diff options
Diffstat (limited to 'tui/nmt-secret-agent.c')
| -rw-r--r-- | tui/nmt-secret-agent.c | 646 |
1 files changed, 646 insertions, 0 deletions
diff --git a/tui/nmt-secret-agent.c b/tui/nmt-secret-agent.c new file mode 100644 index 00000000..7939a843 --- /dev/null +++ b/tui/nmt-secret-agent.c @@ -0,0 +1,646 @@ +/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */ +/* + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + * + * Copyright 2011-2013 Red Hat, Inc. + * Copyright 2011 Giovanni Campagna <scampa.giovanni@gmail.com> + */ + +/** + * SECTION:nmt-secret-agent + * @short_description: A secret agent + * + * #NmtSecretAgent is the secret agent used by nmtui-connect. + * + * This is a stripped-down version of gnome-shell's ShellNetworkAgent, + * with bits of the corresponding JavaScript code squished down into + * it. It is intended to eventually be generic enough that it could + * replace ShellNetworkAgent. + */ + +#include "config.h" + +#include <string.h> +#include <dbus/dbus-glib.h> +#include <glib/gi18n-lib.h> + +#include <nm-utils.h> + +#include "nmt-secret-agent.h" +#include "nmt-newt.h" + +G_DEFINE_TYPE (NmtSecretAgent, nmt_secret_agent, NM_TYPE_SECRET_AGENT) + +#define NMT_SECRET_AGENT_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NMT_TYPE_SECRET_AGENT, NmtSecretAgentPrivate)) + +enum { + REQUEST_SECRETS, + + LAST_SIGNAL +}; + +static guint signals[LAST_SIGNAL] = { 0 }; + +typedef struct { + NmtSecretAgent *self; + + gchar *request_id; + NMConnection *connection; + gchar **hints; + NMSecretAgentGetSecretsFunc callback; + gpointer callback_data; +} NmtSecretAgentRequest; + +typedef struct { + /* <char *request_id, NmtSecretAgentRequest *request> */ + GHashTable *requests; +} NmtSecretAgentPrivate; + +static void +nmt_secret_agent_request_free (gpointer data) +{ + NmtSecretAgentRequest *request = data; + + g_object_unref (request->self); + g_object_unref (request->connection); + g_strfreev (request->hints); + + g_slice_free (NmtSecretAgentRequest, request); +} + +static void +nmt_secret_agent_init (NmtSecretAgent *agent) +{ + NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (agent); + + priv->requests = g_hash_table_new_full (g_str_hash, g_str_equal, + g_free, nmt_secret_agent_request_free); +} + +static void +nmt_secret_agent_finalize (GObject *object) +{ + NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (object); + GError *error; + GHashTableIter iter; + gpointer key; + gpointer value; + + error = g_error_new (NM_SECRET_AGENT_ERROR, + NM_SECRET_AGENT_ERROR_AGENT_CANCELED, + "The secret agent is going away"); + + g_hash_table_iter_init (&iter, priv->requests); + while (g_hash_table_iter_next (&iter, &key, &value)) { + NmtSecretAgentRequest *request = value; + + request->callback (NM_SECRET_AGENT (object), + request->connection, + NULL, error, + request->callback_data); + } + + g_hash_table_destroy (priv->requests); + g_error_free (error); + + G_OBJECT_CLASS (nmt_secret_agent_parent_class)->finalize (object); +} + +static gboolean +strv_has (gchar **haystack, + gchar *needle) +{ + gchar *iter; + + for (iter = *haystack; iter; iter++) { + if (g_strcmp0 (iter, needle) == 0) + return TRUE; + } + + return FALSE; +} + +/** + * NmtSecretAgentSecret: + * @name: the user-visible name of the secret. Eg, "WEP Passphrase". + * @value: the value of the secret + * @password: %TRUE if this secret represents a password, %FALSE + * if it represents non-secret data. + * + * A single "secret" being requested. + */ + +typedef struct { + NmtSecretAgentSecret base; + + NMSetting *setting; + char *property; + + NmtNewtEntryValidator validator; + gpointer validator_data; +} NmtSecretAgentSecretReal; + +static void +nmt_secret_agent_secret_free (NmtSecretAgentSecret *secret) +{ + NmtSecretAgentSecretReal *real = (NmtSecretAgentSecretReal *)secret; + + g_free (secret->name); + g_free (secret->value); + g_free (real->property); + g_clear_object (&real->setting); + + g_slice_free (NmtSecretAgentSecretReal, real); +} + +static NmtSecretAgentSecret * +nmt_secret_agent_secret_new (const char *name, + NMSetting *setting, + const char *property, + gboolean password) +{ + NmtSecretAgentSecretReal *real; + + real = g_slice_new0 (NmtSecretAgentSecretReal); + real->base.name = g_strdup (name); + real->base.password = password; + + if (setting) { + real->setting = g_object_ref (setting); + real->property = g_strdup (property); + + g_object_get (setting, property, &real->base.value, NULL); + } + + return &real->base; +} + +static gboolean +add_8021x_secrets (NmtSecretAgentRequest *request, + GPtrArray *secrets) +{ + NMSetting8021x *s_8021x = nm_connection_get_setting_802_1x (request->connection); + const char *eap_method; + NmtSecretAgentSecret *secret; + + eap_method = nm_setting_802_1x_get_eap_method (s_8021x, 0); + if (!eap_method) + return FALSE; + + if ( !strcmp (eap_method, "md5") + || !strcmp (eap_method, "leap") + || !strcmp (eap_method, "ttls") + || !strcmp (eap_method, "peap")) { + /* TTLS and PEAP are actually much more complicated, but this complication + * is not visible here since we only care about phase2 authentication + * (and don't even care of which one) + */ + secret = nmt_secret_agent_secret_new (_("Username"), + NM_SETTING (s_8021x), + NM_SETTING_802_1X_IDENTITY, + FALSE); + g_ptr_array_add (secrets, secret); + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_8021x), + NM_SETTING_802_1X_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + return TRUE; + } + + if (!strcmp (eap_method, "tls")) { + secret = nmt_secret_agent_secret_new (_("Identity"), + NM_SETTING (s_8021x), + NM_SETTING_802_1X_IDENTITY, + FALSE); + g_ptr_array_add (secrets, secret); + secret = nmt_secret_agent_secret_new (_("Private key password"), + NM_SETTING (s_8021x), + NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + return TRUE; + } + + return FALSE; +} + +static gboolean +add_wireless_secrets (NmtSecretAgentRequest *request, + GPtrArray *secrets) +{ + NMSettingWirelessSecurity *s_wsec = nm_connection_get_setting_wireless_security (request->connection); + const char *key_mgmt = nm_setting_wireless_security_get_key_mgmt (s_wsec); + NmtSecretAgentSecret *secret; + + if (!key_mgmt) + return FALSE; + + if (!strcmp (key_mgmt, "wpa-none") || !strcmp (key_mgmt, "wpa-psk")) { + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_wsec), + NM_SETTING_WIRELESS_SECURITY_PSK, + TRUE); + g_ptr_array_add (secrets, secret); + return TRUE; + } + + if (!strcmp (key_mgmt, "none")) { + int index; + char *key; + + index = nm_setting_wireless_security_get_wep_tx_keyidx (s_wsec); + key = g_strdup_printf ("wep-key%d", index); + secret = nmt_secret_agent_secret_new (_("Key"), + NM_SETTING (s_wsec), + key, + TRUE); + g_free (key); + +#if 0 + nmt_secret_agent_secret_set_validator (secret, static_wep_key_validate, + nm_setting_wireless_security_get_wep_key_type (s_wsec)); +#endif + g_ptr_array_add (secrets, secret); + return TRUE; + } + + if (!strcmp (key_mgmt, "iee8021x")) { + if (!g_strcmp0 (nm_setting_wireless_security_get_auth_alg (s_wsec), "leap")) { + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_wsec), + NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + return TRUE; + } else + return add_8021x_secrets (request, secrets); + } + + if (!strcmp (key_mgmt, "wpa-eap")) + return add_8021x_secrets (request, secrets); + + return FALSE; +} + +static gboolean +add_pppoe_secrets (NmtSecretAgentRequest *request, + GPtrArray *secrets) +{ + NMSettingPPPOE *s_pppoe = nm_connection_get_setting_pppoe (request->connection); + NmtSecretAgentSecret *secret; + + secret = nmt_secret_agent_secret_new (_("Username"), + NM_SETTING (s_pppoe), + NM_SETTING_PPPOE_USERNAME, + FALSE); + g_ptr_array_add (secrets, secret); + secret = nmt_secret_agent_secret_new (_("Service"), + NM_SETTING (s_pppoe), + NM_SETTING_PPPOE_SERVICE, + FALSE); + g_ptr_array_add (secrets, secret); + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_pppoe), + NM_SETTING_PPPOE_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + return TRUE; +} + +static void +request_secrets_from_ui (NmtSecretAgentRequest *request) +{ + GPtrArray *secrets; + NmtSecretAgentSecret *secret; + const char *title; + char *msg; + gboolean ok = TRUE; + + secrets = g_ptr_array_new_with_free_func ((GDestroyNotify) nmt_secret_agent_secret_free); + + if (nm_connection_is_type (request->connection, NM_SETTING_WIRELESS_SETTING_NAME)) { + NMSettingWireless *s_wireless; + char *ssid; + + s_wireless = nm_connection_get_setting_wireless (request->connection); + ssid = nm_utils_ssid_to_utf8 (nm_setting_wireless_get_ssid (s_wireless)); + + title = _("Authentication required by wireless network"); + msg = g_strdup_printf (_("Passwords or encryption keys are required to access the wireless network '%s'."), ssid); + + ok = add_wireless_secrets (request, secrets); + } else if (nm_connection_is_type (request->connection, NM_SETTING_WIRED_SETTING_NAME)) { + NMSettingConnection *s_con; + + s_con = nm_connection_get_setting_connection (request->connection); + + title = _("Wired 802.1X authentication"); + msg = NULL; + + secret = nmt_secret_agent_secret_new (_("Network name"), + NM_SETTING (s_con), + NM_SETTING_CONNECTION_ID, + FALSE); + g_ptr_array_add (secrets, secret); + ok = add_8021x_secrets (request, secrets); + } else if (nm_connection_is_type (request->connection, NM_SETTING_PPPOE_SETTING_NAME)) { + title = _("DSL authentication"); + msg = NULL; + + ok = add_pppoe_secrets (request, secrets); + } else if (nm_connection_is_type (request->connection, NM_SETTING_GSM_SETTING_NAME)) { + NMSettingGsm *s_gsm = nm_connection_get_setting_gsm (request->connection); + + if (strv_has (request->hints, "pin")) { + title = _("PIN code required"); + msg = g_strdup (_("PIN code is needed for the mobile broadband device")); + + secret = nmt_secret_agent_secret_new (_("PIN"), + NM_SETTING (s_gsm), + NM_SETTING_GSM_PIN, + FALSE); + g_ptr_array_add (secrets, secret); + } else { + title = _("Mobile broadband network password"); + msg = g_strdup_printf (_("A password is required to connect to '%s'."), + nm_connection_get_id (request->connection)); + + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_gsm), + NM_SETTING_GSM_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + } + } else if (nm_connection_is_type (request->connection, NM_SETTING_CDMA_SETTING_NAME)) { + NMSettingCdma *s_cdma = nm_connection_get_setting_cdma (request->connection); + + title = _("Mobile broadband network password"); + msg = g_strdup_printf (_("A password is required to connect to '%s'."), + nm_connection_get_id (request->connection)); + + secret = nmt_secret_agent_secret_new (_("Password"), + NM_SETTING (s_cdma), + NM_SETTING_CDMA_PASSWORD, + TRUE); + g_ptr_array_add (secrets, secret); + } else if (nm_connection_is_type (request->connection, NM_SETTING_BLUETOOTH_SETTING_NAME)) { + NMSetting *setting; + + setting = nm_connection_get_setting_by_name (request->connection, NM_SETTING_GSM_SETTING_NAME); + if (!setting) + setting = nm_connection_get_setting_by_name (request->connection, NM_SETTING_CDMA_SETTING_NAME); + + title = _("Mobile broadband network password"); + msg = g_strdup_printf (_("A password is required to connect to '%s'."), + nm_connection_get_id (request->connection)); + + secret = nmt_secret_agent_secret_new (_("Password"), + setting, + "password", + TRUE); + g_ptr_array_add (secrets, secret); + } else + ok = FALSE; + + if (!ok) { + g_ptr_array_unref (secrets); + return; + } + + g_signal_emit (request->self, signals[REQUEST_SECRETS], 0, + request->request_id, title, msg, secrets); +} + +static void +nmt_secret_agent_get_secrets (NMSecretAgent *agent, + NMConnection *connection, + const gchar *connection_path, + const gchar *setting_name, + const gchar **hints, + NMSecretAgentGetSecretsFlags flags, + NMSecretAgentGetSecretsFunc callback, + gpointer callback_data) +{ + NmtSecretAgent *self = NMT_SECRET_AGENT (agent); + NmtSecretAgentPrivate *priv = NMT_SECRET_AGENT_GET_PRIVATE (self); + NmtSecretAgentRequest *request; + NMSettingConnection *s_con; + const char *connection_type; + char *request_id; + GError *error; + + request_id = g_strdup_printf ("%s/%s", connection_path, setting_name); + if (g_hash_table_lookup (priv->requests, request_id) != NULL) { + /* We already have a request pending for this (connection, setting) */ + error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_INTERNAL_ERROR, + "Request for %s secrets already pending", request_id); + nope: + callback (agent, connection, NULL, error, callback_data); + g_error_free (error); + g_free (request_id); + return; + } + + s_con = nm_connection_get_setting_connection (connection); + connection_type = nm_setting_connection_get_connection_type (s_con); + + if (!strcmp (connection_type, NM_SETTING_VPN_SETTING_NAME)) { + /* We don't support VPN secrets yet */ + error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_NO_SECRETS, + "VPN secrets not supported"); + goto nope; + } + + if (!(flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION)) { + /* We don't do stored passwords */ + error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_NO_SECRETS, + "Stored passwords not supported"); + goto nope; + } + + request = g_slice_new (NmtSecretAgentRequest); + request->self = g_object_ref (self); + request->connection = g_object_ref (connection); + request->hints = g_strdupv ((gchar **)hints); + request->callback = callback; + request->callback_data = callback_data; + request->request_id = request_id; + g_hash_table_replace (priv->requests, request->request_id, request); + + request_secrets_from_ui (request); +} + +static void +gvalue_destroy_notify (gpointer data) +{ + GValue *value = data; + g_value_unset (value); + g_slice_free (GValue, value); +} + +/** + * nmt_secret_agent_response: + * @self: the #NmtSecretAgent + * @request_id: the request ID being responded to + * @secrets: (allow-none): the array of secrets, or %NULL + * + * Response to a #NmtSecretAgent::get-secrets signal. + * + * If the user provided secrets, the caller should set the + * corresponding <literal>value</literal> fields in the + * #NmtSecretAgentSecrets (freeing any initial values they had), and + * pass the array to nmt_secret_agent_response(). If the user + * cancelled the request, @secrets should be NULL. + */ +void +nmt_secret_agent_response (NmtSecretAgent *self, + const char *request_id, + GPtrArray *secrets) +{ + NmtSecretAgentPrivate *priv; + NmtSecretAgentRequest *request; + GHashTable *hash = NULL, *setting_hash; + GValue *value; + GError *error = NULL; + int i; + + g_return_if_fail (NMT_IS_SECRET_AGENT (self)); + + priv = NMT_SECRET_AGENT_GET_PRIVATE (self); + request = g_hash_table_lookup (priv->requests, request_id); + g_return_if_fail (request != NULL); + + if (secrets) { + hash = g_hash_table_new_full (g_str_hash, g_str_equal, NULL, (GDestroyNotify) g_hash_table_unref); + for (i = 0; i < secrets->len; i++) { + NmtSecretAgentSecretReal *secret = secrets->pdata[i]; + + setting_hash = g_hash_table_lookup (hash, nm_setting_get_name (secret->setting)); + if (!setting_hash) { + setting_hash = g_hash_table_new_full (g_str_hash, g_str_equal, + g_free, gvalue_destroy_notify); + g_hash_table_insert (hash, (char *)nm_setting_get_name (secret->setting), + setting_hash); + } + + value = g_slice_new0 (GValue); + g_value_init (value, G_TYPE_STRING); + g_value_set_string (value, secret->base.value); + + g_hash_table_insert (setting_hash, g_strdup (secret->property), value); + } + } else { + error = g_error_new (NM_SECRET_AGENT_ERROR, NM_SECRET_AGENT_ERROR_USER_CANCELED, + "User cancelled"); + } + + request->callback (NM_SECRET_AGENT (self), request->connection, hash, error, request->callback_data); + + g_clear_pointer (&hash, g_hash_table_unref); + g_clear_error (&error); + g_hash_table_remove (priv->requests, request_id); +} + +static void +nmt_secret_agent_cancel_get_secrets (NMSecretAgent *agent, + const gchar *connection_path, + const gchar *setting_name) +{ + /* We don't support cancellation. Sorry! */ +} + +static void +nmt_secret_agent_save_secrets (NMSecretAgent *agent, + NMConnection *connection, + const gchar *connection_path, + NMSecretAgentSaveSecretsFunc callback, + gpointer callback_data) +{ + /* We don't support secret storage */ + callback (agent, connection, NULL, callback_data);} + +static void +nmt_secret_agent_delete_secrets (NMSecretAgent *agent, + NMConnection *connection, + const gchar *connection_path, + NMSecretAgentDeleteSecretsFunc callback, + gpointer callback_data) +{ + /* We don't support secret storage, so there's nothing to delete. */ + callback (agent, connection, NULL, callback_data); +} + +void +nmt_secret_agent_class_init (NmtSecretAgentClass *klass) +{ + GObjectClass *gobject_class = G_OBJECT_CLASS (klass); + NMSecretAgentClass *agent_class = NM_SECRET_AGENT_CLASS (klass); + + g_type_class_add_private (klass, sizeof (NmtSecretAgentPrivate)); + + gobject_class->finalize = nmt_secret_agent_finalize; + + agent_class->get_secrets = nmt_secret_agent_get_secrets; + agent_class->cancel_get_secrets = nmt_secret_agent_cancel_get_secrets; + agent_class->save_secrets = nmt_secret_agent_save_secrets; + agent_class->delete_secrets = nmt_secret_agent_delete_secrets; + + /** + * NmtSecretAgent::request-secrets: + * @agent: the #NmtSecretAgent + * @request_id: request ID, to eventually pass to + * nmt_secret_agent_response(). + * @title: a title for the password dialog + * @prompt: a prompt message for the password dialog + * @secrets: (element-type #NmtSecretAgentSecret): array of secrets + * being requested. + * + * Emitted when the agent requires secrets from the user. + * + * The application should create a password dialog (eg, + * #NmtPasswordDialog) with the given title and prompt, and an + * entry for each element of @secrets. If any of the secrets + * already have a <literal>value</literal> filled in, the + * corresponding entry should be initialized to that value. + * + * When the dialog is complete, the app must call + * nmt_secret_agent_response() with the results. + */ + signals[REQUEST_SECRETS] = g_signal_new ("request-secrets", + G_TYPE_FROM_CLASS (klass), + 0, 0, NULL, NULL, NULL, + G_TYPE_NONE, + 4, + G_TYPE_STRING, /* request_id */ + G_TYPE_STRING, /* title */ + G_TYPE_STRING, /* prompt */ + G_TYPE_PTR_ARRAY); +} + +/** + * nmt_secret_agent_new: + * + * Creates a new #NmtSecretAgent. + * + * Returns: a new #NmtSecretAgent + */ +NMSecretAgent * +nmt_secret_agent_new (void) +{ + return g_object_new (NMT_TYPE_SECRET_AGENT, + NM_SECRET_AGENT_IDENTIFIER, "nmtui", + NM_SECRET_AGENT_AUTO_REGISTER, FALSE, + NULL); +} |