diff options
Diffstat (limited to 'libnm-core/nm-setting-8021x.c')
| -rw-r--r-- | libnm-core/nm-setting-8021x.c | 6049 |
1 files changed, 3076 insertions, 2973 deletions
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c index f6dbda63..d3dc251a 100644 --- a/libnm-core/nm-setting-8021x.c +++ b/libnm-core/nm-setting-8021x.c @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: LGPL-2.1+ +/* SPDX-License-Identifier: LGPL-2.1+ */ /* * Copyright (C) 2007 - 2013 Red Hat, Inc. * Copyright (C) 2007 - 2008 Novell, Inc. @@ -46,143 +46,144 @@ /*****************************************************************************/ static NMSetting8021xCKFormat -_crypto_format_to_ck (NMCryptoFileFormat format) +_crypto_format_to_ck(NMCryptoFileFormat format) { - G_STATIC_ASSERT ( (NM_SETTING_802_1X_CK_FORMAT_UNKNOWN == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_UNKNOWN) ); - G_STATIC_ASSERT ( (NM_SETTING_802_1X_CK_FORMAT_X509 == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_X509) ); - G_STATIC_ASSERT ( (NM_SETTING_802_1X_CK_FORMAT_RAW_KEY == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_RAW_KEY) ); - G_STATIC_ASSERT ( (NM_SETTING_802_1X_CK_FORMAT_PKCS12 == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_PKCS12) ); - - nm_assert (NM_IN_SET (format, NM_CRYPTO_FILE_FORMAT_UNKNOWN, - NM_CRYPTO_FILE_FORMAT_X509, - NM_CRYPTO_FILE_FORMAT_RAW_KEY, - NM_CRYPTO_FILE_FORMAT_PKCS12)); - return (NMSetting8021xCKFormat) format; + G_STATIC_ASSERT((NM_SETTING_802_1X_CK_FORMAT_UNKNOWN + == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_UNKNOWN)); + G_STATIC_ASSERT( + (NM_SETTING_802_1X_CK_FORMAT_X509 == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_X509)); + G_STATIC_ASSERT((NM_SETTING_802_1X_CK_FORMAT_RAW_KEY + == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_RAW_KEY)); + G_STATIC_ASSERT((NM_SETTING_802_1X_CK_FORMAT_PKCS12 + == (NMSetting8021xCKFormat) NM_CRYPTO_FILE_FORMAT_PKCS12)); + + nm_assert(NM_IN_SET(format, + NM_CRYPTO_FILE_FORMAT_UNKNOWN, + NM_CRYPTO_FILE_FORMAT_X509, + NM_CRYPTO_FILE_FORMAT_RAW_KEY, + NM_CRYPTO_FILE_FORMAT_PKCS12)); + return (NMSetting8021xCKFormat) format; } /*****************************************************************************/ -typedef void (*EAPMethodNeedSecretsFunc) (NMSetting8021x *self, - GPtrArray *secrets, - gboolean phase2); +typedef void (*EAPMethodNeedSecretsFunc)(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2); -typedef gboolean (*EAPMethodValidateFunc)(NMSetting8021x *self, - gboolean phase2, - GError **error); +typedef gboolean (*EAPMethodValidateFunc)(NMSetting8021x *self, gboolean phase2, GError **error); typedef struct { - const char *method; - EAPMethodNeedSecretsFunc ns_func; - EAPMethodValidateFunc v_func; + const char * method; + EAPMethodNeedSecretsFunc ns_func; + EAPMethodValidateFunc v_func; } EAPMethodsTable; static const EAPMethodsTable eap_methods_table[]; /*****************************************************************************/ -NM_GOBJECT_PROPERTIES_DEFINE (NMSetting8021x, - PROP_EAP, - PROP_IDENTITY, - PROP_ANONYMOUS_IDENTITY, - PROP_PAC_FILE, - PROP_CA_CERT, - PROP_CA_CERT_PASSWORD, - PROP_CA_CERT_PASSWORD_FLAGS, - PROP_CA_PATH, - PROP_SUBJECT_MATCH, - PROP_ALTSUBJECT_MATCHES, - PROP_DOMAIN_SUFFIX_MATCH, - PROP_DOMAIN_MATCH, - PROP_CLIENT_CERT, - PROP_CLIENT_CERT_PASSWORD, - PROP_CLIENT_CERT_PASSWORD_FLAGS, - PROP_PHASE1_PEAPVER, - PROP_PHASE1_PEAPLABEL, - PROP_PHASE1_FAST_PROVISIONING, - PROP_PHASE1_AUTH_FLAGS, - PROP_PHASE2_AUTH, - PROP_PHASE2_AUTHEAP, - PROP_PHASE2_CA_CERT, - PROP_PHASE2_CA_CERT_PASSWORD, - PROP_PHASE2_CA_CERT_PASSWORD_FLAGS, - PROP_PHASE2_CA_PATH, - PROP_PHASE2_SUBJECT_MATCH, - PROP_PHASE2_ALTSUBJECT_MATCHES, - PROP_PHASE2_DOMAIN_SUFFIX_MATCH, - PROP_PHASE2_DOMAIN_MATCH, - PROP_PHASE2_CLIENT_CERT, - PROP_PHASE2_CLIENT_CERT_PASSWORD, - PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS, - PROP_PASSWORD, - PROP_PASSWORD_FLAGS, - PROP_PASSWORD_RAW, - PROP_PASSWORD_RAW_FLAGS, - PROP_PRIVATE_KEY, - PROP_PRIVATE_KEY_PASSWORD, - PROP_PRIVATE_KEY_PASSWORD_FLAGS, - PROP_PHASE2_PRIVATE_KEY, - PROP_PHASE2_PRIVATE_KEY_PASSWORD, - PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS, - PROP_PIN, - PROP_PIN_FLAGS, - PROP_SYSTEM_CA_CERTS, - PROP_OPTIONAL, - PROP_AUTH_TIMEOUT, -); +NM_GOBJECT_PROPERTIES_DEFINE(NMSetting8021x, + PROP_EAP, + PROP_IDENTITY, + PROP_ANONYMOUS_IDENTITY, + PROP_PAC_FILE, + PROP_CA_CERT, + PROP_CA_CERT_PASSWORD, + PROP_CA_CERT_PASSWORD_FLAGS, + PROP_CA_PATH, + PROP_SUBJECT_MATCH, + PROP_ALTSUBJECT_MATCHES, + PROP_DOMAIN_SUFFIX_MATCH, + PROP_DOMAIN_MATCH, + PROP_CLIENT_CERT, + PROP_CLIENT_CERT_PASSWORD, + PROP_CLIENT_CERT_PASSWORD_FLAGS, + PROP_PHASE1_PEAPVER, + PROP_PHASE1_PEAPLABEL, + PROP_PHASE1_FAST_PROVISIONING, + PROP_PHASE1_AUTH_FLAGS, + PROP_PHASE2_AUTH, + PROP_PHASE2_AUTHEAP, + PROP_PHASE2_CA_CERT, + PROP_PHASE2_CA_CERT_PASSWORD, + PROP_PHASE2_CA_CERT_PASSWORD_FLAGS, + PROP_PHASE2_CA_PATH, + PROP_PHASE2_SUBJECT_MATCH, + PROP_PHASE2_ALTSUBJECT_MATCHES, + PROP_PHASE2_DOMAIN_SUFFIX_MATCH, + PROP_PHASE2_DOMAIN_MATCH, + PROP_PHASE2_CLIENT_CERT, + PROP_PHASE2_CLIENT_CERT_PASSWORD, + PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS, + PROP_PASSWORD, + PROP_PASSWORD_FLAGS, + PROP_PASSWORD_RAW, + PROP_PASSWORD_RAW_FLAGS, + PROP_PRIVATE_KEY, + PROP_PRIVATE_KEY_PASSWORD, + PROP_PRIVATE_KEY_PASSWORD_FLAGS, + PROP_PHASE2_PRIVATE_KEY, + PROP_PHASE2_PRIVATE_KEY_PASSWORD, + PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS, + PROP_PIN, + PROP_PIN_FLAGS, + PROP_SYSTEM_CA_CERTS, + PROP_OPTIONAL, + PROP_AUTH_TIMEOUT, ); typedef struct { - GSList *eap; /* GSList of strings */ - char *identity; - char *anonymous_identity; - char *pac_file; - GBytes *ca_cert; - char *ca_cert_password; - char *ca_path; - char *subject_match; - GSList *altsubject_matches; - char *domain_suffix_match; - char *domain_match; - GBytes *client_cert; - char *client_cert_password; - char *phase1_peapver; - char *phase1_peaplabel; - char *phase1_fast_provisioning; - char *phase2_auth; - char *phase2_autheap; - GBytes *phase2_ca_cert; - char *phase2_ca_cert_password; - char *phase2_ca_path; - char *phase2_subject_match; - GSList *phase2_altsubject_matches; - char *phase2_domain_suffix_match; - char *phase2_domain_match; - GBytes *phase2_client_cert; - char *phase2_client_cert_password; - char *password; - GBytes *password_raw; - char *pin; - GBytes *private_key; - char *private_key_password; - GBytes *phase2_private_key; - char *phase2_private_key_password; - int auth_timeout; - NMSetting8021xAuthFlags phase1_auth_flags; - NMSettingSecretFlags ca_cert_password_flags; - NMSettingSecretFlags client_cert_password_flags; - NMSettingSecretFlags phase2_ca_cert_password_flags; - NMSettingSecretFlags phase2_client_cert_password_flags; - NMSettingSecretFlags password_flags; - NMSettingSecretFlags password_raw_flags; - NMSettingSecretFlags pin_flags; - NMSettingSecretFlags private_key_password_flags; - NMSettingSecretFlags phase2_private_key_password_flags; - bool optional:1; - bool system_ca_certs:1; + GSList * eap; /* GSList of strings */ + char * identity; + char * anonymous_identity; + char * pac_file; + GBytes * ca_cert; + char * ca_cert_password; + char * ca_path; + char * subject_match; + GSList * altsubject_matches; + char * domain_suffix_match; + char * domain_match; + GBytes * client_cert; + char * client_cert_password; + char * phase1_peapver; + char * phase1_peaplabel; + char * phase1_fast_provisioning; + char * phase2_auth; + char * phase2_autheap; + GBytes * phase2_ca_cert; + char * phase2_ca_cert_password; + char * phase2_ca_path; + char * phase2_subject_match; + GSList * phase2_altsubject_matches; + char * phase2_domain_suffix_match; + char * phase2_domain_match; + GBytes * phase2_client_cert; + char * phase2_client_cert_password; + char * password; + GBytes * password_raw; + char * pin; + GBytes * private_key; + char * private_key_password; + GBytes * phase2_private_key; + char * phase2_private_key_password; + int auth_timeout; + NMSetting8021xAuthFlags phase1_auth_flags; + NMSettingSecretFlags ca_cert_password_flags; + NMSettingSecretFlags client_cert_password_flags; + NMSettingSecretFlags phase2_ca_cert_password_flags; + NMSettingSecretFlags phase2_client_cert_password_flags; + NMSettingSecretFlags password_flags; + NMSettingSecretFlags password_raw_flags; + NMSettingSecretFlags pin_flags; + NMSettingSecretFlags private_key_password_flags; + NMSettingSecretFlags phase2_private_key_password_flags; + bool optional : 1; + bool system_ca_certs : 1; } NMSetting8021xPrivate; -G_DEFINE_TYPE (NMSetting8021x, nm_setting_802_1x, NM_TYPE_SETTING) +G_DEFINE_TYPE(NMSetting8021x, nm_setting_802_1x, NM_TYPE_SETTING) -#define NM_SETTING_802_1X_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NM_TYPE_SETTING_802_1X, NMSetting8021xPrivate)) +#define NM_SETTING_802_1X_GET_PRIVATE(o) \ + (G_TYPE_INSTANCE_GET_PRIVATE((o), NM_TYPE_SETTING_802_1X, NMSetting8021xPrivate)) /*****************************************************************************/ @@ -202,487 +203,491 @@ G_DEFINE_TYPE (NMSetting8021x, nm_setting_802_1x, NM_TYPE_SETTING) * Since: 1.2 **/ NMSetting8021xCKScheme -nm_setting_802_1x_check_cert_scheme (gconstpointer pdata, gsize length, GError **error) +nm_setting_802_1x_check_cert_scheme(gconstpointer pdata, gsize length, GError **error) { - const char *data = pdata; - NMSetting8021xCKScheme scheme; - gsize prefix_length; - - g_return_val_if_fail (!length || data, NM_SETTING_802_1X_CK_SCHEME_UNKNOWN); - - if (!length || !data) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("binary data missing")); - return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; - } - - if ( length >= NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH) - && !memcmp (data, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH))) { - scheme = NM_SETTING_802_1X_CK_SCHEME_PATH; - prefix_length = NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH); - } else if ( length >= NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11) - && !memcmp (data, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11, NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11))) { - scheme = NM_SETTING_802_1X_CK_SCHEME_PKCS11; - prefix_length = NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11); - } else { - scheme = NM_SETTING_802_1X_CK_SCHEME_BLOB; - prefix_length = 0; - } - - if (scheme != NM_SETTING_802_1X_CK_SCHEME_BLOB) { - /* An actual URI must be NUL terminated, contain at least - * one non-NUL character, and contain only one trailing NUL - * character. - * And ensure it's UTF-8 valid too so we can pass it through - * D-Bus and stuff like that. */ - - if (data[length - 1] != '\0') { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("URI not NUL terminated")); - return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; - } - length--; - - if (length <= prefix_length) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("URI is empty")); - return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; - } - - if (!g_utf8_validate (data + prefix_length, length - prefix_length, NULL)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("URI is not valid UTF-8")); - return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; - } - } - - return scheme; + const char * data = pdata; + NMSetting8021xCKScheme scheme; + gsize prefix_length; + + g_return_val_if_fail(!length || data, NM_SETTING_802_1X_CK_SCHEME_UNKNOWN); + + if (!length || !data) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("binary data missing")); + return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; + } + + if (length >= NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH) + && !memcmp(data, + NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, + NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH))) { + scheme = NM_SETTING_802_1X_CK_SCHEME_PATH; + prefix_length = NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH); + } else if (length >= NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11) + && !memcmp(data, + NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11, + NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11))) { + scheme = NM_SETTING_802_1X_CK_SCHEME_PKCS11; + prefix_length = NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PKCS11); + } else { + scheme = NM_SETTING_802_1X_CK_SCHEME_BLOB; + prefix_length = 0; + } + + if (scheme != NM_SETTING_802_1X_CK_SCHEME_BLOB) { + /* An actual URI must be NUL terminated, contain at least + * one non-NUL character, and contain only one trailing NUL + * character. + * And ensure it's UTF-8 valid too so we can pass it through + * D-Bus and stuff like that. */ + + if (data[length - 1] != '\0') { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("URI not NUL terminated")); + return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; + } + length--; + + if (length <= prefix_length) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("URI is empty")); + return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; + } + + if (!g_utf8_validate(data + prefix_length, length - prefix_length, NULL)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("URI is not valid UTF-8")); + return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; + } + } + + return scheme; } NMSetting8021xCKScheme -_nm_setting_802_1x_cert_get_scheme (GBytes *bytes, GError **error) +_nm_setting_802_1x_cert_get_scheme(GBytes *bytes, GError **error) { - const char *data; - gsize length; - - if (!bytes) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("data missing")); - return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; - } - - data = g_bytes_get_data (bytes, &length); - return nm_setting_802_1x_check_cert_scheme (data, length, error); + const char *data; + gsize length; + + if (!bytes) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("data missing")); + return NM_SETTING_802_1X_CK_SCHEME_UNKNOWN; + } + + data = g_bytes_get_data(bytes, &length); + return nm_setting_802_1x_check_cert_scheme(data, length, error); } static gboolean -_cert_verify_scheme (NMSetting8021xCKScheme scheme, - GBytes *bytes, - GError **error) +_cert_verify_scheme(NMSetting8021xCKScheme scheme, GBytes *bytes, GError **error) { - GError *local = NULL; - NMSetting8021xCKScheme scheme_detected; - - nm_assert (bytes); - - scheme_detected = _nm_setting_802_1x_cert_get_scheme (bytes, &local); - if (scheme_detected == NM_SETTING_802_1X_CK_SCHEME_UNKNOWN) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("certificate is invalid: %s"), local->message); - return FALSE; - } - - if (scheme_detected != scheme) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("certificate detected as invalid scheme")); - return FALSE; - } - - return TRUE; + GError * local = NULL; + NMSetting8021xCKScheme scheme_detected; + + nm_assert(bytes); + + scheme_detected = _nm_setting_802_1x_cert_get_scheme(bytes, &local); + if (scheme_detected == NM_SETTING_802_1X_CK_SCHEME_UNKNOWN) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("certificate is invalid: %s"), + local->message); + return FALSE; + } + + if (scheme_detected != scheme) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("certificate detected as invalid scheme")); + return FALSE; + } + + return TRUE; } GBytes * -_nm_setting_802_1x_cert_value_to_bytes (NMSetting8021xCKScheme scheme, - const guint8 *val_bin, - gssize val_len, - GError **error) +_nm_setting_802_1x_cert_value_to_bytes(NMSetting8021xCKScheme scheme, + const guint8 * val_bin, + gssize val_len, + GError ** error) { - gs_unref_bytes GBytes *bytes = NULL; - guint8 *mem; - gsize total_len; - - nm_assert (val_bin); - - switch (scheme) { - case NM_SETTING_802_1X_CK_SCHEME_PKCS11: - if (val_len < 0) - val_len = strlen ((char *) val_bin) + 1; - - bytes = g_bytes_new (val_bin, val_len); - break; - case NM_SETTING_802_1X_CK_SCHEME_PATH: - if (val_len < 0) - val_len = strlen ((char *) val_bin) + 1; - - total_len = NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH) + ((gsize) val_len); - - mem = g_new (guint8, total_len); - memcpy (mem, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); - memcpy (&mem[NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)], val_bin, val_len); - bytes = g_bytes_new_take (mem, total_len); - break; - default: - g_return_val_if_reached (NULL); - } - - if (!_cert_verify_scheme (scheme, bytes, error)) - return NULL; - - return g_steal_pointer (&bytes); + gs_unref_bytes GBytes *bytes = NULL; + guint8 * mem; + gsize total_len; + + nm_assert(val_bin); + + switch (scheme) { + case NM_SETTING_802_1X_CK_SCHEME_PKCS11: + if (val_len < 0) + val_len = strlen((char *) val_bin) + 1; + + bytes = g_bytes_new(val_bin, val_len); + break; + case NM_SETTING_802_1X_CK_SCHEME_PATH: + if (val_len < 0) + val_len = strlen((char *) val_bin) + 1; + + total_len = NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH) + ((gsize) val_len); + + mem = g_new(guint8, total_len); + memcpy(mem, + NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH, + NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); + memcpy(&mem[NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)], val_bin, val_len); + bytes = g_bytes_new_take(mem, total_len); + break; + default: + g_return_val_if_reached(NULL); + } + + if (!_cert_verify_scheme(scheme, bytes, error)) + return NULL; + + return g_steal_pointer(&bytes); } static const char * -_cert_get_path (GBytes *bytes) +_cert_get_path(GBytes *bytes) { - const guint8 *bin; + const guint8 *bin; - nm_assert (bytes); - nm_assert (g_bytes_get_size (bytes) >= NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); + nm_assert(bytes); + nm_assert(g_bytes_get_size(bytes) >= NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); - bin = g_bytes_get_data (bytes, NULL); + bin = g_bytes_get_data(bytes, NULL); - nm_assert (bin); - nm_assert (bin[g_bytes_get_size (bytes) - 1] == '\0'); - nm_assert (g_str_has_prefix ((const char *) bin, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); + nm_assert(bin); + nm_assert(bin[g_bytes_get_size(bytes) - 1] == '\0'); + nm_assert(g_str_has_prefix((const char *) bin, NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)); - return (const char *) &bin[NM_STRLEN (NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)]; + return (const char *) &bin[NM_STRLEN(NM_SETTING_802_1X_CERT_SCHEME_PREFIX_PATH)]; } -#define _cert_assert_scheme(cert, check_scheme, ret_val) \ - G_STMT_START { \ - NMSetting8021xCKScheme scheme; \ - \ - scheme = _nm_setting_802_1x_cert_get_scheme ((cert), NULL); \ - if (scheme != check_scheme) { \ - g_return_val_if_fail (scheme == check_scheme, ret_val); \ - return ret_val; \ - } \ - } G_STMT_END - -#define _cert_impl_get_scheme(setting, cert_field) \ - G_STMT_START { \ - NMSetting8021x *const _setting = (setting); \ - GBytes *_cert; \ - \ - g_return_val_if_fail (NM_IS_SETTING_802_1X (_setting), NM_SETTING_802_1X_CK_SCHEME_UNKNOWN); \ - \ - _cert = NM_SETTING_802_1X_GET_PRIVATE (_setting)->cert_field; \ - \ - return _nm_setting_802_1x_cert_get_scheme (_cert, NULL); \ - } G_STMT_END - -#define _cert_impl_get_blob(setting, cert_field) \ - G_STMT_START { \ - NMSetting8021x *const _setting = (setting); \ - GBytes *_cert; \ - \ - g_return_val_if_fail (NM_IS_SETTING_802_1X (_setting), NULL); \ - \ - _cert = NM_SETTING_802_1X_GET_PRIVATE (_setting)->cert_field; \ - \ - _cert_assert_scheme (_cert, NM_SETTING_802_1X_CK_SCHEME_BLOB, NULL); \ - \ - return _cert; \ - } G_STMT_END - -#define _cert_impl_get_path(setting, cert_field) \ - G_STMT_START { \ - NMSetting8021x *const _setting = (setting); \ - GBytes *_cert; \ - \ - g_return_val_if_fail (NM_IS_SETTING_802_1X (_setting), NULL); \ - \ - _cert = NM_SETTING_802_1X_GET_PRIVATE (_setting)->cert_field; \ - \ - _cert_assert_scheme (_cert, NM_SETTING_802_1X_CK_SCHEME_PATH, NULL); \ - \ - return _cert_get_path (_cert); \ - } G_STMT_END - -#define _cert_impl_get_uri(setting, cert_field) \ - G_STMT_START { \ - NMSetting8021x *const _setting = (setting); \ - GBytes *_cert; \ - \ - g_return_val_if_fail (NM_IS_SETTING_802_1X (_setting), NULL); \ - \ - _cert = NM_SETTING_802_1X_GET_PRIVATE (_setting)->cert_field; \ - \ - _cert_assert_scheme (_cert, NM_SETTING_802_1X_CK_SCHEME_PKCS11, NULL); \ - \ - return g_bytes_get_data (_cert, NULL); \ - } G_STMT_END +#define _cert_assert_scheme(cert, check_scheme, ret_val) \ + G_STMT_START \ + { \ + NMSetting8021xCKScheme scheme; \ + \ + scheme = _nm_setting_802_1x_cert_get_scheme((cert), NULL); \ + if (scheme != check_scheme) { \ + g_return_val_if_fail(scheme == check_scheme, ret_val); \ + return ret_val; \ + } \ + } \ + G_STMT_END + +#define _cert_impl_get_scheme(setting, cert_field) \ + G_STMT_START \ + { \ + NMSetting8021x *const _setting = (setting); \ + GBytes * _cert; \ + \ + g_return_val_if_fail(NM_IS_SETTING_802_1X(_setting), NM_SETTING_802_1X_CK_SCHEME_UNKNOWN); \ + \ + _cert = NM_SETTING_802_1X_GET_PRIVATE(_setting)->cert_field; \ + \ + return _nm_setting_802_1x_cert_get_scheme(_cert, NULL); \ + } \ + G_STMT_END + +#define _cert_impl_get_blob(setting, cert_field) \ + G_STMT_START \ + { \ + NMSetting8021x *const _setting = (setting); \ + GBytes * _cert; \ + \ + g_return_val_if_fail(NM_IS_SETTING_802_1X(_setting), NULL); \ + \ + _cert = NM_SETTING_802_1X_GET_PRIVATE(_setting)->cert_field; \ + \ + _cert_assert_scheme(_cert, NM_SETTING_802_1X_CK_SCHEME_BLOB, NULL); \ + \ + return _cert; \ + } \ + G_STMT_END + +#define _cert_impl_get_path(setting, cert_field) \ + G_STMT_START \ + { \ + NMSetting8021x *const _setting = (setting); \ + GBytes * _cert; \ + \ + g_return_val_if_fail(NM_IS_SETTING_802_1X(_setting), NULL); \ + \ + _cert = NM_SETTING_802_1X_GET_PRIVATE(_setting)->cert_field; \ + \ + _cert_assert_scheme(_cert, NM_SETTING_802_1X_CK_SCHEME_PATH, NULL); \ + \ + return _cert_get_path(_cert); \ + } \ + G_STMT_END + +#define _cert_impl_get_uri(setting, cert_field) \ + G_STMT_START \ + { \ + NMSetting8021x *const _setting = (setting); \ + GBytes * _cert; \ + \ + g_return_val_if_fail(NM_IS_SETTING_802_1X(_setting), NULL); \ + \ + _cert = NM_SETTING_802_1X_GET_PRIVATE(_setting)->cert_field; \ + \ + _cert_assert_scheme(_cert, NM_SETTING_802_1X_CK_SCHEME_PKCS11, NULL); \ + \ + return g_bytes_get_data(_cert, NULL); \ + } \ + G_STMT_END static gboolean -_cert_impl_set (NMSetting8021x *setting, - _PropertyEnums property, - const char *value, - const char *password, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +_cert_impl_set(NMSetting8021x * setting, + _PropertyEnums property, + const char * value, + const char * password, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - NMSetting8021xPrivate *priv; - NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN; - gs_unref_bytes GBytes *cert = NULL; - GBytes **p_cert = NULL; - GBytes **p_client_cert = NULL; - char **p_password = NULL; - _PropertyEnums notify_cert = property; - _PropertyEnums notify_password = PROP_0; - _PropertyEnums notify_client_cert = PROP_0; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (!error || !*error, FALSE); - if (value) { - g_return_val_if_fail (g_utf8_validate (value, -1, NULL), FALSE); - g_return_val_if_fail (NM_IN_SET (scheme, NM_SETTING_802_1X_CK_SCHEME_BLOB, - NM_SETTING_802_1X_CK_SCHEME_PATH, - NM_SETTING_802_1X_CK_SCHEME_PKCS11), FALSE); - } - - if (!value) { - /* coerce password to %NULL. It should be already. */ - password = NULL; - } - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - - if (!value) { - /* pass. */ - } else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11) { - cert = _nm_setting_802_1x_cert_value_to_bytes (scheme, (guint8 *) value, -1, error); - if (!cert) - goto err; - } else { - gs_unref_bytes GBytes *file = NULL; - - if (NM_IN_SET (property, PROP_PRIVATE_KEY, - PROP_PHASE2_PRIVATE_KEY)) { - file = nm_crypto_read_file (value, error); - if (!file) - goto err; - format = nm_crypto_verify_private_key_data (g_bytes_get_data (file, NULL), - g_bytes_get_size (file), - password, - NULL, - error); - if (format == NM_CRYPTO_FILE_FORMAT_UNKNOWN) - goto err; - } else { - if (!nm_crypto_load_and_verify_certificate (value, &format, &file, error)) - goto err; - } - - nm_assert (format != NM_CRYPTO_FILE_FORMAT_UNKNOWN); - nm_assert (file); - - if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) { - cert = g_steal_pointer (&file); - if (!_cert_verify_scheme (scheme, cert, error)) - goto err; - } else { - cert = _nm_setting_802_1x_cert_value_to_bytes (scheme, (guint8 *) value, -1, error); - if (!cert) - goto err; - } - } - - switch (property) { - case PROP_CA_CERT: - case PROP_PHASE2_CA_CERT: - if ( value - && scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && format != NM_CRYPTO_FILE_FORMAT_X509) { - /* wpa_supplicant can only use raw x509 CA certs */ - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("CA certificate must be in X.509 format")); - goto err; - } - p_cert = (property == PROP_CA_CERT) - ? &priv->ca_cert - : &priv->phase2_ca_cert; - break; - case PROP_CLIENT_CERT: - case PROP_PHASE2_CLIENT_CERT: - if ( value - && scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && !NM_IN_SET (format, NM_CRYPTO_FILE_FORMAT_X509, - NM_CRYPTO_FILE_FORMAT_PKCS12)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("invalid certificate format")); - goto err; - } - p_cert = (property == PROP_CLIENT_CERT) - ? &priv->client_cert - : &priv->phase2_client_cert; - break; - case PROP_PRIVATE_KEY: - p_cert = &priv->private_key; - p_password = &priv->private_key_password; - p_client_cert = &priv->client_cert; - notify_password = PROP_PRIVATE_KEY_PASSWORD; - notify_client_cert = PROP_CLIENT_CERT; - break; - case PROP_PHASE2_PRIVATE_KEY: - p_cert = &priv->phase2_private_key; - p_password = &priv->phase2_private_key_password; - p_client_cert = &priv->phase2_client_cert; - notify_password = PROP_PHASE2_PRIVATE_KEY_PASSWORD; - notify_client_cert = PROP_PHASE2_CLIENT_CERT; - break; - default: - nm_assert_not_reached (); - break; - } - - /* As required by NM and wpa_supplicant, set the client-cert - * property to the same PKCS#12 data. - */ - if ( cert - && p_client_cert - && format == NM_CRYPTO_FILE_FORMAT_PKCS12 - && !nm_gbytes_equal0 (cert, *p_client_cert)) { - g_bytes_unref (*p_client_cert); - *p_client_cert = g_bytes_ref (cert); - } else - notify_client_cert = PROP_0; - - if ( p_cert - && !nm_gbytes_equal0 (cert, *p_cert)) { - g_bytes_unref (*p_cert); - *p_cert = g_steal_pointer (&cert); - } else - notify_cert = PROP_0; - - if ( p_password - && !nm_streq0 (password, *p_password)) { - nm_free_secret (*p_password); - *p_password = g_strdup (password); - } else - notify_password = PROP_0; - - nm_gobject_notify_together (setting, notify_cert, - notify_password, - notify_client_cert); - - NM_SET_OUT (out_format, _crypto_format_to_ck (format)); - return TRUE; + NMSetting8021xPrivate *priv; + NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN; + gs_unref_bytes GBytes *cert = NULL; + GBytes ** p_cert = NULL; + GBytes ** p_client_cert = NULL; + char ** p_password = NULL; + _PropertyEnums notify_cert = property; + _PropertyEnums notify_password = PROP_0; + _PropertyEnums notify_client_cert = PROP_0; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(!error || !*error, FALSE); + if (value) { + g_return_val_if_fail(g_utf8_validate(value, -1, NULL), FALSE); + g_return_val_if_fail(NM_IN_SET(scheme, + NM_SETTING_802_1X_CK_SCHEME_BLOB, + NM_SETTING_802_1X_CK_SCHEME_PATH, + NM_SETTING_802_1X_CK_SCHEME_PKCS11), + FALSE); + } + + if (!value) { + /* coerce password to %NULL. It should be already. */ + password = NULL; + } + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + + if (!value) { + /* pass. */ + } else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11) { + cert = _nm_setting_802_1x_cert_value_to_bytes(scheme, (guint8 *) value, -1, error); + if (!cert) + goto err; + } else { + gs_unref_bytes GBytes *file = NULL; + + if (NM_IN_SET(property, PROP_PRIVATE_KEY, PROP_PHASE2_PRIVATE_KEY)) { + file = nm_crypto_read_file(value, error); + if (!file) + goto err; + format = nm_crypto_verify_private_key_data(g_bytes_get_data(file, NULL), + g_bytes_get_size(file), + password, + NULL, + error); + if (format == NM_CRYPTO_FILE_FORMAT_UNKNOWN) + goto err; + } else { + if (!nm_crypto_load_and_verify_certificate(value, &format, &file, error)) + goto err; + } + + nm_assert(format != NM_CRYPTO_FILE_FORMAT_UNKNOWN); + nm_assert(file); + + if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) { + cert = g_steal_pointer(&file); + if (!_cert_verify_scheme(scheme, cert, error)) + goto err; + } else { + cert = _nm_setting_802_1x_cert_value_to_bytes(scheme, (guint8 *) value, -1, error); + if (!cert) + goto err; + } + } + + switch (property) { + case PROP_CA_CERT: + case PROP_PHASE2_CA_CERT: + if (value && scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && format != NM_CRYPTO_FILE_FORMAT_X509) { + /* wpa_supplicant can only use raw x509 CA certs */ + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("CA certificate must be in X.509 format")); + goto err; + } + p_cert = (property == PROP_CA_CERT) ? &priv->ca_cert : &priv->phase2_ca_cert; + break; + case PROP_CLIENT_CERT: + case PROP_PHASE2_CLIENT_CERT: + if (value && scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && !NM_IN_SET(format, NM_CRYPTO_FILE_FORMAT_X509, NM_CRYPTO_FILE_FORMAT_PKCS12)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("invalid certificate format")); + goto err; + } + p_cert = (property == PROP_CLIENT_CERT) ? &priv->client_cert : &priv->phase2_client_cert; + break; + case PROP_PRIVATE_KEY: + p_cert = &priv->private_key; + p_password = &priv->private_key_password; + p_client_cert = &priv->client_cert; + notify_password = PROP_PRIVATE_KEY_PASSWORD; + notify_client_cert = PROP_CLIENT_CERT; + break; + case PROP_PHASE2_PRIVATE_KEY: + p_cert = &priv->phase2_private_key; + p_password = &priv->phase2_private_key_password; + p_client_cert = &priv->phase2_client_cert; + notify_password = PROP_PHASE2_PRIVATE_KEY_PASSWORD; + notify_client_cert = PROP_PHASE2_CLIENT_CERT; + break; + default: + nm_assert_not_reached(); + break; + } + + /* As required by NM and wpa_supplicant, set the client-cert + * property to the same PKCS#12 data. + */ + if (cert && p_client_cert && format == NM_CRYPTO_FILE_FORMAT_PKCS12 + && !nm_gbytes_equal0(cert, *p_client_cert)) { + g_bytes_unref(*p_client_cert); + *p_client_cert = g_bytes_ref(cert); + } else + notify_client_cert = PROP_0; + + if (p_cert && !nm_gbytes_equal0(cert, *p_cert)) { + g_bytes_unref(*p_cert); + *p_cert = g_steal_pointer(&cert); + } else + notify_cert = PROP_0; + + if (p_password && !nm_streq0(password, *p_password)) { + nm_free_secret(*p_password); + *p_password = g_strdup(password); + } else + notify_password = PROP_0; + + nm_gobject_notify_together(setting, notify_cert, notify_password, notify_client_cert); + + NM_SET_OUT(out_format, _crypto_format_to_ck(format)); + return TRUE; err: - g_prefix_error (error, - "%s.%s: ", - NM_SETTING_802_1X_SETTING_NAME, - obj_properties[property]->name); - NM_SET_OUT (out_format, NM_SETTING_802_1X_CK_FORMAT_UNKNOWN); - return FALSE; + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + obj_properties[property]->name); + NM_SET_OUT(out_format, NM_SETTING_802_1X_CK_FORMAT_UNKNOWN); + return FALSE; } static NMSetting8021xCKFormat -_cert_impl_get_key_format_from_bytes (GBytes *private_key) +_cert_impl_get_key_format_from_bytes(GBytes *private_key) { - const char *path; - GError *error = NULL; - - if (!private_key) - return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; - - switch (_nm_setting_802_1x_cert_get_scheme (private_key, NULL)) { - case NM_SETTING_802_1X_CK_SCHEME_BLOB: - if (nm_crypto_is_pkcs12_data (g_bytes_get_data (private_key, NULL), - g_bytes_get_size (private_key), - NULL)) - return NM_SETTING_802_1X_CK_FORMAT_PKCS12; - return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY; - case NM_SETTING_802_1X_CK_SCHEME_PATH: - path = _cert_get_path (private_key); - if (nm_crypto_is_pkcs12_file (path, &error)) - return NM_SETTING_802_1X_CK_FORMAT_PKCS12; - if (error && error->domain == G_FILE_ERROR) { - g_error_free (error); - return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; - } - g_error_free (error); - return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY; - default: - break; - } - - return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; + const char *path; + GError * error = NULL; + + if (!private_key) + return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; + + switch (_nm_setting_802_1x_cert_get_scheme(private_key, NULL)) { + case NM_SETTING_802_1X_CK_SCHEME_BLOB: + if (nm_crypto_is_pkcs12_data(g_bytes_get_data(private_key, NULL), + g_bytes_get_size(private_key), + NULL)) + return NM_SETTING_802_1X_CK_FORMAT_PKCS12; + return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY; + case NM_SETTING_802_1X_CK_SCHEME_PATH: + path = _cert_get_path(private_key); + if (nm_crypto_is_pkcs12_file(path, &error)) + return NM_SETTING_802_1X_CK_FORMAT_PKCS12; + if (error && error->domain == G_FILE_ERROR) { + g_error_free(error); + return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; + } + g_error_free(error); + return NM_SETTING_802_1X_CK_FORMAT_RAW_KEY; + default: + break; + } + + return NM_SETTING_802_1X_CK_FORMAT_UNKNOWN; } -#define _cert_impl_get_key_format(setting, private_key_field) \ - ({ \ - NMSetting8021x *_setting = (setting); \ - NMSetting8021xPrivate *_priv; \ - \ - g_return_val_if_fail (NM_IS_SETTING_802_1X (_setting), NM_SETTING_802_1X_CK_FORMAT_UNKNOWN); \ - \ - _priv = NM_SETTING_802_1X_GET_PRIVATE (_setting); \ - _cert_impl_get_key_format_from_bytes (_priv->private_key_field); \ - }) +#define _cert_impl_get_key_format(setting, private_key_field) \ + ({ \ + NMSetting8021x * _setting = (setting); \ + NMSetting8021xPrivate *_priv; \ + \ + g_return_val_if_fail(NM_IS_SETTING_802_1X(_setting), NM_SETTING_802_1X_CK_FORMAT_UNKNOWN); \ + \ + _priv = NM_SETTING_802_1X_GET_PRIVATE(_setting); \ + _cert_impl_get_key_format_from_bytes(_priv->private_key_field); \ + }) static gboolean -_cert_verify_property (GBytes *bytes, - const char *prop_name, - const char *password, - const char *password_prop_name, - GError **error) +_cert_verify_property(GBytes * bytes, + const char *prop_name, + const char *password, + const char *password_prop_name, + GError ** error) { - GError *local = NULL; - NMSetting8021xCKScheme scheme; - - if (!bytes) - return TRUE; - - scheme = _nm_setting_802_1x_cert_get_scheme (bytes, &local); - if (scheme == NM_SETTING_802_1X_CK_SCHEME_UNKNOWN) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("certificate is invalid: %s"), local->message); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, prop_name); - g_error_free (local); - return FALSE; - } - - if (password && (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11)) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("password is not supported when certificate is not on a PKCS#11 token")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, password_prop_name); - return FALSE; - } - - return TRUE; + GError * local = NULL; + NMSetting8021xCKScheme scheme; + + if (!bytes) + return TRUE; + + scheme = _nm_setting_802_1x_cert_get_scheme(bytes, &local); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_UNKNOWN) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("certificate is invalid: %s"), + local->message); + g_prefix_error(error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, prop_name); + g_error_free(local); + return FALSE; + } + + if (password && (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11)) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("password is not supported when certificate is not on a PKCS#11 token")); + g_prefix_error(error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, password_prop_name); + return FALSE; + } + + return TRUE; } /*****************************************************************************/ @@ -700,11 +705,11 @@ _cert_verify_property (GBytes *bytes, * Returns: the number of allowed EAP methods **/ guint32 -nm_setting_802_1x_get_num_eap_methods (NMSetting8021x *setting) +nm_setting_802_1x_get_num_eap_methods(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), 0); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), 0); - return g_slist_length (NM_SETTING_802_1X_GET_PRIVATE (setting)->eap); + return g_slist_length(NM_SETTING_802_1X_GET_PRIVATE(setting)->eap); } /** @@ -717,16 +722,16 @@ nm_setting_802_1x_get_num_eap_methods (NMSetting8021x *setting) * Returns: the name of the allowed EAP method at index @i **/ const char * -nm_setting_802_1x_get_eap_method (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_get_eap_method(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_return_val_if_fail (i <= g_slist_length (priv->eap), NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_return_val_if_fail(i <= g_slist_length(priv->eap), NULL); - return (const char *) g_slist_nth_data (priv->eap, i); + return (const char *) g_slist_nth_data(priv->eap, i); } /** @@ -742,23 +747,23 @@ nm_setting_802_1x_get_eap_method (NMSetting8021x *setting, guint32 i) * not a valid method or if it was already allowed. **/ gboolean -nm_setting_802_1x_add_eap_method (NMSetting8021x *setting, const char *eap) +nm_setting_802_1x_add_eap_method(NMSetting8021x *setting, const char *eap) { - NMSetting8021xPrivate *priv; - GSList *iter; + NMSetting8021xPrivate *priv; + GSList * iter; - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (eap != NULL, FALSE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(eap != NULL, FALSE); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->eap; iter; iter = g_slist_next (iter)) { - if (!strcmp (eap, (char *) iter->data)) - return FALSE; - } + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->eap; iter; iter = g_slist_next(iter)) { + if (!strcmp(eap, (char *) iter->data)) + return FALSE; + } - priv->eap = g_slist_append (priv->eap, g_ascii_strdown (eap, -1)); - _notify (setting, PROP_EAP); - return TRUE; + priv->eap = g_slist_append(priv->eap, g_ascii_strdown(eap, -1)); + _notify(setting, PROP_EAP); + return TRUE; } /** @@ -769,20 +774,20 @@ nm_setting_802_1x_add_eap_method (NMSetting8021x *setting, const char *eap) * Removes the allowed EAP method at the specified index. **/ void -nm_setting_802_1x_remove_eap_method (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_remove_eap_method(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; - GSList *elt; + NMSetting8021xPrivate *priv; + GSList * elt; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - elt = g_slist_nth (priv->eap, i); - g_return_if_fail (elt != NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + elt = g_slist_nth(priv->eap, i); + g_return_if_fail(elt != NULL); - g_free (elt->data); - priv->eap = g_slist_delete_link (priv->eap, elt); - _notify (setting, PROP_EAP); + g_free(elt->data); + priv->eap = g_slist_delete_link(priv->eap, elt); + _notify(setting, PROP_EAP); } /** @@ -795,24 +800,23 @@ nm_setting_802_1x_remove_eap_method (NMSetting8021x *setting, guint32 i) * Returns: %TRUE if the EAP method was founs and removed, %FALSE if it was not. **/ gboolean -nm_setting_802_1x_remove_eap_method_by_value (NMSetting8021x *setting, - const char *eap) +nm_setting_802_1x_remove_eap_method_by_value(NMSetting8021x *setting, const char *eap) { - NMSetting8021xPrivate *priv; - GSList *iter; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (eap != NULL, FALSE); - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->eap; iter; iter = g_slist_next (iter)) { - if (!strcmp (eap, (char *) iter->data)) { - priv->eap = g_slist_delete_link (priv->eap, iter); - _notify (setting, PROP_EAP); - return TRUE; - } - } - return FALSE; + NMSetting8021xPrivate *priv; + GSList * iter; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(eap != NULL, FALSE); + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->eap; iter; iter = g_slist_next(iter)) { + if (!strcmp(eap, (char *) iter->data)) { + priv->eap = g_slist_delete_link(priv->eap, iter); + _notify(setting, PROP_EAP); + return TRUE; + } + } + return FALSE; } /** @@ -822,16 +826,16 @@ nm_setting_802_1x_remove_eap_method_by_value (NMSetting8021x *setting, * Clears all allowed EAP methods. **/ void -nm_setting_802_1x_clear_eap_methods (NMSetting8021x *setting) +nm_setting_802_1x_clear_eap_methods(NMSetting8021x *setting) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_slist_free_full (priv->eap, g_free); - priv->eap = NULL; - _notify (setting, PROP_EAP); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_slist_free_full(priv->eap, g_free); + priv->eap = NULL; + _notify(setting, PROP_EAP); } /** @@ -844,11 +848,11 @@ nm_setting_802_1x_clear_eap_methods (NMSetting8021x *setting) * Returns: the user identifier **/ const char * -nm_setting_802_1x_get_identity (NMSetting8021x *setting) +nm_setting_802_1x_get_identity(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->identity; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->identity; } /** @@ -863,11 +867,11 @@ nm_setting_802_1x_get_identity (NMSetting8021x *setting) * Returns: the anonymous identifier **/ const char * -nm_setting_802_1x_get_anonymous_identity (NMSetting8021x *setting) +nm_setting_802_1x_get_anonymous_identity(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->anonymous_identity; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->anonymous_identity; } /** @@ -879,11 +883,11 @@ nm_setting_802_1x_get_anonymous_identity (NMSetting8021x *setting) * Returns: the PAC file **/ const char * -nm_setting_802_1x_get_pac_file (NMSetting8021x *setting) +nm_setting_802_1x_get_pac_file(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->pac_file; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->pac_file; } /** @@ -899,11 +903,11 @@ nm_setting_802_1x_get_pac_file (NMSetting8021x *setting) * Returns: the CA certificate directory path **/ const char * -nm_setting_802_1x_get_ca_path (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_path(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->ca_path; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->ca_path; } /** @@ -920,11 +924,11 @@ nm_setting_802_1x_get_ca_path (NMSetting8021x *setting) * Returns: %TRUE if a system CA certificate path should be used, %FALSE if not **/ gboolean -nm_setting_802_1x_get_system_ca_certs (NMSetting8021x *setting) +nm_setting_802_1x_get_system_ca_certs(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->system_ca_certs; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->system_ca_certs; } /** @@ -939,9 +943,9 @@ nm_setting_802_1x_get_system_ca_certs (NMSetting8021x *setting) * Returns: scheme used to store the CA certificate (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_ca_cert_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, ca_cert); + _cert_impl_get_scheme(setting, ca_cert); } /** @@ -958,9 +962,9 @@ nm_setting_802_1x_get_ca_cert_scheme (NMSetting8021x *setting) * Returns: (transfer none): the CA certificate data **/ GBytes * -nm_setting_802_1x_get_ca_cert_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, ca_cert); + _cert_impl_get_blob(setting, ca_cert); } /** @@ -977,9 +981,9 @@ nm_setting_802_1x_get_ca_cert_blob (NMSetting8021x *setting) * Returns: path to the CA certificate file **/ const char * -nm_setting_802_1x_get_ca_cert_path (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, ca_cert); + _cert_impl_get_path(setting, ca_cert); } /** @@ -990,7 +994,7 @@ nm_setting_802_1x_get_ca_cert_path (NMSetting8021x *setting) * nm_setting_802_1x_get_ca_cert_blob() and * nm_setting_802_1x_get_ca_cert_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -999,9 +1003,9 @@ nm_setting_802_1x_get_ca_cert_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_ca_cert_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, ca_cert); + _cert_impl_get_uri(setting, ca_cert); } /** @@ -1024,13 +1028,13 @@ nm_setting_802_1x_get_ca_cert_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_ca_cert (NMSetting8021x *setting, - const char *value, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_ca_cert(NMSetting8021x * setting, + const char * value, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_CA_CERT, value, NULL, scheme, out_format, error); + return _cert_impl_set(setting, PROP_CA_CERT, value, NULL, scheme, out_format, error); } /** @@ -1044,11 +1048,11 @@ nm_setting_802_1x_set_ca_cert (NMSetting8021x *setting, * Since: 1.8 **/ const char * -nm_setting_802_1x_get_ca_cert_password (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->ca_cert_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->ca_cert_password; } /** @@ -1061,11 +1065,11 @@ nm_setting_802_1x_get_ca_cert_password (NMSetting8021x *setting) * Since: 1.8 **/ NMSettingSecretFlags -nm_setting_802_1x_get_ca_cert_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_ca_cert_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->ca_cert_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->ca_cert_password_flags; } /** @@ -1078,11 +1082,11 @@ nm_setting_802_1x_get_ca_cert_password_flags (NMSetting8021x *setting) * performed. **/ const char * -nm_setting_802_1x_get_subject_match (NMSetting8021x *setting) +nm_setting_802_1x_get_subject_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->subject_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->subject_match; } /** @@ -1095,11 +1099,11 @@ nm_setting_802_1x_get_subject_match (NMSetting8021x *setting) * Returns: the number of altsubject-matches entries. **/ guint32 -nm_setting_802_1x_get_num_altsubject_matches (NMSetting8021x *setting) +nm_setting_802_1x_get_num_altsubject_matches(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), 0); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), 0); - return g_slist_length (NM_SETTING_802_1X_GET_PRIVATE (setting)->altsubject_matches); + return g_slist_length(NM_SETTING_802_1X_GET_PRIVATE(setting)->altsubject_matches); } /** @@ -1112,16 +1116,16 @@ nm_setting_802_1x_get_num_altsubject_matches (NMSetting8021x *setting) * Returns: the altSubjectName match at index @i **/ const char * -nm_setting_802_1x_get_altsubject_match (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_get_altsubject_match(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_return_val_if_fail (i <= g_slist_length (priv->altsubject_matches), NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_return_val_if_fail(i <= g_slist_length(priv->altsubject_matches), NULL); - return (const char *) g_slist_nth_data (priv->altsubject_matches, i); + return (const char *) g_slist_nth_data(priv->altsubject_matches, i); } /** @@ -1137,25 +1141,23 @@ nm_setting_802_1x_get_altsubject_match (NMSetting8021x *setting, guint32 i) * successfully added, %FALSE if it was already allowed. **/ gboolean -nm_setting_802_1x_add_altsubject_match (NMSetting8021x *setting, - const char *altsubject_match) +nm_setting_802_1x_add_altsubject_match(NMSetting8021x *setting, const char *altsubject_match) { - NMSetting8021xPrivate *priv; - GSList *iter; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (altsubject_match != NULL, FALSE); - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->altsubject_matches; iter; iter = g_slist_next (iter)) { - if (!strcmp (altsubject_match, (char *) iter->data)) - return FALSE; - } - - priv->altsubject_matches = g_slist_append (priv->altsubject_matches, - g_strdup (altsubject_match)); - _notify (setting, PROP_ALTSUBJECT_MATCHES); - return TRUE; + NMSetting8021xPrivate *priv; + GSList * iter; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(altsubject_match != NULL, FALSE); + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->altsubject_matches; iter; iter = g_slist_next(iter)) { + if (!strcmp(altsubject_match, (char *) iter->data)) + return FALSE; + } + + priv->altsubject_matches = g_slist_append(priv->altsubject_matches, g_strdup(altsubject_match)); + _notify(setting, PROP_ALTSUBJECT_MATCHES); + return TRUE; } /** @@ -1166,20 +1168,20 @@ nm_setting_802_1x_add_altsubject_match (NMSetting8021x *setting, * Removes the allowed altSubjectName at the specified index. **/ void -nm_setting_802_1x_remove_altsubject_match (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_remove_altsubject_match(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; - GSList *elt; + NMSetting8021xPrivate *priv; + GSList * elt; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - elt = g_slist_nth (priv->altsubject_matches, i); - g_return_if_fail (elt != NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + elt = g_slist_nth(priv->altsubject_matches, i); + g_return_if_fail(elt != NULL); - g_free (elt->data); - priv->altsubject_matches = g_slist_delete_link (priv->altsubject_matches, elt); - _notify (setting, PROP_ALTSUBJECT_MATCHES); + g_free(elt->data); + priv->altsubject_matches = g_slist_delete_link(priv->altsubject_matches, elt); + _notify(setting, PROP_ALTSUBJECT_MATCHES); } /** @@ -1193,24 +1195,24 @@ nm_setting_802_1x_remove_altsubject_match (NMSetting8021x *setting, guint32 i) * %FALSE if it was not. **/ gboolean -nm_setting_802_1x_remove_altsubject_match_by_value (NMSetting8021x *setting, - const char *altsubject_match) +nm_setting_802_1x_remove_altsubject_match_by_value(NMSetting8021x *setting, + const char * altsubject_match) { - NMSetting8021xPrivate *priv; - GSList *iter; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (altsubject_match != NULL, FALSE); - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->altsubject_matches; iter; iter = g_slist_next (iter)) { - if (!strcmp (altsubject_match, (char *) iter->data)) { - priv->altsubject_matches = g_slist_delete_link (priv->altsubject_matches, iter); - _notify (setting, PROP_ALTSUBJECT_MATCHES); - return TRUE; - } - } - return FALSE; + NMSetting8021xPrivate *priv; + GSList * iter; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(altsubject_match != NULL, FALSE); + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->altsubject_matches; iter; iter = g_slist_next(iter)) { + if (!strcmp(altsubject_match, (char *) iter->data)) { + priv->altsubject_matches = g_slist_delete_link(priv->altsubject_matches, iter); + _notify(setting, PROP_ALTSUBJECT_MATCHES); + return TRUE; + } + } + return FALSE; } /** @@ -1220,16 +1222,16 @@ nm_setting_802_1x_remove_altsubject_match_by_value (NMSetting8021x *setting, * Clears all altSubjectName matches. **/ void -nm_setting_802_1x_clear_altsubject_matches (NMSetting8021x *setting) +nm_setting_802_1x_clear_altsubject_matches(NMSetting8021x *setting) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_slist_free_full (priv->altsubject_matches, g_free); - priv->altsubject_matches = NULL; - _notify (setting, PROP_ALTSUBJECT_MATCHES); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_slist_free_full(priv->altsubject_matches, g_free); + priv->altsubject_matches = NULL; + _notify(setting, PROP_ALTSUBJECT_MATCHES); } /** @@ -1241,11 +1243,11 @@ nm_setting_802_1x_clear_altsubject_matches (NMSetting8021x *setting) * Since: 1.2 **/ const char * -nm_setting_802_1x_get_domain_suffix_match (NMSetting8021x *setting) +nm_setting_802_1x_get_domain_suffix_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->domain_suffix_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->domain_suffix_match; } /** @@ -1257,11 +1259,11 @@ nm_setting_802_1x_get_domain_suffix_match (NMSetting8021x *setting) * Since: 1.24 **/ const char * -nm_setting_802_1x_get_domain_match (NMSetting8021x *setting) +nm_setting_802_1x_get_domain_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->domain_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->domain_match; } /** @@ -1276,9 +1278,9 @@ nm_setting_802_1x_get_domain_match (NMSetting8021x *setting) * Returns: scheme used to store the client certificate (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_client_cert_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, client_cert); + _cert_impl_get_scheme(setting, client_cert); } /** @@ -1292,9 +1294,9 @@ nm_setting_802_1x_get_client_cert_scheme (NMSetting8021x *setting) * Returns: (transfer none): the client certificate data **/ GBytes * -nm_setting_802_1x_get_client_cert_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, client_cert); + _cert_impl_get_blob(setting, client_cert); } /** @@ -1308,9 +1310,9 @@ nm_setting_802_1x_get_client_cert_blob (NMSetting8021x *setting) * Returns: path to the client certificate file **/ const char * -nm_setting_802_1x_get_client_cert_path (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, client_cert); + _cert_impl_get_path(setting, client_cert); } /** @@ -1321,7 +1323,7 @@ nm_setting_802_1x_get_client_cert_path (NMSetting8021x *setting) * nm_setting_802_1x_get_client_cert_blob() and * nm_setting_802_1x_get_client_cert_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -1330,9 +1332,9 @@ nm_setting_802_1x_get_client_cert_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_client_cert_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, client_cert); + _cert_impl_get_uri(setting, client_cert); } /** @@ -1359,13 +1361,13 @@ nm_setting_802_1x_get_client_cert_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_client_cert (NMSetting8021x *setting, - const char *value, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_client_cert(NMSetting8021x * setting, + const char * value, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_CLIENT_CERT, value, NULL, scheme, out_format, error); + return _cert_impl_set(setting, PROP_CLIENT_CERT, value, NULL, scheme, out_format, error); } /** @@ -1379,11 +1381,11 @@ nm_setting_802_1x_set_client_cert (NMSetting8021x *setting, * Since: 1.8 **/ const char * -nm_setting_802_1x_get_client_cert_password (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->client_cert_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->client_cert_password; } /** @@ -1396,11 +1398,11 @@ nm_setting_802_1x_get_client_cert_password (NMSetting8021x *setting) * Since: 1.8 **/ NMSettingSecretFlags -nm_setting_802_1x_get_client_cert_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_client_cert_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->client_cert_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->client_cert_password_flags; } /** @@ -1412,11 +1414,11 @@ nm_setting_802_1x_get_client_cert_password_flags (NMSetting8021x *setting) * values are %NULL (unset), "0" (PEAP version 0), and "1" (PEAP version 1). **/ const char * -nm_setting_802_1x_get_phase1_peapver (NMSetting8021x *setting) +nm_setting_802_1x_get_phase1_peapver(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase1_peapver; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase1_peapver; } /** @@ -1430,11 +1432,11 @@ nm_setting_802_1x_get_phase1_peapver (NMSetting8021x *setting) * wpa_supplicant documentation for more details. **/ const char * -nm_setting_802_1x_get_phase1_peaplabel (NMSetting8021x *setting) +nm_setting_802_1x_get_phase1_peaplabel(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase1_peaplabel; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase1_peaplabel; } /** @@ -1446,11 +1448,11 @@ nm_setting_802_1x_get_phase1_peaplabel (NMSetting8021x *setting) * wpa_supplicant documentation for more details. **/ const char * -nm_setting_802_1x_get_phase1_fast_provisioning (NMSetting8021x *setting) +nm_setting_802_1x_get_phase1_fast_provisioning(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase1_fast_provisioning; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase1_fast_provisioning; } /** @@ -1462,11 +1464,11 @@ nm_setting_802_1x_get_phase1_fast_provisioning (NMSetting8021x *setting) * Since: 1.8 */ NMSetting8021xAuthFlags -nm_setting_802_1x_get_phase1_auth_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_phase1_auth_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), 0); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), 0); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase1_auth_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase1_auth_flags; } /** @@ -1477,11 +1479,11 @@ nm_setting_802_1x_get_phase1_auth_flags (NMSetting8021x *setting) * specified by the #NMSetting8021x:phase2-auth property. **/ const char * -nm_setting_802_1x_get_phase2_auth (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_auth(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_auth; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_auth; } /** @@ -1492,11 +1494,11 @@ nm_setting_802_1x_get_phase2_auth (NMSetting8021x *setting) * specified by the #NMSetting8021x:phase2-autheap property. **/ const char * -nm_setting_802_1x_get_phase2_autheap (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_autheap(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_autheap; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_autheap; } /** @@ -1512,11 +1514,11 @@ nm_setting_802_1x_get_phase2_autheap (NMSetting8021x *setting) * Returns: the "phase 2" CA certificate directory path **/ const char * -nm_setting_802_1x_get_phase2_ca_path (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_path(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_ca_path; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_ca_path; } /** @@ -1532,9 +1534,9 @@ nm_setting_802_1x_get_phase2_ca_path (NMSetting8021x *setting) * Returns: scheme used to store the "phase 2" CA certificate (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_phase2_ca_cert_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, phase2_ca_cert); + _cert_impl_get_scheme(setting, phase2_ca_cert); } /** @@ -1551,9 +1553,9 @@ nm_setting_802_1x_get_phase2_ca_cert_scheme (NMSetting8021x *setting) * Returns: (transfer none): the "phase 2" CA certificate data **/ GBytes * -nm_setting_802_1x_get_phase2_ca_cert_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, phase2_ca_cert); + _cert_impl_get_blob(setting, phase2_ca_cert); } /** @@ -1570,9 +1572,9 @@ nm_setting_802_1x_get_phase2_ca_cert_blob (NMSetting8021x *setting) * Returns: path to the "phase 2" CA certificate file **/ const char * -nm_setting_802_1x_get_phase2_ca_cert_path (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, phase2_ca_cert); + _cert_impl_get_path(setting, phase2_ca_cert); } /** @@ -1583,7 +1585,7 @@ nm_setting_802_1x_get_phase2_ca_cert_path (NMSetting8021x *setting) * nm_setting_802_1x_get_phase2_ca_cert_blob() and * nm_setting_802_1x_get_phase2_ca_cert_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -1592,9 +1594,9 @@ nm_setting_802_1x_get_phase2_ca_cert_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_phase2_ca_cert_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, phase2_ca_cert); + _cert_impl_get_uri(setting, phase2_ca_cert); } /** @@ -1617,13 +1619,13 @@ nm_setting_802_1x_get_phase2_ca_cert_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_phase2_ca_cert (NMSetting8021x *setting, - const char *value, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_phase2_ca_cert(NMSetting8021x * setting, + const char * value, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_PHASE2_CA_CERT, value, NULL, scheme, out_format, error); + return _cert_impl_set(setting, PROP_PHASE2_CA_CERT, value, NULL, scheme, out_format, error); } /** @@ -1637,11 +1639,11 @@ nm_setting_802_1x_set_phase2_ca_cert (NMSetting8021x *setting, * Since: 1.8 **/ const char * -nm_setting_802_1x_get_phase2_ca_cert_password (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_ca_cert_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_ca_cert_password; } /** @@ -1654,11 +1656,11 @@ nm_setting_802_1x_get_phase2_ca_cert_password (NMSetting8021x *setting) * Since: 1.8 **/ NMSettingSecretFlags -nm_setting_802_1x_get_phase2_ca_cert_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_ca_cert_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_ca_cert_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_ca_cert_password_flags; } /** @@ -1671,11 +1673,11 @@ nm_setting_802_1x_get_phase2_ca_cert_password_flags (NMSetting8021x *setting) * is to be performed. **/ const char * -nm_setting_802_1x_get_phase2_subject_match (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_subject_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_subject_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_subject_match; } /** @@ -1688,11 +1690,11 @@ nm_setting_802_1x_get_phase2_subject_match (NMSetting8021x *setting) * Returns: the number of phase2-altsubject-matches entries. **/ guint32 -nm_setting_802_1x_get_num_phase2_altsubject_matches (NMSetting8021x *setting) +nm_setting_802_1x_get_num_phase2_altsubject_matches(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), 0); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), 0); - return g_slist_length (NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_altsubject_matches); + return g_slist_length(NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_altsubject_matches); } /** @@ -1704,11 +1706,11 @@ nm_setting_802_1x_get_num_phase2_altsubject_matches (NMSetting8021x *setting) * Since: 1.2 **/ const char * -nm_setting_802_1x_get_phase2_domain_suffix_match (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_domain_suffix_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_domain_suffix_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_domain_suffix_match; } /** @@ -1720,11 +1722,11 @@ nm_setting_802_1x_get_phase2_domain_suffix_match (NMSetting8021x *setting) * Since: 1.24 **/ const char * -nm_setting_802_1x_get_phase2_domain_match (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_domain_match(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_domain_match; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_domain_match; } /** @@ -1737,16 +1739,16 @@ nm_setting_802_1x_get_phase2_domain_match (NMSetting8021x *setting) * Returns: the "phase 2" altSubjectName match at index @i **/ const char * -nm_setting_802_1x_get_phase2_altsubject_match (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_get_phase2_altsubject_match(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_return_val_if_fail (i <= g_slist_length (priv->phase2_altsubject_matches), NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_return_val_if_fail(i <= g_slist_length(priv->phase2_altsubject_matches), NULL); - return (const char *) g_slist_nth_data (priv->phase2_altsubject_matches, i); + return (const char *) g_slist_nth_data(priv->phase2_altsubject_matches, i); } /** @@ -1763,25 +1765,25 @@ nm_setting_802_1x_get_phase2_altsubject_match (NMSetting8021x *setting, guint32 * successfully added, %FALSE if it was already allowed. **/ gboolean -nm_setting_802_1x_add_phase2_altsubject_match (NMSetting8021x *setting, - const char *phase2_altsubject_match) +nm_setting_802_1x_add_phase2_altsubject_match(NMSetting8021x *setting, + const char * phase2_altsubject_match) { - NMSetting8021xPrivate *priv; - GSList *iter; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (phase2_altsubject_match != NULL, FALSE); - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->phase2_altsubject_matches; iter; iter = g_slist_next (iter)) { - if (!strcmp (phase2_altsubject_match, (char *) iter->data)) - return FALSE; - } - - priv->phase2_altsubject_matches = g_slist_append (priv->phase2_altsubject_matches, - g_strdup (phase2_altsubject_match)); - _notify (setting, PROP_PHASE2_ALTSUBJECT_MATCHES); - return TRUE; + NMSetting8021xPrivate *priv; + GSList * iter; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(phase2_altsubject_match != NULL, FALSE); + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->phase2_altsubject_matches; iter; iter = g_slist_next(iter)) { + if (!strcmp(phase2_altsubject_match, (char *) iter->data)) + return FALSE; + } + + priv->phase2_altsubject_matches = + g_slist_append(priv->phase2_altsubject_matches, g_strdup(phase2_altsubject_match)); + _notify(setting, PROP_PHASE2_ALTSUBJECT_MATCHES); + return TRUE; } /** @@ -1792,20 +1794,20 @@ nm_setting_802_1x_add_phase2_altsubject_match (NMSetting8021x *setting, * Removes the allowed "phase 2" altSubjectName at the specified index. **/ void -nm_setting_802_1x_remove_phase2_altsubject_match (NMSetting8021x *setting, guint32 i) +nm_setting_802_1x_remove_phase2_altsubject_match(NMSetting8021x *setting, guint32 i) { - NMSetting8021xPrivate *priv; - GSList *elt; + NMSetting8021xPrivate *priv; + GSList * elt; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - elt = g_slist_nth (priv->phase2_altsubject_matches, i); - g_return_if_fail (elt != NULL); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + elt = g_slist_nth(priv->phase2_altsubject_matches, i); + g_return_if_fail(elt != NULL); - g_free (elt->data); - priv->phase2_altsubject_matches = g_slist_delete_link (priv->phase2_altsubject_matches, elt); - _notify (setting, PROP_PHASE2_ALTSUBJECT_MATCHES); + g_free(elt->data); + priv->phase2_altsubject_matches = g_slist_delete_link(priv->phase2_altsubject_matches, elt); + _notify(setting, PROP_PHASE2_ALTSUBJECT_MATCHES); } /** @@ -1819,24 +1821,25 @@ nm_setting_802_1x_remove_phase2_altsubject_match (NMSetting8021x *setting, guint * %FALSE if it was not. **/ gboolean -nm_setting_802_1x_remove_phase2_altsubject_match_by_value (NMSetting8021x *setting, - const char *phase2_altsubject_match) +nm_setting_802_1x_remove_phase2_altsubject_match_by_value(NMSetting8021x *setting, + const char * phase2_altsubject_match) { - NMSetting8021xPrivate *priv; - GSList *iter; - - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); - g_return_val_if_fail (phase2_altsubject_match != NULL, FALSE); - - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - for (iter = priv->phase2_altsubject_matches; iter; iter = g_slist_next (iter)) { - if (!strcmp (phase2_altsubject_match, (char *) iter->data)) { - priv->phase2_altsubject_matches = g_slist_delete_link (priv->phase2_altsubject_matches, iter); - _notify (setting, PROP_PHASE2_ALTSUBJECT_MATCHES); - return TRUE; - } - } - return FALSE; + NMSetting8021xPrivate *priv; + GSList * iter; + + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); + g_return_val_if_fail(phase2_altsubject_match != NULL, FALSE); + + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + for (iter = priv->phase2_altsubject_matches; iter; iter = g_slist_next(iter)) { + if (!strcmp(phase2_altsubject_match, (char *) iter->data)) { + priv->phase2_altsubject_matches = + g_slist_delete_link(priv->phase2_altsubject_matches, iter); + _notify(setting, PROP_PHASE2_ALTSUBJECT_MATCHES); + return TRUE; + } + } + return FALSE; } /** @@ -1846,16 +1849,16 @@ nm_setting_802_1x_remove_phase2_altsubject_match_by_value (NMSetting8021x *setti * Clears all "phase 2" altSubjectName matches. **/ void -nm_setting_802_1x_clear_phase2_altsubject_matches (NMSetting8021x *setting) +nm_setting_802_1x_clear_phase2_altsubject_matches(NMSetting8021x *setting) { - NMSetting8021xPrivate *priv; + NMSetting8021xPrivate *priv; - g_return_if_fail (NM_IS_SETTING_802_1X (setting)); + g_return_if_fail(NM_IS_SETTING_802_1X(setting)); - priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - g_slist_free_full (priv->phase2_altsubject_matches, g_free); - priv->phase2_altsubject_matches = NULL; - _notify (setting, PROP_PHASE2_ALTSUBJECT_MATCHES); + priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + g_slist_free_full(priv->phase2_altsubject_matches, g_free); + priv->phase2_altsubject_matches = NULL; + _notify(setting, PROP_PHASE2_ALTSUBJECT_MATCHES); } /** @@ -1873,9 +1876,9 @@ nm_setting_802_1x_clear_phase2_altsubject_matches (NMSetting8021x *setting) * Returns: scheme used to store the "phase 2" client certificate (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_phase2_client_cert_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, phase2_client_cert); + _cert_impl_get_scheme(setting, phase2_client_cert); } /** @@ -1889,9 +1892,9 @@ nm_setting_802_1x_get_phase2_client_cert_scheme (NMSetting8021x *setting) * Returns: (transfer none): the "phase 2" client certificate data **/ GBytes * -nm_setting_802_1x_get_phase2_client_cert_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, phase2_client_cert); + _cert_impl_get_blob(setting, phase2_client_cert); } /** @@ -1905,9 +1908,9 @@ nm_setting_802_1x_get_phase2_client_cert_blob (NMSetting8021x *setting) * Returns: path to the "phase 2" client certificate file **/ const char * -nm_setting_802_1x_get_phase2_client_cert_path (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, phase2_client_cert); + _cert_impl_get_path(setting, phase2_client_cert); } /** @@ -1918,7 +1921,7 @@ nm_setting_802_1x_get_phase2_client_cert_path (NMSetting8021x *setting) * nm_setting_802_1x_get_phase2_ca_cert_blob() and * nm_setting_802_1x_get_phase2_ca_cert_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -1927,9 +1930,9 @@ nm_setting_802_1x_get_phase2_client_cert_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_phase2_client_cert_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, phase2_client_cert); + _cert_impl_get_uri(setting, phase2_client_cert); } /** @@ -1956,13 +1959,13 @@ nm_setting_802_1x_get_phase2_client_cert_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_phase2_client_cert (NMSetting8021x *setting, - const char *value, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_phase2_client_cert(NMSetting8021x * setting, + const char * value, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_PHASE2_CLIENT_CERT, value, NULL, scheme, out_format, error); + return _cert_impl_set(setting, PROP_PHASE2_CLIENT_CERT, value, NULL, scheme, out_format, error); } /** @@ -1976,11 +1979,11 @@ nm_setting_802_1x_set_phase2_client_cert (NMSetting8021x *setting, * Since: 1.8 **/ const char * -nm_setting_802_1x_get_phase2_client_cert_password (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_client_cert_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_client_cert_password; } /** @@ -1993,11 +1996,11 @@ nm_setting_802_1x_get_phase2_client_cert_password (NMSetting8021x *setting) * Since: 1.8 **/ NMSettingSecretFlags -nm_setting_802_1x_get_phase2_client_cert_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_client_cert_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_client_cert_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_client_cert_password_flags; } /** @@ -2008,11 +2011,11 @@ nm_setting_802_1x_get_phase2_client_cert_password_flags (NMSetting8021x *setting * by the #NMSetting8021x:password property **/ const char * -nm_setting_802_1x_get_password (NMSetting8021x *setting) +nm_setting_802_1x_get_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->password; } /** @@ -2022,11 +2025,11 @@ nm_setting_802_1x_get_password (NMSetting8021x *setting) * Returns: the #NMSettingSecretFlags pertaining to the #NMSetting8021x:password **/ NMSettingSecretFlags -nm_setting_802_1x_get_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->password_flags; } /** @@ -2038,11 +2041,11 @@ nm_setting_802_1x_get_password_flags (NMSetting8021x *setting) * #NMSetting8021x:password-raw property **/ GBytes * -nm_setting_802_1x_get_password_raw (NMSetting8021x *setting) +nm_setting_802_1x_get_password_raw(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->password_raw; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->password_raw; } /** @@ -2053,11 +2056,11 @@ nm_setting_802_1x_get_password_raw (NMSetting8021x *setting) * #NMSetting8021x:password-raw **/ NMSettingSecretFlags -nm_setting_802_1x_get_password_raw_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_password_raw_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->password_raw_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->password_raw_flags; } /** @@ -2068,11 +2071,11 @@ nm_setting_802_1x_get_password_raw_flags (NMSetting8021x *setting) * by the #NMSetting8021x:pin property **/ const char * -nm_setting_802_1x_get_pin (NMSetting8021x *setting) +nm_setting_802_1x_get_pin(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->pin; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->pin; } /** @@ -2083,11 +2086,11 @@ nm_setting_802_1x_get_pin (NMSetting8021x *setting) * #NMSetting8021x:pin **/ NMSettingSecretFlags -nm_setting_802_1x_get_pin_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_pin_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->pin_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->pin_flags; } /** @@ -2105,9 +2108,9 @@ nm_setting_802_1x_get_pin_flags (NMSetting8021x *setting) * Returns: scheme used to store the private key (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_private_key_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, private_key); + _cert_impl_get_scheme(setting, private_key); } /** @@ -2125,9 +2128,9 @@ nm_setting_802_1x_get_private_key_scheme (NMSetting8021x *setting) * Returns: (transfer none): the private key data **/ GBytes * -nm_setting_802_1x_get_private_key_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, private_key); + _cert_impl_get_blob(setting, private_key); } /** @@ -2141,9 +2144,9 @@ nm_setting_802_1x_get_private_key_blob (NMSetting8021x *setting) * Returns: path to the private key file **/ const char * -nm_setting_802_1x_get_private_key_path (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, private_key); + _cert_impl_get_path(setting, private_key); } /** @@ -2154,7 +2157,7 @@ nm_setting_802_1x_get_private_key_path (NMSetting8021x *setting) * nm_setting_802_1x_get_private_key_blob() and * nm_setting_802_1x_get_private_key_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -2163,9 +2166,9 @@ nm_setting_802_1x_get_private_key_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_private_key_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, private_key); + _cert_impl_get_uri(setting, private_key); } /** @@ -2208,14 +2211,14 @@ nm_setting_802_1x_get_private_key_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_private_key (NMSetting8021x *setting, - const char *value, - const char *password, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_private_key(NMSetting8021x * setting, + const char * value, + const char * password, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_PRIVATE_KEY, value, password, scheme, out_format, error); + return _cert_impl_set(setting, PROP_PRIVATE_KEY, value, password, scheme, out_format, error); } /** @@ -2227,11 +2230,11 @@ nm_setting_802_1x_set_private_key (NMSetting8021x *setting, * #NMSetting8021x:private-key-password property. **/ const char * -nm_setting_802_1x_get_private_key_password (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->private_key_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->private_key_password; } /** @@ -2242,11 +2245,11 @@ nm_setting_802_1x_get_private_key_password (NMSetting8021x *setting) * #NMSetting8021x:private-key-password **/ NMSettingSecretFlags -nm_setting_802_1x_get_private_key_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->private_key_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->private_key_password_flags; } /** @@ -2257,9 +2260,9 @@ nm_setting_802_1x_get_private_key_password_flags (NMSetting8021x *setting) * #NMSetting8021x:private-key property **/ NMSetting8021xCKFormat -nm_setting_802_1x_get_private_key_format (NMSetting8021x *setting) +nm_setting_802_1x_get_private_key_format(NMSetting8021x *setting) { - return _cert_impl_get_key_format (setting, private_key); + return _cert_impl_get_key_format(setting, private_key); } /** @@ -2271,11 +2274,11 @@ nm_setting_802_1x_get_private_key_format (NMSetting8021x *setting) * #NMSetting8021x:phase2-private-key-password property. **/ const char * -nm_setting_802_1x_get_phase2_private_key_password (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_password(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NULL); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_private_key_password; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_private_key_password; } /** @@ -2286,11 +2289,11 @@ nm_setting_802_1x_get_phase2_private_key_password (NMSetting8021x *setting) * #NMSetting8021x:phase2-private-key-password **/ NMSettingSecretFlags -nm_setting_802_1x_get_phase2_private_key_password_flags (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_password_flags(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NM_SETTING_SECRET_FLAG_NONE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), NM_SETTING_SECRET_FLAG_NONE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_private_key_password_flags; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->phase2_private_key_password_flags; } /** @@ -2308,9 +2311,9 @@ nm_setting_802_1x_get_phase2_private_key_password_flags (NMSetting8021x *setting * Returns: scheme used to store the "phase 2" private key (blob or path) **/ NMSetting8021xCKScheme -nm_setting_802_1x_get_phase2_private_key_scheme (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_scheme(NMSetting8021x *setting) { - _cert_impl_get_scheme (setting, phase2_private_key); + _cert_impl_get_scheme(setting, phase2_private_key); } /** @@ -2328,9 +2331,9 @@ nm_setting_802_1x_get_phase2_private_key_scheme (NMSetting8021x *setting) * Returns: (transfer none): the "phase 2" private key data **/ GBytes * -nm_setting_802_1x_get_phase2_private_key_blob (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_blob(NMSetting8021x *setting) { - _cert_impl_get_blob (setting, phase2_private_key); + _cert_impl_get_blob(setting, phase2_private_key); } /** @@ -2344,9 +2347,9 @@ nm_setting_802_1x_get_phase2_private_key_blob (NMSetting8021x *setting) * Returns: path to the "phase 2" private key file **/ const char * -nm_setting_802_1x_get_phase2_private_key_path (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_path(NMSetting8021x *setting) { - _cert_impl_get_path (setting, phase2_private_key); + _cert_impl_get_path(setting, phase2_private_key); } /** @@ -2357,7 +2360,7 @@ nm_setting_802_1x_get_phase2_private_key_path (NMSetting8021x *setting) * nm_setting_802_1x_get_phase2_private_key_blob() and * nm_setting_802_1x_get_phase2_private_key_path(). * - * Currently it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC + * Currently, it's limited to PKCS#11 URIs ('pkcs11' scheme as defined by RFC * 7512), but may be extended to other schemes in future (such as 'file' URIs * for local files and 'data' URIs for inline certificate data). * @@ -2366,9 +2369,9 @@ nm_setting_802_1x_get_phase2_private_key_path (NMSetting8021x *setting) * Since: 1.6 **/ const char * -nm_setting_802_1x_get_phase2_private_key_uri (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_uri(NMSetting8021x *setting) { - _cert_impl_get_uri (setting, phase2_private_key); + _cert_impl_get_uri(setting, phase2_private_key); } /** @@ -2411,14 +2414,20 @@ nm_setting_802_1x_get_phase2_private_key_uri (NMSetting8021x *setting) * Returns: %TRUE if the operation succeeded, %FALSE if it was unsuccessful **/ gboolean -nm_setting_802_1x_set_phase2_private_key (NMSetting8021x *setting, - const char *value, - const char *password, - NMSetting8021xCKScheme scheme, - NMSetting8021xCKFormat *out_format, - GError **error) +nm_setting_802_1x_set_phase2_private_key(NMSetting8021x * setting, + const char * value, + const char * password, + NMSetting8021xCKScheme scheme, + NMSetting8021xCKFormat *out_format, + GError ** error) { - return _cert_impl_set (setting, PROP_PHASE2_PRIVATE_KEY, value, password, scheme, out_format, error); + return _cert_impl_set(setting, + PROP_PHASE2_PRIVATE_KEY, + value, + password, + scheme, + out_format, + error); } /** @@ -2429,9 +2438,9 @@ nm_setting_802_1x_set_phase2_private_key (NMSetting8021x *setting, * #NMSetting8021x:phase2-private-key property **/ NMSetting8021xCKFormat -nm_setting_802_1x_get_phase2_private_key_format (NMSetting8021x *setting) +nm_setting_802_1x_get_phase2_private_key_format(NMSetting8021x *setting) { - return _cert_impl_get_key_format (setting, phase2_private_key); + return _cert_impl_get_key_format(setting, phase2_private_key); } /** @@ -2446,11 +2455,11 @@ nm_setting_802_1x_get_phase2_private_key_format (NMSetting8021x *setting) * Since: 1.8 **/ int -nm_setting_802_1x_get_auth_timeout (NMSetting8021x *setting) +nm_setting_802_1x_get_auth_timeout(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), 0); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), 0); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->auth_timeout; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->auth_timeout; } /** @@ -2465,960 +2474,1019 @@ nm_setting_802_1x_get_auth_timeout (NMSetting8021x *setting) * Since: 1.22 **/ gboolean -nm_setting_802_1x_get_optional (NMSetting8021x *setting) +nm_setting_802_1x_get_optional(NMSetting8021x *setting) { - g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE); + g_return_val_if_fail(NM_IS_SETTING_802_1X(setting), FALSE); - return NM_SETTING_802_1X_GET_PRIVATE (setting)->optional; + return NM_SETTING_802_1X_GET_PRIVATE(setting)->optional; } /*****************************************************************************/ static void -need_secrets_password (NMSetting8021x *self, - GPtrArray *secrets, - gboolean phase2) +need_secrets_password(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); - if ( (!priv->password || !strlen (priv->password)) - && (!priv->password_raw || !g_bytes_get_size (priv->password_raw))) { - g_ptr_array_add (secrets, NM_SETTING_802_1X_PASSWORD); - g_ptr_array_add (secrets, NM_SETTING_802_1X_PASSWORD_RAW); - } + if ((!priv->password || !strlen(priv->password)) + && (!priv->password_raw || !g_bytes_get_size(priv->password_raw))) { + g_ptr_array_add(secrets, NM_SETTING_802_1X_PASSWORD); + g_ptr_array_add(secrets, NM_SETTING_802_1X_PASSWORD_RAW); + } } static void -need_secrets_sim (NMSetting8021x *self, - GPtrArray *secrets, - gboolean phase2) +need_secrets_sim(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); - if (!priv->pin || !strlen (priv->pin)) - g_ptr_array_add (secrets, NM_SETTING_802_1X_PIN); + if (!priv->pin || !strlen(priv->pin)) + g_ptr_array_add(secrets, NM_SETTING_802_1X_PIN); } static gboolean -need_private_key_password (GBytes *blob, - NMSetting8021xCKScheme scheme, - const char *path, - const char *password, - NMSettingSecretFlags flags) +need_private_key_password(GBytes * blob, + NMSetting8021xCKScheme scheme, + const char * path, + const char * password, + NMSettingSecretFlags flags) { - NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN; - - if (flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) - return FALSE; - - if ( scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && flags == NM_SETTING_SECRET_FLAG_NONE) - return FALSE; - - /* Private key password is required */ - if (password) { - if (path) - format = nm_crypto_verify_private_key (path, password, NULL, NULL); - else if (blob) - format = nm_crypto_verify_private_key_data (g_bytes_get_data (blob, NULL), - g_bytes_get_size (blob), - password, NULL, NULL); - else - return FALSE; - } - - return (format == NM_CRYPTO_FILE_FORMAT_UNKNOWN); + NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN; + + if (flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) + return FALSE; + + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 && flags == NM_SETTING_SECRET_FLAG_NONE) + return FALSE; + + /* Private key password is required */ + if (password) { + if (path) + format = nm_crypto_verify_private_key(path, password, NULL, NULL); + else if (blob) + format = nm_crypto_verify_private_key_data(g_bytes_get_data(blob, NULL), + g_bytes_get_size(blob), + password, + NULL, + NULL); + else + return FALSE; + } + + return (format == NM_CRYPTO_FILE_FORMAT_UNKNOWN); } static void -need_secrets_tls (NMSetting8021x *self, - GPtrArray *secrets, - gboolean phase2) +need_secrets_tls(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - NMSetting8021xCKScheme scheme; - GBytes *blob = NULL; - const char *path = NULL; - - if (phase2) { - scheme = nm_setting_802_1x_get_phase2_private_key_scheme (self); - if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) - path = nm_setting_802_1x_get_phase2_private_key_path (self); - else if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) - blob = nm_setting_802_1x_get_phase2_private_key_blob (self); - else if (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11) - g_warning ("%s: unknown phase2 private key scheme %d", __func__, scheme); - - if (need_private_key_password (blob, scheme, path, - priv->phase2_private_key_password, - priv->phase2_private_key_password_flags)) - g_ptr_array_add (secrets, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD); - - scheme = nm_setting_802_1x_get_phase2_ca_cert_scheme (self); - if ( scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && !( priv->phase2_ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE - || priv->phase2_ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) - && !priv->phase2_ca_cert_password) - g_ptr_array_add (secrets, NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD); - - scheme = nm_setting_802_1x_get_phase2_client_cert_scheme (self); - if ( scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && !( priv->phase2_client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED - || priv->phase2_client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE) - && !priv->phase2_client_cert_password) - g_ptr_array_add (secrets, NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD); - } else { - scheme = nm_setting_802_1x_get_private_key_scheme (self); - if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) - path = nm_setting_802_1x_get_private_key_path (self); - else if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) - blob = nm_setting_802_1x_get_private_key_blob (self); - else if (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11) - g_warning ("%s: unknown private key scheme %d", __func__, scheme); - - if (need_private_key_password (blob, scheme, path, - priv->private_key_password, - priv->private_key_password_flags)) - g_ptr_array_add (secrets, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD); - - scheme = nm_setting_802_1x_get_ca_cert_scheme (self); - if ( scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && !( priv->ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED - || priv->ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE) - && !priv->ca_cert_password) - g_ptr_array_add (secrets, NM_SETTING_802_1X_CA_CERT_PASSWORD); - - scheme = nm_setting_802_1x_get_client_cert_scheme (self); - if ( scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 - && !( priv->client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE - || priv->client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) - && !priv->client_cert_password) - g_ptr_array_add (secrets, NM_SETTING_802_1X_CLIENT_CERT_PASSWORD); - } + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + NMSetting8021xCKScheme scheme; + GBytes * blob = NULL; + const char * path = NULL; + + if (phase2) { + scheme = nm_setting_802_1x_get_phase2_private_key_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) + path = nm_setting_802_1x_get_phase2_private_key_path(self); + else if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) + blob = nm_setting_802_1x_get_phase2_private_key_blob(self); + else if (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11) + g_warning("%s: unknown phase2 private key scheme %d", __func__, scheme); + + if (need_private_key_password(blob, + scheme, + path, + priv->phase2_private_key_password, + priv->phase2_private_key_password_flags)) + g_ptr_array_add(secrets, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD); + + scheme = nm_setting_802_1x_get_phase2_ca_cert_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && !(priv->phase2_ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE + || priv->phase2_ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) + && !priv->phase2_ca_cert_password) + g_ptr_array_add(secrets, NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD); + + scheme = nm_setting_802_1x_get_phase2_client_cert_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && !(priv->phase2_client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED + || priv->phase2_client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE) + && !priv->phase2_client_cert_password) + g_ptr_array_add(secrets, NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD); + } else { + scheme = nm_setting_802_1x_get_private_key_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH) + path = nm_setting_802_1x_get_private_key_path(self); + else if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) + blob = nm_setting_802_1x_get_private_key_blob(self); + else if (scheme != NM_SETTING_802_1X_CK_SCHEME_PKCS11) + g_warning("%s: unknown private key scheme %d", __func__, scheme); + + if (need_private_key_password(blob, + scheme, + path, + priv->private_key_password, + priv->private_key_password_flags)) + g_ptr_array_add(secrets, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD); + + scheme = nm_setting_802_1x_get_ca_cert_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && !(priv->ca_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED + || priv->ca_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE) + && !priv->ca_cert_password) + g_ptr_array_add(secrets, NM_SETTING_802_1X_CA_CERT_PASSWORD); + + scheme = nm_setting_802_1x_get_client_cert_scheme(self); + if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11 + && !(priv->client_cert_password_flags == NM_SETTING_SECRET_FLAG_NONE + || priv->client_cert_password_flags & NM_SETTING_SECRET_FLAG_NOT_REQUIRED) + && !priv->client_cert_password) + g_ptr_array_add(secrets, NM_SETTING_802_1X_CLIENT_CERT_PASSWORD); + } } static gboolean -verify_tls (NMSetting8021x *self, gboolean phase2, GError **error) +verify_tls(NMSetting8021x *self, gboolean phase2, GError **error) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - - if (phase2) { - if (!priv->phase2_client_cert) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_CLIENT_CERT); - return FALSE; - } else if (!g_bytes_get_size (priv->phase2_client_cert)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_CLIENT_CERT); - return FALSE; - } - - /* Private key is required for TLS */ - if (!priv->phase2_private_key) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); - return FALSE; - } else if (!g_bytes_get_size (priv->phase2_private_key)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); - return FALSE; - } - - /* If the private key is PKCS#12, check that it matches the client cert */ - if (nm_crypto_is_pkcs12_data (g_bytes_get_data (priv->phase2_private_key, NULL), - g_bytes_get_size (priv->phase2_private_key), - NULL)) { - if (!g_bytes_equal (priv->phase2_private_key, priv->phase2_client_cert)) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("has to match '%s' property for PKCS#12"), - NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_CLIENT_CERT); - return FALSE; - } - } - } else { - if (!priv->client_cert) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_CLIENT_CERT); - return FALSE; - } else if (!g_bytes_get_size (priv->client_cert)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_CLIENT_CERT); - return FALSE; - } - - /* Private key is required for TLS */ - if (!priv->private_key) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PRIVATE_KEY); - return FALSE; - } else if (!g_bytes_get_size (priv->private_key)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PRIVATE_KEY); - return FALSE; - } - - /* If the private key is PKCS#12, check that it matches the client cert */ - if (nm_crypto_is_pkcs12_data (g_bytes_get_data (priv->private_key, NULL), - g_bytes_get_size (priv->private_key), - NULL)) { - if (!g_bytes_equal (priv->private_key, priv->client_cert)) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("has to match '%s' property for PKCS#12"), - NM_SETTING_802_1X_PRIVATE_KEY); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_CLIENT_CERT); - return FALSE; - } - } - } - - return TRUE; + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + + if (phase2) { + if (!priv->phase2_client_cert) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_CLIENT_CERT); + return FALSE; + } else if (!g_bytes_get_size(priv->phase2_client_cert)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_CLIENT_CERT); + return FALSE; + } + + /* Private key is required for TLS */ + if (!priv->phase2_private_key) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); + return FALSE; + } else if (!g_bytes_get_size(priv->phase2_private_key)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); + return FALSE; + } + + /* If the private key is PKCS#12, check that it matches the client cert */ + if (nm_crypto_is_pkcs12_data(g_bytes_get_data(priv->phase2_private_key, NULL), + g_bytes_get_size(priv->phase2_private_key), + NULL)) { + if (!g_bytes_equal(priv->phase2_private_key, priv->phase2_client_cert)) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("has to match '%s' property for PKCS#12"), + NM_SETTING_802_1X_PHASE2_PRIVATE_KEY); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_CLIENT_CERT); + return FALSE; + } + } + } else { + if (!priv->client_cert) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_CLIENT_CERT); + return FALSE; + } else if (!g_bytes_get_size(priv->client_cert)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_CLIENT_CERT); + return FALSE; + } + + /* Private key is required for TLS */ + if (!priv->private_key) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PRIVATE_KEY); + return FALSE; + } else if (!g_bytes_get_size(priv->private_key)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PRIVATE_KEY); + return FALSE; + } + + /* If the private key is PKCS#12, check that it matches the client cert */ + if (nm_crypto_is_pkcs12_data(g_bytes_get_data(priv->private_key, NULL), + g_bytes_get_size(priv->private_key), + NULL)) { + if (!g_bytes_equal(priv->private_key, priv->client_cert)) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("has to match '%s' property for PKCS#12"), + NM_SETTING_802_1X_PRIVATE_KEY); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_CLIENT_CERT); + return FALSE; + } + } + } + + return TRUE; } static gboolean -verify_ttls (NMSetting8021x *self, gboolean phase2, GError **error) +verify_ttls(NMSetting8021x *self, gboolean phase2, GError **error) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - - if ( (!priv->identity || !strlen (priv->identity)) - && (!priv->anonymous_identity || !strlen (priv->anonymous_identity))) { - if (!priv->identity) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_IDENTITY); - } else if (!strlen (priv->identity)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_IDENTITY); - } else if (!priv->anonymous_identity) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_ANONYMOUS_IDENTITY); - } else { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_ANONYMOUS_IDENTITY); - } - return FALSE; - } - - if ( (!priv->phase2_auth || !strlen (priv->phase2_auth)) - && (!priv->phase2_autheap || !strlen (priv->phase2_autheap))) { - if (!priv->phase2_auth) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTH); - } else if (!strlen (priv->phase2_auth)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTH); - } else if (!priv->phase2_autheap) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTHEAP); - } else { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTHEAP); - } - return FALSE; - } - - return TRUE; + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + + if ((!priv->identity || !strlen(priv->identity)) + && (!priv->anonymous_identity || !strlen(priv->anonymous_identity))) { + if (!priv->identity) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_IDENTITY); + } else if (!strlen(priv->identity)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_IDENTITY); + } else if (!priv->anonymous_identity) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_ANONYMOUS_IDENTITY); + } else { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_ANONYMOUS_IDENTITY); + } + return FALSE; + } + + if ((!priv->phase2_auth || !strlen(priv->phase2_auth)) + && (!priv->phase2_autheap || !strlen(priv->phase2_autheap))) { + if (!priv->phase2_auth) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTH); + } else if (!strlen(priv->phase2_auth)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTH); + } else if (!priv->phase2_autheap) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTHEAP); + } else { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTHEAP); + } + return FALSE; + } + + return TRUE; } static gboolean -verify_identity (NMSetting8021x *self, gboolean phase2, GError **error) +verify_identity(NMSetting8021x *self, gboolean phase2, GError **error) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - - if (!priv->identity) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_IDENTITY); - return FALSE; - } else if (!strlen (priv->identity)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is empty")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_IDENTITY); - return FALSE; - } - - return TRUE; + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + + if (!priv->identity) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_IDENTITY); + return FALSE; + } else if (!strlen(priv->identity)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is empty")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_IDENTITY); + return FALSE; + } + + return TRUE; } static void -need_secrets_phase2 (NMSetting8021x *self, - GPtrArray *secrets, - gboolean phase2) +need_secrets_phase2(NMSetting8021x *self, GPtrArray *secrets, gboolean phase2) { - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - char *method = NULL; - int i; - - g_return_if_fail (phase2 == FALSE); - - /* Check phase2_auth and phase2_autheap */ - method = priv->phase2_auth; - if (!method && priv->phase2_autheap) - method = priv->phase2_autheap; - - if (!method) { - g_warning ("Couldn't find EAP method."); - g_assert_not_reached(); - return; - } - - /* Ask the configured phase2 method if it needs secrets */ - for (i = 0; eap_methods_table[i].method; i++) { - if (eap_methods_table[i].ns_func == NULL) - continue; - if (!strcmp (eap_methods_table[i].method, method)) { - (*eap_methods_table[i].ns_func) (self, secrets, TRUE); - break; - } - } + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + char * method = NULL; + int i; + + g_return_if_fail(phase2 == FALSE); + + /* Check phase2_auth and phase2_autheap */ + method = priv->phase2_auth; + if (!method && priv->phase2_autheap) + method = priv->phase2_autheap; + + if (!method) { + g_warning("Couldn't find EAP method."); + g_assert_not_reached(); + return; + } + + /* Ask the configured phase2 method if it needs secrets */ + for (i = 0; eap_methods_table[i].method; i++) { + if (eap_methods_table[i].ns_func == NULL) + continue; + if (!strcmp(eap_methods_table[i].method, method)) { + (*eap_methods_table[i].ns_func)(self, secrets, TRUE); + break; + } + } } static const EAPMethodsTable eap_methods_table[] = { - { "leap", need_secrets_password, verify_identity }, - { "pwd", need_secrets_password, verify_identity }, - { "md5", need_secrets_password, verify_identity }, - { "pap", need_secrets_password, verify_identity }, - { "chap", need_secrets_password, verify_identity }, - { "mschap", need_secrets_password, verify_identity }, - { "mschapv2", need_secrets_password, verify_identity }, - { "fast", need_secrets_password, verify_identity }, - { "tls", need_secrets_tls, verify_tls }, - { "peap", need_secrets_phase2, verify_ttls }, - { "ttls", need_secrets_phase2, verify_ttls }, - { "sim", need_secrets_sim, NULL }, - { "gtc", need_secrets_password, verify_identity }, - { "otp", NULL, NULL }, // FIXME: implement - { "external", NULL, NULL }, - { NULL, NULL, NULL } -}; + {"leap", need_secrets_password, verify_identity}, + {"pwd", need_secrets_password, verify_identity}, + {"md5", need_secrets_password, verify_identity}, + {"pap", need_secrets_password, verify_identity}, + {"chap", need_secrets_password, verify_identity}, + {"mschap", need_secrets_password, verify_identity}, + {"mschapv2", need_secrets_password, verify_identity}, + {"fast", need_secrets_password, verify_identity}, + {"tls", need_secrets_tls, verify_tls}, + {"peap", need_secrets_phase2, verify_ttls}, + {"ttls", need_secrets_phase2, verify_ttls}, + {"sim", need_secrets_sim, NULL}, + {"gtc", need_secrets_password, verify_identity}, + {"otp", NULL, NULL}, // FIXME: implement + {"external", NULL, NULL}, + {NULL, NULL, NULL}}; static gboolean -verify (NMSetting *setting, NMConnection *connection, GError **error) +verify(NMSetting *setting, NMConnection *connection, GError **error) { - NMSetting8021x *self = NM_SETTING_802_1X (setting); - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - const char *valid_eap[] = { "leap", "md5", "tls", "peap", "ttls", "sim", "fast", "pwd", "external", NULL }; - GSList *iter; - - if (error) - g_return_val_if_fail (*error == NULL, FALSE); - - if ( connection - && priv->optional - && !nm_streq0 (nm_connection_get_connection_type (connection), NM_SETTING_WIRED_SETTING_NAME)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("can be enabled only on Ethernet connections")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_OPTIONAL); - return FALSE; - } - - if (!priv->eap) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_MISSING_PROPERTY, - _("property is missing")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_EAP); - return FALSE; - } - - if (!_nm_utils_string_slist_validate (priv->eap, valid_eap)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("property is invalid")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_EAP); - return FALSE; - } - - /* Ask each configured EAP method if its valid */ - for (iter = priv->eap; iter; iter = g_slist_next (iter)) { - const char *method = (const char *) iter->data; - int i; - - for (i = 0; eap_methods_table[i].method; i++) { - if (eap_methods_table[i].v_func == NULL) - continue; - if (!strcmp (eap_methods_table[i].method, method)) { - if (!(*eap_methods_table[i].v_func) (self, FALSE, error)) - return FALSE; - break; - } - } - } - - if (!NM_IN_STRSET (priv->phase1_peapver, NULL, - "0", - "1")) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("'%s' is not a valid value for the property"), - priv->phase1_peapver); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE1_PEAPVER); - return FALSE; - } - - if (!NM_IN_STRSET (priv->phase1_peaplabel, NULL, - "0", - "1")) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("'%s' is not a valid value for the property"), - priv->phase1_peaplabel); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE1_PEAPLABEL); - return FALSE; - } - - if (!NM_IN_STRSET (priv->phase1_fast_provisioning, NULL, - "0", - "1", - "2", - "3")) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("'%s' is not a valid value for the property"), - priv->phase1_fast_provisioning); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING); - return FALSE; - } - - if (NM_FLAGS_ANY (priv->phase1_auth_flags, ~NM_SETTING_802_1X_AUTH_FLAGS_ALL)) { - g_set_error_literal (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("invalid auth flags")); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE1_AUTH_FLAGS); - return FALSE; - } - - if (!NM_IN_STRSET (priv->phase2_auth, NULL, - "pap", - "chap", - "mschap", - "mschapv2", - "gtc", - "otp", - "md5", - "tls")) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("'%s' is not a valid value for the property"), - priv->phase2_auth); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTH); - return FALSE; - } - - if (!NM_IN_STRSET (priv->phase2_autheap, NULL, - "md5", - "mschapv2", - "otp", - "gtc", - "tls")) { - g_set_error (error, - NM_CONNECTION_ERROR, - NM_CONNECTION_ERROR_INVALID_PROPERTY, - _("'%s' is not a valid value for the property"), - priv->phase2_autheap); - g_prefix_error (error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_PHASE2_AUTHEAP); - return FALSE; - } - - if (!_cert_verify_property (priv->ca_cert, - NM_SETTING_802_1X_CA_CERT, - priv->ca_cert_password, - NM_SETTING_802_1X_CA_CERT_PASSWORD, - error)) - return FALSE; - if (!_cert_verify_property (priv->phase2_ca_cert, - NM_SETTING_802_1X_PHASE2_CA_CERT, - priv->phase2_ca_cert_password, - NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD, - error)) - return FALSE; - - if (!_cert_verify_property (priv->client_cert, - NM_SETTING_802_1X_CLIENT_CERT, - priv->client_cert_password, - NM_SETTING_802_1X_CLIENT_CERT_PASSWORD, - error)) - return FALSE; - if (!_cert_verify_property (priv->phase2_client_cert, - NM_SETTING_802_1X_PHASE2_CLIENT_CERT, - priv->phase2_client_cert_password, - NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD, - error)) - return FALSE; - - if (!_cert_verify_property (priv->private_key, - NM_SETTING_802_1X_PRIVATE_KEY, - NULL, - NULL, - error)) - return FALSE; - if (!_cert_verify_property (priv->phase2_private_key, - NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, - NULL, - NULL, - error)) - return FALSE; - - return TRUE; + NMSetting8021x * self = NM_SETTING_802_1X(setting); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + const char * valid_eap[] = + {"leap", "md5", "tls", "peap", "ttls", "sim", "fast", "pwd", "external", NULL}; + GSList *iter; + + if (error) + g_return_val_if_fail(*error == NULL, FALSE); + + if (connection && priv->optional + && !nm_streq0(nm_connection_get_connection_type(connection), + NM_SETTING_WIRED_SETTING_NAME)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("can be enabled only on Ethernet connections")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_OPTIONAL); + return FALSE; + } + + if (!priv->eap) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_MISSING_PROPERTY, + _("property is missing")); + g_prefix_error(error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_EAP); + return FALSE; + } + + if (!_nm_utils_string_slist_validate(priv->eap, valid_eap)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("property is invalid")); + g_prefix_error(error, "%s.%s: ", NM_SETTING_802_1X_SETTING_NAME, NM_SETTING_802_1X_EAP); + return FALSE; + } + + /* Ask each configured EAP method if its valid */ + for (iter = priv->eap; iter; iter = g_slist_next(iter)) { + const char *method = (const char *) iter->data; + int i; + + for (i = 0; eap_methods_table[i].method; i++) { + if (eap_methods_table[i].v_func == NULL) + continue; + if (!strcmp(eap_methods_table[i].method, method)) { + if (!(*eap_methods_table[i].v_func)(self, FALSE, error)) + return FALSE; + break; + } + } + } + + if (!NM_IN_STRSET(priv->phase1_peapver, NULL, "0", "1")) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("'%s' is not a valid value for the property"), + priv->phase1_peapver); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE1_PEAPVER); + return FALSE; + } + + if (!NM_IN_STRSET(priv->phase1_peaplabel, NULL, "0", "1")) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("'%s' is not a valid value for the property"), + priv->phase1_peaplabel); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE1_PEAPLABEL); + return FALSE; + } + + if (!NM_IN_STRSET(priv->phase1_fast_provisioning, NULL, "0", "1", "2", "3")) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("'%s' is not a valid value for the property"), + priv->phase1_fast_provisioning); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING); + return FALSE; + } + + if (NM_FLAGS_ANY(priv->phase1_auth_flags, ~NM_SETTING_802_1X_AUTH_FLAGS_ALL)) { + g_set_error_literal(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("invalid auth flags")); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE1_AUTH_FLAGS); + return FALSE; + } + + if (!NM_IN_STRSET(priv->phase2_auth, + NULL, + "pap", + "chap", + "mschap", + "mschapv2", + "gtc", + "otp", + "md5", + "tls")) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("'%s' is not a valid value for the property"), + priv->phase2_auth); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTH); + return FALSE; + } + + if (!NM_IN_STRSET(priv->phase2_autheap, NULL, "md5", "mschapv2", "otp", "gtc", "tls")) { + g_set_error(error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("'%s' is not a valid value for the property"), + priv->phase2_autheap); + g_prefix_error(error, + "%s.%s: ", + NM_SETTING_802_1X_SETTING_NAME, + NM_SETTING_802_1X_PHASE2_AUTHEAP); + return FALSE; + } + + if (!_cert_verify_property(priv->ca_cert, + NM_SETTING_802_1X_CA_CERT, + priv->ca_cert_password, + NM_SETTING_802_1X_CA_CERT_PASSWORD, + error)) + return FALSE; + if (!_cert_verify_property(priv->phase2_ca_cert, + NM_SETTING_802_1X_PHASE2_CA_CERT, + priv->phase2_ca_cert_password, + NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD, + error)) + return FALSE; + + if (!_cert_verify_property(priv->client_cert, + NM_SETTING_802_1X_CLIENT_CERT, + priv->client_cert_password, + NM_SETTING_802_1X_CLIENT_CERT_PASSWORD, + error)) + return FALSE; + if (!_cert_verify_property(priv->phase2_client_cert, + NM_SETTING_802_1X_PHASE2_CLIENT_CERT, + priv->phase2_client_cert_password, + NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD, + error)) + return FALSE; + + if (!_cert_verify_property(priv->private_key, NM_SETTING_802_1X_PRIVATE_KEY, NULL, NULL, error)) + return FALSE; + if (!_cert_verify_property(priv->phase2_private_key, + NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, + NULL, + NULL, + error)) + return FALSE; + + return TRUE; } /*****************************************************************************/ static GPtrArray * -need_secrets (NMSetting *setting) +need_secrets(NMSetting *setting) { - NMSetting8021x *self = NM_SETTING_802_1X (setting); - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - GSList *iter; - GPtrArray *secrets; - gboolean eap_method_found = FALSE; - - secrets = g_ptr_array_sized_new (4); - - /* Ask each configured EAP method if it needs secrets */ - for (iter = priv->eap; iter && !eap_method_found; iter = g_slist_next (iter)) { - const char *method = (const char *) iter->data; - int i; - - for (i = 0; eap_methods_table[i].method; i++) { - if (eap_methods_table[i].ns_func == NULL) - continue; - if (!strcmp (eap_methods_table[i].method, method)) { - (*eap_methods_table[i].ns_func) (self, secrets, FALSE); - - /* Only break out of the outer loop if this EAP method - * needed secrets. - */ - if (secrets->len > 0) - eap_method_found = TRUE; - break; - } - } - } - - if (secrets->len == 0) { - g_ptr_array_free (secrets, TRUE); - return NULL; - } - - return secrets; + NMSetting8021x * self = NM_SETTING_802_1X(setting); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + GSList * iter; + GPtrArray * secrets; + gboolean eap_method_found = FALSE; + + secrets = g_ptr_array_sized_new(4); + + /* Ask each configured EAP method if it needs secrets */ + for (iter = priv->eap; iter && !eap_method_found; iter = g_slist_next(iter)) { + const char *method = (const char *) iter->data; + int i; + + for (i = 0; eap_methods_table[i].method; i++) { + if (eap_methods_table[i].ns_func == NULL) + continue; + if (!strcmp(eap_methods_table[i].method, method)) { + (*eap_methods_table[i].ns_func)(self, secrets, FALSE); + + /* Only break out of the outer loop if this EAP method + * needed secrets. + */ + if (secrets->len > 0) + eap_method_found = TRUE; + break; + } + } + } + + if (secrets->len == 0) { + g_ptr_array_free(secrets, TRUE); + return NULL; + } + + return secrets; } /*****************************************************************************/ static void -get_property (GObject *object, guint prop_id, - GValue *value, GParamSpec *pspec) +get_property(GObject *object, guint prop_id, GValue *value, GParamSpec *pspec) { - NMSetting8021x *setting = NM_SETTING_802_1X (object); - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - - switch (prop_id) { - case PROP_EAP: - g_value_take_boxed (value, _nm_utils_slist_to_strv (priv->eap, TRUE)); - break; - case PROP_IDENTITY: - g_value_set_string (value, priv->identity); - break; - case PROP_ANONYMOUS_IDENTITY: - g_value_set_string (value, priv->anonymous_identity); - break; - case PROP_PAC_FILE: - g_value_set_string (value, priv->pac_file); - break; - case PROP_CA_CERT: - g_value_set_boxed (value, priv->ca_cert); - break; - case PROP_CA_CERT_PASSWORD: - g_value_set_string (value, priv->ca_cert_password); - break; - case PROP_CA_CERT_PASSWORD_FLAGS: - g_value_set_flags (value, priv->ca_cert_password_flags); - break; - case PROP_CA_PATH: - g_value_set_string (value, priv->ca_path); - break; - case PROP_SUBJECT_MATCH: - g_value_set_string (value, priv->subject_match); - break; - case PROP_ALTSUBJECT_MATCHES: - g_value_take_boxed (value, _nm_utils_slist_to_strv (priv->altsubject_matches, TRUE)); - break; - case PROP_DOMAIN_SUFFIX_MATCH: - g_value_set_string (value, priv->domain_suffix_match); - break; - case PROP_DOMAIN_MATCH: - g_value_set_string (value, priv->domain_match); - break; - case PROP_CLIENT_CERT: - g_value_set_boxed (value, priv->client_cert); - break; - case PROP_CLIENT_CERT_PASSWORD: - g_value_set_string (value, priv->client_cert_password); - break; - case PROP_CLIENT_CERT_PASSWORD_FLAGS: - g_value_set_flags (value, priv->client_cert_password_flags); - break; - case PROP_PHASE1_PEAPVER: - g_value_set_string (value, priv->phase1_peapver); - break; - case PROP_PHASE1_PEAPLABEL: - g_value_set_string (value, priv->phase1_peaplabel); - break; - case PROP_PHASE1_FAST_PROVISIONING: - g_value_set_string (value, priv->phase1_fast_provisioning); - break; - case PROP_PHASE1_AUTH_FLAGS: - g_value_set_uint (value, priv->phase1_auth_flags); - break; - case PROP_PHASE2_AUTH: - g_value_set_string (value, priv->phase2_auth); - break; - case PROP_PHASE2_AUTHEAP: - g_value_set_string (value, priv->phase2_autheap); - break; - case PROP_PHASE2_CA_CERT: - g_value_set_boxed (value, priv->phase2_ca_cert); - break; - case PROP_PHASE2_CA_CERT_PASSWORD: - g_value_set_string (value, priv->phase2_ca_cert_password); - break; - case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS: - g_value_set_flags (value, priv->phase2_ca_cert_password_flags); - break; - case PROP_PHASE2_CA_PATH: - g_value_set_string (value, priv->phase2_ca_path); - break; - case PROP_PHASE2_SUBJECT_MATCH: - g_value_set_string (value, priv->phase2_subject_match); - break; - case PROP_PHASE2_ALTSUBJECT_MATCHES: - g_value_take_boxed (value, _nm_utils_slist_to_strv (priv->phase2_altsubject_matches, TRUE)); - break; - case PROP_PHASE2_DOMAIN_SUFFIX_MATCH: - g_value_set_string (value, priv->phase2_domain_suffix_match); - break; - case PROP_PHASE2_DOMAIN_MATCH: - g_value_set_string (value, priv->phase2_domain_match); - break; - case PROP_PHASE2_CLIENT_CERT: - g_value_set_boxed (value, priv->phase2_client_cert); - break; - case PROP_PHASE2_CLIENT_CERT_PASSWORD: - g_value_set_string (value, priv->phase2_client_cert_password); - break; - case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS: - g_value_set_flags (value, priv->phase2_client_cert_password_flags); - break; - case PROP_PASSWORD: - g_value_set_string (value, priv->password); - break; - case PROP_PASSWORD_FLAGS: - g_value_set_flags (value, priv->password_flags); - break; - case PROP_PASSWORD_RAW: - g_value_set_boxed (value, priv->password_raw); - break; - case PROP_PASSWORD_RAW_FLAGS: - g_value_set_flags (value, priv->password_raw_flags); - break; - case PROP_PRIVATE_KEY: - g_value_set_boxed (value, priv->private_key); - break; - case PROP_PRIVATE_KEY_PASSWORD: - g_value_set_string (value, priv->private_key_password); - break; - case PROP_PRIVATE_KEY_PASSWORD_FLAGS: - g_value_set_flags (value, priv->private_key_password_flags); - break; - case PROP_PHASE2_PRIVATE_KEY: - g_value_set_boxed (value, priv->phase2_private_key); - break; - case PROP_PHASE2_PRIVATE_KEY_PASSWORD: - g_value_set_string (value, priv->phase2_private_key_password); - break; - case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS: - g_value_set_flags (value, priv->phase2_private_key_password_flags); - break; - case PROP_PIN: - g_value_set_string (value, priv->pin); - break; - case PROP_PIN_FLAGS: - g_value_set_flags (value, priv->pin_flags); - break; - case PROP_SYSTEM_CA_CERTS: - g_value_set_boolean (value, priv->system_ca_certs); - break; - case PROP_AUTH_TIMEOUT: - g_value_set_int (value, priv->auth_timeout); - break; - case PROP_OPTIONAL: - g_value_set_boolean (value, priv->optional); - break; - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; - } + NMSetting8021x * setting = NM_SETTING_802_1X(object); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + + switch (prop_id) { + case PROP_EAP: + g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->eap, TRUE)); + break; + case PROP_IDENTITY: + g_value_set_string(value, priv->identity); + break; + case PROP_ANONYMOUS_IDENTITY: + g_value_set_string(value, priv->anonymous_identity); + break; + case PROP_PAC_FILE: + g_value_set_string(value, priv->pac_file); + break; + case PROP_CA_CERT: + g_value_set_boxed(value, priv->ca_cert); + break; + case PROP_CA_CERT_PASSWORD: + g_value_set_string(value, priv->ca_cert_password); + break; + case PROP_CA_CERT_PASSWORD_FLAGS: + g_value_set_flags(value, priv->ca_cert_password_flags); + break; + case PROP_CA_PATH: + g_value_set_string(value, priv->ca_path); + break; + case PROP_SUBJECT_MATCH: + g_value_set_string(value, priv->subject_match); + break; + case PROP_ALTSUBJECT_MATCHES: + g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->altsubject_matches, TRUE)); + break; + case PROP_DOMAIN_SUFFIX_MATCH: + g_value_set_string(value, priv->domain_suffix_match); + break; + case PROP_DOMAIN_MATCH: + g_value_set_string(value, priv->domain_match); + break; + case PROP_CLIENT_CERT: + g_value_set_boxed(value, priv->client_cert); + break; + case PROP_CLIENT_CERT_PASSWORD: + g_value_set_string(value, priv->client_cert_password); + break; + case PROP_CLIENT_CERT_PASSWORD_FLAGS: + g_value_set_flags(value, priv->client_cert_password_flags); + break; + case PROP_PHASE1_PEAPVER: + g_value_set_string(value, priv->phase1_peapver); + break; + case PROP_PHASE1_PEAPLABEL: + g_value_set_string(value, priv->phase1_peaplabel); + break; + case PROP_PHASE1_FAST_PROVISIONING: + g_value_set_string(value, priv->phase1_fast_provisioning); + break; + case PROP_PHASE1_AUTH_FLAGS: + g_value_set_uint(value, priv->phase1_auth_flags); + break; + case PROP_PHASE2_AUTH: + g_value_set_string(value, priv->phase2_auth); + break; + case PROP_PHASE2_AUTHEAP: + g_value_set_string(value, priv->phase2_autheap); + break; + case PROP_PHASE2_CA_CERT: + g_value_set_boxed(value, priv->phase2_ca_cert); + break; + case PROP_PHASE2_CA_CERT_PASSWORD: + g_value_set_string(value, priv->phase2_ca_cert_password); + break; + case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS: + g_value_set_flags(value, priv->phase2_ca_cert_password_flags); + break; + case PROP_PHASE2_CA_PATH: + g_value_set_string(value, priv->phase2_ca_path); + break; + case PROP_PHASE2_SUBJECT_MATCH: + g_value_set_string(value, priv->phase2_subject_match); + break; + case PROP_PHASE2_ALTSUBJECT_MATCHES: + g_value_take_boxed(value, _nm_utils_slist_to_strv(priv->phase2_altsubject_matches, TRUE)); + break; + case PROP_PHASE2_DOMAIN_SUFFIX_MATCH: + g_value_set_string(value, priv->phase2_domain_suffix_match); + break; + case PROP_PHASE2_DOMAIN_MATCH: + g_value_set_string(value, priv->phase2_domain_match); + break; + case PROP_PHASE2_CLIENT_CERT: + g_value_set_boxed(value, priv->phase2_client_cert); + break; + case PROP_PHASE2_CLIENT_CERT_PASSWORD: + g_value_set_string(value, priv->phase2_client_cert_password); + break; + case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS: + g_value_set_flags(value, priv->phase2_client_cert_password_flags); + break; + case PROP_PASSWORD: + g_value_set_string(value, priv->password); + break; + case PROP_PASSWORD_FLAGS: + g_value_set_flags(value, priv->password_flags); + break; + case PROP_PASSWORD_RAW: + g_value_set_boxed(value, priv->password_raw); + break; + case PROP_PASSWORD_RAW_FLAGS: + g_value_set_flags(value, priv->password_raw_flags); + break; + case PROP_PRIVATE_KEY: + g_value_set_boxed(value, priv->private_key); + break; + case PROP_PRIVATE_KEY_PASSWORD: + g_value_set_string(value, priv->private_key_password); + break; + case PROP_PRIVATE_KEY_PASSWORD_FLAGS: + g_value_set_flags(value, priv->private_key_password_flags); + break; + case PROP_PHASE2_PRIVATE_KEY: + g_value_set_boxed(value, priv->phase2_private_key); + break; + case PROP_PHASE2_PRIVATE_KEY_PASSWORD: + g_value_set_string(value, priv->phase2_private_key_password); + break; + case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS: + g_value_set_flags(value, priv->phase2_private_key_password_flags); + break; + case PROP_PIN: + g_value_set_string(value, priv->pin); + break; + case PROP_PIN_FLAGS: + g_value_set_flags(value, priv->pin_flags); + break; + case PROP_SYSTEM_CA_CERTS: + g_value_set_boolean(value, priv->system_ca_certs); + break; + case PROP_AUTH_TIMEOUT: + g_value_set_int(value, priv->auth_timeout); + break; + case PROP_OPTIONAL: + g_value_set_boolean(value, priv->optional); + break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec); + break; + } } static void -set_property (GObject *object, guint prop_id, - const GValue *value, GParamSpec *pspec) +set_property(GObject *object, guint prop_id, const GValue *value, GParamSpec *pspec) { - NMSetting8021x *setting = NM_SETTING_802_1X (object); - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (setting); - - switch (prop_id) { - case PROP_EAP: - g_slist_free_full (priv->eap, g_free); - priv->eap = _nm_utils_strv_to_slist (g_value_get_boxed (value), TRUE); - break; - case PROP_IDENTITY: - g_free (priv->identity); - priv->identity = g_value_dup_string (value); - break; - case PROP_ANONYMOUS_IDENTITY: - g_free (priv->anonymous_identity); - priv->anonymous_identity = g_value_dup_string (value); - break; - case PROP_PAC_FILE: - g_free (priv->pac_file); - priv->pac_file = g_value_dup_string (value); - break; - case PROP_CA_CERT: - g_bytes_unref (priv->ca_cert); - priv->ca_cert = g_value_dup_boxed (value); - break; - case PROP_CA_CERT_PASSWORD: - g_free (priv->ca_cert_password); - priv->ca_cert_password = g_value_dup_string (value); - break; - case PROP_CA_CERT_PASSWORD_FLAGS: - priv->ca_cert_password_flags = g_value_get_flags (value); - break; - case PROP_CA_PATH: - g_free (priv->ca_path); - priv->ca_path = g_value_dup_string (value); - break; - case PROP_SUBJECT_MATCH: - g_free (priv->subject_match); - priv->subject_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_ALTSUBJECT_MATCHES: - g_slist_free_full (priv->altsubject_matches, g_free); - priv->altsubject_matches = _nm_utils_strv_to_slist (g_value_get_boxed (value), TRUE); - break; - case PROP_DOMAIN_SUFFIX_MATCH: - g_free (priv->domain_suffix_match); - priv->domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_DOMAIN_MATCH: - g_free (priv->domain_match); - priv->domain_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_CLIENT_CERT: - g_bytes_unref (priv->client_cert); - priv->client_cert = g_value_dup_boxed (value); - break; - case PROP_CLIENT_CERT_PASSWORD: - g_free (priv->client_cert_password); - priv->client_cert_password = g_value_dup_string (value); - break; - case PROP_CLIENT_CERT_PASSWORD_FLAGS: - priv->client_cert_password_flags = g_value_get_flags (value); - break; - case PROP_PHASE1_PEAPVER: - g_free (priv->phase1_peapver); - priv->phase1_peapver = g_value_dup_string (value); - break; - case PROP_PHASE1_PEAPLABEL: - g_free (priv->phase1_peaplabel); - priv->phase1_peaplabel = g_value_dup_string (value); - break; - case PROP_PHASE1_FAST_PROVISIONING: - g_free (priv->phase1_fast_provisioning); - priv->phase1_fast_provisioning = g_value_dup_string (value); - break; - case PROP_PHASE1_AUTH_FLAGS: - priv->phase1_auth_flags = g_value_get_uint (value); - break; - case PROP_PHASE2_AUTH: - g_free (priv->phase2_auth); - priv->phase2_auth = g_value_dup_string (value); - break; - case PROP_PHASE2_AUTHEAP: - g_free (priv->phase2_autheap); - priv->phase2_autheap = g_value_dup_string (value); - break; - case PROP_PHASE2_CA_CERT: - g_bytes_unref (priv->phase2_ca_cert); - priv->phase2_ca_cert = g_value_dup_boxed (value); - break; - case PROP_PHASE2_CA_CERT_PASSWORD: - g_free (priv->phase2_ca_cert_password); - priv->phase2_ca_cert_password = g_value_dup_string (value); - break; - case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS: - priv->phase2_ca_cert_password_flags = g_value_get_flags (value); - break; - case PROP_PHASE2_CA_PATH: - g_free (priv->phase2_ca_path); - priv->phase2_ca_path = g_value_dup_string (value); - break; - case PROP_PHASE2_SUBJECT_MATCH: - g_free (priv->phase2_subject_match); - priv->phase2_subject_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_PHASE2_ALTSUBJECT_MATCHES: - g_slist_free_full (priv->phase2_altsubject_matches, g_free); - priv->phase2_altsubject_matches = _nm_utils_strv_to_slist (g_value_get_boxed (value), TRUE); - break; - case PROP_PHASE2_DOMAIN_SUFFIX_MATCH: - g_free (priv->phase2_domain_suffix_match); - priv->phase2_domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_PHASE2_DOMAIN_MATCH: - g_free (priv->phase2_domain_match); - priv->phase2_domain_match = nm_strdup_not_empty (g_value_get_string (value)); - break; - case PROP_PHASE2_CLIENT_CERT: - g_bytes_unref (priv->phase2_client_cert); - priv->phase2_client_cert = g_value_dup_boxed (value); - break; - case PROP_PHASE2_CLIENT_CERT_PASSWORD: - g_free (priv->phase2_client_cert_password); - priv->phase2_client_cert_password = g_value_dup_string (value); - break; - case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS: - priv->phase2_client_cert_password_flags = g_value_get_flags (value); - break; - case PROP_PASSWORD: - g_free (priv->password); - priv->password = g_value_dup_string (value); - break; - case PROP_PASSWORD_FLAGS: - priv->password_flags = g_value_get_flags (value); - break; - case PROP_PASSWORD_RAW: - g_bytes_unref (priv->password_raw); - priv->password_raw = g_value_dup_boxed (value); - break; - case PROP_PASSWORD_RAW_FLAGS: - priv->password_raw_flags = g_value_get_flags (value); - break; - case PROP_PRIVATE_KEY: - g_bytes_unref (priv->private_key); - priv->private_key = g_value_dup_boxed (value); - break; - case PROP_PRIVATE_KEY_PASSWORD: - nm_free_secret (priv->private_key_password); - priv->private_key_password = g_value_dup_string (value); - break; - case PROP_PRIVATE_KEY_PASSWORD_FLAGS: - priv->private_key_password_flags = g_value_get_flags (value); - break; - case PROP_PHASE2_PRIVATE_KEY: - g_bytes_unref (priv->phase2_private_key); - priv->phase2_private_key = g_value_dup_boxed (value); - break; - case PROP_PHASE2_PRIVATE_KEY_PASSWORD: - nm_free_secret (priv->phase2_private_key_password); - priv->phase2_private_key_password = g_value_dup_string (value); - break; - case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS: - priv->phase2_private_key_password_flags = g_value_get_flags (value); - break; - case PROP_PIN: - g_free (priv->pin); - priv->pin = g_value_dup_string (value); - break; - case PROP_PIN_FLAGS: - priv->pin_flags = g_value_get_flags (value); - break; - case PROP_SYSTEM_CA_CERTS: - priv->system_ca_certs = g_value_get_boolean (value); - break; - case PROP_AUTH_TIMEOUT: - priv->auth_timeout = g_value_get_int (value); - break; - case PROP_OPTIONAL: - priv->optional = g_value_get_boolean (value); - break; - default: - G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); - break; - } + NMSetting8021x * setting = NM_SETTING_802_1X(object); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(setting); + + switch (prop_id) { + case PROP_EAP: + g_slist_free_full(priv->eap, g_free); + priv->eap = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE); + break; + case PROP_IDENTITY: + g_free(priv->identity); + priv->identity = g_value_dup_string(value); + break; + case PROP_ANONYMOUS_IDENTITY: + g_free(priv->anonymous_identity); + priv->anonymous_identity = g_value_dup_string(value); + break; + case PROP_PAC_FILE: + g_free(priv->pac_file); + priv->pac_file = g_value_dup_string(value); + break; + case PROP_CA_CERT: + g_bytes_unref(priv->ca_cert); + priv->ca_cert = g_value_dup_boxed(value); + break; + case PROP_CA_CERT_PASSWORD: + g_free(priv->ca_cert_password); + priv->ca_cert_password = g_value_dup_string(value); + break; + case PROP_CA_CERT_PASSWORD_FLAGS: + priv->ca_cert_password_flags = g_value_get_flags(value); + break; + case PROP_CA_PATH: + g_free(priv->ca_path); + priv->ca_path = g_value_dup_string(value); + break; + case PROP_SUBJECT_MATCH: + g_free(priv->subject_match); + priv->subject_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_ALTSUBJECT_MATCHES: + g_slist_free_full(priv->altsubject_matches, g_free); + priv->altsubject_matches = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE); + break; + case PROP_DOMAIN_SUFFIX_MATCH: + g_free(priv->domain_suffix_match); + priv->domain_suffix_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_DOMAIN_MATCH: + g_free(priv->domain_match); + priv->domain_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_CLIENT_CERT: + g_bytes_unref(priv->client_cert); + priv->client_cert = g_value_dup_boxed(value); + break; + case PROP_CLIENT_CERT_PASSWORD: + g_free(priv->client_cert_password); + priv->client_cert_password = g_value_dup_string(value); + break; + case PROP_CLIENT_CERT_PASSWORD_FLAGS: + priv->client_cert_password_flags = g_value_get_flags(value); + break; + case PROP_PHASE1_PEAPVER: + g_free(priv->phase1_peapver); + priv->phase1_peapver = g_value_dup_string(value); + break; + case PROP_PHASE1_PEAPLABEL: + g_free(priv->phase1_peaplabel); + priv->phase1_peaplabel = g_value_dup_string(value); + break; + case PROP_PHASE1_FAST_PROVISIONING: + g_free(priv->phase1_fast_provisioning); + priv->phase1_fast_provisioning = g_value_dup_string(value); + break; + case PROP_PHASE1_AUTH_FLAGS: + priv->phase1_auth_flags = g_value_get_uint(value); + break; + case PROP_PHASE2_AUTH: + g_free(priv->phase2_auth); + priv->phase2_auth = g_value_dup_string(value); + break; + case PROP_PHASE2_AUTHEAP: + g_free(priv->phase2_autheap); + priv->phase2_autheap = g_value_dup_string(value); + break; + case PROP_PHASE2_CA_CERT: + g_bytes_unref(priv->phase2_ca_cert); + priv->phase2_ca_cert = g_value_dup_boxed(value); + break; + case PROP_PHASE2_CA_CERT_PASSWORD: + g_free(priv->phase2_ca_cert_password); + priv->phase2_ca_cert_password = g_value_dup_string(value); + break; + case PROP_PHASE2_CA_CERT_PASSWORD_FLAGS: + priv->phase2_ca_cert_password_flags = g_value_get_flags(value); + break; + case PROP_PHASE2_CA_PATH: + g_free(priv->phase2_ca_path); + priv->phase2_ca_path = g_value_dup_string(value); + break; + case PROP_PHASE2_SUBJECT_MATCH: + g_free(priv->phase2_subject_match); + priv->phase2_subject_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_PHASE2_ALTSUBJECT_MATCHES: + g_slist_free_full(priv->phase2_altsubject_matches, g_free); + priv->phase2_altsubject_matches = _nm_utils_strv_to_slist(g_value_get_boxed(value), TRUE); + break; + case PROP_PHASE2_DOMAIN_SUFFIX_MATCH: + g_free(priv->phase2_domain_suffix_match); + priv->phase2_domain_suffix_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_PHASE2_DOMAIN_MATCH: + g_free(priv->phase2_domain_match); + priv->phase2_domain_match = nm_strdup_not_empty(g_value_get_string(value)); + break; + case PROP_PHASE2_CLIENT_CERT: + g_bytes_unref(priv->phase2_client_cert); + priv->phase2_client_cert = g_value_dup_boxed(value); + break; + case PROP_PHASE2_CLIENT_CERT_PASSWORD: + g_free(priv->phase2_client_cert_password); + priv->phase2_client_cert_password = g_value_dup_string(value); + break; + case PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS: + priv->phase2_client_cert_password_flags = g_value_get_flags(value); + break; + case PROP_PASSWORD: + g_free(priv->password); + priv->password = g_value_dup_string(value); + break; + case PROP_PASSWORD_FLAGS: + priv->password_flags = g_value_get_flags(value); + break; + case PROP_PASSWORD_RAW: + g_bytes_unref(priv->password_raw); + priv->password_raw = g_value_dup_boxed(value); + break; + case PROP_PASSWORD_RAW_FLAGS: + priv->password_raw_flags = g_value_get_flags(value); + break; + case PROP_PRIVATE_KEY: + g_bytes_unref(priv->private_key); + priv->private_key = g_value_dup_boxed(value); + break; + case PROP_PRIVATE_KEY_PASSWORD: + nm_free_secret(priv->private_key_password); + priv->private_key_password = g_value_dup_string(value); + break; + case PROP_PRIVATE_KEY_PASSWORD_FLAGS: + priv->private_key_password_flags = g_value_get_flags(value); + break; + case PROP_PHASE2_PRIVATE_KEY: + g_bytes_unref(priv->phase2_private_key); + priv->phase2_private_key = g_value_dup_boxed(value); + break; + case PROP_PHASE2_PRIVATE_KEY_PASSWORD: + nm_free_secret(priv->phase2_private_key_password); + priv->phase2_private_key_password = g_value_dup_string(value); + break; + case PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS: + priv->phase2_private_key_password_flags = g_value_get_flags(value); + break; + case PROP_PIN: + g_free(priv->pin); + priv->pin = g_value_dup_string(value); + break; + case PROP_PIN_FLAGS: + priv->pin_flags = g_value_get_flags(value); + break; + case PROP_SYSTEM_CA_CERTS: + priv->system_ca_certs = g_value_get_boolean(value); + break; + case PROP_AUTH_TIMEOUT: + priv->auth_timeout = g_value_get_int(value); + break; + case PROP_OPTIONAL: + priv->optional = g_value_get_boolean(value); + break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec); + break; + } } /*****************************************************************************/ static void -nm_setting_802_1x_init (NMSetting8021x *setting) -{ -} +nm_setting_802_1x_init(NMSetting8021x *setting) +{} /** * nm_setting_802_1x_new: @@ -3428,1148 +3496,1183 @@ nm_setting_802_1x_init (NMSetting8021x *setting) * Returns: the new empty #NMSetting8021x object **/ NMSetting * -nm_setting_802_1x_new (void) +nm_setting_802_1x_new(void) { - return (NMSetting *) g_object_new (NM_TYPE_SETTING_802_1X, NULL); + return (NMSetting *) g_object_new(NM_TYPE_SETTING_802_1X, NULL); } static void -finalize (GObject *object) +finalize(GObject *object) { - NMSetting8021x *self = NM_SETTING_802_1X (object); - NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE (self); - - g_free (priv->identity); - g_free (priv->anonymous_identity); - g_free (priv->ca_path); - g_free (priv->subject_match); - g_free (priv->domain_suffix_match); - g_free (priv->phase1_peapver); - g_free (priv->phase1_peaplabel); - g_free (priv->phase1_fast_provisioning); - g_free (priv->phase2_auth); - g_free (priv->phase2_autheap); - g_free (priv->phase2_ca_path); - g_free (priv->phase2_subject_match); - g_free (priv->phase2_domain_suffix_match); - g_free (priv->password); - g_bytes_unref (priv->password_raw); - g_free (priv->pin); - - g_slist_free_full (priv->eap, g_free); - g_slist_free_full (priv->altsubject_matches, g_free); - g_slist_free_full (priv->phase2_altsubject_matches, g_free); - - g_bytes_unref (priv->ca_cert); - g_free (priv->ca_cert_password); - g_bytes_unref (priv->client_cert); - g_free (priv->client_cert_password); - g_bytes_unref (priv->private_key); - nm_free_secret (priv->private_key_password); - g_bytes_unref (priv->phase2_ca_cert); - g_free (priv->phase2_ca_cert_password); - g_bytes_unref (priv->phase2_client_cert); - g_free (priv->phase2_client_cert_password); - g_bytes_unref (priv->phase2_private_key); - nm_free_secret (priv->phase2_private_key_password); - - G_OBJECT_CLASS (nm_setting_802_1x_parent_class)->finalize (object); + NMSetting8021x * self = NM_SETTING_802_1X(object); + NMSetting8021xPrivate *priv = NM_SETTING_802_1X_GET_PRIVATE(self); + + g_free(priv->identity); + g_free(priv->anonymous_identity); + g_free(priv->ca_path); + g_free(priv->subject_match); + g_free(priv->domain_suffix_match); + g_free(priv->phase1_peapver); + g_free(priv->phase1_peaplabel); + g_free(priv->phase1_fast_provisioning); + g_free(priv->phase2_auth); + g_free(priv->phase2_autheap); + g_free(priv->phase2_ca_path); + g_free(priv->phase2_subject_match); + g_free(priv->phase2_domain_suffix_match); + g_free(priv->password); + g_bytes_unref(priv->password_raw); + g_free(priv->pin); + + g_slist_free_full(priv->eap, g_free); + g_slist_free_full(priv->altsubject_matches, g_free); + g_slist_free_full(priv->phase2_altsubject_matches, g_free); + + g_bytes_unref(priv->ca_cert); + g_free(priv->ca_cert_password); + g_bytes_unref(priv->client_cert); + g_free(priv->client_cert_password); + g_bytes_unref(priv->private_key); + nm_free_secret(priv->private_key_password); + g_bytes_unref(priv->phase2_ca_cert); + g_free(priv->phase2_ca_cert_password); + g_bytes_unref(priv->phase2_client_cert); + g_free(priv->phase2_client_cert_password); + g_bytes_unref(priv->phase2_private_key); + nm_free_secret(priv->phase2_private_key_password); + + G_OBJECT_CLASS(nm_setting_802_1x_parent_class)->finalize(object); } static void -nm_setting_802_1x_class_init (NMSetting8021xClass *klass) +nm_setting_802_1x_class_init(NMSetting8021xClass *klass) { - GObjectClass *object_class = G_OBJECT_CLASS (klass); - NMSettingClass *setting_class = NM_SETTING_CLASS (klass); - - g_type_class_add_private (klass, sizeof (NMSetting8021xPrivate)); - - object_class->get_property = get_property; - object_class->set_property = set_property; - object_class->finalize = finalize; - - setting_class->verify = verify; - setting_class->need_secrets = need_secrets; - - /** - * NMSetting8021x:eap: - * - * The allowed EAP method to be used when authenticating to the network with - * 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", - * and "fast". Each method requires different configuration using the - * properties of this setting; refer to wpa_supplicant documentation for the - * allowed combinations. - **/ - /* ---ifcfg-rh--- - * property: eap - * variable: IEEE_8021X_EAP_METHODS(+) - * values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST" - * description: EAP method for 802.1X authentication. - * example: IEEE_8021X_EAP_METHODS=PEAP - * ---end--- - */ - obj_properties[PROP_EAP] = - g_param_spec_boxed (NM_SETTING_802_1X_EAP, "", "", - G_TYPE_STRV, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:identity: - * - * Identity string for EAP authentication methods. Often the user's user or - * login name. - **/ - /* ---ifcfg-rh--- - * property: identity - * variable: IEEE_8021X_IDENTITY(+) - * description: Identity for EAP authentication methods. - * example: IEEE_8021X_IDENTITY=itsme - * ---end--- - */ - obj_properties[PROP_IDENTITY] = - g_param_spec_string (NM_SETTING_802_1X_IDENTITY, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:anonymous-identity: - * - * Anonymous identity string for EAP authentication methods. Used as the - * unencrypted identity with EAP types that support different tunneled - * identity like EAP-TTLS. - **/ - /* ---ifcfg-rh--- - * property: anonymous-identity - * variable: IEEE_8021X_ANON_IDENTITY(+) - * description: Anonymous identity for EAP authentication methods. - * ---end--- - */ - obj_properties[PROP_ANONYMOUS_IDENTITY] = - g_param_spec_string (NM_SETTING_802_1X_ANONYMOUS_IDENTITY, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:pac-file: - * - * UTF-8 encoded file path containing PAC for EAP-FAST. - **/ - /* ---ifcfg-rh--- - * property: pac-file - * variable: IEEE_8021X_PAC_FILE(+) - * description: File with PAC (Protected Access Credential) for EAP-FAST. - * example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac - * ---end--- - */ - obj_properties[PROP_PAC_FILE] = - g_param_spec_string (NM_SETTING_802_1X_PAC_FILE, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:ca-cert: - * - * Contains the CA certificate if used by the EAP method specified in the - * #NMSetting8021x:eap property. - * - * Certificate data is specified using a "scheme"; three are currently - * supported: blob, path and pkcs#11 URL. When using the blob scheme this property - * should be set to the certificate's DER encoded data. When using the path - * scheme, this property should be set to the full UTF-8 encoded path of the - * certificate, prefixed with the string "file://" and ending with a terminating - * NUL byte. - * This property can be unset even if the EAP method supports CA certificates, - * but this allows man-in-the-middle attacks and is NOT recommended. - * - * Note that enabling NMSetting8021x:system-ca-certs will override this - * setting to use the built-in path, if the built-in path is not a directory. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_ca_cert() function instead. - **/ - /* ---ifcfg-rh--- - * property: ca-cert - * variable: IEEE_8021X_CA_CERT(+) - * description: CA certificate for EAP. - * example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt - * ---end--- - */ - obj_properties[PROP_CA_CERT] = - g_param_spec_boxed (NM_SETTING_802_1X_CA_CERT, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:ca-cert-password: - * - * The password used to access the CA certificate stored in - * #NMSetting8021x:ca-cert property. Only makes sense if the certificate - * is stored on a PKCS#<!-- -->11 token that requires a login. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_CA_CERT_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_CA_CERT_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:ca-cert-password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:ca-cert-password property. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_CA_CERT_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_CA_CERT_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:ca-path: - * - * UTF-8 encoded path to a directory containing PEM or DER formatted - * certificates to be added to the verification chain in addition to the - * certificate specified in the #NMSetting8021x:ca-cert property. - * - * If NMSetting8021x:system-ca-certs is enabled and the built-in CA - * path is an existing directory, then this setting is ignored. - **/ - /* ---ifcfg-rh--- - * property: ca-path - * variable: IEEE_8021X_CA_PATH(+) - * description: The search path for the certificate. - * ---end--- - */ - obj_properties[PROP_CA_PATH] = - g_param_spec_string (NM_SETTING_802_1X_CA_PATH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:subject-match: - * - * Substring to be matched against the subject of the certificate presented - * by the authentication server. When unset, no verification of the - * authentication server certificate's subject is performed. This property - * provides little security, if any, and its use is deprecated in favor of - * NMSetting8021x:domain-suffix-match. - **/ - /* ---ifcfg-rh--- - * property: subject-match - * variable: IEEE_8021X_SUBJECT_MATCH(+) - * description: Substring to match subject of server certificate against. - * example: IEEE_8021X_SUBJECT_MATCH="Red Hat" - * ---end--- - */ - obj_properties[PROP_SUBJECT_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_SUBJECT_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:altsubject-matches: - * - * List of strings to be matched against the altSubjectName of the - * certificate presented by the authentication server. If the list is empty, - * no verification of the server certificate's altSubjectName is performed. - **/ - /* ---ifcfg-rh--- - * property: altsubject-matches - * variable: IEEE_8021X_ALTSUBJECT_MATCHES(+) - * description: List of strings to be matched against the altSubjectName. - * example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc" - * ---end--- - */ - obj_properties[PROP_ALTSUBJECT_MATCHES] = - g_param_spec_boxed (NM_SETTING_802_1X_ALTSUBJECT_MATCHES, "", "", - G_TYPE_STRV, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:domain-suffix-match: - * - * Constraint for server domain name. If set, this FQDN is used as a suffix - * match requirement for dNSName element(s) of the certificate presented by - * the authentication server. If a matching dNSName is found, this - * constraint is met. If no dNSName values are present, this constraint is - * matched against SubjectName CN using same suffix match comparison. - * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited - * list. - * - * Since: 1.2 - **/ - /* ---ifcfg-rh--- - * property: domain-suffix-match - * description: Suffix to match domain of server certificate against. - * variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+) - * ---end--- - */ - obj_properties[PROP_DOMAIN_SUFFIX_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_DOMAIN_SUFFIX_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:domain-match: - * - * Constraint for server domain name. If set, this list of FQDNs is used as - * a match requirement for dNSName element(s) of the certificate presented - * by the authentication server. If a matching dNSName is found, this - * constraint is met. If no dNSName values are present, this constraint is - * matched against SubjectName CN using the same comparison. - * Multiple valid FQDNs can be passed as a ";" delimited list. - * - * Since: 1.24 - **/ - /* ---ifcfg-rh--- - * property: domain-match - * description: Value to match domain of server certificate against. - * variable: IEEE_8021X_DOMAIN_MATCH(+) - * ---end--- - */ - obj_properties[PROP_DOMAIN_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_DOMAIN_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:client-cert: - * - * Contains the client certificate if used by the EAP method specified in - * the #NMSetting8021x:eap property. - * - * Certificate data is specified using a "scheme"; two are currently - * supported: blob and path. When using the blob scheme (which is backwards - * compatible with NM 0.7.x) this property should be set to the - * certificate's DER encoded data. When using the path scheme, this property - * should be set to the full UTF-8 encoded path of the certificate, prefixed - * with the string "file://" and ending with a terminating NUL byte. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_client_cert() function instead. - **/ - /* ---ifcfg-rh--- - * property: client-cert - * variable: IEEE_8021X_CLIENT_CERT(+) - * description: Client certificate for EAP. - * example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt - * ---end--- - */ - obj_properties[PROP_CLIENT_CERT] = - g_param_spec_boxed (NM_SETTING_802_1X_CLIENT_CERT, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:client-cert-password: - * - * The password used to access the client certificate stored in - * #NMSetting8021x:client-cert property. Only makes sense if the certificate - * is stored on a PKCS#<!-- -->11 token that requires a login. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_CLIENT_CERT_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_CLIENT_CERT_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:client-cert-password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:client-cert-password property. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_CLIENT_CERT_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_CLIENT_CERT_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase1-peapver: - * - * Forces which PEAP version is used when PEAP is set as the EAP method in - * the #NMSetting8021x:eap property. When unset, the version reported by - * the server will be used. Sometimes when using older RADIUS servers, it - * is necessary to force the client to use a particular PEAP version. To do - * so, this property may be set to "0" or "1" to force that specific PEAP - * version. - **/ - /* ---ifcfg-rh--- - * property: phase1-peapver - * variable: IEEE_8021X_PEAP_VERSION(+) - * values: 0, 1 - * description: Use to force a specific PEAP version. - * ---end--- - */ - obj_properties[PROP_PHASE1_PEAPVER] = - g_param_spec_string (NM_SETTING_802_1X_PHASE1_PEAPVER, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase1-peaplabel: - * - * Forces use of the new PEAP label during key derivation. Some RADIUS - * servers may require forcing the new PEAP label to interoperate with - * PEAPv1. Set to "1" to force use of the new PEAP label. See the - * wpa_supplicant documentation for more details. - **/ - /* ---ifcfg-rh--- - * property: phase1-peaplabel - * variable: IEEE_8021X_PEAP_FORCE_NEW_LABEL(+) - * values: yes, no - * default: no - * description: Use to force the new PEAP label during key derivation. - * ---end--- - */ - obj_properties[PROP_PHASE1_PEAPLABEL] = - g_param_spec_string (NM_SETTING_802_1X_PHASE1_PEAPLABEL, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase1-fast-provisioning: - * - * Enables or disables in-line provisioning of EAP-FAST credentials when - * FAST is specified as the EAP method in the #NMSetting8021x:eap property. - * Recognized values are "0" (disabled), "1" (allow unauthenticated - * provisioning), "2" (allow authenticated provisioning), and "3" (allow - * both authenticated and unauthenticated provisioning). See the - * wpa_supplicant documentation for more details. - **/ - /* ---ifcfg-rh--- - * property: phase1-fast-provisioning - * variable: IEEE_8021X_FAST_PROVISIONING(+) - * values: space-separated list of these values [allow-auth, allow-unauth] - * description: Enable in-line provisioning of EAP-FAST credentials. - * example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth" - * ---end--- - */ - obj_properties[PROP_PHASE1_FAST_PROVISIONING] = - g_param_spec_string (NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase1-auth-flags: - * - * Specifies authentication flags to use in "phase 1" outer - * authentication using #NMSetting8021xAuthFlags options. - * The individual TLS versions can be explicitly disabled. If a certain - * TLS disable flag is not set, it is up to the supplicant to allow - * or forbid it. The TLS options map to tls_disable_tlsv1_x settings. - * See the wpa_supplicant documentation for more details. - * - * Since: 1.8 - */ - /* ---ifcfg-rh--- - * property: phase1-auth-flags - * variable: IEEE_8021X_PHASE1_AUTH_FLAGS(+) - * values: space-separated list of authentication flags names - * description: Authentication flags for the supplicant - * example: IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable" - * ---end--- - */ - obj_properties[PROP_PHASE1_AUTH_FLAGS] = - g_param_spec_uint (NM_SETTING_802_1X_PHASE1_AUTH_FLAGS, "", "", - 0, G_MAXUINT32, NM_SETTING_802_1X_AUTH_FLAGS_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-auth: - * - * Specifies the allowed "phase 2" inner non-EAP authentication method when - * an EAP method that uses an inner TLS tunnel is specified in the - * #NMSetting8021x:eap property. Recognized non-EAP "phase 2" methods are - * "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". - * Each "phase 2" inner method requires specific parameters for successful - * authentication; see the wpa_supplicant documentation for more details. - **/ - /* ---ifcfg-rh--- - * property: phase2-auth - * variable: IEEE_8021X_INNER_AUTH_METHODS(+) - * values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS" - * description: Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS - * can contain values both for 'phase2-auth' and 'phase2-autheap' properties. - * example: IEEE_8021X_INNER_AUTH_METHODS=PAP - * ---end--- - */ - obj_properties[PROP_PHASE2_AUTH] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_AUTH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-autheap: - * - * Specifies the allowed "phase 2" inner EAP-based authentication method - * when an EAP method that uses an inner TLS tunnel is specified in the - * #NMSetting8021x:eap property. Recognized EAP-based "phase 2" methods are - * "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method - * requires specific parameters for successful authentication; see the - * wpa_supplicant documentation for more details. - **/ - /* ---ifcfg-rh--- - * property: phase2-autheap - * variable: IEEE_8021X_INNER_AUTH_METHODS(+) - * values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS" - * description: Inner EAP-based authentication methods. Note that - * IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values. - * example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS" - * ---end--- - */ - obj_properties[PROP_PHASE2_AUTHEAP] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_AUTHEAP, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-ca-cert: - * - * Contains the "phase 2" CA certificate if used by the EAP method specified - * in the #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap - * properties. - * - * Certificate data is specified using a "scheme"; three are currently - * supported: blob, path and pkcs#11 URL. When using the blob scheme this property - * should be set to the certificate's DER encoded data. When using the path - * scheme, this property should be set to the full UTF-8 encoded path of the - * certificate, prefixed with the string "file://" and ending with a terminating - * NUL byte. - * This property can be unset even if the EAP method supports CA certificates, - * but this allows man-in-the-middle attacks and is NOT recommended. - * - * Note that enabling NMSetting8021x:system-ca-certs will override this - * setting to use the built-in path, if the built-in path is not a directory. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_phase2_ca_cert() function instead. - **/ - obj_properties[PROP_PHASE2_CA_CERT] = - g_param_spec_boxed (NM_SETTING_802_1X_PHASE2_CA_CERT, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-ca-cert-password: - * - * The password used to access the "phase2" CA certificate stored in - * #NMSetting8021x:phase2-ca-cert property. Only makes sense if the certificate - * is stored on a PKCS#<!-- -->11 token that requires a login. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_PHASE2_CA_CERT_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-ca-cert-password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:phase2-ca-cert-password property. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_PHASE2_CA_CERT_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-ca-path: - * - * UTF-8 encoded path to a directory containing PEM or DER formatted - * certificates to be added to the verification chain in addition to the - * certificate specified in the #NMSetting8021x:phase2-ca-cert property. - * - * If NMSetting8021x:system-ca-certs is enabled and the built-in CA - * path is an existing directory, then this setting is ignored. - **/ - /* ---ifcfg-rh--- - * property: phase2-ca-path - * variable: IEEE_8021X_PHASE2_CA_PATH(+) - * description: The search path for the certificate. - * ---end--- - */ - obj_properties[PROP_PHASE2_CA_PATH] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_CA_PATH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-subject-match: - * - * Substring to be matched against the subject of the certificate presented - * by the authentication server during the inner "phase 2" - * authentication. When unset, no verification of the authentication server - * certificate's subject is performed. This property provides little security, - * if any, and its use is deprecated in favor of - * NMSetting8021x:phase2-domain-suffix-match. - **/ - /* ---ifcfg-rh--- - * property: phase2-subject-match - * variable: IEEE_8021X_PHASE2_SUBJECT_MATCH(+) - * description: Substring to match subject of server certificate against. - * example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat" - * ---end--- - */ - obj_properties[PROP_PHASE2_SUBJECT_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-altsubject-matches: - * - * List of strings to be matched against the altSubjectName of the - * certificate presented by the authentication server during the inner - * "phase 2" authentication. If the list is empty, no verification of the - * server certificate's altSubjectName is performed. - **/ - /* ---ifcfg-rh--- - * property: phase2-altsubject-matches - * variable: IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+) - * ---end--- - */ - obj_properties[PROP_PHASE2_ALTSUBJECT_MATCHES] = - g_param_spec_boxed (NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES, "", "", - G_TYPE_STRV, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-domain-suffix-match: - * - * Constraint for server domain name. If set, this FQDN is used as a suffix - * match requirement for dNSName element(s) of the certificate presented by - * the authentication server during the inner "phase 2" authentication. If - * a matching dNSName is found, this constraint is met. If no dNSName - * values are present, this constraint is matched against SubjectName CN - * using same suffix match comparison. - * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited - * list. - * - * Since: 1.2 - **/ - /* ---ifcfg-rh--- - * property: phase2-domain-suffix-match - * description: Suffix to match domain of server certificate for phase 2 against. - * variable: IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+) - * ---end--- - */ - obj_properties[PROP_PHASE2_DOMAIN_SUFFIX_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-domain-match: - * - * Constraint for server domain name. If set, this list of FQDNs is used as - * a match requirement for dNSName element(s) of the certificate presented - * by the authentication server during the inner "phase 2" authentication. - * If a matching dNSName is found, this constraint is met. If no dNSName - * values are present, this constraint is matched against SubjectName CN - * using the same comparison. - * Multiple valid FQDNs can be passed as a ";" delimited list. - * - * Since: 1.24 - **/ - /* ---ifcfg-rh--- - * property: phase2-domain-match - * description: Value to match domain of server certificate for phase 2 against. - * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+) - * ---end--- - */ - obj_properties[PROP_PHASE2_DOMAIN_MATCH] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH, "", "", - NULL, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-client-cert: - * - * Contains the "phase 2" client certificate if used by the EAP method - * specified in the #NMSetting8021x:phase2-auth or - * #NMSetting8021x:phase2-autheap properties. - * - * Certificate data is specified using a "scheme"; two are currently - * supported: blob and path. When using the blob scheme (which is backwards - * compatible with NM 0.7.x) this property should be set to the - * certificate's DER encoded data. When using the path scheme, this property - * should be set to the full UTF-8 encoded path of the certificate, prefixed - * with the string "file://" and ending with a terminating NUL byte. This - * property can be unset even if the EAP method supports CA certificates, - * but this allows man-in-the-middle attacks and is NOT recommended. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_phase2_client_cert() function instead. - **/ - /* ---ifcfg-rh--- - * property: phase2-client-cert - * variable: IEEE_8021X_INNER_CLIENT_CERT(+) - * description: Client certificate for inner EAP method. - * example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt - * ---end--- - */ - obj_properties[PROP_PHASE2_CLIENT_CERT] = - g_param_spec_boxed (NM_SETTING_802_1X_PHASE2_CLIENT_CERT, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-client-cert-password: - * - * The password used to access the "phase2" client certificate stored in - * #NMSetting8021x:phase2-client-cert property. Only makes sense if the certificate - * is stored on a PKCS#<!-- -->11 token that requires a login. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-client-cert-password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:phase2-client-cert-password property. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * ---end--- - */ - obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:password: - * - * UTF-8 encoded password used for EAP authentication methods. If both the - * #NMSetting8021x:password property and the #NMSetting8021x:password-raw - * property are specified, #NMSetting8021x:password is preferred. - **/ - /* ---ifcfg-rh--- - * property: password - * variable: IEEE_8021X_PASSWORD(+) - * description: UTF-8 encoded password used for EAP. It can also go to "key-" - * lookaside file, or it can be owned by a secret agent. - * ---end--- - */ - obj_properties[PROP_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:password property. - **/ - /* ---ifcfg-rh--- - * property: password-flags - * variable: IEEE_8021X_PASSWORD_FLAGS(+) - * format: NMSettingSecretFlags - * description: Password flags for IEEE_8021X_PASSWORD password. - * ---end--- - */ - obj_properties[PROP_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:password-raw: - * - * Password used for EAP authentication methods, given as a byte array to - * allow passwords in other encodings than UTF-8 to be used. If both the - * #NMSetting8021x:password property and the #NMSetting8021x:password-raw - * property are specified, #NMSetting8021x:password is preferred. - **/ - /* ---ifcfg-rh--- - * property: password-raw - * variable: IEEE_8021X_PASSWORD_RAW(+) - * description: password used for EAP, encoded as a hexadecimal string. It - * can also go to "key-" lookaside file. - * example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf - * ---end--- - */ - obj_properties[PROP_PASSWORD_RAW] = - g_param_spec_boxed (NM_SETTING_802_1X_PASSWORD_RAW, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:password-raw-flags: - * - * Flags indicating how to handle the #NMSetting8021x:password-raw property. - **/ - /* ---ifcfg-rh--- - * property: password-raw-flags - * variable: IEEE_8021X_PASSWORD_RAW_FLAGS(+) - * description: The secret flags for password-raw. - * ---end--- - */ - obj_properties[PROP_PASSWORD_RAW_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PASSWORD_RAW_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:private-key: - * - * Contains the private key when the #NMSetting8021x:eap property is set to - * "tls". - * - * Key data is specified using a "scheme"; two are currently supported: blob - * and path. When using the blob scheme and private keys, this property - * should be set to the key's encrypted PEM encoded data. When using private - * keys with the path scheme, this property should be set to the full UTF-8 - * encoded path of the key, prefixed with the string "file://" and ending - * with a terminating NUL byte. When using PKCS#<!-- -->12 format private - * keys and the blob scheme, this property should be set to the - * PKCS#<!-- -->12 data and the #NMSetting8021x:private-key-password - * property must be set to password used to decrypt the PKCS#<!-- -->12 - * certificate and key. When using PKCS#<!-- -->12 files and the path - * scheme, this property should be set to the full UTF-8 encoded path of the - * key, prefixed with the string "file://" and ending with a terminating - * NUL byte, and as with the blob scheme the "private-key-password" property - * must be set to the password used to decode the PKCS#<!-- -->12 private - * key and certificate. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_private_key() function instead. - * - * WARNING: #NMSetting8021x:private-key is not a "secret" property, and thus - * unencrypted private key data using the BLOB scheme may be readable by - * unprivileged users. Private keys should always be encrypted with a - * private key password to prevent unauthorized access to unencrypted - * private key data. - **/ - /* ---ifcfg-rh--- - * property: private-key - * variable: IEEE_8021X_PRIVATE_KEY(+) - * description: Private key for EAP-TLS. - * example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12 - * ---end--- - */ - obj_properties[PROP_PRIVATE_KEY] = - g_param_spec_boxed (NM_SETTING_802_1X_PRIVATE_KEY, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:private-key-password: - * - * The password used to decrypt the private key specified in the - * #NMSetting8021x:private-key property when the private key either uses the - * path scheme, or if the private key is a PKCS#<!-- -->12 format key. Setting this - * property directly is not generally necessary except when returning - * secrets to NetworkManager; it is generally set automatically when setting - * the private key by the nm_setting_802_1x_set_private_key() function. - **/ - /* ---ifcfg-rh--- - * property: private-key-password - * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD(+) - * description: Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-" - * lookaside file, or it can be owned by a secret agent. - * ---end--- - */ - obj_properties[PROP_PRIVATE_KEY_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:private-key-password-flags: - * - * Flags indicating how to handle the #NMSetting8021x:private-key-password - * property. - **/ - /* ---ifcfg-rh--- - * property: private-key-password-flags - * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+) - * format: NMSettingSecretFlags - * description: Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password. - * ---end--- - */ - obj_properties[PROP_PRIVATE_KEY_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-private-key: - * - * Contains the "phase 2" inner private key when the - * #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap property is - * set to "tls". - * - * Key data is specified using a "scheme"; two are currently supported: blob - * and path. When using the blob scheme and private keys, this property - * should be set to the key's encrypted PEM encoded data. When using private - * keys with the path scheme, this property should be set to the full UTF-8 - * encoded path of the key, prefixed with the string "file://" and ending - * with a terminating NUL byte. When using PKCS#<!-- -->12 format private - * keys and the blob scheme, this property should be set to the - * PKCS#<!-- -->12 data and the #NMSetting8021x:phase2-private-key-password - * property must be set to password used to decrypt the PKCS#<!-- -->12 - * certificate and key. When using PKCS#<!-- -->12 files and the path - * scheme, this property should be set to the full UTF-8 encoded path of the - * key, prefixed with the string "file://" and ending with a terminating - * NUL byte, and as with the blob scheme the - * #NMSetting8021x:phase2-private-key-password property must be set to the - * password used to decode the PKCS#<!-- -->12 private key and certificate. - * - * Setting this property directly is discouraged; use the - * nm_setting_802_1x_set_phase2_private_key() function instead. - **/ - /* ---ifcfg-rh--- - * property: phase2-private-key - * variable: IEEE_8021X_INNER_PRIVATE_KEY(+) - * description: Private key for inner authentication method for EAP-TLS. - * ---end--- - */ - obj_properties[PROP_PHASE2_PRIVATE_KEY] = - g_param_spec_boxed (NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, "", "", - G_TYPE_BYTES, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-private-key-password: - * - * The password used to decrypt the "phase 2" private key specified in the - * #NMSetting8021x:phase2-private-key property when the private key either - * uses the path scheme, or is a PKCS#<!-- -->12 format key. Setting this - * property directly is not generally necessary except when returning - * secrets to NetworkManager; it is generally set automatically when setting - * the private key by the nm_setting_802_1x_set_phase2_private_key() - * function. - **/ - /* ---ifcfg-rh--- - * property: phase2-private-key-password - * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+) - * description: Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-" - * lookaside file, or it can be owned by a secret agent. - * ---end--- - */ - obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD] = - g_param_spec_string (NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:phase2-private-key-password-flags: - * - * Flags indicating how to handle the - * #NMSetting8021x:phase2-private-key-password property. - **/ - /* ---ifcfg-rh--- - * property: phase2-private-key-password-flags - * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+) - * format: NMSettingSecretFlags - * description: Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password. - * ---end--- - */ - obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:pin: - * - * PIN used for EAP authentication methods. - **/ - /* ---ifcfg-rh--- - * property: pin - * variable: IEEE_8021X_PIN(+) - * description: The pin secret used for EAP authentication methods. - * ---end--- - */ - obj_properties[PROP_PIN] = - g_param_spec_string (NM_SETTING_802_1X_PIN, "", "", - NULL, - G_PARAM_READWRITE | - NM_SETTING_PARAM_SECRET | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:pin-flags: - * - * Flags indicating how to handle the #NMSetting8021x:pin property. - **/ - /* ---ifcfg-rh--- - * property: pin-flags - * variable: IEEE_8021X_PIN_FLAGS(+) - * description: The secret flags for the pin property. - * ---end--- - */ - obj_properties[PROP_PIN_FLAGS] = - g_param_spec_flags (NM_SETTING_802_1X_PIN_FLAGS, "", "", - NM_TYPE_SETTING_SECRET_FLAGS, - NM_SETTING_SECRET_FLAG_NONE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:system-ca-certs: - * - * When %TRUE, overrides the #NMSetting8021x:ca-path and - * #NMSetting8021x:phase2-ca-path properties using the system CA directory - * specified at configure time with the --system-ca-path switch. The - * certificates in this directory are added to the verification chain in - * addition to any certificates specified by the #NMSetting8021x:ca-cert and - * #NMSetting8021x:phase2-ca-cert properties. If the path provided with - * --system-ca-path is rather a file name (bundle of trusted CA certificates), - * it overrides #NMSetting8021x:ca-cert and #NMSetting8021x:phase2-ca-cert - * properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant). - **/ - /* ---ifcfg-rh--- - * property: system-ca-certs - * variable: IEEE_8021X_SYSTEM_CA_CERTS(+) - * description: a boolean value. - * ---end--- - */ - obj_properties[PROP_SYSTEM_CA_CERTS] = - g_param_spec_boolean (NM_SETTING_802_1X_SYSTEM_CA_CERTS, "", "", - FALSE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:auth-timeout: - * - * A timeout for the authentication. Zero means the global default; if the - * global default is not set, the authentication timeout is 25 seconds. - * - * Since: 1.8 - **/ - /* ---ifcfg-rh--- - * property: auth-timeout - * variable: IEEE_8021X_AUTH_TIMEOUT(+) - * default: 0 - * description: Timeout in seconds for the 802.1X authentication. Zero means the global default or 25. - * ---end--- - */ - obj_properties[PROP_AUTH_TIMEOUT] = - g_param_spec_int (NM_SETTING_802_1X_AUTH_TIMEOUT, "", "", - 0, G_MAXINT32, 0, - G_PARAM_READWRITE | - NM_SETTING_PARAM_FUZZY_IGNORE | - G_PARAM_STATIC_STRINGS); - - /** - * NMSetting8021x:optional: - * - * Whether the 802.1X authentication is optional. If %TRUE, the activation - * will continue even after a timeout or an authentication failure. Setting - * the property to %TRUE is currently allowed only for Ethernet connections. - * If set to %FALSE, the activation can continue only after a successful - * authentication. - * - * Since: 1.22 - **/ - /* ---ifcfg-rh--- - * property: optional - * variable: IEEE_8021X_OPTIONAL(+) - * default=no - * description: whether the 802.1X authentication is optional - * ---end--- - */ - obj_properties[PROP_OPTIONAL] = - g_param_spec_boolean (NM_SETTING_802_1X_OPTIONAL, "", "", - FALSE, - G_PARAM_READWRITE | - G_PARAM_STATIC_STRINGS); - - g_object_class_install_properties (object_class, _PROPERTY_ENUMS_LAST, obj_properties); - - _nm_setting_class_commit (setting_class, NM_META_SETTING_TYPE_802_1X); + GObjectClass * object_class = G_OBJECT_CLASS(klass); + NMSettingClass *setting_class = NM_SETTING_CLASS(klass); + + g_type_class_add_private(klass, sizeof(NMSetting8021xPrivate)); + + object_class->get_property = get_property; + object_class->set_property = set_property; + object_class->finalize = finalize; + + setting_class->verify = verify; + setting_class->need_secrets = need_secrets; + + /** + * NMSetting8021x:eap: + * + * The allowed EAP method to be used when authenticating to the network with + * 802.1x. Valid methods are: "leap", "md5", "tls", "peap", "ttls", "pwd", + * and "fast". Each method requires different configuration using the + * properties of this setting; refer to wpa_supplicant documentation for the + * allowed combinations. + **/ + /* ---ifcfg-rh--- + * property: eap + * variable: IEEE_8021X_EAP_METHODS(+) + * values: "LEAP", "PWD", "TLS", "PEAP", "TTLS", "FAST" + * description: EAP method for 802.1X authentication. + * example: IEEE_8021X_EAP_METHODS=PEAP + * ---end--- + */ + obj_properties[PROP_EAP] = g_param_spec_boxed(NM_SETTING_802_1X_EAP, + "", + "", + G_TYPE_STRV, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:identity: + * + * Identity string for EAP authentication methods. Often the user's user or + * login name. + **/ + /* ---ifcfg-rh--- + * property: identity + * variable: IEEE_8021X_IDENTITY(+) + * description: Identity for EAP authentication methods. + * example: IEEE_8021X_IDENTITY=itsme + * ---end--- + */ + obj_properties[PROP_IDENTITY] = g_param_spec_string(NM_SETTING_802_1X_IDENTITY, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:anonymous-identity: + * + * Anonymous identity string for EAP authentication methods. Used as the + * unencrypted identity with EAP types that support different tunneled + * identity like EAP-TTLS. + **/ + /* ---ifcfg-rh--- + * property: anonymous-identity + * variable: IEEE_8021X_ANON_IDENTITY(+) + * description: Anonymous identity for EAP authentication methods. + * ---end--- + */ + obj_properties[PROP_ANONYMOUS_IDENTITY] = + g_param_spec_string(NM_SETTING_802_1X_ANONYMOUS_IDENTITY, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:pac-file: + * + * UTF-8 encoded file path containing PAC for EAP-FAST. + **/ + /* ---ifcfg-rh--- + * property: pac-file + * variable: IEEE_8021X_PAC_FILE(+) + * description: File with PAC (Protected Access Credential) for EAP-FAST. + * example: IEEE_8021X_PAC_FILE=/home/joe/my-fast.pac + * ---end--- + */ + obj_properties[PROP_PAC_FILE] = g_param_spec_string(NM_SETTING_802_1X_PAC_FILE, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:ca-cert: + * + * Contains the CA certificate if used by the EAP method specified in the + * #NMSetting8021x:eap property. + * + * Certificate data is specified using a "scheme"; three are currently + * supported: blob, path and pkcs#11 URL. When using the blob scheme this property + * should be set to the certificate's DER encoded data. When using the path + * scheme, this property should be set to the full UTF-8 encoded path of the + * certificate, prefixed with the string "file://" and ending with a terminating + * NUL byte. + * This property can be unset even if the EAP method supports CA certificates, + * but this allows man-in-the-middle attacks and is NOT recommended. + * + * Note that enabling NMSetting8021x:system-ca-certs will override this + * setting to use the built-in path, if the built-in path is not a directory. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_ca_cert() function instead. + **/ + /* ---ifcfg-rh--- + * property: ca-cert + * variable: IEEE_8021X_CA_CERT(+) + * description: CA certificate for EAP. + * example: IEEE_8021X_CA_CERT=/home/joe/cacert.crt + * ---end--- + */ + obj_properties[PROP_CA_CERT] = g_param_spec_boxed(NM_SETTING_802_1X_CA_CERT, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:ca-cert-password: + * + * The password used to access the CA certificate stored in + * #NMSetting8021x:ca-cert property. Only makes sense if the certificate + * is stored on a PKCS#<!-- -->11 token that requires a login. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_CA_CERT_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_CA_CERT_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:ca-cert-password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:ca-cert-password property. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_CA_CERT_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_CA_CERT_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:ca-path: + * + * UTF-8 encoded path to a directory containing PEM or DER formatted + * certificates to be added to the verification chain in addition to the + * certificate specified in the #NMSetting8021x:ca-cert property. + * + * If NMSetting8021x:system-ca-certs is enabled and the built-in CA + * path is an existing directory, then this setting is ignored. + **/ + /* ---ifcfg-rh--- + * property: ca-path + * variable: IEEE_8021X_CA_PATH(+) + * description: The search path for the certificate. + * ---end--- + */ + obj_properties[PROP_CA_PATH] = g_param_spec_string(NM_SETTING_802_1X_CA_PATH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:subject-match: + * + * Substring to be matched against the subject of the certificate presented + * by the authentication server. When unset, no verification of the + * authentication server certificate's subject is performed. This property + * provides little security, if any, and its use is deprecated in favor of + * NMSetting8021x:domain-suffix-match. + **/ + /* ---ifcfg-rh--- + * property: subject-match + * variable: IEEE_8021X_SUBJECT_MATCH(+) + * description: Substring to match subject of server certificate against. + * example: IEEE_8021X_SUBJECT_MATCH="Red Hat" + * ---end--- + */ + obj_properties[PROP_SUBJECT_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_SUBJECT_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:altsubject-matches: + * + * List of strings to be matched against the altSubjectName of the + * certificate presented by the authentication server. If the list is empty, + * no verification of the server certificate's altSubjectName is performed. + **/ + /* ---ifcfg-rh--- + * property: altsubject-matches + * variable: IEEE_8021X_ALTSUBJECT_MATCHES(+) + * description: List of strings to be matched against the altSubjectName. + * example: IEEE_8021X_ALTSUBJECT_MATCHES="s1.domain.cc" + * ---end--- + */ + obj_properties[PROP_ALTSUBJECT_MATCHES] = + g_param_spec_boxed(NM_SETTING_802_1X_ALTSUBJECT_MATCHES, + "", + "", + G_TYPE_STRV, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:domain-suffix-match: + * + * Constraint for server domain name. If set, this FQDN is used as a suffix + * match requirement for dNSName element(s) of the certificate presented by + * the authentication server. If a matching dNSName is found, this + * constraint is met. If no dNSName values are present, this constraint is + * matched against SubjectName CN using same suffix match comparison. + * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited + * list. + * + * Since: 1.2 + **/ + /* ---ifcfg-rh--- + * property: domain-suffix-match + * description: Suffix to match domain of server certificate against. + * variable: IEEE_8021X_DOMAIN_SUFFIX_MATCH(+) + * ---end--- + */ + obj_properties[PROP_DOMAIN_SUFFIX_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_DOMAIN_SUFFIX_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:domain-match: + * + * Constraint for server domain name. If set, this list of FQDNs is used as + * a match requirement for dNSName element(s) of the certificate presented + * by the authentication server. If a matching dNSName is found, this + * constraint is met. If no dNSName values are present, this constraint is + * matched against SubjectName CN using the same comparison. + * Multiple valid FQDNs can be passed as a ";" delimited list. + * + * Since: 1.24 + **/ + /* ---ifcfg-rh--- + * property: domain-match + * description: Value to match domain of server certificate against. + * variable: IEEE_8021X_DOMAIN_MATCH(+) + * ---end--- + */ + obj_properties[PROP_DOMAIN_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_DOMAIN_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:client-cert: + * + * Contains the client certificate if used by the EAP method specified in + * the #NMSetting8021x:eap property. + * + * Certificate data is specified using a "scheme"; two are currently + * supported: blob and path. When using the blob scheme (which is backwards + * compatible with NM 0.7.x) this property should be set to the + * certificate's DER encoded data. When using the path scheme, this property + * should be set to the full UTF-8 encoded path of the certificate, prefixed + * with the string "file://" and ending with a terminating NUL byte. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_client_cert() function instead. + **/ + /* ---ifcfg-rh--- + * property: client-cert + * variable: IEEE_8021X_CLIENT_CERT(+) + * description: Client certificate for EAP. + * example: IEEE_8021X_CLIENT_CERT=/home/joe/mycert.crt + * ---end--- + */ + obj_properties[PROP_CLIENT_CERT] = + g_param_spec_boxed(NM_SETTING_802_1X_CLIENT_CERT, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:client-cert-password: + * + * The password used to access the client certificate stored in + * #NMSetting8021x:client-cert property. Only makes sense if the certificate + * is stored on a PKCS#<!-- -->11 token that requires a login. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_CLIENT_CERT_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:client-cert-password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:client-cert-password property. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_CLIENT_CERT_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_CLIENT_CERT_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase1-peapver: + * + * Forces which PEAP version is used when PEAP is set as the EAP method in + * the #NMSetting8021x:eap property. When unset, the version reported by + * the server will be used. Sometimes when using older RADIUS servers, it + * is necessary to force the client to use a particular PEAP version. To do + * so, this property may be set to "0" or "1" to force that specific PEAP + * version. + **/ + /* ---ifcfg-rh--- + * property: phase1-peapver + * variable: IEEE_8021X_PEAP_VERSION(+) + * values: 0, 1 + * description: Use to force a specific PEAP version. + * ---end--- + */ + obj_properties[PROP_PHASE1_PEAPVER] = + g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPVER, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase1-peaplabel: + * + * Forces use of the new PEAP label during key derivation. Some RADIUS + * servers may require forcing the new PEAP label to interoperate with + * PEAPv1. Set to "1" to force use of the new PEAP label. See the + * wpa_supplicant documentation for more details. + **/ + /* ---ifcfg-rh--- + * property: phase1-peaplabel + * variable: IEEE_8021X_PEAP_FORCE_NEW_LABEL(+) + * values: yes, no + * default: no + * description: Use to force the new PEAP label during key derivation. + * ---end--- + */ + obj_properties[PROP_PHASE1_PEAPLABEL] = + g_param_spec_string(NM_SETTING_802_1X_PHASE1_PEAPLABEL, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase1-fast-provisioning: + * + * Enables or disables in-line provisioning of EAP-FAST credentials when + * FAST is specified as the EAP method in the #NMSetting8021x:eap property. + * Recognized values are "0" (disabled), "1" (allow unauthenticated + * provisioning), "2" (allow authenticated provisioning), and "3" (allow + * both authenticated and unauthenticated provisioning). See the + * wpa_supplicant documentation for more details. + **/ + /* ---ifcfg-rh--- + * property: phase1-fast-provisioning + * variable: IEEE_8021X_FAST_PROVISIONING(+) + * values: space-separated list of these values [allow-auth, allow-unauth] + * description: Enable in-line provisioning of EAP-FAST credentials. + * example: IEEE_8021X_FAST_PROVISIONING="allow-auth allow-unauth" + * ---end--- + */ + obj_properties[PROP_PHASE1_FAST_PROVISIONING] = + g_param_spec_string(NM_SETTING_802_1X_PHASE1_FAST_PROVISIONING, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase1-auth-flags: + * + * Specifies authentication flags to use in "phase 1" outer + * authentication using #NMSetting8021xAuthFlags options. + * The individual TLS versions can be explicitly disabled. If a certain + * TLS disable flag is not set, it is up to the supplicant to allow + * or forbid it. The TLS options map to tls_disable_tlsv1_x settings. + * See the wpa_supplicant documentation for more details. + * + * Since: 1.8 + */ + /* ---ifcfg-rh--- + * property: phase1-auth-flags + * variable: IEEE_8021X_PHASE1_AUTH_FLAGS(+) + * values: space-separated list of authentication flags names + * description: Authentication flags for the supplicant + * example: IEEE_8021X_PHASE1_AUTH_FLAGS="tls-1-0-disable tls-1-1-disable" + * ---end--- + */ + obj_properties[PROP_PHASE1_AUTH_FLAGS] = + g_param_spec_uint(NM_SETTING_802_1X_PHASE1_AUTH_FLAGS, + "", + "", + 0, + G_MAXUINT32, + NM_SETTING_802_1X_AUTH_FLAGS_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-auth: + * + * Specifies the allowed "phase 2" inner non-EAP authentication method when + * an EAP method that uses an inner TLS tunnel is specified in the + * #NMSetting8021x:eap property. Recognized non-EAP "phase 2" methods are + * "pap", "chap", "mschap", "mschapv2", "gtc", "otp", "md5", and "tls". + * Each "phase 2" inner method requires specific parameters for successful + * authentication; see the wpa_supplicant documentation for more details. + **/ + /* ---ifcfg-rh--- + * property: phase2-auth + * variable: IEEE_8021X_INNER_AUTH_METHODS(+) + * values: "PAP", "CHAP", "MSCHAP", "MSCHAPV2", "GTC", "OTP", "MD5" and "TLS" + * description: Inner non-EAP authentication methods. IEEE_8021X_INNER_AUTH_METHODS + * can contain values both for 'phase2-auth' and 'phase2-autheap' properties. + * example: IEEE_8021X_INNER_AUTH_METHODS=PAP + * ---end--- + */ + obj_properties[PROP_PHASE2_AUTH] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-autheap: + * + * Specifies the allowed "phase 2" inner EAP-based authentication method + * when an EAP method that uses an inner TLS tunnel is specified in the + * #NMSetting8021x:eap property. Recognized EAP-based "phase 2" methods are + * "md5", "mschapv2", "otp", "gtc", and "tls". Each "phase 2" inner method + * requires specific parameters for successful authentication; see the + * wpa_supplicant documentation for more details. + **/ + /* ---ifcfg-rh--- + * property: phase2-autheap + * variable: IEEE_8021X_INNER_AUTH_METHODS(+) + * values: "EAP-MD5", "EAP-MSCHAPV2", "EAP-GTC", "EAP-OTP" and "EAP-TLS" + * description: Inner EAP-based authentication methods. Note that + * IEEE_8021X_INNER_AUTH_METHODS is also used for 'phase2-auth' values. + * example: IEEE_8021X_INNER_AUTH_METHODS="MSCHAPV2 EAP-TLS" + * ---end--- + */ + obj_properties[PROP_PHASE2_AUTHEAP] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_AUTHEAP, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-ca-cert: + * + * Contains the "phase 2" CA certificate if used by the EAP method specified + * in the #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap + * properties. + * + * Certificate data is specified using a "scheme"; three are currently + * supported: blob, path and pkcs#11 URL. When using the blob scheme this property + * should be set to the certificate's DER encoded data. When using the path + * scheme, this property should be set to the full UTF-8 encoded path of the + * certificate, prefixed with the string "file://" and ending with a terminating + * NUL byte. + * This property can be unset even if the EAP method supports CA certificates, + * but this allows man-in-the-middle attacks and is NOT recommended. + * + * Note that enabling NMSetting8021x:system-ca-certs will override this + * setting to use the built-in path, if the built-in path is not a directory. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_phase2_ca_cert() function instead. + **/ + obj_properties[PROP_PHASE2_CA_CERT] = + g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CA_CERT, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-ca-cert-password: + * + * The password used to access the "phase2" CA certificate stored in + * #NMSetting8021x:phase2-ca-cert property. Only makes sense if the certificate + * is stored on a PKCS#<!-- -->11 token that requires a login. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_PHASE2_CA_CERT_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-ca-cert-password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:phase2-ca-cert-password property. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_PHASE2_CA_CERT_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CA_CERT_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-ca-path: + * + * UTF-8 encoded path to a directory containing PEM or DER formatted + * certificates to be added to the verification chain in addition to the + * certificate specified in the #NMSetting8021x:phase2-ca-cert property. + * + * If NMSetting8021x:system-ca-certs is enabled and the built-in CA + * path is an existing directory, then this setting is ignored. + **/ + /* ---ifcfg-rh--- + * property: phase2-ca-path + * variable: IEEE_8021X_PHASE2_CA_PATH(+) + * description: The search path for the certificate. + * ---end--- + */ + obj_properties[PROP_PHASE2_CA_PATH] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_CA_PATH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-subject-match: + * + * Substring to be matched against the subject of the certificate presented + * by the authentication server during the inner "phase 2" + * authentication. When unset, no verification of the authentication server + * certificate's subject is performed. This property provides little security, + * if any, and its use is deprecated in favor of + * NMSetting8021x:phase2-domain-suffix-match. + **/ + /* ---ifcfg-rh--- + * property: phase2-subject-match + * variable: IEEE_8021X_PHASE2_SUBJECT_MATCH(+) + * description: Substring to match subject of server certificate against. + * example: IEEE_8021X_PHASE2_SUBJECT_MATCH="Red Hat" + * ---end--- + */ + obj_properties[PROP_PHASE2_SUBJECT_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_SUBJECT_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-altsubject-matches: + * + * List of strings to be matched against the altSubjectName of the + * certificate presented by the authentication server during the inner + * "phase 2" authentication. If the list is empty, no verification of the + * server certificate's altSubjectName is performed. + **/ + /* ---ifcfg-rh--- + * property: phase2-altsubject-matches + * variable: IEEE_8021X_PHASE2_ALTSUBJECT_MATCHES(+) + * ---end--- + */ + obj_properties[PROP_PHASE2_ALTSUBJECT_MATCHES] = + g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES, + "", + "", + G_TYPE_STRV, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-domain-suffix-match: + * + * Constraint for server domain name. If set, this FQDN is used as a suffix + * match requirement for dNSName element(s) of the certificate presented by + * the authentication server during the inner "phase 2" authentication. If + * a matching dNSName is found, this constraint is met. If no dNSName + * values are present, this constraint is matched against SubjectName CN + * using same suffix match comparison. + * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited + * list. + * + * Since: 1.2 + **/ + /* ---ifcfg-rh--- + * property: phase2-domain-suffix-match + * description: Suffix to match domain of server certificate for phase 2 against. + * variable: IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH(+) + * ---end--- + */ + obj_properties[PROP_PHASE2_DOMAIN_SUFFIX_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-domain-match: + * + * Constraint for server domain name. If set, this list of FQDNs is used as + * a match requirement for dNSName element(s) of the certificate presented + * by the authentication server during the inner "phase 2" authentication. + * If a matching dNSName is found, this constraint is met. If no dNSName + * values are present, this constraint is matched against SubjectName CN + * using the same comparison. + * Multiple valid FQDNs can be passed as a ";" delimited list. + * + * Since: 1.24 + **/ + /* ---ifcfg-rh--- + * property: phase2-domain-match + * description: Value to match domain of server certificate for phase 2 against. + * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+) + * ---end--- + */ + obj_properties[PROP_PHASE2_DOMAIN_MATCH] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH, + "", + "", + NULL, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-client-cert: + * + * Contains the "phase 2" client certificate if used by the EAP method + * specified in the #NMSetting8021x:phase2-auth or + * #NMSetting8021x:phase2-autheap properties. + * + * Certificate data is specified using a "scheme"; two are currently + * supported: blob and path. When using the blob scheme (which is backwards + * compatible with NM 0.7.x) this property should be set to the + * certificate's DER encoded data. When using the path scheme, this property + * should be set to the full UTF-8 encoded path of the certificate, prefixed + * with the string "file://" and ending with a terminating NUL byte. This + * property can be unset even if the EAP method supports CA certificates, + * but this allows man-in-the-middle attacks and is NOT recommended. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_phase2_client_cert() function instead. + **/ + /* ---ifcfg-rh--- + * property: phase2-client-cert + * variable: IEEE_8021X_INNER_CLIENT_CERT(+) + * description: Client certificate for inner EAP method. + * example: IEEE_8021X_INNER_CLIENT_CERT=/home/joe/mycert.crt + * ---end--- + */ + obj_properties[PROP_PHASE2_CLIENT_CERT] = + g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_CLIENT_CERT, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-client-cert-password: + * + * The password used to access the "phase2" client certificate stored in + * #NMSetting8021x:phase2-client-cert property. Only makes sense if the certificate + * is stored on a PKCS#<!-- -->11 token that requires a login. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-client-cert-password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:phase2-client-cert-password property. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * ---end--- + */ + obj_properties[PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PHASE2_CLIENT_CERT_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:password: + * + * UTF-8 encoded password used for EAP authentication methods. If both the + * #NMSetting8021x:password property and the #NMSetting8021x:password-raw + * property are specified, #NMSetting8021x:password is preferred. + **/ + /* ---ifcfg-rh--- + * property: password + * variable: IEEE_8021X_PASSWORD(+) + * description: UTF-8 encoded password used for EAP. It can also go to "key-" + * lookaside file, or it can be owned by a secret agent. + * ---end--- + */ + obj_properties[PROP_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:password property. + **/ + /* ---ifcfg-rh--- + * property: password-flags + * variable: IEEE_8021X_PASSWORD_FLAGS(+) + * format: NMSettingSecretFlags + * description: Password flags for IEEE_8021X_PASSWORD password. + * ---end--- + */ + obj_properties[PROP_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:password-raw: + * + * Password used for EAP authentication methods, given as a byte array to + * allow passwords in other encodings than UTF-8 to be used. If both the + * #NMSetting8021x:password property and the #NMSetting8021x:password-raw + * property are specified, #NMSetting8021x:password is preferred. + **/ + /* ---ifcfg-rh--- + * property: password-raw + * variable: IEEE_8021X_PASSWORD_RAW(+) + * description: password used for EAP, encoded as a hexadecimal string. It + * can also go to "key-" lookaside file. + * example: IEEE_8021X_PASSWORD_RAW=041c8320083aa4bf + * ---end--- + */ + obj_properties[PROP_PASSWORD_RAW] = + g_param_spec_boxed(NM_SETTING_802_1X_PASSWORD_RAW, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:password-raw-flags: + * + * Flags indicating how to handle the #NMSetting8021x:password-raw property. + **/ + /* ---ifcfg-rh--- + * property: password-raw-flags + * variable: IEEE_8021X_PASSWORD_RAW_FLAGS(+) + * description: The secret flags for password-raw. + * ---end--- + */ + obj_properties[PROP_PASSWORD_RAW_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PASSWORD_RAW_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:private-key: + * + * Contains the private key when the #NMSetting8021x:eap property is set to + * "tls". + * + * Key data is specified using a "scheme"; two are currently supported: blob + * and path. When using the blob scheme and private keys, this property + * should be set to the key's encrypted PEM encoded data. When using private + * keys with the path scheme, this property should be set to the full UTF-8 + * encoded path of the key, prefixed with the string "file://" and ending + * with a terminating NUL byte. When using PKCS#<!-- -->12 format private + * keys and the blob scheme, this property should be set to the + * PKCS#<!-- -->12 data and the #NMSetting8021x:private-key-password + * property must be set to password used to decrypt the PKCS#<!-- -->12 + * certificate and key. When using PKCS#<!-- -->12 files and the path + * scheme, this property should be set to the full UTF-8 encoded path of the + * key, prefixed with the string "file://" and ending with a terminating + * NUL byte, and as with the blob scheme the "private-key-password" property + * must be set to the password used to decode the PKCS#<!-- -->12 private + * key and certificate. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_private_key() function instead. + * + * WARNING: #NMSetting8021x:private-key is not a "secret" property, and thus + * unencrypted private key data using the BLOB scheme may be readable by + * unprivileged users. Private keys should always be encrypted with a + * private key password to prevent unauthorized access to unencrypted + * private key data. + **/ + /* ---ifcfg-rh--- + * property: private-key + * variable: IEEE_8021X_PRIVATE_KEY(+) + * description: Private key for EAP-TLS. + * example: IEEE_8021X_PRIVATE_KEY=/home/joe/mykey.p12 + * ---end--- + */ + obj_properties[PROP_PRIVATE_KEY] = + g_param_spec_boxed(NM_SETTING_802_1X_PRIVATE_KEY, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:private-key-password: + * + * The password used to decrypt the private key specified in the + * #NMSetting8021x:private-key property when the private key either uses the + * path scheme, or if the private key is a PKCS#<!-- -->12 format key. Setting this + * property directly is not generally necessary except when returning + * secrets to NetworkManager; it is generally set automatically when setting + * the private key by the nm_setting_802_1x_set_private_key() function. + **/ + /* ---ifcfg-rh--- + * property: private-key-password + * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD(+) + * description: Password for IEEE_8021X_PRIVATE_KEY. It can also go to "key-" + * lookaside file, or it can be owned by a secret agent. + * ---end--- + */ + obj_properties[PROP_PRIVATE_KEY_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:private-key-password-flags: + * + * Flags indicating how to handle the #NMSetting8021x:private-key-password + * property. + **/ + /* ---ifcfg-rh--- + * property: private-key-password-flags + * variable: IEEE_8021X_PRIVATE_KEY_PASSWORD_FLAGS(+) + * format: NMSettingSecretFlags + * description: Password flags for IEEE_8021X_PRIVATE_KEY_PASSWORD password. + * ---end--- + */ + obj_properties[PROP_PRIVATE_KEY_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-private-key: + * + * Contains the "phase 2" inner private key when the + * #NMSetting8021x:phase2-auth or #NMSetting8021x:phase2-autheap property is + * set to "tls". + * + * Key data is specified using a "scheme"; two are currently supported: blob + * and path. When using the blob scheme and private keys, this property + * should be set to the key's encrypted PEM encoded data. When using private + * keys with the path scheme, this property should be set to the full UTF-8 + * encoded path of the key, prefixed with the string "file://" and ending + * with a terminating NUL byte. When using PKCS#<!-- -->12 format private + * keys and the blob scheme, this property should be set to the + * PKCS#<!-- -->12 data and the #NMSetting8021x:phase2-private-key-password + * property must be set to password used to decrypt the PKCS#<!-- -->12 + * certificate and key. When using PKCS#<!-- -->12 files and the path + * scheme, this property should be set to the full UTF-8 encoded path of the + * key, prefixed with the string "file://" and ending with a terminating + * NUL byte, and as with the blob scheme the + * #NMSetting8021x:phase2-private-key-password property must be set to the + * password used to decode the PKCS#<!-- -->12 private key and certificate. + * + * Setting this property directly is discouraged; use the + * nm_setting_802_1x_set_phase2_private_key() function instead. + **/ + /* ---ifcfg-rh--- + * property: phase2-private-key + * variable: IEEE_8021X_INNER_PRIVATE_KEY(+) + * description: Private key for inner authentication method for EAP-TLS. + * ---end--- + */ + obj_properties[PROP_PHASE2_PRIVATE_KEY] = + g_param_spec_boxed(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY, + "", + "", + G_TYPE_BYTES, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-private-key-password: + * + * The password used to decrypt the "phase 2" private key specified in the + * #NMSetting8021x:phase2-private-key property when the private key either + * uses the path scheme, or is a PKCS#<!-- -->12 format key. Setting this + * property directly is not generally necessary except when returning + * secrets to NetworkManager; it is generally set automatically when setting + * the private key by the nm_setting_802_1x_set_phase2_private_key() + * function. + **/ + /* ---ifcfg-rh--- + * property: phase2-private-key-password + * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD(+) + * description: Password for IEEE_8021X_INNER_PRIVATE_KEY. It can also go to "key-" + * lookaside file, or it can be owned by a secret agent. + * ---end--- + */ + obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD] = + g_param_spec_string(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:phase2-private-key-password-flags: + * + * Flags indicating how to handle the + * #NMSetting8021x:phase2-private-key-password property. + **/ + /* ---ifcfg-rh--- + * property: phase2-private-key-password-flags + * variable: IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD_FLAGS(+) + * format: NMSettingSecretFlags + * description: Password flags for IEEE_8021X_INNER_PRIVATE_KEY_PASSWORD password. + * ---end--- + */ + obj_properties[PROP_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS] = + g_param_spec_flags(NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:pin: + * + * PIN used for EAP authentication methods. + **/ + /* ---ifcfg-rh--- + * property: pin + * variable: IEEE_8021X_PIN(+) + * description: The pin secret used for EAP authentication methods. + * ---end--- + */ + obj_properties[PROP_PIN] = + g_param_spec_string(NM_SETTING_802_1X_PIN, + "", + "", + NULL, + G_PARAM_READWRITE | NM_SETTING_PARAM_SECRET | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:pin-flags: + * + * Flags indicating how to handle the #NMSetting8021x:pin property. + **/ + /* ---ifcfg-rh--- + * property: pin-flags + * variable: IEEE_8021X_PIN_FLAGS(+) + * description: The secret flags for the pin property. + * ---end--- + */ + obj_properties[PROP_PIN_FLAGS] = g_param_spec_flags(NM_SETTING_802_1X_PIN_FLAGS, + "", + "", + NM_TYPE_SETTING_SECRET_FLAGS, + NM_SETTING_SECRET_FLAG_NONE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:system-ca-certs: + * + * When %TRUE, overrides the #NMSetting8021x:ca-path and + * #NMSetting8021x:phase2-ca-path properties using the system CA directory + * specified at configure time with the --system-ca-path switch. The + * certificates in this directory are added to the verification chain in + * addition to any certificates specified by the #NMSetting8021x:ca-cert and + * #NMSetting8021x:phase2-ca-cert properties. If the path provided with + * --system-ca-path is rather a file name (bundle of trusted CA certificates), + * it overrides #NMSetting8021x:ca-cert and #NMSetting8021x:phase2-ca-cert + * properties instead (sets ca_cert/ca_cert2 options for wpa_supplicant). + **/ + /* ---ifcfg-rh--- + * property: system-ca-certs + * variable: IEEE_8021X_SYSTEM_CA_CERTS(+) + * description: a boolean value. + * ---end--- + */ + obj_properties[PROP_SYSTEM_CA_CERTS] = + g_param_spec_boolean(NM_SETTING_802_1X_SYSTEM_CA_CERTS, + "", + "", + FALSE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:auth-timeout: + * + * A timeout for the authentication. Zero means the global default; if the + * global default is not set, the authentication timeout is 25 seconds. + * + * Since: 1.8 + **/ + /* ---ifcfg-rh--- + * property: auth-timeout + * variable: IEEE_8021X_AUTH_TIMEOUT(+) + * default: 0 + * description: Timeout in seconds for the 802.1X authentication. Zero means the global default or 25. + * ---end--- + */ + obj_properties[PROP_AUTH_TIMEOUT] = g_param_spec_int( + NM_SETTING_802_1X_AUTH_TIMEOUT, + "", + "", + 0, + G_MAXINT32, + 0, + G_PARAM_READWRITE | NM_SETTING_PARAM_FUZZY_IGNORE | G_PARAM_STATIC_STRINGS); + + /** + * NMSetting8021x:optional: + * + * Whether the 802.1X authentication is optional. If %TRUE, the activation + * will continue even after a timeout or an authentication failure. Setting + * the property to %TRUE is currently allowed only for Ethernet connections. + * If set to %FALSE, the activation can continue only after a successful + * authentication. + * + * Since: 1.22 + **/ + /* ---ifcfg-rh--- + * property: optional + * variable: IEEE_8021X_OPTIONAL(+) + * default=no + * description: whether the 802.1X authentication is optional + * ---end--- + */ + obj_properties[PROP_OPTIONAL] = + g_param_spec_boolean(NM_SETTING_802_1X_OPTIONAL, + "", + "", + FALSE, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); + + g_object_class_install_properties(object_class, _PROPERTY_ENUMS_LAST, obj_properties); + + _nm_setting_class_commit(setting_class, NM_META_SETTING_TYPE_802_1X); } |