about summary refs log tree commit diff
path: root/libnm-core/nm-setting-8021x.c
diff options
context:
space:
mode:
Diffstat (limited to 'libnm-core/nm-setting-8021x.c')
-rw-r--r--libnm-core/nm-setting-8021x.c91
1 files changed, 37 insertions, 54 deletions
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index af195211..3b4240e6 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -1686,7 +1686,6 @@ nm_setting_802_1x_remove_phase2_altsubject_match (NMSetting8021x *setting, guint
 	g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PHASE2_ALTSUBJECT_MATCHES);
 }
 
-
 /**
  * nm_setting_802_1x_remove_phase2_altsubject_match_by_value:
  * @setting: the #NMSetting8021x
@@ -2247,7 +2246,7 @@ nm_setting_802_1x_set_private_key (NMSetting8021x *setting,
 {
 	NMSetting8021xPrivate *priv;
 	NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
-	gboolean key_cleared = FALSE, password_cleared = FALSE;
+	gboolean password_changed = FALSE;
 	GError *local_err = NULL;
 
 	g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE);
@@ -2281,39 +2280,35 @@ nm_setting_802_1x_set_private_key (NMSetting8021x *setting,
 
 	priv = NM_SETTING_802_1X_GET_PRIVATE (setting);
 
-	/* Clear out any previous private key data */
-	if (priv->private_key) {
-		g_bytes_unref (priv->private_key);
-		priv->private_key = NULL;
-		key_cleared = TRUE;
-	}
-
-	if (priv->private_key_password) {
-		g_free (priv->private_key_password);
-		priv->private_key_password = NULL;
-		password_cleared = TRUE;
-	}
-
 	if (value == NULL) {
-		if (key_cleared)
+		if (priv->private_key) {
+			g_clear_pointer (&priv->private_key, g_bytes_unref);
 			g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PRIVATE_KEY);
-		if (password_cleared)
+		}
+		if (nm_clear_g_free (&priv->private_key_password))
 			g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
 		return TRUE;
 	}
 
-	priv->private_key_password = g_strdup (password);
+	/* this makes password self-assignment safe. */
+	if (!nm_streq0 (priv->private_key_password, password)) {
+		g_free (priv->private_key_password);
+		priv->private_key_password = g_strdup (password);
+		password_changed = TRUE;
+	}
+
+	g_bytes_unref (priv->private_key);
 	if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
 		/* FIXME: potential race after verifying the private key above */
 		/* FIXME: ensure blob doesn't start with file:// */
 		priv->private_key = file_to_secure_bytes (value);
-		g_assert (priv->private_key);
+		nm_assert (priv->private_key);
 	} else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH)
 		priv->private_key = path_to_scheme_value (value);
-	else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11)
+	else {
+		nm_assert (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11);
 		priv->private_key = g_bytes_new (value, strlen (value) + 1);
-	else
-		g_assert_not_reached ();
+	}
 
 	/* As required by NM and wpa_supplicant, set the client-cert
 	 * property to the same PKCS#12 data.
@@ -2326,11 +2321,10 @@ nm_setting_802_1x_set_private_key (NMSetting8021x *setting,
 	}
 
 	g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PRIVATE_KEY);
-	if (password_cleared || password)
+	if (password_changed)
 		g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);
 
-	if (out_format)
-		*out_format = (NMSetting8021xCKFormat) format;
+	NM_SET_OUT (out_format, (NMSetting8021xCKFormat) format);
 	return priv->private_key != NULL;
 }
 
@@ -2594,7 +2588,7 @@ nm_setting_802_1x_set_phase2_private_key (NMSetting8021x *setting,
 {
 	NMSetting8021xPrivate *priv;
 	NMCryptoFileFormat format = NM_CRYPTO_FILE_FORMAT_UNKNOWN;
-	gboolean key_cleared = FALSE, password_cleared = FALSE;
+	gboolean password_changed = FALSE;
 	GError *local_err = NULL;
 
 	g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), FALSE);
@@ -2628,39 +2622,34 @@ nm_setting_802_1x_set_phase2_private_key (NMSetting8021x *setting,
 
 	priv = NM_SETTING_802_1X_GET_PRIVATE (setting);
 
-	/* Clear out any previous private key data */
-	if (priv->phase2_private_key) {
-		g_bytes_unref (priv->phase2_private_key);
-		priv->phase2_private_key = NULL;
-		key_cleared = TRUE;
-	}
-
-	if (priv->phase2_private_key_password) {
-		g_free (priv->phase2_private_key_password);
-		priv->phase2_private_key_password = NULL;
-		password_cleared = TRUE;
-	}
-
 	if (value == NULL) {
-		if (key_cleared)
+		if (priv->phase2_private_key) {
+			g_clear_pointer (&priv->phase2_private_key, g_bytes_unref);
 			g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PHASE2_PRIVATE_KEY);
-		if (password_cleared)
+		}
+		if (nm_clear_g_free (&priv->phase2_private_key_password))
 			g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
 		return TRUE;
 	}
 
-	priv->phase2_private_key_password = g_strdup (password);
+	/* this makes password self-assignment safe. */
+	if (!nm_streq0 (priv->phase2_private_key_password, password)) {
+		g_free (priv->phase2_private_key_password);
+		priv->phase2_private_key_password = g_strdup (password);
+		password_changed = TRUE;
+	}
+
 	if (scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB) {
 		/* FIXME: potential race after verifying the private key above */
 		/* FIXME: ensure blob doesn't start with file:// */
 		priv->phase2_private_key = file_to_secure_bytes (value);
-		g_assert (priv->phase2_private_key);
+		nm_assert (priv->phase2_private_key);
 	} else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PATH)
 		priv->phase2_private_key = path_to_scheme_value (value);
-	else if (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11)
+	else {
+		nm_assert (scheme == NM_SETTING_802_1X_CK_SCHEME_PKCS11);
 		priv->phase2_private_key = g_bytes_new (value, strlen (value) + 1);
-	else
-		g_assert_not_reached ();
+	}
 
 	/* As required by NM and wpa_supplicant, set the client-cert
 	 * property to the same PKCS#12 data.
@@ -2674,11 +2663,10 @@ nm_setting_802_1x_set_phase2_private_key (NMSetting8021x *setting,
 	}
 
 	g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PHASE2_PRIVATE_KEY);
-	if (password_cleared || password)
+	if (password_changed)
 		g_object_notify (G_OBJECT (setting), NM_SETTING_802_1X_PHASE2_PRIVATE_KEY_PASSWORD);
 
-	if (out_format)
-		*out_format = (NMSetting8021xCKFormat) format;
+	NM_SET_OUT (out_format, (NMSetting8021xCKFormat) format);
 	return priv->phase2_private_key != NULL;
 }
 
@@ -3071,7 +3059,6 @@ static void need_secrets_phase2 (NMSetting8021x *self,
                                  GPtrArray *secrets,
                                  gboolean phase2);
 
-
 typedef void (*EAPMethodNeedSecretsFunc) (NMSetting8021x *self,
                                           GPtrArray *secrets,
                                           gboolean phase2);
@@ -3137,7 +3124,6 @@ need_secrets_phase2 (NMSetting8021x *self,
 	}
 }
 
-
 static GPtrArray *
 need_secrets (NMSetting *setting)
 {
@@ -4434,9 +4420,6 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
 		                     G_PARAM_READWRITE |
 		                     G_PARAM_STATIC_STRINGS));
 
-
-
-
 	/**
 	 * NMSetting8021x:phase2-client-cert-password:
 	 *
generated by cgit-pink 1.3.0-6-gf8a5 (git 2.35.1) at 2026-09-08 06:37:44 +0000