diff options
Diffstat (limited to 'libnm-core/nm-setting-macsec.c')
| -rw-r--r-- | libnm-core/nm-setting-macsec.c | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/libnm-core/nm-setting-macsec.c b/libnm-core/nm-setting-macsec.c index 2c7cff23..5c468221 100644 --- a/libnm-core/nm-setting-macsec.c +++ b/libnm-core/nm-setting-macsec.c @@ -243,6 +243,12 @@ verify_macsec_key (const char *key, gboolean cak, GError **error) { int req_len; + /* CAK is a connection secret and can be NULL for various + * reasons (agent-owned, no permissions to get secrets, etc.) + */ + if (cak && !key) + return TRUE; + if (!key || !key[0]) { g_set_error_literal (error, NM_CONNECTION_ERROR, @@ -254,7 +260,7 @@ verify_macsec_key (const char *key, gboolean cak, GError **error) req_len = cak ? NM_SETTING_MACSEC_MKA_CAK_LENGTH : NM_SETTING_MACSEC_MKA_CKN_LENGTH; - if (strlen (key) != req_len) { + if (strlen (key) != (gsize) req_len) { g_set_error (error, NM_CONNECTION_ERROR, NM_CONNECTION_ERROR_INVALID_PROPERTY, @@ -340,6 +346,10 @@ verify (NMSetting *setting, NMConnection *connection, GError **error) g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_MKA_CKN); return FALSE; } + if (!verify_macsec_key (priv->mka_cak, TRUE, error)) { + g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_MKA_CAK); + return FALSE; + } } else if (priv->mode == NM_SETTING_MACSEC_MODE_EAP) { if (!s_8021x) { g_set_error (error, @@ -350,6 +360,13 @@ verify (NMSetting *setting, NMConnection *connection, GError **error) g_prefix_error (error, "%s: ", NM_SETTING_MACSEC_SETTING_NAME); return FALSE; } + } else { + g_set_error_literal (error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("must be either psk (0) or eap (1)")); + g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, NM_SETTING_MACSEC_MODE); + return FALSE; } if (priv->port <= 0 || priv->port > 65534) { @@ -362,6 +379,17 @@ verify (NMSetting *setting, NMConnection *connection, GError **error) return FALSE; } + if ( priv->mode != NM_SETTING_MACSEC_MODE_PSK + && (priv->mka_cak || priv->mka_ckn)) { + g_set_error_literal (error, + NM_CONNECTION_ERROR, + NM_CONNECTION_ERROR_INVALID_PROPERTY, + _("only valid for psk mode")); + g_prefix_error (error, "%s.%s: ", NM_SETTING_MACSEC_SETTING_NAME, + priv->mka_cak ? NM_SETTING_MACSEC_MKA_CAK : NM_SETTING_MACSEC_MKA_CKN); + return NM_SETTING_VERIFY_NORMALIZABLE; + } + return TRUE; } |