2003-04-27 Havoc Pennington <hp@pobox.com>
[platform/upstream/dbus.git] / bus / connection.c
index aa8d65c..6bb5314 100644 (file)
  */
 #include "connection.h"
 #include "dispatch.h"
-#include "loop.h"
 #include "policy.h"
 #include "services.h"
 #include "utils.h"
 #include <dbus/dbus-list.h>
+#include <dbus/dbus-hash.h>
+#include <dbus/dbus-timeout.h>
 
 static void bus_connection_remove_transactions (DBusConnection *connection);
 
 struct BusConnections
 {
   int refcount;
-  DBusList *list; /**< List of all the connections */
+  DBusList *completed;  /**< List of all completed connections */
+  int n_completed;      /**< Length of completed list */
+  DBusList *incomplete; /**< List of all not-yet-active connections */
+  int n_incomplete;     /**< Length of incomplete list */
   BusContext *context;
+  DBusHashTable *completed_by_user; /**< Number of completed connections for each UID */
+  DBusTimeout *expire_timeout; /**< Timeout for expiring incomplete connections. */
 };
 
 static int connection_data_slot = -1;
@@ -43,17 +49,22 @@ static int connection_data_slot_refcount = 0;
 typedef struct
 {
   BusConnections *connections;
+  DBusList *link_in_connection_list;
   DBusConnection *connection;
   DBusList *services_owned;
+  int n_services_owned;
   char *name;
   DBusList *transaction_messages; /**< Stuff we need to send as part of a transaction */
   DBusMessage *oom_message;
   DBusPreallocatedSend *oom_preallocated;
-  unsigned long *group_ids;
-  int n_group_ids;
-  BusPolicy *policy;
+  BusClientPolicy *policy;
+
+  long connection_tv_sec;  /**< Time when we connected (seconds component) */
+  long connection_tv_usec; /**< Time when we connected (microsec component) */
 } BusConnectionData;
 
+static dbus_bool_t expire_incomplete_timeout (void *data);
+
 #define BUS_CONNECTION_DATA(connection) (dbus_connection_get_data ((connection), connection_data_slot))
 
 static dbus_bool_t
@@ -89,7 +100,7 @@ connection_data_slot_unref (void)
     }
 }
 
-static BusLoop*
+static DBusLoop*
 connection_get_loop (DBusConnection *connection)
 {
   BusConnectionData *d;
@@ -99,6 +110,65 @@ connection_get_loop (DBusConnection *connection)
   return bus_context_get_loop (d->connections->context);
 }
 
+
+static int
+get_connections_for_uid (BusConnections *connections,
+                         dbus_uid_t      uid)
+{
+  void *val;
+  int current_count;
+
+  /* val is NULL is 0 when it isn't in the hash yet */
+  
+  val = _dbus_hash_table_lookup_ulong (connections->completed_by_user,
+                                       uid);
+
+  current_count = _DBUS_POINTER_TO_INT (val);
+
+  return current_count;
+}
+
+static dbus_bool_t
+adjust_connections_for_uid (BusConnections *connections,
+                            dbus_uid_t      uid,
+                            int             adjustment)
+{
+  int current_count;
+
+  current_count = get_connections_for_uid (connections, uid);
+
+  _dbus_verbose ("Adjusting connection count for UID " DBUS_UID_FORMAT
+                 ": was %d adjustment %d making %d\n",
+                 uid, current_count, adjustment, current_count + adjustment);
+  
+  _dbus_assert (current_count >= 0);
+  
+  current_count += adjustment;
+
+  _dbus_assert (current_count >= 0);
+
+  if (current_count == 0)
+    {
+      _dbus_hash_table_remove_ulong (connections->completed_by_user, uid);
+      return TRUE;
+    }
+  else
+    {
+      dbus_bool_t retval;
+      
+      retval = _dbus_hash_table_insert_ulong (connections->completed_by_user,
+                                              uid, _DBUS_INT_TO_POINTER (current_count));
+
+      /* only positive adjustment can fail as otherwise
+       * a hash entry should already exist
+       */
+      _dbus_assert (adjustment > 0 ||
+                    (adjustment <= 0 && retval));
+
+      return retval;
+    }
+}
+
 void
 bus_connection_disconnected (DBusConnection *connection)
 {
@@ -116,10 +186,7 @@ bus_connection_disconnected (DBusConnection *connection)
    * handle it other than sleeping; we can't "fail" the operation of
    * disconnecting a client, and preallocating a broadcast "service is
    * now gone" message for every client-service pair seems kind of
-   * involved. Probably we need to do that though, and also
-   * extend BusTransaction to be able to revert generic
-   * stuff, not just sending a message (so we can e.g. revert
-   * removal of service owners).
+   * involved. Probably we need to do that though.
    */
   while ((service = _dbus_list_get_last (&d->services_owned)))
     {
@@ -134,21 +201,27 @@ bus_connection_disconnected (DBusConnection *connection)
       while (transaction == NULL)
         {
           transaction = bus_transaction_new (d->connections->context);
-          bus_wait_for_memory ();
+          _dbus_wait_for_memory ();
         }
         
       if (!bus_service_remove_owner (service, connection,
                                      transaction, &error))
         {
+          _DBUS_ASSERT_ERROR_IS_SET (&error);
+          
           if (dbus_error_has_name (&error, DBUS_ERROR_NO_MEMORY))
             {
               dbus_error_free (&error);
               bus_transaction_cancel_and_free (transaction);
-              bus_wait_for_memory ();
+              _dbus_wait_for_memory ();
               goto retry;
             }
           else
-            _dbus_assert_not_reached ("Removing service owner failed for non-memory-related reason");
+            {
+              _dbus_verbose ("Failed to remove service owner: %s %s\n",
+                             error.name, error.message);
+              _dbus_assert_not_reached ("Removing service owner failed for non-memory-related reason");
+            }
         }
         
       bus_transaction_execute_and_free (transaction);
@@ -171,11 +244,40 @@ bus_connection_disconnected (DBusConnection *connection)
   
   dbus_connection_set_unix_user_function (connection,
                                           NULL, NULL, NULL);
+
+  dbus_connection_set_dispatch_status_function (connection,
+                                                NULL, NULL, NULL);
   
   bus_connection_remove_transactions (connection);
 
-  _dbus_list_remove (&d->connections->list, connection);
+  if (d->link_in_connection_list != NULL)
+    {
+      if (d->name != NULL)
+        {
+          unsigned long uid;
+          
+          _dbus_list_remove_link (&d->connections->completed, d->link_in_connection_list);
+          d->link_in_connection_list = NULL;
+          d->connections->n_completed -= 1;
 
+          if (dbus_connection_get_unix_user (connection, &uid))
+            {
+              if (!adjust_connections_for_uid (d->connections,
+                                               uid, -1))
+                _dbus_assert_not_reached ("adjusting downward should never fail");
+            }
+        }
+      else
+        {
+          _dbus_list_remove_link (&d->connections->incomplete, d->link_in_connection_list);
+          d->link_in_connection_list = NULL;
+          d->connections->n_incomplete -= 1;
+        }
+      
+      _dbus_assert (d->connections->n_incomplete >= 0);
+      _dbus_assert (d->connections->n_completed >= 0);
+    }
+  
   /* frees "d" as side effect */
   dbus_connection_set_data (connection,
                             connection_data_slot,
@@ -189,18 +291,15 @@ connection_watch_callback (DBusWatch     *watch,
                            unsigned int   condition,
                            void          *data)
 {
-  DBusConnection *connection = data;
-  dbus_bool_t retval;
-
-  dbus_connection_ref (connection);
-  
-  retval = dbus_connection_handle_watch (connection, watch, condition);
-
-  bus_connection_dispatch_all_messages (connection);
+ /* FIXME this can be done in dbus-mainloop.c
+   * if the code in activation.c for the babysitter
+   * watch handler is fixed.
+   */
   
-  dbus_connection_unref (connection);
-
-  return retval;
+#if 0
+  _dbus_verbose ("Calling handle_watch\n");
+#endif
+  return dbus_watch_handle (watch, condition);
 }
 
 static dbus_bool_t
@@ -209,9 +308,9 @@ add_connection_watch (DBusWatch      *watch,
 {
   DBusConnection *connection = data;
 
-  return bus_loop_add_watch (connection_get_loop (connection),
-                             watch, connection_watch_callback, connection,
-                             NULL);
+  return _dbus_loop_add_watch (connection_get_loop (connection),
+                               watch, connection_watch_callback, connection,
+                               NULL);
 }
 
 static void
@@ -220,24 +319,18 @@ remove_connection_watch (DBusWatch      *watch,
 {
   DBusConnection *connection = data;
   
-  bus_loop_remove_watch (connection_get_loop (connection),
-                         watch, connection_watch_callback, connection);
+  _dbus_loop_remove_watch (connection_get_loop (connection),
+                           watch, connection_watch_callback, connection);
 }
 
 static void
 connection_timeout_callback (DBusTimeout   *timeout,
                              void          *data)
 {
-  DBusConnection *connection = data;
-
-  dbus_connection_ref (connection);
+  /* DBusConnection *connection = data; */
 
   /* can return FALSE on OOM but we just let it fire again later */
   dbus_timeout_handle (timeout);
-
-  bus_connection_dispatch_all_messages (connection);
-  
-  dbus_connection_unref (connection);
 }
 
 static dbus_bool_t
@@ -246,8 +339,8 @@ add_connection_timeout (DBusTimeout    *timeout,
 {
   DBusConnection *connection = data;
   
-  return bus_loop_add_timeout (connection_get_loop (connection),
-                               timeout, connection_timeout_callback, connection, NULL);
+  return _dbus_loop_add_timeout (connection_get_loop (connection),
+                                 timeout, connection_timeout_callback, connection, NULL);
 }
 
 static void
@@ -256,8 +349,22 @@ remove_connection_timeout (DBusTimeout    *timeout,
 {
   DBusConnection *connection = data;
   
-  bus_loop_remove_timeout (connection_get_loop (connection),
-                           timeout, connection_timeout_callback, connection);
+  _dbus_loop_remove_timeout (connection_get_loop (connection),
+                             timeout, connection_timeout_callback, connection);
+}
+
+static void
+dispatch_status_function (DBusConnection    *connection,
+                          DBusDispatchStatus new_status,
+                          void              *data)
+{
+  DBusLoop *loop = data;
+  
+  if (new_status != DBUS_DISPATCH_COMPLETE)
+    {
+      while (!_dbus_loop_queue_dispatch (loop, connection))
+        _dbus_wait_for_memory ();
+    }
 }
 
 static dbus_bool_t
@@ -270,8 +377,6 @@ allow_user_function (DBusConnection *connection,
   d = BUS_CONNECTION_DATA (connection);
 
   _dbus_assert (d != NULL);
-
-  return TRUE; /* FIXME - this is just until we can parse a config file */
   
   return bus_context_allow_user (d->connections->context, uid);
 }
@@ -283,6 +388,7 @@ free_connection_data (void *data)
 
   /* services_owned should be NULL since we should be disconnected */
   _dbus_assert (d->services_owned == NULL);
+  _dbus_assert (d->n_services_owned == 0);
   /* similarly */
   _dbus_assert (d->transaction_messages == NULL);
 
@@ -293,34 +399,66 @@ free_connection_data (void *data)
     dbus_message_unref (d->oom_message);
 
   if (d->policy)
-    bus_policy_unref (d->policy);
-  
-  dbus_free (d->group_ids);
+    bus_client_policy_unref (d->policy);
   
   dbus_free (d->name);
   
   dbus_free (d);
 }
 
+static void
+call_timeout_callback (DBusTimeout   *timeout,
+                       void          *data)
+{
+  /* can return FALSE on OOM but we just let it fire again later */
+  dbus_timeout_handle (timeout);
+}
+
 BusConnections*
 bus_connections_new (BusContext *context)
 {
   BusConnections *connections;
 
   if (!connection_data_slot_ref ())
-    return NULL;
+    goto failed_0;
 
   connections = dbus_new0 (BusConnections, 1);
   if (connections == NULL)
-    {
-      connection_data_slot_unref ();
-      return NULL;
-    }
+    goto failed_1;
+
+  connections->completed_by_user = _dbus_hash_table_new (DBUS_HASH_ULONG,
+                                                         NULL, NULL);
+  if (connections->completed_by_user == NULL)
+    goto failed_2;
+
+  connections->expire_timeout = _dbus_timeout_new (100, /* irrelevant */
+                                                   expire_incomplete_timeout,
+                                                   connections, NULL);
+  if (connections->expire_timeout == NULL)
+    goto failed_3;
+
+  _dbus_timeout_set_enabled (connections->expire_timeout, FALSE);
+
+  if (!_dbus_loop_add_timeout (bus_context_get_loop (context),
+                               connections->expire_timeout,
+                               call_timeout_callback, NULL, NULL))
+    goto failed_4;
   
   connections->refcount = 1;
   connections->context = context;
   
   return connections;
+
+ failed_4:
+  _dbus_timeout_unref (connections->expire_timeout);
+ failed_3:
+  _dbus_hash_table_unref (connections->completed_by_user);
+ failed_2:
+  dbus_free (connections);
+ failed_1:
+  connection_data_slot_unref ();
+ failed_0:
+  return NULL;
 }
 
 void
@@ -337,19 +475,43 @@ bus_connections_unref (BusConnections *connections)
   connections->refcount -= 1;
   if (connections->refcount == 0)
     {
-      while (connections->list != NULL)
+      /* drop all incomplete */
+      while (connections->incomplete != NULL)
         {
           DBusConnection *connection;
 
-          connection = connections->list->data;
+          connection = connections->incomplete->data;
 
           dbus_connection_ref (connection);
           dbus_connection_disconnect (connection);
           bus_connection_disconnected (connection);
           dbus_connection_unref (connection);
         }
+
+      _dbus_assert (connections->n_incomplete == 0);
       
-      _dbus_list_clear (&connections->list);
+      /* drop all real connections */
+      while (connections->completed != NULL)
+        {
+          DBusConnection *connection;
+
+          connection = connections->completed->data;
+
+          dbus_connection_ref (connection);
+          dbus_connection_disconnect (connection);
+          bus_connection_disconnected (connection);
+          dbus_connection_unref (connection);          
+        }
+
+      _dbus_assert (connections->n_completed == 0);
+
+      _dbus_loop_remove_timeout (bus_context_get_loop (connections->context),
+                                 connections->expire_timeout,
+                                 call_timeout_callback, NULL);
+      
+      _dbus_timeout_unref (connections->expire_timeout);
+      
+      _dbus_hash_table_unref (connections->completed_by_user);
       
       dbus_free (connections);
 
@@ -372,6 +534,9 @@ bus_connections_setup_connection (BusConnections *connections,
   d->connections = connections;
   d->connection = connection;
 
+  _dbus_get_current_time (&d->connection_tv_sec,
+                          &d->connection_tv_usec);
+  
   _dbus_assert (connection_data_slot >= 0);
   
   if (!dbus_connection_set_data (connection,
@@ -383,9 +548,6 @@ bus_connections_setup_connection (BusConnections *connections,
     }
 
   retval = FALSE;
-
-  d->n_group_ids = 0;
-  d->group_ids = NULL;
   
   if (!dbus_connection_set_watch_functions (connection,
                                             add_connection_watch,
@@ -401,28 +563,69 @@ bus_connections_setup_connection (BusConnections *connections,
                                               NULL,
                                               connection, NULL))
     goto out;
-
-
+  
   dbus_connection_set_unix_user_function (connection,
                                           allow_user_function,
                                           NULL, NULL);
+
+  dbus_connection_set_dispatch_status_function (connection,
+                                                dispatch_status_function,
+                                                bus_context_get_loop (connections->context),
+                                                NULL);
+
+  d->link_in_connection_list = _dbus_list_alloc_link (connection);
+  if (d->link_in_connection_list == NULL)
+    goto out;
   
   /* Setup the connection with the dispatcher */
   if (!bus_dispatch_add_connection (connection))
     goto out;
-  
-  if (!_dbus_list_append (&connections->list, connection))
+
+  if (dbus_connection_get_dispatch_status (connection) != DBUS_DISPATCH_COMPLETE)
     {
-      bus_dispatch_remove_connection (connection);
-      goto out;
+      if (!_dbus_loop_queue_dispatch (bus_context_get_loop (connections->context), connection))
+        {
+          bus_dispatch_remove_connection (connection);
+          goto out;
+        }
     }
+
+  _dbus_list_append_link (&connections->incomplete, d->link_in_connection_list);
+  connections->n_incomplete += 1;
   
   dbus_connection_ref (connection);
+
+  /* Note that we might disconnect ourselves here, but it only takes
+   * effect on return to the main loop. We call this to free up
+   * expired connections if possible, and to queue the timeout for our
+   * own expiration.
+   */
+  bus_connections_expire_incomplete (connections);
+  
+  /* And we might also disconnect ourselves here, but again it
+   * only takes effect on return to main loop.
+   */
+  if (connections->n_incomplete >
+      bus_context_get_max_incomplete_connections (connections->context))
+    {
+      _dbus_verbose ("Number of incomplete connections exceeds max, dropping oldest one\n");
+      
+      _dbus_assert (connections->incomplete != NULL);
+      /* Disconnect the oldest unauthenticated connection.  FIXME
+       * would it be more secure to drop a *random* connection?  This
+       * algorithm seems to mean that if someone can create new
+       * connections quickly enough, they can keep anyone else from
+       * completing authentication. But random may or may not really
+       * help with that, a more elaborate solution might be required.
+       */
+      dbus_connection_disconnect (connections->incomplete->data);
+    }
+  
   retval = TRUE;
 
  out:
   if (!retval)
-    {        
+    {      
       if (!dbus_connection_set_watch_functions (connection,
                                                 NULL, NULL, NULL,
                                                 connection,
@@ -438,55 +641,149 @@ bus_connections_setup_connection (BusConnections *connections,
       dbus_connection_set_unix_user_function (connection,
                                               NULL, NULL, NULL);
 
+      dbus_connection_set_dispatch_status_function (connection,
+                                                    NULL, NULL, NULL);
+      
       if (!dbus_connection_set_data (connection,
                                      connection_data_slot,
                                      NULL, NULL))
         _dbus_assert_not_reached ("failed to set connection data to null");
+
+      if (d->link_in_connection_list != NULL)
+        {
+          _dbus_assert (d->link_in_connection_list->next == NULL);
+          _dbus_assert (d->link_in_connection_list->prev == NULL);
+          _dbus_list_free_link (d->link_in_connection_list);
+        }
     }
   
   return retval;
 }
 
+void
+bus_connections_expire_incomplete (BusConnections *connections)
+{    
+  int next_interval;
+
+  next_interval = -1;
+  
+  if (connections->incomplete != NULL)
+    {
+      long tv_sec, tv_usec;
+      DBusList *link;
+      int auth_timeout;
+      
+      _dbus_get_current_time (&tv_sec, &tv_usec);
+      auth_timeout = bus_context_get_auth_timeout (connections->context);
+  
+      link = _dbus_list_get_first_link (&connections->incomplete);
+      while (link != NULL)
+        {
+          DBusList *next = _dbus_list_get_next_link (&connections->incomplete, link);
+          DBusConnection *connection;
+          BusConnectionData *d;
+          double elapsed;
+      
+          connection = link->data;
+      
+          d = BUS_CONNECTION_DATA (connection);
+      
+          _dbus_assert (d != NULL);
+      
+          elapsed = ((double) tv_sec - (double) d->connection_tv_sec) * 1000.0 +
+            ((double) tv_usec - (double) d->connection_tv_usec) / 1000.0;
+
+          if (elapsed >= (double) auth_timeout)
+            {
+              _dbus_verbose ("Timing out authentication for connection %p\n", connection);
+              dbus_connection_disconnect (connection);
+            }
+          else
+            {
+              /* We can end the loop, since the connections are in oldest-first order */
+              next_interval = ((double)auth_timeout) - elapsed;
+              _dbus_verbose ("Connection %p authentication expires in %d milliseconds\n",
+                             connection, next_interval);
+          
+              break;
+            }
+      
+          link = next;
+        }
+    }
+  
+  if (next_interval >= 0)
+    {
+      _dbus_timeout_set_interval (connections->expire_timeout,
+                                  next_interval);
+      _dbus_timeout_set_enabled (connections->expire_timeout, TRUE);
+
+      _dbus_verbose ("Enabled incomplete connections timeout with interval %d, %d incomplete connections\n",
+                     next_interval, connections->n_incomplete);
+    }
+  else if (dbus_timeout_get_enabled (connections->expire_timeout))
+    {
+      _dbus_timeout_set_enabled (connections->expire_timeout, FALSE);
+
+      _dbus_verbose ("Disabled incomplete connections timeout, %d incomplete connections\n",
+                     connections->n_incomplete);
+    }
+  else
+    _dbus_verbose ("No need to disable incomplete connections timeout\n");
+}
+
+static dbus_bool_t
+expire_incomplete_timeout (void *data)
+{
+  BusConnections *connections = data;
+
+  _dbus_verbose ("Running %s\n", _DBUS_FUNCTION_NAME);
+  
+  /* note that this may remove the timeout */
+  bus_connections_expire_incomplete (connections);
+
+  return TRUE;
+}
+
 dbus_bool_t
-bus_connection_get_groups  (DBusConnection       *connection,
-                            const unsigned long **groups,
-                            int                  *n_groups)
+bus_connection_get_groups  (DBusConnection   *connection,
+                            unsigned long   **groups,
+                            int              *n_groups,
+                            DBusError        *error)
 {
   BusConnectionData *d;
-    
+  unsigned long uid;
+  DBusUserDatabase *user_database;
+  
   d = BUS_CONNECTION_DATA (connection);
 
   _dbus_assert (d != NULL);
 
+  user_database = bus_context_get_user_database (d->connections->context);
+  
   *groups = NULL;
   *n_groups = 0;
 
-  /* we do a lazy lookup on groups a user is in for two reasons:
-   * 1) we can't do it on connection setup since the user
-   * hasn't authenticated and 2) it might be expensive
-   * and we don't need to do it if there are no group-based
-   * rules in the config file
-   */
-  
-  if (d->n_group_ids == 0)
+  if (dbus_connection_get_unix_user (connection, &uid))
     {
-      unsigned long uid;
-      
-      if (dbus_connection_get_unix_user (connection, &uid))
+      if (!_dbus_user_database_get_groups (user_database,
+                                           uid, groups, n_groups,
+                                           error))
         {
-          if (!_dbus_get_groups (uid, &d->group_ids, &d->n_group_ids))
-            {
-              _dbus_verbose ("Did not get any groups for UID %lu\n",
-                             uid);
-              return FALSE;
-            }
+          _DBUS_ASSERT_ERROR_IS_SET (error);
+          _dbus_verbose ("Did not get any groups for UID %lu\n",
+                         uid);
+          return FALSE;
+        }
+      else
+        {
+          _dbus_verbose ("Got %d groups for UID %lu\n",
+                         *n_groups, uid);
+          return TRUE;
         }
     }
-
-  *groups = d->group_ids;
-  *n_groups = d->n_group_ids;
-
-  return TRUE;
+  else
+    return TRUE; /* successfully got 0 groups */
 }
 
 dbus_bool_t
@@ -494,24 +791,29 @@ bus_connection_is_in_group (DBusConnection *connection,
                             unsigned long   gid)
 {
   int i;
-  const unsigned long *group_ids;
+  unsigned long *group_ids;
   int n_group_ids;
 
-  if (!bus_connection_get_groups (connection, &group_ids, &n_group_ids))
+  if (!bus_connection_get_groups (connection, &group_ids, &n_group_ids,
+                                  NULL))
     return FALSE;
 
   i = 0;
   while (i < n_group_ids)
     {
       if (group_ids[i] == gid)
-        return TRUE;
+        {
+          dbus_free (group_ids);
+          return TRUE;
+        }
       ++i;
     }
 
+  dbus_free (group_ids);
   return FALSE;
 }
 
-BusPolicy*
+BusClientPolicy*
 bus_connection_get_policy (DBusConnection *connection)
 {
   BusConnectionData *d;
@@ -519,30 +821,70 @@ bus_connection_get_policy (DBusConnection *connection)
   d = BUS_CONNECTION_DATA (connection);
 
   _dbus_assert (d != NULL);
+  _dbus_assert (d->policy != NULL);
+  
+  return d->policy;
+}
 
-  if (!dbus_connection_get_is_authenticated (connection))
+static dbus_bool_t
+foreach_active (BusConnections               *connections,
+                BusConnectionForeachFunction  function,
+                void                         *data)
+{
+  DBusList *link;
+  
+  link = _dbus_list_get_first_link (&connections->completed);
+  while (link != NULL)
     {
-      _dbus_verbose ("Tried to get policy for unauthenticated connection!\n");
-      return NULL;
+      DBusConnection *connection = link->data;
+      DBusList *next = _dbus_list_get_next_link (&connections->completed, link);
+
+      if (!(* function) (connection, data))
+        return FALSE;
+      
+      link = next;
     }
+
+  return TRUE;
+}
+
+static dbus_bool_t
+foreach_inactive (BusConnections               *connections,
+                  BusConnectionForeachFunction  function,
+                  void                         *data)
+{
+  DBusList *link;
   
-  /* We do lazy creation of the policy because
-   * it can only be done post-authentication.
-   */
-  if (d->policy == NULL)
+  link = _dbus_list_get_first_link (&connections->incomplete);
+  while (link != NULL)
     {
-      d->policy =
-        bus_context_create_connection_policy (d->connections->context,
-                                              connection);
-
-      /* we may have a NULL policy on OOM or error getting list of
-       * groups for a user. In the latter case we don't handle it so
-       * well currently, just keep pretending we're out of memory,
-       * which is kind of bizarre.
-       */
+      DBusConnection *connection = link->data;
+      DBusList *next = _dbus_list_get_next_link (&connections->incomplete, link);
+
+      if (!(* function) (connection, data))
+        return FALSE;
+      
+      link = next;
     }
 
-  return d->policy;
+  return TRUE;
+}
+
+/**
+ * Calls function on each active connection; if the function returns
+ * #FALSE, stops iterating. Active connections are authenticated
+ * and have sent a Hello message.
+ *
+ * @param connections the connections object
+ * @param function the function
+ * @param data data to pass to it as a second arg
+ */
+void
+bus_connections_foreach_active (BusConnections               *connections,
+                                BusConnectionForeachFunction  function,
+                                void                         *data)
+{
+  foreach_active (connections, function, data);
 }
 
 /**
@@ -556,21 +898,12 @@ bus_connection_get_policy (DBusConnection *connection)
 void
 bus_connections_foreach (BusConnections               *connections,
                          BusConnectionForeachFunction  function,
-                       void                          *data)
+                         void                         *data)
 {
-  DBusList *link;
-  
-  link = _dbus_list_get_first_link (&connections->list);
-  while (link != NULL)
-    {
-      DBusConnection *connection = link->data;
-      DBusList *next = _dbus_list_get_next_link (&connections->list, link);
+  if (!foreach_active (connections, function, data))
+    return;
 
-      if (!(* function) (connection, data))
-        break;
-      
-      link = next;
-    }
+  foreach_inactive (connections, function, data);
 }
 
 BusContext*
@@ -661,9 +994,9 @@ bus_connection_preallocate_oom_error (DBusConnection *connection)
   if (preallocated == NULL)
     return FALSE;
 
-  /* d->name may be NULL, but that should be OK */
-  message = dbus_message_new (d->name,
-                              DBUS_ERROR_NO_MEMORY);
+  /* d->name may be NULL, but that is OK */
+  message = dbus_message_new (DBUS_ERROR_NO_MEMORY,
+                              d->name);
   if (message == NULL)
     {
       dbus_connection_free_preallocated_send (connection, preallocated);
@@ -722,19 +1055,33 @@ bus_connection_send_oom_error (DBusConnection *connection,
   d->oom_preallocated = NULL;
 }
 
-dbus_bool_t
-bus_connection_add_owned_service (DBusConnection *connection,
-                                  BusService     *service)
+void
+bus_connection_add_owned_service_link (DBusConnection *connection,
+                                       DBusList       *link)
 {
   BusConnectionData *d;
 
   d = BUS_CONNECTION_DATA (connection);
   _dbus_assert (d != NULL);
 
-  if (!_dbus_list_append (&d->services_owned,
-                          service))
+  _dbus_list_append_link (&d->services_owned, link);
+
+  d->n_services_owned += 1;
+}
+
+dbus_bool_t
+bus_connection_add_owned_service (DBusConnection *connection,
+                                  BusService     *service)
+{
+  DBusList *link;
+
+  link = _dbus_list_alloc_link (service);
+
+  if (link == NULL)
     return FALSE;
 
+  bus_connection_add_owned_service_link (connection, link);
+
   return TRUE;
 }
 
@@ -748,24 +1095,89 @@ bus_connection_remove_owned_service (DBusConnection *connection,
   _dbus_assert (d != NULL);
 
   _dbus_list_remove_last (&d->services_owned, service);
+
+  d->n_services_owned -= 1;
+  _dbus_assert (d->n_services_owned >= 0);
+}
+
+int
+bus_connection_get_n_services_owned (DBusConnection *connection)
+{
+  BusConnectionData *d;
+
+  d = BUS_CONNECTION_DATA (connection);
+  _dbus_assert (d != NULL);
+  
+  return d->n_services_owned;
 }
 
 dbus_bool_t
-bus_connection_set_name (DBusConnection   *connection,
-                        const DBusString *name)
+bus_connection_complete (DBusConnection   *connection,
+                        const DBusString *name,
+                         DBusError        *error)
 {
   BusConnectionData *d;
+  unsigned long uid;
   
   d = BUS_CONNECTION_DATA (connection);
   _dbus_assert (d != NULL);
   _dbus_assert (d->name == NULL);
-
+  _dbus_assert (d->policy == NULL);
+  
   if (!_dbus_string_copy_data (name, &d->name))
-    return FALSE;
+    {
+      BUS_SET_OOM (error);
+      return FALSE;
+    }
 
   _dbus_assert (d->name != NULL);
   
   _dbus_verbose ("Name %s assigned to %p\n", d->name, connection);
+
+  d->policy = bus_context_create_client_policy (d->connections->context,
+                                                connection,
+                                                error);
+
+  /* we may have a NULL policy on OOM or error getting list of
+   * groups for a user. In the latter case we don't handle it so
+   * well currently, as it will just keep failing over and over.
+   */
+
+  if (d->policy == NULL)
+    {
+      _dbus_verbose ("Failed to create security policy for connection %p\n",
+                     connection);
+      _DBUS_ASSERT_ERROR_IS_SET (error);
+      dbus_free (d->name);
+      d->name = NULL;
+      return FALSE;
+    }
+  
+  if (dbus_connection_get_unix_user (connection, &uid))
+    {
+      if (!adjust_connections_for_uid (d->connections,
+                                       uid, 1))
+        {
+          BUS_SET_OOM (error);
+          dbus_free (d->name);
+          d->name = NULL;
+          return FALSE;
+        }
+    }
+  
+  /* Now the connection is active, move it between lists */
+  _dbus_list_unlink (&d->connections->incomplete,
+                     d->link_in_connection_list);
+  d->connections->n_incomplete -= 1;
+  _dbus_list_append_link (&d->connections->completed,
+                          d->link_in_connection_list);
+  d->connections->n_completed += 1;
+
+  _dbus_assert (d->connections->n_incomplete >= 0);
+  _dbus_assert (d->connections->n_completed > 0);
+
+  /* See if we can remove the timeout */
+  bus_connections_expire_incomplete (d->connections);
   
   return TRUE;
 }
@@ -781,6 +1193,54 @@ bus_connection_get_name (DBusConnection *connection)
   return d->name;
 }
 
+/**
+ * Check whether completing the passed-in connection would
+ * exceed limits, and if so set error and return #FALSE
+ */
+dbus_bool_t
+bus_connections_check_limits (BusConnections  *connections,
+                              DBusConnection  *requesting_completion,
+                              DBusError       *error)
+{
+  BusConnectionData *d;
+  unsigned long uid;
+  
+  d = BUS_CONNECTION_DATA (requesting_completion);
+  _dbus_assert (d != NULL);
+
+  _dbus_assert (d->name == NULL);
+
+  if (connections->n_completed >=
+      bus_context_get_max_completed_connections (connections->context))
+    {
+      dbus_set_error (error, DBUS_ERROR_LIMITS_EXCEEDED,
+                      "The maximum number of active connections has been reached");
+      return FALSE;
+    }
+  
+  if (dbus_connection_get_unix_user (requesting_completion, &uid))
+    {
+      if (get_connections_for_uid (connections, uid) >=
+          bus_context_get_max_connections_per_user (connections->context))
+        {
+          dbus_set_error (error, DBUS_ERROR_LIMITS_EXCEEDED,
+                          "The maximum number of active connections for UID %lu has been reached",
+                          uid);
+          return FALSE;
+        }
+    }
+  
+  return TRUE;
+}
+
+
+/*
+ * Transactions
+ *
+ * Note that this is fairly fragile; in particular, don't try to use
+ * one transaction across any main loop iterations.
+ */
+
 typedef struct
 {
   BusTransaction *transaction;
@@ -788,10 +1248,18 @@ typedef struct
   DBusPreallocatedSend *preallocated;
 } MessageToSend;
 
+typedef struct
+{
+  BusTransactionCancelFunction cancel_function;
+  DBusFreeFunction free_data_function;
+  void *data;
+} CancelHook;
+
 struct BusTransaction
 {
   DBusList *connections;
   BusContext *context;
+  DBusList *cancel_hooks;
 };
 
 static void
@@ -807,6 +1275,39 @@ message_to_send_free (DBusConnection *connection,
   dbus_free (to_send);
 }
 
+static void
+cancel_hook_cancel (void *element,
+                    void *data)
+{
+  CancelHook *ch = element;
+
+  _dbus_verbose ("Running transaction cancel hook\n");
+  
+  if (ch->cancel_function)
+    (* ch->cancel_function) (ch->data);  
+}
+
+static void
+cancel_hook_free (void *element,
+                  void *data)
+{
+  CancelHook *ch = element;
+
+  if (ch->free_data_function)
+    (* ch->free_data_function) (ch->data);
+
+  dbus_free (ch);
+}
+
+static void
+free_cancel_hooks (BusTransaction *transaction)
+{
+  _dbus_list_foreach (&transaction->cancel_hooks,
+                      cancel_hook_free, NULL);
+  
+  _dbus_list_clear (&transaction->cancel_hooks);
+}
+
 BusTransaction*
 bus_transaction_new (BusContext *context)
 {
@@ -834,15 +1335,43 @@ bus_transaction_get_connections (BusTransaction  *transaction)
 }
 
 dbus_bool_t
-bus_transaction_send_message (BusTransaction *transaction,
-                              DBusConnection *connection,
-                              DBusMessage    *message)
+bus_transaction_send_from_driver (BusTransaction *transaction,
+                                  DBusConnection *connection,
+                                  DBusMessage    *message)
+{
+  /* We have to set the sender to the driver, and have
+   * to check security policy since it was not done in
+   * dispatch.c
+   */
+  _dbus_verbose ("Sending %s from driver\n",
+                 dbus_message_get_name (message));
+  
+  if (!dbus_message_set_sender (message, DBUS_SERVICE_DBUS))
+    return FALSE;
+
+  /* If security policy doesn't allow the message, we silently
+   * eat it; the driver doesn't care about getting a reply.
+   */
+  if (!bus_context_check_security_policy (bus_transaction_get_context (transaction),
+                                          NULL, connection, message, NULL))
+    return TRUE;
+
+  return bus_transaction_send (transaction, connection, message);
+}
+
+dbus_bool_t
+bus_transaction_send (BusTransaction *transaction,
+                      DBusConnection *connection,
+                      DBusMessage    *message)
 {
   MessageToSend *to_send;
   BusConnectionData *d;
   DBusList *link;
 
-  _dbus_verbose ("  trying to add message %s to transaction%s\n",
+  _dbus_verbose ("  trying to add %s %s to transaction%s\n",
+                 dbus_message_get_is_error (message) ? "error" :
+                 dbus_message_get_reply_serial (message) != 0 ? "reply" :
+                 "message",
                  dbus_message_get_name (message),
                  dbus_connection_get_is_connected (connection) ?
                  "" : " (disconnected)");
@@ -953,6 +1482,11 @@ bus_transaction_cancel_and_free (BusTransaction *transaction)
 
   _dbus_assert (transaction->connections == NULL);
 
+  _dbus_list_foreach (&transaction->cancel_hooks,
+                      cancel_hook_cancel, NULL);
+
+  free_cancel_hooks (transaction);
+  
   dbus_free (transaction);
 }
 
@@ -1009,6 +1543,8 @@ bus_transaction_execute_and_free (BusTransaction *transaction)
 
   _dbus_assert (transaction->connections == NULL);
 
+  free_cancel_hooks (transaction);
+  
   dbus_free (transaction);
 }
 
@@ -1045,15 +1581,17 @@ bus_transaction_send_error_reply (BusTransaction  *transaction,
   
   _dbus_assert (error != NULL);
   _DBUS_ASSERT_ERROR_IS_SET (error);
-  
+
+  _dbus_verbose ("Sending error reply %s \"%s\"\n",
+                 error->name, error->message);
+
   reply = dbus_message_new_error_reply (in_reply_to,
                                         error->name,
                                         error->message);
   if (reply == NULL)
     return FALSE;
 
-  if (!dbus_message_set_sender (reply, DBUS_SERVICE_DBUS) ||
-      !bus_transaction_send_message (transaction, connection, reply))
+  if (!bus_transaction_send_from_driver (transaction, connection, reply))
     {
       dbus_message_unref (reply);
       return FALSE;
@@ -1063,3 +1601,31 @@ bus_transaction_send_error_reply (BusTransaction  *transaction,
   
   return TRUE;
 }
+
+dbus_bool_t
+bus_transaction_add_cancel_hook (BusTransaction               *transaction,
+                                 BusTransactionCancelFunction  cancel_function,
+                                 void                         *data,
+                                 DBusFreeFunction              free_data_function)
+{
+  CancelHook *ch;
+
+  ch = dbus_new (CancelHook, 1);
+  if (ch == NULL)
+    return FALSE;
+  
+  ch->cancel_function = cancel_function;
+  ch->data = data;
+  ch->free_data_function = free_data_function;
+
+  /* It's important that the hooks get run in reverse order that they
+   * were added
+   */
+  if (!_dbus_list_prepend (&transaction->cancel_hooks, ch))
+    {
+      dbus_free (ch);
+      return FALSE;
+    }
+
+  return TRUE;
+}