Files
NetworkManager/tui/nmt-secret-agent.c
2014-01-16 14:54:39 -05:00

647 lines
22 KiB
C

/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
/*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Copyright 2011-2013 Red Hat, Inc.
* Copyright 2011 Giovanni Campagna <scampa.giovanni@gmail.com>
*/
/**
* SECTION:nmt-secret-agent
* @short_description: A secret agent
*
* #NmtSecretAgent is the secret agent used by nmtui-connect.
*
* This is a stripped-down version of gnome-shell's ShellNetworkAgent,
* with bits of the corresponding JavaScript code squished down into
* it. It is intended to eventually be generic enough that it could
* replace ShellNetworkAgent.
*/
#include "config.h"
#include <string.h>
#include <dbus/dbus-glib.h>
#include <glib/gi18n-lib.h>
#include <nm-utils.h>
#include "nmt-secret-agent.h"
#include "nmt-newt.h"
G_DEFINE_TYPE (NmtSecretAgent, nmt_secret_agent, NM_TYPE_SECRET_AGENT)
#define NMT_SECRET_AGENT_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NMT_TYPE_SECRET_AGENT, NmtSecretAgentPrivate))
enum {
REQUEST_SECRETS,
LAST_SIGNAL
};
static guint signals[LAST_SIGNAL] = { 0 };
typedef struct {
NmtSecretAgent *self;
gchar *request_id;
NMConnection *connection;
gchar **hints;
NMSecretAgentGetSecretsFunc callback;
gpointer callback_data;
} NmtSecretAgentRequest;
typedef struct {
/* <char *request_id, NmtSecretAgentRequest *request> */
GHashTable *requests;
} NmtSecretAgentPrivate;
static void
nmt_secret_agent_request_free (gpointer data)
{
NmtSecretAgentRequest *request = data;
g_object_unref (request->self);
g_object_unref (request->connection);
g_strfreev (request->hints);
g_slice_free (NmtSecretAgentRequest, request);
}
static void
nmt_secret_agent_init (NmtSecretAgent *agent)
{
NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (agent);
priv->requests = g_hash_table_new_full (g_str_hash, g_str_equal,
g_free, nmt_secret_agent_request_free);
}
static void
nmt_secret_agent_finalize (GObject *object)
{
NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (object);
GError *error;
GHashTableIter iter;
gpointer key;
gpointer value;
error = g_error_new (NM_SECRET_AGENT_ERROR,
NM_SECRET_AGENT_ERROR_AGENT_CANCELED,
"The secret agent is going away");
g_hash_table_iter_init (&iter, priv->requests);
while (g_hash_table_iter_next (&iter, &key, &value)) {
NmtSecretAgentRequest *request = value;
request->callback (NM_SECRET_AGENT (object),
request->connection,
NULL, error,
request->callback_data);
}
g_hash_table_destroy (priv->requests);
g_error_free (error);
G_OBJECT_CLASS (nmt_secret_agent_parent_class)->finalize (object);
}
static gboolean
strv_has (gchar **haystack,
gchar *needle)
{
gchar *iter;
for (iter = *haystack; iter; iter++) {
if (g_strcmp0 (iter, needle) == 0)
return TRUE;
}
return FALSE;
}
/**
* NmtSecretAgentSecret:
* @name: the user-visible name of the secret. Eg, "WEP Passphrase".
* @value: the value of the secret
* @password: %TRUE if this secret represents a password, %FALSE
* if it represents non-secret data.
*
* A single "secret" being requested.
*/
typedef struct {
NmtSecretAgentSecret base;
NMSetting *setting;
char *property;
NmtNewtEntryValidator validator;
gpointer validator_data;
} NmtSecretAgentSecretReal;
static void
nmt_secret_agent_secret_free (NmtSecretAgentSecret *secret)
{
NmtSecretAgentSecretReal *real = (NmtSecretAgentSecretReal *)secret;
g_free (secret->name);
g_free (secret->value);
g_free (real->property);
g_clear_object (&real->setting);
g_slice_free (NmtSecretAgentSecretReal, real);
}
static NmtSecretAgentSecret *
nmt_secret_agent_secret_new (const char *name,
NMSetting *setting,
const char *property,
gboolean password)
{
NmtSecretAgentSecretReal *real;
real = g_slice_new0 (NmtSecretAgentSecretReal);
real->base.name = g_strdup (name);
real->base.password = password;
if (setting) {
real->setting = g_object_ref (setting);
real->property = g_strdup (property);
g_object_get (setting, property, &real->base.value, NULL);
}
return &real->base;
}
static gboolean
add_8021x_secrets (NmtSecretAgentRequest *request,
GPtrArray *secrets)
{
NMSetting8021x *s_8021x = nm_connection_get_setting_802_1x (request->connection);
const char *eap_method;
NmtSecretAgentSecret *secret;
eap_method = nm_setting_802_1x_get_eap_method (s_8021x, 0);
if (!eap_method)
return FALSE;
if ( !strcmp (eap_method, "md5")
|| !strcmp (eap_method, "leap")
|| !strcmp (eap_method, "ttls")
|| !strcmp (eap_method, "peap")) {
/* TTLS and PEAP are actually much more complicated, but this complication
* is not visible here since we only care about phase2 authentication
* (and don't even care of which one)
*/
secret = nmt_secret_agent_secret_new (_("Username"),
NM_SETTING (s_8021x),
NM_SETTING_802_1X_IDENTITY,
FALSE);
g_ptr_array_add (secrets, secret);
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_8021x),
NM_SETTING_802_1X_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
return TRUE;
}
if (!strcmp (eap_method, "tls")) {
secret = nmt_secret_agent_secret_new (_("Identity"),
NM_SETTING (s_8021x),
NM_SETTING_802_1X_IDENTITY,
FALSE);
g_ptr_array_add (secrets, secret);
secret = nmt_secret_agent_secret_new (_("Private key password"),
NM_SETTING (s_8021x),
NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
return TRUE;
}
return FALSE;
}
static gboolean
add_wireless_secrets (NmtSecretAgentRequest *request,
GPtrArray *secrets)
{
NMSettingWirelessSecurity *s_wsec = nm_connection_get_setting_wireless_security (request->connection);
const char *key_mgmt = nm_setting_wireless_security_get_key_mgmt (s_wsec);
NmtSecretAgentSecret *secret;
if (!key_mgmt)
return FALSE;
if (!strcmp (key_mgmt, "wpa-none") || !strcmp (key_mgmt, "wpa-psk")) {
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_wsec),
NM_SETTING_WIRELESS_SECURITY_PSK,
TRUE);
g_ptr_array_add (secrets, secret);
return TRUE;
}
if (!strcmp (key_mgmt, "none")) {
int index;
char *key;
index = nm_setting_wireless_security_get_wep_tx_keyidx (s_wsec);
key = g_strdup_printf ("wep-key%d", index);
secret = nmt_secret_agent_secret_new (_("Key"),
NM_SETTING (s_wsec),
key,
TRUE);
g_free (key);
#if 0
nmt_secret_agent_secret_set_validator (secret, static_wep_key_validate,
nm_setting_wireless_security_get_wep_key_type (s_wsec));
#endif
g_ptr_array_add (secrets, secret);
return TRUE;
}
if (!strcmp (key_mgmt, "iee8021x")) {
if (!g_strcmp0 (nm_setting_wireless_security_get_auth_alg (s_wsec), "leap")) {
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_wsec),
NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
return TRUE;
} else
return add_8021x_secrets (request, secrets);
}
if (!strcmp (key_mgmt, "wpa-eap"))
return add_8021x_secrets (request, secrets);
return FALSE;
}
static gboolean
add_pppoe_secrets (NmtSecretAgentRequest *request,
GPtrArray *secrets)
{
NMSettingPPPOE *s_pppoe = nm_connection_get_setting_pppoe (request->connection);
NmtSecretAgentSecret *secret;
secret = nmt_secret_agent_secret_new (_("Username"),
NM_SETTING (s_pppoe),
NM_SETTING_PPPOE_USERNAME,
FALSE);
g_ptr_array_add (secrets, secret);
secret = nmt_secret_agent_secret_new (_("Service"),
NM_SETTING (s_pppoe),
NM_SETTING_PPPOE_SERVICE,
FALSE);
g_ptr_array_add (secrets, secret);
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_pppoe),
NM_SETTING_PPPOE_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
return TRUE;
}
static void
request_secrets_from_ui (NmtSecretAgentRequest *request)
{
GPtrArray *secrets;
NmtSecretAgentSecret *secret;
const char *title;
char *msg;
gboolean ok = TRUE;
secrets = g_ptr_array_new_with_free_func ((GDestroyNotify) nmt_secret_agent_secret_free);
if (nm_connection_is_type (request->connection, NM_SETTING_WIRELESS_SETTING_NAME)) {
NMSettingWireless *s_wireless;
char *ssid;
s_wireless = nm_connection_get_setting_wireless (request->connection);
ssid = nm_utils_ssid_to_utf8 (nm_setting_wireless_get_ssid (s_wireless));
title = _("Authentication required by wireless network");
msg = g_strdup_printf (_("Passwords or encryption keys are required to access the wireless network '%s'."), ssid);
ok = add_wireless_secrets (request, secrets);
} else if (nm_connection_is_type (request->connection, NM_SETTING_WIRED_SETTING_NAME)) {
NMSettingConnection *s_con;
s_con = nm_connection_get_setting_connection (request->connection);
title = _("Wired 802.1X authentication");
msg = NULL;
secret = nmt_secret_agent_secret_new (_("Network name"),
NM_SETTING (s_con),
NM_SETTING_CONNECTION_ID,
FALSE);
g_ptr_array_add (secrets, secret);
ok = add_8021x_secrets (request, secrets);
} else if (nm_connection_is_type (request->connection, NM_SETTING_PPPOE_SETTING_NAME)) {
title = _("DSL authentication");
msg = NULL;
ok = add_pppoe_secrets (request, secrets);
} else if (nm_connection_is_type (request->connection, NM_SETTING_GSM_SETTING_NAME)) {
NMSettingGsm *s_gsm = nm_connection_get_setting_gsm (request->connection);
if (strv_has (request->hints, "pin")) {
title = _("PIN code required");
msg = g_strdup (_("PIN code is needed for the mobile broadband device"));
secret = nmt_secret_agent_secret_new (_("PIN"),
NM_SETTING (s_gsm),
NM_SETTING_GSM_PIN,
FALSE);
g_ptr_array_add (secrets, secret);
} else {
title = _("Mobile broadband network password");
msg = g_strdup_printf (_("A password is required to connect to '%s'."),
nm_connection_get_id (request->connection));
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_gsm),
NM_SETTING_GSM_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
}
} else if (nm_connection_is_type (request->connection, NM_SETTING_CDMA_SETTING_NAME)) {
NMSettingCdma *s_cdma = nm_connection_get_setting_cdma (request->connection);
title = _("Mobile broadband network password");
msg = g_strdup_printf (_("A password is required to connect to '%s'."),
nm_connection_get_id (request->connection));
secret = nmt_secret_agent_secret_new (_("Password"),
NM_SETTING (s_cdma),
NM_SETTING_CDMA_PASSWORD,
TRUE);
g_ptr_array_add (secrets, secret);
} else if (nm_connection_is_type (request->connection, NM_SETTING_BLUETOOTH_SETTING_NAME)) {
NMSetting *setting;
setting = nm_connection_get_setting_by_name (request->connection, NM_SETTING_GSM_SETTING_NAME);
if (!setting)
setting = nm_connection_get_setting_by_name (request->connection, NM_SETTING_CDMA_SETTING_NAME);
title = _("Mobile broadband network password");
msg = g_strdup_printf (_("A password is required to connect to '%s'."),
nm_connection_get_id (request->connection));
secret = nmt_secret_agent_secret_new (_("Password"),
setting,
"password",
TRUE);
g_ptr_array_add (secrets, secret);
} else
ok = FALSE;
if (!ok) {
g_ptr_array_unref (secrets);
return;
}
g_signal_emit (request->self, signals[REQUEST_SECRETS], 0,
request->request_id, title, msg, secrets);
}
static void
nmt_secret_agent_get_secrets (NMSecretAgent *agent,
NMConnection *connection,
const gchar *connection_path,
const gchar *setting_name,
const gchar **hints,
NMSecretAgentGetSecretsFlags flags,
NMSecretAgentGetSecretsFunc callback,
gpointer callback_data)
{
NmtSecretAgent *self = NMT_SECRET_AGENT (agent);
NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (self);
NmtSecretAgentRequest *request;
NMSettingConnection *s_con;
const char *connection_type;
char *request_id;
GError *error;
request_id = g_strdup_printf ("%s/%s", connection_path, setting_name);
if (g_hash_table_lookup (priv->requests, request_id) != NULL) {
/* We already have a request pending for this (connection, setting) */
error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_INTERNAL_ERROR,
"Request for %s secrets already pending", request_id);
nope:
callback (agent, connection, NULL, error, callback_data);
g_error_free (error);
g_free (request_id);
return;
}
s_con = nm_connection_get_setting_connection (connection);
connection_type = nm_setting_connection_get_connection_type (s_con);
if (!strcmp (connection_type, NM_SETTING_VPN_SETTING_NAME)) {
/* We don't support VPN secrets yet */
error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_NO_SECRETS,
"VPN secrets not supported");
goto nope;
}
if (!(flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION)) {
/* We don't do stored passwords */
error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_NO_SECRETS,
"Stored passwords not supported");
goto nope;
}
request = g_slice_new (NmtSecretAgentRequest);
request->self = g_object_ref (self);
request->connection = g_object_ref (connection);
request->hints = g_strdupv ((gchar **)hints);
request->callback = callback;
request->callback_data = callback_data;
request->request_id = request_id;
g_hash_table_replace (priv->requests, request->request_id, request);
request_secrets_from_ui (request);
}
static void
gvalue_destroy_notify (gpointer data)
{
GValue *value = data;
g_value_unset (value);
g_slice_free (GValue, value);
}
/**
* nmt_secret_agent_response:
* @self: the #NmtSecretAgent
* @request_id: the request ID being responded to
* @secrets: (allow-none): the array of secrets, or %NULL
*
* Response to a #NmtSecretAgent::get-secrets signal.
*
* If the user provided secrets, the caller should set the
* corresponding <literal>value</literal> fields in the
* #NmtSecretAgentSecrets (freeing any initial values they had), and
* pass the array to nmt_secret_agent_response(). If the user
* cancelled the request, @secrets should be NULL.
*/
void
nmt_secret_agent_response (NmtSecretAgent *self,
const char *request_id,
GPtrArray *secrets)
{
NmtSecretAgentPrivate *priv;
NmtSecretAgentRequest *request;
GHashTable *hash = NULL, *setting_hash;
GValue *value;
GError *error = NULL;
int i;
g_return_if_fail (NMT_IS_SECRET_AGENT (self));
priv = NMT_SECRET_AGENT_GET_PRIVATE (self);
request = g_hash_table_lookup (priv->requests, request_id);
g_return_if_fail (request != NULL);
if (secrets) {
hash = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_hash_table_unref);
for (i = 0; i < secrets->len; i++) {
NmtSecretAgentSecretReal *secret = secrets->pdata[i];
setting_hash = g_hash_table_lookup (hash, nm_setting_get_name (secret->setting));
if (!setting_hash) {
setting_hash = g_hash_table_new_full (g_str_hash, g_str_equal,
g_free, gvalue_destroy_notify);
g_hash_table_insert (hash, (char *)nm_setting_get_name (secret->setting),
setting_hash);
}
value = g_slice_new0 (GValue);
g_value_init (value, G_TYPE_STRING);
g_value_set_string (value, secret->base.value);
g_hash_table_insert (setting_hash, g_strdup (secret->property), value);
}
} else {
error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_USER_CANCELED,
"User cancelled");
}
request->callback (NM_SECRET_AGENT (self), request->connection, hash, error, request->callback_data);
g_clear_pointer (&hash, g_hash_table_unref);
g_clear_error (&error);
g_hash_table_remove (priv->requests, request_id);
}
static void
nmt_secret_agent_cancel_get_secrets (NMSecretAgent *agent,
const gchar *connection_path,
const gchar *setting_name)
{
/* We don't support cancellation. Sorry! */
}
static void
nmt_secret_agent_save_secrets (NMSecretAgent *agent,
NMConnection *connection,
const gchar *connection_path,
NMSecretAgentSaveSecretsFunc callback,
gpointer callback_data)
{
/* We don't support secret storage */
callback (agent, connection, NULL, callback_data);}
static void
nmt_secret_agent_delete_secrets (NMSecretAgent *agent,
NMConnection *connection,
const gchar *connection_path,
NMSecretAgentDeleteSecretsFunc callback,
gpointer callback_data)
{
/* We don't support secret storage, so there's nothing to delete. */
callback (agent, connection, NULL, callback_data);
}
void
nmt_secret_agent_class_init (NmtSecretAgentClass *klass)
{
GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
NMSecretAgentClass *agent_class = NM_SECRET_AGENT_CLASS (klass);
g_type_class_add_private (klass, sizeof (NmtSecretAgentPrivate));
gobject_class->finalize = nmt_secret_agent_finalize;
agent_class->get_secrets = nmt_secret_agent_get_secrets;
agent_class->cancel_get_secrets = nmt_secret_agent_cancel_get_secrets;
agent_class->save_secrets = nmt_secret_agent_save_secrets;
agent_class->delete_secrets = nmt_secret_agent_delete_secrets;
/**
* NmtSecretAgent::request-secrets:
* @agent: the #NmtSecretAgent
* @request_id: request ID, to eventually pass to
* nmt_secret_agent_response().
* @title: a title for the password dialog
* @prompt: a prompt message for the password dialog
* @secrets: (element-type #NmtSecretAgentSecret): array of secrets
* being requested.
*
* Emitted when the agent requires secrets from the user.
*
* The application should create a password dialog (eg,
* #NmtPasswordDialog) with the given title and prompt, and an
* entry for each element of @secrets. If any of the secrets
* already have a <literal>value</literal> filled in, the
* corresponding entry should be initialized to that value.
*
* When the dialog is complete, the app must call
* nmt_secret_agent_response() with the results.
*/
signals[REQUEST_SECRETS] = g_signal_new ("request-secrets",
G_TYPE_FROM_CLASS (klass),
0, 0, NULL, NULL, NULL,
G_TYPE_NONE,
4,
G_TYPE_STRING, /* request_id */
G_TYPE_STRING, /* title */
G_TYPE_STRING, /* prompt */
G_TYPE_PTR_ARRAY);
}
/**
* nmt_secret_agent_new:
*
* Creates a new #NmtSecretAgent.
*
* Returns: a new #NmtSecretAgent
*/
NMSecretAgent *
nmt_secret_agent_new (void)
{
return g_object_new (NMT_TYPE_SECRET_AGENT,
NM_SECRET_AGENT_IDENTIFIER, "nmtui",
NM_SECRET_AGENT_AUTO_REGISTER, FALSE,
NULL);
}