Skip to content
  • Thomas Haller's avatar
    ifcfg-rh: don't use 802-1x certifcate setter functions · e3ac45c0
    Thomas Haller authored
    The certificate setter function like nm_setting_802_1x_set_ca_cert()
    actually load the file from disk, and validate whether it is a valid
    certificate. That is very wrong to do.
    
    For one, the certificates are external files, which are not embedded
    into the NMConnection. That means, strongly validating the files while
    loading the ifcfg files, is wrong because:
     - if validation fails, loading the file fails in its entirety with
       a warning in the log. That is not helpful to the user, who now
       can no longer use nmcli to fix the path of the certificate (because
       the profile failed to load in the first place).
     - even if the certificate is valid at load-time, there is no guarantee
       that it is valid later on, when we actually try to use the file. What
       good does such a validation do? nm_setting_802_1x_set_ca_cert() might
       make sense during nmcli_connection_modify(). At the moment when we
       create or update the profile, we do want to validate the ...
    e3ac45c0