Skip to content

SAML: disable proxy when opening auth dialog #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

SAML: disable proxy when opening auth dialog #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b2b2c7e
SAML: disable proxy when opening auth dialog
mchehab Dec 5, 2023
053d16f
Add a menu option to enable/disable using proxy at webkit dialog
mchehab Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion auth-dialog/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -745,9 +745,18 @@ static gboolean open_webview_idle(gpointer data)
// Create a browser instance
webView = WEBKIT_WEB_VIEW(webkit_web_view_new());

dont_use_proxy_for_auth = g_hash_table_lookup(ui_data->options,
NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION);

dm = webkit_web_view_get_website_data_manager(webView);
if (dm)
if (dm) {
cm = webkit_website_data_manager_get_cookie_manager(dm);

if (dont_use_proxy_for_auth) {
// Ensure that proxies won't be used on auth dialog
webkit_website_data_manager_set_network_proxy_settings(dm, WEBKIT_NETWORK_PROXY_MODE_NO_PROXY, NULL);
}
}
if (cm)
storage = g_string_new (g_get_user_data_dir());
if (storage)
Expand Down
25 changes: 21 additions & 4 deletions properties/nm-openconnect-dialog.ui
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,23 @@
<property name="width">2</property>
</packing>
</child>
<child>
<object class="GtkCheckButton" id="dont_use_proxy_for_authentication">
<property name="visible">True</property>
<property name="can_focus">True</property>
<property name="label" translatable="yes">Don't use system proxy settings during authentication</property>
<property name="use_underline">True</property>
<property name="focus_on_click">True</property>
<property name="active">False</property>
<property name="inconsistent">False</property>
<property name="draw_indicator">True</property>
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">13</property>
<property name="width">2</property>
</packing>
</child>
<child>
<object class="GtkLabel" id="token_label">
<property name="visible">False</property>
Expand All @@ -344,7 +361,7 @@
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">13</property>
<property name="top_attach">14</property>
<property name="width">2</property>
</packing>
</child>
Expand All @@ -366,7 +383,7 @@
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">14</property>
<property name="top_attach">15</property>
</packing>
</child>
<child>
Expand All @@ -384,7 +401,7 @@
</object>
<packing>
<property name="left_attach">1</property>
<property name="top_attach">14</property>
<property name="top_attach">15</property>
</packing>
</child>
<child>
Expand All @@ -406,7 +423,7 @@
</object>
<packing>
<property name="left_attach">0</property>
<property name="top_attach">15</property>
<property name="top_attach">16</property>
</packing>
</child>
<child>
Expand Down
9 changes: 9 additions & 0 deletions properties/nm-openconnect-editor-plugin.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,11 @@ import (NMVpnEditorPlugin *iface, const char *path, GError **error)
if (true)
nm_setting_vpn_add_data_item (s_vpn, NM_OPENCONNECT_KEY_PREVENT_INVALID_CERT, "yes");

/* Don't use system proxy settings during authentication */
bval = g_key_file_get_boolean (keyfile, "openconnect", "DontUseProxyAuth", NULL);
if (true)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be 'if (bval)' ?

nm_setting_vpn_add_data_item (s_vpn, NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION, "yes");

/* Soft token mode */
buf = g_key_file_get_string (keyfile, "openconnect", "StokenSource", NULL);
if (buf)
Expand Down Expand Up @@ -366,6 +371,10 @@ export (NMVpnEditorPlugin *iface,
if (value && !strcmp (value, "yes"))
prevent_invalid_cert = TRUE;

value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION);
if (value && !strcmp (value, "yes"))
prevent_invalid_cert = TRUE;

value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENCONNECT_KEY_TOKEN_MODE);
if (value && strlen (value))
token_mode = value;
Expand Down
16 changes: 15 additions & 1 deletion properties/nm-openconnect-editor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,7 +364,17 @@ init_editor_plugin (OpenconnectEditor *self, NMConnection *connection, GError **
}
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (stuff_changed_cb), self);

widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "csd_button"));
widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "dont_use_proxy_for_authentication"));
g_return_val_if_fail (widget, FALSE);

if (s_vpn) {
value = nm_setting_vpn_get_data_item (s_vpn, NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION);
if (value && !strcmp(value, "yes"))
gtk_check_button_set_active (GTK_CHECK_BUTTON (widget), TRUE);
}
g_signal_connect (G_OBJECT (widget), "toggled", G_CALLBACK (stuff_changed_cb), self);

widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "csd_button"));
g_return_val_if_fail (widget, FALSE);

if (s_vpn) {
Expand Down Expand Up @@ -468,6 +478,10 @@ update_connection (NMVpnEditor *iface,
str = gtk_check_button_get_active (GTK_CHECK_BUTTON (widget))?"yes":"no";
nm_setting_vpn_add_data_item (s_vpn, NM_OPENCONNECT_KEY_PREVENT_INVALID_CERT, str);

widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "dont_use_proxy_for_authentication"));
str = gtk_check_button_get_active (GTK_CHECK_BUTTON (widget))?"yes":"no";
nm_setting_vpn_add_data_item (s_vpn, NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION, str);

widget = GTK_WIDGET (gtk_builder_get_object (priv->builder, "csd_button"));
str = gtk_check_button_get_active (GTK_CHECK_BUTTON (widget))?"yes":"no";
nm_setting_vpn_add_data_item (s_vpn, NM_OPENCONNECT_KEY_CSD_ENABLE, str);
Expand Down
1 change: 1 addition & 0 deletions shared/nm-service-defines.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@
#define NM_OPENCONNECT_KEY_MTU "mtu"
#define NM_OPENCONNECT_KEY_PEM_PASSPHRASE_FSID "pem_passphrase_fsid"
#define NM_OPENCONNECT_KEY_PREVENT_INVALID_CERT "prevent_invalid_cert"
#define NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION "no_proxy_auth"
#define NM_OPENCONNECT_KEY_PROTOCOL "protocol"
#define NM_OPENCONNECT_KEY_PROXY "proxy"
#define NM_OPENCONNECT_KEY_CSD_ENABLE "enable_csd_trojan"
Expand Down
3 changes: 2 additions & 1 deletion src/nm-openconnect-service.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ static const ValidProperty valid_properties[] = {
{ NM_OPENCONNECT_KEY_MTU, G_TYPE_STRING, 0, 0 },
{ NM_OPENCONNECT_KEY_PEM_PASSPHRASE_FSID, G_TYPE_BOOLEAN, 0, 0 },
{ NM_OPENCONNECT_KEY_PREVENT_INVALID_CERT, G_TYPE_BOOLEAN, 0, 0 },
{ NM_OPENCONNECT_DONT_USE_PROXY_AUTHENTICATION, G_TYPE_BOOLEAN, 0, 0 },
{ NM_OPENCONNECT_KEY_PROTOCOL, G_TYPE_STRING, 0, 0 },
{ NM_OPENCONNECT_KEY_PROXY, G_TYPE_STRING, 0, 0 },
{ NM_OPENCONNECT_KEY_CSD_ENABLE, G_TYPE_BOOLEAN, 0, 0 },
Expand Down Expand Up @@ -603,7 +604,7 @@ real_need_secrets (NMVpnServicePlugin *plugin,
}

/* We just need the WebVPN cookie, and the final IP address of the gateway
(after HTTP redirects, which do happen). All the certificate/SecurID
(after HTTP redirects, which do happen). All the certificate/SecurID
nonsense can be handled for us, in the user's context, by auth-dialog */
if (!nm_setting_vpn_get_secret (s_vpn, NM_OPENCONNECT_KEY_GATEWAY)) {
*setting_name = NM_SETTING_VPN_SETTING_NAME;
Expand Down