00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023 #include "dbus-auth.h"
00024 #include "dbus-string.h"
00025 #include "dbus-list.h"
00026 #include "dbus-internals.h"
00027 #include "dbus-keyring.h"
00028 #include "dbus-sha.h"
00029 #include "dbus-protocol.h"
00030 #include "dbus-userdb.h"
00031
00068 typedef dbus_bool_t (* DBusInitialResponseFunction) (DBusAuth *auth,
00069 DBusString *response);
00070
00075 typedef dbus_bool_t (* DBusAuthDataFunction) (DBusAuth *auth,
00076 const DBusString *data);
00077
00081 typedef dbus_bool_t (* DBusAuthEncodeFunction) (DBusAuth *auth,
00082 const DBusString *data,
00083 DBusString *encoded);
00084
00088 typedef dbus_bool_t (* DBusAuthDecodeFunction) (DBusAuth *auth,
00089 const DBusString *data,
00090 DBusString *decoded);
00091
00095 typedef void (* DBusAuthShutdownFunction) (DBusAuth *auth);
00096
00100 typedef struct
00101 {
00102 const char *mechanism;
00103 DBusAuthDataFunction server_data_func;
00104 DBusAuthEncodeFunction server_encode_func;
00105 DBusAuthDecodeFunction server_decode_func;
00106 DBusAuthShutdownFunction server_shutdown_func;
00107 DBusInitialResponseFunction client_initial_response_func;
00108 DBusAuthDataFunction client_data_func;
00109 DBusAuthEncodeFunction client_encode_func;
00110 DBusAuthDecodeFunction client_decode_func;
00111 DBusAuthShutdownFunction client_shutdown_func;
00112 } DBusAuthMechanismHandler;
00113
00117 typedef enum {
00118 DBUS_AUTH_COMMAND_AUTH,
00119 DBUS_AUTH_COMMAND_CANCEL,
00120 DBUS_AUTH_COMMAND_DATA,
00121 DBUS_AUTH_COMMAND_BEGIN,
00122 DBUS_AUTH_COMMAND_REJECTED,
00123 DBUS_AUTH_COMMAND_OK,
00124 DBUS_AUTH_COMMAND_ERROR,
00125 DBUS_AUTH_COMMAND_UNKNOWN
00126 } DBusAuthCommand;
00127
00133 typedef dbus_bool_t (* DBusAuthStateFunction) (DBusAuth *auth,
00134 DBusAuthCommand command,
00135 const DBusString *args);
00136
00140 typedef struct
00141 {
00142 const char *name;
00143 DBusAuthStateFunction handler;
00144 } DBusAuthStateData;
00145
00149 struct DBusAuth
00150 {
00151 int refcount;
00152 const char *side;
00154 DBusString incoming;
00155 DBusString outgoing;
00157 const DBusAuthStateData *state;
00159 const DBusAuthMechanismHandler *mech;
00161 DBusString identity;
00165 DBusCredentials credentials;
00169 DBusCredentials authorized_identity;
00171 DBusCredentials desired_identity;
00173 DBusString context;
00174 DBusKeyring *keyring;
00175 int cookie_id;
00176 DBusString challenge;
00178 char **allowed_mechs;
00182 unsigned int needed_memory : 1;
00185 unsigned int already_got_mechanisms : 1;
00186 unsigned int already_asked_for_initial_response : 1;
00187 unsigned int buffer_outstanding : 1;
00188 };
00189
00193 typedef struct
00194 {
00195 DBusAuth base;
00197 DBusList *mechs_to_try;
00199 DBusString guid_from_server;
00201 } DBusAuthClient;
00202
00206 typedef struct
00207 {
00208 DBusAuth base;
00210 int failures;
00211 int max_failures;
00213 DBusString guid;
00215 } DBusAuthServer;
00216
00217 static void goto_state (DBusAuth *auth,
00218 const DBusAuthStateData *new_state);
00219 static dbus_bool_t send_auth (DBusAuth *auth,
00220 const DBusAuthMechanismHandler *mech);
00221 static dbus_bool_t send_data (DBusAuth *auth,
00222 DBusString *data);
00223 static dbus_bool_t send_rejected (DBusAuth *auth);
00224 static dbus_bool_t send_error (DBusAuth *auth,
00225 const char *message);
00226 static dbus_bool_t send_ok (DBusAuth *auth);
00227 static dbus_bool_t send_begin (DBusAuth *auth,
00228 const DBusString *args_from_ok);
00229 static dbus_bool_t send_cancel (DBusAuth *auth);
00230
00235 static dbus_bool_t handle_server_state_waiting_for_auth (DBusAuth *auth,
00236 DBusAuthCommand command,
00237 const DBusString *args);
00238 static dbus_bool_t handle_server_state_waiting_for_data (DBusAuth *auth,
00239 DBusAuthCommand command,
00240 const DBusString *args);
00241 static dbus_bool_t handle_server_state_waiting_for_begin (DBusAuth *auth,
00242 DBusAuthCommand command,
00243 const DBusString *args);
00244
00245 static const DBusAuthStateData server_state_waiting_for_auth = {
00246 "WaitingForAuth", handle_server_state_waiting_for_auth
00247 };
00248 static const DBusAuthStateData server_state_waiting_for_data = {
00249 "WaitingForData", handle_server_state_waiting_for_data
00250 };
00251 static const DBusAuthStateData server_state_waiting_for_begin = {
00252 "WaitingForBegin", handle_server_state_waiting_for_begin
00253 };
00254
00259 static dbus_bool_t handle_client_state_waiting_for_data (DBusAuth *auth,
00260 DBusAuthCommand command,
00261 const DBusString *args);
00262 static dbus_bool_t handle_client_state_waiting_for_ok (DBusAuth *auth,
00263 DBusAuthCommand command,
00264 const DBusString *args);
00265 static dbus_bool_t handle_client_state_waiting_for_reject (DBusAuth *auth,
00266 DBusAuthCommand command,
00267 const DBusString *args);
00268
00269 static const DBusAuthStateData client_state_need_send_auth = {
00270 "NeedSendAuth", NULL
00271 };
00272 static const DBusAuthStateData client_state_waiting_for_data = {
00273 "WaitingForData", handle_client_state_waiting_for_data
00274 };
00275 static const DBusAuthStateData client_state_waiting_for_ok = {
00276 "WaitingForOK", handle_client_state_waiting_for_ok
00277 };
00278 static const DBusAuthStateData client_state_waiting_for_reject = {
00279 "WaitingForReject", handle_client_state_waiting_for_reject
00280 };
00281
00286 static const DBusAuthStateData common_state_authenticated = {
00287 "Authenticated", NULL
00288 };
00289
00290 static const DBusAuthStateData common_state_need_disconnect = {
00291 "NeedDisconnect", NULL
00292 };
00293
00294 static const char auth_side_client[] = "client";
00295 static const char auth_side_server[] = "server";
00300 #define DBUS_AUTH_IS_SERVER(auth) ((auth)->side == auth_side_server)
00301
00305 #define DBUS_AUTH_IS_CLIENT(auth) ((auth)->side == auth_side_client)
00306
00310 #define DBUS_AUTH_CLIENT(auth) ((DBusAuthClient*)(auth))
00311
00315 #define DBUS_AUTH_SERVER(auth) ((DBusAuthServer*)(auth))
00316
00322 #define DBUS_AUTH_NAME(auth) ((auth)->side)
00323
00324 static DBusAuth*
00325 _dbus_auth_new (int size)
00326 {
00327 DBusAuth *auth;
00328
00329 auth = dbus_malloc0 (size);
00330 if (auth == NULL)
00331 return NULL;
00332
00333 auth->refcount = 1;
00334
00335 _dbus_credentials_clear (&auth->credentials);
00336 _dbus_credentials_clear (&auth->authorized_identity);
00337 _dbus_credentials_clear (&auth->desired_identity);
00338
00339 auth->keyring = NULL;
00340 auth->cookie_id = -1;
00341
00342
00343
00344
00345
00346
00347
00348
00349
00350 if (!_dbus_string_init (&auth->incoming))
00351 goto enomem_0;
00352
00353 if (!_dbus_string_init (&auth->outgoing))
00354 goto enomem_1;
00355
00356 if (!_dbus_string_init (&auth->identity))
00357 goto enomem_2;
00358
00359 if (!_dbus_string_init (&auth->context))
00360 goto enomem_3;
00361
00362 if (!_dbus_string_init (&auth->challenge))
00363 goto enomem_4;
00364
00365
00366 if (!_dbus_string_append (&auth->context, "org_freedesktop_general"))
00367 goto enomem_5;
00368
00369 return auth;
00370
00371 enomem_5:
00372 _dbus_string_free (&auth->challenge);
00373 enomem_4:
00374 _dbus_string_free (&auth->context);
00375 enomem_3:
00376 _dbus_string_free (&auth->identity);
00377 enomem_2:
00378 _dbus_string_free (&auth->outgoing);
00379 enomem_1:
00380 _dbus_string_free (&auth->incoming);
00381 enomem_0:
00382 dbus_free (auth);
00383 return NULL;
00384 }
00385
00386 static void
00387 shutdown_mech (DBusAuth *auth)
00388 {
00389
00390 auth->already_asked_for_initial_response = FALSE;
00391 _dbus_string_set_length (&auth->identity, 0);
00392
00393 _dbus_credentials_clear (&auth->authorized_identity);
00394 _dbus_credentials_clear (&auth->desired_identity);
00395
00396 if (auth->mech != NULL)
00397 {
00398 _dbus_verbose ("%s: Shutting down mechanism %s\n",
00399 DBUS_AUTH_NAME (auth), auth->mech->mechanism);
00400
00401 if (DBUS_AUTH_IS_CLIENT (auth))
00402 (* auth->mech->client_shutdown_func) (auth);
00403 else
00404 (* auth->mech->server_shutdown_func) (auth);
00405
00406 auth->mech = NULL;
00407 }
00408 }
00409
00410
00411
00412
00413
00414 static dbus_bool_t
00415 sha1_compute_hash (DBusAuth *auth,
00416 int cookie_id,
00417 const DBusString *server_challenge,
00418 const DBusString *client_challenge,
00419 DBusString *hash)
00420 {
00421 DBusString cookie;
00422 DBusString to_hash;
00423 dbus_bool_t retval;
00424
00425 _dbus_assert (auth->keyring != NULL);
00426
00427 retval = FALSE;
00428
00429 if (!_dbus_string_init (&cookie))
00430 return FALSE;
00431
00432 if (!_dbus_keyring_get_hex_key (auth->keyring, cookie_id,
00433 &cookie))
00434 goto out_0;
00435
00436 if (_dbus_string_get_length (&cookie) == 0)
00437 {
00438 retval = TRUE;
00439 goto out_0;
00440 }
00441
00442 if (!_dbus_string_init (&to_hash))
00443 goto out_0;
00444
00445 if (!_dbus_string_copy (server_challenge, 0,
00446 &to_hash, _dbus_string_get_length (&to_hash)))
00447 goto out_1;
00448
00449 if (!_dbus_string_append (&to_hash, ":"))
00450 goto out_1;
00451
00452 if (!_dbus_string_copy (client_challenge, 0,
00453 &to_hash, _dbus_string_get_length (&to_hash)))
00454 goto out_1;
00455
00456 if (!_dbus_string_append (&to_hash, ":"))
00457 goto out_1;
00458
00459 if (!_dbus_string_copy (&cookie, 0,
00460 &to_hash, _dbus_string_get_length (&to_hash)))
00461 goto out_1;
00462
00463 if (!_dbus_sha_compute (&to_hash, hash))
00464 goto out_1;
00465
00466 retval = TRUE;
00467
00468 out_1:
00469 _dbus_string_zero (&to_hash);
00470 _dbus_string_free (&to_hash);
00471 out_0:
00472 _dbus_string_zero (&cookie);
00473 _dbus_string_free (&cookie);
00474 return retval;
00475 }
00476
00481 #define N_CHALLENGE_BYTES (128/8)
00482
00483 static dbus_bool_t
00484 sha1_handle_first_client_response (DBusAuth *auth,
00485 const DBusString *data)
00486 {
00487
00488
00489
00490 DBusString tmp;
00491 DBusString tmp2;
00492 dbus_bool_t retval;
00493 DBusError error;
00494
00495 retval = FALSE;
00496
00497 _dbus_string_set_length (&auth->challenge, 0);
00498
00499 if (_dbus_string_get_length (data) > 0)
00500 {
00501 if (_dbus_string_get_length (&auth->identity) > 0)
00502 {
00503
00504 _dbus_verbose ("%s: client tried to send auth identity, but we already have one\n",
00505 DBUS_AUTH_NAME (auth));
00506 return send_rejected (auth);
00507 }
00508 else
00509 {
00510
00511 if (!_dbus_string_copy (data, 0, &auth->identity, 0))
00512 return FALSE;
00513 }
00514 }
00515
00516 if (!_dbus_credentials_from_username (data, &auth->desired_identity))
00517 {
00518 _dbus_verbose ("%s: Did not get a valid username from client\n",
00519 DBUS_AUTH_NAME (auth));
00520 return send_rejected (auth);
00521 }
00522
00523 if (!_dbus_string_init (&tmp))
00524 return FALSE;
00525
00526 if (!_dbus_string_init (&tmp2))
00527 {
00528 _dbus_string_free (&tmp);
00529 return FALSE;
00530 }
00531
00532
00533
00534
00535
00536 if (auth->keyring &&
00537 !_dbus_keyring_is_for_user (auth->keyring,
00538 data))
00539 {
00540 _dbus_keyring_unref (auth->keyring);
00541 auth->keyring = NULL;
00542 }
00543
00544 if (auth->keyring == NULL)
00545 {
00546 dbus_error_init (&error);
00547 auth->keyring = _dbus_keyring_new_homedir (data,
00548 &auth->context,
00549 &error);
00550
00551 if (auth->keyring == NULL)
00552 {
00553 if (dbus_error_has_name (&error,
00554 DBUS_ERROR_NO_MEMORY))
00555 {
00556 dbus_error_free (&error);
00557 goto out;
00558 }
00559 else
00560 {
00561 _DBUS_ASSERT_ERROR_IS_SET (&error);
00562 _dbus_verbose ("%s: Error loading keyring: %s\n",
00563 DBUS_AUTH_NAME (auth), error.message);
00564 if (send_rejected (auth))
00565 retval = TRUE;
00566 dbus_error_free (&error);
00567 goto out;
00568 }
00569 }
00570 else
00571 {
00572 _dbus_assert (!dbus_error_is_set (&error));
00573 }
00574 }
00575
00576 _dbus_assert (auth->keyring != NULL);
00577
00578 dbus_error_init (&error);
00579 auth->cookie_id = _dbus_keyring_get_best_key (auth->keyring, &error);
00580 if (auth->cookie_id < 0)
00581 {
00582 _DBUS_ASSERT_ERROR_IS_SET (&error);
00583 _dbus_verbose ("%s: Could not get a cookie ID to send to client: %s\n",
00584 DBUS_AUTH_NAME (auth), error.message);
00585 if (send_rejected (auth))
00586 retval = TRUE;
00587 dbus_error_free (&error);
00588 goto out;
00589 }
00590 else
00591 {
00592 _dbus_assert (!dbus_error_is_set (&error));
00593 }
00594
00595 if (!_dbus_string_copy (&auth->context, 0,
00596 &tmp2, _dbus_string_get_length (&tmp2)))
00597 goto out;
00598
00599 if (!_dbus_string_append (&tmp2, " "))
00600 goto out;
00601
00602 if (!_dbus_string_append_int (&tmp2, auth->cookie_id))
00603 goto out;
00604
00605 if (!_dbus_string_append (&tmp2, " "))
00606 goto out;
00607
00608 if (!_dbus_generate_random_bytes (&tmp, N_CHALLENGE_BYTES))
00609 goto out;
00610
00611 _dbus_string_set_length (&auth->challenge, 0);
00612 if (!_dbus_string_hex_encode (&tmp, 0, &auth->challenge, 0))
00613 goto out;
00614
00615 if (!_dbus_string_hex_encode (&tmp, 0, &tmp2,
00616 _dbus_string_get_length (&tmp2)))
00617 goto out;
00618
00619 if (!send_data (auth, &tmp2))
00620 goto out;
00621
00622 goto_state (auth, &server_state_waiting_for_data);
00623 retval = TRUE;
00624
00625 out:
00626 _dbus_string_zero (&tmp);
00627 _dbus_string_free (&tmp);
00628 _dbus_string_zero (&tmp2);
00629 _dbus_string_free (&tmp2);
00630
00631 return retval;
00632 }
00633
00634 static dbus_bool_t
00635 sha1_handle_second_client_response (DBusAuth *auth,
00636 const DBusString *data)
00637 {
00638
00639
00640
00641
00642
00643 int i;
00644 DBusString client_challenge;
00645 DBusString client_hash;
00646 dbus_bool_t retval;
00647 DBusString correct_hash;
00648
00649 retval = FALSE;
00650
00651 if (!_dbus_string_find_blank (data, 0, &i))
00652 {
00653 _dbus_verbose ("%s: no space separator in client response\n",
00654 DBUS_AUTH_NAME (auth));
00655 return send_rejected (auth);
00656 }
00657
00658 if (!_dbus_string_init (&client_challenge))
00659 goto out_0;
00660
00661 if (!_dbus_string_init (&client_hash))
00662 goto out_1;
00663
00664 if (!_dbus_string_copy_len (data, 0, i, &client_challenge,
00665 0))
00666 goto out_2;
00667
00668 _dbus_string_skip_blank (data, i, &i);
00669
00670 if (!_dbus_string_copy_len (data, i,
00671 _dbus_string_get_length (data) - i,
00672 &client_hash,
00673 0))
00674 goto out_2;
00675
00676 if (_dbus_string_get_length (&client_challenge) == 0 ||
00677 _dbus_string_get_length (&client_hash) == 0)
00678 {
00679 _dbus_verbose ("%s: zero-length client challenge or hash\n",
00680 DBUS_AUTH_NAME (auth));
00681 if (send_rejected (auth))
00682 retval = TRUE;
00683 goto out_2;
00684 }
00685
00686 if (!_dbus_string_init (&correct_hash))
00687 goto out_2;
00688
00689 if (!sha1_compute_hash (auth, auth->cookie_id,
00690 &auth->challenge,
00691 &client_challenge,
00692 &correct_hash))
00693 goto out_3;
00694
00695
00696 if (_dbus_string_get_length (&correct_hash) == 0)
00697 {
00698 if (send_rejected (auth))
00699 retval = TRUE;
00700 goto out_3;
00701 }
00702
00703 if (!_dbus_string_equal (&client_hash, &correct_hash))
00704 {
00705 if (send_rejected (auth))
00706 retval = TRUE;
00707 goto out_3;
00708 }
00709
00710 if (!send_ok (auth))
00711 goto out_3;
00712
00713 _dbus_verbose ("%s: authenticated client with UID "DBUS_UID_FORMAT" using DBUS_COOKIE_SHA1\n",
00714 DBUS_AUTH_NAME (auth), auth->desired_identity.uid);
00715
00716 auth->authorized_identity = auth->desired_identity;
00717 retval = TRUE;
00718
00719 out_3:
00720 _dbus_string_zero (&correct_hash);
00721 _dbus_string_free (&correct_hash);
00722 out_2:
00723 _dbus_string_zero (&client_hash);
00724 _dbus_string_free (&client_hash);
00725 out_1:
00726 _dbus_string_free (&client_challenge);
00727 out_0:
00728 return retval;
00729 }
00730
00731 static dbus_bool_t
00732 handle_server_data_cookie_sha1_mech (DBusAuth *auth,
00733 const DBusString *data)
00734 {
00735 if (auth->cookie_id < 0)
00736 return sha1_handle_first_client_response (auth, data);
00737 else
00738 return sha1_handle_second_client_response (auth, data);
00739 }
00740
00741 static void
00742 handle_server_shutdown_cookie_sha1_mech (DBusAuth *auth)
00743 {
00744 auth->cookie_id = -1;
00745 _dbus_string_set_length (&auth->challenge, 0);
00746 }
00747
00748 static dbus_bool_t
00749 handle_client_initial_response_cookie_sha1_mech (DBusAuth *auth,
00750 DBusString *response)
00751 {
00752 const DBusString *username;
00753 dbus_bool_t retval;
00754
00755 retval = FALSE;
00756
00757 if (!_dbus_username_from_current_process (&username))
00758 goto out_0;
00759
00760 if (!_dbus_string_hex_encode (username, 0,
00761 response,
00762 _dbus_string_get_length (response)))
00763 goto out_0;
00764
00765 retval = TRUE;
00766
00767 out_0:
00768 return retval;
00769 }
00770
00771 static dbus_bool_t
00772 handle_client_data_cookie_sha1_mech (DBusAuth *auth,
00773 const DBusString *data)
00774 {
00775
00776
00777
00778
00779 dbus_bool_t retval;
00780 DBusString context;
00781 DBusString cookie_id_str;
00782 DBusString server_challenge;
00783 DBusString client_challenge;
00784 DBusString correct_hash;
00785 DBusString tmp;
00786 int i, j;
00787 long val;
00788
00789 retval = FALSE;
00790
00791 if (!_dbus_string_find_blank (data, 0, &i))
00792 {
00793 if (send_error (auth,
00794 "Server did not send context/ID/challenge properly"))
00795 retval = TRUE;
00796 goto out_0;
00797 }
00798
00799 if (!_dbus_string_init (&context))
00800 goto out_0;
00801
00802 if (!_dbus_string_copy_len (data, 0, i,
00803 &context, 0))
00804 goto out_1;
00805
00806 _dbus_string_skip_blank (data, i, &i);
00807 if (!_dbus_string_find_blank (data, i, &j))
00808 {
00809 if (send_error (auth,
00810 "Server did not send context/ID/challenge properly"))
00811 retval = TRUE;
00812 goto out_1;
00813 }
00814
00815 if (!_dbus_string_init (&cookie_id_str))
00816 goto out_1;
00817
00818 if (!_dbus_string_copy_len (data, i, j - i,
00819 &cookie_id_str, 0))
00820 goto out_2;
00821
00822 if (!_dbus_string_init (&server_challenge))
00823 goto out_2;
00824
00825 i = j;
00826 _dbus_string_skip_blank (data, i, &i);
00827 j = _dbus_string_get_length (data);
00828
00829 if (!_dbus_string_copy_len (data, i, j - i,
00830 &server_challenge, 0))
00831 goto out_3;
00832
00833 if (!_dbus_keyring_validate_context (&context))
00834 {
00835 if (send_error (auth, "Server sent invalid cookie context"))
00836 retval = TRUE;
00837 goto out_3;
00838 }
00839
00840 if (!_dbus_string_parse_int (&cookie_id_str, 0, &val, NULL))
00841 {
00842 if (send_error (auth, "Could not parse cookie ID as an integer"))
00843 retval = TRUE;
00844 goto out_3;
00845 }
00846
00847 if (_dbus_string_get_length (&server_challenge) == 0)
00848 {
00849 if (send_error (auth, "Empty server challenge string"))
00850 retval = TRUE;
00851 goto out_3;
00852 }
00853
00854 if (auth->keyring == NULL)
00855 {
00856 DBusError error;
00857
00858 dbus_error_init (&error);
00859 auth->keyring = _dbus_keyring_new_homedir (NULL,
00860 &context,
00861 &error);
00862
00863 if (auth->keyring == NULL)
00864 {
00865 if (dbus_error_has_name (&error,
00866 DBUS_ERROR_NO_MEMORY))
00867 {
00868 dbus_error_free (&error);
00869 goto out_3;
00870 }
00871 else
00872 {
00873 _DBUS_ASSERT_ERROR_IS_SET (&error);
00874
00875 _dbus_verbose ("%s: Error loading keyring: %s\n",
00876 DBUS_AUTH_NAME (auth), error.message);
00877
00878 if (send_error (auth, "Could not load cookie file"))
00879 retval = TRUE;
00880
00881 dbus_error_free (&error);
00882 goto out_3;
00883 }
00884 }
00885 else
00886 {
00887 _dbus_assert (!dbus_error_is_set (&error));
00888 }
00889 }
00890
00891 _dbus_assert (auth->keyring != NULL);
00892
00893 if (!_dbus_string_init (&tmp))
00894 goto out_3;
00895
00896 if (!_dbus_generate_random_bytes (&tmp, N_CHALLENGE_BYTES))
00897 goto out_4;
00898
00899 if (!_dbus_string_init (&client_challenge))
00900 goto out_4;
00901
00902 if (!_dbus_string_hex_encode (&tmp, 0, &client_challenge, 0))
00903 goto out_5;
00904
00905 if (!_dbus_string_init (&correct_hash))
00906 goto out_5;
00907
00908 if (!sha1_compute_hash (auth, val,
00909 &server_challenge,
00910 &client_challenge,
00911 &correct_hash))
00912 goto out_6;
00913
00914 if (_dbus_string_get_length (&correct_hash) == 0)
00915 {
00916
00917 if (send_error (auth, "Don't have the requested cookie ID"))
00918 retval = TRUE;
00919 goto out_6;
00920 }
00921
00922 _dbus_string_set_length (&tmp, 0);
00923
00924 if (!_dbus_string_copy (&client_challenge, 0, &tmp,
00925 _dbus_string_get_length (&tmp)))
00926 goto out_6;
00927
00928 if (!_dbus_string_append (&tmp, " "))
00929 goto out_6;
00930
00931 if (!_dbus_string_copy (&correct_hash, 0, &tmp,
00932 _dbus_string_get_length (&tmp)))
00933 goto out_6;
00934
00935 if (!send_data (auth, &tmp))
00936 goto out_6;
00937
00938 retval = TRUE;
00939
00940 out_6:
00941 _dbus_string_zero (&correct_hash);
00942 _dbus_string_free (&correct_hash);
00943 out_5:
00944 _dbus_string_free (&client_challenge);
00945 out_4:
00946 _dbus_string_zero (&tmp);
00947 _dbus_string_free (&tmp);
00948 out_3:
00949 _dbus_string_free (&server_challenge);
00950 out_2:
00951 _dbus_string_free (&cookie_id_str);
00952 out_1:
00953 _dbus_string_free (&context);
00954 out_0:
00955 return retval;
00956 }
00957
00958 static void
00959 handle_client_shutdown_cookie_sha1_mech (DBusAuth *auth)
00960 {
00961 auth->cookie_id = -1;
00962 _dbus_string_set_length (&auth->challenge, 0);
00963 }
00964
00965 static dbus_bool_t
00966 handle_server_data_external_mech (DBusAuth *auth,
00967 const DBusString *data)
00968 {
00969 if (auth->credentials.uid == DBUS_UID_UNSET)
00970 {
00971 auth->credentials.uid = 0;
00972 }
00973
00974 if (_dbus_string_get_length (data) > 0)
00975 {
00976 if (_dbus_string_get_length (&auth->identity) > 0)
00977 {
00978
00979 _dbus_verbose ("%s: client tried to send auth identity, but we already have one\n",
00980 DBUS_AUTH_NAME (auth));
00981 return send_rejected (auth);
00982 }
00983 else
00984 {
00985
00986 if (!_dbus_string_copy (data, 0, &auth->identity, 0))
00987 return FALSE;
00988 }
00989 }
00990
00991
00992 if (_dbus_string_get_length (&auth->identity) == 0 &&
00993 !auth->already_asked_for_initial_response)
00994 {
00995 if (send_data (auth, NULL))
00996 {
00997 _dbus_verbose ("%s: sending empty challenge asking client for auth identity\n",
00998 DBUS_AUTH_NAME (auth));
00999 auth->already_asked_for_initial_response = TRUE;
01000 return TRUE;
01001 }
01002 else
01003 return FALSE;
01004 }
01005
01006 _dbus_credentials_clear (&auth->desired_identity);
01007
01008
01009
01010
01011
01012
01013 if (_dbus_string_get_length (&auth->identity) == 0)
01014 {
01015 auth->desired_identity.uid = auth->credentials.uid;
01016 }
01017 else
01018 {
01019 if (!_dbus_parse_uid (&auth->identity,
01020 &auth->desired_identity.uid))
01021 {
01022 _dbus_verbose ("%s: could not get credentials from uid string\n",
01023 DBUS_AUTH_NAME (auth));
01024 return send_rejected (auth);
01025 }
01026 }
01027
01028 if (auth->desired_identity.uid == DBUS_UID_UNSET)
01029 {
01030 _dbus_verbose ("%s: desired user %s is no good\n",
01031 DBUS_AUTH_NAME (auth),
01032 _dbus_string_get_const_data (&auth->identity));
01033 return send_rejected (auth);
01034 }
01035
01036 if (_dbus_credentials_match (&auth->desired_identity,
01037 &auth->credentials))
01038 {
01039
01040 if (!send_ok (auth))
01041 return FALSE;
01042
01043 _dbus_verbose ("%s: authenticated client with UID "DBUS_UID_FORMAT
01044 " matching socket credentials UID "DBUS_UID_FORMAT"\n",
01045 DBUS_AUTH_NAME (auth),
01046 auth->desired_identity.uid,
01047 auth->credentials.uid);
01048
01049 auth->authorized_identity.pid = auth->credentials.pid;
01050 auth->authorized_identity.uid = auth->desired_identity.uid;
01051 return TRUE;
01052 }
01053 else
01054 {
01055 _dbus_verbose ("%s: credentials uid="DBUS_UID_FORMAT
01056 " gid="DBUS_GID_FORMAT
01057 " do not allow uid="DBUS_UID_FORMAT
01058 " gid="DBUS_GID_FORMAT"\n",
01059 DBUS_AUTH_NAME (auth),
01060 auth->credentials.uid, auth->credentials.gid,
01061 auth->desired_identity.uid, auth->desired_identity.gid);
01062 return send_rejected (auth);
01063 }
01064 }
01065
01066 static void
01067 handle_server_shutdown_external_mech (DBusAuth *auth)
01068 {
01069
01070 }
01071
01072 static dbus_bool_t
01073 handle_client_initial_response_external_mech (DBusAuth *auth,
01074 DBusString *response)
01075 {
01076
01077
01078
01079
01080
01081 DBusString plaintext;
01082
01083 if (!_dbus_string_init (&plaintext))
01084 return FALSE;
01085
01086 if (!_dbus_string_append_uint (&plaintext,
01087 _dbus_getuid ()))
01088 goto failed;
01089
01090 if (!_dbus_string_hex_encode (&plaintext, 0,
01091 response,
01092 _dbus_string_get_length (response)))
01093 goto failed;
01094
01095 _dbus_string_free (&plaintext);
01096
01097 return TRUE;
01098
01099 failed:
01100 _dbus_string_free (&plaintext);
01101 return FALSE;
01102 }
01103
01104 static dbus_bool_t
01105 handle_client_data_external_mech (DBusAuth *auth,
01106 const DBusString *data)
01107 {
01108
01109 return TRUE;
01110 }
01111
01112 static void
01113 handle_client_shutdown_external_mech (DBusAuth *auth)
01114 {
01115
01116 }
01117
01118
01119
01120
01121
01122
01123
01124
01125
01126
01127 static const DBusAuthMechanismHandler
01128 all_mechanisms[] = {
01129 { "EXTERNAL",
01130 handle_server_data_external_mech,
01131 NULL, NULL,
01132 handle_server_shutdown_external_mech,
01133 handle_client_initial_response_external_mech,
01134 handle_client_data_external_mech,
01135 NULL, NULL,
01136 handle_client_shutdown_external_mech },
01137 { "DBUS_COOKIE_SHA1",
01138 handle_server_data_cookie_sha1_mech,
01139 NULL, NULL,
01140 handle_server_shutdown_cookie_sha1_mech,
01141 handle_client_initial_response_cookie_sha1_mech,
01142 handle_client_data_cookie_sha1_mech,
01143 NULL, NULL,
01144 handle_client_shutdown_cookie_sha1_mech },
01145 { NULL, NULL }
01146 };
01147
01148 static const DBusAuthMechanismHandler*
01149 find_mech (const DBusString *name,
01150 char **allowed_mechs)
01151 {
01152 int i;
01153
01154 if (allowed_mechs != NULL &&
01155 !_dbus_string_array_contains ((const char**) allowed_mechs,
01156 _dbus_string_get_const_data (name)))
01157 return NULL;
01158
01159 i = 0;
01160 while (all_mechanisms[i].mechanism != NULL)
01161 {
01162 if (_dbus_string_equal_c_str (name,
01163 all_mechanisms[i].mechanism))
01164
01165 return &all_mechanisms[i];
01166
01167 ++i;
01168 }
01169
01170 return NULL;
01171 }
01172
01173 static dbus_bool_t
01174 send_auth (DBusAuth *auth, const DBusAuthMechanismHandler *mech)
01175 {
01176 DBusString auth_command;
01177
01178 if (!_dbus_string_init (&auth_command))
01179 return FALSE;
01180
01181 if (!_dbus_string_append (&auth_command,
01182 "AUTH "))
01183 {
01184 _dbus_string_free (&auth_command);
01185 return FALSE;
01186 }
01187
01188 if (!_dbus_string_append (&auth_command,
01189 mech->mechanism))
01190 {
01191 _dbus_string_free (&auth_command);
01192 return FALSE;
01193 }
01194
01195 if (mech->client_initial_response_func != NULL)
01196 {
01197 if (!_dbus_string_append (&auth_command, " "))
01198 {
01199 _dbus_string_free (&auth_command);
01200 return FALSE;
01201 }
01202
01203 if (!(* mech->client_initial_response_func) (auth, &auth_command))
01204 {
01205 _dbus_string_free (&auth_command);
01206 return FALSE;
01207 }
01208 }
01209
01210 if (!_dbus_string_append (&auth_command,
01211 "\r\n"))
01212 {
01213 _dbus_string_free (&auth_command);
01214 return FALSE;
01215 }
01216
01217 if (!_dbus_string_copy (&auth_command, 0,
01218 &auth->outgoing,
01219 _dbus_string_get_length (&auth->outgoing)))
01220 {
01221 _dbus_string_free (&auth_command);
01222 return FALSE;
01223 }
01224
01225 _dbus_string_free (&auth_command);
01226 shutdown_mech (auth);
01227 auth->mech = mech;
01228 goto_state (auth, &client_state_waiting_for_data);
01229
01230 return TRUE;
01231 }
01232
01233 static dbus_bool_t
01234 send_data (DBusAuth *auth, DBusString *data)
01235 {
01236 int old_len;
01237
01238 if (data == NULL || _dbus_string_get_length (data) == 0)
01239 return _dbus_string_append (&auth->outgoing, "DATA\r\n");
01240 else
01241 {
01242 old_len = _dbus_string_get_length (&auth->outgoing);
01243 if (!_dbus_string_append (&auth->outgoing, "DATA "))
01244 goto out;
01245
01246 if (!_dbus_string_hex_encode (data, 0, &auth->outgoing,
01247 _dbus_string_get_length (&auth->outgoing)))
01248 goto out;
01249
01250 if (!_dbus_string_append (&auth->outgoing, "\r\n"))
01251 goto out;
01252
01253 return TRUE;
01254
01255 out:
01256 _dbus_string_set_length (&auth->outgoing, old_len);
01257
01258 return FALSE;
01259 }
01260 }
01261
01262 static dbus_bool_t
01263 send_rejected (DBusAuth *auth)
01264 {
01265 DBusString command;
01266 DBusAuthServer *server_auth;
01267 int i;
01268
01269 if (!_dbus_string_init (&command))
01270 return FALSE;
01271
01272 if (!_dbus_string_append (&command,
01273 "REJECTED"))
01274 goto nomem;
01275
01276 i = 0;
01277 while (all_mechanisms[i].mechanism != NULL)
01278 {
01279 if (!_dbus_string_append (&command,
01280 " "))
01281 goto nomem;
01282
01283 if (!_dbus_string_append (&command,
01284 all_mechanisms[i].mechanism))
01285 goto nomem;
01286
01287 ++i;
01288 }
01289
01290 if (!_dbus_string_append (&command, "\r\n"))
01291 goto nomem;
01292
01293 if (!_dbus_string_copy (&command, 0, &auth->outgoing,
01294 _dbus_string_get_length (&auth->outgoing)))
01295 goto nomem;
01296
01297 shutdown_mech (auth);
01298
01299 _dbus_assert (DBUS_AUTH_IS_SERVER (auth));
01300 server_auth = DBUS_AUTH_SERVER (auth);
01301 server_auth->failures += 1;
01302
01303 if (server_auth->failures >= server_auth->max_failures)
01304 goto_state (auth, &common_state_need_disconnect);
01305 else
01306 goto_state (auth, &server_state_waiting_for_auth);
01307
01308 _dbus_string_free (&command);
01309
01310 return TRUE;
01311
01312 nomem:
01313 _dbus_string_free (&command);
01314 return FALSE;
01315 }
01316
01317 static dbus_bool_t
01318 send_error (DBusAuth *auth, const char *message)
01319 {
01320 return _dbus_string_append_printf (&auth->outgoing,
01321 "ERROR \"%s\"\r\n", message);
01322 }
01323
01324 static dbus_bool_t
01325 send_ok (DBusAuth *auth)
01326 {
01327 int orig_len;
01328
01329 orig_len = _dbus_string_get_length (&auth->outgoing);
01330
01331 if (_dbus_string_append (&auth->outgoing, "OK ") &&
01332 _dbus_string_copy (& DBUS_AUTH_SERVER (auth)->guid,
01333 0,
01334 &auth->outgoing,
01335 _dbus_string_get_length (&auth->outgoing)) &&
01336 _dbus_string_append (&auth->outgoing, "\r\n"))
01337 {
01338 goto_state (auth, &server_state_waiting_for_begin);
01339 return TRUE;
01340 }
01341 else
01342 {
01343 _dbus_string_set_length (&auth->outgoing, orig_len);
01344 return FALSE;
01345 }
01346 }
01347
01348 static dbus_bool_t
01349 send_begin (DBusAuth *auth,
01350 const DBusString *args_from_ok)
01351 {
01352 int end_of_hex;
01353
01354
01355 _dbus_assert (_dbus_string_get_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server) == 0);
01356
01357
01358
01359 end_of_hex = 0;
01360 if (!_dbus_string_hex_decode (args_from_ok, 0, &end_of_hex,
01361 & DBUS_AUTH_CLIENT (auth)->guid_from_server, 0))
01362 return FALSE;
01363
01364
01365 _dbus_string_set_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server, 0);
01366
01367 if (end_of_hex != _dbus_string_get_length (args_from_ok) ||
01368 end_of_hex == 0)
01369 {
01370 _dbus_verbose ("Bad GUID from server, parsed %d bytes and had %d bytes from server\n",
01371 end_of_hex, _dbus_string_get_length (args_from_ok));
01372 goto_state (auth, &common_state_need_disconnect);
01373 return TRUE;
01374 }
01375
01376 if (_dbus_string_copy (args_from_ok, 0, &DBUS_AUTH_CLIENT (auth)->guid_from_server, 0) &&
01377 _dbus_string_append (&auth->outgoing, "BEGIN\r\n"))
01378 {
01379 _dbus_verbose ("Got GUID '%s' from the server\n",
01380 _dbus_string_get_const_data (& DBUS_AUTH_CLIENT (auth)->guid_from_server));
01381
01382 goto_state (auth, &common_state_authenticated);
01383 return TRUE;
01384 }
01385 else
01386 {
01387 _dbus_string_set_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server, 0);
01388 return FALSE;
01389 }
01390 }
01391
01392 static dbus_bool_t
01393 send_cancel (DBusAuth *auth)
01394 {
01395 if (_dbus_string_append (&auth->outgoing, "CANCEL\r\n"))
01396 {
01397 goto_state (auth, &client_state_waiting_for_reject);
01398 return TRUE;
01399 }
01400 else
01401 return FALSE;
01402 }
01403
01404 static dbus_bool_t
01405 process_data (DBusAuth *auth,
01406 const DBusString *args,
01407 DBusAuthDataFunction data_func)
01408 {
01409 int end;
01410 DBusString decoded;
01411
01412 if (!_dbus_string_init (&decoded))
01413 return FALSE;
01414
01415 if (!_dbus_string_hex_decode (args, 0, &end, &decoded, 0))
01416 {
01417 _dbus_string_free (&decoded);
01418 return FALSE;
01419 }
01420
01421 if (_dbus_string_get_length (args) != end)
01422 {
01423 _dbus_string_free (&decoded);
01424 if (!send_error (auth, "Invalid hex encoding"))
01425 return FALSE;
01426
01427 return TRUE;
01428 }
01429
01430 #ifdef DBUS_ENABLE_VERBOSE_MODE
01431 if (_dbus_string_validate_ascii (&decoded, 0,
01432 _dbus_string_get_length (&decoded)))
01433 _dbus_verbose ("%s: data: '%s'\n",
01434 DBUS_AUTH_NAME (auth),
01435 _dbus_string_get_const_data (&decoded));
01436 #endif
01437
01438 if (!(* data_func) (auth, &decoded))
01439 {
01440 _dbus_string_free (&decoded);
01441 return FALSE;
01442 }
01443
01444 _dbus_string_free (&decoded);
01445 return TRUE;
01446 }
01447
01448 static dbus_bool_t
01449 handle_auth (DBusAuth *auth, const DBusString *args)
01450 {
01451 if (_dbus_string_get_length (args) == 0)
01452 {
01453
01454 if (!send_rejected (auth))
01455 return FALSE;
01456
01457 return TRUE;
01458 }
01459 else
01460 {
01461 int i;
01462 DBusString mech;
01463 DBusString hex_response;
01464
01465 _dbus_string_find_blank (args, 0, &i);
01466
01467 if (!_dbus_string_init (&mech))
01468 return FALSE;
01469
01470 if (!_dbus_string_init (&hex_response))
01471 {
01472 _dbus_string_free (&mech);
01473 return FALSE;
01474 }
01475
01476 if (!_dbus_string_copy_len (args, 0, i, &mech, 0))
01477 goto failed;
01478
01479 _dbus_string_skip_blank (args, i, &i);
01480 if (!_dbus_string_copy (args, i, &hex_response, 0))
01481 goto failed;
01482
01483 auth->mech = find_mech (&mech, auth->allowed_mechs);
01484 if (auth->mech != NULL)
01485 {
01486 _dbus_verbose ("%s: Trying mechanism %s\n",
01487 DBUS_AUTH_NAME (auth),
01488 auth->mech->mechanism);
01489
01490 if (!process_data (auth, &hex_response,
01491 auth->mech->server_data_func))
01492 goto failed;
01493 }
01494 else
01495 {
01496
01497 _dbus_verbose ("%s: Unsupported mechanism %s\n",
01498 DBUS_AUTH_NAME (auth),
01499 _dbus_string_get_const_data (&mech));
01500
01501 if (!send_rejected (auth))
01502 goto failed;
01503 }
01504
01505 _dbus_string_free (&mech);
01506 _dbus_string_free (&hex_response);
01507
01508 return TRUE;
01509
01510 failed:
01511 auth->mech = NULL;
01512 _dbus_string_free (&mech);
01513 _dbus_string_free (&hex_response);
01514 return FALSE;
01515 }
01516 }
01517
01518 static dbus_bool_t
01519 handle_server_state_waiting_for_auth (DBusAuth *auth,
01520 DBusAuthCommand command,
01521 const DBusString *args)
01522 {
01523 switch (command)
01524 {
01525 case DBUS_AUTH_COMMAND_AUTH:
01526 return handle_auth (auth, args);
01527
01528 case DBUS_AUTH_COMMAND_CANCEL:
01529 case DBUS_AUTH_COMMAND_DATA:
01530 return send_error (auth, "Not currently in an auth conversation");
01531
01532 case DBUS_AUTH_COMMAND_BEGIN:
01533 goto_state (auth, &common_state_need_disconnect);
01534 return TRUE;
01535
01536 case DBUS_AUTH_COMMAND_ERROR:
01537 return send_rejected (auth);
01538
01539 case DBUS_AUTH_COMMAND_REJECTED:
01540 case DBUS_AUTH_COMMAND_OK:
01541 case DBUS_AUTH_COMMAND_UNKNOWN:
01542 default:
01543 return send_error (auth, "Unknown command");
01544 }
01545 }
01546
01547 static dbus_bool_t
01548 handle_server_state_waiting_for_data (DBusAuth *auth,
01549 DBusAuthCommand command,
01550 const DBusString *args)
01551 {
01552 switch (command)
01553 {
01554 case DBUS_AUTH_COMMAND_AUTH:
01555 return send_error (auth, "Sent AUTH while another AUTH in progress");
01556
01557 case DBUS_AUTH_COMMAND_CANCEL:
01558 case DBUS_AUTH_COMMAND_ERROR:
01559 return send_rejected (auth);
01560
01561 case DBUS_AUTH_COMMAND_DATA:
01562 return process_data (auth, args, auth->mech->server_data_func);
01563
01564 case DBUS_AUTH_COMMAND_BEGIN:
01565 goto_state (auth, &common_state_need_disconnect);
01566 return TRUE;
01567
01568 case DBUS_AUTH_COMMAND_REJECTED:
01569 case DBUS_AUTH_COMMAND_OK:
01570 case DBUS_AUTH_COMMAND_UNKNOWN:
01571 default:
01572 return send_error (auth, "Unknown command");
01573 }
01574 }
01575
01576 static dbus_bool_t
01577 handle_server_state_waiting_for_begin (DBusAuth *auth,
01578 DBusAuthCommand command,
01579 const DBusString *args)
01580 {
01581 switch (command)
01582 {
01583 case DBUS_AUTH_COMMAND_AUTH:
01584 return send_error (auth, "Sent AUTH while expecting BEGIN");
01585
01586 case DBUS_AUTH_COMMAND_DATA:
01587 return send_error (auth, "Sent DATA while expecting BEGIN");
01588
01589 case DBUS_AUTH_COMMAND_BEGIN:
01590 goto_state (auth, &common_state_authenticated);
01591 return TRUE;
01592
01593 case DBUS_AUTH_COMMAND_REJECTED:
01594 case DBUS_AUTH_COMMAND_OK:
01595 case DBUS_AUTH_COMMAND_UNKNOWN:
01596 default:
01597 return send_error (auth, "Unknown command");
01598
01599 case DBUS_AUTH_COMMAND_CANCEL:
01600 case DBUS_AUTH_COMMAND_ERROR:
01601 return send_rejected (auth);
01602 }
01603 }
01604
01605
01606 static dbus_bool_t
01607 get_word (const DBusString *str,
01608 int *start,
01609 DBusString *word)
01610 {
01611 int i;
01612
01613 _dbus_string_skip_blank (str, *start, start);
01614 _dbus_string_find_blank (str, *start, &i);
01615
01616 if (i > *start)
01617 {
01618 if (!_dbus_string_copy_len (str, *start, i - *start, word, 0))
01619 return FALSE;
01620
01621 *start = i;
01622 }
01623
01624 return TRUE;
01625 }
01626
01627 static dbus_bool_t
01628 record_mechanisms (DBusAuth *auth,
01629 const DBusString *args)
01630 {
01631 int next;
01632 int len;
01633
01634 if (auth->already_got_mechanisms)
01635 return TRUE;
01636
01637 len = _dbus_string_get_length (args);
01638
01639 next = 0;
01640 while (next < len)
01641 {
01642 DBusString m;
01643 const DBusAuthMechanismHandler *mech;
01644
01645 if (!_dbus_string_init (&m))
01646 goto nomem;
01647
01648 if (!get_word (args, &next, &m))
01649 {
01650 _dbus_string_free (&m);
01651 goto nomem;
01652 }
01653
01654 mech = find_mech (&m, auth->allowed_mechs);
01655
01656 if (mech != NULL)
01657 {
01658
01659
01660
01661
01662
01663
01664
01665
01666
01667 if (mech != &all_mechanisms[0])
01668 {
01669 _dbus_verbose ("%s: Adding mechanism %s to list we will try\n",
01670 DBUS_AUTH_NAME (auth), mech->mechanism);
01671
01672 if (!_dbus_list_append (& DBUS_AUTH_CLIENT (auth)->mechs_to_try,
01673 (void*) mech))
01674 {
01675 _dbus_string_free (&m);
01676 goto nomem;
01677 }
01678 }
01679 else
01680 {
01681 _dbus_verbose ("%s: Already tried mechanism %s; not adding to list we will try\n",
01682 DBUS_AUTH_NAME (auth), mech->mechanism);
01683 }
01684 }
01685 else
01686 {
01687 _dbus_verbose ("%s: Server offered mechanism \"%s\" that we don't know how to use\n",
01688 DBUS_AUTH_NAME (auth),
01689 _dbus_string_get_const_data (&m));
01690 }
01691
01692 _dbus_string_free (&m);
01693 }
01694
01695 auth->already_got_mechanisms = TRUE;
01696
01697 return TRUE;
01698
01699 nomem:
01700 _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
01701
01702 return FALSE;
01703 }
01704
01705 static dbus_bool_t
01706 process_rejected (DBusAuth *auth, const DBusString *args)
01707 {
01708 const DBusAuthMechanismHandler *mech;
01709 DBusAuthClient *client;
01710
01711 client = DBUS_AUTH_CLIENT (auth);
01712
01713 if (!auth->already_got_mechanisms)
01714 {
01715 if (!record_mechanisms (auth, args))
01716 return FALSE;
01717 }
01718
01719 if (DBUS_AUTH_CLIENT (auth)->mechs_to_try != NULL)
01720 {
01721 mech = client->mechs_to_try->data;
01722
01723 if (!send_auth (auth, mech))
01724 return FALSE;
01725
01726 _dbus_list_pop_first (&client->mechs_to_try);
01727
01728 _dbus_verbose ("%s: Trying mechanism %s\n",
01729 DBUS_AUTH_NAME (auth),
01730 mech->mechanism);
01731 }
01732 else
01733 {
01734
01735 _dbus_verbose ("%s: Disconnecting because we are out of mechanisms to try using\n",
01736 DBUS_AUTH_NAME (auth));
01737 goto_state (auth, &common_state_need_disconnect);
01738 }
01739
01740 return TRUE;
01741 }
01742
01743
01744 static dbus_bool_t
01745 handle_client_state_waiting_for_data (DBusAuth *auth,
01746 DBusAuthCommand command,
01747 const DBusString *args)
01748 {
01749 _dbus_assert (auth->mech != NULL);
01750
01751 switch (command)
01752 {
01753 case DBUS_AUTH_COMMAND_DATA:
01754 return process_data (auth, args, auth->mech->client_data_func);
01755
01756 case DBUS_AUTH_COMMAND_REJECTED:
01757 return process_rejected (auth, args);
01758
01759 case DBUS_AUTH_COMMAND_OK:
01760 return send_begin (auth, args);
01761
01762 case DBUS_AUTH_COMMAND_ERROR:
01763 return send_cancel (auth);
01764
01765 case DBUS_AUTH_COMMAND_AUTH:
01766 case DBUS_AUTH_COMMAND_CANCEL:
01767 case DBUS_AUTH_COMMAND_BEGIN:
01768 case DBUS_AUTH_COMMAND_UNKNOWN:
01769 default:
01770 return send_error (auth, "Unknown command");
01771 }
01772 }
01773
01774 static dbus_bool_t
01775 handle_client_state_waiting_for_ok (DBusAuth *auth,
01776 DBusAuthCommand command,
01777 const DBusString *args)
01778 {
01779 switch (command)
01780 {
01781 case DBUS_AUTH_COMMAND_REJECTED:
01782 return process_rejected (auth, args);
01783
01784 case DBUS_AUTH_COMMAND_OK:
01785 return send_begin (auth, args);
01786
01787 case DBUS_AUTH_COMMAND_DATA:
01788 case DBUS_AUTH_COMMAND_ERROR:
01789 return send_cancel (auth);
01790
01791 case DBUS_AUTH_COMMAND_AUTH:
01792 case DBUS_AUTH_COMMAND_CANCEL:
01793 case DBUS_AUTH_COMMAND_BEGIN:
01794 case DBUS_AUTH_COMMAND_UNKNOWN:
01795 default:
01796 return send_error (auth, "Unknown command");
01797 }
01798 }
01799
01800 static dbus_bool_t
01801 handle_client_state_waiting_for_reject (DBusAuth *auth,
01802 DBusAuthCommand command,
01803 const DBusString *args)
01804 {
01805 switch (command)
01806 {
01807 case DBUS_AUTH_COMMAND_REJECTED:
01808 return process_rejected (auth, args);
01809
01810 case DBUS_AUTH_COMMAND_AUTH:
01811 case DBUS_AUTH_COMMAND_CANCEL:
01812 case DBUS_AUTH_COMMAND_DATA:
01813 case DBUS_AUTH_COMMAND_BEGIN:
01814 case DBUS_AUTH_COMMAND_OK:
01815 case DBUS_AUTH_COMMAND_ERROR:
01816 case DBUS_AUTH_COMMAND_UNKNOWN:
01817 default:
01818 goto_state (auth, &common_state_need_disconnect);
01819 return TRUE;
01820 }
01821 }
01822
01826 typedef struct {
01827 const char *name;
01828 DBusAuthCommand command;
01829 } DBusAuthCommandName;
01830
01831 static const DBusAuthCommandName auth_command_names[] = {
01832 { "AUTH", DBUS_AUTH_COMMAND_AUTH },
01833 { "CANCEL", DBUS_AUTH_COMMAND_CANCEL },
01834 { "DATA", DBUS_AUTH_COMMAND_DATA },
01835 { "BEGIN", DBUS_AUTH_COMMAND_BEGIN },
01836 { "REJECTED", DBUS_AUTH_COMMAND_REJECTED },
01837 { "OK", DBUS_AUTH_COMMAND_OK },
01838 { "ERROR", DBUS_AUTH_COMMAND_ERROR }
01839 };
01840
01841 static DBusAuthCommand
01842 lookup_command_from_name (DBusString *command)
01843 {
01844 int i;
01845
01846 for (i = 0; i < _DBUS_N_ELEMENTS (auth_command_names); i++)
01847 {
01848 if (_dbus_string_equal_c_str (command,
01849 auth_command_names[i].name))
01850 return auth_command_names[i].command;
01851 }
01852
01853 return DBUS_AUTH_COMMAND_UNKNOWN;
01854 }
01855
01856 static void
01857 goto_state (DBusAuth *auth, const DBusAuthStateData *state)
01858 {
01859 _dbus_verbose ("%s: going from state %s to state %s\n",
01860 DBUS_AUTH_NAME (auth),
01861 auth->state->name,
01862 state->name);
01863
01864 auth->state = state;
01865 }
01866
01867
01868 static dbus_bool_t
01869 process_command (DBusAuth *auth)
01870 {
01871 DBusAuthCommand command;
01872 DBusString line;
01873 DBusString args;
01874 int eol;
01875 int i, j;
01876 dbus_bool_t retval;
01877
01878
01879
01880 retval = FALSE;
01881
01882 eol = 0;
01883 if (!_dbus_string_find (&auth->incoming, 0, "\r\n", &eol))
01884 return FALSE;
01885
01886 if (!_dbus_string_init (&line))
01887 {
01888 auth->needed_memory = TRUE;
01889 return FALSE;
01890 }
01891
01892 if (!_dbus_string_init (&args))
01893 {
01894 _dbus_string_free (&line);
01895 auth->needed_memory = TRUE;
01896 return FALSE;
01897 }
01898
01899 if (!_dbus_string_copy_len (&auth->incoming, 0, eol, &line, 0))
01900 goto out;
01901
01902 if (!_dbus_string_validate_ascii (&line, 0,
01903 _dbus_string_get_length (&line)))
01904 {
01905 _dbus_verbose ("%s: Command contained non-ASCII chars or embedded nul\n",
01906 DBUS_AUTH_NAME (auth));
01907 if (!send_error (auth, "Command contained non-ASCII"))
01908 goto out;
01909 else
01910 goto next_command;
01911 }
01912
01913 _dbus_verbose ("%s: got command \"%s\"\n",
01914 DBUS_AUTH_NAME (auth),
01915 _dbus_string_get_const_data (&line));
01916
01917 _dbus_string_find_blank (&line, 0, &i);
01918 _dbus_string_skip_blank (&line, i, &j);
01919
01920 if (j > i)
01921 _dbus_string_delete (&line, i, j - i);
01922
01923 if (!_dbus_string_move (&line, i, &args, 0))
01924 goto out;
01925
01926
01927
01928
01929
01930 command = lookup_command_from_name (&line);
01931 if (!(* auth->state->handler) (auth, command, &args))
01932 goto out;
01933
01934 next_command:
01935
01936
01937
01938
01939
01940 _dbus_string_delete (&auth->incoming, 0, eol);
01941
01942
01943 _dbus_string_delete (&auth->incoming, 0, 2);
01944
01945 retval = TRUE;
01946
01947 out:
01948 _dbus_string_free (&args);
01949 _dbus_string_free (&line);
01950
01951 if (!retval)
01952 auth->needed_memory = TRUE;
01953 else
01954 auth->needed_memory = FALSE;
01955
01956 return retval;
01957 }
01958
01959
01974 DBusAuth*
01975 _dbus_auth_server_new (const DBusString *guid)
01976 {
01977 DBusAuth *auth;
01978 DBusAuthServer *server_auth;
01979 DBusString guid_copy;
01980
01981 if (!_dbus_string_init (&guid_copy))
01982 return NULL;
01983
01984 if (!_dbus_string_copy (guid, 0, &guid_copy, 0))
01985 {
01986 _dbus_string_free (&guid_copy);
01987 return NULL;
01988 }
01989
01990 auth = _dbus_auth_new (sizeof (DBusAuthServer));
01991 if (auth == NULL)
01992 {
01993 _dbus_string_free (&guid_copy);
01994 return NULL;
01995 }
01996
01997 auth->side = auth_side_server;
01998 auth->state = &server_state_waiting_for_auth;
01999
02000 server_auth = DBUS_AUTH_SERVER (auth);
02001
02002 server_auth->guid = guid_copy;
02003
02004
02005
02006
02007 server_auth->failures = 0;
02008 server_auth->max_failures = 6;
02009
02010 return auth;
02011 }
02012
02020 DBusAuth*
02021 _dbus_auth_client_new (void)
02022 {
02023 DBusAuth *auth;
02024 DBusString guid_str;
02025
02026 if (!_dbus_string_init (&guid_str))
02027 return NULL;
02028
02029 auth = _dbus_auth_new (sizeof (DBusAuthClient));
02030 if (auth == NULL)
02031 {
02032 _dbus_string_free (&guid_str);
02033 return NULL;
02034 }
02035
02036 DBUS_AUTH_CLIENT (auth)->guid_from_server = guid_str;
02037
02038 auth->side = auth_side_client;
02039 auth->state = &client_state_need_send_auth;
02040
02041
02042
02043 if (!send_auth (auth, &all_mechanisms[0]))
02044 {
02045 _dbus_auth_unref (auth);
02046 return NULL;
02047 }
02048
02049 return auth;
02050 }
02051
02058 DBusAuth *
02059 _dbus_auth_ref (DBusAuth *auth)
02060 {
02061 _dbus_assert (auth != NULL);
02062
02063 auth->refcount += 1;
02064
02065 return auth;
02066 }
02067
02073 void
02074 _dbus_auth_unref (DBusAuth *auth)
02075 {
02076 _dbus_assert (auth != NULL);
02077 _dbus_assert (auth->refcount > 0);
02078
02079 auth->refcount -= 1;
02080 if (auth->refcount == 0)
02081 {
02082 shutdown_mech (auth);
02083
02084 if (DBUS_AUTH_IS_CLIENT (auth))
02085 {
02086 _dbus_string_free (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
02087 _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
02088 }
02089 else
02090 {
02091 _dbus_assert (DBUS_AUTH_IS_SERVER (auth));
02092
02093 _dbus_string_free (& DBUS_AUTH_SERVER (auth)->guid);
02094 }
02095
02096 if (auth->keyring)
02097 _dbus_keyring_unref (auth->keyring);
02098
02099 _dbus_string_free (&auth->context);
02100 _dbus_string_free (&auth->challenge);
02101 _dbus_string_free (&auth->identity);
02102 _dbus_string_free (&auth->incoming);
02103 _dbus_string_free (&auth->outgoing);
02104
02105 dbus_free_string_array (auth->allowed_mechs);
02106
02107 dbus_free (auth);
02108 }
02109 }
02110
02119 dbus_bool_t
02120 _dbus_auth_set_mechanisms (DBusAuth *auth,
02121 const char **mechanisms)
02122 {
02123 char **copy;
02124
02125 if (mechanisms != NULL)
02126 {
02127 copy = _dbus_dup_string_array (mechanisms);
02128 if (copy == NULL)
02129 return FALSE;
02130 }
02131 else
02132 copy = NULL;
02133
02134 dbus_free_string_array (auth->allowed_mechs);
02135
02136 auth->allowed_mechs = copy;
02137
02138 return TRUE;
02139 }
02140
02145 #define DBUS_AUTH_IN_END_STATE(auth) ((auth)->state->handler == NULL)
02146
02154 DBusAuthState
02155 _dbus_auth_do_work (DBusAuth *auth)
02156 {
02157 auth->needed_memory = FALSE;
02158
02159
02160 #define MAX_BUFFER (16 * _DBUS_ONE_KILOBYTE)
02161
02162 do
02163 {
02164 if (DBUS_AUTH_IN_END_STATE (auth))
02165 break;
02166
02167 if (_dbus_string_get_length (&auth->incoming) > MAX_BUFFER ||
02168 _dbus_string_get_length (&auth->outgoing) > MAX_BUFFER)
02169 {
02170 goto_state (auth, &common_state_need_disconnect);
02171 _dbus_verbose ("%s: Disconnecting due to excessive data buffered in auth phase\n",
02172 DBUS_AUTH_NAME (auth));
02173 break;
02174 }
02175 }
02176 while (process_command (auth));
02177
02178 if (auth->needed_memory)
02179 return DBUS_AUTH_STATE_WAITING_FOR_MEMORY;
02180 else if (_dbus_string_get_length (&auth->outgoing) > 0)
02181 return DBUS_AUTH_STATE_HAVE_BYTES_TO_SEND;
02182 else if (auth->state == &common_state_need_disconnect)
02183 return DBUS_AUTH_STATE_NEED_DISCONNECT;
02184 else if (auth->state == &common_state_authenticated)
02185 return DBUS_AUTH_STATE_AUTHENTICATED;
02186 else return DBUS_AUTH_STATE_WAITING_FOR_INPUT;
02187 }
02188
02198 dbus_bool_t
02199 _dbus_auth_get_bytes_to_send (DBusAuth *auth,
02200 const DBusString **str)
02201 {
02202 _dbus_assert (auth != NULL);
02203 _dbus_assert (str != NULL);
02204
02205 *str = NULL;
02206
02207 if (_dbus_string_get_length (&auth->outgoing) == 0)
02208 return FALSE;
02209
02210 *str = &auth->outgoing;
02211
02212 return TRUE;
02213 }
02214
02223 void
02224 _dbus_auth_bytes_sent (DBusAuth *auth,
02225 int bytes_sent)
02226 {
02227 _dbus_verbose ("%s: Sent %d bytes of: %s\n",
02228 DBUS_AUTH_NAME (auth),
02229 bytes_sent,
02230 _dbus_string_get_const_data (&auth->outgoing));
02231
02232 _dbus_string_delete (&auth->outgoing,
02233 0, bytes_sent);
02234 }
02235
02243 void
02244 _dbus_auth_get_buffer (DBusAuth *auth,
02245 DBusString **buffer)
02246 {
02247 _dbus_assert (auth != NULL);
02248 _dbus_assert (!auth->buffer_outstanding);
02249
02250 *buffer = &auth->incoming;
02251
02252 auth->buffer_outstanding = TRUE;
02253 }
02254
02262 void
02263 _dbus_auth_return_buffer (DBusAuth *auth,
02264 DBusString *buffer,
02265 int bytes_read)
02266 {
02267 _dbus_assert (buffer == &auth->incoming);
02268 _dbus_assert (auth->buffer_outstanding);
02269
02270 auth->buffer_outstanding = FALSE;
02271 }
02272
02282 void
02283 _dbus_auth_get_unused_bytes (DBusAuth *auth,
02284 const DBusString **str)
02285 {
02286 if (!DBUS_AUTH_IN_END_STATE (auth))
02287 return;
02288
02289 *str = &auth->incoming;
02290 }
02291
02292
02299 void
02300 _dbus_auth_delete_unused_bytes (DBusAuth *auth)
02301 {
02302 if (!DBUS_AUTH_IN_END_STATE (auth))
02303 return;
02304
02305 _dbus_string_set_length (&auth->incoming, 0);
02306 }
02307
02316 dbus_bool_t
02317 _dbus_auth_needs_encoding (DBusAuth *auth)
02318 {
02319 if (auth->state != &common_state_authenticated)
02320 return FALSE;
02321
02322 if (auth->mech != NULL)
02323 {
02324 if (DBUS_AUTH_IS_CLIENT (auth))
02325 return auth->mech->client_encode_func != NULL;
02326 else
02327 return auth->mech->server_encode_func != NULL;
02328 }
02329 else
02330 return FALSE;
02331 }
02332
02343 dbus_bool_t
02344 _dbus_auth_encode_data (DBusAuth *auth,
02345 const DBusString *plaintext,
02346 DBusString *encoded)
02347 {
02348 _dbus_assert (plaintext != encoded);
02349
02350 if (auth->state != &common_state_authenticated)
02351 return FALSE;
02352
02353 if (_dbus_auth_needs_encoding (auth))
02354 {
02355 if (DBUS_AUTH_IS_CLIENT (auth))
02356 return (* auth->mech->client_encode_func) (auth, plaintext, encoded);
02357 else
02358 return (* auth->mech->server_encode_func) (auth, plaintext, encoded);
02359 }
02360 else
02361 {
02362 return _dbus_string_copy (plaintext, 0, encoded,
02363 _dbus_string_get_length (encoded));
02364 }
02365 }
02366
02375 dbus_bool_t
02376 _dbus_auth_needs_decoding (DBusAuth *auth)
02377 {
02378 if (auth->state != &common_state_authenticated)
02379 return FALSE;
02380
02381 if (auth->mech != NULL)
02382 {
02383 if (DBUS_AUTH_IS_CLIENT (auth))
02384 return auth->mech->client_decode_func != NULL;
02385 else
02386 return auth->mech->server_decode_func != NULL;
02387 }
02388 else
02389 return FALSE;
02390 }
02391
02392
02406 dbus_bool_t
02407 _dbus_auth_decode_data (DBusAuth *auth,
02408 const DBusString *encoded,
02409 DBusString *plaintext)
02410 {
02411 _dbus_assert (plaintext != encoded);
02412
02413 if (auth->state != &common_state_authenticated)
02414 return FALSE;
02415
02416 if (_dbus_auth_needs_decoding (auth))
02417 {
02418 if (DBUS_AUTH_IS_CLIENT (auth))
02419 return (* auth->mech->client_decode_func) (auth, encoded, plaintext);
02420 else
02421 return (* auth->mech->server_decode_func) (auth, encoded, plaintext);
02422 }
02423 else
02424 {
02425 return _dbus_string_copy (encoded, 0, plaintext,
02426 _dbus_string_get_length (plaintext));
02427 }
02428 }
02429
02437 void
02438 _dbus_auth_set_credentials (DBusAuth *auth,
02439 const DBusCredentials *credentials)
02440 {
02441 auth->credentials = *credentials;
02442 }
02443
02451 void
02452 _dbus_auth_get_identity (DBusAuth *auth,
02453 DBusCredentials *credentials)
02454 {
02455 if (auth->state == &common_state_authenticated)
02456 *credentials = auth->authorized_identity;
02457 else
02458 _dbus_credentials_clear (credentials);
02459 }
02460
02467 const char*
02468 _dbus_auth_get_guid_from_server (DBusAuth *auth)
02469 {
02470 _dbus_assert (DBUS_AUTH_IS_CLIENT (auth));
02471
02472 if (auth->state == &common_state_authenticated)
02473 return _dbus_string_get_const_data (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
02474 else
02475 return NULL;
02476 }
02477
02486 dbus_bool_t
02487 _dbus_auth_set_context (DBusAuth *auth,
02488 const DBusString *context)
02489 {
02490 return _dbus_string_replace_len (context, 0, _dbus_string_get_length (context),
02491 &auth->context, 0, _dbus_string_get_length (context));
02492 }
02493
02496