/* dbus-auth.c Authentication
*
* Copyright (C) 2002, 2003, 2004 Red Hat Inc.
+ * Copyright (C) 2013 Samsung Electronics
*
* Licensed under the Academic Free License version 2.1
*
#include "dbus-sha.h"
#include "dbus-protocol.h"
#include "dbus-credentials.h"
-#include "dbus-authorization.h"
/**
* @defgroup DBusAuth Authentication
*/
struct DBusAuth
{
+ int refcount; /**< reference count */
const char *side; /**< Client or server */
DBusString incoming; /**< Incoming data buffer */
DBusCredentials *credentials; /**< Credentials read from socket
*/
- DBusCredentials *authenticated_identity; /**< Credentials that are authorized */
+ DBusCredentials *authorized_identity; /**< Credentials that are authorized */
DBusCredentials *desired_identity; /**< Identity client has requested */
{
DBusAuth base; /**< Parent class */
- DBusAuthorization *authorization; /* DBus Authorization callbacks */
-
int failures; /**< Number of times client has been rejected */
int max_failures; /**< Number of times we reject before disconnect */
if (auth == NULL)
return NULL;
+ auth->refcount = 1;
+
auth->keyring = NULL;
auth->cookie_id = -1;
if (auth->credentials == NULL)
goto enomem_6;
- auth->authenticated_identity = _dbus_credentials_new ();
- if (auth->authenticated_identity == NULL)
+ auth->authorized_identity = _dbus_credentials_new ();
+ if (auth->authorized_identity == NULL)
goto enomem_7;
auth->desired_identity = _dbus_credentials_new ();
_dbus_credentials_unref (auth->desired_identity);
#endif
enomem_8:
- _dbus_credentials_unref (auth->authenticated_identity);
+ _dbus_credentials_unref (auth->authorized_identity);
enomem_7:
_dbus_credentials_unref (auth->credentials);
enomem_6:
auth->already_asked_for_initial_response = FALSE;
_dbus_string_set_length (&auth->identity, 0);
- _dbus_credentials_clear (auth->authenticated_identity);
+ _dbus_credentials_clear (auth->authorized_identity);
_dbus_credentials_clear (auth->desired_identity);
if (auth->mech != NULL)
goto out_3;
}
- if (!_dbus_credentials_add_credentials (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credentials (auth->authorized_identity,
auth->desired_identity))
goto out_3;
/* Copy process ID from the socket credentials if it's there
*/
- if (!_dbus_credentials_add_credential (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credential (auth->authorized_identity,
DBUS_CREDENTIAL_UNIX_PROCESS_ID,
auth->credentials))
goto out_3;
auth->desired_identity))
{
/* client has authenticated */
- if (!_dbus_credentials_add_credentials (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credentials (auth->authorized_identity,
auth->desired_identity))
return FALSE;
/* also copy process ID from the socket credentials
*/
- if (!_dbus_credentials_add_credential (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credential (auth->authorized_identity,
DBUS_CREDENTIAL_UNIX_PROCESS_ID,
auth->credentials))
return FALSE;
/* also copy audit data from the socket credentials
*/
- if (!_dbus_credentials_add_credential (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credential (auth->authorized_identity,
DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID,
auth->credentials))
return FALSE;
+
+ if (!send_ok (auth))
+ return FALSE;
- /* Do a first authorization of the transport, in order to REJECT
- * immediately connection if needed (FDO#39720), transport will
- * re-authorize later, but it will close the connection on fail,
- * we want to REJECT now if possible */
- if (_dbus_authorization_do_authorization (DBUS_AUTH_SERVER (auth)->authorization,
- auth->authenticated_identity))
- {
- if (!send_ok (auth))
- return FALSE;
- }
- else
- {
- _dbus_verbose ("%s: authenticated identity not authorized by server\n",
- DBUS_AUTH_NAME (auth));
- return send_rejected (auth);
- }
-
- _dbus_verbose ("%s: authenticated and authorized client based on "
- "socket credentials\n", DBUS_AUTH_NAME (auth));
+ _dbus_verbose ("%s: authenticated client based on socket credentials\n",
+ DBUS_AUTH_NAME (auth));
return TRUE;
}
/* Copy process ID from the socket credentials
*/
- if (!_dbus_credentials_add_credential (auth->authenticated_identity,
+ if (!_dbus_credentials_add_credential (auth->authorized_identity,
DBUS_CREDENTIAL_UNIX_PROCESS_ID,
auth->credentials))
return FALSE;
* @returns the new object or #NULL if no memory
*/
DBusAuth*
-_dbus_auth_server_new (const DBusString *guid,
- DBusAuthorization *authorization)
+_dbus_auth_server_new (const DBusString *guid)
{
DBusAuth *auth;
DBusAuthServer *server_auth;
server_auth = DBUS_AUTH_SERVER (auth);
server_auth->guid = guid_copy;
- server_auth->authorization = authorization;
-
+
/* perhaps this should be per-mechanism with a lower
* max
*/
* mechanism */
if (!send_auth (auth, &all_mechanisms[0]))
{
- _dbus_auth_free (auth);
+ _dbus_auth_unref (auth);
return NULL;
}
return auth;
}
+#ifdef ENABLE_KDBUS_TRANSPORT
/**
- * Free memory allocated for an auth object.
+ * Creates a new auth conversation object for the client side of kdbus.
+ * In fact it only initialize structures and sets authenticated state
+ * because of different authentication-like mechanism in kdbus - policies
+ * TODO Probably to be checked and modified when kdbus will be documented
*
- * @param auth the auth conversation
+ * @returns the new object or #NULL if no memory
*/
-void
-_dbus_auth_free (DBusAuth *auth)
+DBusAuth*
+_dbus_auth_client_new_kdbus (void)
{
- _dbus_assert (auth != NULL);
+ DBusAuth *auth;
+ DBusString guid_str;
- shutdown_mech (auth);
+ if (!_dbus_string_init (&guid_str))
+ return NULL;
- if (DBUS_AUTH_IS_CLIENT (auth))
+ auth = _dbus_auth_new (sizeof (DBusAuthClient));
+ if (auth == NULL)
{
- _dbus_string_free (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
- _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
+ _dbus_string_free (&guid_str);
+ return NULL;
}
- else
+
+ DBUS_AUTH_CLIENT (auth)->guid_from_server = guid_str;
+
+ auth->side = auth_side_client;
+ auth->state = &common_state_authenticated;
+ auth->unix_fd_negotiated = TRUE;
+
+ /* Start the auth conversation by sending AUTH for our default
+ * mechanism */
+/* if (!send_auth (auth, &all_mechanisms[0]))
{
- _dbus_assert (DBUS_AUTH_IS_SERVER (auth));
+ _dbus_auth_unref (auth);
+ return NULL;
+ }*/
- _dbus_string_free (& DBUS_AUTH_SERVER (auth)->guid);
- }
+ return auth;
+}
+#endif
- if (auth->keyring)
- _dbus_keyring_unref (auth->keyring);
+/**
+ * Increments the refcount of an auth object.
+ *
+ * @param auth the auth conversation
+ * @returns the auth conversation
+ */
+DBusAuth *
+_dbus_auth_ref (DBusAuth *auth)
+{
+ _dbus_assert (auth != NULL);
+
+ auth->refcount += 1;
+
+ return auth;
+}
- _dbus_string_free (&auth->context);
- _dbus_string_free (&auth->challenge);
- _dbus_string_free (&auth->identity);
- _dbus_string_free (&auth->incoming);
- _dbus_string_free (&auth->outgoing);
+/**
+ * Decrements the refcount of an auth object.
+ *
+ * @param auth the auth conversation
+ */
+void
+_dbus_auth_unref (DBusAuth *auth)
+{
+ _dbus_assert (auth != NULL);
+ _dbus_assert (auth->refcount > 0);
- dbus_free_string_array (auth->allowed_mechs);
+ auth->refcount -= 1;
+ if (auth->refcount == 0)
+ {
+ shutdown_mech (auth);
- _dbus_credentials_unref (auth->credentials);
- _dbus_credentials_unref (auth->authenticated_identity);
- _dbus_credentials_unref (auth->desired_identity);
+ if (DBUS_AUTH_IS_CLIENT (auth))
+ {
+ _dbus_string_free (& DBUS_AUTH_CLIENT (auth)->guid_from_server);
+ _dbus_list_clear (& DBUS_AUTH_CLIENT (auth)->mechs_to_try);
+ }
+ else
+ {
+ _dbus_assert (DBUS_AUTH_IS_SERVER (auth));
- dbus_free (auth);
+ _dbus_string_free (& DBUS_AUTH_SERVER (auth)->guid);
+ }
+
+ if (auth->keyring)
+ _dbus_keyring_unref (auth->keyring);
+
+ _dbus_string_free (&auth->context);
+ _dbus_string_free (&auth->challenge);
+ _dbus_string_free (&auth->identity);
+ _dbus_string_free (&auth->incoming);
+ _dbus_string_free (&auth->outgoing);
+
+ dbus_free_string_array (auth->allowed_mechs);
+
+ _dbus_credentials_unref (auth->credentials);
+ _dbus_credentials_unref (auth->authorized_identity);
+ _dbus_credentials_unref (auth->desired_identity);
+
+ dbus_free (auth);
+ }
}
/**
{
if (auth->state == &common_state_authenticated)
{
- return auth->authenticated_identity;
+ return auth->authorized_identity;
}
else
{
* doesn't require allocation or something
*/
/* return empty credentials */
- _dbus_assert (_dbus_credentials_are_empty (auth->authenticated_identity));
- return auth->authenticated_identity;
+ _dbus_assert (_dbus_credentials_are_empty (auth->authorized_identity));
+ return auth->authorized_identity;
}
}