File nm-probe-radius-server-cert.patch of Package NetworkManager

Overview Repositories Revisions Requests Users Attributes Meta

File nm-probe-radius-server-cert.patch of Package NetworkManager (Revision d820ada6b633890dea8bf6ba80b7bb76)

Currently displaying revision d820ada6b633890dea8bf6ba80b7bb76 , Show latest

From b8577d72672d51ad9a164442ab208e9ca5063522 Mon Sep 17 00:00:00 2001
From: Gary Ching-Pang Lin <chingpang@gmail.com>
Date: Wed, 18 Jul 2012 12:14:56 +0800
Subject: [PATCH 1/4] libnm-util: allow the server hash to be the CA
 certificate

---
 libnm-util/libnm-util.ver                      |  1 +
 libnm-util/nm-setting-8021x.c                  | 54 +++++++++++++++++-
 libnm-util/nm-setting-8021x.h                  |  6 +-
 src/settings/plugins/ifnet/connection_parser.c | 76 +++++++++++++++++++++-----
 src/settings/plugins/keyfile/reader.c          |  7 +++
 src/settings/plugins/keyfile/writer.c          | 14 ++++-
 6 files changed, 139 insertions(+), 19 deletions(-)

diff --git a/libnm-util/libnm-util.ver b/libnm-util/libnm-util.ver
index e14f08d..7aab288 100644
--- a/libnm-util/libnm-util.ver
+++ b/libnm-util/libnm-util.ver
@@ -125,6 +125,7 @@ global:
 	nm_setting_802_1x_get_anonymous_identity;
 	nm_setting_802_1x_get_ca_cert_blob;
 	nm_setting_802_1x_get_ca_cert_path;
+	nm_setting_802_1x_get_ca_cert_hash;
 	nm_setting_802_1x_get_ca_cert_scheme;
 	nm_setting_802_1x_get_ca_path;
 	nm_setting_802_1x_get_client_cert_blob;
diff --git a/libnm-util/nm-setting-8021x.c b/libnm-util/nm-setting-8021x.c
index d85b87b..774ddb1 100644
--- a/libnm-util/nm-setting-8021x.c
+++ b/libnm-util/nm-setting-8021x.c
@@ -65,6 +65,7 @@
  **/
 
 #define SCHEME_PATH "file://"
+#define SCHEME_HASH "hash://server/sha256/"
 
 /**
  * nm_setting_802_1x_error_quark:
@@ -429,6 +430,9 @@ get_cert_scheme (GByteArray *array)
 	if (   (array->len > strlen (SCHEME_PATH))
 	    && !memcmp (array->data, SCHEME_PATH, strlen (SCHEME_PATH)))
 		return NM_SETTING_802_1X_CK_SCHEME_PATH;
+	else if (   (array->len > strlen (SCHEME_HASH))
+	         && !memcmp (array->data, SCHEME_HASH, strlen (SCHEME_HASH)))
+		return NM_SETTING_802_1X_CK_SCHEME_HASH;
 
 	return NM_SETTING_802_1X_CK_SCHEME_BLOB;
 }
@@ -439,7 +443,8 @@ get_cert_scheme (GByteArray *array)
  *
  * Returns the scheme used to store the CA certificate.  If the returned scheme
  * is %NM_SETTING_802_1X_CK_SCHEME_BLOB, use nm_setting_802_1x_get_ca_cert_blob();
- * if %NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_ca_cert_path().
+ * if %NM_SETTING_802_1X_CK_SCHEME_PATH, use nm_setting_802_1x_get_ca_cert_path();
+ * if %NM_SETTING_802_1X_CK_SCHEME_HASH, use nm_setting_802_1x_get_ca_cert_hash().
  *
  * Returns: scheme used to store the CA certificate (blob or path)
  **/
@@ -503,6 +508,32 @@ nm_setting_802_1x_get_ca_cert_path (NMSetting8021x *setting)
 	return (const char *) (NM_SETTING_802_1X_GET_PRIVATE (setting)->ca_cert->data + strlen (SCHEME_PATH));
 }
 
+/**
+ * nm_setting_802_1x_get_ca_cert_hash:
+ * @setting: the #NMSetting8021x
+ *
+ * Returns the CA certificate path if the CA certificate is stored using the
+ * %NM_SETTING_802_1X_CK_SCHEME_HASH scheme.  Not all EAP methods use a
+ * CA certificate (LEAP for example), and those that can take advantage of the
+ * CA certificate allow it to be unset.  Note that lack of a CA certificate
+ * reduces security by allowing man-in-the-middle attacks, because the identity
+ * of the network cannot be confirmed by the client.
+ *
+ * Returns: hash of the RADIUS server
+ **/
+const char *
+nm_setting_802_1x_get_ca_cert_hash (NMSetting8021x *setting)
+{
+	NMSetting8021xCKScheme scheme;
+
+	g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), NULL);
+
+	scheme = nm_setting_802_1x_get_ca_cert_scheme (setting);
+	g_return_val_if_fail (scheme == NM_SETTING_802_1X_CK_SCHEME_HASH, NULL);
+
+	return (const char *) (NM_SETTING_802_1X_GET_PRIVATE (setting)->ca_cert->data);
+}
+
 static GByteArray *
 path_to_scheme_value (const char *path)
 {
@@ -554,7 +585,8 @@ nm_setting_802_1x_set_ca_cert (NMSetting8021x *setting,
 	if (cert_path) {
 		g_return_val_if_fail (g_utf8_validate (cert_path, -1, NULL), FALSE);
 		g_return_val_if_fail (   scheme == NM_SETTING_802_1X_CK_SCHEME_BLOB
-		                      || scheme == NM_SETTING_802_1X_CK_SCHEME_PATH,
+		                      || scheme == NM_SETTING_802_1X_CK_SCHEME_PATH
+		                      || scheme == NM_SETTING_802_1X_CK_SCHEME_HASH,
 		                      FALSE);
 	}
 
@@ -574,6 +606,17 @@ nm_setting_802_1x_set_ca_cert (NMSetting8021x *setting,
 		return TRUE;
 	}
 
+	if (scheme == NM_SETTING_802_1X_CK_SCHEME_HASH) {
+		int length = strlen (cert_path);
+		if (   length == (strlen (SCHEME_HASH) + 64)
+		    && !g_str_has_prefix (cert_path, SCHEME_HASH))
+			return FALSE;
+		data = g_byte_array_sized_new (length + 1);
+		g_byte_array_append (data, (guint8 *) cert_path, length + 1);
+		priv->ca_cert = data;
+		return TRUE;
+	}
+
 	data = crypto_load_and_verify_certificate (cert_path, &format, error);
 	if (data) {
 		/* wpa_supplicant can only use raw x509 CA certs */
@@ -2616,6 +2659,13 @@ verify_cert (GByteArray *array, const char *prop_name, GError **error)
 				return TRUE;
 		}
 		break;
+	case NM_SETTING_802_1X_CK_SCHEME_HASH:
+		/* For hash-based schemes, verify that the has is zero-terminated */
+		if (array->data[array->len - 1] == '\0') {
+			if (g_str_has_prefix ((char *)array->data, SCHEME_HASH))
+				return TRUE;
+		}
+		break;
 	default:
 		break;
 	}
diff --git a/libnm-util/nm-setting-8021x.h b/libnm-util/nm-setting-8021x.h
index 263630e..6c9515e 100644
--- a/libnm-util/nm-setting-8021x.h
+++ b/libnm-util/nm-setting-8021x.h
@@ -57,6 +57,8 @@ typedef enum { /*< underscore_name=nm_setting_802_1x_ck_format >*/
  * item data
  * @NM_SETTING_802_1X_CK_SCHEME_PATH: certificate or key is stored as a path
  * to a file containing the certificate or key data
+ * @NM_SETTING_802_1X_CK_SCHEME_HASH: certificate or key is stored as a path
+ * of the CA server hash
  *
  * #NMSetting8021xCKScheme values indicate how a certificate or private key is
  * stored in the setting properties, either as a blob of the item's data, or as
@@ -65,7 +67,8 @@ typedef enum { /*< underscore_name=nm_setting_802_1x_ck_format >*/
 typedef enum { /*< underscore_name=nm_setting_802_1x_ck_scheme >*/
 	NM_SETTING_802_1X_CK_SCHEME_UNKNOWN = 0,
 	NM_SETTING_802_1X_CK_SCHEME_BLOB,
-	NM_SETTING_802_1X_CK_SCHEME_PATH
+	NM_SETTING_802_1X_CK_SCHEME_PATH,
+	NM_SETTING_802_1X_CK_SCHEME_HASH
 } NMSetting8021xCKScheme;
 
 
@@ -187,6 +190,7 @@ const char *      nm_setting_802_1x_get_phase2_ca_path               (NMSetting8
 NMSetting8021xCKScheme nm_setting_802_1x_get_ca_cert_scheme          (NMSetting8021x *setting);
 const GByteArray *     nm_setting_802_1x_get_ca_cert_blob            (NMSetting8021x *setting);
 const char *           nm_setting_802_1x_get_ca_cert_path            (NMSetting8021x *setting);
+const char *           nm_setting_802_1x_get_ca_cert_hash            (NMSetting8021x *setting);
 gboolean               nm_setting_802_1x_set_ca_cert                 (NMSetting8021x *setting,
                                                                       const char *cert_path,
                                                                       NMSetting8021xCKScheme scheme,
diff --git a/src/settings/plugins/ifnet/connection_parser.c b/src/settings/plugins/ifnet/connection_parser.c
index 85873d5..db2c2e9 100644
--- a/src/settings/plugins/ifnet/connection_parser.c
+++ b/src/settings/plugins/ifnet/connection_parser.c
@@ -46,6 +46,8 @@
 #include "nm-ifnet-connection.h"
 #include "errors.h"
 
+#define SCHEME_HASH "hash://server/sha256/"
+
 static char *
 connection_id_from_ifnet_name (const char *conn_name)
 {
@@ -194,11 +196,18 @@ eap_tls_reader (const char *eap_method,
 								   NULL, error))
 				goto done;
 		} else {
-			if (!nm_setting_802_1x_set_ca_cert (s_8021x,
-							    ca_cert,
-							    NM_SETTING_802_1X_CK_SCHEME_PATH,
-							    NULL, error))
-				goto done;
+			if (g_str_has_prefix (ca_cert, SCHEME_HASH))
+				if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+								    ca_cert,
+								    NM_SETTING_802_1X_CK_SCHEME_HASH,
+								    NULL, error))
+					goto done;
+			else
+				if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+								    ca_cert,
+								    NM_SETTING_802_1X_CK_SCHEME_PATH,
+								    NULL, error))
+					goto done;
 		}
 	} else {
 		nm_log_warn (LOGD_SETTINGS, "    missing %s for EAP method '%s'; this is insecure!",
@@ -303,11 +312,18 @@ eap_peap_reader (const char *eap_method,
 
 	ca_cert = get_cert (ssid, "ca_cert", basepath);
 	if (ca_cert) {
-		if (!nm_setting_802_1x_set_ca_cert (s_8021x,
-						    ca_cert,
-						    NM_SETTING_802_1X_CK_SCHEME_PATH,
-						    NULL, error))
-			goto done;
+		if (g_str_has_prefix (ca_cert, SCHEME_HASH))
+			if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+							    ca_cert,
+							    NM_SETTING_802_1X_CK_SCHEME_HASH,
+							    NULL, error))
+				goto done;
+		else
+			if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+							    ca_cert,
+							    NM_SETTING_802_1X_CK_SCHEME_PATH,
+							    NULL, error))
+				goto done;
 	} else {
 		nm_log_warn (LOGD_SETTINGS, "    missing IEEE_8021X_CA_CERT for EAP method '%s'; this is insecure!",
 		             eap_method);
@@ -405,11 +421,18 @@ eap_ttls_reader (const char *eap_method,
 	/* ca cert */
 	ca_cert = get_cert (ssid, "ca_cert", basepath);
 	if (ca_cert) {
-		if (!nm_setting_802_1x_set_ca_cert (s_8021x,
-						    ca_cert,
-						    NM_SETTING_802_1X_CK_SCHEME_PATH,
-						    NULL, error))
-			goto done;
+		if (g_str_has_prefix (ca_cert, SCHEME_HASH))
+			if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+							    ca_cert,
+							    NM_SETTING_802_1X_CK_SCHEME_HASH,
+							    NULL, error))
+				goto done;
+		else
+			if (!nm_setting_802_1x_set_ca_cert (s_8021x,
+							    ca_cert,
+							    NM_SETTING_802_1X_CK_SCHEME_PATH,
+							    NULL, error))
+				goto done;
 	} else {
 		nm_log_warn (LOGD_SETTINGS, "    missing IEEE_8021X_CA_CERT for EAP method '%s'; this is insecure!",
 		             eap_method);
@@ -1727,12 +1750,14 @@ error:
 
 typedef NMSetting8021xCKScheme (*SchemeFunc) (NMSetting8021x * setting);
 typedef const char *(*PathFunc) (NMSetting8021x * setting);
+typedef const char *(*HashFunc) (NMSetting8021x * setting);
 typedef const GByteArray *(*BlobFunc) (NMSetting8021x * setting);
 
 typedef struct ObjectType {
 	const char *setting_key;
 	SchemeFunc scheme_func;
 	PathFunc path_func;
+	HashFunc hash_func;
 	BlobFunc blob_func;
 	const char *conn_name_key;
 	const char *suffix;
@@ -1742,6 +1767,7 @@ static const ObjectType ca_type = {
 	NM_SETTING_802_1X_CA_CERT,
 	nm_setting_802_1x_get_ca_cert_scheme,
 	nm_setting_802_1x_get_ca_cert_path,
+	nm_setting_802_1x_get_ca_cert_hash,
 	nm_setting_802_1x_get_ca_cert_blob,
 	"ca_cert",
 	"ca-cert.der"
@@ -1751,6 +1777,7 @@ static const ObjectType phase2_ca_type = {
 	NM_SETTING_802_1X_PHASE2_CA_CERT,
 	nm_setting_802_1x_get_phase2_ca_cert_scheme,
 	nm_setting_802_1x_get_phase2_ca_cert_path,
+	NULL,
 	nm_setting_802_1x_get_phase2_ca_cert_blob,
 	"ca_cert2",
 	"inner-ca-cert.der"
@@ -1760,6 +1787,7 @@ static const ObjectType client_type = {
 	NM_SETTING_802_1X_CLIENT_CERT,
 	nm_setting_802_1x_get_client_cert_scheme,
 	nm_setting_802_1x_get_client_cert_path,
+	NULL,
 	nm_setting_802_1x_get_client_cert_blob,
 	"client_cert",
 	"client-cert.der"
@@ -1769,6 +1797,7 @@ static const ObjectType phase2_client_type = {
 	NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
 	nm_setting_802_1x_get_phase2_client_cert_scheme,
 	nm_setting_802_1x_get_phase2_client_cert_path,
+	NULL,
 	nm_setting_802_1x_get_phase2_client_cert_blob,
 	"client_cert2",
 	"inner-client-cert.der"
@@ -1778,6 +1807,7 @@ static const ObjectType pk_type = {
 	NM_SETTING_802_1X_PRIVATE_KEY,
 	nm_setting_802_1x_get_private_key_scheme,
 	nm_setting_802_1x_get_private_key_path,
+	NULL,
 	nm_setting_802_1x_get_private_key_blob,
 	"private_key",
 	"private-key.pem"
@@ -1787,6 +1817,7 @@ static const ObjectType phase2_pk_type = {
 	NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
 	nm_setting_802_1x_get_phase2_private_key_scheme,
 	nm_setting_802_1x_get_phase2_private_key_path,
+	NULL,
 	nm_setting_802_1x_get_phase2_private_key_blob,
 	"private_key2",
 	"inner-private-key.pem"
@@ -1796,6 +1827,7 @@ static const ObjectType p12_type = {
 	NM_SETTING_802_1X_PRIVATE_KEY,
 	nm_setting_802_1x_get_private_key_scheme,
 	nm_setting_802_1x_get_private_key_path,
+	NULL,
 	nm_setting_802_1x_get_private_key_blob,
 	"private_key",
 	"private-key.p12"
@@ -1805,6 +1837,7 @@ static const ObjectType phase2_p12_type = {
 	NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
 	nm_setting_802_1x_get_phase2_private_key_scheme,
 	nm_setting_802_1x_get_phase2_private_key_path,
+	NULL,
 	nm_setting_802_1x_get_phase2_private_key_blob,
 	"private_key2",
 	"inner-private-key.p12"
@@ -1819,6 +1852,7 @@ write_object (NMSetting8021x *s_8021x,
 {
 	NMSetting8021xCKScheme scheme;
 	const char *path = NULL;
+	const char *hash = NULL;
 	const GByteArray *blob = NULL;
 
 	g_return_val_if_fail (conn_name != NULL, FALSE);
@@ -1837,6 +1871,9 @@ write_object (NMSetting8021x *s_8021x,
 		case NM_SETTING_802_1X_CK_SCHEME_PATH:
 			path = (*(objtype->path_func)) (s_8021x);
 			break;
+		case NM_SETTING_802_1X_CK_SCHEME_HASH:
+			hash = (*(objtype->hash_func)) (s_8021x);
+			break;
 		default:
 			break;
 		}
@@ -1851,6 +1888,15 @@ write_object (NMSetting8021x *s_8021x,
 		return TRUE;
 	}
 
+	/* If the object hash was specified, prefer that over any raw cert data that
+	 * may have been sent.
+	 */
+	if (hash) {
+		wpa_set_data (conn_name, (gchar *) objtype->conn_name_key,
+			      (gchar *) hash);
+		return TRUE;
+	}
+
 	/* does not support writing encryption data now */
 	if (blob)
 		nm_log_warn (LOGD_SETTINGS, "    Currently we do not support cert writing.");
diff --git a/src/settings/plugins/keyfile/reader.c b/src/settings/plugins/keyfile/reader.c
index 735f8c2..c2a6d11 100644
--- a/src/settings/plugins/keyfile/reader.c
+++ b/src/settings/plugins/keyfile/reader.c
@@ -778,6 +778,7 @@ get_cert_path (const char *keyfile_path, GByteArray *cert_path)
 }
 
 #define SCHEME_PATH "file://"
+#define SCHEME_HASH "hash://server/sha256/"
 
 static const char *certext[] = { ".pem", ".cert", ".crt", ".cer", ".p12", ".der", ".key" };
 
@@ -802,6 +803,12 @@ handle_as_scheme (GByteArray *array, NMSetting *setting, const char *key)
 	    && (array->data[array->len - 1] == '\0')) {
 		g_object_set (setting, key, array, NULL);
 		return TRUE;
+	} else if (   (array->len > strlen (SCHEME_HASH))
+	           && g_str_has_prefix ((const char *) array->data, SCHEME_HASH)
+	           && (array->data[array->len - 1] == '\0')) {
+		/* It's the HASH scheme, can just set plain data */
+		g_object_set (setting, key, array, NULL);
+		return TRUE;
 	}
 	return FALSE;
 }
diff --git a/src/settings/plugins/keyfile/writer.c b/src/settings/plugins/keyfile/writer.c
index 5f3ebe2..41409a7 100644
--- a/src/settings/plugins/keyfile/writer.c
+++ b/src/settings/plugins/keyfile/writer.c
@@ -555,6 +555,7 @@ typedef struct ObjectType {
 	NMSetting8021xCKScheme (*scheme_func) (NMSetting8021x *setting);
 	NMSetting8021xCKFormat (*format_func) (NMSetting8021x *setting);
 	const char *           (*path_func)   (NMSetting8021x *setting);
+	const char *           (*hash_func)   (NMSetting8021x *setting);
 	const GByteArray *     (*blob_func)   (NMSetting8021x *setting);
 } ObjectType;
 
@@ -565,6 +566,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_ca_cert_scheme,
 	  NULL,
 	  nm_setting_802_1x_get_ca_cert_path,
+	  nm_setting_802_1x_get_ca_cert_hash,
 	  nm_setting_802_1x_get_ca_cert_blob },
 
 	{ NM_SETTING_802_1X_PHASE2_CA_CERT,
@@ -573,6 +575,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_phase2_ca_cert_scheme,
 	  NULL,
 	  nm_setting_802_1x_get_phase2_ca_cert_path,
+	  NULL,
 	  nm_setting_802_1x_get_phase2_ca_cert_blob },
 
 	{ NM_SETTING_802_1X_CLIENT_CERT,
@@ -581,6 +584,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_client_cert_scheme,
 	  NULL,
 	  nm_setting_802_1x_get_client_cert_path,
+	  NULL,
 	  nm_setting_802_1x_get_client_cert_blob },
 
 	{ NM_SETTING_802_1X_PHASE2_CLIENT_CERT,
@@ -589,6 +593,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_phase2_client_cert_scheme,
 	  NULL,
 	  nm_setting_802_1x_get_phase2_client_cert_path,
+	  NULL,
 	  nm_setting_802_1x_get_phase2_client_cert_blob },
 
 	{ NM_SETTING_802_1X_PRIVATE_KEY,
@@ -597,6 +602,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_private_key_scheme,
 	  nm_setting_802_1x_get_private_key_format,
 	  nm_setting_802_1x_get_private_key_path,
+	  NULL,
 	  nm_setting_802_1x_get_private_key_blob },
 
 	{ NM_SETTING_802_1X_PHASE2_PRIVATE_KEY,
@@ -605,6 +611,7 @@ static const ObjectType objtypes[10] = {
 	  nm_setting_802_1x_get_phase2_private_key_scheme,
 	  nm_setting_802_1x_get_phase2_private_key_format,
 	  nm_setting_802_1x_get_phase2_private_key_path,
+	  NULL,
 	  nm_setting_802_1x_get_phase2_private_key_blob },
 
 	{ NULL },
@@ -683,7 +690,7 @@ cert_writer (GKeyFile *file,
 	const char *setting_name = nm_setting_get_name (setting);
 	NMSetting8021xCKScheme scheme;
 	NMSetting8021xCKFormat format;
-	const char *path = NULL, *ext = "pem";
+	const char *path = NULL, *hash = NULL, *ext = "pem";
 	const ObjectType *objtype = NULL;
 	int i;
 
@@ -749,6 +756,11 @@ cert_writer (GKeyFile *file,
 			g_error_free (error);
 		}
 		g_free (new_path);
+	} else if (scheme == NM_SETTING_802_1X_CK_SCHEME_HASH) {
+		hash = objtype->hash_func (NM_SETTING_802_1X (setting));
+		g_assert (hash);
+
+		g_key_file_set_string (file, setting_name, key, hash);
 	} else
 		g_assert_not_reached ();
 }
-- 
1.8.4.5

From e7f85dd3aecacac04abe921121a6e98d21c2891a Mon Sep 17 00:00:00 2001
From: Gary Ching-Pang Lin <chingpang@gmail.com>
Date: Fri, 8 Feb 2013 11:23:15 +0800
Subject: [PATCH 2/4] wifi: add the dbus method to probe the certificate

---
 introspection/nm-device-wifi.xml                 | 23 ++++++
 src/devices/wifi/nm-device-wifi.c                | 97 ++++++++++++++++++++++++
 src/devices/wifi/nm-device-wifi.h                |  2 +
 src/supplicant-manager/nm-supplicant-config.c    | 24 ++++++
 src/supplicant-manager/nm-supplicant-config.h    |  2 +
 src/supplicant-manager/nm-supplicant-interface.c | 32 ++++++++
 src/supplicant-manager/nm-supplicant-interface.h |  4 +
 7 files changed, 184 insertions(+)

diff --git a/introspection/nm-device-wifi.xml b/introspection/nm-device-wifi.xml
index 65c7b71..a3f78ca 100644
--- a/introspection/nm-device-wifi.xml
+++ b/introspection/nm-device-wifi.xml
@@ -43,6 +43,18 @@
       </tp:docstring>
     </method>
 
+    <method name="ProbeCert">
+      <annotation name="org.freedesktop.DBus.GLib.CSymbol" value="impl_device_probe_cert"/>
+      <arg name="ssid" type="ay" direction="in">
+        <tp:docstring>
+          The SSID of the AP to be probed
+        </tp:docstring>
+      </arg>
+      <tp:docstring>
+        Probe the certificate of the RADIUS server.
+      </tp:docstring>
+    </method>
+
     <property name="HwAddress" type="s" access="read">
       <tp:docstring>
         The active hardware address of the device.
@@ -118,6 +130,17 @@
         </tp:docstring>
     </signal>
 
+    <signal name="CertReceived">
+      <arg name="cert" type="a{sv}" tp:type="String_Variant_Map">
+        <tp:docstring>
+          The certificate of the RADIUS server
+        </tp:docstring>
+      </arg>
+        <tp:docstring>
+            Emitted when wpa_supplicant replies the certificate of the RADIUS server.
+        </tp:docstring>
+    </signal>
+
     <tp:flags name="NM_802_11_DEVICE_CAP" type="u">
       <tp:docstring>
         Flags describing the capabilities of a wireless device.
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index 95173cf..c25f285 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -65,6 +65,9 @@
 static gboolean impl_device_get_access_points (NMDeviceWifi *device,
                                                GPtrArray **aps,
                                                GError **err);
+static gboolean impl_device_probe_cert (NMDeviceWifi *device,
+                                        GByteArray *ssid,
+                                        GError **err);
 
 static gboolean impl_device_get_all_access_points (NMDeviceWifi *device,
                                                    GPtrArray **aps,
@@ -106,6 +109,7 @@ enum {
 	ACCESS_POINT_ADDED,
 	ACCESS_POINT_REMOVED,
 	SCANNING_ALLOWED,
+	CERT_RECEIVED,
 
 	LAST_SIGNAL
 };
@@ -134,6 +138,7 @@ struct _NMDeviceWifiPrivate {
 	NMSupplicantManager   *sup_mgr;
 	NMSupplicantInterface *sup_iface;
 	guint                  sup_timeout_id; /* supplicant association timeout */
+	guint                  sup_cert_id;
 
 	gboolean          ssid_found;
 	NM80211Mode       mode;
@@ -1701,6 +1706,88 @@ try_fill_ssid_for_hidden_ap (NMAccessPoint *ap)
 
 #define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
 #define MAC_ARG(x) ((guint8*)(x))[0],((guint8*)(x))[1],((guint8*)(x))[2],((guint8*)(x))[3],((guint8*)(x))[4],((guint8*)(x))[5]
+static void
+supplicant_iface_certification_cb (NMSupplicantInterface * iface,
+                                   GHashTable *cert,
+                                   NMDeviceWifi * self)
+{
+	NMDeviceWifiPrivate *priv = NM_DEVICE_WIFI_GET_PRIVATE (self);
+	GValue *value;
+	const char *subject, *hash;
+	guint depth;
+
+	value = g_hash_table_lookup (cert, "depth");
+	if (!value || !G_VALUE_HOLDS_UINT(value)) {
+		nm_log_dbg (LOGD_WIFI_SCAN, "Depth was not set");
+		return;
+	}
+	depth = g_value_get_uint (value);
+
+	value = g_hash_table_lookup (cert, "subject");
+	if (!value || !G_VALUE_HOLDS_STRING(value))
+		return;
+	subject = g_value_get_string (value);
+
+	value = g_hash_table_lookup (cert, "cert_hash");
+	if (!value || !G_VALUE_HOLDS_STRING(value))
+		return;
+	hash = g_value_get_string (value);
+
+	nm_log_info (LOGD_WIFI_SCAN, "Got Server Certificate %u, subject %s, hash %s", depth, subject, hash);
+
+	if (depth != 0)
+		return;
+
+	g_signal_emit (self, signals[CERT_RECEIVED], 0, cert);
+
+	if (priv->sup_cert_id > 0) {
+		g_signal_handler_disconnect (priv->sup_iface, priv->sup_cert_id);
+		priv->sup_cert_id = 0;
+	}
+
+	nm_supplicant_interface_disconnect (iface);
+}
+
+static gboolean
+impl_device_probe_cert (NMDeviceWifi *self,
+                        GByteArray *ssid,
+                        GError **err)
+{
+	NMDeviceWifiPrivate *priv = NM_DEVICE_WIFI_GET_PRIVATE (self);
+	NMSupplicantConfig *config = NULL;
+	guint id;
+	gboolean ret = FALSE;
+
+	config = nm_supplicant_config_new_probe (ssid);
+	if (!config)
+		goto error;
+
+	/* Hook up signal handler to capture certification signal */
+	id = g_signal_connect (priv->sup_iface,
+	                       "certification",
+	                       G_CALLBACK (supplicant_iface_certification_cb),
+	                       self);
+	priv->sup_cert_id = id;
+
+	if (!nm_supplicant_interface_set_config (priv->sup_iface, config))
+		goto error;
+
+	ret = TRUE;
+
+error:
+	if (!ret) {
+		g_set_error_literal (err,
+		                     NM_WIFI_ERROR,
+		                     NM_WIFI_ERROR_INVALID_CERT_PROBE,
+		                     "Couldn't probe RADIUS server certificate");
+		if (priv->sup_cert_id) {
+			g_signal_handler_disconnect (priv->sup_iface, priv->sup_cert_id);
+			priv->sup_cert_id = 0;
+		}
+	}
+
+	return ret;
+}
 
 /*
  * merge_scanned_ap
@@ -3492,6 +3579,16 @@ nm_device_wifi_class_init (NMDeviceWifiClass *klass)
 		              scanning_allowed_accumulator, NULL, NULL,
 		              G_TYPE_BOOLEAN, 0);
 
+	signals[CERT_RECEIVED] =
+		g_signal_new ("cert-received",
+		              G_OBJECT_CLASS_TYPE (object_class),
+		              G_SIGNAL_RUN_FIRST,
+		              G_STRUCT_OFFSET (NMDeviceWifiClass, cert_received),
+		              NULL, NULL,
+		              g_cclosure_marshal_VOID__BOXED,
+		              G_TYPE_NONE, 1,
+		              DBUS_TYPE_G_MAP_OF_VARIANT);
+
 	nm_dbus_manager_register_exported_type (nm_dbus_manager_get (),
 	                                        G_TYPE_FROM_CLASS (klass),
 	                                        &dbus_glib_nm_device_wifi_object_info);
diff --git a/src/devices/wifi/nm-device-wifi.h b/src/devices/wifi/nm-device-wifi.h
index f0a1bea..5f6439e 100644
--- a/src/devices/wifi/nm-device-wifi.h
+++ b/src/devices/wifi/nm-device-wifi.h
@@ -48,6 +48,7 @@ typedef enum {
 	NM_WIFI_ERROR_SCAN_NOT_ALLOWED,            /*< nick=ScanNotAllowed >*/
 	NM_WIFI_ERROR_AP_MODE_UNSUPPORTED,         /*< nick=ApModeUnsupported >*/
 	NM_WIFI_ERROR_ADHOC_MODE_UNSUPPORTED,      /*< nick=AdhocModeUnsupported >*/
+	NM_WIFI_ERROR_INVALID_CERT_PROBE,          /*< nick=InvalidCertProbe >*/
 } NMWifiError;
 
 #define NM_DEVICE_WIFI_PERMANENT_HW_ADDRESS "perm-hw-address"
@@ -82,6 +83,7 @@ struct _NMDeviceWifiClass
 	void (*access_point_added)   (NMDeviceWifi *device, NMAccessPoint *ap);
 	void (*access_point_removed) (NMDeviceWifi *device, NMAccessPoint *ap);
 	gboolean (*scanning_allowed) (NMDeviceWifi *device);
+	void (*cert_received)        (NMDeviceWifi *device, GHashTable *cert);
 };
 
 
diff --git a/src/supplicant-manager/nm-supplicant-config.c b/src/supplicant-manager/nm-supplicant-config.c
index 438b436..cbc55aa 100644
--- a/src/supplicant-manager/nm-supplicant-config.c
+++ b/src/supplicant-manager/nm-supplicant-config.c
@@ -163,6 +163,25 @@ nm_supplicant_config_add_option (NMSupplicantConfig *self,
 	return nm_supplicant_config_add_option_with_type (self, key, value, len, TYPE_INVALID, secret);
 }
 
+NMSupplicantConfig *
+nm_supplicant_config_new_probe (const GByteArray *ssid)
+{
+	NMSupplicantConfig *probe_config;
+
+	if (!ssid)
+		return NULL;
+
+	probe_config = (NMSupplicantConfig *)g_object_new (NM_TYPE_SUPPLICANT_CONFIG, NULL);
+
+	nm_supplicant_config_add_option (probe_config, "ssid", (char *)ssid->data, ssid->len, FALSE);
+	nm_supplicant_config_add_option (probe_config, "key_mgmt", "WPA-EAP", -1, FALSE);
+	nm_supplicant_config_add_option (probe_config, "eap", "TTLS PEAP TLS", -1, FALSE);
+	nm_supplicant_config_add_option (probe_config, "identity", " ", -1, FALSE);
+	nm_supplicant_config_add_option (probe_config, "ca_cert", "probe://", -1, FALSE);
+
+	return probe_config;
+}
+
 static gboolean
 nm_supplicant_config_add_blob (NMSupplicantConfig *self,
                                const char *key,
@@ -902,6 +921,11 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self,
 		if (!add_string_val (self, path, "ca_cert", FALSE, FALSE))
 			return FALSE;
 		break;
+	case NM_SETTING_802_1X_CK_SCHEME_HASH:
+		path = nm_setting_802_1x_get_ca_cert_hash (setting);
+		if (!add_string_val (self, path, "ca_cert", FALSE, FALSE))
+			return FALSE;
+		break;
 	default:
 		break;
 	}
diff --git a/src/supplicant-manager/nm-supplicant-config.h b/src/supplicant-manager/nm-supplicant-config.h
index 75d6b77..9e71ea6 100644
--- a/src/supplicant-manager/nm-supplicant-config.h
+++ b/src/supplicant-manager/nm-supplicant-config.h
@@ -52,6 +52,8 @@ GType nm_supplicant_config_get_type (void);
 
 NMSupplicantConfig *nm_supplicant_config_new (void);
 
+NMSupplicantConfig *nm_supplicant_config_new_probe (const GByteArray *ssid);
+
 guint32 nm_supplicant_config_get_ap_scan (NMSupplicantConfig *self);
 
 void nm_supplicant_config_set_ap_scan (NMSupplicantConfig *self,
diff --git a/src/supplicant-manager/nm-supplicant-interface.c b/src/supplicant-manager/nm-supplicant-interface.c
index 15138dc..3f4b5f9 100644
--- a/src/supplicant-manager/nm-supplicant-interface.c
+++ b/src/supplicant-manager/nm-supplicant-interface.c
@@ -66,6 +66,7 @@ enum {
 	SCAN_DONE,           /* wifi scan is complete */
 	CONNECTION_ERROR,    /* an error occurred during a connection request */
 	CREDENTIALS_REQUEST, /* 802.1x identity or password requested */
+	CERTIFICATION,       /* a RADIUS server certificate was received */
 	LAST_SIGNAL
 };
 static guint signals[LAST_SIGNAL] = { 0 };
@@ -447,6 +448,17 @@ parse_capabilities (NMSupplicantInterface *self, GHashTable *props)
 }
 
 static void
+wpas_iface_got_certification (DBusGProxy *proxy,
+                              const GHashTable *cert_table,
+                              gpointer user_data)
+{
+	g_signal_emit (user_data,
+	               signals[CERTIFICATION],
+	               0,
+	               cert_table);
+}
+
+static void
 wpas_iface_properties_changed (DBusGProxy *proxy,
                                GHashTable *props,
                                gpointer user_data)
@@ -764,6 +776,18 @@ interface_add_done (NMSupplicantInterface *self, char *path)
 	                             self,
 	                             NULL);
 
+	dbus_g_object_register_marshaller (g_cclosure_marshal_VOID__BOXED,
+                                           G_TYPE_NONE,
+	                                   DBUS_TYPE_G_MAP_OF_VARIANT,
+	                                   G_TYPE_INVALID);
+	dbus_g_proxy_add_signal (priv->iface_proxy, "Certification",
+	                         DBUS_TYPE_G_MAP_OF_VARIANT,
+                                 G_TYPE_INVALID);
+	dbus_g_proxy_connect_signal (priv->iface_proxy, "Certification",
+	                             G_CALLBACK (wpas_iface_got_certification),
+	                             self,
+	                             NULL);
+
 	priv->introspect_proxy = dbus_g_proxy_new_for_name (nm_dbus_manager_get_connection (priv->dbus_mgr),
 	                                                    WPAS_DBUS_SERVICE,
 	                                                    priv->object_path,
@@ -1543,5 +1567,13 @@ nm_supplicant_interface_class_init (NMSupplicantInterfaceClass *klass)
 		              G_STRUCT_OFFSET (NMSupplicantInterfaceClass, credentials_request),
 		              NULL, NULL, NULL,
 		              G_TYPE_NONE, 2, G_TYPE_STRING, G_TYPE_STRING);
+	signals[CERTIFICATION] =
+		g_signal_new ("certification",
+		              G_OBJECT_CLASS_TYPE (object_class),
+		              G_SIGNAL_RUN_LAST,
+		              G_STRUCT_OFFSET (NMSupplicantInterfaceClass, certification),
+		              NULL, NULL,
+		              g_cclosure_marshal_VOID__BOXED,
+		              G_TYPE_NONE, 1, DBUS_TYPE_G_MAP_OF_VARIANT);
 }
 
diff --git a/src/supplicant-manager/nm-supplicant-interface.h b/src/supplicant-manager/nm-supplicant-interface.h
index 633c16c..18ad2f2 100644
--- a/src/supplicant-manager/nm-supplicant-interface.h
+++ b/src/supplicant-manager/nm-supplicant-interface.h
@@ -115,6 +115,10 @@ typedef struct {
 	void (*credentials_request) (NMSupplicantInterface *iface,
 	                             const char *field,
 	                             const char *message);
+
+	/* a RADIUS server certificate was received */
+	void (*certification) (NMSupplicantInterface * iface,
+	                       const GHashTable * ca_cert);
 } NMSupplicantInterfaceClass;
 
 
-- 
1.8.4.5

From be0d0f92d916787bb197d88fe66c0ef9234f5ca2 Mon Sep 17 00:00:00 2001
From: Gary Ching-Pang Lin <chingpang@gmail.com>
Date: Fri, 8 Feb 2013 11:24:10 +0800
Subject: [PATCH 3/4] libnm-glib: add the function to probe the certificate

---
 libnm-glib/libnm-glib.ver   |  1 +
 libnm-glib/nm-device-wifi.c | 70 +++++++++++++++++++++++++++++++++++++++++++++
 libnm-glib/nm-device-wifi.h |  5 +++-
 3 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/libnm-glib/libnm-glib.ver b/libnm-glib/libnm-glib.ver
index 982288e..6ea9500 100644
--- a/libnm-glib/libnm-glib.ver
+++ b/libnm-glib/libnm-glib.ver
@@ -197,6 +197,7 @@ global:
 	nm_device_wifi_get_type;
 	nm_device_wifi_new;
 	nm_device_wifi_request_scan_simple;
+	nm_device_wifi_probe_cert;
 	nm_device_wimax_error_get_type;
 	nm_device_wimax_error_quark;
 	nm_device_wimax_get_active_nsp;
diff --git a/libnm-glib/nm-device-wifi.c b/libnm-glib/nm-device-wifi.c
index b9cc31d..60ca89e 100644
--- a/libnm-glib/nm-device-wifi.c
+++ b/libnm-glib/nm-device-wifi.c
@@ -81,6 +81,7 @@ enum {
 enum {
 	ACCESS_POINT_ADDED,
 	ACCESS_POINT_REMOVED,
+	CERT_RECEIVED,
 
 	LAST_SIGNAL
 };
@@ -382,6 +383,49 @@ nm_device_wifi_request_scan_simple (NMDeviceWifi *device,
 	g_hash_table_unref (options);
 }
 
+/**
+ * nm_device_wifi_probe_cert:
+ * @device: a #NMDeviceWifi
+ * @ssid: the ssid of the AP to probe
+ *
+ * Probe the certificate of the RADIUS server
+ *
+ * Returns: if the probe is sent or not
+ **/
+gboolean
+nm_device_wifi_probe_cert (NMDeviceWifi *device,
+                           const GByteArray *ssid)
+{
+	NMDeviceWifiPrivate *priv;
+	GError *error = NULL;
+	gboolean ret;
+
+	g_return_val_if_fail (NM_IS_DEVICE_WIFI (device), FALSE);
+
+	priv = NM_DEVICE_WIFI_GET_PRIVATE (device);
+
+	ret = dbus_g_proxy_call (priv->proxy, "ProbeCert", &error,
+				 DBUS_TYPE_G_UCHAR_ARRAY, ssid,
+				 G_TYPE_INVALID,
+				 G_TYPE_INVALID);
+
+	if (!ret) {
+		g_warning ("%s: error probe certificate: %s", __func__, error->message);
+		g_error_free (error);
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+static void
+cert_received_proxy (DBusGProxy *proxy, GHashTable *cert, gpointer user_data)
+{
+	NMDeviceWifi *self = NM_DEVICE_WIFI (user_data);
+
+	g_signal_emit (self, signals[CERT_RECEIVED], 0, cert);
+}
+
 static void
 clean_up_aps (NMDeviceWifi *self, gboolean notify)
 {
@@ -650,6 +694,14 @@ constructed (GObject *object)
 	G_OBJECT_CLASS (nm_device_wifi_parent_class)->constructed (object);
 
 	priv->proxy = _nm_object_new_proxy (NM_OBJECT (object), NULL, NM_DBUS_INTERFACE_DEVICE_WIRELESS);
+
+	dbus_g_proxy_add_signal (priv->proxy, "CertReceived",
+	                         DBUS_TYPE_G_MAP_OF_VARIANT,
+	                         G_TYPE_INVALID);
+	dbus_g_proxy_connect_signal (priv->proxy, "CertReceived",
+						    G_CALLBACK (cert_received_proxy),
+						    object, NULL);
+
 	register_properties (NM_DEVICE_WIFI (object));
 
 	g_signal_connect (NM_DEVICE (object),
@@ -844,4 +896,22 @@ nm_device_wifi_class_init (NMDeviceWifiClass *wifi_class)
 				    g_cclosure_marshal_VOID__OBJECT,
 				    G_TYPE_NONE, 1,
 				    G_TYPE_OBJECT);
+
+	/**
+	 * NMDeviceWifi::cert-received:
+	 * @device: the wifi device that received the signal
+	 * @subject: the subject of the RADIUS server
+	 * @hash: the hash of the RADIUS server
+	 *
+	 * Notifies that a certificate of a RADIUS server is received.
+	 **/
+	signals[CERT_RECEIVED] =
+		g_signal_new ("cert-received",
+				    G_OBJECT_CLASS_TYPE (object_class),
+				    G_SIGNAL_RUN_FIRST,
+				    G_STRUCT_OFFSET (NMDeviceWifiClass, cert_received),
+				    NULL, NULL,
+				    g_cclosure_marshal_VOID__BOXED,
+				    G_TYPE_NONE, 1,
+				    G_TYPE_HASH_TABLE);
 }
diff --git a/libnm-glib/nm-device-wifi.h b/libnm-glib/nm-device-wifi.h
index f9b30d9..97779ed 100644
--- a/libnm-glib/nm-device-wifi.h
+++ b/libnm-glib/nm-device-wifi.h
@@ -79,6 +79,7 @@ typedef struct {
 	/* Signals */
 	void (*access_point_added) (NMDeviceWifi *device, NMAccessPoint *ap);
 	void (*access_point_removed) (NMDeviceWifi *device, NMAccessPoint *ap);
+	void (*cert_received) (NMDeviceWifi *device, GHashTable *cert);
 
 	/* Padding for future expansion */
 	void (*_reserved1) (void);
@@ -86,7 +87,6 @@ typedef struct {
 	void (*_reserved3) (void);
 	void (*_reserved4) (void);
 	void (*_reserved5) (void);
-	void (*_reserved6) (void);
 } NMDeviceWifiClass;
 
 GType nm_device_wifi_get_type (void);
@@ -112,6 +112,9 @@ void                     nm_device_wifi_request_scan_simple      (NMDeviceWifi *
                                                                   NMDeviceWifiRequestScanFn callback,
                                                                   gpointer user_data);
 
+gboolean                 nm_device_wifi_probe_cert               (NMDeviceWifi *device,
+                                                                  const GByteArray *ssid);
+
 G_END_DECLS
 
 #endif /* NM_DEVICE_WIFI_H */
-- 
1.8.4.5

From 5d7a52e008ebf37ef8252f7e87c7b3f5a022176d Mon Sep 17 00:00:00 2001
From: Gary Ching-Pang Lin <chingpang@gmail.com>
Date: Thu, 25 Apr 2013 11:13:52 +0800
Subject: [PATCH 4/4] wifi: Probe the Radius server with the user credential

Some servers do not accept anonymous probe.
---
 introspection/nm-device-wifi.xml              |  4 +--
 libnm-glib/nm-device-wifi.c                   | 14 ++++++++---
 libnm-glib/nm-device-wifi.h                   |  2 +-
 src/devices/wifi/nm-device-wifi.c             | 35 ++++++++++++++++++++++++---
 src/supplicant-manager/nm-supplicant-config.c | 31 +++++++++++++++++++++---
 src/supplicant-manager/nm-supplicant-config.h |  3 ++-
 6 files changed, 74 insertions(+), 15 deletions(-)

diff --git a/introspection/nm-device-wifi.xml b/introspection/nm-device-wifi.xml
index a3f78ca..cd437a8 100644
--- a/introspection/nm-device-wifi.xml
+++ b/introspection/nm-device-wifi.xml
@@ -45,9 +45,9 @@
 
     <method name="ProbeCert">
       <annotation name="org.freedesktop.DBus.GLib.CSymbol" value="impl_device_probe_cert"/>
-      <arg name="ssid" type="ay" direction="in">
+      <arg name="settings" type="a{sa{sv}}" direction="in">
         <tp:docstring>
-          The SSID of the AP to be probed
+          Connection settings and properties
         </tp:docstring>
       </arg>
       <tp:docstring>
diff --git a/libnm-glib/nm-device-wifi.c b/libnm-glib/nm-device-wifi.c
index 60ca89e..c8da80a 100644
--- a/libnm-glib/nm-device-wifi.c
+++ b/libnm-glib/nm-device-wifi.c
@@ -386,7 +386,7 @@ nm_device_wifi_request_scan_simple (NMDeviceWifi *device,
 /**
  * nm_device_wifi_probe_cert:
  * @device: a #NMDeviceWifi
- * @ssid: the ssid of the AP to probe
+ * @partial: the connection settings and properties
  *
  * Probe the certificate of the RADIUS server
  *
@@ -394,21 +394,29 @@ nm_device_wifi_request_scan_simple (NMDeviceWifi *device,
  **/
 gboolean
 nm_device_wifi_probe_cert (NMDeviceWifi *device,
-                           const GByteArray *ssid)
+                           NMConnection *partial)
 {
 	NMDeviceWifiPrivate *priv;
+	GHashTable *hash = NULL;
 	GError *error = NULL;
 	gboolean ret;
 
 	g_return_val_if_fail (NM_IS_DEVICE_WIFI (device), FALSE);
+	g_return_val_if_fail (partial, FALSE);
 
 	priv = NM_DEVICE_WIFI_GET_PRIVATE (device);
 
+	hash = nm_connection_to_hash (partial, NM_SETTING_HASH_FLAG_ALL);
+	if (hash == NULL)
+		return FALSE;
+
 	ret = dbus_g_proxy_call (priv->proxy, "ProbeCert", &error,
-				 DBUS_TYPE_G_UCHAR_ARRAY, ssid,
+				 DBUS_TYPE_G_MAP_OF_MAP_OF_VARIANT, hash,
 				 G_TYPE_INVALID,
 				 G_TYPE_INVALID);
 
+	g_hash_table_unref (hash);
+
 	if (!ret) {
 		g_warning ("%s: error probe certificate: %s", __func__, error->message);
 		g_error_free (error);
diff --git a/libnm-glib/nm-device-wifi.h b/libnm-glib/nm-device-wifi.h
index 97779ed..628cef7 100644
--- a/libnm-glib/nm-device-wifi.h
+++ b/libnm-glib/nm-device-wifi.h
@@ -113,7 +113,7 @@ void                     nm_device_wifi_request_scan_simple      (NMDeviceWifi *
                                                                   gpointer user_data);
 
 gboolean                 nm_device_wifi_probe_cert               (NMDeviceWifi *device,
-                                                                  const GByteArray *ssid);
+                                                                  NMConnection *partial);
 
 G_END_DECLS
 
diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c
index c25f285..bfd5662 100644
--- a/src/devices/wifi/nm-device-wifi.c
+++ b/src/devices/wifi/nm-device-wifi.c
@@ -66,7 +66,7 @@ static gboolean impl_device_get_access_points (NMDeviceWifi *device,
                                                GPtrArray **aps,
                                                GError **err);
 static gboolean impl_device_probe_cert (NMDeviceWifi *device,
-                                        GByteArray *ssid,
+                                        GHashTable *settings,
                                         GError **err);
 
 static gboolean impl_device_get_all_access_points (NMDeviceWifi *device,
@@ -1750,16 +1750,40 @@ supplicant_iface_certification_cb (NMSupplicantInterface * iface,
 
 static gboolean
 impl_device_probe_cert (NMDeviceWifi *self,
-                        GByteArray *ssid,
+                        GHashTable *settings,
                         GError **err)
 {
 	NMDeviceWifiPrivate *priv = NM_DEVICE_WIFI_GET_PRIVATE (self);
+	NMConnection *connection = NULL;
+	NMSettingWireless *setting_wifi;
+	const GByteArray *ssid;
+	NMSetting8021x *setting_8021x;
 	NMSupplicantConfig *config = NULL;
 	guint id;
 	gboolean ret = FALSE;
 
-	config = nm_supplicant_config_new_probe (ssid);
-	if (!config)
+	if (!settings)
+		goto error;
+
+	connection = nm_connection_new ();
+	if (!connection)
+		goto error;
+	nm_connection_replace_settings (connection, settings, NULL);
+
+	setting_wifi = nm_connection_get_setting_wireless (connection);
+	if (setting_wifi == NULL)
+		goto error;
+
+	ssid = nm_setting_wireless_get_ssid (setting_wifi);
+	if (ssid == NULL)
+		goto error;
+
+	setting_8021x = nm_connection_get_setting_802_1x (connection);
+	if (setting_8021x == NULL)
+		goto error;
+
+	config = nm_supplicant_config_new_probe (ssid, setting_8021x);
+	if (config == NULL)
 		goto error;
 
 	/* Hook up signal handler to capture certification signal */
@@ -1775,6 +1799,9 @@ impl_device_probe_cert (NMDeviceWifi *self,
 	ret = TRUE;
 
 error:
+	if (connection)
+		g_object_unref (connection);
+
 	if (!ret) {
 		g_set_error_literal (err,
 		                     NM_WIFI_ERROR,
diff --git a/src/supplicant-manager/nm-supplicant-config.c b/src/supplicant-manager/nm-supplicant-config.c
index cbc55aa..87580ad 100644
--- a/src/supplicant-manager/nm-supplicant-config.c
+++ b/src/supplicant-manager/nm-supplicant-config.c
@@ -164,21 +164,44 @@ nm_supplicant_config_add_option (NMSupplicantConfig *self,
 }
 
 NMSupplicantConfig *
-nm_supplicant_config_new_probe (const GByteArray *ssid)
+nm_supplicant_config_new_probe (const GByteArray *ssid, NMSetting8021x *setting)
 {
 	NMSupplicantConfig *probe_config;
+	const char *identity, *password;
+	gboolean use_pw = FALSE;
+	guint32 i, num_eap;
+
+	g_return_val_if_fail (ssid != NULL, NULL);
+	g_return_val_if_fail (setting != NULL, NULL);
+
+	num_eap = nm_setting_802_1x_get_num_eap_methods (setting);
+	for (i = 0; i < num_eap; i++) {
+		const char *method = nm_setting_802_1x_get_eap_method (setting, i);
+
+		if (method && (strcasecmp (method, "ttls") == 0 ||
+			       strcasecmp (method, "peap") == 0))
+			use_pw = TRUE;
+	}
 
-	if (!ssid)
-		return NULL;
+	identity = nm_setting_802_1x_get_identity (setting);
+	if (!identity)
+		identity = " ";
 
 	probe_config = (NMSupplicantConfig *)g_object_new (NM_TYPE_SUPPLICANT_CONFIG, NULL);
 
 	nm_supplicant_config_add_option (probe_config, "ssid", (char *)ssid->data, ssid->len, FALSE);
 	nm_supplicant_config_add_option (probe_config, "key_mgmt", "WPA-EAP", -1, FALSE);
 	nm_supplicant_config_add_option (probe_config, "eap", "TTLS PEAP TLS", -1, FALSE);
-	nm_supplicant_config_add_option (probe_config, "identity", " ", -1, FALSE);
+	nm_supplicant_config_add_option (probe_config, "identity", identity, -1, FALSE);
 	nm_supplicant_config_add_option (probe_config, "ca_cert", "probe://", -1, FALSE);
 
+	if (use_pw) {
+		password = nm_setting_802_1x_get_password(setting);
+		if (!password)
+			return NULL;
+		nm_supplicant_config_add_option (probe_config, "password", password, -1, TRUE);
+	}
+
 	return probe_config;
 }
 
diff --git a/src/supplicant-manager/nm-supplicant-config.h b/src/supplicant-manager/nm-supplicant-config.h
index 9e71ea6..06b31fc 100644
--- a/src/supplicant-manager/nm-supplicant-config.h
+++ b/src/supplicant-manager/nm-supplicant-config.h
@@ -52,7 +52,8 @@ GType nm_supplicant_config_get_type (void);
 
 NMSupplicantConfig *nm_supplicant_config_new (void);
 
-NMSupplicantConfig *nm_supplicant_config_new_probe (const GByteArray *ssid);
+NMSupplicantConfig *nm_supplicant_config_new_probe (const GByteArray *ssid,
+						    NMSetting8021x *setting);
 
 guint32 nm_supplicant_config_get_ap_scan (NMSupplicantConfig *self);
 
-- 
1.8.4.5

Places

File nm-probe-radius-server-cert.patch of Package NetworkManager (Revision d820ada6b633890dea8bf6ba80b7bb76)

Places