/* SPDX-License-Identifier: GPL-2.0-or-later */

/*

 * Copyright (C) 2006 - 2012 Red Hat, Inc.

 * Copyright (C) 2007 - 2008 Novell, Inc.

 */

#include "nm-default.h"

#include "nm-supplicant-config.h"

#include <stdlib.h>

#include "nm-glib-aux/nm-str-buf.h"

#include "nm-core-internal.h"

#include "nm-supplicant-settings-verify.h"

#include "nm-setting.h"

#include "nm-libnm-core-intern/nm-auth-subject.h"

#include "NetworkManagerUtils.h"

#include "nm-utils.h"

#include "nm-setting-ip4-config.h"

typedef struct {

    char *         value;

    guint32        len;

    NMSupplOptType type;

} ConfigOption;

/*****************************************************************************/

typedef struct {

    GHashTable *   config;

    GHashTable *   blobs;

    NMSupplCapMask capabilities;

    guint32        ap_scan;

    bool           fast_required : 1;

    bool           dispose_has_run : 1;

    bool           ap_isolation : 1;

} NMSupplicantConfigPrivate;

struct _NMSupplicantConfig {

    GObject                   parent;

    NMSupplicantConfigPrivate _priv;

};

struct _NMSupplicantConfigClass {

    GObjectClass parent;

};

G_DEFINE_TYPE(NMSupplicantConfig, nm_supplicant_config, G_TYPE_OBJECT)

#define NM_SUPPLICANT_CONFIG_GET_PRIVATE(self) \

    _NM_GET_PRIVATE(self, NMSupplicantConfig, NM_IS_SUPPLICANT_CONFIG)

/*****************************************************************************/

static gboolean

_get_capability(NMSupplicantConfigPrivate *priv, NMSupplCapType type)

{

    return NM_SUPPL_CAP_MASK_GET(priv->capabilities, type) == NM_TERNARY_TRUE;

}

NMSupplicantConfig *

nm_supplicant_config_new(NMSupplCapMask capabilities)

{

    NMSupplicantConfigPrivate *priv;

    NMSupplicantConfig *       self;

    self = g_object_new(NM_TYPE_SUPPLICANT_CONFIG, NULL);

    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    priv->capabilities = capabilities;

    return self;

}

static void

config_option_free(ConfigOption *opt)

{

    g_free(opt->value);

    g_slice_free(ConfigOption, opt);

}

static void

nm_supplicant_config_init(NMSupplicantConfig *self)

{

    NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    priv->config = g_hash_table_new_full(nm_str_hash,

                                         g_str_equal,

                                         g_free,

                                         (GDestroyNotify) config_option_free);

    priv->ap_scan         = 1;

    priv->dispose_has_run = FALSE;

}

static gboolean

nm_supplicant_config_add_option_with_type(NMSupplicantConfig *self,

                                          const char *        key,

                                          const char *        value,

                                          gint32              len,

                                          NMSupplOptType      opt_type,

                                          const char *        hidden,

                                          GError **           error)

{

    NMSupplicantConfigPrivate *priv;

    ConfigOption *             old_opt;

    ConfigOption *             opt;

    NMSupplOptType             type;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    g_return_val_if_fail(key != NULL, FALSE);

    g_return_val_if_fail(value != NULL, FALSE);

    nm_assert(!error || !*error);

    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    if (len < 0)

        len = strlen(value);

    if (opt_type != NM_SUPPL_OPT_TYPE_INVALID)

        type = opt_type;

    else {

        type = nm_supplicant_settings_verify_setting(key, value, len);

        if (type == NM_SUPPL_OPT_TYPE_INVALID) {

            gs_free char *str_free = NULL;

            const char *  str;

            str = nm_utils_buf_utf8safe_escape(value,

                                               len,

                                               NM_UTILS_STR_UTF8_SAFE_FLAG_ESCAPE_CTRL,

                                               &str_free);

            str = nm_strquote_a(255, str);

            g_set_error(error,

                        NM_SUPPLICANT_ERROR,

                        NM_SUPPLICANT_ERROR_CONFIG,

                        "key '%s' and/or value %s invalid",

                        key,

                        hidden ?: str);

            return FALSE;

        }

    }

    old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);

    if (old_opt) {

        g_set_error(error,

                    NM_SUPPLICANT_ERROR,

                    NM_SUPPLICANT_ERROR_CONFIG,

                    "key '%s' already configured",

                    key);

        return FALSE;

    }

    opt        = g_slice_new0(ConfigOption);

    opt->value = g_malloc(len + 1);

    memcpy(opt->value, value, len);

    opt->value[len] = '\0';

    opt->len  = len;

    opt->type = type;

    {

        char buf[255];

        memset(&buf[0], 0, sizeof(buf));

        memcpy(&buf[0], opt->value, opt->len > 254 ? 254 : opt->len);

        nm_log_info(LOGD_SUPPLICANT, "Config: added '%s' value '%s'", key, hidden ?: &buf[0]);

    }

    g_hash_table_insert(priv->config, g_strdup(key), opt);

    return TRUE;

}

static gboolean

nm_supplicant_config_add_option(NMSupplicantConfig *self,

                                const char *        key,

                                const char *        value,

                                gint32              len,

                                const char *        hidden,

                                GError **           error)

{

    return nm_supplicant_config_add_option_with_type(self,

                                                     key,

                                                     value,

                                                     len,

                                                     NM_SUPPL_OPT_TYPE_INVALID,

                                                     hidden,

                                                     error);

}

static gboolean

nm_supplicant_config_add_blob(NMSupplicantConfig *self,

                              const char *        key,

                              GBytes *            value,

                              const char *        blobid,

                              GError **           error)

{

    NMSupplicantConfigPrivate *priv;

    ConfigOption *             old_opt;

    ConfigOption *             opt;

    NMSupplOptType             type;

    const guint8 *             data;

    gsize                      data_len;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    g_return_val_if_fail(key != NULL, FALSE);

    g_return_val_if_fail(value != NULL, FALSE);

    g_return_val_if_fail(blobid != NULL, FALSE);

    data = g_bytes_get_data(value, &data_len);

    g_return_val_if_fail(data_len > 0, FALSE);

    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    type = nm_supplicant_settings_verify_setting(key, (const char *) data, data_len);

    if (type == NM_SUPPL_OPT_TYPE_INVALID) {

        g_set_error(error,

                    NM_SUPPLICANT_ERROR,

                    NM_SUPPLICANT_ERROR_CONFIG,

                    "key '%s' and/or its contained value is invalid",

                    key);

        return FALSE;

    }

    old_opt = (ConfigOption *) g_hash_table_lookup(priv->config, key);

    if (old_opt) {

        g_set_error(error,

                    NM_SUPPLICANT_ERROR,

                    NM_SUPPLICANT_ERROR_CONFIG,

                    "key '%s' already configured",

                    key);

        return FALSE;

    }

    opt        = g_slice_new0(ConfigOption);

    opt->value = g_strdup_printf("blob://%s", blobid);

    opt->len   = strlen(opt->value);

    opt->type  = type;

    nm_log_info(LOGD_SUPPLICANT, "Config: added '%s' value '%s'", key, opt->value);

    g_hash_table_insert(priv->config, g_strdup(key), opt);

    if (!priv->blobs) {

        priv->blobs =

            g_hash_table_new_full(nm_str_hash, g_str_equal, g_free, (GDestroyNotify) g_bytes_unref);

    }

    g_hash_table_insert(priv->blobs, g_strdup(blobid), g_bytes_ref(value));

    return TRUE;

}

static gboolean

nm_supplicant_config_add_blob_for_connection(NMSupplicantConfig *self,

                                             GBytes *            field,

                                             const char *        name,

                                             const char *        con_uid,

                                             GError **           error)

{

    if (field && g_bytes_get_size(field)) {

        gs_free char *uid = NULL;

        char *        p;

        uid = g_strdup_printf("%s-%s", con_uid, name);

        for (p = uid; *p; p++) {

            if (*p == '/')

                *p = '-';

        }

        if (!nm_supplicant_config_add_blob(self, name, field, uid, error))

            return FALSE;

    }

    return TRUE;

}

static void

nm_supplicant_config_finalize(GObject *object)

{

    NMSupplicantConfigPrivate *priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(object);

    g_hash_table_destroy(priv->config);

    nm_clear_pointer(&priv->blobs, g_hash_table_destroy);

    G_OBJECT_CLASS(nm_supplicant_config_parent_class)->finalize(object);

}

static void

nm_supplicant_config_class_init(NMSupplicantConfigClass *klass)

{

    GObjectClass *object_class = G_OBJECT_CLASS(klass);

    object_class->finalize = nm_supplicant_config_finalize;

}

guint32

nm_supplicant_config_get_ap_scan(NMSupplicantConfig *self)

{

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), 1);

    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->ap_scan;

}

gboolean

nm_supplicant_config_fast_required(NMSupplicantConfig *self)

{

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->fast_required;

}

GVariant *

nm_supplicant_config_to_variant(NMSupplicantConfig *self)

{

    NMSupplicantConfigPrivate *priv;

    GVariantBuilder            builder;

    GHashTableIter             iter;

    ConfigOption *             option;

    const char *               key;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);

    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    g_variant_builder_init(&builder, G_VARIANT_TYPE_VARDICT);

    g_hash_table_iter_init(&iter, priv->config);

    while (g_hash_table_iter_next(&iter, (gpointer) &key, (gpointer) &option)) {

        switch (option->type) {

        case NM_SUPPL_OPT_TYPE_INT:

            g_variant_builder_add(&builder, "{sv}", key, g_variant_new_int32(atoi(option->value)));

            break;

        case NM_SUPPL_OPT_TYPE_BYTES:

        case NM_SUPPL_OPT_TYPE_UTF8:

            g_variant_builder_add(

                &builder,

                "{sv}",

                key,

                g_variant_new_fixed_array(G_VARIANT_TYPE_BYTE, option->value, option->len, 1));

            break;

        case NM_SUPPL_OPT_TYPE_KEYWORD:

        case NM_SUPPL_OPT_TYPE_STRING:

            g_variant_builder_add(&builder, "{sv}", key, g_variant_new_string(option->value));

            break;

        default:

            break;

        }

    }

    return g_variant_builder_end(&builder);

}

GHashTable *

nm_supplicant_config_get_blobs(NMSupplicantConfig *self)

{

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), NULL);

    return NM_SUPPLICANT_CONFIG_GET_PRIVATE(self)->blobs;

}

static const char *

wifi_freqs_to_string(gboolean bg_band)

{

    static const char *str_2ghz = NULL;

    static const char *str_5ghz = NULL;

    const char **      f_p;

    const char *       f;

    f_p = bg_band ? &str_2ghz : &str_5ghz;

again:

    f = g_atomic_pointer_get(f_p);

    if (G_UNLIKELY(!f)) {

        nm_auto_str_buf NMStrBuf strbuf = NM_STR_BUF_INIT(400, FALSE);

        const guint *            freqs;

        int                      i;

        freqs = bg_band ? nm_utils_wifi_2ghz_freqs() : nm_utils_wifi_5ghz_freqs();

        for (i = 0; freqs[i]; i++) {

            if (i > 0)

                nm_str_buf_append_c(&strbuf, ' ');

            nm_str_buf_append_printf(&strbuf, "%u", freqs[i]);

        }

        f = g_strdup(nm_str_buf_get_str(&strbuf));

        if (!g_atomic_pointer_compare_and_exchange(f_p, NULL, f)) {

            g_free((char *) f);

            goto again;

        }

    }

    return f;

}

gboolean

nm_supplicant_config_add_setting_macsec(NMSupplicantConfig *self,

                                        NMSettingMacsec *   setting,

                                        GError **           error)

{

    const char *value;

    char        buf[32];

    int         port;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    g_return_val_if_fail(setting != NULL, FALSE);

    g_return_val_if_fail(!error || !*error, FALSE);

    if (!nm_supplicant_config_add_option(self, "macsec_policy", "1", -1, NULL, error))

        return FALSE;

    value = nm_setting_macsec_get_encrypt(setting) ? "0" : "1";

    if (!nm_supplicant_config_add_option(self, "macsec_integ_only", value, -1, NULL, error))

        return FALSE;

    port = nm_setting_macsec_get_port(setting);

    if (port > 0 && port < 65534) {

        snprintf(buf, sizeof(buf), "%d", port);

        if (!nm_supplicant_config_add_option(self, "macsec_port", buf, -1, NULL, error))

            return FALSE;

    }

    if (nm_setting_macsec_get_mode(setting) == NM_SETTING_MACSEC_MODE_PSK) {

        guint8 buffer_cak[NM_SETTING_MACSEC_MKA_CAK_LENGTH / 2];

        guint8 buffer_ckn[NM_SETTING_MACSEC_MKA_CKN_LENGTH / 2];

        if (!nm_supplicant_config_add_option(self, "key_mgmt", "NONE", -1, NULL, error))

            return FALSE;

        value = nm_setting_macsec_get_mka_cak(setting);

        if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_cak)) {

            g_set_error_literal(error,

                                NM_SUPPLICANT_ERROR,

                                NM_SUPPLICANT_ERROR_CONFIG,

                                value ? "invalid MKA CAK" : "missing MKA CAK");

            return FALSE;

        }

        if (!nm_supplicant_config_add_option(self,

                                             "mka_cak",

                                             (char *) buffer_cak,

                                             sizeof(buffer_cak),

                                             "<hidden>",

                                             error))

            return FALSE;

        value = nm_setting_macsec_get_mka_ckn(setting);

        if (!value || !nm_utils_hexstr2bin_buf(value, FALSE, FALSE, NULL, buffer_ckn)) {

            g_set_error_literal(error,

                                NM_SUPPLICANT_ERROR,

                                NM_SUPPLICANT_ERROR_CONFIG,

                                value ? "invalid MKA CKN" : "missing MKA CKN");

            return FALSE;

        }

        if (!nm_supplicant_config_add_option(self,

                                             "mka_ckn",

                                             (char *) buffer_ckn,

                                             sizeof(buffer_ckn),

                                             NULL,

                                             error))

            return FALSE;

    }

    return TRUE;

}

gboolean

nm_supplicant_config_add_setting_wireless(NMSupplicantConfig *self,

                                          NMSettingWireless * setting,

                                          guint32             fixed_freq,

                                          GError **           error)

{

    NMSupplicantConfigPrivate *priv;

    gboolean                   is_adhoc, is_ap, is_mesh;

    const char *               mode, *band;

    guint32                    channel;

    GBytes *                   ssid;

    const char *               bssid;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    g_return_val_if_fail(setting != NULL, FALSE);

    g_return_val_if_fail(!error || !*error, FALSE);

    priv = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    mode     = nm_setting_wireless_get_mode(setting);

    is_adhoc = nm_streq0(mode, "adhoc");

    is_ap    = nm_streq0(mode, "ap");

    is_mesh  = nm_streq0(mode, "mesh");

    if (is_adhoc || is_ap)

        priv->ap_scan = 2;

    else

        priv->ap_scan = 1;

    ssid = nm_setting_wireless_get_ssid(setting);

    if (!nm_supplicant_config_add_option(self,

                                         "ssid",

                                         (char *) g_bytes_get_data(ssid, NULL),

                                         g_bytes_get_size(ssid),

                                         NULL,

                                         error))

        return FALSE;

    if (is_adhoc) {

        if (!nm_supplicant_config_add_option(self, "mode", "1", -1, NULL, error))

            return FALSE;

    }

    if (is_ap) {

        if (!nm_supplicant_config_add_option(self, "mode", "2", -1, NULL, error))

            return FALSE;

        if (nm_setting_wireless_get_hidden(setting)

            && !nm_supplicant_config_add_option(self,

                                                "ignore_broadcast_ssid",

                                                "1",

                                                -1,

                                                NULL,

                                                error))

            return FALSE;

    }

    if (is_mesh) {

        if (!nm_supplicant_config_add_option(self, "mode", "5", -1, NULL, error))

            return FALSE;

    }

    if ((is_adhoc || is_ap || is_mesh) && fixed_freq) {

        gs_free char *str_freq = NULL;

        str_freq = g_strdup_printf("%u", fixed_freq);

        if (!nm_supplicant_config_add_option(self, "frequency", str_freq, -1, NULL, error))

            return FALSE;

    }

    /* Except for Ad-Hoc, Hotspot and Mesh, request that the driver probe for the

     * specific SSID we want to associate with.

     */

    if (!(is_adhoc || is_ap || is_mesh)) {

        if (!nm_supplicant_config_add_option(self, "scan_ssid", "1", -1, NULL, error))

            return FALSE;

    }

    bssid = nm_setting_wireless_get_bssid(setting);

    if (bssid) {

        if (!nm_supplicant_config_add_option(self, "bssid", bssid, strlen(bssid), NULL, error))

            return FALSE;

    }

    band    = nm_setting_wireless_get_band(setting);

    channel = nm_setting_wireless_get_channel(setting);

    if (band) {

        if (channel) {

            guint32       freq;

            gs_free char *str_freq = NULL;

            freq     = nm_utils_wifi_channel_to_freq(channel, band);

            str_freq = g_strdup_printf("%u", freq);

            if (!nm_supplicant_config_add_option(self, "freq_list", str_freq, -1, NULL, error))

                return FALSE;

        } else {

            const char *freqs = NULL;

            if (nm_streq(band, "a"))

                freqs = wifi_freqs_to_string(FALSE);

            else if (nm_streq(band, "bg"))

                freqs = wifi_freqs_to_string(TRUE);

            if (freqs

                && !nm_supplicant_config_add_option(self,

                                                    "freq_list",

                                                    freqs,

                                                    strlen(freqs),

                                                    NULL,

                                                    error))

                return FALSE;

        }

    }

    return TRUE;

}

gboolean

nm_supplicant_config_add_bgscan(NMSupplicantConfig *self, NMConnection *connection, GError **error)

{

    NMSettingWireless *        s_wifi;

    NMSettingWirelessSecurity *s_wsec;

    const char *               bgscan;

    s_wifi = nm_connection_get_setting_wireless(connection);

    g_assert(s_wifi);

    /* Don't scan when a shared connection (either AP or Ad-Hoc) is active;

     * it will disrupt connected clients.

     */

    if (NM_IN_STRSET(nm_setting_wireless_get_mode(s_wifi),

                     NM_SETTING_WIRELESS_MODE_AP,

                     NM_SETTING_WIRELESS_MODE_ADHOC))

        return TRUE;

    /* Don't scan when the connection is locked to a specific AP, since

     * intra-ESS roaming (which requires periodic scanning) isn't being

     * used due to the specific AP lock. (bgo #513820)

     */

    if (nm_setting_wireless_get_bssid(s_wifi))

        return TRUE;

    /* Default to a very long bgscan interval when signal is OK on the assumption

     * that either (a) there aren't multiple APs and we don't need roaming, or

     * (b) since EAP/802.1x isn't used and thus there are fewer steps to fail

     * during a roam, we can wait longer before scanning for roam candidates.

     */

    bgscan = "simple:30:-70:86400";

    /* If using WPA Enterprise, Dynamic WEP or we have seen more than one AP use

     * a shorter bgscan interval on the assumption that this is a multi-AP ESS

     * in which we want more reliable roaming between APs. Thus trigger scans

     * when the signal is still somewhat OK so we have an up-to-date roam

     * candidate list when the signal gets bad.

     */

    if (nm_setting_wireless_get_num_seen_bssids(s_wifi) > 1

        || ((s_wsec = nm_connection_get_setting_wireless_security(connection))

            && NM_IN_STRSET(nm_setting_wireless_security_get_key_mgmt(s_wsec),

                            "ieee8021x",

                            "wpa-eap",

                            "wpa-eap-suite-b-192")))

        bgscan = "simple:30:-65:300";

    return nm_supplicant_config_add_option(self, "bgscan", bgscan, -1, FALSE, error);

}

static gboolean

add_string_val(NMSupplicantConfig *self,

               const char *        field,

               const char *        name,

               gboolean            ucase,

               const char *        hidden,

               GError **           error)

{

    if (field) {

        gs_free char *value = NULL;

        if (ucase) {

            value = g_ascii_strup(field, -1);

            field = value;

        }

        return nm_supplicant_config_add_option(self, name, field, strlen(field), hidden, error);

    }

    return TRUE;

}

#define ADD_STRING_LIST_VAL(self,                                                         \

                            setting,                                                      \

                            setting_name,                                                 \

                            field,                                                        \

                            field_plural,                                                 \

                            name,                                                         \

                            separator,                                                    \

                            ucase,                                                        \

                            hidden,                                                       \

                            error)                                                        \

    ({                                                                                    \

        typeof(*(setting)) *_setting = (setting);                                         \

        gboolean            _success = TRUE;                                              \

                                                                                          \

        if (nm_setting_##setting_name##_get_num_##field_plural(_setting)) {               \

            const char _separator = (separator);                                          \

            GString *  _str       = g_string_new(NULL);                                   \

            guint      _k, _n;                                                            \

                                                                                          \

            _n = nm_setting_##setting_name##_get_num_##field_plural(_setting);            \

            for (_k = 0; _k < _n; _k++) {                                                 \

                const char *item = nm_setting_##setting_name##_get_##field(_setting, _k); \

                                                                                          \

                if (!_str->len) {                                                         \

                    g_string_append(_str, item);                                          \

                } else {                                                                  \

                    g_string_append_c(_str, _separator);                                  \

                    g_string_append(_str, item);                                          \

                }                                                                         \

            }                                                                             \

            if ((ucase))                                                                  \

                g_string_ascii_up(_str);                                                  \

            if (_str->len) {                                                              \

                if (!nm_supplicant_config_add_option((self),                              \

                                                     (name),                              \

                                                     _str->str,                           \

                                                     -1,                                  \

                                                     (hidden),                            \

                                                     (error)))                            \

                    _success = FALSE;                                                     \

            }                                                                             \

            g_string_free(_str, TRUE);                                                    \

        }                                                                                 \

        _success;                                                                         \

    })

static void

wep128_passphrase_hash(const char *input, gsize input_len, guint8 *digest /* 13 bytes */)

{

    nm_auto_free_checksum GChecksum *sum = NULL;

    guint8                           md5[NM_UTILS_CHECKSUM_LENGTH_MD5];

    guint8                           data[64];

    int                              i;

    nm_assert(input);

    nm_assert(input_len);

    nm_assert(digest);

    /* Get at least 64 bytes by repeating the passphrase into the buffer */

    for (i = 0; i < sizeof(data); i++)

        data[i] = input[i % input_len];

    sum = g_checksum_new(G_CHECKSUM_MD5);

    g_checksum_update(sum, data, sizeof(data));

    nm_utils_checksum_get_digest(sum, md5);

    /* WEP104 keys are 13 bytes in length (26 hex characters) */

    memcpy(digest, md5, 13);

}

static gboolean

add_wep_key(NMSupplicantConfig *self,

            const char *        key,

            const char *        name,

            NMWepKeyType        wep_type,

            GError **           error)

{

    gsize key_len;

    if (!key || (key_len = strlen(key)) == 0)

        return TRUE;

    if (wep_type == NM_WEP_KEY_TYPE_UNKNOWN) {

        if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_KEY))

            wep_type = NM_WEP_KEY_TYPE_KEY;

        else if (nm_utils_wep_key_valid(key, NM_WEP_KEY_TYPE_PASSPHRASE))

            wep_type = NM_WEP_KEY_TYPE_PASSPHRASE;

    }

    if ((wep_type == NM_WEP_KEY_TYPE_UNKNOWN) || (wep_type == NM_WEP_KEY_TYPE_KEY)) {

        if ((key_len == 10) || (key_len == 26)) {

            guint8 buffer[26 / 2];

            if (!nm_utils_hexstr2bin_full(key,

                                          FALSE,

                                          FALSE,

                                          FALSE,

                                          NULL,

                                          key_len / 2,

                                          buffer,

                                          sizeof(buffer),

                                          NULL)) {

                g_set_error(error,

                            NM_SUPPLICANT_ERROR,

                            NM_SUPPLICANT_ERROR_CONFIG,

                            "cannot add wep-key %s to supplicant config because key is not hex",

                            name);

                return FALSE;

            }

            if (!nm_supplicant_config_add_option(self,

                                                 name,

                                                 (char *) buffer,

                                                 key_len / 2,

                                                 "<hidden>",

                                                 error))

                return FALSE;

        } else if ((key_len == 5) || (key_len == 13)) {

            if (!nm_supplicant_config_add_option(self, name, key, key_len, "<hidden>", error))

                return FALSE;

        } else {

            g_set_error(

                error,

                NM_SUPPLICANT_ERROR,

                NM_SUPPLICANT_ERROR_CONFIG,

                "Cannot add wep-key %s to supplicant config because key-length %u is invalid",

                name,

                (guint) key_len);

            return FALSE;

        }

    } else if (wep_type == NM_WEP_KEY_TYPE_PASSPHRASE) {

        guint8 digest[13];

        wep128_passphrase_hash(key, key_len, digest);

        if (!nm_supplicant_config_add_option(self,

                                             name,

                                             (const char *) digest,

                                             sizeof(digest),

                                             "<hidden>",

                                             error))

            return FALSE;

    }

    return TRUE;

}

gboolean

nm_supplicant_config_add_setting_wireless_security(NMSupplicantConfig *          self,

                                                   NMSettingWirelessSecurity *   setting,

                                                   NMSetting8021x *              setting_8021x,

                                                   const char *                  con_uuid,

                                                   guint32                       mtu,

                                                   NMSettingWirelessSecurityPmf  pmf,

                                                   NMSettingWirelessSecurityFils fils,

                                                   GError **                     error)

{

    NMSupplicantConfigPrivate *priv             = NM_SUPPLICANT_CONFIG_GET_PRIVATE(self);

    nm_auto_free_gstring GString *key_mgmt_conf = NULL;

    const char *                  key_mgmt, *auth_alg;

    const char *                  psk;

    gboolean                      set_pmf;

    g_return_val_if_fail(NM_IS_SUPPLICANT_CONFIG(self), FALSE);

    g_return_val_if_fail(setting != NULL, FALSE);

    g_return_val_if_fail(con_uuid != NULL, FALSE);

    g_return_val_if_fail(!error || !*error, FALSE);

    /* Check if we actually support FILS */

    if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_FILS)) {

        if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED) {

            g_set_error_literal(error,

                                NM_SUPPLICANT_ERROR,

                                NM_SUPPLICANT_ERROR_CONFIG,

                                "Supplicant does not support FILS");

            return FALSE;

        } else if (fils == NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL)

            fils = NM_SETTING_WIRELESS_SECURITY_FILS_DISABLE;

    }

    key_mgmt      = nm_setting_wireless_security_get_key_mgmt(setting);

    key_mgmt_conf = g_string_new(key_mgmt);

    if (nm_streq(key_mgmt, "wpa-psk")) {

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))

            g_string_append(key_mgmt_conf, " wpa-psk-sha256");

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))

            g_string_append(key_mgmt_conf, " ft-psk");

    } else if (nm_streq(key_mgmt, "wpa-eap")) {

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)) {

            g_string_append(key_mgmt_conf, " wpa-eap-sha256");

            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_SUITEB192)

                && pmf == NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED)

                g_string_append(key_mgmt_conf, " wpa-eap-suite-b-192");

        }

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))

            g_string_append(key_mgmt_conf, " ft-eap");

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT)

            && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))

            g_string_append(key_mgmt_conf, " ft-eap-sha384");

        switch (fils) {

        case NM_SETTING_WIRELESS_SECURITY_FILS_REQUIRED:

            g_string_truncate(key_mgmt_conf, 0);

            if (!_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))

                g_string_assign(key_mgmt_conf, "fils-sha256 fils-sha384");

            /* fall-through */

        case NM_SETTING_WIRELESS_SECURITY_FILS_OPTIONAL:

            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF))

                g_string_append(key_mgmt_conf, " fils-sha256 fils-sha384");

            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)

                && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT))

                g_string_append(key_mgmt_conf, " ft-fils-sha256");

            if (_get_capability(priv, NM_SUPPL_CAP_TYPE_PMF)

                && _get_capability(priv, NM_SUPPL_CAP_TYPE_FT)

                && _get_capability(priv, NM_SUPPL_CAP_TYPE_SHA384))

                g_string_append(key_mgmt_conf, " ft-fils-sha384");

            break;

        default:

            break;

        }

    } else if (nm_streq(key_mgmt, "sae")) {

        if (_get_capability(priv, NM_SUPPL_CAP_TYPE_FT))

            g_string_append(key_mgmt_conf, " ft-sae");

    } else if (nm_streq(key_mgmt, "wpa-eap-suite-b-192")) {

        pmf = NM_SETTING_WIRELESS_SECURITY_PMF_REQUIRED;

        if (!nm_supplicant_config_add_option(self, "pairwise", "GCMP-256", -1, NULL, error)

            || !nm_supplicant_config_add_option(self, "group", "GCMP-256", -1, NULL, error))

            return FALSE;

    }

    if (!add_string_val(self, key_mgmt_conf->str, "key_mgmt", TRUE, NULL, error))

        return FALSE;