gio/gdbusauthobserver.c

   1 /* GDBus - GLib D-Bus Library
   2  *
   3  * Copyright (C) 2008-2010 Red Hat, Inc.
   4  *
   5  * This library is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU Lesser General Public
   7  * License as published by the Free Software Foundation; either
   8  * version 2 of the License, or (at your option) any later version.
   9  *
  10  * This library is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13  * Lesser General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU Lesser General
  16  * Public License along with this library; if not, write to the
  17  * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
  18  * Boston, MA 02111-1307, USA.
  19  *
  20  * Author: David Zeuthen <davidz@redhat.com>
  21  */
  22
  23 #include "config.h"
  24
  25 #include "gdbusauthobserver.h"
  26 #include "gcredentials.h"
  27 #include "gioenumtypes.h"
  28 #include "giostream.h"
  29 #include "gdbusprivate.h"
  30
  31 #include "glibintl.h"
  32
  33 /**
  34  * SECTION:gdbusauthobserver
  35  * @short_description: Object used for authenticating connections
  36  * @include: gio/gio.h
  37  *
  38  * The #GDBusAuthObserver type provides a mechanism for participating
  39  * in how a #GDBusServer (or a #GDBusConnection) authenticates remote
  40  * peers. Simply instantiate a #GDBusAuthObserver and connect to the
  41  * signals you are interested in. Note that new signals may be added
  42  * in the future
  43  *
  44  * For example, if you only want to allow D-Bus connections from
  45  * processes owned by the same uid as the server, you would use a
  46  * signal handler like the following:
  47  * <example id="auth-observer"><title>Controlling Authentication</title><programlisting>
  48  * static gboolean
  49  * on_authorize_authenticated_peer (GDBusAuthObserver *observer,
  50  *                                  GIOStream         *stream,
  51  *                                  GCredentials      *credentials,
  52  *                                  gpointer           user_data)
  53  * {
  54  *   gboolean authorized;
  55  *
  56  *   authorized = FALSE;
  57  *   if (credentials != NULL)
  58  *     {
  59  *       GCredentials *own_credentials;
  60  *       own_credentials = g_credentials_new ();
  61  *       if (g_credentials_is_same_user (credentials, own_credentials, NULL))
  62  *         authorized = TRUE;
  63  *       g_object_unref (own_credentials);
  64  *     }
  65  *
  66  *   return authorized;
  67  * }
  68  * </programlisting></example>
  69  */
  70
  71 typedef struct _GDBusAuthObserverClass GDBusAuthObserverClass;
  72
  73 /**
  74  * GDBusAuthObserverClass:
  75  * @authorize_authenticated_peer: Signal class handler for the #GDBusAuthObserver::authorize-authenticated-peer signal.
  76  *
  77  * Class structure for #GDBusAuthObserverClass.
  78  *
  79  * Since: 2.26
  80  */
  81 struct _GDBusAuthObserverClass
  82 {
  83   /*< private >*/
  84   GObjectClass parent_class;
  85
  86   /*< public >*/
  87
  88   /* Signals */
  89   gboolean (*authorize_authenticated_peer) (GDBusAuthObserver  *observer,
  90                                             GIOStream          *stream,
  91                                             GCredentials       *credentials);
  92
  93   gboolean (*allow_mechanism) (GDBusAuthObserver  *observer,
  94                                const gchar        *mechanism);
  95 };
  96
  97 /**
  98  * GDBusAuthObserver:
  99  *
 100  * The #GDBusAuthObserver structure contains only private data and
 101  * should only be accessed using the provided API.
 102  *
 103  * Since: 2.26
 104  */
 105 struct _GDBusAuthObserver
 106 {
 107   GObject parent_instance;
 108 };
 109
 110 enum
 111 {
 112   AUTHORIZE_AUTHENTICATED_PEER_SIGNAL,
 113   ALLOW_MECHANISM_SIGNAL,
 114   LAST_SIGNAL,
 115 };
 116
 117 static guint signals[LAST_SIGNAL] = { 0 };
 118
 119 G_DEFINE_TYPE (GDBusAuthObserver, g_dbus_auth_observer, G_TYPE_OBJECT);
 120
 121 /* ---------------------------------------------------------------------------------------------------- */
 122
 123 static void
 124 g_dbus_auth_observer_finalize (GObject *object)
 125 {
 126   G_OBJECT_CLASS (g_dbus_auth_observer_parent_class)->finalize (object);
 127 }
 128
 129 static gboolean
 130 g_dbus_auth_observer_authorize_authenticated_peer_real (GDBusAuthObserver  *observer,
 131                                                         GIOStream          *stream,
 132                                                         GCredentials       *credentials)
 133 {
 134   return TRUE;
 135 }
 136
 137 static gboolean
 138 g_dbus_auth_observer_allow_mechanism_real (GDBusAuthObserver  *observer,
 139                                            const gchar        *mechanism)
 140 {
 141   return TRUE;
 142 }
 143
 144 static void
 145 g_dbus_auth_observer_class_init (GDBusAuthObserverClass *klass)
 146 {
 147   GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
 148
 149   gobject_class->finalize = g_dbus_auth_observer_finalize;
 150
 151   klass->authorize_authenticated_peer = g_dbus_auth_observer_authorize_authenticated_peer_real;
 152   klass->allow_mechanism = g_dbus_auth_observer_allow_mechanism_real;
 153
 154   /**
 155    * GDBusAuthObserver::authorize-authenticated-peer:
 156    * @observer: The #GDBusAuthObserver emitting the signal.
 157    * @stream: A #GIOStream for the #GDBusConnection.
 158    * @credentials: (allow-none): Credentials received from the peer or %NULL.
 159    *
 160    * Emitted to check if a peer that is successfully authenticated
 161    * is authorized.
 162    *
 163    * Returns: %TRUE if the peer is authorized, %FALSE if not.
 164    *
 165    * Since: 2.26
 166    */
 167   signals[AUTHORIZE_AUTHENTICATED_PEER_SIGNAL] =
 168     g_signal_new ("authorize-authenticated-peer",
 169                   G_TYPE_DBUS_AUTH_OBSERVER,
 170                   G_SIGNAL_RUN_LAST,
 171                   G_STRUCT_OFFSET (GDBusAuthObserverClass, authorize_authenticated_peer),
 172                   _g_signal_accumulator_false_handled,
 173                   NULL, /* accu_data */
 174                   NULL,
 175                   G_TYPE_BOOLEAN,
 176                   2,
 177                   G_TYPE_IO_STREAM,
 178                   G_TYPE_CREDENTIALS);
 179
 180   /**
 181    * GDBusAuthObserver::allow-mechanism:
 182    * @observer: The #GDBusAuthObserver emitting the signal.
 183    * @mechanism: The name of the mechanism, e.g. <literal>DBUS_COOKIE_SHA1</literal>.
 184    *
 185    * Emitted to check if @mechanism is allowed to be used.
 186    *
 187    * Returns: %TRUE if @mechanism can be used to authenticate the other peer, %FALSE if not.
 188    *
 189    * Since: 2.34
 190    */
 191   signals[ALLOW_MECHANISM_SIGNAL] =
 192     g_signal_new ("allow-mechanism",
 193                   G_TYPE_DBUS_AUTH_OBSERVER,
 194                   G_SIGNAL_RUN_LAST,
 195                   G_STRUCT_OFFSET (GDBusAuthObserverClass, allow_mechanism),
 196                   _g_signal_accumulator_false_handled,
 197                   NULL, /* accu_data */
 198                   NULL,
 199                   G_TYPE_BOOLEAN,
 200                   1,
 201                   G_TYPE_STRING);
 202 }
 203
 204 static void
 205 g_dbus_auth_observer_init (GDBusAuthObserver *observer)
 206 {
 207 }
 208
 209 /**
 210  * g_dbus_auth_observer_new:
 211  *
 212  * Creates a new #GDBusAuthObserver object.
 213  *
 214  * Returns: A #GDBusAuthObserver. Free with g_object_unref().
 215  *
 216  * Since: 2.26
 217  */
 218 GDBusAuthObserver *
 219 g_dbus_auth_observer_new (void)
 220 {
 221   return g_object_new (G_TYPE_DBUS_AUTH_OBSERVER, NULL);
 222 }
 223
 224 /* ---------------------------------------------------------------------------------------------------- */
 225
 226 /**
 227  * g_dbus_auth_observer_authorize_authenticated_peer:
 228  * @observer: A #GDBusAuthObserver.
 229  * @stream: A #GIOStream for the #GDBusConnection.
 230  * @credentials: (allow-none): Credentials received from the peer or %NULL.
 231  *
 232  * Emits the #GDBusAuthObserver::authorize-authenticated-peer signal on @observer.
 233  *
 234  * Returns: %TRUE if the peer is authorized, %FALSE if not.
 235  *
 236  * Since: 2.26
 237  */
 238 gboolean
 239 g_dbus_auth_observer_authorize_authenticated_peer (GDBusAuthObserver  *observer,
 240                                                    GIOStream          *stream,
 241                                                    GCredentials       *credentials)
 242 {
 243   gboolean denied;
 244
 245   denied = FALSE;
 246   g_signal_emit (observer,
 247                  signals[AUTHORIZE_AUTHENTICATED_PEER_SIGNAL],
 248                  0,
 249                  stream,
 250                  credentials,
 251                  &denied);
 252   return denied;
 253 }
 254
 255 /**
 256  * g_dbus_auth_observer_allow_mechanism:
 257  * @observer: A #GDBusAuthObserver.
 258  * @mechanism: The name of the mechanism, e.g. <literal>DBUS_COOKIE_SHA1</literal>.
 259  *
 260  * Emits the #GDBusAuthObserver::allow-mechanism signal on @observer.
 261  *
 262  * Returns: %TRUE if @mechanism can be used to authenticate the other peer, %FALSE if not.
 263  *
 264  * Since: 2.34
 265  */
 266 gboolean
 267 g_dbus_auth_observer_allow_mechanism (GDBusAuthObserver  *observer,
 268                                       const gchar        *mechanism)
 269 {
 270   gboolean ret;
 271
 272   ret = FALSE;
 273   g_signal_emit (observer,
 274                  signals[ALLOW_MECHANISM_SIGNAL],
 275                  0,
 276                  mechanism,
 277                  &ret);
 278   return ret;
 279 }
 280