vpn: fix tls openvpn connection types

related #1344

core/internal/server/network/agent_networkmanager.go

@@ -545,12 +545,18 @@ func (a *SecretAgent) GetSecrets(
 		out[settingName] = sec
 	}
 	if settingName == "vpn" && a.backend != nil && !isPKCS11 && (vpnUsername != "" || reply.Save) {
-		pw := reply.Secrets["password"]
+		secrets := make(map[string]string)
+		for k, v := range reply.Secrets {
+			if k != "username" {
+				secrets[k] = v
+			}
+		}
 		a.backend.pendingVPNSaveMu.Lock()
 		a.backend.pendingVPNSave = &pendingVPNCredentials{
 			ConnectionPath: string(path),
 			Username:       vpnUsername,
-			Password:       pw,
+			Password:       reply.Secrets["password"],
+			Secrets:        secrets,
 			SavePassword:   reply.Save,
 		}
 		a.backend.pendingVPNSaveMu.Unlock()
@@ -790,7 +796,23 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 			fields = []string{"username", "password"}
 		}
 	case strings.Contains(vpnService, "openvpn"):
-		if connType == "password" || connType == "password-tls" {
+		switch connType {
+		case "tls":
+			// Cert auth wants the private-key passphrase, not a password.
+			if secretFlagsNotRequired(dataMap["cert-pass-flags"]) {
+				return nil
+			}
+			return []string{"cert-pass"}
+		case "password-tls":
+			fields = []string{}
+			if dataMap["username"] == "" {
+				fields = append(fields, "username")
+			}
+			fields = append(fields, "password")
+			if !secretFlagsNotRequired(dataMap["cert-pass-flags"]) {
+				fields = append(fields, "cert-pass")
+			}
+		case "password":
 			if dataMap["username"] == "" {
 				fields = []string{"username", "password"}
 			}
@@ -805,6 +827,19 @@ func inferVPNFields(conn map[string]nmVariantMap, vpnService string) []string {
 	return fields
 }
 
+// NetworkManager secret flags: bit 1 (value 2) marks a secret as not-saved,
+// bit 2 (value 4) as not-required. A not-required secret must not be prompted.
+func secretFlagsNotRequired(flags string) bool {
+	if flags == "" {
+		return false
+	}
+	n, err := strconv.Atoi(flags)
+	if err != nil {
+		return false
+	}
+	return n&0x4 != 0
+}
+
 func needsExternalBrowserAuth(protocol, authType, username string, data map[string]string) bool {
 	if method, ok := data["saml-auth-method"]; ok {
 		if method == "REDIRECT" || method == "POST" {

core/internal/server/network/agent_networkmanager_test.go

@@ -315,6 +315,44 @@ func TestInferVPNFields_GPSaml(t *testing.T) {
 			expectedLen: 1,
 			shouldHave:  []string{"password"},
 		},
+		{
+			name:       "OpenVPN cert auth (tls) - private-key passphrase",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "tls",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"cert-pass"},
+		},
+		{
+			name:       "OpenVPN cert auth (tls) with passphrase-less key",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "tls",
+				"cert-pass-flags": "4",
+			},
+			expectedLen: 0,
+		},
+		{
+			name:       "OpenVPN password-tls no username",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "password-tls",
+			},
+			expectedLen: 3,
+			shouldHave:  []string{"username", "password", "cert-pass"},
+		},
+		{
+			name:       "OpenVPN password-tls with username, passphrase-less key",
+			vpnService: "org.freedesktop.NetworkManager.openvpn",
+			dataMap: map[string]string{
+				"connection-type": "password-tls",
+				"username":        "john",
+				"cert-pass-flags": "4",
+			},
+			expectedLen: 1,
+			shouldHave:  []string{"password"},
+		},
 	}
 
 	for _, tt := range tests {

core/internal/server/network/backend_networkmanager.go

@@ -90,7 +90,10 @@ type pendingVPNCredentials struct {
 	ConnectionPath string
 	Username       string
 	Password       string
-	SavePassword   bool
+	// Secrets holds all VPN secret fields keyed by name (e.g. "cert-pass");
+	// falls back to Password under the "password" key when empty.
+	Secrets      map[string]string
+	SavePassword bool
 }
 
 type cachedVPNCredentials struct {

core/internal/server/network/backend_networkmanager_vpn.go

@@ -863,13 +863,17 @@ func (b *NetworkManagerBackend) saveVPNCredentials(creds *pendingVPNCredentials)
 		log.Infof("[saveVPNCredentials] Saving username")
 	}
 
-	// Save password if requested
+	// Save secrets if requested
 	if creds.SavePassword {
-		data["password-flags"] = "0"
-		secs := make(map[string]string)
-		secs["password"] = creds.Password
+		secs := creds.Secrets
+		if len(secs) == 0 {
+			secs = map[string]string{"password": creds.Password}
+		}
+		for field := range secs {
+			data[field+"-flags"] = "0"
+		}
 		vpn["secrets"] = dbus.MakeVariant(secs)
-		log.Infof("[saveVPNCredentials] Saving password with password-flags=0")
+		log.Infof("[saveVPNCredentials] Saving %d secret field(s) with flags=0", len(secs))
 	}
 
 	vpn["data"] = dbus.MakeVariant(data)