mirror of
https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git
synced 2026-02-09 21:20:38 +01:00
28e6523b8d
First, it was not easily possible to set a private key without also providing a password. This used to be OK, but now with secret flags it may be the case that when the connection is read, there's no private key password. So functions that set the private key must account for NULL passwords. Unfortunately, the crytpo code did not handle this case well. We need to be able to independently (a) verify that a file looks like a certificate or private key and (b) that a given password decrypts a private key. Previously the crypto code would fail to verify the file when the password was NULL. So this change fixes up the crytpo code for a more distinct split between these two operations, such that if no password is given, the file is still checked to ensure that it's a private key or a certificate. If a password is given, the password is checked against the private key file. This commit also changes how private keys and certificates were handled with the BLOB scheme. Previously only the first certificate or first private key was included in the property data, while now the entire file is encoded in the data. This is intended to fix cases where multiple private keys or certificates are present in a PEM file. It also allows clients to push certificate data to NetworkManager for storage in system settings locations, which was not as flexible before when only part of the certificate or key was sent as the data.
127 lines
3.1 KiB
Makefile
127 lines
3.1 KiB
Makefile
SUBDIRS=certs
|
|
|
|
INCLUDES = \
|
|
-I$(top_srcdir)/include \
|
|
-I$(top_srcdir)/libnm-util
|
|
|
|
noinst_PROGRAMS = \
|
|
test-settings-defaults \
|
|
test-crypto \
|
|
test-need-secrets \
|
|
test-general \
|
|
test-setting-8021x
|
|
|
|
test_settings_defaults_SOURCES = \
|
|
test-settings-defaults.c
|
|
|
|
test_settings_defaults_CPPFLAGS = \
|
|
$(GLIB_CFLAGS) \
|
|
$(DBUS_CFLAGS)
|
|
|
|
test_settings_defaults_LDADD = \
|
|
$(top_builddir)/libnm-util/libnm-util.la \
|
|
$(GLIB_LIBS) \
|
|
$(DBUS_LIBS)
|
|
|
|
test_crypto_SOURCES = \
|
|
test-crypto.c
|
|
|
|
test_crypto_CPPFLAGS = \
|
|
$(GLIB_CFLAGS)
|
|
|
|
test_crypto_LDADD = \
|
|
$(top_builddir)/libnm-util/libtest-crypto.la \
|
|
$(top_builddir)/libnm-util/libnm-util.la \
|
|
$(GLIB_LIBS)
|
|
|
|
test_need_secrets_SOURCES = \
|
|
test-need-secrets.c
|
|
|
|
test_need_secrets_CPPFLAGS = \
|
|
-DTEST_CERT_DIR=\"$(top_srcdir)/libnm-util/tests/certs/\" \
|
|
$(GLIB_CFLAGS) \
|
|
$(DBUS_CFLAGS)
|
|
|
|
test_need_secrets_LDADD = \
|
|
$(top_builddir)/libnm-util/libnm-util.la \
|
|
$(GLIB_LIBS) \
|
|
$(DBUS_LIBS)
|
|
|
|
test_general_SOURCES = \
|
|
test-general.c
|
|
|
|
test_general_CPPFLAGS = \
|
|
$(GLIB_CFLAGS) \
|
|
$(DBUS_CFLAGS)
|
|
|
|
test_general_LDADD = \
|
|
$(top_builddir)/libnm-util/libnm-util.la \
|
|
$(GLIB_LIBS) \
|
|
$(DBUS_LIBS)
|
|
|
|
test_setting_8021x_SOURCES = \
|
|
test-setting-8021x.c
|
|
|
|
test_setting_8021x_CPPFLAGS = \
|
|
$(GLIB_CFLAGS) \
|
|
$(DBUS_CFLAGS)
|
|
|
|
test_setting_8021x_LDADD = \
|
|
$(top_builddir)/libnm-util/libnm-util.la \
|
|
$(GLIB_LIBS) \
|
|
$(DBUS_LIBS)
|
|
|
|
if WITH_TESTS
|
|
|
|
check-local: test-settings-defaults test-crypto test-need-secrets
|
|
$(abs_builddir)/test-settings-defaults
|
|
$(abs_builddir)/test-need-secrets
|
|
$(abs_builddir)/test-general
|
|
|
|
# Private key and CA certificate in the same file (PEM)
|
|
$(abs_builddir)/test-setting-8021x $(srcdir)/certs/test_key_and_cert.pem "test"
|
|
|
|
# Private key by itself (PEM)
|
|
$(abs_builddir)/test-setting-8021x $(srcdir)/certs/test-key-only.pem "test"
|
|
|
|
# Private key and CA certificate in the same file (pkcs12)
|
|
$(abs_builddir)/test-setting-8021x $(srcdir)/certs/test-cert.p12 "test"
|
|
|
|
# Normal CA certificate
|
|
$(abs_builddir)/test-crypto --cert $(srcdir)/certs/test_ca_cert.pem
|
|
|
|
# Another CA certificate
|
|
$(abs_builddir)/test-crypto --cert $(srcdir)/certs/test2_ca_cert.pem
|
|
|
|
# CA certificate without an ending newline
|
|
$(abs_builddir)/test-crypto --cert $(srcdir)/certs/ca-no-ending-newline.pem
|
|
|
|
# Combined user cert and private key
|
|
$(abs_builddir)/test-crypto --cert $(srcdir)/certs/test_key_and_cert.pem
|
|
|
|
# Another combined user cert and private key
|
|
$(abs_builddir)/test-crypto --cert $(srcdir)/certs/test2_key_and_cert.pem
|
|
|
|
# Private key with 8 bytes of tail padding
|
|
$(abs_builddir)/test-crypto --key \
|
|
$(srcdir)/certs/test_key_and_cert.pem \
|
|
"test" \
|
|
$(srcdir)/certs/test-key-only-decrypted.der
|
|
|
|
# Private key only (not combined with a cert)
|
|
$(abs_builddir)/test-crypto --key \
|
|
$(srcdir)/certs/test-key-only.pem \
|
|
"test" \
|
|
$(srcdir)/certs/test-key-only-decrypted.der
|
|
|
|
# Private key with 6 bytes of tail padding
|
|
$(abs_builddir)/test-crypto --key $(srcdir)/certs/test2_key_and_cert.pem "12345testing"
|
|
|
|
# PKCS#12 file
|
|
$(abs_builddir)/test-crypto --p12 $(srcdir)/certs/test-cert.p12 "test"
|
|
|
|
# Another PKCS#12 file
|
|
$(abs_builddir)/test-crypto --p12 $(srcdir)/certs/test2-cert.p12 "12345testing"
|
|
|
|
endif
|
|
|