpIpsecWidget::L2tpIpsecWidget(const NetworkManager::VpnSetting::Ptr &setting, QWidget *parent) 37​L2tpIpsecWidget::L2tpIpsecWidget(const NetworkManager::VpnSetting::Ptr &setting, QWidget *parent)
29 : QDialog(parent) 38​ : QDialog(parent)
30 , m_ui(new Ui::L2tpIpsecWidget) 39​ , m_ui(new Ui::L2tpIpsecWidget)
31{ 40​{
32 m_ui->setupUi(this); 41​ m_ui->setupUi(this);
42​ m_ui->machineKeyPassword->setPasswordOptionsEnabled(true);
43​ m_ui->machineKeyPassword->setPasswordNotRequiredEnabled(true);
44​
45​ // use requesters' urlSelected signals to set other requester's startDirs to save clicking
46​ // around the filesystem, also if it is a .p12 file, set the other URLs to that .p12 file.
47​ QList<const KUrlRequester *> requesters;
48​ requesters << m_ui->machineCA << m_ui->machineCert << m_ui->machineKey;
49​ for (const KUrlRequester *requester : requesters) {
50​ connect(requester, &KUrlRequester::urlSelected, this, &L2tpIpsecWidget::updateStartDirUrl);
51​ }
52​
53​ connect(m_ui->cbIkelifetime, &QCheckBox::toggled, this, &L2tpIpsecWidget::setDefaultIkelifetime);
54​ connect(m_ui->cbSalifetime, &QCheckBox::toggled, this, &L2tpIpsecWidget::setDefaultSalifetime);
55​ connect(m_ui->cmbAuthType, QOverload<int>::of(&QComboBox::currentIndexChanged), this, &L2tpIpsecWidget::resizeStackedWidget);
33 56​
34 setWindowTitle(i18n("L2TP IPsec Options")); 57​ setWindowTitle(i18n("L2TP IPsec Options"));
35 58​
36 KAcceleratorManager::manage(this); 59​ KAcceleratorManager::manage(this);
37 60​
38 loadConfig(setting); 61​ loadConfig(setting);
62​
63​ resizeStackedWidget(m_ui->cmbAuthType->currentIndex());
39} 64​}
40 65​
41L2tpIpsecWidget::~L2tpIpsecWidget() 66​L2tpIpsecWidget::~L2tpIpsecWidget()
Context not available.
45 70​
46void L2tpIpsecWidget::loadConfig(const NetworkManager::VpnSetting::Ptr &setting) 71​void L2tpIpsecWidget::loadConfig(const NetworkManager::VpnSetting::Ptr &setting)
47{ 72​{
48 if (setting->data().value(NM_L2TP_KEY_IPSEC_ENABLE) == "yes") { 73​ const QString yesString = QLatin1String("yes");
49 m_ui->cbEnableTunnelToHost->setChecked(true); 74​ const QString noString = QLatin1String("no");
50 m_ui->gatewayId->setText(setting->data().value(NM_L2TP_KEY_IPSEC_GATEWAY_ID)); 75​
51 m_ui->presharedKey->setText(setting->data().value(NM_L2TP_KEY_IPSEC_PSK)); 76​ // General settings
52 m_ui->ike->setText(setting->data().value(NM_L2TP_KEY_IPSEC_IKE)); 77​ const NMStringMap dataMap = setting->data();
53 m_ui->esp->setText(setting->data().value(NM_L2TP_KEY_IPSEC_ESP)); 78​
54 if (setting->data().value(NM_L2TP_KEY_IPSEC_FORCEENCAPS) == "yes" ) { 79​ if (!hasIpsecDaemon()) {
80​ m_ui->gbEnableTunnelToHost->setChecked(false);
81​ m_ui->gbEnableTunnelToHost->setDisabled(true);
82​ } else if (dataMap[NM_L2TP_KEY_IPSEC_ENABLE] == yesString) {
83​ m_ui->gbEnableTunnelToHost->setChecked(true);
84​
85​ if (dataMap[NM_L2TP_KEY_MACHINE_AUTH_TYPE].isEmpty()
86​ || dataMap[NM_L2TP_KEY_MACHINE_AUTH_TYPE] == QLatin1String(NM_L2TP_AUTHTYPE_PSK)) {
87​ m_ui->cmbAuthType->setCurrentIndex(AuthType::PSK);
88​ m_ui->stackedWidget->setCurrentIndex(AuthType::PSK);
89​
90​ // *SWAN support Base64 encoded PSKs that are prefixed with "0s"
91​ QString psk = dataMap[NM_L2TP_KEY_IPSEC_PSK];
92​ if (psk.length() > 2 && psk.startsWith(QLatin1String("0s"))) {
93​ m_ui->presharedKey->setText(QByteArray::fromBase64(psk.mid(2).toUtf8()));
94​ } else {
95​ m_ui->presharedKey->setText(psk);
96​ }
97​
98​ } else { // NM_L2TP_AUTHTYPE_TLS
99​ m_ui->cmbAuthType->setCurrentIndex(AuthType::TLS);
100​ m_ui->stackedWidget->setCurrentIndex(AuthType::TLS);
101​
102​ m_ui->machineCA->setUrl(QUrl::fromLocalFile(dataMap[NM_L2TP_KEY_MACHINE_CA]));
103​ m_ui->machineCert->setUrl(QUrl::fromLocalFile(dataMap[NM_L2TP_KEY_MACHINE_CERT]));
104​ m_ui->machineKey->setUrl(QUrl::fromLocalFile(dataMap[NM_L2TP_KEY_MACHINE_KEY]));
105​
106​ const NetworkManager::Setting::SecretFlags machineKeyPassType = static_cast<NetworkManager::Setting::SecretFlags>(dataMap[NM_L2TP_KEY_MACHINE_CERTPASS"-flags"].toInt());
107​ if (machineKeyPassType.testFlag(NetworkManager::Setting::None)) {
108​ m_ui->machineKeyPassword->setPasswordOption(PasswordField::StoreForAllUsers);
109​ } else if (machineKeyPassType.testFlag(NetworkManager::Setting::AgentOwned)) {
110​ m_ui->machineKeyPassword->setPasswordOption(PasswordField::StoreForUser);
111​ } else if (machineKeyPassType.testFlag(NetworkManager::Setting::NotSaved)) {
112​ m_ui->machineKeyPassword->setPasswordOption(PasswordField::AlwaysAsk);
113​ } else if (machineKeyPassType.testFlag(NetworkManager::Setting::NotRequired)) {
114​ m_ui->machineKeyPassword->setPasswordOption(PasswordField::NotRequired);
115​ }
116​ }
117​
118​ if (!dataMap[NM_L2TP_KEY_IPSEC_GATEWAY_ID].isEmpty()) {
119​ m_ui->remoteId->setText(dataMap[NM_L2TP_KEY_IPSEC_GATEWAY_ID]);
120​ } else {
121​ m_ui->remoteId->setText(dataMap[NM_L2TP_KEY_IPSEC_REMOTE_ID]);
122​ }
123​ m_ui->ike->setText(dataMap[NM_L2TP_KEY_IPSEC_IKE]);
124​ m_ui->esp->setText(dataMap[NM_L2TP_KEY_IPSEC_ESP]);
125​
126​ if (!dataMap[NM_L2TP_KEY_IPSEC_IKELIFETIME].isEmpty()) {
127​ int totalSeconds = dataMap[NM_L2TP_KEY_IPSEC_IKELIFETIME].toInt();
jgrulichUnsubmitted
Not Done

const? Same for variables below.

jgrulich: const? Same for variables below.
128​ int hours = totalSeconds / 3600;
129​ int minutes = (totalSeconds % 3600) / 60;
130​ int seconds = totalSeconds % 60;
131​ QTime lifetime = QTime(hours, minutes, seconds);
132​
133​ m_ui->ikelifetime->setTime(lifetime);
jgrulichUnsubmitted
Not Done

Missing indentation.

jgrulich: Missing indentation.
134​ m_ui->ikelifetime->setEnabled(true);
135​ m_ui->cbIkelifetime->setChecked(true);
136​ } else {
137​ setDefaultIkelifetime(false);
138​ m_ui->ikelifetime->setEnabled(false);
139​ m_ui->cbIkelifetime->setChecked(false);
140​ }
141​
142​ if (!dataMap[NM_L2TP_KEY_IPSEC_SALIFETIME].isEmpty()) {
143​ int totalSeconds = dataMap[NM_L2TP_KEY_IPSEC_SALIFETIME].toInt();
jgrulichUnsubmitted
Not Done

const? Same for variables below.

jgrulich: const? Same for variables below.
144​ int hours = totalSeconds / 3600;
145​ int minutes = (totalSeconds % 3600) / 60;
146​ int seconds = totalSeconds % 60;
147​ QTime lifetime = QTime(hours, minutes, seconds);
148​
149​ m_ui->salifetime->setTime(lifetime);
150​ m_ui->salifetime->setEnabled(true);
151​ m_ui->cbSalifetime->setChecked(true);
152​ } else {
153​ setDefaultSalifetime(false);
154​ m_ui->salifetime->setEnabled(false);
155​ m_ui->cbSalifetime->setChecked(false);
156​ }
157​
158​ if (dataMap[NM_L2TP_KEY_IPSEC_FORCEENCAPS] == yesString ) {
55 m_ui->cbForceEncaps->setChecked(true); 159​ m_ui->cbForceEncaps->setChecked(true);
56 } else { 160​ } else {
57 m_ui->cbForceEncaps->setChecked(false); 161​ m_ui->cbForceEncaps->setChecked(false);
58 } 162​ }
163​ if (dataMap[NM_L2TP_KEY_IPSEC_IPCOMP] == yesString ) {
164​ m_ui->cbIPComp->setChecked(true);
165​ } else {
166​ m_ui->cbIPComp->setChecked(false);
167​ }
168​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan) {
169​ if (dataMap[NM_L2TP_KEY_IPSEC_PFS] == noString ) {
170​ m_ui->cbPFS->setChecked(true);
jgrulichUnsubmitted
Not Done

This can be simplified using:

m_ui->cbIPComp->setChecked(dataMap[NM_L2TP_KEY_IPSEC_IPCOMP] == yesString)

Same above.

jgrulich: This can be simplified using: ``` m_ui->cbIPComp->setChecked(dataMap[NM_L2TP_KEY_IPSEC_IPCOMP]…
171​ } else {
172​ m_ui->cbPFS->setChecked(false);
173​ }
174​ } else {
175​ m_ui->cbPFS->setChecked(false);
176​ m_ui->cbPFS->setDisabled(true);
177​ m_ui->cbPFS->setToolTip("");
178​ }
59 } else { 179​ } else {
60 m_ui->cbEnableTunnelToHost->setChecked(false); 180​ m_ui->gbEnableTunnelToHost->setChecked(false);
181​ setDefaultIkelifetime(false);
182​ setDefaultSalifetime(false);
183​ if (m_ipsecDaemonType == IpsecDaemonType::Strongswan) {
184​ m_ui->cbPFS->setDisabled(true);
185​ m_ui->cbPFS->setToolTip("");
186​ }
61 } 187​ }
62} 188​}
63 189​
64NMStringMap L2tpIpsecWidget::setting() const 190​NMStringMap L2tpIpsecWidget::setting() const
65{ 191​{
66 NMStringMap result; 192​ NMStringMap result;
193​ const QString yesString = QLatin1String("yes");
194​ const QString noString = QLatin1String("no");
195​
196​ if (m_ui->gbEnableTunnelToHost->isChecked()) {
197​ result.insert(NM_L2TP_KEY_IPSEC_ENABLE, yesString);
198​
199​ if (m_ui->cmbAuthType->currentIndex() == AuthType::PSK) {
200​ // NetworkManager-l2tp < 1.2.12 does not support Base64 PSK
201​ // For backwards compatibilty don't use Base64 PSK for now.
202​ if (!m_ui->presharedKey->text().isEmpty()) {
203​ result.insert(NM_L2TP_KEY_IPSEC_PSK, m_ui->presharedKey->text());
204​ // *SWAN support Base64 encoded PSKs that are prefixed with "0s"
205​ /*
206​ QString psk = QLatin1String("0s");
207​ psk.append(m_ui->presharedKey->text().toUtf8().toBase64());
208​ result.insert(NM_L2TP_KEY_IPSEC_PSK, psk);
209​ */
210​ }
211​ } else { // AuthType::TLS
67 212​
68 if (m_ui->cbEnableTunnelToHost->isChecked()) { 213​ result.insert(NM_L2TP_KEY_MACHINE_AUTH_TYPE, NM_L2TP_AUTHTYPE_TLS);
69 result.insert(NM_L2TP_KEY_IPSEC_ENABLE, "yes"); ​
70 214​
71 if (!m_ui->gatewayId->text().isEmpty()) { 215​ result.insert(NM_L2TP_KEY_MACHINE_CA, m_ui->machineCA->url().toLocalFile());
72 result.insert(NM_L2TP_KEY_IPSEC_GATEWAY_ID, m_ui->gatewayId->text()); 216​ result.insert(NM_L2TP_KEY_MACHINE_CERT, m_ui->machineCert->url().toLocalFile());
217​ result.insert(NM_L2TP_KEY_MACHINE_KEY, m_ui->machineKey->url().toLocalFile());
218​
219​ switch (m_ui->machineKeyPassword->passwordOption()) {
220​ case PasswordField::StoreForAllUsers:
221​ result.insert(NM_L2TP_KEY_MACHINE_CERTPASS"-flags",
222​ QString::number(NetworkManager::Setting::None));
223​ break;
224​ case PasswordField::StoreForUser:
225​ result.insert(NM_L2TP_KEY_MACHINE_CERTPASS"-flags",
226​ QString::number(NetworkManager::Setting::AgentOwned));
227​ break;
228​ case PasswordField::AlwaysAsk:
229​ result.insert(NM_L2TP_KEY_MACHINE_CERTPASS"-flags",
230​ QString::number(NetworkManager::Setting::NotSaved));
231​ break;
232​ case PasswordField::NotRequired:
233​ result.insert(NM_L2TP_KEY_MACHINE_CERTPASS"-flags",
234​ QString::number(NetworkManager::Setting::NotRequired));
235​ break;
236​ };
73 } 237​ }
74 238​
75 if (!m_ui->presharedKey->text().isEmpty()) { 239​ // NetworkManager-l2tp 1.2.12 recommends NM_L2TP_KEY_IPSEC_REMOTE_ID
76 result.insert(NM_L2TP_KEY_IPSEC_PSK, m_ui->presharedKey->text()); 240​ // instead of deprecated NM_L2TP_KEY_IPSEC_GATEWAY_ID
241​ // For backwards compatibilty use NM_L2TP_KEY_IPSEC_GATEWAY_ID for now.
242​ if (!m_ui->remoteId->text().isEmpty()) {
243​ result.insert(NM_L2TP_KEY_IPSEC_GATEWAY_ID, m_ui->remoteId->text());
77 } 244​ }
78 245​
79 if (!m_ui->ike->text().isEmpty()) { 246​ if (!m_ui->ike->text().isEmpty()) {
Context not available.
85 } 252​ }
86 253​
87 if (m_ui->cbForceEncaps->isChecked()) { 254​ if (m_ui->cbForceEncaps->isChecked()) {
88 result.insert(NM_L2TP_KEY_IPSEC_FORCEENCAPS, "yes"); 255​ result.insert(NM_L2TP_KEY_IPSEC_FORCEENCAPS, yesString);
256​ }
257​
258​ if (m_ui->cbIkelifetime->isChecked()) {
259​ int totalSeconds = m_ui->ikelifetime->time().hour() * 3600 + m_ui->ikelifetime->time().minute() * 60 + m_ui->ikelifetime->time().second();
jgrulichUnsubmitted
Not Done

const?

jgrulich: const?
260​
261​ result.insert(NM_L2TP_KEY_IPSEC_IKELIFETIME, QString::number(totalSeconds));
262​ }
263​
264​ if (m_ui->cbSalifetime->isChecked()) {
265​ int totalSeconds = m_ui->salifetime->time().hour() * 3600 + m_ui->salifetime->time().minute() * 60 + m_ui->salifetime->time().second();
jgrulichUnsubmitted
Not Done

const?

jgrulich: const?
266​ result.insert(NM_L2TP_KEY_IPSEC_SALIFETIME, QString::number(totalSeconds));
267​ }
268​
269​ if (m_ui->cbIPComp->isChecked()) {
270​ result.insert(NM_L2TP_KEY_IPSEC_IPCOMP, yesString);
271​ }
272​
273​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan) {
274​ if (m_ui->cbPFS->isChecked()) {
275​ result.insert(NM_L2TP_KEY_IPSEC_PFS, noString);
276​ }
277​ }
278​ }
279​
280​ return result;
281​}
282​
283​NMStringMap L2tpIpsecWidget::secrets() const
284​{
285​ NMStringMap result;
286​
287​ if (m_ui->gbEnableTunnelToHost->isChecked()) {
288​ if (m_ui->cmbAuthType->currentIndex() == AuthType::TLS) {
289​
290​ // private key password
291​ if (!m_ui->machineKeyPassword->text().isEmpty()) {
292​ result.insert(NM_L2TP_KEY_MACHINE_CERTPASS, m_ui->machineKeyPassword->text());
293​ }
89 } 294​ }
90 } 295​ }
91 296​
92 return result; 297​ return result;
93} 298​}
299​
300​void L2tpIpsecWidget::updateStartDirUrl(const QUrl &url)
301​{
302​ QList<KUrlRequester *> requesters;
303​ requesters << m_ui->machineCA << m_ui->machineCert << m_ui->machineKey;
304​ bool isP12 = url.toString().endsWith(QLatin1String(".p12"));
jgrulichUnsubmitted
Not Done

const?

jgrulich: const?
305​
306​ for (KUrlRequester *requester : requesters) {
307​ requester->setStartDir(url.adjusted(QUrl::RemoveFilename | QUrl::StripTrailingSlash));
308​ if (isP12) {
309​ requester->setUrl(url);
310​ }
311​ }
312​}
313​
314​void L2tpIpsecWidget::setDefaultIkelifetime(bool isChecked)
315​{
316​ if (!isChecked) {
317​ QTime lifetime;
318​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan) {
319​ lifetime = QTime(DEFAULT_IPSEC_LIBRESWAN_IKELIFETIME_HOURS, 0, 0);
320​ } else {
321​ lifetime = QTime(DEFAULT_IPSEC_STRONGSWAN_IKELIFETIME_HOURS, 0, 0);
322​ }
323​ m_ui->ikelifetime->setTime(lifetime);
324​ }
325​}
326​
327​void L2tpIpsecWidget::setDefaultSalifetime(bool isChecked)
328​{
329​ if (!isChecked) {
330​ QTime lifetime;
331​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan) {
332​ lifetime = QTime(DEFAULT_IPSEC_LIBRESWAN_SALIFETIME_HOURS, 0, 0);
333​ } else {
334​ lifetime = QTime(DEFAULT_IPSEC_STRONGSWAN_LIFETIME_HOURS, 0, 0);
335​ }
336​ m_ui->salifetime->setTime(lifetime);
337​ }
338​}
339​
340​void L2tpIpsecWidget::resizeStackedWidget(int currentIndex)
341​{
342​ m_ui->stackedWidget->setCurrentIndex(currentIndex);
343​ for (int i = 0; i < m_ui->stackedWidget->count(); ++i) {
344​ QSizePolicy::Policy policy;
345​
346​ if (i == currentIndex) {
347​ policy = QSizePolicy::Preferred;
348​ } else {
349​ policy = QSizePolicy::Ignored;
350​ }
351​ m_ui->stackedWidget->widget(i)->setSizePolicy(QSizePolicy::Preferred, policy);
352​ }
353​ QApplication::processEvents(QEventLoop::ExcludeUserInputEvents);
354​ resize(width(), sizeHint().height());
355​}
356​
357​L2tpIpsecWidget::IpsecDaemonType L2tpIpsecWidget::m_ipsecDaemonType = IpsecDaemonType::NoIpsecDaemon;
358​
359​bool L2tpIpsecWidget::hasIpsecDaemon()
360​{
361​ // NetworkManager-l2tp currently only supports libreswan and strongswan
362​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan
363​ || m_ipsecDaemonType == IpsecDaemonType::Strongswan) {
364​ return true;
365​ }
366​
367​ QString ipsecBinary = QStandardPaths::findExecutable("ipsec",
368​ QStringList() << "/sbin" << "/usr/sbin");
369​
370​ // On some Linux distributions, ipsec executable has been renamed strongswan
371​ if (ipsecBinary.isEmpty()) {
372​ ipsecBinary = QStandardPaths::findExecutable("strongswan",
373​ QStringList() << "/sbin" << "/usr/sbin");
374​ }
375​
376​ if (ipsecBinary.isEmpty()) {
377​ m_ipsecDaemonType = IpsecDaemonType::NoIpsecDaemon;
378​ return false;
379​ }
380​
381​ QProcess ipsecVersionProcess;
382​ ipsecVersionProcess.setProgram(ipsecBinary);
383​ ipsecVersionProcess.setArguments(QStringList() << "--version");
384​ ipsecVersionProcess.start();
385​ ipsecVersionProcess.waitForFinished(-1);
386​
387​ if (ipsecVersionProcess.exitStatus() == QProcess::NormalExit) {
388​ QString ipsecStdout = ipsecVersionProcess.readAllStandardOutput();
389​
390​ if (ipsecStdout.contains(" strongSwan ", Qt::CaseSensitive)) {
391​ L2tpIpsecWidget::m_ipsecDaemonType = IpsecDaemonType::Strongswan;
392​ } else if (ipsecStdout.contains(" Libreswan ", Qt::CaseSensitive)) {
393​ L2tpIpsecWidget::m_ipsecDaemonType = IpsecDaemonType::Libreswan;
394​ } else if (ipsecStdout.contains(" Openswan ", Qt::CaseSensitive)) {
395​ L2tpIpsecWidget::m_ipsecDaemonType = IpsecDaemonType::Openswan;
396​ } else {
397​ L2tpIpsecWidget::m_ipsecDaemonType = IpsecDaemonType::UnknownIpsecDaemon;
398​ }
399​ }
400​
401​ if (m_ipsecDaemonType == IpsecDaemonType::Libreswan
402​ || m_ipsecDaemonType == IpsecDaemonType::Strongswan) {
403​ return true;
404​ }
405​ return false;
406​}
Context not available.