nm-vpn-service-plugin.c 41.1 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
/*
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the
 * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 * Boston, MA 02110-1301 USA.
 *
 * Copyright 2007 - 2008 Novell, Inc.
19
 * Copyright 2007 - 2015 Red Hat, Inc.
20 21
 */

22
#include "nm-default.h"
23

24 25
#include "nm-vpn-service-plugin.h"

26 27 28 29 30 31 32 33 34 35 36 37 38
#include <errno.h>
#include <signal.h>
#include <stdlib.h>

#include "nm-enum-types.h"
#include "nm-utils.h"
#include "nm-connection.h"
#include "nm-dbus-helpers.h"
#include "nm-core-internal.h"
#include "nm-simple-connection.h"

#include "nmdbus-vpn-plugin.h"

39
#define NM_VPN_SERVICE_PLUGIN_QUIT_TIMER    180
40

41
static void nm_vpn_service_plugin_initable_iface_init (GInitableIface *iface);
42

43 44
G_DEFINE_ABSTRACT_TYPE_WITH_CODE (NMVpnServicePlugin, nm_vpn_service_plugin, G_TYPE_OBJECT,
                                  G_IMPLEMENT_INTERFACE (G_TYPE_INITABLE, nm_vpn_service_plugin_initable_iface_init);
45 46 47 48 49 50 51
                                  )

typedef struct {
	NMVpnServiceState state;

	/* DBUS-y stuff */
	GDBusConnection *connection;
52
	NMDBusVpnPlugin *dbus_vpn_service_plugin;
53
	char *dbus_service_name;
54
	gboolean dbus_watch_peer;
55 56 57 58 59

	/* Temporary stuff */
	guint connect_timer;
	guint quit_timer;
	guint fail_stop_id;
60
	guint peer_watch_id;
61 62 63 64 65 66 67 68
	gboolean interactive;

	gboolean got_config;
	gboolean has_ip4, got_ip4;
	gboolean has_ip6, got_ip6;

	/* Config stuff copied from config to ip4config */
	GVariant *banner, *tundev, *gateway, *mtu;
69
} NMVpnServicePluginPrivate;
70

71
#define NM_VPN_SERVICE_PLUGIN_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), NM_TYPE_VPN_SERVICE_PLUGIN, NMVpnServicePluginPrivate))
72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90

enum {
	STATE_CHANGED,
	CONFIG,
	IP4_CONFIG,
	IP6_CONFIG,
	LOGIN_BANNER,
	FAILURE,
	QUIT,
	SECRETS_REQUIRED,

	LAST_SIGNAL
};

static guint signals[LAST_SIGNAL] = { 0 };

enum {
	PROP_0,
	PROP_DBUS_SERVICE_NAME,
91
	PROP_DBUS_WATCH_PEER,
92 93 94 95 96 97 98 99 100
	PROP_STATE,

	LAST_PROP
};

static GSList *active_plugins = NULL;


static void
101 102
nm_vpn_service_plugin_set_connection (NMVpnServicePlugin *plugin,
                                      GDBusConnection *connection)
103
{
104
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
105 106 107 108 109 110 111 112

	g_clear_object (&priv->connection);

	if (connection)
		priv->connection = g_object_ref (connection);
}

/**
113
 * nm_vpn_service_plugin_get_connection:
114 115
 *
 * Returns: (transfer full):
116 117
 *
 * Since: 1.2
118 119
 */
GDBusConnection *
120
nm_vpn_service_plugin_get_connection (NMVpnServicePlugin *plugin)
121 122 123
{
	GDBusConnection *connection;

124
	g_return_val_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin), NULL);
125

126
	connection = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin)->connection;
127 128 129 130 131 132 133

	if (connection)
		g_object_ref (connection);

	return connection;
}

134
static NMVpnServiceState
135
nm_vpn_service_plugin_get_state (NMVpnServicePlugin *plugin)
136
{
137
	g_return_val_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin), NM_VPN_SERVICE_STATE_UNKNOWN);
138

139
	return NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin)->state;
140 141
}

142
static void
143 144
nm_vpn_service_plugin_set_state (NMVpnServicePlugin *plugin,
                                 NMVpnServiceState state)
145
{
146
	NMVpnServicePluginPrivate *priv;
147

148
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
149

150
	priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
151 152 153
	if (priv->state != state) {
		priv->state = state;
		g_signal_emit (plugin, signals[STATE_CHANGED], 0, state);
154
		nmdbus_vpn_plugin_emit_state_changed (priv->dbus_vpn_service_plugin, state);
155 156 157 158
	}
}

void
159 160
nm_vpn_service_plugin_set_login_banner (NMVpnServicePlugin *plugin,
                                        const char *banner)
161
{
162 163
	NMVpnServicePluginPrivate *priv;

164
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
165 166
	g_return_if_fail (banner != NULL);

167
	priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
168
	g_signal_emit (plugin, signals[LOGIN_BANNER], 0, banner);
169
	nmdbus_vpn_plugin_emit_login_banner (priv->dbus_vpn_service_plugin, banner);
170 171
}

172 173 174 175 176 177 178 179 180 181
static void
_emit_failure (NMVpnServicePlugin *plugin,
               NMVpnPluginFailure reason)
{
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);

	g_signal_emit (plugin, signals[FAILURE], 0, reason);
	nmdbus_vpn_plugin_emit_failure (priv->dbus_vpn_service_plugin, reason);
}

182
void
183 184
nm_vpn_service_plugin_failure (NMVpnServicePlugin *plugin,
                               NMVpnPluginFailure reason)
185
{
186
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
187

188 189
	_emit_failure (plugin, reason);
	nm_vpn_service_plugin_disconnect (plugin, NULL);
190 191 192
}

gboolean
193
nm_vpn_service_plugin_disconnect (NMVpnServicePlugin *plugin, GError **err)
194
{
195
	NMVpnServicePluginPrivate *priv;
196 197 198
	gboolean ret = FALSE;
	NMVpnServiceState state;

199
	g_return_val_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin), FALSE);
200

201
	priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
202
	state = nm_vpn_service_plugin_get_state (plugin);
203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218
	switch (state) {
	case NM_VPN_SERVICE_STATE_STOPPING:
		g_set_error (err,
		             NM_VPN_PLUGIN_ERROR,
		             NM_VPN_PLUGIN_ERROR_STOPPING_IN_PROGRESS,
		             "%s",
		             "Could not process the request because the VPN connection is already being stopped.");
		break;
	case NM_VPN_SERVICE_STATE_STOPPED:
		g_set_error (err,
		             NM_VPN_PLUGIN_ERROR,
		             NM_VPN_PLUGIN_ERROR_ALREADY_STOPPED,
		             "%s",
		             "Could not process the request because no VPN connection was active.");
		break;
	case NM_VPN_SERVICE_STATE_STARTING:
219 220
		_emit_failure (plugin, NM_VPN_PLUGIN_FAILURE_CONNECT_FAILED);
		/* fallthru */
221
	case NM_VPN_SERVICE_STATE_STARTED:
222 223 224
		nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_STOPPING);
		ret = NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->disconnect (plugin, err);
		nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_STOPPED);
225 226 227 228 229 230 231 232 233 234 235 236 237 238 239
		break;
	case NM_VPN_SERVICE_STATE_INIT:
		ret = TRUE;
		break;

	default:
		g_warning ("Unhandled VPN service state %d", state);
		g_assert_not_reached ();
		break;
	}

	return ret;
}

static void
240
nm_vpn_service_plugin_emit_quit (NMVpnServicePlugin *plugin)
241 242 243 244 245 246 247
{
	g_signal_emit (plugin, signals[QUIT], 0);
}

static gboolean
connect_timer_expired (gpointer data)
{
248
	NMVpnServicePlugin *plugin = NM_VPN_SERVICE_PLUGIN (data);
249 250
	GError *err = NULL;

251
	NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin)->connect_timer = 0;
252
	g_message ("Connect timer expired, disconnecting.");
253
	nm_vpn_service_plugin_disconnect (plugin, &err);
254 255 256 257 258 259 260 261 262 263 264
	if (err) {
		g_warning ("Disconnect failed: %s", err->message);
		g_error_free (err);
	}

	return G_SOURCE_REMOVE;
}

static gboolean
quit_timer_expired (gpointer data)
{
265
	NMVpnServicePlugin *self = NM_VPN_SERVICE_PLUGIN (data);
266

267 268
	NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (self)->quit_timer = 0;
	nm_vpn_service_plugin_emit_quit (self);
269 270 271 272
	return G_SOURCE_REMOVE;
}

static void
273
schedule_quit_timer (NMVpnServicePlugin *self)
274
{
275
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (self);
276 277

	nm_clear_g_source (&priv->quit_timer);
278
	priv->quit_timer = g_timeout_add_seconds (NM_VPN_SERVICE_PLUGIN_QUIT_TIMER,
279 280 281 282 283 284 285
	                                          quit_timer_expired,
	                                          self);
}

static gboolean
fail_stop (gpointer data)
{
286
	NMVpnServicePlugin *self = NM_VPN_SERVICE_PLUGIN (data);
287

288 289
	NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (self)->fail_stop_id = 0;
	nm_vpn_service_plugin_set_state (self, NM_VPN_SERVICE_STATE_STOPPED);
290 291 292 293
	return G_SOURCE_REMOVE;
}

static void
294
schedule_fail_stop (NMVpnServicePlugin *plugin, guint timeout_secs)
295
{
296
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
297 298

	nm_clear_g_source (&priv->fail_stop_id);
299 300 301 302
	if (timeout_secs)
		priv->fail_stop_id = g_timeout_add_seconds (timeout_secs, fail_stop, plugin);
	else
		priv->fail_stop_id = g_idle_add (fail_stop, plugin);
303 304 305
}

void
306 307
nm_vpn_service_plugin_set_config (NMVpnServicePlugin *plugin,
                                  GVariant *config)
308
{
309
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
310

311
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339
	g_return_if_fail (config != NULL);

	priv->got_config = TRUE;

	(void) g_variant_lookup (config, NM_VPN_PLUGIN_CONFIG_HAS_IP4, "b", &priv->has_ip4);
	(void) g_variant_lookup (config, NM_VPN_PLUGIN_CONFIG_HAS_IP6, "b", &priv->has_ip6);

	/* Record the items that need to also be inserted into the
	 * ip4config, for compatibility with older daemons.
	 */
	if (priv->banner)
		g_variant_unref (priv->banner);
	priv->banner = g_variant_lookup_value (config, NM_VPN_PLUGIN_CONFIG_BANNER,
	                                       G_VARIANT_TYPE ("s"));
	if (priv->tundev)
		g_variant_unref (priv->tundev);
	priv->tundev = g_variant_lookup_value (config, NM_VPN_PLUGIN_CONFIG_TUNDEV,
	                                       G_VARIANT_TYPE ("s"));
	if (priv->gateway)
		g_variant_unref (priv->gateway);
	priv->gateway = g_variant_lookup_value (config, NM_VPN_PLUGIN_CONFIG_EXT_GATEWAY,
	                                        G_VARIANT_TYPE ("u"));
	if (priv->mtu)
		g_variant_unref (priv->mtu);
	priv->mtu = g_variant_lookup_value (config, NM_VPN_PLUGIN_CONFIG_MTU,
	                                    G_VARIANT_TYPE ("u"));

	g_signal_emit (plugin, signals[CONFIG], 0, config);
340
	nmdbus_vpn_plugin_emit_config (priv->dbus_vpn_service_plugin, config);
341 342 343
}

void
344 345
nm_vpn_service_plugin_set_ip4_config (NMVpnServicePlugin *plugin,
                                      GVariant *ip4_config)
346
{
347
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
348 349 350 351 352 353
	GVariant *combined_config;
	GVariantBuilder builder;
	GVariantIter iter;
	const char *key;
	GVariant *value;

354
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
355 356 357 358 359
	g_return_if_fail (ip4_config != NULL);

	priv->got_ip4 = TRUE;

	/* Old plugins won't send the "config" signal and thus can't send
360
	 * NM_VPN_SERVICE_PLUGIN_CONFIG_HAS_IP4 either.  But since they don't support IPv6,
361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
	 * we can safely assume that, if we don't receive a "config" signal but do
	 * receive an "ip4-config" signal, the old plugin supports IPv4.
	 */
	if (!priv->got_config)
		priv->has_ip4 = TRUE;

	/* Older NetworkManager daemons expect all config info to be in
	 * the ip4 config, so they won't even notice the "config" signal
	 * being emitted. So just copy all of that data into the ip4
	 * config too.
	 */
	g_variant_builder_init (&builder, G_VARIANT_TYPE ("a{sv}"));
	g_variant_iter_init (&iter, ip4_config);
	while (g_variant_iter_next (&iter, "{&sv}", &key, &value)) {
		g_variant_builder_add (&builder, "{sv}", key, value);
		g_variant_unref (value);
	}

	if (priv->banner)
380
		g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_BANNER, priv->banner);
381
	if (priv->tundev)
382
		g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV, priv->tundev);
383
	if (priv->gateway)
384
		g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_EXT_GATEWAY, priv->gateway);
385
	if (priv->mtu)
386
		g_variant_builder_add (&builder, "{sv}", NM_VPN_PLUGIN_IP4_CONFIG_MTU, priv->mtu);
387 388 389 390

	combined_config = g_variant_builder_end (&builder);
	g_variant_ref_sink (combined_config);
	g_signal_emit (plugin, signals[IP4_CONFIG], 0, combined_config);
391
	nmdbus_vpn_plugin_emit_ip4_config (priv->dbus_vpn_service_plugin, combined_config);
392 393 394 395
	g_variant_unref (combined_config);

	if (   priv->has_ip4 == priv->got_ip4
	    && priv->has_ip6 == priv->got_ip6)
396
		nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_STARTED);
397 398 399
}

void
400 401
nm_vpn_service_plugin_set_ip6_config (NMVpnServicePlugin *plugin,
                                      GVariant *ip6_config)
402
{
403
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
404

405
	g_return_if_fail (NM_IS_VPN_SERVICE_PLUGIN (plugin));
406 407
	g_return_if_fail (ip6_config != NULL);

408 409
	g_variant_ref_sink (ip6_config);

410 411
	priv->got_ip6 = TRUE;
	g_signal_emit (plugin, signals[IP6_CONFIG], 0, ip6_config);
412
	nmdbus_vpn_plugin_emit_ip6_config (priv->dbus_vpn_service_plugin, ip6_config);
413

414 415
	g_variant_unref (ip6_config);

416 417
	if (   priv->has_ip4 == priv->got_ip4
	    && priv->has_ip6 == priv->got_ip6)
418
		nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_STARTED);
419 420 421
}

static void
422
connect_timer_start (NMVpnServicePlugin *plugin)
423
{
424
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
425

426
	nm_clear_g_source (&priv->connect_timer);
427 428 429
	priv->connect_timer = g_timeout_add_seconds (60, connect_timer_expired, plugin);
}

430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460
static void
peer_vanished (GDBusConnection *connection,
               const gchar *sender_name,
               const gchar *object_path,
               const gchar *interface_name,
               const gchar *signal_name,
               GVariant *parameters,
               gpointer user_data)
{
	nm_vpn_service_plugin_disconnect (NM_VPN_SERVICE_PLUGIN (user_data), NULL);
}

static guint
watch_peer (NMVpnServicePlugin *plugin,
            GDBusMethodInvocation *context)
{
	GDBusConnection *connection = g_dbus_method_invocation_get_connection (context);
	const gchar *peer = g_dbus_message_get_sender (g_dbus_method_invocation_get_message (context));

	return g_dbus_connection_signal_subscribe (connection,
	                                           "org.freedesktop.DBus",
	                                           "org.freedesktop.DBus",
	                                           "NameOwnerChanged",
	                                           "/org/freedesktop/DBus",
	                                           peer,
	                                           G_DBUS_SIGNAL_FLAGS_NONE,
	                                           peer_vanished,
	                                           plugin,
	                                           NULL);
}

461
static void
462
_connect_generic (NMVpnServicePlugin *plugin,
463 464 465 466
                  GDBusMethodInvocation *context,
                  GVariant *properties,
                  GVariant *details)
{
467 468
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
	NMVpnServicePluginClass *vpn_class = NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin);
469 470 471
	NMConnection *connection;
	gboolean success = FALSE;
	GError *error = NULL;
472
	guint fail_stop_timeout = 0;
473 474 475 476 477 478 479 480 481 482 483

	if (priv->state != NM_VPN_SERVICE_STATE_STOPPED &&
	    priv->state != NM_VPN_SERVICE_STATE_INIT) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_WRONG_STATE,
		                                       "Could not start connection: wrong plugin state %d",
		                                       priv->state);
		return;
	}

484
	connection = _nm_simple_connection_new_from_dbus (properties, NM_SETTING_PARSE_FLAGS_BEST_EFFORT, &error);
485 486 487 488
	if (!connection) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
489 490
		                                       "Invalid connection: %s",
		                                       error->message);
491
		g_clear_error (&error);
492
		return;
493 494 495 496 497 498 499 500 501 502 503
	}

	priv->interactive = FALSE;
	if (details && !vpn_class->connect_interactive) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_INTERACTIVE_NOT_SUPPORTED,
		                                       "Plugin does not implement ConnectInteractive()");
		return;
	}

504
	nm_clear_g_source (&priv->fail_stop_id);
505

506 507 508
	if (priv->dbus_watch_peer)
		priv->peer_watch_id = watch_peer (plugin, context);

509 510 511
	if (details) {
		priv->interactive = TRUE;
		success = vpn_class->connect_interactive (plugin, connection, details, &error);
512 513 514 515
		if (g_error_matches (error, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_INTERACTIVE_NOT_SUPPORTED)) {
			/* Give NetworkManager a bit of time to fall back to Connect() */
			fail_stop_timeout = 5;
		}
516 517 518 519
	} else
		success = vpn_class->connect (plugin, connection, &error);

	if (success) {
520 521
		nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_STARTING);

522 523 524 525 526 527 528 529 530 531
		g_dbus_method_invocation_return_value (context, NULL);

		/* Add a timer to make sure we do not wait indefinitely for the successful connect. */
		connect_timer_start (plugin);
	} else {
		g_dbus_method_invocation_take_error (context, error);

		/* Stop the plugin from an idle handler so that the Connect
		 * method return gets sent before the STOP StateChanged signal.
		 */
532
		schedule_fail_stop (plugin, fail_stop_timeout);
533 534 535 536 537 538
	}

	g_object_unref (connection);
}

static void
539 540 541 542
impl_vpn_service_plugin_connect (NMVpnServicePlugin *plugin,
                                 GDBusMethodInvocation *context,
                                 GVariant *connection,
                                 gpointer user_data)
543 544 545 546 547
{
	_connect_generic (plugin, context, connection, NULL);
}

static void
548 549 550 551 552
impl_vpn_service_plugin_connect_interactive (NMVpnServicePlugin *plugin,
                                             GDBusMethodInvocation *context,
                                             GVariant *connection,
                                             GVariant *details,
                                             gpointer user_data)
553 554 555 556 557 558 559
{
	_connect_generic (plugin, context, connection, details);
}

/***************************************************************/

static void
560 561 562 563
impl_vpn_service_plugin_need_secrets (NMVpnServicePlugin *plugin,
                                      GDBusMethodInvocation *context,
                                      GVariant *properties,
                                      gpointer user_data)
564 565 566 567 568 569
{
	NMConnection *connection;
	const char *setting_name;
	gboolean needed;
	GError *error = NULL;

570
	connection = _nm_simple_connection_new_from_dbus (properties, NM_SETTING_PARSE_FLAGS_BEST_EFFORT, &error);
571 572 573 574 575 576 577 578 579 580
	if (!connection) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_INVALID_CONNECTION,
		                                       "The connection was invalid: %s",
		                                       error->message);
		g_error_free (error);
		return;
	}

581
	if (!NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->need_secrets) {
582 583 584 585 586
		g_dbus_method_invocation_return_value (context,
		                                       g_variant_new ("(s)", ""));
		return;
	}

587
	needed = NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->need_secrets (plugin, connection, &setting_name, &error);
588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609
	if (error) {
		g_dbus_method_invocation_take_error (context, error);
		return;
	}

	if (needed) {
		/* Push back the quit timer so the VPN plugin doesn't quit in the
		 * middle of asking the user for secrets.
		 */
		schedule_quit_timer (plugin);

		g_assert (setting_name);
		g_dbus_method_invocation_return_value (context,
		                                       g_variant_new ("(s)", setting_name));
	} else {
		/* No secrets required */
		g_dbus_method_invocation_return_value (context,
		                                       g_variant_new ("(s)", ""));
	}
}

static void
610 611 612 613
impl_vpn_service_plugin_new_secrets (NMVpnServicePlugin *plugin,
                                     GDBusMethodInvocation *context,
                                     GVariant *properties,
                                     gpointer user_data)
614
{
615
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
616 617 618 619 620 621 622 623 624 625 626 627 628
	NMConnection *connection;
	GError *error = NULL;
	gboolean success;

	if (priv->state != NM_VPN_SERVICE_STATE_STARTING) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_WRONG_STATE,
		                                       "Could not accept new secrets: wrong plugin state %d",
		                                       priv->state);
		return;
	}

629
	connection = _nm_simple_connection_new_from_dbus (properties, NM_SETTING_PARSE_FLAGS_BEST_EFFORT, &error);
630 631 632 633
	if (!connection) {
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
634 635
		                                       "Invalid connection: %s",
		                                       error->message);
636 637 638 639
		g_clear_error (&error);
		return;
	}

640
	if (!NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->new_secrets) {
641 642 643 644 645 646 647 648
		g_dbus_method_invocation_return_error (context,
		                                       NM_VPN_PLUGIN_ERROR,
		                                       NM_VPN_PLUGIN_ERROR_INTERACTIVE_NOT_SUPPORTED,
		                                       "Could not accept new secrets: plugin cannot process interactive secrets");
		g_object_unref (connection);
		return;
	}

649
	success = NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->new_secrets (plugin, connection, &error);
650 651 652 653 654 655 656 657 658 659 660
	if (success) {
		g_dbus_method_invocation_return_value (context, NULL);

		/* Add a timer to make sure we do not wait indefinitely for the successful connect. */
		connect_timer_start (plugin);
	} else {
		g_dbus_method_invocation_take_error (context, error);

		/* Stop the plugin from and idle handler so that the NewSecrets
		 * method return gets sent before the STOP StateChanged signal.
		 */
661
		schedule_fail_stop (plugin, 0);
662 663 664 665 666 667
	}

	g_object_unref (connection);
}

/**
668 669
 * nm_vpn_service_plugin_secrets_required:
 * @plugin: the #NMVpnServicePlugin
670 671 672 673 674 675 676 677
 * @message: an information message about why secrets are required, if any
 * @hints: VPN specific secret names for required new secrets
 *
 * Called by VPN plugin implementations to signal to NetworkManager that secrets
 * are required during the connection process.  This signal may be used to
 * request new secrets when the secrets originally provided by NetworkManager
 * are insufficient, or the VPN process indicates that it needs additional
 * information to complete the request.
678 679
 *
 * Since: 1.2
680 681
 */
void
682 683 684
nm_vpn_service_plugin_secrets_required (NMVpnServicePlugin *plugin,
                                        const char *message,
                                        const char **hints)
685
{
686
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
687 688

	/* Plugin must be able to accept the new secrets if it calls this method */
689
	g_return_if_fail (NM_VPN_SERVICE_PLUGIN_GET_CLASS (plugin)->new_secrets);
690 691 692 693 694 695 696 697 698 699 700 701

	/* Plugin cannot call this method if NetworkManager didn't originally call
	 * ConnectInteractive().
	 */
	g_return_if_fail (priv->interactive == TRUE);

	/* Cancel the connect timer since secrets might take a while.  It'll
	 * get restarted when the secrets come back via NewSecrets().
	 */
	nm_clear_g_source (&priv->connect_timer);

	g_signal_emit (plugin, signals[SECRETS_REQUIRED], 0, message, hints);
702
	nmdbus_vpn_plugin_emit_secrets_required (priv->dbus_vpn_service_plugin, message, hints);
703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721
}

/***************************************************************/

#define DATA_KEY_TAG "DATA_KEY="
#define DATA_VAL_TAG "DATA_VAL="
#define SECRET_KEY_TAG "SECRET_KEY="
#define SECRET_VAL_TAG "SECRET_VAL="

static void
free_secret (gpointer data)
{
	char *secret = data;

	memset (secret, 0, strlen (secret));
	g_free (secret);
}

/**
722
 * nm_vpn_service_plugin_read_vpn_details:
723 724 725 726 727 728 729 730 731 732
 * @fd: file descriptor to read from, usually stdin (0)
 * @out_data: (out) (transfer full): on successful return, a hash table
 * (mapping char*:char*) containing the key/value pairs of VPN data items
 * @out_secrets: (out) (transfer full): on successful return, a hash table
 * (mapping char*:char*) containing the key/value pairsof VPN secrets
 *
 * Parses key/value pairs from a file descriptor (normally stdin) passed by
 * an applet when the applet calls the authentication dialog of the VPN plugin.
 *
 * Returns: %TRUE if reading values was successful, %FALSE if not
733 734
 *
 * Since: 1.2
735 736
 **/
gboolean
737 738 739
nm_vpn_service_plugin_read_vpn_details (int fd,
                                        GHashTable **out_data,
                                        GHashTable **out_secrets)
740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824
{
	GHashTable *data, *secrets;
	gboolean success = FALSE;
	char *key = NULL, *val = NULL;
	GString *line;
	gchar c;

	if (out_data)
		g_return_val_if_fail (*out_data == NULL, FALSE);
	if (out_secrets)
		g_return_val_if_fail (*out_secrets == NULL, FALSE);

	data = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
	secrets = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, free_secret);

	line = g_string_new (NULL);

	/* Read stdin for data and secret items until we get a DONE */
	while (1) {
		ssize_t nr;
		GHashTable *hash = NULL;

		errno = 0;
		nr = read (fd, &c, 1);
		if (nr == -1) {
			if (errno == EAGAIN) {
				g_usleep (100);
				continue;
			}
			break;
		}

		if (c != '\n') {
			g_string_append_c (line, c);
			continue;
		}

		/* Check for the finish marker */
		if (strcmp (line->str, "DONE") == 0)
			break;

		/* Otherwise it's a data/secret item */
		if (strncmp (line->str, DATA_KEY_TAG, strlen (DATA_KEY_TAG)) == 0) {
			hash = data;
			key = g_strdup (line->str + strlen (DATA_KEY_TAG));
		} else if (strncmp (line->str, DATA_VAL_TAG, strlen (DATA_VAL_TAG)) == 0) {
			hash = data;
			val = g_strdup (line->str + strlen (DATA_VAL_TAG));
		} else if (strncmp (line->str, SECRET_KEY_TAG, strlen (SECRET_KEY_TAG)) == 0) {
			hash = secrets;
			key = g_strdup (line->str + strlen (SECRET_KEY_TAG));
		} else if (strncmp (line->str, SECRET_VAL_TAG, strlen (SECRET_VAL_TAG)) == 0) {
			hash = secrets;
			val = g_strdup (line->str + strlen (SECRET_VAL_TAG));
		}
		g_string_truncate (line, 0);

		if (key && val && hash) {
			g_hash_table_insert (hash, key, val);
			key = NULL;
			val = NULL;
			success = TRUE;  /* Got at least one value */
		}
	}

	if (success) {
		if (out_data)
			*out_data = data;
		else
			g_hash_table_destroy (data);

		if (out_secrets)
			*out_secrets = secrets;
		else
			g_hash_table_destroy (secrets);
	} else {
		g_hash_table_destroy (data);
		g_hash_table_destroy (secrets);
	}

	g_string_free (line, TRUE);
	return success;
}

/**
825
 * nm_vpn_service_plugin_get_secret_flags:
826 827 828 829 830 831 832 833 834 835
 * @data: hash table containing VPN key/value pair data items
 * @secret_name: VPN secret key name for which to retrieve flags for
 * @out_flags: (out): on success, the flags associated with @secret_name
 *
 * Given a VPN secret key name, attempts to find the corresponding flags data
 * item in @data.  If found, converts the flags data item to
 * #NMSettingSecretFlags and returns it.
 *
 * Returns: %TRUE if the flag data item was found and successfully converted
 * to flags, %FALSE if not
836 837
 *
 * Since: 1.2
838 839
 **/
gboolean
840 841 842
nm_vpn_service_plugin_get_secret_flags (GHashTable *data,
                                        const char *secret_name,
                                        NMSettingSecretFlags *out_flags)
843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873
{
	char *flag_name;
	const char *val;
	unsigned long tmp;
	gboolean success = FALSE;

	g_return_val_if_fail (data != NULL, FALSE);
	g_return_val_if_fail (secret_name != NULL, FALSE);
	g_return_val_if_fail (out_flags != NULL, FALSE);
	g_return_val_if_fail (*out_flags == NM_SETTING_SECRET_FLAG_NONE, FALSE);

	flag_name = g_strdup_printf ("%s-flags", secret_name);

	/* Try new flags value first */
	val = g_hash_table_lookup (data, flag_name);
	if (val) {
		errno = 0;
		tmp = strtoul (val, NULL, 10);
		if (errno == 0 && tmp <= NM_SETTING_SECRET_FLAGS_ALL) {
			*out_flags = (NMSettingSecretFlags) tmp;
			success = TRUE;
		}
	}

	g_free (flag_name);
	return success;
}

/***************************************************************/

static void
874 875 876
impl_vpn_service_plugin_disconnect (NMVpnServicePlugin *plugin,
                                    GDBusMethodInvocation *context,
                                    gpointer user_data)
877 878 879
{
	GError *error = NULL;

880
	if (nm_vpn_service_plugin_disconnect (plugin, &error))
881 882 883 884 885 886
		g_dbus_method_invocation_return_value (context, NULL);
	else
		g_dbus_method_invocation_take_error (context, error);
}

static void
887 888 889 890
impl_vpn_service_plugin_set_config (NMVpnServicePlugin *plugin,
                                    GDBusMethodInvocation *context,
                                    GVariant *config,
                                    gpointer user_data)
891
{
892
	nm_vpn_service_plugin_set_config (plugin, config);
893 894 895 896
	g_dbus_method_invocation_return_value (context, NULL);
}

static void
897 898 899 900
impl_vpn_service_plugin_set_ip4_config (NMVpnServicePlugin *plugin,
                                        GDBusMethodInvocation *context,
                                        GVariant *config,
                                        gpointer user_data)
901
{
902
	nm_vpn_service_plugin_set_ip4_config (plugin, config);
903 904 905 906
	g_dbus_method_invocation_return_value (context, NULL);
}

static void
907 908 909 910
impl_vpn_service_plugin_set_ip6_config (NMVpnServicePlugin *plugin,
                                        GDBusMethodInvocation *context,
                                        GVariant *config,
                                        gpointer user_data)
911
{
912
	nm_vpn_service_plugin_set_ip6_config (plugin, config);
913 914 915 916
	g_dbus_method_invocation_return_value (context, NULL);
}

static void
917 918 919 920
impl_vpn_service_plugin_set_failure (NMVpnServicePlugin *plugin,
                                     GDBusMethodInvocation *context,
                                     char *reason,
                                     gpointer user_data)
921
{
922
	nm_vpn_service_plugin_failure (plugin, NM_VPN_PLUGIN_FAILURE_BAD_IP_CONFIG);
923 924 925 926 927 928 929 930
	g_dbus_method_invocation_return_value (context, NULL);
}

/*********************************************************************/

static void
sigterm_handler (int signum)
{
931
	g_slist_foreach (active_plugins, (GFunc) nm_vpn_service_plugin_emit_quit, NULL);
932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957
}

static void
setup_unix_signal_handler (void)
{
	struct sigaction action;
	sigset_t block_mask;

	action.sa_handler = sigterm_handler;
	sigemptyset (&block_mask);
	action.sa_mask = block_mask;
	action.sa_flags = 0;
	sigaction (SIGINT, &action, NULL);
	sigaction (SIGTERM, &action, NULL);
}

/*********************************************************************/

static void
one_plugin_destroyed (gpointer data,
                      GObject *object)
{
	active_plugins = g_slist_remove (active_plugins, object);
}

static void
958
nm_vpn_service_plugin_init (NMVpnServicePlugin *plugin)
959 960 961 962 963 964 965 966 967 968
{
	active_plugins = g_slist_append (active_plugins, plugin);
	g_object_weak_ref (G_OBJECT (plugin),
	                   one_plugin_destroyed,
	                   NULL);
}

static gboolean
init_sync (GInitable *initable, GCancellable *cancellable, GError **error)
{
969 970
	NMVpnServicePlugin *plugin = NM_VPN_SERVICE_PLUGIN (initable);
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996
	GDBusConnection *connection = NULL;
	GDBusProxy *proxy;
	GVariant *ret;
	gboolean success = FALSE;

	if (!priv->dbus_service_name) {
		g_set_error_literal (error, NM_VPN_PLUGIN_ERROR, NM_VPN_PLUGIN_ERROR_BAD_ARGUMENTS,
		                     _("No service name specified"));
		return FALSE;
	}

	connection = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, error);
	if (!connection)
		return FALSE;

	proxy = g_dbus_proxy_new_sync (connection,
	                               G_DBUS_PROXY_FLAGS_DO_NOT_LOAD_PROPERTIES |
	                               G_DBUS_PROXY_FLAGS_DO_NOT_CONNECT_SIGNALS,
	                               NULL,
	                               DBUS_SERVICE_DBUS,
	                               DBUS_PATH_DBUS,
	                               DBUS_INTERFACE_DBUS,
	                               cancellable, error);
	if (!proxy)
		goto out;

997 998
	priv->dbus_vpn_service_plugin = nmdbus_vpn_plugin_skeleton_new ();
	if (!g_dbus_interface_skeleton_export (G_DBUS_INTERFACE_SKELETON (priv->dbus_vpn_service_plugin),
999 1000 1001 1002 1003
	                                       connection,
	                                       NM_VPN_DBUS_PLUGIN_PATH,
	                                       error))
		goto out;

1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014
	_nm_dbus_bind_properties (plugin, priv->dbus_vpn_service_plugin);
	_nm_dbus_bind_methods (plugin, priv->dbus_vpn_service_plugin,
	                       "Connect", impl_vpn_service_plugin_connect,
	                       "ConnectInteractive", impl_vpn_service_plugin_connect_interactive,
	                       "NeedSecrets", impl_vpn_service_plugin_need_secrets,
	                       "NewSecrets", impl_vpn_service_plugin_new_secrets,
	                       "Disconnect", impl_vpn_service_plugin_disconnect,
	                       "SetConfig", impl_vpn_service_plugin_set_config,
	                       "SetIp4Config", impl_vpn_service_plugin_set_ip4_config,
	                       "SetIp6Config", impl_vpn_service_plugin_set_ip6_config,
	                       "SetFailure", impl_vpn_service_plugin_set_failure,
1015 1016
	                       NULL);

1017 1018
	nm_vpn_service_plugin_set_connection (plugin, connection);
	nm_vpn_service_plugin_set_state (plugin, NM_VPN_SERVICE_STATE_INIT);
1019

1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
	ret = g_dbus_proxy_call_sync (proxy,
	                              "RequestName",
	                              g_variant_new ("(su)", priv->dbus_service_name, 0),
	                              G_DBUS_CALL_FLAGS_NONE, -1,
	                              cancellable, error);
	g_object_unref (proxy);
	if (!ret) {
		if (error && *error)
			g_dbus_error_strip_remote_error (*error);
		goto out;
	}
	g_variant_unref (ret);

1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044
	success = TRUE;

 out:
	g_clear_object (&connection);

	return success;
}

static void
set_property (GObject *object, guint prop_id,
              const GValue *value, GParamSpec *pspec)
{
1045
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (object);
1046 1047 1048 1049 1050 1051

	switch (prop_id) {
	case PROP_DBUS_SERVICE_NAME:
		/* Construct-only */
		priv->dbus_service_name = g_value_dup_string (value);
		break;
1052 1053 1054 1055
	case PROP_DBUS_WATCH_PEER:
		/* Construct-only */
		priv->dbus_watch_peer = g_value_get_boolean (value);
		break;
1056
	case PROP_STATE:
1057
		nm_vpn_service_plugin_set_state (NM_VPN_SERVICE_PLUGIN (object),
1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069
		                             (NMVpnServiceState) g_value_get_enum (value));
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
		break;
	}
}

static void
get_property (GObject *object, guint prop_id,
              GValue *value, GParamSpec *pspec)
{
1070
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (object);
1071 1072 1073 1074 1075

	switch (prop_id) {
	case PROP_DBUS_SERVICE_NAME:
		g_value_set_string (value, priv->dbus_service_name);
		break;
1076 1077 1078
	case PROP_DBUS_WATCH_PEER:
		g_value_set_boolean (value, priv->dbus_watch_peer);
		break;
1079
	case PROP_STATE:
1080
		g_value_set_enum (value, nm_vpn_service_plugin_get_state (NM_VPN_SERVICE_PLUGIN (object)));
1081 1082 1083 1084 1085 1086 1087 1088 1089 1090
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
		break;
	}
}

static void
dispose (GObject *object)
{
1091 1092
	NMVpnServicePlugin *plugin = NM_VPN_SERVICE_PLUGIN (object);
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
1093 1094 1095 1096 1097 1098 1099
	NMVpnServiceState state;
	GError *err = NULL;

	nm_clear_g_source (&priv->fail_stop_id);
	nm_clear_g_source (&priv->quit_timer);
	nm_clear_g_source (&priv->connect_timer);

1100
	state = nm_vpn_service_plugin_get_state (plugin);
1101 1102 1103

	if (state == NM_VPN_SERVICE_STATE_STARTED ||
	    state == NM_VPN_SERVICE_STATE_STARTING)
1104
		nm_vpn_service_plugin_disconnect (plugin, &err);
1105 1106 1107 1108 1109 1110

	if (err) {
		g_warning ("Error disconnecting VPN connection: %s", err->message);
		g_error_free (err);
	}

1111
	G_OBJECT_CLASS (nm_vpn_service_plugin_parent_class)->dispose (object);
1112 1113 1114 1115 1116
}

static void
finalize (GObject *object)
{
1117 1118
	NMVpnServicePlugin *plugin = NM_VPN_SERVICE_PLUGIN (object);
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
1119

1120
	nm_vpn_service_plugin_set_connection (plugin, NULL);
1121 1122 1123 1124 1125 1126 1127
	g_free (priv->dbus_service_name);

	g_clear_pointer (&priv->banner, g_variant_unref);
	g_clear_pointer (&priv->tundev, g_variant_unref);
	g_clear_pointer (&priv->gateway, g_variant_unref);
	g_clear_pointer (&priv->mtu, g_variant_unref);

1128
	G_OBJECT_CLASS (nm_vpn_service_plugin_parent_class)->finalize (object);
1129 1130 1131
}

static void
1132
state_changed (NMVpnServicePlugin *plugin, NMVpnServiceState state)
1133
{
1134
	NMVpnServicePluginPrivate *priv = NM_VPN_SERVICE_PLUGIN_GET_PRIVATE (plugin);
1135 1136 1137 1138 1139 1140 1141

	switch (state) {
	case NM_VPN_SERVICE_STATE_STARTING:
		nm_clear_g_source (&priv->quit_timer);
		nm_clear_g_source (&priv->fail_stop_id);
		break;
	case NM_VPN_SERVICE_STATE_STOPPED:
1142 1143 1144 1145 1146 1147 1148 1149 1150
		if (priv->dbus_watch_peer)
			nm_vpn_service_plugin_emit_quit (plugin);
		else
			schedule_quit_timer (plugin);
		if (priv->peer_watch_id) {
			g_dbus_connection_signal_unsubscribe (nm_vpn_service_plugin_get_connection (plugin),
			                                      priv->peer_watch_id);
			priv->peer_watch_id = 0;
		}
1151