summaryrefslogtreecommitdiff
path: root/src/core/supplicant/nm-supplicant-config.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/core/supplicant/nm-supplicant-config.c')
-rw-r--r--src/core/supplicant/nm-supplicant-config.c1698
1 files changed, 1698 insertions, 0 deletions
diff --git a/src/core/supplicant/nm-supplicant-config.c b/src/core/supplicant/nm-supplicant-config.c
new file mode 100644
index 0000000000..1754bfff59
--- /dev/null
+++ b/src/core/supplicant/nm-supplicant-config.c
@@ -0,0 +1,1698 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2006 - 2012 Red Hat, Inc.
+ * Copyright (C) 2007 - 2008 Novell, Inc.
+ */
+
+#include "nm-default.h"
+
+#include "nm-supplicant-config.h"
+
+#include <stdlib.h>
+
+#include "nm-glib-aux/nm-str-buf.h"
+#include "nm-core-internal.h"
+#include "nm-supplicant-settings-verify.h"
+#include "nm-setting.h"
+#include "nm-libnm-core-intern/nm-auth-subject.h"
+#include "NetworkManagerUtils.h"
+#include "nm-utils.h"
+#include "nm-setting-ip4-config.h"
+
+typedef struct {
+ char * value;
+ guint32 len;
+ NMSupplOptType type;
+} ConfigOption;
+
+/*****************************************************************************/
+
+typedef struct {
+ GHashTable * config;
+ GHashTable * blobs;
+ NMSupplCapMask capabilities;
+ guint32 ap_scan;
+ bool fast_required : 1;
+ bool dispose_has_run : 1;
+ bool ap_isolation : 1;
+} NMSupplicantConfigPrivate;
+
+struct _NMSupplicantConfig {
+ GObject parent;
+ NMSupplicantConfigPrivate _priv;
+};
+
+struct _NMSupplicantConfigClass {
+ GObjectClass parent;
+};
+
+G_DEFINE_TYPE(NMSupplicantConfig, nm_supplicant_config, G_TYPE_OBJECT)
+
+#define NM_SUPPLICANT_CONFIG_GET_PRIVATE(self) \
+ _NM_GET_PRIVATE(self, NMSupplicantConfig, NM_IS_SUPPLICANT_CONFIG)
+
+/*****************************************************************************/
+
+static gboolean
+_get_capability(NMSupplicantConfigPrivate *priv, NMSupplCapType type)
+{
+ return NM_SUPPL_CAP_MASK_GET(priv->capabilities, type) == NM_TERNARY_TRUE;
+}
+
+NMSupplicantConfig *
+nm_supplicant_config_new(NMSupplCapMask capabilities)
+{
+ NMSupplicantConfigPrivate *priv;
+ NMSupplicantConfig * self;
+
+ self = g_object_new(NM_TYPE_SUPPLICANT_CONFIG, NULL);
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ priv->capabilities = capabilities;
+
+ return self;
+}
+
+static void
+config_option_free(ConfigOption *opt)
+{
+ g_free(opt->value);
+ g_slice_free(ConfigOption, opt);
+}
+
+static void
+nm_supplicant_config_init(NMSupplicantConfig *self)
+{
+ NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ priv->config = g_hash_table_new_full(nm_str_hash,
+ g_str_equal,
+ g_free,
+ (GDestroyNotify) config_option_free);
+
+ priv->ap_scan = 1;
+ priv->dispose_has_run = FALSE;
+}
+
+static gboolean
+nm_supplicant_config_add_option_with_type(NMSupplicantConfig *self,
+ const char * key,
+ const char * value,
+ gint32 len,
+ NMSupplOptType opt_type,
+ const char * display_value,
+ GError ** error)
+{
+ NMSupplicantConfigPrivate *priv;
+ ConfigOption * old_opt;
+ ConfigOption * opt;
+ NMSupplOptType type;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(key != NULL, FALSE);
+ g_return_val_if_fail(value != NULL, FALSE);
+ nm_assert(!error || !*error);
+
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ if (len < 0)
+ len = strlen(value);
+
+ if (opt_type != NM_SUPPL_OPT_TYPE_INVALID)
+ type = opt_type;
+ else {
+ type = nm_supplicant_settings_verify_setting(key, value, len);
+ if (type == NM_SUPPL_OPT_TYPE_INVALID) {
+ gs_free char *str_free = NULL;
+ const char * str;
+
+ str = nm_utils_buf_utf8safe_escape(value,
+ len,
+ NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL,
+ &str_free);
+
+ str = nm_strquote_a(255, str);
+
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "key '%s' and/or value %s invalid",
+ key,
+ display_value ?: str);
+ return FALSE;
+ }
+ }
+
+ old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);
+ if (old_opt) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "key '%s' already configured",
+ key);
+ return FALSE;
+ }
+
+ opt = g_slice_new0(ConfigOption);
+ opt->value = g_malloc(len + 1);
+ memcpy(opt->value, value, len);
+ opt->value[len] = '\0';
+
+ opt->len = len;
+ opt->type = type;
+
+ {
+ char buf[255];
+ memset(&buf[0], 0, sizeof(buf));
+ memcpy(&buf[0], opt->value, opt->len > 254 ? 254 : opt->len);
+ nm_log_info(LOGD_SUPPLICANT,
+ "Config: added '%s' value '%s'",
+ key,
+ display_value ?: &buf[0]);
+ }
+
+ g_hash_table_insert(priv->config, g_strdup(key), opt);
+
+ return TRUE;
+}
+
+static gboolean
+nm_supplicant_config_add_option(NMSupplicantConfig *self,
+ const char * key,
+ const char * value,
+ gint32 len,
+ const char * display_value,
+ GError ** error)
+{
+ return nm_supplicant_config_add_option_with_type(self,
+ key,
+ value,
+ len,
+ NM_SUPPL_OPT_TYPE_INVALID,
+ display_value,
+ error);
+}
+
+static gboolean
+nm_supplicant_config_add_blob(NMSupplicantConfig *self,
+ const char * key,
+ GBytes * value,
+ const char * blobid,
+ GError ** error)
+{
+ NMSupplicantConfigPrivate *priv;
+ ConfigOption * old_opt;
+ ConfigOption * opt;
+ NMSupplOptType type;
+ const guint8 * data;
+ gsize data_len;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(key != NULL, FALSE);
+ g_return_val_if_fail(value != NULL, FALSE);
+ g_return_val_if_fail(blobid != NULL, FALSE);
+
+ data = g_bytes_get_data(value, &data_len);
+ g_return_val_if_fail(data_len > 0, FALSE);
+
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ type = nm_supplicant_settings_verify_setting(key, (const char *) data, data_len);
+ if (type == NM_SUPPL_OPT_TYPE_INVALID) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "key '%s' and/or its contained value is invalid",
+ key);
+ return FALSE;
+ }
+
+ old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);
+ if (old_opt) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "key '%s' already configured",
+ key);
+ return FALSE;
+ }
+
+ opt = g_slice_new0(ConfigOption);
+ opt->value = g_strdup_printf("blob://%s", blobid);
+ opt->len = strlen(opt->value);
+ opt->type = type;
+
+ nm_log_info(LOGD_SUPPLICANT, "Config: added '%s' value '%s'", key, opt->value);
+
+ g_hash_table_insert(priv->config, g_strdup(key), opt);
+ if (!priv->blobs) {
+ priv->blobs =
+ g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, (GDestroyNotify) g_bytes_unref);
+ }
+ g_hash_table_insert(priv->blobs, g_strdup(blobid), g_bytes_ref(value));
+
+ return TRUE;
+}
+
+static gboolean
+nm_supplicant_config_add_blob_for_connection(NMSupplicantConfig *self,
+ GBytes * field,
+ const char * name,
+ const char * con_uid,
+ GError ** error)
+{
+ if (field && g_bytes_get_size(field)) {
+ gs_free char *uid = NULL;
+ char * p;
+
+ uid = g_strdup_printf("%s-%s", con_uid, name);
+ for (p = uid; *p; p++) {
+ if (*p == '/')
+ *p = '-';
+ }
+ if (!nm_supplicant_config_add_blob(self, name, field, uid, error))
+ return FALSE;
+ }
+ return TRUE;
+}
+
+static void
+nm_supplicant_config_finalize(GObject *object)
+{
+ NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(object);
+
+ g_hash_table_destroy(priv->config);
+ nm_clear_pointer(&priv->blobs, g_hash_table_destroy);
+
+ G_OBJECT_CLASS(nm_supplicant_config_parent_class)->finalize(object);
+}
+
+static void
+nm_supplicant_config_class_init(NMSupplicantConfigClass *klass)
+{
+ GObjectClass *object_class = G_OBJECT_CLASS(klass);
+
+ object_class->finalize = nm_supplicant_config_finalize;
+}
+
+guint32
+nm_supplicant_config_get_ap_scan(NMSupplicantConfig *self)
+{
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), 1);
+
+ return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->ap_scan;
+}
+
+gboolean
+nm_supplicant_config_fast_required(NMSupplicantConfig *self)
+{
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+
+ return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->fast_required;
+}
+
+GVariant *
+nm_supplicant_config_to_variant(NMSupplicantConfig *self)
+{
+ NMSupplicantConfigPrivate *priv;
+ GVariantBuilder builder;
+ GHashTableIter iter;
+ ConfigOption * option;
+ const char * key;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);
+
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);
+
+ g_hash_table_iter_init(&iter, priv->config);
+ while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &option)) {
+ switch (option->type) {
+ case NM_SUPPL_OPT_TYPE_INT:
+ g_variant_builder_add(&builder, "{sv}", key, g_variant_new_int32(atoi(option->value)));
+ break;
+ case NM_SUPPL_OPT_TYPE_BYTES:
+ case NM_SUPPL_OPT_TYPE_UTF8:
+ g_variant_builder_add(
+ &builder,
+ "{sv}",
+ key,
+ g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, option->value, option->len, 1));
+ break;
+ case NM_SUPPL_OPT_TYPE_KEYWORD:
+ case NM_SUPPL_OPT_TYPE_STRING:
+ g_variant_builder_add(&builder, "{sv}", key, g_variant_new_string(option->value));
+ break;
+ default:
+ break;
+ }
+ }
+
+ return g_variant_builder_end(&builder);
+}
+
+GHashTable *
+nm_supplicant_config_get_blobs(NMSupplicantConfig *self)
+{
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);
+
+ return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->blobs;
+}
+
+static const char *
+wifi_freqs_to_string(gboolean bg_band)
+{
+ static const char *str_2ghz = NULL;
+ static const char *str_5ghz = NULL;
+ const char ** f_p;
+ const char * f;
+
+ f_p = bg_band ? &str_2ghz : &str_5ghz;
+
+again:
+ f = g_atomic_pointer_get(f_p);
+
+ if (G_UNLIKELY(!f)) {
+ nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT(400, FALSE);
+ const guint * freqs;
+ int i;
+
+ freqs = bg_band ? nm_utils_wifi_2ghz_freqs() : nm_utils_wifi_5ghz_freqs();
+ for (i = 0; freqs[i]; i++) {
+ if (i > 0)
+ nm_str_buf_append_c(&strbuf, ' ');
+ nm_str_buf_append_printf(&strbuf, "%u", freqs[i]);
+ }
+
+ f = g_strdup(nm_str_buf_get_str(&strbuf));
+
+ if (!g_atomic_pointer_compare_and_exchange(f_p, NULL, f)) {
+ g_free((char *) f);
+ goto again;
+ }
+ }
+
+ return f;
+}
+
+gboolean
+nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,
+ NMSettingMacsec * setting,
+ GError ** error)
+{
+ const char *value;
+ char buf[32];
+ int port;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(setting != NULL, FALSE);
+ g_return_val_if_fail(!error || !*error, FALSE);
+
+ if (!nm_supplicant_config_add_option(self, "macsec_policy", "1", -1, NULL, error))
+ return FALSE;
+
+ value = nm_setting_macsec_get_encrypt(setting) ? "0" : "1";
+ if (!nm_supplicant_config_add_option(self, "macsec_integ_only", value, -1, NULL, error))
+ return FALSE;
+
+ port = nm_setting_macsec_get_port(setting);
+ if (port > 0 && port < 65534) {
+ snprintf(buf, sizeof(buf), "%d", port);
+ if (!nm_supplicant_config_add_option(self, "macsec_port", buf, -1, NULL, error))
+ return FALSE;
+ }
+
+ if (nm_setting_macsec_get_mode(setting) == NM_SETTING_MACSEC_MODE_PSK) {
+ guint8 buffer_cak[NM_SETTING_MACSEC_MKA_CAK_LENGTH / 2];
+ guint8 buffer_ckn[NM_SETTING_MACSEC_MKA_CKN_LENGTH / 2];
+
+ if (!nm_supplicant_config_add_option(self, "key_mgmt", "NONE", -1, NULL, error))
+ return FALSE;
+
+ value = nm_setting_macsec_get_mka_cak(setting);
+ if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_cak)) {
+ g_set_error_literal(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ value ? "invalid MKA CAK" : "missing MKA CAK");
+ return FALSE;
+ }
+ if (!nm_supplicant_config_add_option(self,
+ "mka_cak",
+ (char *) buffer_cak,
+ sizeof(buffer_cak),
+ "<hidden>",
+ error))
+ return FALSE;
+
+ value = nm_setting_macsec_get_mka_ckn(setting);
+ if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_ckn)) {
+ g_set_error_literal(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ value ? "invalid MKA CKN" : "missing MKA CKN");
+ return FALSE;
+ }
+ if (!nm_supplicant_config_add_option(self,
+ "mka_ckn",
+ (char *) buffer_ckn,
+ sizeof(buffer_ckn),
+ value,
+ error))
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,
+ NMSettingWireless * setting,
+ guint32 fixed_freq,
+ GError ** error)
+{
+ NMSupplicantConfigPrivate *priv;
+ gboolean is_adhoc, is_ap, is_mesh;
+ const char * mode, *band;
+ guint32 channel;
+ GBytes * ssid;
+ const char * bssid;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(setting != NULL, FALSE);
+ g_return_val_if_fail(!error || !*error, FALSE);
+
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ mode = nm_setting_wireless_get_mode(setting);
+ is_adhoc = nm_streq0(mode, "adhoc");
+ is_ap = nm_streq0(mode, "ap");
+ is_mesh = nm_streq0(mode, "mesh");
+ if (is_adhoc || is_ap)
+ priv->ap_scan = 2;
+ else
+ priv->ap_scan = 1;
+
+ ssid = nm_setting_wireless_get_ssid(setting);
+ if (!nm_supplicant_config_add_option(self,
+ "ssid",
+ (char *) g_bytes_get_data(ssid, NULL),
+ g_bytes_get_size(ssid),
+ NULL,
+ error))
+ return FALSE;
+
+ if (is_adhoc) {
+ if (!nm_supplicant_config_add_option(self, "mode", "1", -1, NULL, error))
+ return FALSE;
+ }
+
+ if (is_ap) {
+ if (!nm_supplicant_config_add_option(self, "mode", "2", -1, NULL, error))
+ return FALSE;
+
+ if (nm_setting_wireless_get_hidden(setting)
+ && !nm_supplicant_config_add_option(self,
+ "ignore_broadcast_ssid",
+ "1",
+ -1,
+ NULL,
+ error))
+ return FALSE;
+ }
+
+ if (is_mesh) {
+ if (!nm_supplicant_config_add_option(self, "mode", "5", -1, NULL, error))
+ return FALSE;
+ }
+
+ if ((is_adhoc || is_ap || is_mesh) && fixed_freq) {
+ gs_free char *str_freq = NULL;
+
+ str_freq = g_strdup_printf("%u", fixed_freq);
+ if (!nm_supplicant_config_add_option(self, "frequency", str_freq, -1, NULL, error))
+ return FALSE;
+ }
+
+ /* Except for Ad-Hoc, Hotspot and Mesh, request that the driver probe for the
+ * specific SSID we want to associate with.
+ */
+ if (!(is_adhoc || is_ap || is_mesh)) {
+ if (!nm_supplicant_config_add_option(self, "scan_ssid", "1", -1, NULL, error))
+ return FALSE;
+ }
+
+ bssid = nm_setting_wireless_get_bssid(setting);
+ if (bssid) {
+ if (!nm_supplicant_config_add_option(self, "bssid", bssid, strlen(bssid), NULL, error))
+ return FALSE;
+ }
+
+ band = nm_setting_wireless_get_band(setting);
+ channel = nm_setting_wireless_get_channel(setting);
+ if (band) {
+ if (channel) {
+ guint32 freq;
+ gs_free char *str_freq = NULL;
+
+ freq = nm_utils_wifi_channel_to_freq(channel, band);
+ str_freq = g_strdup_printf("%u", freq);
+ if (!nm_supplicant_config_add_option(self, "freq_list", str_freq, -1, NULL, error))
+ return FALSE;
+ } else {
+ const char *freqs = NULL;
+
+ if (nm_streq(band, "a"))
+ freqs = wifi_freqs_to_string(FALSE);
+ else if (nm_streq(band, "bg"))
+ freqs = wifi_freqs_to_string(TRUE);
+
+ if (freqs
+ && !nm_supplicant_config_add_option(self,
+ "freq_list",
+ freqs,
+ strlen(freqs),
+ NULL,
+ error))
+ return FALSE;
+ }
+ }
+
+ return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error)
+{
+ NMSettingWireless * s_wifi;
+ NMSettingWirelessSecurity *s_wsec;
+ const char * bgscan;
+
+ s_wifi = nm_connection_get_setting_wireless(connection);
+ g_assert(s_wifi);
+
+ /* Don't scan when a shared connection (either AP or Ad-Hoc) is active;
+ * it will disrupt connected clients.
+ */
+ if (NM_IN_STRSET(nm_setting_wireless_get_mode(s_wifi),
+ NM_SETTING_WIRELESS_MODE_AP,
+ NM_SETTING_WIRELESS_MODE_ADHOC))
+ return TRUE;
+
+ /* Don't scan when the connection is locked to a specific AP, since
+ * intra-ESS roaming (which requires periodic scanning) isn't being
+ * used due to the specific AP lock. (bgo #513820)
+ */
+ if (nm_setting_wireless_get_bssid(s_wifi))
+ return TRUE;
+
+ /* Default to a very long bgscan interval when signal is OK on the assumption
+ * that either (a) there aren't multiple APs and we don't need roaming, or
+ * (b) since EAP/802.1x isn't used and thus there are fewer steps to fail
+ * during a roam, we can wait longer before scanning for roam candidates.
+ */
+ bgscan = "simple:30:-70:86400";
+
+ /* If using WPA Enterprise, Dynamic WEP or we have seen more than one AP use
+ * a shorter bgscan interval on the assumption that this is a multi-AP ESS
+ * in which we want more reliable roaming between APs. Thus trigger scans
+ * when the signal is still somewhat OK so we have an up-to-date roam
+ * candidate list when the signal gets bad.
+ */
+ if (nm_setting_wireless_get_num_seen_bssids(s_wifi) > 1
+ || ((s_wsec = nm_connection_get_setting_wireless_security(connection))
+ && NM_IN_STRSET(nm_setting_wireless_security_get_key_mgmt(s_wsec),
+ "ieee8021x",
+ "wpa-eap",
+ "wpa-eap-suite-b-192")))
+ bgscan = "simple:30:-65:300";
+
+ return nm_supplicant_config_add_option(self, "bgscan", bgscan, -1, FALSE, error);
+}
+
+static gboolean
+add_string_val(NMSupplicantConfig *self,
+ const char * field,
+ const char * name,
+ gboolean ucase,
+ const char * display_value,
+ GError ** error)
+{
+ if (field) {
+ gs_free char *value = NULL;
+
+ if (ucase) {
+ value = g_ascii_strup(field, -1);
+ field = value;
+ }
+ return nm_supplicant_config_add_option(self,
+ name,
+ field,
+ strlen(field),
+ display_value,
+ error);
+ }
+ return TRUE;
+}
+
+#define ADD_STRING_LIST_VAL(self, \
+ setting, \
+ setting_name, \
+ field, \
+ field_plural, \
+ name, \
+ separator, \
+ ucase, \
+ display_value, \
+ error) \
+ ({ \
+ typeof(*(setting)) *_setting = (setting); \
+ gboolean _success = TRUE; \
+ \
+ if (nm_setting_##setting_name##_get_num_##field_plural(_setting)) { \
+ const char _separator = (separator); \
+ GString * _str = g_string_new(NULL); \
+ guint _k, _n; \
+ \
+ _n = nm_setting_##setting_name##_get_num_##field_plural(_setting); \
+ for (_k = 0; _k < _n; _k++) { \
+ const char *item = nm_setting_##setting_name##_get_##field(_setting, _k); \
+ \
+ if (!_str->len) { \
+ g_string_append(_str, item); \
+ } else { \
+ g_string_append_c(_str, _separator); \
+ g_string_append(_str, item); \
+ } \
+ } \
+ if ((ucase)) \
+ g_string_ascii_up(_str); \
+ if (_str->len) { \
+ if (!nm_supplicant_config_add_option((self), \
+ (name), \
+ _str->str, \
+ -1, \
+ (display_value), \
+ (error))) \
+ _success = FALSE; \
+ } \
+ g_string_free(_str, TRUE); \
+ } \
+ _success; \
+ })
+
+static void
+wep128_passphrase_hash(const char *input, gsize input_len, guint8 *digest /* 13 bytes */)
+{
+ nm_auto_free_checksum GChecksum *sum = NULL;
+ guint8 md5[NM_UTILS_CHECKSUM_LENGTH_MD5];
+ guint8 data[64];
+ int i;
+
+ nm_assert(input);
+ nm_assert(input_len);
+ nm_assert(digest);
+
+ /* Get at least 64 bytes by repeating the passphrase into the buffer */
+ for (i = 0; i < sizeof(data); i++)
+ data[i] = input[i % input_len];
+
+ sum = g_checksum_new(G_CHECKSUM_MD5);
+ g_checksum_update(sum, data, sizeof(data));
+ nm_utils_checksum_get_digest(sum, md5);
+
+ /* WEP104 keys are 13 bytes in length (26 hex characters) */
+ memcpy(digest, md5, 13);
+}
+
+static gboolean
+add_wep_key(NMSupplicantConfig *self,
+ const char * key,
+ const char * name,
+ NMWepKeyType wep_type,
+ GError ** error)
+{
+ gsize key_len;
+
+ if (!key || (key_len = strlen(key)) == 0)
+ return TRUE;
+
+ if (wep_type == NM_WEP_KEY_TYPE_UNKNOWN) {
+ if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_KEY))
+ wep_type = NM_WEP_KEY_TYPE_KEY;
+ else if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_PASSPHRASE))
+ wep_type = NM_WEP_KEY_TYPE_PASSPHRASE;
+ }
+
+ if ((wep_type == NM_WEP_KEY_TYPE_UNKNOWN) || (wep_type == NM_WEP_KEY_TYPE_KEY)) {
+ if ((key_len == 10) || (key_len == 26)) {
+ guint8 buffer[26 / 2];
+
+ if (!nm_utils_hexstr2bin_full(key,
+ FALSE,
+ FALSE,
+ FALSE,
+ NULL,
+ key_len / 2,
+ buffer,
+ sizeof(buffer),
+ NULL)) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "cannot add wep-key %s to supplicant config because key is not hex",
+ name);
+ return FALSE;
+ }
+ if (!nm_supplicant_config_add_option(self,
+ name,
+ (char *) buffer,
+ key_len / 2,
+ "<hidden>",
+ error))
+ return FALSE;
+ } else if ((key_len == 5) || (key_len == 13)) {
+ if (!nm_supplicant_config_add_option(self, name, key, key_len, "<hidden>", error))
+ return FALSE;
+ } else {
+ g_set_error(
+ error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Cannot add wep-key %s to supplicant config because key-length %u is invalid",
+ name,
+ (guint) key_len);
+ return FALSE;
+ }
+ } else if (wep_type == NM_WEP_KEY_TYPE_PASSPHRASE) {
+ guint8 digest[13];
+
+ wep128_passphrase_hash(key, key_len, digest);
+ if (!nm_supplicant_config_add_option(self,
+ name,
+ (const char *) digest,
+ sizeof(digest),
+ "<hidden>",
+ error))
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig * self,
+ NMSettingWirelessSecurity * setting,
+ NMSetting8021x * setting_8021x,
+ const char * con_uuid,
+ guint32 mtu,
+ NMSettingWirelessSecurityPmf pmf,
+ NMSettingWirelessSecurityFils fils,
+ GError ** error)
+{
+ NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+ nm_auto_free_gstring GString *key_mgmt_conf = NULL;
+ const char * key_mgmt, *auth_alg;
+ const char * psk;
+ gboolean set_pmf;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(setting != NULL, FALSE);
+ g_return_val_if_fail(con_uuid != NULL, FALSE);
+ g_return_val_if_fail(!error || !*error, FALSE);
+
+ /* Check if we actually support FILS */
+ if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_FILS)) {
+ if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED) {
+ g_set_error_literal(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Supplicant does not support FILS");
+ return FALSE;
+ } else if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL)
+ fils = NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE;
+ }
+
+ key_mgmt = nm_setting_wireless_security_get_key_mgmt(setting);
+ key_mgmt_conf = g_string_new(key_mgmt);
+ if (nm_streq(key_mgmt, "wpa-psk")) {
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+ g_string_append(key_mgmt_conf, " wpa-psk-sha256");
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+ g_string_append(key_mgmt_conf, " ft-psk");
+ } else if (nm_streq(key_mgmt, "wpa-eap")) {
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {
+ g_string_append(key_mgmt_conf, " wpa-eap-sha256");
+
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SUITEB192)
+ && pmf == NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED)
+ g_string_append(key_mgmt_conf, " wpa-eap-suite-b-192");
+ }
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+ g_string_append(key_mgmt_conf, " ft-eap");
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)
+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))
+ g_string_append(key_mgmt_conf, " ft-eap-sha384");
+ switch (fils) {
+ case NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED:
+ g_string_truncate(key_mgmt_conf, 0);
+ if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+ g_string_assign(key_mgmt_conf, "fils-sha256 fils-sha384");
+ /* fall-through */
+ case NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL:
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))
+ g_string_append(key_mgmt_conf, " fils-sha256 fils-sha384");
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)
+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+ g_string_append(key_mgmt_conf, " ft-fils-sha256");
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)
+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT)
+ && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))
+ g_string_append(key_mgmt_conf, " ft-fils-sha384");
+ break;
+ default:
+ break;
+ }
+ } else if (nm_streq(key_mgmt, "sae")) {
+ if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))
+ g_string_append(key_mgmt_conf, " ft-sae");
+ } else if (nm_streq(key_mgmt, "wpa-eap-suite-b-192")) {
+ pmf = NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED;
+ if (!nm_supplicant_config_add_option(self, "pairwise", "GCMP-256", -1, NULL, error)
+ || !nm_supplicant_config_add_option(self, "group", "GCMP-256", -1, NULL, error))
+ return FALSE;
+ }
+
+ if (!add_string_val(self, key_mgmt_conf->str, "key_mgmt", TRUE, NULL, error))
+ return FALSE;
+
+ auth_alg = nm_setting_wireless_security_get_auth_alg(setting);
+ if (!add_string_val(self, auth_alg, "auth_alg", TRUE, NULL, error))
+ return FALSE;
+
+ psk = nm_setting_wireless_security_get_psk(setting);
+ if (psk) {
+ size_t psk_len = strlen(psk);
+
+ if (psk_len >= 8 && psk_len <= 63) {
+ /* Use NM_SUPPL_OPT_TYPE_STRING here so that it gets pushed to the
+ * supplicant as a string, and therefore gets quoted,
+ * and therefore the supplicant will interpret it as a
+ * passphrase and not a hex key.
+ */
+ if (!nm_supplicant_config_add_option_with_type(self,
+ "psk",
+ psk,
+ -1,
+ NM_SUPPL_OPT_TYPE_STRING,
+ "<hidden>",
+ error))
+ return FALSE;
+ } else if (nm_streq(key_mgmt, "sae")) {
+ /* If the SAE password doesn't comply with WPA-PSK limitation,
+ * we need to call it "sae_password" instead of "psk".
+ */
+ if (!nm_supplicant_config_add_option_with_type(self,
+ "sae_password",
+ psk,
+ -1,
+ NM_SUPPL_OPT_TYPE_STRING,
+ "<hidden>",
+ error))
+ return FALSE;
+ } else if (psk_len == 64) {
+ guint8 buffer[32];
+
+ /* Hex PSK */
+ if (!nm_utils_hexstr2bin_buf(psk, FALSE, FALSE, NULL, buffer)) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Cannot add psk to supplicant config due to invalid hex");
+ return FALSE;
+ }
+ if (!nm_supplicant_config_add_option(self,
+ "psk",
+ (char *) buffer,
+ sizeof(buffer),
+ "<hidden>",
+ error))
+ return FALSE;
+ } else {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Cannot add psk to supplicant config due to invalid PSK length %u (not "
+ "between 8 and 63 characters)",
+ (guint) psk_len);
+ return FALSE;
+ }
+ }
+
+ /* Don't try to enable PMF on non-WPA/SAE/OWE networks */
+ if (!NM_IN_STRSET(key_mgmt, "wpa-eap", "wpa-eap-suite-b-192", "wpa-psk", "sae", "owe"))
+ pmf = NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE;
+
+ /* Check if we actually support PMF */
+ set_pmf = TRUE;
+ if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {
+ if (pmf == NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED) {
+ g_set_error_literal(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Supplicant does not support PMF");
+ return FALSE;
+ }
+ set_pmf = FALSE;
+ }
+
+ /* Only WPA-specific things when using WPA */
+ if (NM_IN_STRSET(key_mgmt, "wpa-psk", "wpa-eap", "sae", "owe")) {
+ if (!ADD_STRING_LIST_VAL(self,
+ setting,
+ wireless_security,
+ proto,
+ protos,
+ "proto",
+ ' ',
+ TRUE,
+ NULL,
+ error))
+ return FALSE;
+ if (!ADD_STRING_LIST_VAL(self,
+ setting,
+ wireless_security,
+ pairwise,
+ pairwise,
+ "pairwise",
+ ' ',
+ TRUE,
+ NULL,
+ error))
+ return FALSE;
+ if (!ADD_STRING_LIST_VAL(self,
+ setting,
+ wireless_security,
+ group,
+ groups,
+ "group",
+ ' ',
+ TRUE,
+ NULL,
+ error))
+ return FALSE;
+
+ if (set_pmf
+ && NM_IN_SET(pmf,
+ NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE,
+ NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED)) {
+ if (!nm_supplicant_config_add_option(
+ self,
+ "ieee80211w",
+ pmf == NM_SETTING_WIRELESS_SECURITY_PMF_DISABLE ? "0" : "2",
+ -1,
+ NULL,
+ error))
+ return FALSE;
+ }
+ }
+
+ /* WEP keys if required */
+ if (nm_streq(key_mgmt, "none")) {
+ NMWepKeyType wep_type = nm_setting_wireless_security_get_wep_key_type(setting);
+ const char * wep0 = nm_setting_wireless_security_get_wep_key(setting, 0);
+ const char * wep1 = nm_setting_wireless_security_get_wep_key(setting, 1);
+ const char * wep2 = nm_setting_wireless_security_get_wep_key(setting, 2);
+ const char * wep3 = nm_setting_wireless_security_get_wep_key(setting, 3);
+
+ if (!add_wep_key(self, wep0, "wep_key0", wep_type, error))
+ return FALSE;
+ if (!add_wep_key(self, wep1, "wep_key1", wep_type, error))
+ return FALSE;
+ if (!add_wep_key(self, wep2, "wep_key2", wep_type, error))
+ return FALSE;
+ if (!add_wep_key(self, wep3, "wep_key3", wep_type, error))
+ return FALSE;
+
+ if (wep0 || wep1 || wep2 || wep3) {
+ gs_free char *value = NULL;
+
+ value = g_strdup_printf("%d", nm_setting_wireless_security_get_wep_tx_keyidx(setting));
+ if (!nm_supplicant_config_add_option(self, "wep_tx_keyidx", value, -1, NULL, error))
+ return FALSE;
+ }
+ }
+
+ if (nm_streq0(auth_alg, "leap")) {
+ /* LEAP */
+ if (nm_streq(key_mgmt, "ieee8021x")) {
+ const char *tmp;
+
+ tmp = nm_setting_wireless_security_get_leap_username(setting);
+ if (!add_string_val(self, tmp, "identity", FALSE, NULL, error))
+ return FALSE;
+
+ tmp = nm_setting_wireless_security_get_leap_password(setting);
+ if (!add_string_val(self, tmp, "password", FALSE, "<hidden>", error))
+ return FALSE;
+
+ if (!add_string_val(self, "leap", "eap", TRUE, NULL, error))
+ return FALSE;
+ } else {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Invalid key-mgmt \"%s\" for leap",
+ key_mgmt);
+ return FALSE;
+ }
+ } else {
+ /* 802.1x for Dynamic WEP and WPA-Enterprise */
+ if (NM_IN_STRSET(key_mgmt, "ieee8021x", "wpa-eap", "wpa-eap-suite-b-192")) {
+ if (!setting_8021x) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Cannot set key-mgmt %s with missing 8021x setting",
+ key_mgmt);
+ return FALSE;
+ }
+ if (!nm_supplicant_config_add_setting_8021x(self,
+ setting_8021x,
+ con_uuid,
+ mtu,
+ FALSE,
+ error))
+ return FALSE;
+ }
+
+ if (NM_IN_STRSET(key_mgmt, "wpa-eap", "wpa-eap-suite-b-192")) {
+ /* When using WPA-Enterprise, we want to use Proactive Key Caching (also
+ * called Opportunistic Key Caching) to avoid full EAP exchanges when
+ * roaming between access points in the same mobility group.
+ */
+ if (!nm_supplicant_config_add_option(self,
+ "proactive_key_caching",
+ "1",
+ -1,
+ NULL,
+ error))
+ return FALSE;
+ }
+ }
+
+ return TRUE;
+}
+
+static gboolean
+add_pkcs11_uri_with_pin(NMSupplicantConfig * self,
+ const char * name,
+ const char * uri,
+ const char * pin,
+ const NMSettingSecretFlags pin_flags,
+ GError ** error)
+{
+ gs_strfreev char **split = NULL;
+ gs_free char * tmp = NULL;
+ gs_free char * tmp_log = NULL;
+ gs_free char * pin_qattr = NULL;
+ char * escaped = NULL;
+
+ if (uri == NULL)
+ return TRUE;
+
+ /* We ignore the attributes -- RFC 7512 suggests that some of them
+ * might be unsafe and we want to be on the safe side. Also, we're
+ * installing our attributes, so this makes things a bit easier for us. */
+ split = g_strsplit(uri, "&", 2);
+ if (split[1])
+ nm_log_info(LOGD_SUPPLICANT, "URI attributes ignored");
+
+ /* Fill in the PIN if required. */
+ if (pin) {
+ escaped = g_uri_escape_string(pin, NULL, TRUE);
+ pin_qattr = g_strdup_printf("pin-value=%s", escaped);
+ g_free(escaped);
+ } else if (!(pin_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED)) {
+ /* Include an empty PIN to indicate the login is still needed.
+ * Probably a token that has a PIN path and the actual PIN will
+ * be entered using a protected path. */
+ pin_qattr = g_strdup("pin-value=");
+ }
+
+ tmp = g_strdup_printf("%s%s%s", split[0], (pin_qattr ? "?" : ""), (pin_qattr ?: ""));
+
+ tmp_log = g_strdup_printf("%s%s%s",
+ split[0],
+ (pin_qattr ? "?" : ""),
+ (pin_qattr ? "pin-value=<hidden>" : ""));
+
+ return add_string_val(self, tmp, name, FALSE, tmp_log, error);
+}
+
+gboolean
+nm_supplicant_config_add_setting_8021x(NMSupplicantConfig *self,
+ NMSetting8021x * setting,
+ const char * con_uuid,
+ guint32 mtu,
+ gboolean wired,
+ GError ** error)
+{
+ NMSupplicantConfigPrivate *priv;
+ char * tmp;
+ const char * peapver, *value, *path;
+ gboolean added;
+ GString * phase1, *phase2;
+ GBytes * bytes;
+ gboolean fast = FALSE;
+ guint32 i, num_eap;
+ gboolean fast_provisoning_allowed = FALSE;
+ const char * ca_path_override = NULL, *ca_cert_override = NULL;
+ guint32 frag, hdrs;
+ gs_free char * frag_str = NULL;
+ NMSetting8021xAuthFlags phase1_auth_flags;
+ nm_auto_free_gstring GString *eap_str = NULL;
+
+ g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);
+ g_return_val_if_fail(setting != NULL, FALSE);
+ g_return_val_if_fail(con_uuid != NULL, FALSE);
+
+ priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);
+
+ value = nm_setting_802_1x_get_password(setting);
+ if (value) {
+ if (!add_string_val(self, value, "password", FALSE, "<hidden>", error))
+ return FALSE;
+ } else {
+ bytes = nm_setting_802_1x_get_password_raw(setting);
+ if (bytes) {
+ if (!nm_supplicant_config_add_option(self,
+ "password",
+ (const char *) g_bytes_get_data(bytes, NULL),
+ g_bytes_get_size(bytes),
+ "<hidden>",
+ error))
+ return FALSE;
+ }
+ }
+ value = nm_setting_802_1x_get_pin(setting);
+ if (!add_string_val(self, value, "pin", FALSE, "<hidden>", error))
+ return FALSE;
+
+ if (wired) {
+ if (!add_string_val(self, "IEEE8021X", "key_mgmt", FALSE, NULL, error))
+ return FALSE;
+ /* Wired 802.1x must always use eapol_flags=0 */
+ if (!add_string_val(self, "0", "eapol_flags", FALSE, NULL, error))
+ return FALSE;
+ priv->ap_scan = 0;
+ }
+
+ /* Build the "eap" option string while we check for EAP methods needing
+ * special handling: PEAP + GTC, FAST, external */
+ eap_str = g_string_new(NULL);
+ num_eap = nm_setting_802_1x_get_num_eap_methods(setting);
+ for (i = 0; i < num_eap; i++) {
+ const char *method = nm_setting_802_1x_get_eap_method(setting, i);
+
+ if (nm_streq(method, "fast")) {
+ fast = TRUE;
+ priv->fast_required = TRUE;
+ }
+
+ if (nm_streq(method, "external")) {
+ if (num_eap == 1) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "Connection settings managed externally to NM, connection"
+ " cannot be used with wpa_supplicant");
+ return FALSE;
+ }
+ continue;
+ }
+
+ if (eap_str->len)
+ g_string_append_c(eap_str, ' ');
+ g_string_append(eap_str, method);
+ }
+
+ g_string_ascii_up(eap_str);
+ if (eap_str->len
+ && !nm_supplicant_config_add_option(self, "eap", eap_str->str, -1, NULL, error))
+ return FALSE;
+
+ /* Adjust the fragment size according to MTU, but do not set it higher than 1280-14
+ * for better compatibility */
+ hdrs = 14; /* EAPOL + EAP-TLS */
+ frag = 1280 - hdrs;
+ if (mtu > hdrs)
+ frag = CLAMP(mtu - hdrs, 100, frag);
+ frag_str = g_strdup_printf("%u", frag);
+
+ if (!nm_supplicant_config_add_option(self, "fragment_size", frag_str, -1, NULL, error))
+ return FALSE;
+
+ phase1 = g_string_new(NULL);
+ peapver = nm_setting_802_1x_get_phase1_peapver(setting);
+ if (peapver) {
+ if (nm_streq(peapver, "0"))
+ g_string_append(phase1, "peapver=0");
+ else if (nm_streq(peapver, "1"))
+ g_string_append(phase1, "peapver=1");
+ }
+
+ if (nm_setting_802_1x_get_phase1_peaplabel(setting)) {
+ if (phase1->len)
+ g_string_append_c(phase1, ' ');
+ g_string_append_printf(phase1,
+ "peaplabel=%s",
+ nm_setting_802_1x_get_phase1_peaplabel(setting));
+ }
+
+ value = nm_setting_802_1x_get_phase1_fast_provisioning(setting);
+ if (value) {
+ if (phase1->len)
+ g_string_append_c(phase1, ' ');
+ g_string_append_printf(phase1, "fast_provisioning=%s", value);
+
+ if (!nm_streq(value, "0"))
+ fast_provisoning_allowed = TRUE;
+ }
+
+ phase1_auth_flags = nm_setting_802_1x_get_phase1_auth_flags(setting);
+ if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_0_DISABLE))
+ g_string_append_printf(phase1, "%stls_disable_tlsv1_0=1", (phase1->len ? " " : ""));
+ if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_1_DISABLE))
+ g_string_append_printf(phase1, "%stls_disable_tlsv1_1=1", (phase1->len ? " " : ""));
+ if (NM_FLAGS_HAS(phase1_auth_flags, NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_2_DISABLE))
+ g_string_append_printf(phase1, "%stls_disable_tlsv1_2=1", (phase1->len ? " " : ""));
+
+ if (phase1->len) {
+ if (!add_string_val(self, phase1->str, "phase1", FALSE, NULL, error)) {
+ g_string_free(phase1, TRUE);
+ return FALSE;
+ }
+ }
+ g_string_free(phase1, TRUE);
+
+ phase2 = g_string_new(NULL);
+ if (nm_setting_802_1x_get_phase2_auth(setting) && !fast_provisoning_allowed) {
+ tmp = g_ascii_strup(nm_setting_802_1x_get_phase2_auth(setting), -1);
+ g_string_append_printf(phase2, "auth=%s", tmp);
+ g_free(tmp);
+ }
+
+ if (nm_setting_802_1x_get_phase2_autheap(setting)) {
+ if (phase2->len)
+ g_string_append_c(phase2, ' ');
+ tmp = g_ascii_strup(nm_setting_802_1x_get_phase2_autheap(setting), -1);
+ g_string_append_printf(phase2, "autheap=%s", tmp);
+ g_free(tmp);
+ }
+
+ if (phase2->len) {
+ if (!add_string_val(self, phase2->str, "phase2", FALSE, NULL, error)) {
+ g_string_free(phase2, TRUE);
+ return FALSE;
+ }
+ }
+ g_string_free(phase2, TRUE);
+
+ /* PAC file */
+ path = nm_setting_802_1x_get_pac_file(setting);
+ if (path) {
+ if (!add_string_val(self, path, "pac_file", FALSE, NULL, error))
+ return FALSE;
+ } else {
+ /* PAC file is not specified.
+ * If provisioning is allowed, use an blob format.
+ */
+ if (fast_provisoning_allowed) {
+ gs_free char *blob_name = NULL;
+
+ blob_name = g_strdup_printf("blob://pac-blob-%s", con_uuid);
+ if (!add_string_val(self, blob_name, "pac_file", FALSE, NULL, error))
+ return FALSE;
+ } else {
+ /* This is only error for EAP-FAST; don't disturb other methods. */
+ if (fast) {
+ g_set_error(error,
+ NM_SUPPLICANT_ERROR,
+ NM_SUPPLICANT_ERROR_CONFIG,
+ "EAP-FAST error: no PAC file provided and "
+ "automatic PAC provisioning is disabled");
+ return FALSE;
+ }
+ }
+ }
+
+ /* If user wants to use system CA certs, either populate ca_path (if the path
+ * is a directory) or ca_cert (the path is a file name) */
+ if (nm_setting_802_1x_get_system_ca_certs(setting)) {
+ if (g_file_test(SYSTEM_CA_PATH, G_FILE_TEST_IS_DIR))
+ ca_path_override = SYSTEM_CA_PATH;
+ else
+ ca_cert_override = SYSTEM_CA_PATH;
+ }
+
+ /* CA path */
+ path = nm_setting_802_1x_get_ca_path(setting);
+ path = ca_path_override ?: path;
+ if (path) {
+ if (!add_string_val(self, path, "ca_path", FALSE, NULL, error))
+ return FALSE;
+ }
+
+ /* Phase2 CA path */
+ path = nm_setting_802_1x_get_phase2_ca_path(setting);
+ path = ca_path_override ?: path;
+ if (path) {
+ if (!add_string_val(self, path, "ca_path2", FALSE, NULL, error))
+ return FALSE;
+ }
+
+ /* CA certificate */
+ if (ca_cert_override) {
+ if (!add_string_val(self, ca_cert_override, "ca_cert", FALSE, NULL, error))
+ return FALSE;
+ } else {
+ switch (nm_setting_802_1x_get_ca_cert_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_ca_cert_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "ca_cert",
+ con_uuid,
+ error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_ca_cert_path(setting);
+ if (!add_string_val(self, path, "ca_cert", FALSE, NULL, error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(self,
+ "ca_cert",
+ nm_setting_802_1x_get_ca_cert_uri(setting),
+ nm_setting_802_1x_get_ca_cert_password(setting),
+ nm_setting_802_1x_get_ca_cert_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+
+ /* Phase 2 CA certificate */
+ if (ca_cert_override) {
+ if (!add_string_val(self, ca_cert_override, "ca_cert2", FALSE, NULL, error))
+ return FALSE;
+ } else {
+ switch (nm_setting_802_1x_get_phase2_ca_cert_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_phase2_ca_cert_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "ca_cert2",
+ con_uuid,
+ error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_phase2_ca_cert_path(setting);
+ if (!add_string_val(self, path, "ca_cert2", FALSE, NULL, error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(
+ self,
+ "ca_cert2",
+ nm_setting_802_1x_get_phase2_ca_cert_uri(setting),
+ nm_setting_802_1x_get_phase2_ca_cert_password(setting),
+ nm_setting_802_1x_get_phase2_ca_cert_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+
+ /* Subject match */
+ value = nm_setting_802_1x_get_subject_match(setting);
+ if (!add_string_val(self, value, "subject_match", FALSE, NULL, error))
+ return FALSE;
+ value = nm_setting_802_1x_get_phase2_subject_match(setting);
+ if (!add_string_val(self, value, "subject_match2", FALSE, NULL, error))
+ return FALSE;
+
+ /* altSubjectName match */
+ if (!ADD_STRING_LIST_VAL(self,
+ setting,
+ 802_1x,
+ altsubject_match,
+ altsubject_matches,
+ "altsubject_match",
+ ';',
+ FALSE,
+ NULL,
+ error))
+ return FALSE;
+ if (!ADD_STRING_LIST_VAL(self,
+ setting,
+ 802_1x,
+ phase2_altsubject_match,
+ phase2_altsubject_matches,
+ "altsubject_match2",
+ ';',
+ FALSE,
+ NULL,
+ error))
+ return FALSE;
+
+ /* Domain suffix match */
+ value = nm_setting_802_1x_get_domain_suffix_match(setting);
+ if (!add_string_val(self, value, "domain_suffix_match", FALSE, NULL, error))
+ return FALSE;
+ value = nm_setting_802_1x_get_phase2_domain_suffix_match(setting);
+ if (!add_string_val(self, value, "domain_suffix_match2", FALSE, NULL, error))
+ return FALSE;
+
+ /* domain match */
+ value = nm_setting_802_1x_get_domain_match(setting);
+ if (!add_string_val(self, value, "domain_match", FALSE, NULL, error))
+ return FALSE;
+ value = nm_setting_802_1x_get_phase2_domain_match(setting);
+ if (!add_string_val(self, value, "domain_match2", FALSE, NULL, error))
+ return FALSE;
+
+ /* Private key */
+ added = FALSE;
+ switch (nm_setting_802_1x_get_private_key_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_private_key_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "private_key",
+ con_uuid,
+ error))
+ return FALSE;
+ added = TRUE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_private_key_path(setting);
+ if (!add_string_val(self, path, "private_key", FALSE, NULL, error))
+ return FALSE;
+ added = TRUE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(self,
+ "private_key",
+ nm_setting_802_1x_get_private_key_uri(setting),
+ nm_setting_802_1x_get_private_key_password(setting),
+ nm_setting_802_1x_get_private_key_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ added = TRUE;
+ break;
+ default:
+ break;
+ }
+
+ if (added) {
+ NMSetting8021xCKFormat format;
+ NMSetting8021xCKScheme scheme;
+
+ format = nm_setting_802_1x_get_private_key_format(setting);
+ scheme = nm_setting_802_1x_get_private_key_scheme(setting);
+
+ if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
+ || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+ /* Only add the private key password for PKCS#12 blobs and
+ * all path schemes, since in both of these cases the private key
+ * isn't decrypted at all.
+ */
+ value = nm_setting_802_1x_get_private_key_password(setting);
+ if (!add_string_val(self, value, "private_key_passwd", FALSE, "<hidden>", error))
+ return FALSE;
+ }
+
+ if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+ /* Only add the client cert if the private key is not PKCS#12, as
+ * wpa_supplicant configuration directs us to do.
+ */
+ switch (nm_setting_802_1x_get_client_cert_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_client_cert_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "client_cert",
+ con_uuid,
+ error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_client_cert_path(setting);
+ if (!add_string_val(self, path, "client_cert", FALSE, NULL, error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(
+ self,
+ "client_cert",
+ nm_setting_802_1x_get_client_cert_uri(setting),
+ nm_setting_802_1x_get_client_cert_password(setting),
+ nm_setting_802_1x_get_client_cert_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ }
+
+ /* Phase 2 private key */
+ added = FALSE;
+ switch (nm_setting_802_1x_get_phase2_private_key_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_phase2_private_key_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "private_key2",
+ con_uuid,
+ error))
+ return FALSE;
+ added = TRUE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_phase2_private_key_path(setting);
+ if (!add_string_val(self, path, "private_key2", FALSE, NULL, error))
+ return FALSE;
+ added = TRUE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(
+ self,
+ "private_key2",
+ nm_setting_802_1x_get_phase2_private_key_uri(setting),
+ nm_setting_802_1x_get_phase2_private_key_password(setting),
+ nm_setting_802_1x_get_phase2_private_key_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ added = TRUE;
+ break;
+ default:
+ break;
+ }
+
+ if (added) {
+ NMSetting8021xCKFormat format;
+ NMSetting8021xCKScheme scheme;
+
+ format = nm_setting_802_1x_get_phase2_private_key_format(setting);
+ scheme = nm_setting_802_1x_get_phase2_private_key_scheme(setting);
+
+ if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
+ || format == NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+ /* Only add the private key password for PKCS#12 blobs and
+ * all path schemes, since in both of these cases the private key
+ * isn't decrypted at all.
+ */
+ value = nm_setting_802_1x_get_phase2_private_key_password(setting);
+ if (!add_string_val(self, value, "private_key2_passwd", FALSE, "<hidden>", error))
+ return FALSE;
+ }
+
+ if (format != NM_SETTING_802_1X_CK_FORMAT_PKCS12) {
+ /* Only add the client cert if the private key is not PKCS#12, as
+ * wpa_supplicant configuration directs us to do.
+ */
+ switch (nm_setting_802_1x_get_phase2_client_cert_scheme(setting)) {
+ case NM_SETTING_802_1X_CK_SCHEME_BLOB:
+ bytes = nm_setting_802_1x_get_phase2_client_cert_blob(setting);
+ if (!nm_supplicant_config_add_blob_for_connection(self,
+ bytes,
+ "client_cert2",
+ con_uuid,
+ error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PATH:
+ path = nm_setting_802_1x_get_phase2_client_cert_path(setting);
+ if (!add_string_val(self, path, "client_cert2", FALSE, NULL, error))
+ return FALSE;
+ break;
+ case NM_SETTING_802_1X_CK_SCHEME_PKCS11:
+ if (!add_pkcs11_uri_with_pin(
+ self,
+ "client_cert2",
+ nm_setting_802_1x_get_phase2_client_cert_uri(setting),
+ nm_setting_802_1x_get_phase2_client_cert_password(setting),
+ nm_setting_802_1x_get_phase2_client_cert_password_flags(setting),
+ error)) {
+ return FALSE;
+ }
+ break;
+ default:
+ break;
+ }
+ }
+ }
+
+ value = nm_setting_802_1x_get_identity(setting);
+ if (!add_string_val(self, value, "identity", FALSE, NULL, error))
+ return FALSE;
+ value = nm_setting_802_1x_get_anonymous_identity(setting);
+ if (!add_string_val(self, value, "anonymous_identity", FALSE, NULL, error))
+ return FALSE;
+
+ return TRUE;
+}
+
+gboolean
+nm_supplicant_config_add_no_security(NMSupplicantConfig *self, GError **error)
+{
+ return nm_supplicant_config_add_option(self, "key_mgmt", "NONE", -1, NULL, error);
+}
+
+gboolean
+nm_supplicant_config_get_ap_isolation(NMSupplicantConfig *self)
+{
+ return self->_priv.ap_isolation;
+}
+
+void
+nm_supplicant_config_set_ap_isolation(NMSupplicantConfig *self, gboolean ap_isolation)
+{
+ self->_priv.ap_isolation = ap_isolation;
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-22 11:10:55 +0000