Unverified Commit 8b93a430 authored by Michele Guerini Rocco's avatar Michele Guerini Rocco Committed by GitHub
Browse files

Merge pull request #305689 from rnhmjoj/pr-fix-wpa-secrets 

nixos/wireless: correctly handle secrets containing &
parents 23fc571c 89a1bde0

nixos/modules/services/networking/wpa_supplicant.nix

+6 −2
Original line number Diff line number Diff line
@@ -132,8 +132,12 @@ let 
        # substitute environment variables

        if [ -f "${configFile}" ]; then

          ${pkgs.gawk}/bin/awk '{

            for(varname in ENVIRON)

              gsub("@"varname"@", ENVIRON[varname])

            for(varname in ENVIRON) {

              find = "@"varname"@"

              repl = ENVIRON[varname]

              if (i = index($0, find))

                $0 = substr($0, 1, i-1) repl substr($0, i+length(find))

            }

            print

          }' "${configFile}" > "${finalConfig}"

        else

nixos/tests/wpa_supplicant.nix

+4 −1
Original line number Diff line number Diff line
@@ -102,13 +102,15 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: 
          test2.psk = "@PSK_SPECIAL@";            # should be replaced

          test3.psk = "@PSK_MISSING@";            # should not be replaced

          test4.psk = "P@ssowrdWithSome@tSymbol"; # should not be replaced

          test5.psk = "@PSK_AWK_REGEX@";          # should be replaced

        };



        # secrets

        environmentFile = pkgs.writeText "wpa-secrets" ''

          PSK_VALID="S0m3BadP4ssw0rd";

          # taken from https://github.com/minimaxir/big-list-of-naughty-strings

          PSK_SPECIAL=",./;'[]\-= <>?:\"{}|_+ !@#$%^\&*()`~";

          PSK_SPECIAL=",./;'[]\/\-= <>?:\"{}|_+ !@#$%^&*()`~";

          PSK_AWK_REGEX="PassowrdWith&symbol";

        '';

      };

    };
@@ -186,6 +188,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...}: 
          basic.fail(f"grep -q @PSK_SPECIAL@ {config_file}")

          basic.succeed(f"grep -q @PSK_MISSING@ {config_file}")

          basic.succeed(f"grep -q P@ssowrdWithSome@tSymbol {config_file}")

          basic.succeed(f"grep -q 'PassowrdWith&symbol' {config_file}")



      with subtest("WPA2 fallbacks have been generated"):

          assert int(basic.succeed(f"grep -c sae-only {config_file}")) == 1