D-Bus  1.12.20
dbus-auth.c
1 /* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- */
2 /* dbus-auth.c Authentication
3  *
4  * Copyright (C) 2002, 2003, 2004 Red Hat Inc.
5  *
6  * Licensed under the Academic Free License version 2.1
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
21  *
22  */
23 
24 #include <config.h>
25 #include "dbus-auth.h"
26 #include "dbus-string.h"
27 #include "dbus-list.h"
28 #include "dbus-internals.h"
29 #include "dbus-keyring.h"
30 #include "dbus-sha.h"
31 #include "dbus-protocol.h"
32 #include "dbus-credentials.h"
33 
71  DBusString *response);
72 
78  const DBusString *data);
79 
84  const DBusString *data,
85  DBusString *encoded);
86 
91  const DBusString *data,
92  DBusString *decoded);
93 
97 typedef void (* DBusAuthShutdownFunction) (DBusAuth *auth);
98 
102 typedef struct
103 {
104  const char *mechanism;
115 
119 typedef enum {
120  DBUS_AUTH_COMMAND_AUTH,
121  DBUS_AUTH_COMMAND_CANCEL,
122  DBUS_AUTH_COMMAND_DATA,
123  DBUS_AUTH_COMMAND_BEGIN,
124  DBUS_AUTH_COMMAND_REJECTED,
125  DBUS_AUTH_COMMAND_OK,
126  DBUS_AUTH_COMMAND_ERROR,
127  DBUS_AUTH_COMMAND_UNKNOWN,
128  DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD,
129  DBUS_AUTH_COMMAND_AGREE_UNIX_FD
131 
138  DBusAuthCommand command,
139  const DBusString *args);
140 
144 typedef struct
145 {
146  const char *name;
149 
153 struct DBusAuth
154 {
155  int refcount;
156  const char *side;
178  int cookie_id;
181  char **allowed_mechs;
185  unsigned int needed_memory : 1;
188  unsigned int already_got_mechanisms : 1;
190  unsigned int buffer_outstanding : 1;
192  unsigned int unix_fd_possible : 1;
193  unsigned int unix_fd_negotiated : 1;
194 };
195 
199 typedef struct
200 {
208 
212 typedef struct
213 {
216  int failures;
222 
223 static void goto_state (DBusAuth *auth,
224  const DBusAuthStateData *new_state);
225 static dbus_bool_t send_auth (DBusAuth *auth,
226  const DBusAuthMechanismHandler *mech);
227 static dbus_bool_t send_data (DBusAuth *auth,
228  DBusString *data);
229 static dbus_bool_t send_rejected (DBusAuth *auth);
230 static dbus_bool_t send_error (DBusAuth *auth,
231  const char *message);
232 static dbus_bool_t send_ok (DBusAuth *auth);
233 static dbus_bool_t send_begin (DBusAuth *auth);
234 static dbus_bool_t send_cancel (DBusAuth *auth);
235 static dbus_bool_t send_negotiate_unix_fd (DBusAuth *auth);
236 static dbus_bool_t send_agree_unix_fd (DBusAuth *auth);
237 
242 static dbus_bool_t handle_server_state_waiting_for_auth (DBusAuth *auth,
243  DBusAuthCommand command,
244  const DBusString *args);
245 static dbus_bool_t handle_server_state_waiting_for_data (DBusAuth *auth,
246  DBusAuthCommand command,
247  const DBusString *args);
248 static dbus_bool_t handle_server_state_waiting_for_begin (DBusAuth *auth,
249  DBusAuthCommand command,
250  const DBusString *args);
251 
252 static const DBusAuthStateData server_state_waiting_for_auth = {
253  "WaitingForAuth", handle_server_state_waiting_for_auth
254 };
255 static const DBusAuthStateData server_state_waiting_for_data = {
256  "WaitingForData", handle_server_state_waiting_for_data
257 };
258 static const DBusAuthStateData server_state_waiting_for_begin = {
259  "WaitingForBegin", handle_server_state_waiting_for_begin
260 };
261 
266 static dbus_bool_t handle_client_state_waiting_for_data (DBusAuth *auth,
267  DBusAuthCommand command,
268  const DBusString *args);
269 static dbus_bool_t handle_client_state_waiting_for_ok (DBusAuth *auth,
270  DBusAuthCommand command,
271  const DBusString *args);
272 static dbus_bool_t handle_client_state_waiting_for_reject (DBusAuth *auth,
273  DBusAuthCommand command,
274  const DBusString *args);
275 static dbus_bool_t handle_client_state_waiting_for_agree_unix_fd (DBusAuth *auth,
276  DBusAuthCommand command,
277  const DBusString *args);
278 
279 static const DBusAuthStateData client_state_need_send_auth = {
280  "NeedSendAuth", NULL
281 };
282 static const DBusAuthStateData client_state_waiting_for_data = {
283  "WaitingForData", handle_client_state_waiting_for_data
284 };
285 /* The WaitingForOK state doesn't appear to be used.
286  * See https://bugs.freedesktop.org/show_bug.cgi?id=97298 */
287 _DBUS_GNUC_UNUSED
288 static const DBusAuthStateData client_state_waiting_for_ok = {
289  "WaitingForOK", handle_client_state_waiting_for_ok
290 };
291 static const DBusAuthStateData client_state_waiting_for_reject = {
292  "WaitingForReject", handle_client_state_waiting_for_reject
293 };
294 static const DBusAuthStateData client_state_waiting_for_agree_unix_fd = {
295  "WaitingForAgreeUnixFD", handle_client_state_waiting_for_agree_unix_fd
296 };
297 
302 static const DBusAuthStateData common_state_authenticated = {
303  "Authenticated", NULL
304 };
305 
306 static const DBusAuthStateData common_state_need_disconnect = {
307  "NeedDisconnect", NULL
308 };
309 
310 static const char auth_side_client[] = "client";
311 static const char auth_side_server[] = "server";
316 #define DBUS_AUTH_IS_SERVER(auth) ((auth)->side == auth_side_server)
317 
321 #define DBUS_AUTH_IS_CLIENT(auth) ((auth)->side == auth_side_client)
322 
326 #define DBUS_AUTH_CLIENT(auth) ((DBusAuthClient*)(auth))
327 
331 #define DBUS_AUTH_SERVER(auth) ((DBusAuthServer*)(auth))
332 
338 #define DBUS_AUTH_NAME(auth) ((auth)->side)
339 
340 static DBusAuth*
341 _dbus_auth_new (int size)
342 {
343  DBusAuth *auth;
344 
345  auth = dbus_malloc0 (size);
346  if (auth == NULL)
347  return NULL;
348 
349  auth->refcount = 1;
350 
351  auth->keyring = NULL;
352  auth->cookie_id = -1;
353 
354  /* note that we don't use the max string length feature,
355  * because you can't use that feature if you're going to
356  * try to recover from out-of-memory (it creates
357  * what looks like unrecoverable inability to alloc
358  * more space in the string). But we do handle
359  * overlong buffers in _dbus_auth_do_work().
360  */
361 
362  if (!_dbus_string_init (&auth->incoming))
363  goto enomem_0;
364 
365  if (!_dbus_string_init (&auth->outgoing))
366  goto enomem_1;
367 
368  if (!_dbus_string_init (&auth->identity))
369  goto enomem_2;
370 
371  if (!_dbus_string_init (&auth->context))
372  goto enomem_3;
373 
374  if (!_dbus_string_init (&auth->challenge))
375  goto enomem_4;
376 
377  /* default context if none is specified */
378  if (!_dbus_string_append (&auth->context, "org_freedesktop_general"))
379  goto enomem_5;
380 
382  if (auth->credentials == NULL)
383  goto enomem_6;
384 
386  if (auth->authorized_identity == NULL)
387  goto enomem_7;
388 
390  if (auth->desired_identity == NULL)
391  goto enomem_8;
392 
393  return auth;
394 
395 #if 0
396  enomem_9:
398 #endif
399  enomem_8:
401  enomem_7:
403  enomem_6:
404  /* last alloc was an append to context, which is freed already below */ ;
405  enomem_5:
406  _dbus_string_free (&auth->challenge);
407  enomem_4:
408  _dbus_string_free (&auth->context);
409  enomem_3:
410  _dbus_string_free (&auth->identity);
411  enomem_2:
412  _dbus_string_free (&auth->outgoing);
413  enomem_1:
414  _dbus_string_free (&auth->incoming);
415  enomem_0:
416  dbus_free (auth);
417  return NULL;
418 }
419 
420 static void
421 shutdown_mech (DBusAuth *auth)
422 {
423  /* Cancel any auth */
425  _dbus_string_set_length (&auth->identity, 0);
426 
429 
430  if (auth->mech != NULL)
431  {
432  _dbus_verbose ("%s: Shutting down mechanism %s\n",
433  DBUS_AUTH_NAME (auth), auth->mech->mechanism);
434 
435  if (DBUS_AUTH_IS_CLIENT (auth))
436  (* auth->mech->client_shutdown_func) (auth);
437  else
438  (* auth->mech->server_shutdown_func) (auth);
439 
440  auth->mech = NULL;
441  }
442 }
443 
444 /*
445  * DBUS_COOKIE_SHA1 mechanism
446  */
447 
448 /* Returns TRUE but with an empty string hash if the
449  * cookie_id isn't known. As with all this code
450  * TRUE just means we had enough memory.
451  */
452 static dbus_bool_t
453 sha1_compute_hash (DBusAuth *auth,
454  int cookie_id,
455  const DBusString *server_challenge,
456  const DBusString *client_challenge,
457  DBusString *hash)
458 {
459  DBusString cookie;
460  DBusString to_hash;
461  dbus_bool_t retval;
462 
463  _dbus_assert (auth->keyring != NULL);
464 
465  retval = FALSE;
466 
467  if (!_dbus_string_init (&cookie))
468  return FALSE;
469 
470  if (!_dbus_keyring_get_hex_key (auth->keyring, cookie_id,
471  &cookie))
472  goto out_0;
473 
474  if (_dbus_string_get_length (&cookie) == 0)
475  {
476  retval = TRUE;
477  goto out_0;
478  }
479 
480  if (!_dbus_string_init (&to_hash))
481  goto out_0;
482 
483  if (!_dbus_string_copy (server_challenge, 0,
484  &to_hash, _dbus_string_get_length (&to_hash)))
485  goto out_1;
486 
487  if (!_dbus_string_append (&to_hash, ":"))
488  goto out_1;
489 
490  if (!_dbus_string_copy (client_challenge, 0,
491  &to_hash, _dbus_string_get_length (&to_hash)))
492  goto out_1;
493 
494  if (!_dbus_string_append (&to_hash, ":"))
495  goto out_1;
496 
497  if (!_dbus_string_copy (&cookie, 0,
498  &to_hash, _dbus_string_get_length (&to_hash)))
499  goto out_1;
500 
501  if (!_dbus_sha_compute (&to_hash, hash))
502  goto out_1;
503 
504  retval = TRUE;
505 
506  out_1:
507  _dbus_string_zero (&to_hash);
508  _dbus_string_free (&to_hash);
509  out_0:
510  _dbus_string_zero (&cookie);
511  _dbus_string_free (&cookie);
512  return retval;
513 }
514 
519 #define N_CHALLENGE_BYTES (128/8)
520 
521 static dbus_bool_t
522 sha1_handle_first_client_response (DBusAuth *auth,
523  const DBusString *data)
524 {
525  /* We haven't sent a challenge yet, we're expecting a desired
526  * username from the client.
527  */
528  DBusString tmp;
529  DBusString tmp2;
530  dbus_bool_t retval = FALSE;
531  DBusError error = DBUS_ERROR_INIT;
532  DBusCredentials *myself = NULL;
533 
535 
536  if (_dbus_string_get_length (data) > 0)
537  {
538  if (_dbus_string_get_length (&auth->identity) > 0)
539  {
540  /* Tried to send two auth identities, wtf */
541  _dbus_verbose ("%s: client tried to send auth identity, but we already have one\n",
542  DBUS_AUTH_NAME (auth));
543  return send_rejected (auth);
544  }
545  else
546  {
547  /* this is our auth identity */
548  if (!_dbus_string_copy (data, 0, &auth->identity, 0))
549  return FALSE;
550  }
551  }
552 
554  {
555  _dbus_verbose ("%s: Did not get a valid username from client\n",
556  DBUS_AUTH_NAME (auth));
557  return send_rejected (auth);
558  }
559 
560  if (!_dbus_string_init (&tmp))
561  return FALSE;
562 
563  if (!_dbus_string_init (&tmp2))
564  {
565  _dbus_string_free (&tmp);
566  return FALSE;
567  }
568 
570 
571  if (myself == NULL)
572  goto out;
573 
574  if (!_dbus_credentials_same_user (myself, auth->desired_identity))
575  {
576  /*
577  * DBUS_COOKIE_SHA1 is not suitable for authenticating that the
578  * client is anyone other than the user owning the process
579  * containing the DBusServer: we probably aren't allowed to write
580  * to other users' home directories. Even if we can (for example
581  * uid 0 on traditional Unix or CAP_DAC_OVERRIDE on Linux), we
582  * must not, because the other user controls their home directory,
583  * and could carry out symlink attacks to make us read from or
584  * write to unintended locations. It's difficult to avoid symlink
585  * attacks in a portable way, so we just don't try. This isn't a
586  * regression, because DBUS_COOKIE_SHA1 never worked for other
587  * users anyway.
588  */
589  _dbus_verbose ("%s: client tried to authenticate as \"%s\", "
590  "but that doesn't match this process",
591  DBUS_AUTH_NAME (auth),
592  _dbus_string_get_const_data (data));
593  retval = send_rejected (auth);
594  goto out;
595  }
596 
597  /* we cache the keyring for speed, so here we drop it if it's the
598  * wrong one. FIXME caching the keyring here is useless since we use
599  * a different DBusAuth for every connection.
600  */
601  if (auth->keyring &&
603  auth->desired_identity))
604  {
606  auth->keyring = NULL;
607  }
608 
609  if (auth->keyring == NULL)
610  {
612  &auth->context,
613  &error);
614 
615  if (auth->keyring == NULL)
616  {
617  if (dbus_error_has_name (&error,
619  {
620  dbus_error_free (&error);
621  goto out;
622  }
623  else
624  {
625  _DBUS_ASSERT_ERROR_IS_SET (&error);
626  _dbus_verbose ("%s: Error loading keyring: %s\n",
627  DBUS_AUTH_NAME (auth), error.message);
628  if (send_rejected (auth))
629  retval = TRUE; /* retval is only about mem */
630  dbus_error_free (&error);
631  goto out;
632  }
633  }
634  else
635  {
636  _dbus_assert (!dbus_error_is_set (&error));
637  }
638  }
639 
640  _dbus_assert (auth->keyring != NULL);
641 
642  auth->cookie_id = _dbus_keyring_get_best_key (auth->keyring, &error);
643  if (auth->cookie_id < 0)
644  {
645  _DBUS_ASSERT_ERROR_IS_SET (&error);
646  _dbus_verbose ("%s: Could not get a cookie ID to send to client: %s\n",
647  DBUS_AUTH_NAME (auth), error.message);
648  if (send_rejected (auth))
649  retval = TRUE;
650  dbus_error_free (&error);
651  goto out;
652  }
653  else
654  {
655  _dbus_assert (!dbus_error_is_set (&error));
656  }
657 
658  if (!_dbus_string_copy (&auth->context, 0,
659  &tmp2, _dbus_string_get_length (&tmp2)))
660  goto out;
661 
662  if (!_dbus_string_append (&tmp2, " "))
663  goto out;
664 
665  if (!_dbus_string_append_int (&tmp2, auth->cookie_id))
666  goto out;
667 
668  if (!_dbus_string_append (&tmp2, " "))
669  goto out;
670 
671  if (!_dbus_generate_random_bytes (&tmp, N_CHALLENGE_BYTES, &error))
672  {
674  {
675  dbus_error_free (&error);
676  goto out;
677  }
678  else
679  {
680  _DBUS_ASSERT_ERROR_IS_SET (&error);
681  _dbus_verbose ("%s: Error generating challenge: %s\n",
682  DBUS_AUTH_NAME (auth), error.message);
683  if (send_rejected (auth))
684  retval = TRUE; /* retval is only about mem */
685 
686  dbus_error_free (&error);
687  goto out;
688  }
689  }
690 
692  if (!_dbus_string_hex_encode (&tmp, 0, &auth->challenge, 0))
693  goto out;
694 
695  if (!_dbus_string_hex_encode (&tmp, 0, &tmp2,
696  _dbus_string_get_length (&tmp2)))
697  goto out;
698 
699  if (!send_data (auth, &tmp2))
700  goto out;
701 
702  goto_state (auth, &server_state_waiting_for_data);
703  retval = TRUE;
704 
705  out:
706  _dbus_string_zero (&tmp);
707  _dbus_string_free (&tmp);
708  _dbus_string_zero (&tmp2);
709  _dbus_string_free (&tmp2);
710 
711  if (myself != NULL)
712  _dbus_credentials_unref (myself);
713 
714  return retval;
715 }
716 
717 static dbus_bool_t
718 sha1_handle_second_client_response (DBusAuth *auth,
719  const DBusString *data)
720 {
721  /* We are expecting a response which is the hex-encoded client
722  * challenge, space, then SHA-1 hash of the concatenation of our
723  * challenge, ":", client challenge, ":", secret key, all
724  * hex-encoded.
725  */
726  int i;
727  DBusString client_challenge;
728  DBusString client_hash;
729  dbus_bool_t retval;
730  DBusString correct_hash;
731 
732  retval = FALSE;
733 
734  if (!_dbus_string_find_blank (data, 0, &i))
735  {
736  _dbus_verbose ("%s: no space separator in client response\n",
737  DBUS_AUTH_NAME (auth));
738  return send_rejected (auth);
739  }
740 
741  if (!_dbus_string_init (&client_challenge))
742  goto out_0;
743 
744  if (!_dbus_string_init (&client_hash))
745  goto out_1;
746 
747  if (!_dbus_string_copy_len (data, 0, i, &client_challenge,
748  0))
749  goto out_2;
750 
751  _dbus_string_skip_blank (data, i, &i);
752 
753  if (!_dbus_string_copy_len (data, i,
754  _dbus_string_get_length (data) - i,
755  &client_hash,
756  0))
757  goto out_2;
758 
759  if (_dbus_string_get_length (&client_challenge) == 0 ||
760  _dbus_string_get_length (&client_hash) == 0)
761  {
762  _dbus_verbose ("%s: zero-length client challenge or hash\n",
763  DBUS_AUTH_NAME (auth));
764  if (send_rejected (auth))
765  retval = TRUE;
766  goto out_2;
767  }
768 
769  if (!_dbus_string_init (&correct_hash))
770  goto out_2;
771 
772  if (!sha1_compute_hash (auth, auth->cookie_id,
773  &auth->challenge,
774  &client_challenge,
775  &correct_hash))
776  goto out_3;
777 
778  /* if cookie_id was invalid, then we get an empty hash */
779  if (_dbus_string_get_length (&correct_hash) == 0)
780  {
781  if (send_rejected (auth))
782  retval = TRUE;
783  goto out_3;
784  }
785 
786  if (!_dbus_string_equal (&client_hash, &correct_hash))
787  {
788  if (send_rejected (auth))
789  retval = TRUE;
790  goto out_3;
791  }
792 
794  auth->desired_identity))
795  goto out_3;
796 
797  /* Copy process ID from the socket credentials if it's there
798  */
800  DBUS_CREDENTIAL_UNIX_PROCESS_ID,
801  auth->credentials))
802  goto out_3;
803 
804  if (!send_ok (auth))
805  goto out_3;
806 
807  _dbus_verbose ("%s: authenticated client using DBUS_COOKIE_SHA1\n",
808  DBUS_AUTH_NAME (auth));
809 
810  retval = TRUE;
811 
812  out_3:
813  _dbus_string_zero (&correct_hash);
814  _dbus_string_free (&correct_hash);
815  out_2:
816  _dbus_string_zero (&client_hash);
817  _dbus_string_free (&client_hash);
818  out_1:
819  _dbus_string_free (&client_challenge);
820  out_0:
821  return retval;
822 }
823 
824 static dbus_bool_t
825 handle_server_data_cookie_sha1_mech (DBusAuth *auth,
826  const DBusString *data)
827 {
828  if (auth->cookie_id < 0)
829  return sha1_handle_first_client_response (auth, data);
830  else
831  return sha1_handle_second_client_response (auth, data);
832 }
833 
834 static void
835 handle_server_shutdown_cookie_sha1_mech (DBusAuth *auth)
836 {
837  auth->cookie_id = -1;
839 }
840 
841 static dbus_bool_t
842 handle_client_initial_response_cookie_sha1_mech (DBusAuth *auth,
843  DBusString *response)
844 {
845  DBusString username;
846  dbus_bool_t retval;
847 
848  retval = FALSE;
849 
850  if (!_dbus_string_init (&username))
851  return FALSE;
852 
854  goto out_0;
855 
856  if (!_dbus_string_hex_encode (&username, 0,
857  response,
858  _dbus_string_get_length (response)))
859  goto out_0;
860 
861  retval = TRUE;
862 
863  out_0:
864  _dbus_string_free (&username);
865 
866  return retval;
867 }
868 
869 static dbus_bool_t
870 handle_client_data_cookie_sha1_mech (DBusAuth *auth,
871  const DBusString *data)
872 {
873  /* The data we get from the server should be the cookie context
874  * name, the cookie ID, and the server challenge, separated by
875  * spaces. We send back our challenge string and the correct hash.
876  */
877  dbus_bool_t retval = FALSE;
878  DBusString context;
879  DBusString cookie_id_str;
880  DBusString server_challenge;
881  DBusString client_challenge;
882  DBusString correct_hash;
883  DBusString tmp;
884  int i, j;
885  long val;
886  DBusError error = DBUS_ERROR_INIT;
887 
888  if (!_dbus_string_find_blank (data, 0, &i))
889  {
890  if (send_error (auth,
891  "Server did not send context/ID/challenge properly"))
892  retval = TRUE;
893  goto out_0;
894  }
895 
896  if (!_dbus_string_init (&context))
897  goto out_0;
898 
899  if (!_dbus_string_copy_len (data, 0, i,
900  &context, 0))
901  goto out_1;
902 
903  _dbus_string_skip_blank (data, i, &i);
904  if (!_dbus_string_find_blank (data, i, &j))
905  {
906  if (send_error (auth,
907  "Server did not send context/ID/challenge properly"))
908  retval = TRUE;
909  goto out_1;
910  }
911 
912  if (!_dbus_string_init (&cookie_id_str))
913  goto out_1;
914 
915  if (!_dbus_string_copy_len (data, i, j - i,
916  &cookie_id_str, 0))
917  goto out_2;
918 
919  if (!_dbus_string_init (&server_challenge))
920  goto out_2;
921 
922  i = j;
923  _dbus_string_skip_blank (data, i, &i);
924  j = _dbus_string_get_length (data);
925 
926  if (!_dbus_string_copy_len (data, i, j - i,
927  &server_challenge, 0))
928  goto out_3;
929 
930  if (!_dbus_keyring_validate_context (&context))
931  {
932  if (send_error (auth, "Server sent invalid cookie context"))
933  retval = TRUE;
934  goto out_3;
935  }
936 
937  if (!_dbus_string_parse_int (&cookie_id_str, 0, &val, NULL))
938  {
939  if (send_error (auth, "Could not parse cookie ID as an integer"))
940  retval = TRUE;
941  goto out_3;
942  }
943 
944  if (_dbus_string_get_length (&server_challenge) == 0)
945  {
946  if (send_error (auth, "Empty server challenge string"))
947  retval = TRUE;
948  goto out_3;
949  }
950 
951  if (auth->keyring == NULL)
952  {
954  &context,
955  &error);
956 
957  if (auth->keyring == NULL)
958  {
959  if (dbus_error_has_name (&error,
961  {
962  dbus_error_free (&error);
963  goto out_3;
964  }
965  else
966  {
967  _DBUS_ASSERT_ERROR_IS_SET (&error);
968 
969  _dbus_verbose ("%s: Error loading keyring: %s\n",
970  DBUS_AUTH_NAME (auth), error.message);
971 
972  if (send_error (auth, "Could not load cookie file"))
973  retval = TRUE; /* retval is only about mem */
974 
975  dbus_error_free (&error);
976  goto out_3;
977  }
978  }
979  else
980  {
981  _dbus_assert (!dbus_error_is_set (&error));
982  }
983  }
984 
985  _dbus_assert (auth->keyring != NULL);
986 
987  if (!_dbus_string_init (&tmp))
988  goto out_3;
989 
990  if (!_dbus_generate_random_bytes (&tmp, N_CHALLENGE_BYTES, &error))
991  {
993  {
994  dbus_error_free (&error);
995  goto out_4;
996  }
997  else
998  {
999  _DBUS_ASSERT_ERROR_IS_SET (&error);
1000 
1001  _dbus_verbose ("%s: Failed to generate challenge: %s\n",
1002  DBUS_AUTH_NAME (auth), error.message);
1003 
1004  if (send_error (auth, "Failed to generate challenge"))
1005  retval = TRUE; /* retval is only about mem */
1006 
1007  dbus_error_free (&error);
1008  goto out_4;
1009  }
1010  }
1011 
1012  if (!_dbus_string_init (&client_challenge))
1013  goto out_4;
1014 
1015  if (!_dbus_string_hex_encode (&tmp, 0, &client_challenge, 0))
1016  goto out_5;
1017 
1018  if (!_dbus_string_init (&correct_hash))
1019  goto out_5;
1020 
1021  if (!sha1_compute_hash (auth, val,
1022  &server_challenge,
1023  &client_challenge,
1024  &correct_hash))
1025  goto out_6;
1026 
1027  if (_dbus_string_get_length (&correct_hash) == 0)
1028  {
1029  /* couldn't find the cookie ID or something */
1030  if (send_error (auth, "Don't have the requested cookie ID"))
1031  retval = TRUE;
1032  goto out_6;
1033  }
1034 
1035  _dbus_string_set_length (&tmp, 0);
1036 
1037  if (!_dbus_string_copy (&client_challenge, 0, &tmp,
1038  _dbus_string_get_length (&tmp)))
1039  goto out_6;
1040 
1041  if (!_dbus_string_append (&tmp, " "))
1042  goto out_6;
1043 
1044  if (!_dbus_string_copy (&correct_hash, 0, &tmp,
1045  _dbus_string_get_length (&tmp)))
1046  goto out_6;
1047 
1048  if (!send_data (auth, &tmp))
1049  goto out_6;
1050 
1051  retval = TRUE;
1052 
1053  out_6:
1054  _dbus_string_zero (&correct_hash);
1055  _dbus_string_free (&correct_hash);
1056  out_5:
1057  _dbus_string_free (&client_challenge);
1058  out_4:
1059  _dbus_string_zero (&tmp);
1060  _dbus_string_free (&tmp);
1061  out_3:
1062  _dbus_string_free (&server_challenge);
1063  out_2:
1064  _dbus_string_free (&cookie_id_str);
1065  out_1:
1066  _dbus_string_free (&context);
1067  out_0:
1068  return retval;
1069 }
1070 
1071 static void
1072 handle_client_shutdown_cookie_sha1_mech (DBusAuth *auth)
1073 {
1074  auth->cookie_id = -1;
1075  _dbus_string_set_length (&auth->challenge, 0);
1076 }
1077 
1078 /*
1079  * EXTERNAL mechanism
1080  */
1081 
1082 static dbus_bool_t
1083 handle_server_data_external_mech (DBusAuth *auth,
1084  const DBusString *data)
1085 {
1087  {
1088  _dbus_verbose ("%s: no credentials, mechanism EXTERNAL can't authenticate\n",
1089  DBUS_AUTH_NAME (auth));
1090  return send_rejected (auth);
1091  }
1092 
1093  if (_dbus_string_get_length (data) > 0)
1094  {
1095  if (_dbus_string_get_length (&auth->identity) > 0)
1096  {
1097  /* Tried to send two auth identities, wtf */
1098  _dbus_verbose ("%s: client tried to send auth identity, but we already have one\n",
1099  DBUS_AUTH_NAME (auth));
1100  return send_rejected (auth);
1101  }
1102  else
1103  {
1104  /* this is our auth identity */
1105  if (!_dbus_string_copy (data, 0, &auth->identity, 0))
1106  return FALSE;
1107  }
1108  }
1109 
1110  /* Poke client for an auth identity, if none given */
1111  if (_dbus_string_get_length (&auth->identity) == 0 &&
1113  {
1114  if (send_data (auth, NULL))
1115  {
1116  _dbus_verbose ("%s: sending empty challenge asking client for auth identity\n",
1117  DBUS_AUTH_NAME (auth));
1119  goto_state (auth, &server_state_waiting_for_data);
1120  return TRUE;
1121  }
1122  else
1123  return FALSE;
1124  }
1125 
1127 
1128  /* If auth->identity is still empty here, then client
1129  * responded with an empty string after we poked it for
1130  * an initial response. This means to try to auth the
1131  * identity provided in the credentials.
1132  */
1133  if (_dbus_string_get_length (&auth->identity) == 0)
1134  {
1136  auth->credentials))
1137  {
1138  return FALSE; /* OOM */
1139  }
1140  }
1141  else
1142  {
1144  &auth->identity))
1145  {
1146  _dbus_verbose ("%s: could not get credentials from uid string\n",
1147  DBUS_AUTH_NAME (auth));
1148  return send_rejected (auth);
1149  }
1150  }
1151 
1153  {
1154  _dbus_verbose ("%s: desired user %s is no good\n",
1155  DBUS_AUTH_NAME (auth),
1156  _dbus_string_get_const_data (&auth->identity));
1157  return send_rejected (auth);
1158  }
1159 
1161  auth->desired_identity))
1162  {
1163  /* client has authenticated */
1165  auth->desired_identity))
1166  return FALSE;
1167 
1168  /* also copy misc process info from the socket credentials
1169  */
1171  DBUS_CREDENTIAL_UNIX_PROCESS_ID,
1172  auth->credentials))
1173  return FALSE;
1174 
1175 #ifdef HAVE_PDPLINUX
1176  _dbus_verbose("***** add DBUS_CREDENTIAL_UNIX_PARSEC\n");
1178  DBUS_CREDENTIAL_UNIX_PARSEC,
1179  auth->credentials)){
1180  _dbus_verbose("_dbus_credentials_add_credential FAILED \n");
1181  return FALSE;
1182  }
1183  else{
1184  _dbus_verbose("_dbus_credentials_add_credential OK \n");
1185  }
1186 #endif
1187 
1189  DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID,
1190  auth->credentials))
1191  return FALSE;
1192 
1194  DBUS_CREDENTIAL_LINUX_SECURITY_LABEL,
1195  auth->credentials))
1196  return FALSE;
1197 
1198  if (!send_ok (auth))
1199  return FALSE;
1200 
1201  _dbus_verbose ("%s: authenticated client based on socket credentials\n",
1202  DBUS_AUTH_NAME (auth));
1203 
1204  return TRUE;
1205  }
1206  else
1207  {
1208  _dbus_verbose ("%s: desired identity not found in socket credentials\n",
1209  DBUS_AUTH_NAME (auth));
1210  return send_rejected (auth);
1211  }
1212 }
1213 
1214 static void
1215 handle_server_shutdown_external_mech (DBusAuth *auth)
1216 {
1217 
1218 }
1219 
1220 static dbus_bool_t
1221 handle_client_initial_response_external_mech (DBusAuth *auth,
1222  DBusString *response)
1223 {
1224  /* We always append our UID as an initial response, so the server
1225  * doesn't have to send back an empty challenge to check whether we
1226  * want to specify an identity. i.e. this avoids a round trip that
1227  * the spec for the EXTERNAL mechanism otherwise requires.
1228  */
1229  DBusString plaintext;
1230 
1231  if (!_dbus_string_init (&plaintext))
1232  return FALSE;
1233 
1234  if (!_dbus_append_user_from_current_process (&plaintext))
1235  goto failed;
1236 
1237  if (!_dbus_string_hex_encode (&plaintext, 0,
1238  response,
1239  _dbus_string_get_length (response)))
1240  goto failed;
1241 
1242  _dbus_string_free (&plaintext);
1243 
1244  return TRUE;
1245 
1246  failed:
1247  _dbus_string_free (&plaintext);
1248  return FALSE;
1249 }
1250 
1251 static dbus_bool_t
1252 handle_client_data_external_mech (DBusAuth *auth,
1253  const DBusString *data)
1254 {
1255 
1256  return TRUE;
1257 }
1258 
1259 static void
1260 handle_client_shutdown_external_mech (DBusAuth *auth)
1261 {
1262 
1263 }
1264 
1265 /*
1266  * ANONYMOUS mechanism
1267  */
1268 
1269 static dbus_bool_t
1270 handle_server_data_anonymous_mech (DBusAuth *auth,
1271  const DBusString *data)
1272 {
1273  if (_dbus_string_get_length (data) > 0)
1274  {
1275  /* Client is allowed to send "trace" data, the only defined
1276  * meaning is that if it contains '@' it is an email address,
1277  * and otherwise it is anything else, and it's supposed to be
1278  * UTF-8
1279  */
1280  if (!_dbus_string_validate_utf8 (data, 0, _dbus_string_get_length (data)))
1281  {
1282  _dbus_verbose ("%s: Received invalid UTF-8 trace data from ANONYMOUS client\n",
1283  DBUS_AUTH_NAME (auth));
1284  return send_rejected (auth);
1285  }
1286 
1287  _dbus_verbose ("%s: ANONYMOUS client sent trace string: '%s'\n",
1288  DBUS_AUTH_NAME (auth),
1289  _dbus_string_get_const_data (data));
1290  }
1291 
1292  /* We want to be anonymous (clear in case some other protocol got midway through I guess) */
1294 
1295  /* Copy process ID from the socket credentials
1296  */
1298  DBUS_CREDENTIAL_UNIX_PROCESS_ID,
1299  auth->credentials))
1300  return FALSE;
1301 
1302  /* Anonymous is always allowed */
1303  if (!send_ok (auth))
1304  return FALSE;
1305 
1306  _dbus_verbose ("%s: authenticated client as anonymous\n",
1307  DBUS_AUTH_NAME (auth));
1308 
1309  return TRUE;
1310 }
1311 
1312 static void
1313 handle_server_shutdown_anonymous_mech (DBusAuth *auth)
1314 {
1315 
1316 }
1317 
1318 static dbus_bool_t
1319 handle_client_initial_response_anonymous_mech (DBusAuth *auth,
1320  DBusString *response)
1321 {
1322  /* Our initial response is a "trace" string which must be valid UTF-8
1323  * and must be an email address if it contains '@'.
1324  * We just send the dbus implementation info, like a user-agent or
1325  * something, because... why not. There's nothing guaranteed here
1326  * though, we could change it later.
1327  */
1328  DBusString plaintext;
1329 
1330  if (!_dbus_string_init (&plaintext))
1331  return FALSE;
1332 
1333  if (!_dbus_string_append (&plaintext,
1334  "libdbus " DBUS_VERSION_STRING))
1335  goto failed;
1336 
1337  if (!_dbus_string_hex_encode (&plaintext, 0,
1338  response,
1339  _dbus_string_get_length (response)))
1340  goto failed;
1341 
1342  _dbus_string_free (&plaintext);
1343 
1344  return TRUE;
1345 
1346  failed:
1347  _dbus_string_free (&plaintext);
1348  return FALSE;
1349 }
1350 
1351 static dbus_bool_t
1352 handle_client_data_anonymous_mech (DBusAuth *auth,
1353  const DBusString *data)
1354 {
1355 
1356  return TRUE;
1357 }
1358 
1359 static void
1360 handle_client_shutdown_anonymous_mech (DBusAuth *auth)
1361 {
1362 
1363 }
1364 
1365 /* Put mechanisms here in order of preference.
1366  * Right now we have:
1367  *
1368  * - EXTERNAL checks socket credentials (or in the future, other info from the OS)
1369  * - DBUS_COOKIE_SHA1 uses a cookie in the home directory, like xauth or ICE
1370  * - ANONYMOUS checks nothing but doesn't auth the person as a user
1371  *
1372  * We might ideally add a mechanism to chain to Cyrus SASL so we can
1373  * use its mechanisms as well.
1374  *
1375  */
1376 static const DBusAuthMechanismHandler
1377 all_mechanisms[] = {
1378  { "EXTERNAL",
1379  handle_server_data_external_mech,
1380  NULL, NULL,
1381  handle_server_shutdown_external_mech,
1382  handle_client_initial_response_external_mech,
1383  handle_client_data_external_mech,
1384  NULL, NULL,
1385  handle_client_shutdown_external_mech },
1386  { "DBUS_COOKIE_SHA1",
1387  handle_server_data_cookie_sha1_mech,
1388  NULL, NULL,
1389  handle_server_shutdown_cookie_sha1_mech,
1390  handle_client_initial_response_cookie_sha1_mech,
1391  handle_client_data_cookie_sha1_mech,
1392  NULL, NULL,
1393  handle_client_shutdown_cookie_sha1_mech },
1394  { "ANONYMOUS",
1395  handle_server_data_anonymous_mech,
1396  NULL, NULL,
1397  handle_server_shutdown_anonymous_mech,
1398  handle_client_initial_response_anonymous_mech,
1399  handle_client_data_anonymous_mech,
1400  NULL, NULL,
1401  handle_client_shutdown_anonymous_mech },
1402  { NULL, NULL }
1403 };
1404 
1405 static const DBusAuthMechanismHandler*
1406 find_mech (const DBusString *name,
1407  char **allowed_mechs)
1408 {
1409  int i;
1410 
1411  if (allowed_mechs != NULL &&
1412  !_dbus_string_array_contains ((const char**) allowed_mechs,
1413  _dbus_string_get_const_data (name)))
1414  return NULL;
1415 
1416  i = 0;
1417  while (all_mechanisms[i].mechanism != NULL)
1418  {
1419  if (_dbus_string_equal_c_str (name,
1420  all_mechanisms[i].mechanism))
1421 
1422  return &all_mechanisms[i];
1423 
1424  ++i;
1425  }
1426 
1427  return NULL;
1428 }
1429 
1430 static dbus_bool_t
1431 send_auth (DBusAuth *auth, const DBusAuthMechanismHandler *mech)
1432 {
1433  DBusString auth_command;
1434 
1435  if (!_dbus_string_init (&auth_command))
1436  return FALSE;
1437 
1438  if (!_dbus_string_append (&auth_command,
1439  "AUTH "))
1440  {
1441  _dbus_string_free (&auth_command);
1442  return FALSE;
1443  }
1444 
1445  if (!_dbus_string_append (&auth_command,
1446  mech->mechanism))
1447  {
1448  _dbus_string_free (&auth_command);
1449  return FALSE;
1450  }
1451 
1452  if (mech->client_initial_response_func != NULL)
1453  {
1454  if (!_dbus_string_append (&auth_command, " "))
1455  {
1456  _dbus_string_free (&auth_command);
1457  return FALSE;
1458  }
1459 
1460  if (!(* mech->client_initial_response_func) (auth, &auth_command))
1461  {
1462  _dbus_string_free (&auth_command);
1463  return FALSE;
1464  }
1465  }
1466 
1467  if (!_dbus_string_append (&auth_command,
1468  "\r\n"))
1469  {
1470  _dbus_string_free (&auth_command);
1471  return FALSE;
1472  }
1473 
1474  if (!_dbus_string_copy (&auth_command, 0,
1475  &auth->outgoing,
1476  _dbus_string_get_length (&auth->outgoing)))
1477  {
1478  _dbus_string_free (&auth_command);
1479  return FALSE;
1480  }
1481 
1482  _dbus_string_free (&auth_command);
1483  shutdown_mech (auth);
1484  auth->mech = mech;
1485  goto_state (auth, &client_state_waiting_for_data);
1486 
1487  return TRUE;
1488 }
1489 
1490 static dbus_bool_t
1491 send_data (DBusAuth *auth, DBusString *data)
1492 {
1493  int old_len;
1494 
1495  if (data == NULL || _dbus_string_get_length (data) == 0)
1496  return _dbus_string_append (&auth->outgoing, "DATA\r\n");
1497  else
1498  {
1499  old_len = _dbus_string_get_length (&auth->outgoing);
1500  if (!_dbus_string_append (&auth->outgoing, "DATA "))
1501  goto out;
1502 
1503  if (!_dbus_string_hex_encode (data, 0, &auth->outgoing,
1504  _dbus_string_get_length (&auth->outgoing)))
1505  goto out;
1506 
1507  if (!_dbus_string_append (&auth->outgoing, "\r\n"))
1508  goto out;
1509 
1510  return TRUE;
1511 
1512  out:
1513  _dbus_string_set_length (&auth->outgoing, old_len);
1514 
1515  return FALSE;
1516  }
1517 }
1518 
1519 static dbus_bool_t
1520 send_rejected (DBusAuth *auth)
1521 {
1522  DBusString command;
1523  DBusAuthServer *server_auth;
1524  int i;
1525 
1526  if (!_dbus_string_init (&command))
1527  return FALSE;
1528 
1529  if (!_dbus_string_append (&command,
1530  "REJECTED"))
1531  goto nomem;
1532 
1533  for (i = 0; all_mechanisms[i].mechanism != NULL; i++)
1534  {
1535  /* skip mechanisms that aren't allowed */
1536  if (auth->allowed_mechs != NULL &&
1537  !_dbus_string_array_contains ((const char**)auth->allowed_mechs,
1538  all_mechanisms[i].mechanism))
1539  continue;
1540 
1541  if (!_dbus_string_append (&command,
1542  " "))
1543  goto nomem;
1544 
1545  if (!_dbus_string_append (&command,
1546  all_mechanisms[i].mechanism))
1547  goto nomem;
1548  }
1549 
1550  if (!_dbus_string_append (&command, "\r\n"))
1551  goto nomem;
1552 
1553  if (!_dbus_string_copy (&command, 0, &auth->outgoing,
1554  _dbus_string_get_length (&auth->outgoing)))
1555  goto nomem;
1556 
1557  shutdown_mech (auth);
1558 
1560  server_auth = DBUS_AUTH_SERVER (auth);
1561  server_auth->failures += 1;
1562 
1563  if (server_auth->failures >= server_auth->max_failures)
1564  goto_state (auth, &common_state_need_disconnect);
1565  else
1566  goto_state (auth, &server_state_waiting_for_auth);
1567 
1568  _dbus_string_free (&command);
1569 
1570  return TRUE;
1571 
1572  nomem:
1573  _dbus_string_free (&command);
1574  return FALSE;
1575 }
1576 
1577 static dbus_bool_t
1578 send_error (DBusAuth *auth, const char *message)
1579 {
1580  return _dbus_string_append_printf (&auth->outgoing,
1581  "ERROR \"%s\"\r\n", message);
1582 }
1583 
1584 static dbus_bool_t
1585 send_ok (DBusAuth *auth)
1586 {
1587  int orig_len;
1588 
1589  orig_len = _dbus_string_get_length (&auth->outgoing);
1590 
1591  if (_dbus_string_append (&auth->outgoing, "OK ") &&
1592  _dbus_string_copy (& DBUS_AUTH_SERVER (auth)->guid,
1593  0,
1594  &auth->outgoing,
1595  _dbus_string_get_length (&auth->outgoing)) &&
1596  _dbus_string_append (&auth->outgoing, "\r\n"))
1597  {
1598  goto_state (auth, &server_state_waiting_for_begin);
1599  return TRUE;
1600  }
1601  else
1602  {
1603  _dbus_string_set_length (&auth->outgoing, orig_len);
1604  return FALSE;
1605  }
1606 }
1607 
1608 static dbus_bool_t
1609 send_begin (DBusAuth *auth)
1610 {
1611 
1612  if (!_dbus_string_append (&auth->outgoing,
1613  "BEGIN\r\n"))
1614  return FALSE;
1615 
1616  goto_state (auth, &common_state_authenticated);
1617  return TRUE;
1618 }
1619 
1620 static dbus_bool_t
1621 process_ok(DBusAuth *auth,
1622  const DBusString *args_from_ok) {
1623 
1624  int end_of_hex;
1625 
1626  /* "args_from_ok" should be the GUID, whitespace already pulled off the front */
1627  _dbus_assert (_dbus_string_get_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server) == 0);
1628 
1629  /* We decode the hex string to binary, using guid_from_server as scratch... */
1630 
1631  end_of_hex = 0;
1632  if (!_dbus_string_hex_decode (args_from_ok, 0, &end_of_hex,
1633  & DBUS_AUTH_CLIENT (auth)->guid_from_server, 0))
1634  return FALSE;
1635 
1636  /* now clear out the scratch */
1637  _dbus_string_set_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server, 0);
1638 
1639  if (end_of_hex != _dbus_string_get_length (args_from_ok) ||
1640  end_of_hex == 0)
1641  {
1642  _dbus_verbose ("Bad GUID from server, parsed %d bytes and had %d bytes from server\n",
1643  end_of_hex, _dbus_string_get_length (args_from_ok));
1644  goto_state (auth, &common_state_need_disconnect);
1645  return TRUE;
1646  }
1647 
1648  if (!_dbus_string_copy (args_from_ok, 0, &DBUS_AUTH_CLIENT (auth)->guid_from_server, 0)) {
1649  _dbus_string_set_length (& DBUS_AUTH_CLIENT (auth)->guid_from_server, 0);
1650  return FALSE;
1651  }
1652 
1653  _dbus_verbose ("Got GUID '%s' from the server\n",
1654  _dbus_string_get_const_data (& DBUS_AUTH_CLIENT (auth)->guid_from_server));
1655 
1656  if (auth->unix_fd_possible)
1657  return send_negotiate_unix_fd(auth);
1658 
1659  _dbus_verbose("Not negotiating unix fd passing, since not possible\n");
1660  return send_begin (auth);
1661 }
1662 
1663 static dbus_bool_t
1664 send_cancel (DBusAuth *auth)
1665 {
1666  if (_dbus_string_append (&auth->outgoing, "CANCEL\r\n"))
1667  {
1668  goto_state (auth, &client_state_waiting_for_reject);
1669  return TRUE;
1670  }
1671  else
1672  return FALSE;
1673 }
1674 
1675 static dbus_bool_t
1676 process_data (DBusAuth *auth,
1677  const DBusString *args,
1678  DBusAuthDataFunction data_func)
1679 {
1680  int end;
1681  DBusString decoded;
1682 
1683  if (!_dbus_string_init (&decoded))
1684  return FALSE;
1685 
1686  if (!_dbus_string_hex_decode (args, 0, &end, &decoded, 0))
1687  {
1688  _dbus_string_free (&decoded);
1689  return FALSE;
1690  }
1691 
1692  if (_dbus_string_get_length (args) != end)
1693  {
1694  _dbus_string_free (&decoded);
1695  if (!send_error (auth, "Invalid hex encoding"))
1696  return FALSE;
1697 
1698  return TRUE;
1699  }
1700 
1701 #ifdef DBUS_ENABLE_VERBOSE_MODE
1702  if (_dbus_string_validate_ascii (&decoded, 0,
1703  _dbus_string_get_length (&decoded)))
1704  _dbus_verbose ("%s: data: '%s'\n",
1705  DBUS_AUTH_NAME (auth),
1706  _dbus_string_get_const_data (&decoded));
1707 #endif
1708 
1709  if (!(* data_func) (auth, &decoded))
1710  {
1711  _dbus_string_free (&decoded);
1712  return FALSE;
1713  }
1714 
1715  _dbus_string_free (&decoded);
1716  return TRUE;
1717 }
1718 
1719 static dbus_bool_t
1720 send_negotiate_unix_fd (DBusAuth *auth)
1721 {
1722  if (!_dbus_string_append (&auth->outgoing,
1723  "NEGOTIATE_UNIX_FD\r\n"))
1724  return FALSE;
1725 
1726  goto_state (auth, &client_state_waiting_for_agree_unix_fd);
1727  return TRUE;
1728 }
1729 
1730 static dbus_bool_t
1731 send_agree_unix_fd (DBusAuth *auth)
1732 {
1734 
1735  auth->unix_fd_negotiated = TRUE;
1736  _dbus_verbose("Agreed to UNIX FD passing\n");
1737 
1738  if (!_dbus_string_append (&auth->outgoing,
1739  "AGREE_UNIX_FD\r\n"))
1740  return FALSE;
1741 
1742  goto_state (auth, &server_state_waiting_for_begin);
1743  return TRUE;
1744 }
1745 
1746 static dbus_bool_t
1747 handle_auth (DBusAuth *auth, const DBusString *args)
1748 {
1749  if (_dbus_string_get_length (args) == 0)
1750  {
1751  /* No args to the auth, send mechanisms */
1752  if (!send_rejected (auth))
1753  return FALSE;
1754 
1755  return TRUE;
1756  }
1757  else
1758  {
1759  int i;
1760  DBusString mech;
1761  DBusString hex_response;
1762 
1763  _dbus_string_find_blank (args, 0, &i);
1764 
1765  if (!_dbus_string_init (&mech))
1766  return FALSE;
1767 
1768  if (!_dbus_string_init (&hex_response))
1769  {
1770  _dbus_string_free (&mech);
1771  return FALSE;
1772  }
1773 
1774  if (!_dbus_string_copy_len (args, 0, i, &mech, 0))
1775  goto failed;
1776 
1777  _dbus_string_skip_blank (args, i, &i);
1778  if (!_dbus_string_copy (args, i, &hex_response, 0))
1779  goto failed;
1780 
1781  auth->mech = find_mech (&mech, auth->allowed_mechs);
1782  if (auth->mech != NULL)
1783  {
1784  _dbus_verbose ("%s: Trying mechanism %s\n",
1785  DBUS_AUTH_NAME (auth),
1786  auth->mech->mechanism);
1787 
1788  if (!process_data (auth, &hex_response,
1789  auth->mech->server_data_func))
1790  goto failed;
1791  }
1792  else
1793  {
1794  /* Unsupported mechanism */
1795  _dbus_verbose ("%s: Unsupported mechanism %s\n",
1796  DBUS_AUTH_NAME (auth),
1797  _dbus_string_get_const_data (&mech));
1798 
1799  if (!send_rejected (auth))
1800  goto failed;
1801  }
1802 
1803  _dbus_string_free (&mech);
1804  _dbus_string_free (&hex_response);
1805 
1806  return TRUE;
1807 
1808  failed:
1809  auth->mech = NULL;
1810  _dbus_string_free (&mech);
1811  _dbus_string_free (&hex_response);
1812  return FALSE;
1813  }
1814 }
1815 
1816 static dbus_bool_t
1817 handle_server_state_waiting_for_auth (DBusAuth *auth,
1818  DBusAuthCommand command,
1819  const DBusString *args)
1820 {
1821  switch (command)
1822  {
1823  case DBUS_AUTH_COMMAND_AUTH:
1824  return handle_auth (auth, args);
1825 
1826  case DBUS_AUTH_COMMAND_CANCEL:
1827  case DBUS_AUTH_COMMAND_DATA:
1828  return send_error (auth, "Not currently in an auth conversation");
1829 
1830  case DBUS_AUTH_COMMAND_BEGIN:
1831  goto_state (auth, &common_state_need_disconnect);
1832  return TRUE;
1833 
1834  case DBUS_AUTH_COMMAND_ERROR:
1835  return send_rejected (auth);
1836 
1837  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
1838  return send_error (auth, "Need to authenticate first");
1839 
1840  case DBUS_AUTH_COMMAND_REJECTED:
1841  case DBUS_AUTH_COMMAND_OK:
1842  case DBUS_AUTH_COMMAND_UNKNOWN:
1843  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
1844  default:
1845  return send_error (auth, "Unknown command");
1846  }
1847 }
1848 
1849 static dbus_bool_t
1850 handle_server_state_waiting_for_data (DBusAuth *auth,
1851  DBusAuthCommand command,
1852  const DBusString *args)
1853 {
1854  switch (command)
1855  {
1856  case DBUS_AUTH_COMMAND_AUTH:
1857  return send_error (auth, "Sent AUTH while another AUTH in progress");
1858 
1859  case DBUS_AUTH_COMMAND_CANCEL:
1860  case DBUS_AUTH_COMMAND_ERROR:
1861  return send_rejected (auth);
1862 
1863  case DBUS_AUTH_COMMAND_DATA:
1864  return process_data (auth, args, auth->mech->server_data_func);
1865 
1866  case DBUS_AUTH_COMMAND_BEGIN:
1867  goto_state (auth, &common_state_need_disconnect);
1868  return TRUE;
1869 
1870  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
1871  return send_error (auth, "Need to authenticate first");
1872 
1873  case DBUS_AUTH_COMMAND_REJECTED:
1874  case DBUS_AUTH_COMMAND_OK:
1875  case DBUS_AUTH_COMMAND_UNKNOWN:
1876  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
1877  default:
1878  return send_error (auth, "Unknown command");
1879  }
1880 }
1881 
1882 static dbus_bool_t
1883 handle_server_state_waiting_for_begin (DBusAuth *auth,
1884  DBusAuthCommand command,
1885  const DBusString *args)
1886 {
1887  switch (command)
1888  {
1889  case DBUS_AUTH_COMMAND_AUTH:
1890  return send_error (auth, "Sent AUTH while expecting BEGIN");
1891 
1892  case DBUS_AUTH_COMMAND_DATA:
1893  return send_error (auth, "Sent DATA while expecting BEGIN");
1894 
1895  case DBUS_AUTH_COMMAND_BEGIN:
1896  goto_state (auth, &common_state_authenticated);
1897  return TRUE;
1898 
1899  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
1900  if (auth->unix_fd_possible)
1901  return send_agree_unix_fd(auth);
1902  else
1903  return send_error(auth, "Unix FD passing not supported, not authenticated or otherwise not possible");
1904 
1905  case DBUS_AUTH_COMMAND_REJECTED:
1906  case DBUS_AUTH_COMMAND_OK:
1907  case DBUS_AUTH_COMMAND_UNKNOWN:
1908  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
1909  default:
1910  return send_error (auth, "Unknown command");
1911 
1912  case DBUS_AUTH_COMMAND_CANCEL:
1913  case DBUS_AUTH_COMMAND_ERROR:
1914  return send_rejected (auth);
1915  }
1916 }
1917 
1918 /* return FALSE if no memory, TRUE if all OK */
1919 static dbus_bool_t
1920 get_word (const DBusString *str,
1921  int *start,
1922  DBusString *word)
1923 {
1924  int i;
1925 
1926  _dbus_string_skip_blank (str, *start, start);
1927  _dbus_string_find_blank (str, *start, &i);
1928 
1929  if (i > *start)
1930  {
1931  if (!_dbus_string_copy_len (str, *start, i - *start, word, 0))
1932  return FALSE;
1933 
1934  *start = i;
1935  }
1936 
1937  return TRUE;
1938 }
1939 
1940 static dbus_bool_t
1941 record_mechanisms (DBusAuth *auth,
1942  const DBusString *args)
1943 {
1944  int next;
1945  int len;
1946 
1947  if (auth->already_got_mechanisms)
1948  return TRUE;
1949 
1950  len = _dbus_string_get_length (args);
1951 
1952  next = 0;
1953  while (next < len)
1954  {
1955  DBusString m;
1956  const DBusAuthMechanismHandler *mech;
1957 
1958  if (!_dbus_string_init (&m))
1959  goto nomem;
1960 
1961  if (!get_word (args, &next, &m))
1962  {
1963  _dbus_string_free (&m);
1964  goto nomem;
1965  }
1966 
1967  mech = find_mech (&m, auth->allowed_mechs);
1968 
1969  if (mech != NULL)
1970  {
1971  /* FIXME right now we try mechanisms in the order
1972  * the server lists them; should we do them in
1973  * some more deterministic order?
1974  *
1975  * Probably in all_mechanisms order, our order of
1976  * preference. Of course when the server is us,
1977  * it lists things in that order anyhow.
1978  */
1979 
1980  if (mech != &all_mechanisms[0])
1981  {
1982  _dbus_verbose ("%s: Adding mechanism %s to list we will try\n",
1983  DBUS_AUTH_NAME (auth), mech->mechanism);
1984 
1985  if (!_dbus_list_append (& DBUS_AUTH_CLIENT (auth)->mechs_to_try,
1986  (void*) mech))
1987  {
1988  _dbus_string_free (&m);
1989  goto nomem;
1990  }
1991  }
1992  else
1993  {
1994  _dbus_verbose ("%s: Already tried mechanism %s; not adding to list we will try\n",
1995  DBUS_AUTH_NAME (auth), mech->mechanism);
1996  }
1997  }
1998  else
1999  {
2000  _dbus_verbose ("%s: Server offered mechanism \"%s\" that we don't know how to use\n",
2001  DBUS_AUTH_NAME (auth),
2002  _dbus_string_get_const_data (&m));
2003  }
2004 
2005  _dbus_string_free (&m);
2006  }
2007 
2008  auth->already_got_mechanisms = TRUE;
2009 
2010  return TRUE;
2011 
2012  nomem:
2013  _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
2014 
2015  return FALSE;
2016 }
2017 
2018 static dbus_bool_t
2019 process_rejected (DBusAuth *auth, const DBusString *args)
2020 {
2021  const DBusAuthMechanismHandler *mech;
2022  DBusAuthClient *client;
2023 
2024  client = DBUS_AUTH_CLIENT (auth);
2025 
2026  if (!auth->already_got_mechanisms)
2027  {
2028  if (!record_mechanisms (auth, args))
2029  return FALSE;
2030  }
2031 
2032  if (DBUS_AUTH_CLIENT (auth)->mechs_to_try != NULL)
2033  {
2034  mech = client->mechs_to_try->data;
2035 
2036  if (!send_auth (auth, mech))
2037  return FALSE;
2038 
2040 
2041  _dbus_verbose ("%s: Trying mechanism %s\n",
2042  DBUS_AUTH_NAME (auth),
2043  mech->mechanism);
2044  }
2045  else
2046  {
2047  /* Give up */
2048  _dbus_verbose ("%s: Disconnecting because we are out of mechanisms to try using\n",
2049  DBUS_AUTH_NAME (auth));
2050  goto_state (auth, &common_state_need_disconnect);
2051  }
2052 
2053  return TRUE;
2054 }
2055 
2056 
2057 static dbus_bool_t
2058 handle_client_state_waiting_for_data (DBusAuth *auth,
2059  DBusAuthCommand command,
2060  const DBusString *args)
2061 {
2062  _dbus_assert (auth->mech != NULL);
2063 
2064  switch (command)
2065  {
2066  case DBUS_AUTH_COMMAND_DATA:
2067  return process_data (auth, args, auth->mech->client_data_func);
2068 
2069  case DBUS_AUTH_COMMAND_REJECTED:
2070  return process_rejected (auth, args);
2071 
2072  case DBUS_AUTH_COMMAND_OK:
2073  return process_ok(auth, args);
2074 
2075  case DBUS_AUTH_COMMAND_ERROR:
2076  return send_cancel (auth);
2077 
2078  case DBUS_AUTH_COMMAND_AUTH:
2079  case DBUS_AUTH_COMMAND_CANCEL:
2080  case DBUS_AUTH_COMMAND_BEGIN:
2081  case DBUS_AUTH_COMMAND_UNKNOWN:
2082  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
2083  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
2084  default:
2085  return send_error (auth, "Unknown command");
2086  }
2087 }
2088 
2089 static dbus_bool_t
2090 handle_client_state_waiting_for_ok (DBusAuth *auth,
2091  DBusAuthCommand command,
2092  const DBusString *args)
2093 {
2094  switch (command)
2095  {
2096  case DBUS_AUTH_COMMAND_REJECTED:
2097  return process_rejected (auth, args);
2098 
2099  case DBUS_AUTH_COMMAND_OK:
2100  return process_ok(auth, args);
2101 
2102  case DBUS_AUTH_COMMAND_DATA:
2103  case DBUS_AUTH_COMMAND_ERROR:
2104  return send_cancel (auth);
2105 
2106  case DBUS_AUTH_COMMAND_AUTH:
2107  case DBUS_AUTH_COMMAND_CANCEL:
2108  case DBUS_AUTH_COMMAND_BEGIN:
2109  case DBUS_AUTH_COMMAND_UNKNOWN:
2110  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
2111  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
2112  default:
2113  return send_error (auth, "Unknown command");
2114  }
2115 }
2116 
2117 static dbus_bool_t
2118 handle_client_state_waiting_for_reject (DBusAuth *auth,
2119  DBusAuthCommand command,
2120  const DBusString *args)
2121 {
2122  switch (command)
2123  {
2124  case DBUS_AUTH_COMMAND_REJECTED:
2125  return process_rejected (auth, args);
2126 
2127  case DBUS_AUTH_COMMAND_AUTH:
2128  case DBUS_AUTH_COMMAND_CANCEL:
2129  case DBUS_AUTH_COMMAND_DATA:
2130  case DBUS_AUTH_COMMAND_BEGIN:
2131  case DBUS_AUTH_COMMAND_OK:
2132  case DBUS_AUTH_COMMAND_ERROR:
2133  case DBUS_AUTH_COMMAND_UNKNOWN:
2134  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
2135  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
2136  default:
2137  goto_state (auth, &common_state_need_disconnect);
2138  return TRUE;
2139  }
2140 }
2141 
2142 static dbus_bool_t
2143 handle_client_state_waiting_for_agree_unix_fd(DBusAuth *auth,
2144  DBusAuthCommand command,
2145  const DBusString *args)
2146 {
2147  switch (command)
2148  {
2149  case DBUS_AUTH_COMMAND_AGREE_UNIX_FD:
2151  auth->unix_fd_negotiated = TRUE;
2152  _dbus_verbose("Successfully negotiated UNIX FD passing\n");
2153  return send_begin (auth);
2154 
2155  case DBUS_AUTH_COMMAND_ERROR:
2157  auth->unix_fd_negotiated = FALSE;
2158  _dbus_verbose("Failed to negotiate UNIX FD passing\n");
2159  return send_begin (auth);
2160 
2161  case DBUS_AUTH_COMMAND_OK:
2162  case DBUS_AUTH_COMMAND_DATA:
2163  case DBUS_AUTH_COMMAND_REJECTED:
2164  case DBUS_AUTH_COMMAND_AUTH:
2165  case DBUS_AUTH_COMMAND_CANCEL:
2166  case DBUS_AUTH_COMMAND_BEGIN:
2167  case DBUS_AUTH_COMMAND_UNKNOWN:
2168  case DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD:
2169  default:
2170  return send_error (auth, "Unknown command");
2171  }
2172 }
2173 
2177 typedef struct {
2178  const char *name;
2181 
2182 static const DBusAuthCommandName auth_command_names[] = {
2183  { "AUTH", DBUS_AUTH_COMMAND_AUTH },
2184  { "CANCEL", DBUS_AUTH_COMMAND_CANCEL },
2185  { "DATA", DBUS_AUTH_COMMAND_DATA },
2186  { "BEGIN", DBUS_AUTH_COMMAND_BEGIN },
2187  { "REJECTED", DBUS_AUTH_COMMAND_REJECTED },
2188  { "OK", DBUS_AUTH_COMMAND_OK },
2189  { "ERROR", DBUS_AUTH_COMMAND_ERROR },
2190  { "NEGOTIATE_UNIX_FD", DBUS_AUTH_COMMAND_NEGOTIATE_UNIX_FD },
2191  { "AGREE_UNIX_FD", DBUS_AUTH_COMMAND_AGREE_UNIX_FD }
2192 };
2193 
2194 static DBusAuthCommand
2195 lookup_command_from_name (DBusString *command)
2196 {
2197  int i;
2198 
2199  for (i = 0; i < _DBUS_N_ELEMENTS (auth_command_names); i++)
2200  {
2201  if (_dbus_string_equal_c_str (command,
2202  auth_command_names[i].name))
2203  return auth_command_names[i].command;
2204  }
2205 
2206  return DBUS_AUTH_COMMAND_UNKNOWN;
2207 }
2208 
2209 static void
2210 goto_state (DBusAuth *auth,
2211  const DBusAuthStateData *state)
2212 {
2213  _dbus_verbose ("%s: going from state %s to state %s\n",
2214  DBUS_AUTH_NAME (auth),
2215  auth->state->name,
2216  state->name);
2217 
2218  auth->state = state;
2219 }
2220 
2221 /* returns whether to call it again right away */
2222 static dbus_bool_t
2223 process_command (DBusAuth *auth)
2224 {
2225  DBusAuthCommand command;
2226  DBusString line;
2227  DBusString args;
2228  int eol;
2229  int i, j;
2230  dbus_bool_t retval;
2231 
2232  /* _dbus_verbose ("%s: trying process_command()\n"); */
2233 
2234  retval = FALSE;
2235 
2236  eol = 0;
2237  if (!_dbus_string_find (&auth->incoming, 0, "\r\n", &eol))
2238  return FALSE;
2239 
2240  if (!_dbus_string_init (&line))
2241  {
2242  auth->needed_memory = TRUE;
2243  return FALSE;
2244  }
2245 
2246  if (!_dbus_string_init (&args))
2247  {
2248  _dbus_string_free (&line);
2249  auth->needed_memory = TRUE;
2250  return FALSE;
2251  }
2252 
2253  if (!_dbus_string_copy_len (&auth->incoming, 0, eol, &line, 0))
2254  goto out;
2255 
2256  if (!_dbus_string_validate_ascii (&line, 0,
2257  _dbus_string_get_length (&line)))
2258  {
2259  _dbus_verbose ("%s: Command contained non-ASCII chars or embedded nul\n",
2260  DBUS_AUTH_NAME (auth));
2261  if (!send_error (auth, "Command contained non-ASCII"))
2262  goto out;
2263  else
2264  goto next_command;
2265  }
2266 
2267  _dbus_verbose ("%s: got command \"%s\"\n",
2268  DBUS_AUTH_NAME (auth),
2269  _dbus_string_get_const_data (&line));
2270 
2271  _dbus_string_find_blank (&line, 0, &i);
2272  _dbus_string_skip_blank (&line, i, &j);
2273 
2274  if (j > i)
2275  _dbus_string_delete (&line, i, j - i);
2276 
2277  if (!_dbus_string_move (&line, i, &args, 0))
2278  goto out;
2279 
2280  /* FIXME 1.0 we should probably validate that only the allowed
2281  * chars are in the command name
2282  */
2283 
2284  command = lookup_command_from_name (&line);
2285  if (!(* auth->state->handler) (auth, command, &args))
2286  goto out;
2287 
2288  next_command:
2289 
2290  /* We've succeeded in processing the whole command so drop it out
2291  * of the incoming buffer and return TRUE to try another command.
2292  */
2293 
2294  _dbus_string_delete (&auth->incoming, 0, eol);
2295 
2296  /* kill the \r\n */
2297  _dbus_string_delete (&auth->incoming, 0, 2);
2298 
2299  retval = TRUE;
2300 
2301  out:
2302  _dbus_string_free (&args);
2303  _dbus_string_free (&line);
2304 
2305  if (!retval)
2306  auth->needed_memory = TRUE;
2307  else
2308  auth->needed_memory = FALSE;
2309 
2310  return retval;
2311 }
2312 
2313 
2328 DBusAuth*
2330 {
2331  DBusAuth *auth;
2332  DBusAuthServer *server_auth;
2333  DBusString guid_copy;
2334 
2335  if (!_dbus_string_init (&guid_copy))
2336  return NULL;
2337 
2338  if (!_dbus_string_copy (guid, 0, &guid_copy, 0))
2339  {
2340  _dbus_string_free (&guid_copy);
2341  return NULL;
2342  }
2343 
2344  auth = _dbus_auth_new (sizeof (DBusAuthServer));
2345  if (auth == NULL)
2346  {
2347  _dbus_string_free (&guid_copy);
2348  return NULL;
2349  }
2350 
2351  auth->side = auth_side_server;
2352  auth->state = &server_state_waiting_for_auth;
2353 
2354  server_auth = DBUS_AUTH_SERVER (auth);
2355 
2356  server_auth->guid = guid_copy;
2357 
2358  /* perhaps this should be per-mechanism with a lower
2359  * max
2360  */
2361  server_auth->failures = 0;
2362  server_auth->max_failures = 6;
2363 
2364  return auth;
2365 }
2366 
2374 DBusAuth*
2376 {
2377  DBusAuth *auth;
2378  DBusString guid_str;
2379 
2380  if (!_dbus_string_init (&guid_str))
2381  return NULL;
2382 
2383  auth = _dbus_auth_new (sizeof (DBusAuthClient));
2384  if (auth == NULL)
2385  {
2386  _dbus_string_free (&guid_str);
2387  return NULL;
2388  }
2389 
2390  DBUS_AUTH_CLIENT (auth)->guid_from_server = guid_str;
2391 
2392  auth->side = auth_side_client;
2393  auth->state = &client_state_need_send_auth;
2394 
2395  /* Start the auth conversation by sending AUTH for our default
2396  * mechanism */
2397  if (!send_auth (auth, &all_mechanisms[0]))
2398  {
2399  _dbus_auth_unref (auth);
2400  return NULL;
2401  }
2402 
2403  return auth;
2404 }
2405 
2412 DBusAuth *
2414 {
2415  _dbus_assert (auth != NULL);
2416 
2417  auth->refcount += 1;
2418 
2419  return auth;
2420 }
2421 
2427 void
2429 {
2430  _dbus_assert (auth != NULL);
2431  _dbus_assert (auth->refcount > 0);
2432 
2433  auth->refcount -= 1;
2434  if (auth->refcount == 0)
2435  {
2436  shutdown_mech (auth);
2437 
2438  if (DBUS_AUTH_IS_CLIENT (auth))
2439  {
2440  _dbus_string_free (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
2441  _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
2442  }
2443  else
2444  {
2446 
2447  _dbus_string_free (& DBUS_AUTH_SERVER (auth)->guid);
2448  }
2449 
2450  if (auth->keyring)
2451  _dbus_keyring_unref (auth->keyring);
2452 
2453  _dbus_string_free (&auth->context);
2454  _dbus_string_free (&auth->challenge);
2455  _dbus_string_free (&auth->identity);
2456  _dbus_string_free (&auth->incoming);
2457  _dbus_string_free (&auth->outgoing);
2458 
2460 
2464 
2465  dbus_free (auth);
2466  }
2467 }
2468 
2479  const char **mechanisms)
2480 {
2481  char **copy;
2482 
2483  if (mechanisms != NULL)
2484  {
2485  copy = _dbus_dup_string_array (mechanisms);
2486  if (copy == NULL)
2487  return FALSE;
2488  }
2489  else
2490  copy = NULL;
2491 
2493 
2494  auth->allowed_mechs = copy;
2495 
2496  return TRUE;
2497 }
2498 
2503 #define DBUS_AUTH_IN_END_STATE(auth) ((auth)->state->handler == NULL)
2504 
2512 DBusAuthState
2514 {
2515  auth->needed_memory = FALSE;
2516 
2517  /* Max amount we'll buffer up before deciding someone's on crack */
2518 #define MAX_BUFFER (16 * _DBUS_ONE_KILOBYTE)
2519 
2520  do
2521  {
2522  if (DBUS_AUTH_IN_END_STATE (auth))
2523  break;
2524 
2525  if (_dbus_string_get_length (&auth->incoming) > MAX_BUFFER ||
2526  _dbus_string_get_length (&auth->outgoing) > MAX_BUFFER)
2527  {
2528  goto_state (auth, &common_state_need_disconnect);
2529  _dbus_verbose ("%s: Disconnecting due to excessive data buffered in auth phase\n",
2530  DBUS_AUTH_NAME (auth));
2531  break;
2532  }
2533  }
2534  while (process_command (auth));
2535 
2536  if (auth->needed_memory)
2537  return DBUS_AUTH_STATE_WAITING_FOR_MEMORY;
2538  else if (_dbus_string_get_length (&auth->outgoing) > 0)
2539  return DBUS_AUTH_STATE_HAVE_BYTES_TO_SEND;
2540  else if (auth->state == &common_state_need_disconnect)
2541  return DBUS_AUTH_STATE_NEED_DISCONNECT;
2542  else if (auth->state == &common_state_authenticated)
2543  return DBUS_AUTH_STATE_AUTHENTICATED;
2544  else return DBUS_AUTH_STATE_WAITING_FOR_INPUT;
2545 }
2546 
2558  const DBusString **str)
2559 {
2560  _dbus_assert (auth != NULL);
2561  _dbus_assert (str != NULL);
2562 
2563  *str = NULL;
2564 
2565  if (_dbus_string_get_length (&auth->outgoing) == 0)
2566  return FALSE;
2567 
2568  *str = &auth->outgoing;
2569 
2570  return TRUE;
2571 }
2572 
2581 void
2583  int bytes_sent)
2584 {
2585  _dbus_verbose ("%s: Sent %d bytes of: %s\n",
2586  DBUS_AUTH_NAME (auth),
2587  bytes_sent,
2588  _dbus_string_get_const_data (&auth->outgoing));
2589 
2590  _dbus_string_delete (&auth->outgoing,
2591  0, bytes_sent);
2592 }
2593 
2601 void
2603  DBusString **buffer)
2604 {
2605  _dbus_assert (auth != NULL);
2607 
2608  *buffer = &auth->incoming;
2609 
2610  auth->buffer_outstanding = TRUE;
2611 }
2612 
2619 void
2621  DBusString *buffer)
2622 {
2623  _dbus_assert (buffer == &auth->incoming);
2625 
2626  auth->buffer_outstanding = FALSE;
2627 }
2628 
2638 void
2640  const DBusString **str)
2641 {
2642  if (!DBUS_AUTH_IN_END_STATE (auth))
2643  return;
2644 
2645  *str = &auth->incoming;
2646 }
2647 
2648 
2655 void
2657 {
2658  if (!DBUS_AUTH_IN_END_STATE (auth))
2659  return;
2660 
2661  _dbus_string_set_length (&auth->incoming, 0);
2662 }
2663 
2674 {
2675  if (auth->state != &common_state_authenticated)
2676  return FALSE;
2677 
2678  if (auth->mech != NULL)
2679  {
2680  if (DBUS_AUTH_IS_CLIENT (auth))
2681  return auth->mech->client_encode_func != NULL;
2682  else
2683  return auth->mech->server_encode_func != NULL;
2684  }
2685  else
2686  return FALSE;
2687 }
2688 
2701  const DBusString *plaintext,
2702  DBusString *encoded)
2703 {
2704  _dbus_assert (plaintext != encoded);
2705 
2706  if (auth->state != &common_state_authenticated)
2707  return FALSE;
2708 
2709  if (_dbus_auth_needs_encoding (auth))
2710  {
2711  if (DBUS_AUTH_IS_CLIENT (auth))
2712  return (* auth->mech->client_encode_func) (auth, plaintext, encoded);
2713  else
2714  return (* auth->mech->server_encode_func) (auth, plaintext, encoded);
2715  }
2716  else
2717  {
2718  return _dbus_string_copy (plaintext, 0, encoded,
2719  _dbus_string_get_length (encoded));
2720  }
2721 }
2722 
2733 {
2734  if (auth->state != &common_state_authenticated)
2735  return FALSE;
2736 
2737  if (auth->mech != NULL)
2738  {
2739  if (DBUS_AUTH_IS_CLIENT (auth))
2740  return auth->mech->client_decode_func != NULL;
2741  else
2742  return auth->mech->server_decode_func != NULL;
2743  }
2744  else
2745  return FALSE;
2746 }
2747 
2748 
2764  const DBusString *encoded,
2765  DBusString *plaintext)
2766 {
2767  _dbus_assert (plaintext != encoded);
2768 
2769  if (auth->state != &common_state_authenticated)
2770  return FALSE;
2771 
2772  if (_dbus_auth_needs_decoding (auth))
2773  {
2774  if (DBUS_AUTH_IS_CLIENT (auth))
2775  return (* auth->mech->client_decode_func) (auth, encoded, plaintext);
2776  else
2777  return (* auth->mech->server_decode_func) (auth, encoded, plaintext);
2778  }
2779  else
2780  {
2781  return _dbus_string_copy (encoded, 0, plaintext,
2782  _dbus_string_get_length (plaintext));
2783  }
2784 }
2785 
2796  DBusCredentials *credentials)
2797 {
2800  credentials);
2801 }
2802 
2814 {
2815  if (auth->state == &common_state_authenticated)
2816  {
2817  return auth->authorized_identity;
2818  }
2819  else
2820  {
2821  /* FIXME instead of this, keep an empty credential around that
2822  * doesn't require allocation or something
2823  */
2824  /* return empty credentials */
2826  return auth->authorized_identity;
2827  }
2828 }
2829 
2836 const char*
2838 {
2840 
2841  if (auth->state == &common_state_authenticated)
2842  return _dbus_string_get_const_data (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
2843  else
2844  return NULL;
2845 }
2846 
2857  const DBusString *context)
2858 {
2859  return _dbus_string_replace_len (context, 0, _dbus_string_get_length (context),
2860  &auth->context, 0, _dbus_string_get_length (context));
2861 }
2862 
2870 void
2872 {
2873  auth->unix_fd_possible = b;
2874 }
2875 
2884 {
2885  return auth->unix_fd_negotiated;
2886 }
2887 
2896 {
2897  _dbus_assert (name != NULL);
2898 
2899  return find_mech (name, NULL) != NULL;
2900 }
2901 
2910 {
2911  unsigned int i;
2912  _dbus_assert (buffer != NULL);
2913 
2914  for (i = 0; all_mechanisms[i].mechanism != NULL; i++)
2915  {
2916  if (i > 0)
2917  {
2918  if (!_dbus_string_append (buffer, ", "))
2919  return FALSE;
2920  }
2921  if (!_dbus_string_append (buffer, all_mechanisms[i].mechanism))
2922  return FALSE;
2923  }
2924  return TRUE;
2925 }
2926 
2929 /* tests in dbus-auth-util.c */
_dbus_keyring_get_hex_key
dbus_bool_t _dbus_keyring_get_hex_key(DBusKeyring *keyring, int key_id, DBusString *hex_key)
Gets the hex-encoded secret key for the given ID.
Definition: dbus-keyring.c:1003
_DBUS_N_ELEMENTS
#define _DBUS_N_ELEMENTS(array)
Computes the number of elements in a fixed-size array using sizeof().
Definition: dbus-internals.h:188
DBusAuthStateData::handler
DBusAuthStateFunction handler
State function for this state.
Definition: dbus-auth.c:147
DBusInitialResponseFunction
dbus_bool_t(* DBusInitialResponseFunction)(DBusAuth *auth, DBusString *response)
This function appends an initial client response to the given string.
Definition: dbus-auth.c:70
_dbus_string_hex_decode
dbus_bool_t _dbus_string_hex_decode(const DBusString *source, int start, int *end_return, DBusString *dest, int insert_at)
Decodes a string from hex encoding.
Definition: dbus-string.c:2309
_dbus_auth_encode_data
dbus_bool_t _dbus_auth_encode_data(DBusAuth *auth, const DBusString *plaintext, DBusString *encoded)
Called post-authentication, encodes a block of bytes for sending to the peer.
Definition: dbus-auth.c:2700
DBusAuth::challenge
DBusString challenge
Challenge sent to client.
Definition: dbus-auth.c:179
_dbus_dup_string_array
char ** _dbus_dup_string_array(const char **array)
Duplicates a string array.
Definition: dbus-internals.c:695
DBusAuthMechanismHandler::server_decode_func
DBusAuthDecodeFunction server_decode_func
Function on server side to decode.
Definition: dbus-auth.c:107
_dbus_auth_dump_supported_mechanisms
dbus_bool_t _dbus_auth_dump_supported_mechanisms(DBusString *buffer)
Return a human-readable string containing all supported auth mechanisms.
Definition: dbus-auth.c:2909
DBusAuthClient::base
DBusAuth base
Parent class.
Definition: dbus-auth.c:201
_dbus_string_free
void _dbus_string_free(DBusString *str)
Frees a string created by _dbus_string_init().
Definition: dbus-string.c:259
_dbus_auth_set_context
dbus_bool_t _dbus_auth_set_context(DBusAuth *auth, const DBusString *context)
Sets the "authentication context" which scopes cookies with the DBUS_COOKIE_SHA1 auth mechanism for e...
Definition: dbus-auth.c:2856
DBusAuthMechanismHandler::client_initial_response_func
DBusInitialResponseFunction client_initial_response_func
Function on client side to handle initial response.
Definition: dbus-auth.c:109
DBusAuth::keyring
DBusKeyring * keyring
Keyring for cookie mechanism.
Definition: dbus-auth.c:177
DBusAuthMechanismHandler::mechanism
const char * mechanism
Name of the mechanism.
Definition: dbus-auth.c:104
_dbus_auth_return_buffer
void _dbus_auth_return_buffer(DBusAuth *auth, DBusString *buffer)
Returns a buffer with new data read into it.
Definition: dbus-auth.c:2620
DBusAuth::outgoing
DBusString outgoing
Outgoing data buffer.
Definition: dbus-auth.c:159
DBusAuthStateFunction
dbus_bool_t(* DBusAuthStateFunction)(DBusAuth *auth, DBusAuthCommand command, const DBusString *args)
Auth state function, determines the reaction to incoming events for a particular state.
Definition: dbus-auth.c:137
_dbus_list_clear
void _dbus_list_clear(DBusList **list)
Frees all links in the list and sets the list head to NULL.
Definition: dbus-list.c:542
_dbus_auth_do_work
DBusAuthState _dbus_auth_do_work(DBusAuth *auth)
Analyzes buffered input and moves the auth conversation forward, returning the new state of the auth ...
Definition: dbus-auth.c:2513
_dbus_string_append_int
DBUS_PRIVATE_EXPORT dbus_bool_t _dbus_string_append_int(DBusString *str, long value)
Appends an integer to a DBusString.
Definition: dbus-sysdeps.c:356
_dbus_auth_needs_decoding
dbus_bool_t _dbus_auth_needs_decoding(DBusAuth *auth)
Called post-authentication, indicates whether we need to decode the message stream with _dbus_auth_de...
Definition: dbus-auth.c:2732
_dbus_keyring_is_for_credentials
dbus_bool_t _dbus_keyring_is_for_credentials(DBusKeyring *keyring, DBusCredentials *credentials)
Checks whether the keyring is for the same user as the given credentials.
Definition: dbus-keyring.c:984
DBusAuthServer::failures
int failures
Number of times client has been rejected.
Definition: dbus-auth.c:216
_dbus_credentials_are_empty
dbus_bool_t _dbus_credentials_are_empty(DBusCredentials *credentials)
Checks whether a credentials object contains anything.
Definition: dbus-credentials.c:417
_dbus_auth_is_supported_mechanism
dbus_bool_t _dbus_auth_is_supported_mechanism(DBusString *name)
Queries whether the given auth mechanism is supported.
Definition: dbus-auth.c:2895
_dbus_credentials_same_user
dbus_bool_t _dbus_credentials_same_user(DBusCredentials *credentials, DBusCredentials *other_credentials)
Check whether the user-identifying credentials in two credentials objects are identical.
Definition: dbus-credentials.c:616
DBUS_AUTH_IS_CLIENT
#define DBUS_AUTH_IS_CLIENT(auth)
Definition: dbus-auth.c:321
DBusAuth::context
DBusString context
Cookie scope.
Definition: dbus-auth.c:176
DBusAuthMechanismHandler::client_encode_func
DBusAuthEncodeFunction client_encode_func
Function on client side for encode.
Definition: dbus-auth.c:111
_dbus_string_copy
dbus_bool_t _dbus_string_copy(const DBusString *source, int start, DBusString *dest, int insert_at)
Like _dbus_string_move(), but does not delete the section of the source string that's copied to the d...
Definition: dbus-string.c:1283
DBusAuthServer::max_failures
int max_failures
Number of times we reject before disconnect.
Definition: dbus-auth.c:217
_dbus_string_parse_int
DBUS_PRIVATE_EXPORT dbus_bool_t _dbus_string_parse_int(const DBusString *str, int start, long *value_return, int *end_return)
Parses an integer contained in a DBusString.
Definition: dbus-sysdeps.c:437
_dbus_string_validate_ascii
dbus_bool_t _dbus_string_validate_ascii(const DBusString *str, int start, int len)
Checks that the given range of the string is valid ASCII with no nul bytes.
Definition: dbus-string.c:2450
_dbus_generate_random_bytes
dbus_bool_t _dbus_generate_random_bytes(DBusString *str, int n_bytes, DBusError *error)
Generates the given number of securely random bytes, using the best mechanism we can come up with.
Definition: dbus-sysdeps-unix.c:3362
DBusKeyring
Internals of DBusKeyring.
Definition: dbus-keyring.c:112
_dbus_string_zero
void _dbus_string_zero(DBusString *str)
Clears all allocated bytes in the string to zero.
Definition: dbus-string.c:2685
DBusAuthClient
"Subclass" of DBusAuth for client side
Definition: dbus-auth.c:200
DBusAuthServer::base
DBusAuth base
Parent class.
Definition: dbus-auth.c:214
_dbus_string_init
dbus_bool_t _dbus_string_init(DBusString *str)
Initializes a string.
Definition: dbus-string.c:175
_dbus_auth_set_mechanisms
dbus_bool_t _dbus_auth_set_mechanisms(DBusAuth *auth, const char **mechanisms)
Sets an array of authentication mechanism names that we are willing to use.
Definition: dbus-auth.c:2478
DBusAuth::state
const DBusAuthStateData * state
Current protocol state.
Definition: dbus-auth.c:161
DBusAuth::already_asked_for_initial_response
unsigned int already_asked_for_initial_response
Already sent a blank challenge to get an initial response.
Definition: dbus-auth.c:189
_dbus_auth_get_buffer
void _dbus_auth_get_buffer(DBusAuth *auth, DBusString **buffer)
Get a buffer to be used for reading bytes from the peer we're conversing with.
Definition: dbus-auth.c:2602
_dbus_auth_decode_data
dbus_bool_t _dbus_auth_decode_data(DBusAuth *auth, const DBusString *encoded, DBusString *plaintext)
Called post-authentication, decodes a block of bytes received from the peer.
Definition: dbus-auth.c:2763
DBusAuthCommand
DBusAuthCommand
Enumeration for the known authentication commands.
Definition: dbus-auth.c:119
_dbus_string_array_contains
dbus_bool_t _dbus_string_array_contains(const char **array, const char *str)
Checks whether a string array contains the given string.
Definition: dbus-internals.c:735
DBusAuth::authorized_identity
DBusCredentials * authorized_identity
Credentials that are authorized.
Definition: dbus-auth.c:172
TRUE
#define TRUE
Expands to "1".
_dbus_list_append
dbus_bool_t _dbus_list_append(DBusList **list, void *data)
Appends a value to the list.
Definition: dbus-list.c:270
_dbus_string_find
dbus_bool_t _dbus_string_find(const DBusString *str, int start, const char *substr, int *found)
Finds the given substring in the string, returning TRUE and filling in the byte index where the subst...
Definition: dbus-string.c:1604
_dbus_auth_get_unix_fd_negotiated
dbus_bool_t _dbus_auth_get_unix_fd_negotiated(DBusAuth *auth)
Queries whether unix fd passing was successfully negotiated.
Definition: dbus-auth.c:2883
_dbus_auth_bytes_sent
void _dbus_auth_bytes_sent(DBusAuth *auth, int bytes_sent)
Notifies the auth conversation object that the given number of bytes of the outgoing buffer have been...
Definition: dbus-auth.c:2582
DBusAuthCommandName
Mapping from command name to enum.
Definition: dbus-auth.c:2177
DBusAuthMechanismHandler::server_encode_func
DBusAuthEncodeFunction server_encode_func
Function on server side to encode.
Definition: dbus-auth.c:106
dbus_error_has_name
dbus_bool_t dbus_error_has_name(const DBusError *error, const char *name)
Checks whether the error is set and has the given name.
Definition: dbus-errors.c:302
DBusAuth::unix_fd_negotiated
unsigned int unix_fd_negotiated
Unix fd was successfully negotiated.
Definition: dbus-auth.c:193
dbus_malloc0
void * dbus_malloc0(size_t bytes)
Allocates the given number of bytes, as with standard malloc(), but all bytes are initialized to zero...
Definition: dbus-memory.c:532
DBusAuthEncodeFunction
dbus_bool_t(* DBusAuthEncodeFunction)(DBusAuth *auth, const DBusString *data, DBusString *encoded)
This function encodes a block of data from the peer.
Definition: dbus-auth.c:83
DBusAuth::desired_identity
DBusCredentials * desired_identity
Identity client has requested.
Definition: dbus-auth.c:174
DBUS_AUTH_CLIENT
#define DBUS_AUTH_CLIENT(auth)
Definition: dbus-auth.c:326
dbus_free
void dbus_free(void *memory)
Frees a block of memory previously allocated by dbus_malloc() or dbus_malloc0().
Definition: dbus-memory.c:702
DBusAuth::incoming
DBusString incoming
Incoming data buffer.
Definition: dbus-auth.c:158
_dbus_credentials_add_credential
dbus_bool_t _dbus_credentials_add_credential(DBusCredentials *credentials, DBusCredentialType which, DBusCredentials *other_credentials)
Merge the given credential found in the second object into the first object, overwriting the first ob...
Definition: dbus-credentials.c:495
_dbus_keyring_unref
void _dbus_keyring_unref(DBusKeyring *keyring)
Decrements refcount and finalizes if it reaches zero.
Definition: dbus-keyring.c:677
_dbus_auth_server_new
DBusAuth * _dbus_auth_server_new(const DBusString *guid)
Creates a new auth conversation object for the server side.
Definition: dbus-auth.c:2329
_dbus_auth_get_identity
DBusCredentials * _dbus_auth_get_identity(DBusAuth *auth)
Gets the identity we authorized the client as.
Definition: dbus-auth.c:2813
_dbus_credentials_add_from_user
dbus_bool_t _dbus_credentials_add_from_user(DBusCredentials *credentials, const DBusString *username)
Adds the credentials corresponding to the given username.
Definition: dbus-sysdeps-win.c:2067
DBusAuth::identity
DBusString identity
Current identity we're authorizing as.
Definition: dbus-auth.c:165
DBusAuth::already_got_mechanisms
unsigned int already_got_mechanisms
Client already got mech list.
Definition: dbus-auth.c:188
_dbus_credentials_add_credentials
dbus_bool_t _dbus_credentials_add_credentials(DBusCredentials *credentials, DBusCredentials *other_credentials)
Merge all credentials found in the second object into the first object, overwriting the first object ...
Definition: dbus-credentials.c:453
DBusString
Definition: dbus-string.h:43
_dbus_keyring_validate_context
dbus_bool_t _dbus_keyring_validate_context(const DBusString *context)
Checks whether the context is a valid context.
Definition: dbus-keyring.c:849
DBusAuthMechanismHandler::client_shutdown_func
DBusAuthShutdownFunction client_shutdown_func
Function on client side for shutdown.
Definition: dbus-auth.c:113
_dbus_string_append_printf
dbus_bool_t _dbus_string_append_printf(DBusString *str, const char *format,...)
Appends a printf-style formatted string to the DBusString.
Definition: dbus-string.c:1114
DBusAuthCommandName::command
DBusAuthCommand command
Corresponding enum.
Definition: dbus-auth.c:2179
DBusAuth::buffer_outstanding
unsigned int buffer_outstanding
Buffer is "checked out" for reading data into.
Definition: dbus-auth.c:190
DBusAuthMechanismHandler::client_data_func
DBusAuthDataFunction client_data_func
Function on client side for DATA.
Definition: dbus-auth.c:110
_dbus_list_pop_first
void * _dbus_list_pop_first(DBusList **list)
Removes the first value in the list and returns it.
Definition: dbus-list.c:649
_dbus_keyring_get_best_key
int _dbus_keyring_get_best_key(DBusKeyring *keyring, DBusError *error)
Gets a recent key to use for authentication.
Definition: dbus-keyring.c:945
_dbus_credentials_clear
void _dbus_credentials_clear(DBusCredentials *credentials)
Clear all credentials in the object.
Definition: dbus-credentials.c:563
_dbus_credentials_new_from_current_process
DBusCredentials * _dbus_credentials_new_from_current_process(void)
Creates a new object with credentials (user ID and process ID) from the current process.
Definition: dbus-credentials.c:102
_dbus_auth_ref
DBusAuth * _dbus_auth_ref(DBusAuth *auth)
Increments the refcount of an auth object.
Definition: dbus-auth.c:2413
DBusCredentials
Definition: dbus-credentials.c:48
_dbus_auth_get_guid_from_server
const char * _dbus_auth_get_guid_from_server(DBusAuth *auth)
Gets the GUID from the server if we've authenticated; gets NULL otherwise.
Definition: dbus-auth.c:2837
DBUS_AUTH_SERVER
#define DBUS_AUTH_SERVER(auth)
Definition: dbus-auth.c:331
DBusAuth::credentials
DBusCredentials * credentials
Credentials read from socket.
Definition: dbus-auth.c:169
_dbus_string_find_blank
dbus_bool_t _dbus_string_find_blank(const DBusString *str, int start, int *found)
Finds a blank (space or tab) in the string.
Definition: dbus-string.c:1765
FALSE
#define FALSE
Expands to "0".
DBUS_ERROR_NO_MEMORY
#define DBUS_ERROR_NO_MEMORY
There was not enough memory to complete an operation.
Definition: dbus-protocol.h:370
DBusAuthServer
"Subclass" of DBusAuth for server side.
Definition: dbus-auth.c:213
DBUS_ERROR_INIT
#define DBUS_ERROR_INIT
Expands to a suitable initializer for a DBusError on the stack.
Definition: dbus-errors.h:62
_dbus_string_replace_len
dbus_bool_t _dbus_string_replace_len(const DBusString *source, int start, int len, DBusString *dest, int replace_at, int replace_len)
Replaces a segment of dest string with a segment of source string.
Definition: dbus-string.c:1404
N_CHALLENGE_BYTES
#define N_CHALLENGE_BYTES
http://www.ietf.org/rfc/rfc2831.txt suggests at least 64 bits of entropy, we use 128.
Definition: dbus-auth.c:519
DBusList::data
void * data
Data stored at this element.
Definition: dbus-list.h:38
DBusAuth
Internal members of DBusAuth.
Definition: dbus-auth.c:154
DBusAuthMechanismHandler::client_decode_func
DBusAuthDecodeFunction client_decode_func
Function on client side for decode.
Definition: dbus-auth.c:112
_dbus_string_delete
void _dbus_string_delete(DBusString *str, int start, int len)
Deletes a segment of a DBusString with length len starting at start.
Definition: dbus-string.c:1193
DBusAuth::side
const char * side
Client or server.
Definition: dbus-auth.c:156
DBusAuthMechanismHandler::server_data_func
DBusAuthDataFunction server_data_func
Function on server side for DATA.
Definition: dbus-auth.c:105
dbus_error_is_set
dbus_bool_t dbus_error_is_set(const DBusError *error)
Checks whether an error occurred (the error is set).
Definition: dbus-errors.c:329
DBusAuth::refcount
int refcount
reference count
Definition: dbus-auth.c:155
_dbus_string_set_length
dbus_bool_t _dbus_string_set_length(DBusString *str, int length)
Sets the length of a string.
Definition: dbus-string.c:802
_dbus_auth_set_unix_fd_possible
void _dbus_auth_set_unix_fd_possible(DBusAuth *auth, dbus_bool_t b)
Sets whether unix fd passing is potentially on the transport and hence shall be negotiated.
Definition: dbus-auth.c:2871
DBusAuthClient::mechs_to_try
DBusList * mechs_to_try
Mechanisms we got from the server that we're going to try using.
Definition: dbus-auth.c:203
DBusAuth::unix_fd_possible
unsigned int unix_fd_possible
This side could do unix fd passing.
Definition: dbus-auth.c:192
_dbus_assert
#define _dbus_assert(condition)
Aborts with an error message if the condition is false.
Definition: dbus-internals.h:152
dbus_error_free
void dbus_error_free(DBusError *error)
Frees an error that's been set (or just initialized), then reinitializes the error as in dbus_error_i...
Definition: dbus-errors.c:211
_dbus_auth_set_credentials
dbus_bool_t _dbus_auth_set_credentials(DBusAuth *auth, DBusCredentials *credentials)
Sets credentials received via reliable means from the operating system.
Definition: dbus-auth.c:2795
_dbus_auth_get_bytes_to_send
dbus_bool_t _dbus_auth_get_bytes_to_send(DBusAuth *auth, const DBusString **str)
Gets bytes that need to be sent to the peer we're conversing with.
Definition: dbus-auth.c:2557
DBusAuth::allowed_mechs
char ** allowed_mechs
Mechanisms we're allowed to use, or NULL if we can use any.
Definition: dbus-auth.c:181
DBusAuth::needed_memory
unsigned int needed_memory
We needed memory to continue since last successful getting something done.
Definition: dbus-auth.c:185
_dbus_credentials_are_anonymous
dbus_bool_t _dbus_credentials_are_anonymous(DBusCredentials *credentials)
Checks whether a credentials object contains a user identity.
Definition: dbus-credentials.c:437
DBusError
Object representing an exception.
Definition: dbus-errors.h:49
DBusAuthServer::guid
DBusString guid
Our globally unique ID in hex encoding.
Definition: dbus-auth.c:219
_dbus_string_skip_blank
void _dbus_string_skip_blank(const DBusString *str, int start, int *end)
Skips blanks from start, storing the first non-blank in *end (blank is space or tab).
Definition: dbus-string.c:1803
DBusAuth::mech
const DBusAuthMechanismHandler * mech
Current auth mechanism.
Definition: dbus-auth.c:163
DBUS_AUTH_NAME
#define DBUS_AUTH_NAME(auth)
The name of the auth ("client" or "server")
Definition: dbus-auth.c:338
_dbus_string_validate_utf8
dbus_bool_t _dbus_string_validate_utf8(const DBusString *str, int start, int len)
Checks that the given range of the string is valid UTF-8.
Definition: dbus-string.c:2555
_dbus_sha_compute
dbus_bool_t _dbus_sha_compute(const DBusString *data, DBusString *ascii_output)
Computes the ASCII hex-encoded shasum of the given data and appends it to the output string.
Definition: dbus-sha.c:483
_dbus_string_hex_encode
dbus_bool_t _dbus_string_hex_encode(const DBusString *source, int start, DBusString *dest, int insert_at)
Encodes a string in hex, the way MD5 and SHA-1 are usually encoded.
Definition: dbus-string.c:2259
DBusList
A node in a linked list.
Definition: dbus-list.h:35
_dbus_append_user_from_current_process
dbus_bool_t _dbus_append_user_from_current_process(DBusString *str)
Append to the string the identity we would like to have when we authenticate, on UNIX this is the cur...
Definition: dbus-sysdeps-unix.c:2919
DBusAuthDataFunction
dbus_bool_t(* DBusAuthDataFunction)(DBusAuth *auth, const DBusString *data)
This function processes a block of data received from the peer.
Definition: dbus-auth.c:77
DBusAuth::cookie_id
int cookie_id
ID of cookie to use.
Definition: dbus-auth.c:178
_dbus_keyring_new_for_credentials
DBusKeyring * _dbus_keyring_new_for_credentials(DBusCredentials *credentials, const DBusString *context, DBusError *error)
Creates a new keyring that lives in the ~/.dbus-keyrings directory of the user represented by credent...
Definition: dbus-keyring.c:705
_dbus_credentials_unref
void _dbus_credentials_unref(DBusCredentials *credentials)
Decrement refcount on credentials.
Definition: dbus-credentials.c:137
DBUS_AUTH_IS_SERVER
#define DBUS_AUTH_IS_SERVER(auth)
Definition: dbus-auth.c:316
_dbus_auth_needs_encoding
dbus_bool_t _dbus_auth_needs_encoding(DBusAuth *auth)
Called post-authentication, indicates whether we need to encode the message stream with _dbus_auth_en...
Definition: dbus-auth.c:2673
dbus_free_string_array
void dbus_free_string_array(char **str_array)
Frees a NULL-terminated array of strings.
Definition: dbus-memory.c:750
DBusAuthDecodeFunction
dbus_bool_t(* DBusAuthDecodeFunction)(DBusAuth *auth, const DBusString *data, DBusString *decoded)
This function decodes a block of data from the peer.
Definition: dbus-auth.c:90
_dbus_auth_unref
void _dbus_auth_unref(DBusAuth *auth)
Decrements the refcount of an auth object.
Definition: dbus-auth.c:2428
DBusAuthClient::guid_from_server
DBusString guid_from_server
GUID received from server.
Definition: dbus-auth.c:205
DBusAuthStateData::name
const char * name
Name of the state.
Definition: dbus-auth.c:146
DBusAuthMechanismHandler
Virtual table representing a particular auth mechanism.
Definition: dbus-auth.c:103
_dbus_string_move
dbus_bool_t _dbus_string_move(DBusString *source, int start, DBusString *dest, int insert_at)
Moves the end of one string into another string.
Definition: dbus-string.c:1259
_dbus_string_equal_c_str
dbus_bool_t _dbus_string_equal_c_str(const DBusString *a, const char *c_str)
Checks whether a string is equal to a C string.
Definition: dbus-string.c:2152
DBusError::message
const char * message
public error message field
Definition: dbus-errors.h:51
DBusAuthCommandName::name
const char * name
Name of the command.
Definition: dbus-auth.c:2178
DBusAuthShutdownFunction
void(* DBusAuthShutdownFunction)(DBusAuth *auth)
This function is called when the mechanism is abandoned.
Definition: dbus-auth.c:97
_dbus_string_copy_len
dbus_bool_t _dbus_string_copy_len(const DBusString *source, int start, int len, DBusString *dest, int insert_at)
Like _dbus_string_copy(), but can copy a segment from the middle of the source string.
Definition: dbus-string.c:1375
_dbus_string_append
dbus_bool_t _dbus_string_append(DBusString *str, const char *buffer)
Appends a nul-terminated C-style string to a DBusString.
Definition: dbus-string.c:935
DBusAuthMechanismHandler::server_shutdown_func
DBusAuthShutdownFunction server_shutdown_func
Function on server side to shut down.
Definition: dbus-auth.c:108
_dbus_auth_delete_unused_bytes
void _dbus_auth_delete_unused_bytes(DBusAuth *auth)
Gets rid of unused bytes returned by _dbus_auth_get_unused_bytes() after we've gotten them and succes...
Definition: dbus-auth.c:2656
_dbus_auth_client_new
DBusAuth * _dbus_auth_client_new(void)
Creates a new auth conversation object for the client side.
Definition: dbus-auth.c:2375
DBUS_AUTH_IN_END_STATE
#define DBUS_AUTH_IN_END_STATE(auth)
Definition: dbus-auth.c:2503
dbus_bool_t
dbus_uint32_t dbus_bool_t
A boolean, valid values are TRUE and FALSE.
Definition: dbus-types.h:35
_dbus_auth_get_unused_bytes
void _dbus_auth_get_unused_bytes(DBusAuth *auth, const DBusString **str)
Returns leftover bytes that were not used as part of the auth conversation.
Definition: dbus-auth.c:2639
_dbus_credentials_new
DBusCredentials * _dbus_credentials_new(void)
Creates a new credentials object.
Definition: dbus-credentials.c:75
NULL
#define NULL
A null pointer, defined appropriately for C or C++.
DBusAuthStateData
Information about a auth state.
Definition: dbus-auth.c:145
_dbus_credentials_are_superset
dbus_bool_t _dbus_credentials_are_superset(DBusCredentials *credentials, DBusCredentials *possible_subset)
Checks whether the first credentials object contains all the credentials found in the second credenti...
Definition: dbus-credentials.c:382
_dbus_string_equal
dbus_bool_t _dbus_string_equal(const DBusString *a, const DBusString *b)
Tests two DBusString for equality.
Definition: dbus-string.c:2013