Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

auth: add support for LEAP and EAP-PWD (LP: #2038811) #415

Merged
merged 1 commit into from
Oct 12, 2023

Conversation

daniloegea
Copy link
Collaborator

@daniloegea daniloegea commented Oct 10, 2023

This changes add support for the LEAP and PWD EAP authentication methods for NetworkManager, wpa_supplicant (networkd) and the keyfile parser.

Using these method through the NM GUI is causing problems because libnetplan will generate a broken keyfile. See LP: #2038811

Note that the NM GUI supports more methods not recognized by netplan and we probably should also implement them later.

Reproducers

nmcli con add type wifi ifname wlan0 ssid asdasd wifi-sec.key-mgmt ieee8021x 802-1x.eap leap 802-1x.identity username 802-1x.password aaaaaaaa
nmcli con add type wifi ifname wlan0 ssid asdasd wifi-sec.key-mgmt wpa-eap 802-1x.eap leap 802-1x.identity username 802-1x.password aaaaaaaa

Description

Checklist

  • Runs make check successfully.
  • Retains 100% code coverage (make check-coverage).
  • New/changed keys in YAML format are documented.
  • (Optional) Adds example YAML for new feature.
  • (Optional) Closes an open bug in Launchpad.

@daniloegea daniloegea marked this pull request as ready for review October 10, 2023 16:27
@daniloegea daniloegea requested a review from slyon October 10, 2023 16:27
Copy link
Collaborator

@slyon slyon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you very much! I think this should fix the case for the "leap" and "pwd" values of NetworkManager's 801-1x.eap setting. But there might be more, similar cases and we should think about implementing some generic (future proof) fallback, using networkmanager.passthrough.

src/networkd.c Show resolved Hide resolved
src/parse-nm.c Show resolved Hide resolved
src/nm.c Show resolved Hide resolved
@daniloegea daniloegea marked this pull request as draft October 11, 2023 14:32
@daniloegea
Copy link
Collaborator Author

daniloegea commented Oct 11, 2023

Something is still missing, the commands below are still failing:

nmcli con add type wifi ifname wlan0 ssid asdasd wifi-sec.key-mgmt wpa-eap 802-1x.eap md5 802-1x.identity username 802-1x.password aaaaaaaa
nmcli con add type wifi ifname wlan0 ssid asdasd wifi-sec.key-mgmt wpa-psk wifi-sec.psk asdasdasd 802-1x.eap md5 802-1x.identity username 802-1x.password aaaaaaaa

@daniloegea daniloegea force-pushed the key_mgmt_ieee8021x branch 2 times, most recently from 66a65eb to 62a2d52 Compare October 12, 2023 13:10
@daniloegea daniloegea marked this pull request as ready for review October 12, 2023 14:32
Copy link
Collaborator

@slyon slyon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with the reduced scope. Let's fix the bug at hand first and work on the generic solution afterwards.

nitpick: May I just suggest to add simple testcases for the new "leap"/"pwd" EAP methods in test_keyfile.py?

diff --git a/tests/parser/test_keyfile.py b/tests/parser/test_keyfile.py
index dbb992ed..7a6bd2ca 100644
--- a/tests/parser/test_keyfile.py
+++ b/tests/parser/test_keyfile.py
@@ -526,6 +526,12 @@ dns-search='''.format(UUID, method))
     def test_keyfile_type_wifi_eap_ttls(self):
         self._template_keyfile_type_wifi_eap('ttls')
 
+    def test_keyfile_type_wifi_eap_leap(self):
+        self._template_keyfile_type_wifi_eap('leap')
+
+    def test_keyfile_type_wifi_eap_pwd(self):
+        self._template_keyfile_type_wifi_eap('pwd')
+
     def test_keyfile_type_wifi_eap_leap(self):
         self.generate_from_keyfile('''[connection]
 type=wifi

src/parse-nm.c Show resolved Hide resolved
This changes add support for the LEAP and PWD EAP authentication methods
for NetworkManager, wpa_supplicant (networkd) and the keyfile parser.

Using these method through the NM GUI is causing problems because
libnetplan will generate a broken keyfile. See LP: #2038811

Note that the NM GUI supports more methods not recognized by netplan and
we probably should also implement them later.
@daniloegea daniloegea merged commit 4a5a9ed into canonical:main Oct 12, 2023
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants