diff options
Diffstat (limited to 'libnm-core/nm-setting-8021x.c')
| -rw-r--r-- | libnm-core/nm-setting-8021x.c | 129 |
1 files changed, 115 insertions, 14 deletions
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c index 8464100d..ade34ff5 100644 --- a/libnm-core/nm-setting-8021x.c +++ b/libnm-core/nm-setting-8021x.c @@ -92,6 +92,7 @@ NM_GOBJECT_PROPERTIES_DEFINE (NMSetting8021x, PROP_SUBJECT_MATCH, PROP_ALTSUBJECT_MATCHES, PROP_DOMAIN_SUFFIX_MATCH, + PROP_DOMAIN_MATCH, PROP_CLIENT_CERT, PROP_CLIENT_CERT_PASSWORD, PROP_CLIENT_CERT_PASSWORD_FLAGS, @@ -108,6 +109,7 @@ NM_GOBJECT_PROPERTIES_DEFINE (NMSetting8021x, PROP_PHASE2_SUBJECT_MATCH, PROP_PHASE2_ALTSUBJECT_MATCHES, PROP_PHASE2_DOMAIN_SUFFIX_MATCH, + PROP_PHASE2_DOMAIN_MATCH, PROP_PHASE2_CLIENT_CERT, PROP_PHASE2_CLIENT_CERT_PASSWORD, PROP_PHASE2_CLIENT_CERT_PASSWORD_FLAGS, @@ -135,45 +137,47 @@ typedef struct { char *pac_file; GBytes *ca_cert; char *ca_cert_password; - NMSettingSecretFlags ca_cert_password_flags; char *ca_path; char *subject_match; GSList *altsubject_matches; char *domain_suffix_match; + char *domain_match; GBytes *client_cert; char *client_cert_password; - NMSettingSecretFlags client_cert_password_flags; char *phase1_peapver; char *phase1_peaplabel; char *phase1_fast_provisioning; - NMSetting8021xAuthFlags phase1_auth_flags; char *phase2_auth; char *phase2_autheap; GBytes *phase2_ca_cert; char *phase2_ca_cert_password; - NMSettingSecretFlags phase2_ca_cert_password_flags; char *phase2_ca_path; char *phase2_subject_match; GSList *phase2_altsubject_matches; char *phase2_domain_suffix_match; + char *phase2_domain_match; GBytes *phase2_client_cert; char *phase2_client_cert_password; - NMSettingSecretFlags phase2_client_cert_password_flags; char *password; - NMSettingSecretFlags password_flags; GBytes *password_raw; - NMSettingSecretFlags password_raw_flags; char *pin; - NMSettingSecretFlags pin_flags; GBytes *private_key; char *private_key_password; - NMSettingSecretFlags private_key_password_flags; GBytes *phase2_private_key; char *phase2_private_key_password; - NMSettingSecretFlags phase2_private_key_password_flags; - gboolean system_ca_certs; int auth_timeout; - gboolean optional; + NMSetting8021xAuthFlags phase1_auth_flags; + NMSettingSecretFlags ca_cert_password_flags; + NMSettingSecretFlags client_cert_password_flags; + NMSettingSecretFlags phase2_ca_cert_password_flags; + NMSettingSecretFlags phase2_client_cert_password_flags; + NMSettingSecretFlags password_flags; + NMSettingSecretFlags password_raw_flags; + NMSettingSecretFlags pin_flags; + NMSettingSecretFlags private_key_password_flags; + NMSettingSecretFlags phase2_private_key_password_flags; + bool optional:1; + bool system_ca_certs:1; } NMSetting8021xPrivate; G_DEFINE_TYPE (NMSetting8021x, nm_setting_802_1x, NM_TYPE_SETTING) @@ -1245,6 +1249,22 @@ nm_setting_802_1x_get_domain_suffix_match (NMSetting8021x *setting) } /** + * nm_setting_802_1x_get_domain_match: + * @setting: the #NMSetting8021x + * + * Returns: the #NMSetting8021x:domain-match property. + * + * Since: 1.24 + **/ +const char * +nm_setting_802_1x_get_domain_match (NMSetting8021x *setting) +{ + g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + + return NM_SETTING_802_1X_GET_PRIVATE (setting)->domain_match; +} + +/** * nm_setting_802_1x_get_client_cert_scheme: * @setting: the #NMSetting8021x * @@ -1692,6 +1712,22 @@ nm_setting_802_1x_get_phase2_domain_suffix_match (NMSetting8021x *setting) } /** + * nm_setting_802_1x_get_phase2_domain_match: + * @setting: the #NMSetting8021x + * + * Returns: the #NMSetting8021x:phase2-domain-match property. + * + * Since: 1.24 + **/ +const char * +nm_setting_802_1x_get_phase2_domain_match (NMSetting8021x *setting) +{ + g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL); + + return NM_SETTING_802_1X_GET_PRIVATE (setting)->phase2_domain_match; +} + +/** * nm_setting_802_1x_get_phase2_altsubject_match: * @setting: the #NMSettingConnection * @i: the zero-based index of the array of "phase 2" altSubjectName matches @@ -3074,6 +3110,9 @@ get_property (GObject *object, guint prop_id, case PROP_DOMAIN_SUFFIX_MATCH: g_value_set_string (value, priv->domain_suffix_match); break; + case PROP_DOMAIN_MATCH: + g_value_set_string (value, priv->domain_match); + break; case PROP_CLIENT_CERT: g_value_set_boxed (value, priv->client_cert); break; @@ -3122,6 +3161,9 @@ get_property (GObject *object, guint prop_id, case PROP_PHASE2_DOMAIN_SUFFIX_MATCH: g_value_set_string (value, priv->phase2_domain_suffix_match); break; + case PROP_PHASE2_DOMAIN_MATCH: + g_value_set_string (value, priv->phase2_domain_match); + break; case PROP_PHASE2_CLIENT_CERT: g_value_set_boxed (value, priv->phase2_client_cert); break; @@ -3233,6 +3275,10 @@ set_property (GObject *object, guint prop_id, g_free (priv->domain_suffix_match); priv->domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value)); break; + case PROP_DOMAIN_MATCH: + g_free (priv->domain_match); + priv->domain_match = nm_strdup_not_empty (g_value_get_string (value)); + break; case PROP_CLIENT_CERT: g_bytes_unref (priv->client_cert); priv->client_cert = g_value_dup_boxed (value); @@ -3294,6 +3340,10 @@ set_property (GObject *object, guint prop_id, g_free (priv->phase2_domain_suffix_match); priv->phase2_domain_suffix_match = nm_strdup_not_empty (g_value_get_string (value)); break; + case PROP_PHASE2_DOMAIN_MATCH: + g_free (priv->phase2_domain_match); + priv->phase2_domain_match = nm_strdup_not_empty (g_value_get_string (value)); + break; case PROP_PHASE2_CLIENT_CERT: g_bytes_unref (priv->phase2_client_cert); priv->phase2_client_cert = g_value_dup_boxed (value); @@ -3656,6 +3706,8 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) * the authentication server. If a matching dNSName is found, this * constraint is met. If no dNSName values are present, this constraint is * matched against SubjectName CN using same suffix match comparison. + * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited + * list. * * Since: 1.2 **/ @@ -3672,6 +3724,30 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) G_PARAM_STATIC_STRINGS); /** + * NMSetting8021x:domain-match: + * + * Constraint for server domain name. If set, this list of FQDNs is used as + * a match requirement for dNSName element(s) of the certificate presented + * by the authentication server. If a matching dNSName is found, this + * constraint is met. If no dNSName values are present, this constraint is + * matched against SubjectName CN using the same comparison. + * Multiple valid FQDNs can be passed as a ";" delimited list. + * + * Since: 1.24 + **/ + /* ---ifcfg-rh--- + * property: domain-match + * description: Value to match domain of server certificate against. + * variable: IEEE_8021X_DOMAIN_MATCH(+) + * ---end--- + */ + obj_properties[PROP_DOMAIN_MATCH] = + g_param_spec_string (NM_SETTING_802_1X_DOMAIN_MATCH, "", "", + NULL, + G_PARAM_READWRITE | + G_PARAM_STATIC_STRINGS); + + /** * NMSetting8021x:client-cert: * * Contains the client certificate if used by the EAP method specified in @@ -3828,7 +3904,6 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) obj_properties[PROP_PHASE1_AUTH_FLAGS] = g_param_spec_uint (NM_SETTING_802_1X_PHASE1_AUTH_FLAGS, "", "", 0, G_MAXUINT32, NM_SETTING_802_1X_AUTH_FLAGS_NONE, - G_PARAM_CONSTRUCT | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS); @@ -4007,6 +4082,8 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) * a matching dNSName is found, this constraint is met. If no dNSName * values are present, this constraint is matched against SubjectName CN * using same suffix match comparison. + * Since version 1.24, multiple valid FQDNs can be passed as a ";" delimited + * list. * * Since: 1.2 **/ @@ -4023,6 +4100,31 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) G_PARAM_STATIC_STRINGS); /** + * NMSetting8021x:phase2-domain-match: + * + * Constraint for server domain name. If set, this list of FQDNs is used as + * a match requirement for dNSName element(s) of the certificate presented + * by the authentication server during the inner "phase 2" authentication. + * If a matching dNSName is found, this constraint is met. If no dNSName + * values are present, this constraint is matched against SubjectName CN + * using the same comparison. + * Multiple valid FQDNs can be passed as a ";" delimited list. + * + * Since: 1.24 + **/ + /* ---ifcfg-rh--- + * property: phase2-domain-match + * description: Value to match domain of server certificate for phase 2 against. + * variable: IEEE_8021X_PHASE2_DOMAIN_MATCH(+) + * ---end--- + */ + obj_properties[PROP_PHASE2_DOMAIN_MATCH] = + g_param_spec_string (NM_SETTING_802_1X_PHASE2_DOMAIN_MATCH, "", "", + NULL, + G_PARAM_READWRITE | + G_PARAM_STATIC_STRINGS); + + /** * NMSetting8021x:phase2-client-cert: * * Contains the "phase 2" client certificate if used by the EAP method @@ -4401,7 +4503,6 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *klass) g_param_spec_boolean (NM_SETTING_802_1X_SYSTEM_CA_CERTS, "", "", FALSE, G_PARAM_READWRITE | - G_PARAM_CONSTRUCT | G_PARAM_STATIC_STRINGS); /** |