VPN: WireGuard-/OpenVPN-Konfigurationen verwalten, Hosts zuordnen, automatischer Aufbau vor dem Verbinden (Linux: NetworkManager, Windows: WireGuard-Dienst/OpenVPN GUI)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-25 19:05:33 +02:00
parent b716ce3415
commit b38837d4e0
8 changed files with 368 additions and 8 deletions
@@ -11,6 +11,7 @@ const { Updater } = require('./updater');
 const { createEmbed, embedSupported } = require('./rdp-embed');
 const i18n = require('../i18n');
 const fido = require('./fido');
+const { VpnManager } = require('./vpn');
 const applyLanguage = () => i18n.setLanguage(store.get().settings.language, app.getLocale());

 let win;
@@ -59,6 +60,7 @@ function askSecret(sessionId, req) {

 const ssh = new SshManager(store, confirmHostKey, askSecret);
 const updater = new Updater(store, send);
+const vpn = new VpnManager(store, app.getPath('userData'));

 function createWindow() {
  win = new BrowserWindow({
@@ -176,8 +178,26 @@ handle('lock:removeFido', (id) => {

 // ---------- Vault ----------
 handle('vault:get', () => ({ ...store.get(), encrypted: store.encrypted, platform: process.platform }));
-handle('vault:upsert', (col, item) => store.upsert(col, item));
-handle('vault:remove', (col, id) => store.remove(col, id));
+handle('vault:upsert', async (col, item) => {
+  // Geänderte VPN-Konfiguration: alte Systemverbindung entfernen, beim nächsten Verbinden neu importieren
+  if (col === 'vpns' && item.id) {
+    const old = store.get().vpns.find((v) => v.id === item.id);
+    if (old && ['type', 'config', 'username', 'password'].some((k) => (old[k] || '') !== (item[k] || ''))) await vpn.forget(old);
+  }
+  return store.upsert(col, item);
+});
+handle('vault:remove', async (col, id) => {
+  if (col === 'vpns') {
+    await vpn.forget(store.get().vpns.find((v) => v.id === id));
+    store.get().hosts.forEach((h) => { if (h.vpnId === id) h.vpnId = null; });
+  }
+  return store.remove(col, id);
+});
+
+// ---------- VPN ----------
+handle('vpn:status', () => vpn.status());
+handle('vpn:up', (id) => vpn.up(id));
+handle('vpn:down', (id) => vpn.down(id));
 handle('vault:settings', (s) => {
  store.setSettings(s);
  if ('language' in s) applyLanguage();
@@ -274,6 +294,8 @@ function hostWithOverrides(hostOrId) {
 handle('ssh:open', async (sessionId, hostRef, size) => {
  const host = hostWithOverrides(hostRef);
  if (host.id) store.addHistory({ hostId: host.id, at: Date.now() });
+  const onEvent = (type, payload) => send('ssh:event', sessionId, type, payload);
+  if (await vpn.ensureForHost(host, (m) => onEvent('status', m))) send('vpn:changed');
  await ssh.openShell(sessionId, host, size, (type, payload) => send('ssh:event', sessionId, type, payload));
  return true;
 });
@@ -286,7 +308,11 @@ ipcMain.on('secret:reply', (_e, reqId, value) => {
 });

 // ---------- SFTP ----------
-handle('sftp:open', (sessionId, hostRef) => ssh.openSftp(sessionId, hostWithOverrides(hostRef)));
+handle('sftp:open', async (sessionId, hostRef) => {
+  const host = hostWithOverrides(hostRef);
+  if (await vpn.ensureForHost(host)) send('vpn:changed');
+  return ssh.openSftp(sessionId, host);
+});
 handle('sftp:list', (id, dir) => ssh.sftpList(id, dir));
 handle('sftp:op', (id, op, a, b) => ssh.sftpOp(id, op, a, b));
 handle('sftp:transfer', async (id, dir, localPath, remotePath, transferId) => {
@@ -320,9 +346,10 @@ handle('local:op', (op, a, b) => {
 });

 // ---------- Port-Forwarding ----------
-handle('fw:start', (id) => {
+handle('fw:start', async (id) => {
  const fw = store.get().forwards.find((f) => f.id === id);
  if (!fw) throw new Error(i18n.t('Rule not found'));
+  if (await vpn.ensureForHost(store.resolveHost(fw.hostId))) send('vpn:changed');
  return ssh.startForward(fw, (ev) => send('fw:event', id, ev));
 });
 handle('fw:stop', (id) => ssh.stopForward(id));
@@ -330,8 +357,9 @@ handle('fw:active', () => ssh.activeForwards());

 // ---------- RDP ----------
 handle('rdp:detect', () => rdp.detect(store.get().settings));
-handle('rdp:launch', (hostId) => {
+handle('rdp:launch', async (hostId) => {
  const host = hostWithOverrides(hostId);
+  if (await vpn.ensureForHost(host)) send('vpn:changed');
  if (host.id) store.addHistory({ hostId: host.id, at: Date.now() });
  const r = rdp.launch(host, store.get().settings);
  if (r.process) {
@@ -351,6 +379,7 @@ handle('rdp:embedSupported', () => {
 handle('rdp:open', async (id, hostRef, bounds) => {
  const host = hostWithOverrides(hostRef);
  if (host.id) store.addHistory({ hostId: host.id, at: Date.now() });
+  if (await vpn.ensureForHost(host)) send('vpn:changed');
  const emb = createEmbed(win.getNativeWindowHandle());
  const sess = { emb, cancelled: false };
  rdpSessions.set(id, sess);
@@ -453,7 +482,7 @@ function scheduleUpdateCheck() {
  updateScheduled = true;
  setTimeout(() => updater.check().then((r) => { if (r.available) send('update:available', r); }).catch(() => {}), 6000);
 }
-app.on('window-all-closed', () => { ssh.closeAll(); app.quit(); });
+app.on('window-all-closed', async () => { ssh.closeAll(); await vpn.downOnQuit(); app.quit(); });

 // Smoke-Test: MRTERM_SMOKE=<pfad.png> startet, loggt Renderer-Meldungen, speichert einen Screenshot und beendet.
 if (process.env.MRTERM_SMOKE) {
@@ -12,6 +12,7 @@ const DEFAULTS = {
  keys: [],
  snippets: [],
  forwards: [],
+  vpns: [],
  knownHosts: {},
  history: [],
  settings: {
@@ -0,0 +1,183 @@
+// VPN-Verbindungen (WireGuard / OpenVPN), die vor dem Verbinden zu zugeordneten Hosts automatisch aufgebaut werden.
+//   Linux:   NetworkManager (nmcli) – kein root nötig. MrTerm legt pro VPN eine Verbindung "mrterm-<id>" an
+//            (autoconnect aus). OpenVPN braucht das Plugin networkmanager-openvpn.
+//   Windows: WireGuard als Tunnel-Dienst über wireguard.exe (UAC-Abfrage), OpenVPN über die OpenVPN GUI.
+const { execFile, spawn } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const i18n = require('../i18n');
+
+function exec(cmd, args) {
+  return new Promise((resolve) => {
+    execFile(cmd, args, { windowsHide: true, timeout: 90000 }, (err, stdout, stderr) => {
+      resolve({ code: err ? (typeof err.code === 'number' ? err.code : err.code === 'ENOENT' ? 'ENOENT' : 1) : 0, stdout: String(stdout || ''), stderr: String(stderr || err?.message || '') });
+    });
+  });
+}
+const lastLine = (s) => s.split('\n').map((l) => l.trim()).filter(Boolean).slice(-1)[0] || '';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+class VpnManager {
+  constructor(store, userDir) {
+    this.store = store;
+    this.dir = path.join(userDir, 'vpn');
+    this.busy = new Map(); // id -> laufendes up() (parallele Verbindungen zum selben VPN nur einmal aufbauen)
+    this.started = new Set(); // von MrTerm aufgebaute VPNs
+  }
+
+  get(id) { return this.store.get().vpns.find((v) => v.id === id); }
+  nmName(v) { return 'mrterm-' + v.id.slice(0, 8); }
+  // Interface-/Tunnelname: max. 15 Zeichen (Linux), nur [a-z0-9]
+  ifName(v) { return 'mt' + v.id.replace(/-/g, '').slice(0, 10); }
+
+  // ---------------------------------------------------------------- Linux (NetworkManager)
+  async nm(args) {
+    const r = await exec('nmcli', args);
+    if (r.code === 'ENOENT') throw new Error(i18n.t('NetworkManager (nmcli) not found. MrTerm uses NetworkManager for VPN connections.'));
+    return r;
+  }
+  async nmExists(v) {
+    const r = await this.nm(['-t', '-f', 'NAME', 'connection', 'show']);
+    return r.stdout.split('\n').includes(this.nmName(v));
+  }
+  async nmImport(v) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'mrterm-vpn-'));
+    const file = path.join(tmp, this.ifName(v) + (v.type === 'openvpn' ? '.ovpn' : '.conf'));
+    try {
+      fs.writeFileSync(file, v.config || '', { mode: 0o600 });
+      const r = await this.nm(['connection', 'import', 'type', v.type === 'openvpn' ? 'openvpn' : 'wireguard', 'file', file]);
+      if (r.code) {
+        const err = lastLine(r.stderr);
+        if (v.type === 'openvpn' && /plugin|openvpn/i.test(err)) throw new Error(i18n.t('OpenVPN support for NetworkManager is missing. Install it with: sudo pacman -S networkmanager-openvpn'));
+        throw new Error(i18n.t('VPN configuration could not be imported: {err}', { err }));
+      }
+      const uuid = (r.stdout.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/) || [])[0];
+      const mod = ['connection', 'modify', uuid || this.ifName(v), 'connection.id', this.nmName(v), 'connection.autoconnect', 'no'];
+      if (v.type === 'openvpn' && v.username) mod.push('+vpn.data', `username=${v.username}`);
+      if (v.type === 'openvpn' && v.password) mod.push('+vpn.data', 'password-flags=0', 'vpn.secrets', `password=${v.password}`);
+      const m = await this.nm(mod);
+      if (m.code) throw new Error(lastLine(m.stderr));
+    } finally {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  }
+
+  // ---------------------------------------------------------------- Windows
+  get wgExe() { return path.join(process.env.ProgramFiles || 'C:\\Program Files', 'WireGuard', 'wireguard.exe'); }
+  get ovpnGui() { return path.join(process.env.ProgramFiles || 'C:\\Program Files', 'OpenVPN', 'bin', 'openvpn-gui.exe'); }
+  // Programm mit Administratorrechten starten (UAC) und warten
+  async elevate(exe, args) {
+    const q = (s) => `'${String(s).replace(/'/g, "''")}'`;
+    const cmd = `$p = Start-Process -FilePath ${q(exe)} -ArgumentList @(${args.map((a) => q(`"${a}"`)).join(',')}) -Verb RunAs -Wait -WindowStyle Hidden -PassThru; exit $p.ExitCode`;
+    const r = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', cmd]);
+    if (r.code) throw new Error(i18n.t('VPN “{name}” could not be connected: {err}', { name: path.basename(exe), err: lastLine(r.stderr) || r.code }));
+  }
+  winOvpnName(v) { return this.ifName(v) + '.ovpn'; }
+  async winOpenvpnUp() {
+    const r = await exec('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+      "@(Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -match 'TAP-Windows|Wintun|OpenVPN|ovpn-dco' }).Count"]);
+    return Number(r.stdout.trim()) > 0;
+  }
+
+  // ---------------------------------------------------------------- Gemeinsame API
+  async isUp(v) {
+    if (process.platform === 'win32') {
+      if (v.type === 'openvpn') return this.winOpenvpnUp();
+      const r = await exec('sc', ['query', `WireGuardTunnel$${this.ifName(v)}`]);
+      return /RUNNING/.test(r.stdout);
+    }
+    const r = await this.nm(['-t', '-f', 'NAME', 'connection', 'show', '--active']);
+    return r.stdout.split('\n').includes(this.nmName(v));
+  }
+
+  async status() {
+    const out = {};
+    for (const v of this.store.get().vpns) { try { out[v.id] = await this.isUp(v); } catch { out[v.id] = false; } }
+    return out;
+  }
+
+  up(id) {
+    if (this.busy.has(id)) return this.busy.get(id);
+    const p = this._up(id).finally(() => this.busy.delete(id));
+    this.busy.set(id, p);
+    return p;
+  }
+
+  async _up(id) {
+    const v = this.get(id);
+    if (!v) throw new Error(i18n.t('VPN not found'));
+    if (await this.isUp(v)) return;
+    const fail = (err) => new Error(i18n.t('VPN “{name}” could not be connected: {err}', { name: v.label, err }));
+    if (process.platform === 'win32') {
+      fs.mkdirSync(this.dir, { recursive: true });
+      if (v.type === 'openvpn') {
+        if (!fs.existsSync(this.ovpnGui)) throw new Error(i18n.t('OpenVPN GUI not found. Install OpenVPN from openvpn.net.'));
+        const dir = path.join(os.homedir(), 'OpenVPN', 'config', this.ifName(v));
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, this.winOvpnName(v)), v.config || '');
+        spawn(this.ovpnGui, ['--connect', this.winOvpnName(v)], { detached: true, stdio: 'ignore' }).unref();
+      } else {
+        if (!fs.existsSync(this.wgExe)) throw new Error(i18n.t('WireGuard for Windows not found. Install it from wireguard.com.'));
+        const file = path.join(this.dir, this.ifName(v) + '.conf');
+        fs.writeFileSync(file, v.config || '');
+        await this.elevate(this.wgExe, ['/installtunnelservice', file]);
+      }
+      for (let i = 0; i < 60; i++) { if (await this.isUp(v)) { this.started.add(id); return; } await sleep(500); }
+      throw fail(i18n.t('timeout'));
+    }
+    if (!(await this.nmExists(v))) await this.nmImport(v);
+    const r = await this.nm(['--wait', '45', 'connection', 'up', 'id', this.nmName(v)]);
+    if (r.code) throw fail(lastLine(r.stderr));
+    this.started.add(id);
+  }
+
+  // Beim Beenden: von MrTerm aufgebaute VPNs mit Option "beim Beenden trennen" wieder abbauen
+  async downOnQuit() {
+    for (const id of this.started) {
+      const v = this.get(id);
+      if (v && v.disconnectOnQuit !== false) await this.down(id).catch(() => {});
+    }
+  }
+
+  async down(id) {
+    const v = this.get(id);
+    if (!v) return;
+    if (process.platform === 'win32') {
+      if (v.type === 'openvpn') spawn(this.ovpnGui, ['--command', 'disconnect', this.winOvpnName(v)], { detached: true, stdio: 'ignore' }).unref();
+      else if (await this.isUp(v)) await this.elevate(this.wgExe, ['/uninstalltunnelservice', this.ifName(v)]);
+      return;
+    }
+    await this.nm(['connection', 'down', 'id', this.nmName(v)]);
+  }
+
+  // Nach Änderung/Löschen: im System hinterlegte Verbindung entfernen, beim nächsten Verbinden wird neu importiert
+  async forget(v) {
+    if (!v) return;
+    try {
+      if (process.platform === 'win32') {
+        if (v.type !== 'openvpn' && (await this.isUp(v))) await this.elevate(this.wgExe, ['/uninstalltunnelservice', this.ifName(v)]);
+        fs.rmSync(path.join(this.dir, this.ifName(v) + '.conf'), { force: true });
+        fs.rmSync(path.join(os.homedir(), 'OpenVPN', 'config', this.ifName(v)), { recursive: true, force: true });
+      } else if (await this.nmExists(v)) await this.nm(['connection', 'delete', 'id', this.nmName(v)]);
+    } catch { /* VPN-Werkzeuge fehlen – nichts aufzuräumen */ }
+  }
+
+  // Alle VPNs eines Hosts (inkl. Jump-Host-Kette) aufbauen, bevor verbunden wird
+  async ensureForHost(host, onStatus = () => {}) {
+    const ids = [];
+    for (let h = host, n = 0; h && n < 10; h = h.jumpHostId ? this.store.resolveHost(h.jumpHostId) : null, n++) {
+      if (h.vpnId && !ids.includes(h.vpnId)) ids.push(h.vpnId);
+    }
+    for (const id of ids.reverse()) {
+      const v = this.get(id);
+      if (!v) continue;
+      if (await this.isUp(v)) continue;
+      onStatus(i18n.t('Connecting VPN “{name}” …', { name: v.label }));
+      await this.up(id);
+    }
+    return ids.length > 0;
+  }
+}
+
+module.exports = { VpnManager };