vpn/strongswan: Add EAP-TTLS authentication method

Wyllian Bezerra da Silvarequested to merge
wyllian/plasma-nm:add-eap-ttls-support into master

Summary

Add support for IKEv2 with EAP-TTLS/MSCHAPv2 authentication to the strongSwan VPN plugin. This method is used by several university and enterprise networks (e.g. UFSC's VPN, vpn.ufsc.br) that require an inner MSCHAPv2 authentication tunneled inside TLS, distinct from plain EAP.

Reason for the change

Currently the strongSwan KCM only exposes "EAP" as a generic method, which maps to eap-mschapv2 in charon-nm and does not support the TTLS-wrapped variant required by these networks. Without this, KDE Plasma users have no GUI way to configure such VPNs and must fall back to manual swanctl configuration.

This is part of a 3-layer patch set (see strongswan/strongswan#3134 on GitHub) that also touches charon-nm (the actual IKE daemon) and the GTK nm-strongswan editor, so the feature works across desktop environments. This MR is the KDE/Plasma side.

Changes

  • nm-strongswan-service.h: add NM_STRONGSWAN_AUTH_EAP_TTLS define
  • strongswanprop.ui: add "EAP-TTLS" entry to the authentication method combo box, plus a placeholder page in the QStackedWidget
  • strongswanwidget.cpp: add EapTtls enum value; redirect the stacked widget to reuse the existing EAP username/password fields; load/save the eap-ttls method string

Test plan

  • Built and installed the patched plasma-nm package on Debian 13 (trixie) with KDE Plasma 6.3.6
  • Created a new strongSwan VPN connection via Plasma Network Manager settings, selected "EAP-TTLS", entered username/password
  • Verified the connection is saved correctly and successfully connects to a real IKEv2/EAP-TTLS VPN gateway (UFSC university VPN) once combined with the corresponding charon-nm patch

Merge request reports