supplicant: allow with_system_ca_path to be a file name (rh #1236548)
authorJiří Klimeš <jklimes@redhat.com>
Wed, 1 Jul 2015 12:11:12 +0000 (14:11 +0200)
committerJiří Klimeš <jklimes@redhat.com>
Wed, 8 Jul 2015 15:07:02 +0000 (17:07 +0200)
commit640eb8f28418596e585cee826a31f8ec2929e03f
treebd5c3a13e0290af531125069dcdbd1a87d4b70d8
parent43a50fd5f21018e3e02d7e8e73dae5d2f3e278f5
supplicant: allow with_system_ca_path to be a file name (rh #1236548)

NetworkManager uses wpa_supplicant, which in turn calls OpenSSL for verifying
certificates. wpa_supplicant calls
SSL_CTX_load_verify_locations(ctx, CAfile, CApath)
using its ca_cert and ca_path options as CAfile and CApath parameters.

We have a configure time option with_system_ca_path to override ca_path.
However, it doesn't work when a system (like Fedora) only uses bundled PEM
certificates instead of a directory with hashed certificates ([1], [2]).

So this commit allows setting --with_system_ca_path to a file name (the
trusted certificate bundle). Then the name is used to populate wpa_supplicant's
ca_cert instead of ca_path.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1053882
[2] https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/

https://bugzilla.redhat.com/show_bug.cgi?id=1236548
contrib/fedora/rpm/NetworkManager.spec
libnm-core/nm-setting-8021x.c
src/supplicant-manager/nm-supplicant-config.c