summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--clients/common/nm-meta-setting-desc.c3
-rw-r--r--clients/common/settings-docs.c.in1
-rw-r--r--libnm-core/nm-setting-8021x.c52
-rw-r--r--libnm-core/nm-setting-8021x.h3
-rw-r--r--man/NetworkManager.conf.xml5
-rw-r--r--src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c5
-rw-r--r--src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c12
7 files changed, 74 insertions, 7 deletions
diff --git a/clients/common/nm-meta-setting-desc.c b/clients/common/nm-meta-setting-desc.c
index 0231fe06ce..573bee7cb8 100644
--- a/clients/common/nm-meta-setting-desc.c
+++ b/clients/common/nm-meta-setting-desc.c
@@ -4691,6 +4691,9 @@ static const NMMetaPropertyInfo *const property_infos_802_1X[] = {
PROPERTY_INFO_WITH_DESC (NM_SETTING_802_1X_AUTH_TIMEOUT,
.property_type = &_pt_gobject_int,
),
+ PROPERTY_INFO_WITH_DESC (NM_SETTING_802_1X_AUTH_RETRIES,
+ .property_type = &_pt_gobject_int,
+ ),
NULL
};
diff --git a/clients/common/settings-docs.c.in b/clients/common/settings-docs.c.in
index 5ea7ea4059..c56f0a8af7 100644
--- a/clients/common/settings-docs.c.in
+++ b/clients/common/settings-docs.c.in
@@ -43,6 +43,7 @@
#define DESCRIBE_DOC_NM_SETTING_WIRELESS_SECURITY_WPS_METHOD N_("Flags indicating which mode of WPS is to be used if any. There's little point in changing the default setting as NetworkManager will automatically determine whether it's feasible to start WPS enrollment from the Access Point capabilities. WPS can be disabled by setting this property to a value of 1.")
#define DESCRIBE_DOC_NM_SETTING_802_1X_ALTSUBJECT_MATCHES N_("List of strings to be matched against the altSubjectName of the certificate presented by the authentication server. If the list is empty, no verification of the server certificate's altSubjectName is performed.")
#define DESCRIBE_DOC_NM_SETTING_802_1X_ANONYMOUS_IDENTITY N_("Anonymous identity string for EAP authentication methods. Used as the unencrypted identity with EAP types that support different tunneled identity like EAP-TTLS.")
+#define DESCRIBE_DOC_NM_SETTING_802_1X_AUTH_RETRIES N_("The number of retries for the authentication. Zero means to try indefinitely; -1 means to use a global default. If the global default is not set, the authentication retries for 3 times before failing the connection.")
#define DESCRIBE_DOC_NM_SETTING_802_1X_AUTH_TIMEOUT N_("A timeout for the authentication. Zero means the global default; if the global default is not set, the authentication timeout is 25 seconds.")
#define DESCRIBE_DOC_NM_SETTING_802_1X_CA_CERT N_("Contains the CA certificate if used by the EAP method specified in the \"eap\" property. Certificate data is specified using a \"scheme\"; two are currently supported: blob and path. When using the blob scheme (which is backwards compatible with NM 0.7.x) this property should be set to the certificate's DER encoded data. When using the path scheme, this property should be set to the full UTF-8 encoded path of the certificate, prefixed with the string \"file://\" and ending with a terminating NUL byte. This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended.")
#define DESCRIBE_DOC_NM_SETTING_802_1X_CA_CERT_PASSWORD N_("The password used to access the CA certificate stored in \"ca-cert\" property. Only makes sense if the certificate is stored on a PKCS#11 token that requires a login.")
diff --git a/libnm-core/nm-setting-8021x.c b/libnm-core/nm-setting-8021x.c
index 82dc41dd55..b9f37df8d7 100644
--- a/libnm-core/nm-setting-8021x.c
+++ b/libnm-core/nm-setting-8021x.c
@@ -116,6 +116,7 @@ typedef struct {
NMSettingSecretFlags phase2_private_key_password_flags;
gboolean system_ca_certs;
gint auth_timeout;
+ gint auth_retries;
} NMSetting8021xPrivate;
enum {
@@ -164,6 +165,7 @@ enum {
PROP_PIN_FLAGS,
PROP_SYSTEM_CA_CERTS,
PROP_AUTH_TIMEOUT,
+ PROP_AUTH_RETRIES,
LAST_PROP
};
@@ -2745,6 +2747,25 @@ nm_setting_802_1x_get_auth_timeout (NMSetting8021x *setting)
return NM_SETTING_802_1X_GET_PRIVATE (setting)->auth_timeout;
}
+/**
+ * nm_setting_802_1x_get_auth_retries:
+ * @setting: the #NMSetting8021x
+ *
+ * Returns the value contained in the #NMSetting8021x:auth-retries property.
+ *
+ * Returns: the configured authentication retries in seconds. Zero means
+ * infinity and -1 means a global default value.
+ *
+ * Since: 1.10
+ **/
+gint
+nm_setting_802_1x_get_auth_retries (NMSetting8021x *setting)
+{
+ g_return_val_if_fail (NM_IS_SETTING_802_1X (setting), -1);
+
+ return NM_SETTING_802_1X_GET_PRIVATE (setting)->auth_retries;
+}
+
static void
need_secrets_password (NMSetting8021x *self,
GPtrArray *secrets,
@@ -3623,6 +3644,9 @@ set_property (GObject *object, guint prop_id,
case PROP_AUTH_TIMEOUT:
priv->auth_timeout = g_value_get_int (value);
break;
+ case PROP_AUTH_RETRIES:
+ priv->auth_retries = g_value_get_int (value);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -3769,6 +3793,9 @@ get_property (GObject *object, guint prop_id,
case PROP_AUTH_TIMEOUT:
g_value_set_int (value, priv->auth_timeout);
break;
+ case PROP_AUTH_RETRIES:
+ g_value_set_int (value, priv->auth_retries);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -4825,4 +4852,29 @@ nm_setting_802_1x_class_init (NMSetting8021xClass *setting_class)
NM_SETTING_PARAM_FUZZY_IGNORE |
G_PARAM_STATIC_STRINGS));
+ /**
+ * NMSetting8021x:auth-retries:
+ *
+ * The number of retries for the authentication. Zero means to try indefinitely; -1 means
+ * to use a global default. If the global default is not set, the authentication
+ * retries for 3 times before failing the connection.
+ *
+ * Since: 1.10
+ **/
+ /* ---ifcfg-rh---
+ * property: auth-retries
+ * variable: IEEE_8021X_AUTH_RETRIES(+)
+ * default: 0
+ * description: Number of retries for the 802.1X authentication.
+ * ---end---
+ */
+ g_object_class_install_property
+ (object_class, PROP_AUTH_RETRIES,
+ g_param_spec_int (NM_SETTING_802_1X_AUTH_RETRIES, "", "",
+ -1, G_MAXINT32, -1,
+ G_PARAM_READWRITE |
+ G_PARAM_CONSTRUCT |
+ NM_SETTING_PARAM_FUZZY_IGNORE |
+ G_PARAM_STATIC_STRINGS));
+
}
diff --git a/libnm-core/nm-setting-8021x.h b/libnm-core/nm-setting-8021x.h
index e1631e2d51..53f5bb5239 100644
--- a/libnm-core/nm-setting-8021x.h
+++ b/libnm-core/nm-setting-8021x.h
@@ -151,6 +151,7 @@ typedef enum { /*< underscore_name=nm_setting_802_1x_auth_flags >*/
#define NM_SETTING_802_1X_PIN_FLAGS "pin-flags"
#define NM_SETTING_802_1X_SYSTEM_CA_CERTS "system-ca-certs"
#define NM_SETTING_802_1X_AUTH_TIMEOUT "auth-timeout"
+#define NM_SETTING_802_1X_AUTH_RETRIES "auth-retries"
/* PRIVATE KEY NOTE: when setting PKCS#12 private keys directly via properties
* using the "blob" scheme, the data must be passed in PKCS#12 binary format.
@@ -361,6 +362,8 @@ NM_AVAILABLE_IN_1_8
NMSetting8021xAuthFlags nm_setting_802_1x_get_phase1_auth_flags (NMSetting8021x *setting);
NM_AVAILABLE_IN_1_8
gint nm_setting_802_1x_get_auth_timeout (NMSetting8021x *setting);
+NM_AVAILABLE_IN_1_10
+gint nm_setting_802_1x_get_auth_retries (NMSetting8021x *setting);
G_END_DECLS
diff --git a/man/NetworkManager.conf.xml b/man/NetworkManager.conf.xml
index 611c7d0798..357474eaf8 100644
--- a/man/NetworkManager.conf.xml
+++ b/man/NetworkManager.conf.xml
@@ -742,6 +742,11 @@ ipv6.ip6-privacy=0
<listitem><para>If left unspecified, the default value
"<literal>optional</literal>" will be used.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>802-1x.auth-retries</varname></term>
+ <listitem><para>If left unspecified, the default value is 3 tries before failing the connection.
+ </para></listitem>
+ </varlistentry>
</variablelist>
</para>
</refsect2>
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
index be7226533e..7b487f0f93 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-reader.c
@@ -3356,7 +3356,10 @@ next:
g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_DOMAIN_SUFFIX_MATCH, v, NULL);
timeout = svGetValueInt64 (ifcfg, "IEEE_8021X_AUTH_TIMEOUT", 10, 0, G_MAXINT32, 0);
- g_object_set (s_8021x, NM_SETTING_802_1X_AUTH_TIMEOUT, (gint32) timeout, NULL);
+ g_object_set (s_8021x, NM_SETTING_802_1X_AUTH_TIMEOUT, (gint) timeout, NULL);
+
+ timeout = svGetValueInt64 (ifcfg, "IEEE_8021X_AUTH_RETRIES", 10, -1, G_MAXINT32, -1);
+ g_object_set (s_8021x, NM_SETTING_802_1X_AUTH_RETRIES, (gint) timeout, NULL);
return g_steal_pointer (&s_8021x);
}
diff --git a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
index 61a04b6696..ea2e4af3e2 100644
--- a/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
+++ b/src/settings/plugins/ifcfg-rh/nms-ifcfg-rh-writer.c
@@ -409,8 +409,8 @@ write_8021x_setting (NMConnection *connection,
GString *phase2_auth;
GString *str;
guint32 i, num;
- gint timeout;
gsize size;
+ int vint;
s_8021x = nm_connection_get_setting_802_1x (connection);
if (!s_8021x) {
@@ -562,11 +562,11 @@ write_8021x_setting (NMConnection *connection,
svSetValueStr (ifcfg, "IEEE_8021X_PHASE2_DOMAIN_SUFFIX_MATCH",
nm_setting_802_1x_get_phase2_domain_suffix_match (s_8021x));
- timeout = nm_setting_802_1x_get_auth_timeout (s_8021x);
- if (timeout > 0)
- svSetValueInt64 (ifcfg, "IEEE_8021X_AUTH_TIMEOUT", timeout);
- else
- svUnsetValue (ifcfg, "IEEE_8021X_AUTH_TIMEOUT");
+ vint = nm_setting_802_1x_get_auth_timeout (s_8021x);
+ svSetValueInt64_cond (ifcfg, "IEEE_8021X_AUTH_TIMEOUT", vint > 0, vint);
+
+ vint = nm_setting_802_1x_get_auth_retries (s_8021x);
+ svSetValueInt64_cond (ifcfg, "IEEE_8021X_AUTH_RETRIES", vint > 0, vint);
if (!write_8021x_certs (s_8021x, secrets, blobs, FALSE, ifcfg, error))
return FALSE;
View Lorry Controller Status