Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(web2): 802.1x CA cert should not be "Optional" #5092

Closed
wants to merge 5 commits into from

Conversation

mattdibi
Copy link
Contributor

@mattdibi mattdibi commented Jan 10, 2024

Brief description: CA cert parameter was wrongly set as "Optional". This PR removes the "Optional" qualifier from the UI and adds some additional UI validation so that the parameter is not left blank.

Background: When submitting a configuration for the 802.1x tab and the Certificate Authority Certificate is not set, the following error is thrown:

2024-01-08T11:20:26,100 [ConfigurationListener Event Queue] ERROR o.e.k.n.c.NMConfigurationServiceImpl - Unable to decode key/certificate net.interface.wlan0.config.802-1x.ca-cert-name from keystore.
org.eclipse.kura.KuraException: Configuration Error: Certificate "" is not of the expected key type or not found.
	at org.eclipse.kura.nm.configuration.NMConfigurationServiceImpl.getTrustedCertificateFromKeystore(NMConfigurationServiceImpl.java:382)
	at org.eclipse.kura.nm.configuration.NMConfigurationServiceImpl.findAndDecodeCertificatesForInterface(NMConfigurationServiceImpl.java:358)
	at org.eclipse.kura.nm.configuration.NMConfigurationServiceImpl.lambda$0(NMConfigurationServiceImpl.java:329)
	at java.base/java.lang.Iterable.forEach(Iterable.java:75)
	at org.eclipse.kura.nm.configuration.NMConfigurationServiceImpl.decryptAndConvertCertificatesProperties(NMConfigurationServiceImpl.java:320)
	at org.eclipse.kura.nm.configuration.NMConfigurationServiceImpl.update(NMConfigurationServiceImpl.java:242)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at org.apache.felix.scr.impl.inject.methods.BaseMethod.invokeMethod(BaseMethod.java:228)
	at org.apache.felix.scr.impl.inject.methods.BaseMethod.access$500(BaseMethod.java:41)
	at org.apache.felix.scr.impl.inject.methods.BaseMethod$Resolved.invoke(BaseMethod.java:664)
	at org.apache.felix.scr.impl.inject.methods.BaseMethod.invoke(BaseMethod.java:510)
	at org.apache.felix.scr.impl.inject.methods.ActivateMethod.invoke(ActivateMethod.java:317)
	at org.apache.felix.scr.impl.inject.methods.ActivateMethod.invoke(ActivateMethod.java:307)
	at org.apache.felix.scr.impl.manager.SingleComponentManager.invokeModifiedMethod(SingleComponentManager.java:836)
	at org.apache.felix.scr.impl.manager.SingleComponentManager.modify(SingleComponentManager.java:791)
	at org.apache.felix.scr.impl.manager.SingleComponentManager.reconfigure(SingleComponentManager.java:709)
	at org.apache.felix.scr.impl.manager.SingleComponentManager.reconfigure(SingleComponentManager.java:673)
	at org.apache.felix.scr.impl.manager.ConfigurableComponentHolder.configurationUpdated(ConfigurableComponentHolder.java:435)
	at org.apache.felix.scr.impl.manager.RegionConfigurationSupport.configurationEvent(RegionConfigurationSupport.java:316)
	at org.apache.felix.scr.impl.manager.RegionConfigurationSupport$2.configurationEvent(RegionConfigurationSupport.java:118)
	at org.eclipse.equinox.internal.cm.EventDispatcher$1.run(EventDispatcher.java:92)
	at org.eclipse.equinox.internal.cm.SerializedTaskQueue$1.run(SerializedTaskQueue.java:40)

The error is due to a wrong implementation of the Certificate decryption stage in the NMConfigurationServiceImpl.

In the findAndDecodeCertificatesForInterface, the case in which the ca-cert-name is an empty string, was not taken into account. Leaving the field blank falls into this case and result in the error reported.

According to the NM documentation, the property can be unset but it is recommended to set a CA cert for security reasons

This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks andis NOT recommended.

We decided to follow our "secure by default" policy and have the parameter mandatory. This PR updates the code to enforce that in our Web UI.

This PR supersedes #5088 by only focusing on the Web UI

@mattdibi
Copy link
Contributor Author

Superseded by #5096

@mattdibi mattdibi closed this Jan 11, 2024
@mattdibi mattdibi deleted the fix/web2_ca_cert_validation branch October 2, 2024 08:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant