Fix Windows IPsec (#909)

* Fix Windows IPsec

* Fix work wth PKCS12 TempFile
This commit is contained in:
Mykola Baibuz 2024-08-23 06:23:19 -07:00 committed by GitHub
parent b036c38981
commit 758b25947c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 49 additions and 44 deletions

View file

@ -10,6 +10,7 @@
#include "ikev2_vpn_protocol_windows.h" #include "ikev2_vpn_protocol_windows.h"
#include "utilities.h" #include "utilities.h"
static Ikev2Protocol* self = nullptr; static Ikev2Protocol* self = nullptr;
static std::mutex rasDialFuncMutex; static std::mutex rasDialFuncMutex;
@ -80,10 +81,10 @@ void Ikev2Protocol::newConnectionStateEventReceived(UINT unMsg, tagRASCONNSTATE
case RASCS_AuthNotify: case RASCS_AuthNotify:
//qDebug()<<__FUNCTION__ << __LINE__; //qDebug()<<__FUNCTION__ << __LINE__;
if (dwError != 0) { if (dwError != 0) {
//qDebug() << "have error" << dwError; qDebug() << "have error" << dwError;
setConnectionState(Vpn::ConnectionState::Disconnected); setConnectionState(Vpn::ConnectionState::Disconnected);
} else { } else {
//qDebug() << "RASCS_AuthNotify but no error" << dwError; qDebug() << "RASCS_AuthNotify but no error" << dwError;
} }
break; break;
case RASCS_AuthRetry: case RASCS_AuthRetry:
@ -179,11 +180,13 @@ ErrorCode Ikev2Protocol::start()
QByteArray cert = QByteArray::fromBase64(m_config[config_key::cert].toString().toUtf8()); QByteArray cert = QByteArray::fromBase64(m_config[config_key::cert].toString().toUtf8());
setConnectionState(Vpn::ConnectionState::Connecting); setConnectionState(Vpn::ConnectionState::Connecting);
QTemporaryFile certFile; QTemporaryFile * certFile = new QTemporaryFile;
certFile.setAutoRemove(false); certFile->setAutoRemove(false);
certFile.open(); certFile->open();
certFile.write(cert); QString m_filename = certFile->fileName();
certFile.close(); certFile->write(cert);
certFile->close();
delete certFile;
{ {
auto certInstallProcess = IpcClient::CreatePrivilegedProcess(); auto certInstallProcess = IpcClient::CreatePrivilegedProcess();
@ -193,19 +196,19 @@ ErrorCode Ikev2Protocol::start()
return ErrorCode::AmneziaServiceConnectionFailed; return ErrorCode::AmneziaServiceConnectionFailed;
} }
certInstallProcess->waitForSource(1000); certInstallProcess->waitForSource();
if (!certInstallProcess->isInitialized()) { if (!certInstallProcess->isInitialized()) {
qWarning() << "IpcProcess replica is not connected!"; qWarning() << "IpcProcess replica is not connected!";
setLastError(ErrorCode::AmneziaServiceConnectionFailed); setLastError(ErrorCode::AmneziaServiceConnectionFailed);
return ErrorCode::AmneziaServiceConnectionFailed; return ErrorCode::AmneziaServiceConnectionFailed;
} }
certInstallProcess->setProgram(PermittedProcess::CertUtil); certInstallProcess->setProgram(PermittedProcess::CertUtil);
QStringList arguments({"-f" , "-importpfx",
"-p", m_config[config_key::password].toString(),
certFile.fileName(), "NoExport"
});
certInstallProcess->setArguments(arguments);
QStringList arguments({"-f", "-importpfx", "-p", m_config[config_key::password].toString(),
QDir::toNativeSeparators(m_filename), "NoExport"
});
certInstallProcess->setArguments(arguments);
certInstallProcess->start(); certInstallProcess->start();
} }
// /* // /*
@ -222,14 +225,13 @@ ErrorCode Ikev2Protocol::start()
{ {
if ( !create_new_vpn(tunnelName(), m_config[config_key::hostName].toString())){ if ( !create_new_vpn(tunnelName(), m_config[config_key::hostName].toString())){
qDebug() <<"Can't create the VPN connect"; qDebug() <<"Can't create the VPN connect";
} }
} }
} }
{ {
auto adapterConfigProcess = new QProcess; QProcess adapterConfigProcess;
adapterConfigProcess.setProgram("powershell");
adapterConfigProcess->setProgram("powershell");
QString arguments = QString("-command \"Set-VpnConnectionIPsecConfiguration\" " QString arguments = QString("-command \"Set-VpnConnectionIPsecConfiguration\" "
"-ConnectionName '%1' " "-ConnectionName '%1' "
"-AuthenticationTransformConstants GCMAES128 " "-AuthenticationTransformConstants GCMAES128 "
@ -240,19 +242,20 @@ ErrorCode Ikev2Protocol::start()
"-DHGroup Group14 " "-DHGroup Group14 "
"-PassThru -Force\"") "-PassThru -Force\"")
.arg(tunnelName()); .arg(tunnelName());
adapterConfigProcess->setNativeArguments(arguments);
adapterConfigProcess->start(); adapterConfigProcess.setNativeArguments(arguments);
adapterConfigProcess->waitForFinished(5000);
} adapterConfigProcess.start();
//*/ adapterConfigProcess.waitForFinished(5000);
{ }
//*/
{
if (!connect_to_vpn(tunnelName())) { if (!connect_to_vpn(tunnelName())) {
qDebug()<<"We can't connect to VPN"; qDebug()<<"We can't connect to VPN";
} }
} }
//setConnectionState(Connecting); //setConnectionState(Connecting);
return ErrorCode::NoError; return ErrorCode::NoError;
} }
//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
bool Ikev2Protocol::create_new_vpn(const QString & vpn_name, bool Ikev2Protocol::create_new_vpn(const QString & vpn_name,
@ -299,6 +302,7 @@ bool Ikev2Protocol::connect_to_vpn(const QString & vpn_name){
auto ret = RasDial(NULL, NULL, &RasDialParams, 0, auto ret = RasDial(NULL, NULL, &RasDialParams, 0,
&RasDialFuncCallback, &RasDialFuncCallback,
&hRasConn); &hRasConn);
if (ret == ERROR_SUCCESS){ if (ret == ERROR_SUCCESS){
return true; return true;
} }

View file

@ -263,7 +263,8 @@ PageType {
clickedFunc: function() { clickedFunc: function() {
if (!port.textField.acceptableInput && if (!port.textField.acceptableInput &&
ContainerProps.containerTypeToString(dockerContainer) !== "torwebsite") { ContainerProps.containerTypeToString(dockerContainer) !== "torwebsite" &&
ContainerProps.containerTypeToString(dockerContainer) !== "ikev2") {
port.errorText = qsTr("The port must be in the range of 1 to 65535") port.errorText = qsTr("The port must be in the range of 1 to 65535")
return return
} }