Share a Wi-Fi network by QR code
GNOME's Wi-Fi panel has this and it is the most-used thing in it: the alternative is reading a passphrase out loud. Network & Devices now shows a scannable code for any saved network whose passphrase this user can read. The image contains the network password in machine-readable form, so most of the care here is about that rather than about QR codes. It is written under XDG_RUNTIME_DIR -- 0700, on tmpfs, gone at logout -- rather than /tmp, which is shared; the file is 0600; the passphrase is piped to qrencode on stdin rather than passed as an argument, because argv is world-readable through /proc for as long as the process runs; and it is never printed or included in an error message. Generated on demand, because producing a code for every saved network up front means writing images of passwords nobody asked to see. Enterprise networks are listed as not shareable rather than offered and broken: there is no passphrase to encode, so the code could not work. Two bugs the contract caught while being written. Semicolons in an SSID were not escaped -- the sed replacement had one backslash where its four neighbours have two, so sed dropped it, and an SSID containing a semicolon would have produced a QR code describing a different network. And nmcli's trailing newline landed inside the payload; it decoded here, but a newline in the middle of a WIFI: URI is not something every phone tolerates, and that failure would present as "the QR code just doesn't work on my phone". The contract stubs nmcli and qrencode, because the real ones would write this machine's actual Wi-Fi password into a fixture directory. It asserts the escaping, the absence of a newline, the file and directory modes, that no temporary payload survives, and that the passphrase never reaches argv. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L
This commit is contained in:
Gabriel Brown
Executable
+126
@@ -0,0 +1,126 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# panama-wifi-qr renders a saved network as a QR code a phone can scan.
|
||||
#
|
||||
# The QR contains the network PASSWORD in machine-readable form, so most of what
|
||||
# is worth testing here is about handling that safely rather than about QR
|
||||
# codes. Both nmcli and qrencode are stubbed: the real ones would read this
|
||||
# machine's actual passphrases, and a test that writes the daily driver's Wi-Fi
|
||||
# password into a fixture directory is not one worth having.
|
||||
|
||||
set -uo pipefail
|
||||
|
||||
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
||||
helper="$repo_dir/config/dot/quickshell/scripts/panama-wifi-qr"
|
||||
|
||||
fail() {
|
||||
printf 'wifi qr contract: %s\n' "$1" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
work="$(mktemp -d /tmp/panama-wifiqr.XXXXXX)"
|
||||
trap 'rm -rf "$work"' EXIT
|
||||
mkdir -p "$work/bin" "$work/run"
|
||||
|
||||
readonly SECRET='hunter2-secret'
|
||||
|
||||
cat >"$work/bin/nmcli" <<STUB
|
||||
#!/usr/bin/env bash
|
||||
# -t -f NAME,TYPE connection show
|
||||
if [[ "\$*" == *"-f NAME,TYPE"* ]]; then
|
||||
printf 'home net:802-11-wireless\n'
|
||||
printf 'work-eap:802-11-wireless\n'
|
||||
printf 'Wired connection 1:802-3-ethernet\n'
|
||||
exit 0
|
||||
fi
|
||||
name="\${@: -1}"
|
||||
case "\$*" in
|
||||
*802-11-wireless.ssid*)
|
||||
# An SSID containing reserved characters, to prove they are escaped.
|
||||
case "\$name" in
|
||||
"home net") printf 'home;net\n' ;;
|
||||
"work-eap") printf 'work-eap\n' ;;
|
||||
esac ;;
|
||||
*802-11-wireless.hidden*) printf 'no\n' ;;
|
||||
*802-11-wireless-security.psk*)
|
||||
# work-eap is enterprise: no passphrase exists to share.
|
||||
[[ "\$name" == "home net" ]] && printf '%s\n' "$SECRET" ;;
|
||||
esac
|
||||
exit 0
|
||||
STUB
|
||||
chmod +x "$work/bin/nmcli"
|
||||
|
||||
# Records its argv and its stdin separately, so the test can prove the secret
|
||||
# arrived on stdin and never on the command line -- argv is world-readable
|
||||
# through /proc while a process runs.
|
||||
cat >"$work/bin/qrencode" <<'STUB'
|
||||
#!/usr/bin/env bash
|
||||
printf '%s\n' "$*" >>"$QRENCODE_ARGV_LOG"
|
||||
out=""
|
||||
prev=""
|
||||
for arg in "$@"; do
|
||||
[[ "$prev" == "-o" ]] && out="$arg"
|
||||
prev="$arg"
|
||||
done
|
||||
cat >"$QRENCODE_STDIN_LOG"
|
||||
printf 'fake-png' >"$out"
|
||||
exit 0
|
||||
STUB
|
||||
chmod +x "$work/bin/qrencode"
|
||||
|
||||
export QRENCODE_ARGV_LOG="$work/argv.log"
|
||||
export QRENCODE_STDIN_LOG="$work/stdin.log"
|
||||
: >"$QRENCODE_ARGV_LOG"
|
||||
: >"$QRENCODE_STDIN_LOG"
|
||||
|
||||
run() { PATH="$work/bin:$PATH" XDG_RUNTIME_DIR="$work/run" "$helper" "$@"; }
|
||||
|
||||
# ── Listing distinguishes shareable from not ────────────────────────────────
|
||||
out="$(run list)"
|
||||
jq -e . >/dev/null 2>&1 <<<"$out" || fail "list did not emit JSON: $out"
|
||||
[[ "$(jq -r '.networks | length' <<<"$out")" == "2" ]] \
|
||||
|| fail "only wireless connections belong in the list: $out"
|
||||
jq -e '.networks[] | select(.name == "home net") | .shareable == true' >/dev/null <<<"$out" \
|
||||
|| fail "a network with a passphrase must be shareable: $out"
|
||||
jq -e '.networks[] | select(.name == "work-eap") | .shareable == false' >/dev/null <<<"$out" \
|
||||
|| fail "an enterprise network has no passphrase, so a QR code for it cannot work: $out"
|
||||
|
||||
# ── The payload ─────────────────────────────────────────────────────────────
|
||||
path="$(run qr 'home net' | jq -r .path)"
|
||||
[[ -n "$path" && -e "$path" ]] || fail 'no image was produced'
|
||||
|
||||
payload="$(cat "$QRENCODE_STDIN_LOG")"
|
||||
grep -q "P:$SECRET;" <<<"$payload" \
|
||||
|| fail 'the passphrase did not reach the payload intact'
|
||||
|
||||
# The SSID is "home;net": unescaped, the semicolon ends the S: field early and
|
||||
# the code describes a different network.
|
||||
grep -qF 'S:home\;net;' <<<"$payload" \
|
||||
|| fail "a reserved character in the SSID was not escaped: $payload"
|
||||
|
||||
[[ "$(wc -l <"$QRENCODE_STDIN_LOG")" == "0" ]] \
|
||||
|| fail "the payload contains a newline; nmcli's trailing newline must be stripped: $(cat -A "$QRENCODE_STDIN_LOG")"
|
||||
|
||||
grep -q ';;$' <<<"$payload" || fail "the WIFI: URI must be terminated with ;;: $payload"
|
||||
|
||||
# ── The secret must never appear in argv ────────────────────────────────────
|
||||
grep -q "$SECRET" "$QRENCODE_ARGV_LOG" \
|
||||
&& fail 'the passphrase was passed as a command-line argument, where /proc exposes it to every process on the machine'
|
||||
|
||||
# ── The image and its directory must not be readable by others ──────────────
|
||||
[[ "$(stat -c '%a' "$path")" == "600" ]] \
|
||||
|| fail "the QR image is mode $(stat -c '%a' "$path"); it contains a password"
|
||||
[[ "$(stat -c '%a' "$(dirname "$path")")" == "700" ]] \
|
||||
|| fail "the directory holding QR images is mode $(stat -c '%a' "$(dirname "$path")")"
|
||||
|
||||
# ── No temporary payload files may survive ──────────────────────────────────
|
||||
leftovers="$(find "$work/run" -name 'payload.*' | wc -l)"
|
||||
[[ "$leftovers" == "0" ]] \
|
||||
|| fail "$leftovers temporary payload file(s) containing the passphrase were left behind"
|
||||
|
||||
# ── An unknown network is an error, not an empty image ──────────────────────
|
||||
out="$(run qr 'no-such-network')"
|
||||
jq -e '.path == "" and .error != ""' >/dev/null <<<"$out" \
|
||||
|| fail "an unknown network must be reported: $out"
|
||||
|
||||
printf 'wifi qr contract: PASS\n'
|
||||
Reference in New Issue
Block a user