// SPDX-License-Identifier: GPL-2.0+

/*

 * Copyright (C) 2012 - 2018 Red Hat, Inc.

 */

#include "nm-default.h"

#include "common.h"

#include <stdio.h>

#include <stdlib.h>

#include <sys/ioctl.h>

#include <readline/readline.h>

#include <readline/history.h>

#include "nm-libnm-aux/nm-libnm-aux.h"

#include "nm-vpn-helpers.h"

#include "nm-client-utils.h"

#include "nm-glib-aux/nm-secret-utils.h"

#include "utils.h"

/*****************************************************************************/

static char **

_ip_config_get_routes (NMIPConfig *cfg)

{

	gs_unref_hashtable GHashTable *hash = NULL;

	GPtrArray *ptr_array;

	char **arr;

	guint i;

	ptr_array = nm_ip_config_get_routes (cfg);

	if (!ptr_array)

		return NULL;

	if (ptr_array->len == 0)

		return NULL;

	arr = g_new (char *, ptr_array->len + 1);

	for (i = 0; i < ptr_array->len; i++) {

		NMIPRoute *route = g_ptr_array_index (ptr_array, i);

		gs_strfreev char **names = NULL;

		gsize j;

		GString *str;

		guint64 metric;

		gs_free char *attributes = NULL;

		str = g_string_new (NULL);

		g_string_append_printf (str,

		                        "dst = %s/%u, nh = %s",

		                        nm_ip_route_get_dest (route),

		                        nm_ip_route_get_prefix (route),

		                        nm_ip_route_get_next_hop (route)

		                          ?: (nm_ip_route_get_family (route) == AF_INET ? "0.0.0.0" : "::"));

		metric = nm_ip_route_get_metric (route);

		if (metric != -1) {

			g_string_append_printf (str,

			                        ", mt = %u",

			                        (guint) metric);

		}

		names = nm_ip_route_get_attribute_names (route);

		if (names[0]) {

			if (!hash)

				hash = g_hash_table_new (nm_str_hash, g_str_equal);

			else

				g_hash_table_remove_all (hash);

			for (j = 0; names[j]; j++)

				g_hash_table_insert (hash, names[j], nm_ip_route_get_attribute (route, names[j]));

			attributes = nm_utils_format_variant_attributes (hash, ',', '=');

			if (attributes) {

				g_string_append (str, ", ");

				g_string_append (str, attributes);

			}

		}

		arr[i] = g_string_free (str, FALSE);

	}

	nm_assert (i == ptr_array->len);

	arr[i] = NULL;

	return arr;

}

/*****************************************************************************/

static gconstpointer

_metagen_ip4_config_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)

{

	NMIPConfig *cfg4 = target;

	GPtrArray *ptr_array;

	char **arr;

	const char *const*arrc;

	guint i = 0;

	const char *str;

	nm_assert (info->info_type < _NMC_GENERIC_INFO_TYPE_IP4_CONFIG_NUM);

	NMC_HANDLE_COLOR (NM_META_COLOR_NONE);

	NM_SET_OUT (out_is_default, TRUE);

	switch (info->info_type) {

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_ADDRESS:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		ptr_array = nm_ip_config_get_addresses (cfg4);

		if (ptr_array) {

			arr = g_new (char *, ptr_array->len + 1);

			for (i = 0; i < ptr_array->len; i++) {

				NMIPAddress *addr = g_ptr_array_index (ptr_array, i);

				arr[i] = g_strdup_printf ("%s/%u",

				                          nm_ip_address_get_address (addr),

				                          nm_ip_address_get_prefix (addr));

			}

			arr[i] = NULL;

		} else

			arr = NULL;

		goto arr_out;

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_GATEWAY:

		str = nm_ip_config_get_gateway (cfg4);

		NM_SET_OUT (out_is_default, !str);

		return str;

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_ROUTE:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arr = _ip_config_get_routes (cfg4);

		goto arr_out;

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_DNS:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arrc = nm_ip_config_get_nameservers (cfg4);

		goto arrc_out;

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_DOMAIN:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arrc = nm_ip_config_get_domains (cfg4);

		goto arrc_out;

	case NMC_GENERIC_INFO_TYPE_IP4_CONFIG_WINS:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arrc = nm_ip_config_get_wins_servers (cfg4);

		goto arrc_out;

	default:

		break;

	}

	g_return_val_if_reached (NULL);

arrc_out:

	NM_SET_OUT (out_is_default, !arrc || !arrc[0]);

	*out_flags |= NM_META_ACCESSOR_GET_OUT_FLAGS_STRV;

	return arrc;

arr_out:

	NM_SET_OUT (out_is_default, !arr || !arr[0]);

	*out_flags |= NM_META_ACCESSOR_GET_OUT_FLAGS_STRV;

	*out_to_free = arr;

	return arr;

}

const NmcMetaGenericInfo *const metagen_ip4_config[_NMC_GENERIC_INFO_TYPE_IP4_CONFIG_NUM + 1] = {

#define _METAGEN_IP4_CONFIG(type, name) \

	[type] = NMC_META_GENERIC(name, .info_type = type, .get_fcn = _metagen_ip4_config_get_fcn)

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_ADDRESS, "ADDRESS"),

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_GATEWAY, "GATEWAY"),

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_ROUTE,   "ROUTE"),

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_DNS,     "DNS"),

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_DOMAIN,  "DOMAIN"),

	_METAGEN_IP4_CONFIG (NMC_GENERIC_INFO_TYPE_IP4_CONFIG_WINS,    "WINS"),

};

/*****************************************************************************/

static gconstpointer

_metagen_ip6_config_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)

{

	NMIPConfig *cfg6 = target;

	GPtrArray *ptr_array;

	char **arr;

	const char *const*arrc;

	guint i = 0;

	const char *str;

	nm_assert (info->info_type < _NMC_GENERIC_INFO_TYPE_IP6_CONFIG_NUM);

	NMC_HANDLE_COLOR (NM_META_COLOR_NONE);

	NM_SET_OUT (out_is_default, TRUE);

	switch (info->info_type) {

	case NMC_GENERIC_INFO_TYPE_IP6_CONFIG_ADDRESS:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		ptr_array = nm_ip_config_get_addresses (cfg6);

		if (ptr_array) {

			arr = g_new (char *, ptr_array->len + 1);

			for (i = 0; i < ptr_array->len; i++) {

				NMIPAddress *addr = g_ptr_array_index (ptr_array, i);

				arr[i] = g_strdup_printf ("%s/%u",

				                          nm_ip_address_get_address (addr),

				                          nm_ip_address_get_prefix (addr));

			}

			arr[i] = NULL;

		} else

			arr = NULL;

		goto arr_out;

	case NMC_GENERIC_INFO_TYPE_IP6_CONFIG_GATEWAY:

		str = nm_ip_config_get_gateway (cfg6);

		NM_SET_OUT (out_is_default, !str);

		return str;

	case NMC_GENERIC_INFO_TYPE_IP6_CONFIG_ROUTE:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arr = _ip_config_get_routes (cfg6);

		goto arr_out;

	case NMC_GENERIC_INFO_TYPE_IP6_CONFIG_DNS:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arrc = nm_ip_config_get_nameservers (cfg6);

		goto arrc_out;

	case NMC_GENERIC_INFO_TYPE_IP6_CONFIG_DOMAIN:

		if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

			return NULL;

		arrc = nm_ip_config_get_domains (cfg6);

		goto arrc_out;

	default:

		break;

	}

	g_return_val_if_reached (NULL);

arrc_out:

	NM_SET_OUT (out_is_default, !arrc || !arrc[0]);

	*out_flags |= NM_META_ACCESSOR_GET_OUT_FLAGS_STRV;

	return arrc;

arr_out:

	NM_SET_OUT (out_is_default, !arr || !arr[0]);

	*out_flags |= NM_META_ACCESSOR_GET_OUT_FLAGS_STRV;

	*out_to_free = arr;

	return arr;

}

const NmcMetaGenericInfo *const metagen_ip6_config[_NMC_GENERIC_INFO_TYPE_IP6_CONFIG_NUM + 1] = {

#define _METAGEN_IP6_CONFIG(type, name) \

	[type] = NMC_META_GENERIC(name, .info_type = type, .get_fcn = _metagen_ip6_config_get_fcn)

	_METAGEN_IP6_CONFIG (NMC_GENERIC_INFO_TYPE_IP6_CONFIG_ADDRESS, "ADDRESS"),

	_METAGEN_IP6_CONFIG (NMC_GENERIC_INFO_TYPE_IP6_CONFIG_GATEWAY, "GATEWAY"),

	_METAGEN_IP6_CONFIG (NMC_GENERIC_INFO_TYPE_IP6_CONFIG_ROUTE,   "ROUTE"),

	_METAGEN_IP6_CONFIG (NMC_GENERIC_INFO_TYPE_IP6_CONFIG_DNS,     "DNS"),

	_METAGEN_IP6_CONFIG (NMC_GENERIC_INFO_TYPE_IP6_CONFIG_DOMAIN,  "DOMAIN"),

};

/*****************************************************************************/

static gconstpointer

_metagen_dhcp_config_get_fcn (NMC_META_GENERIC_INFO_GET_FCN_ARGS)

{

	NMDhcpConfig *dhcp = target;

	guint i;

	char **arr = NULL;

	NMC_HANDLE_COLOR (NM_META_COLOR_NONE);

	switch (info->info_type) {

	case NMC_GENERIC_INFO_TYPE_DHCP_CONFIG_OPTION:

		{

			GHashTable *table;

			gs_free char **arr2 = NULL;

			guint n;

			if (!NM_FLAGS_HAS (get_flags, NM_META_ACCESSOR_GET_FLAGS_ACCEPT_STRV))

				return NULL;

			table = nm_dhcp_config_get_options (dhcp);

			if (!table)

				goto arr_out;

			arr2 = (char **) nm_utils_strdict_get_keys (table, TRUE, &n);

			if (!n)

				goto arr_out;

			nm_assert (arr2 && !arr2[n] && n == NM_PTRARRAY_LEN (arr2));

			for (i = 0; i < n; i++) {

				const char *k = arr2[i];

				const char *v;

				nm_assert (k);

				v = g_hash_table_lookup (table, k);

				arr2[i] = g_strdup_printf ("%s = %s", k, v);

			}

			arr = g_steal_pointer (&arr2);

			goto arr_out;

		}

	default:

		break;

	}

	g_return_val_if_reached (NULL);

arr_out:

	NM_SET_OUT (out_is_default, !arr || !arr[0]);

	*out_flags |= NM_META_ACCESSOR_GET_OUT_FLAGS_STRV;

	*out_to_free = arr;

	return arr;

}

const NmcMetaGenericInfo *const metagen_dhcp_config[_NMC_GENERIC_INFO_TYPE_DHCP_CONFIG_NUM + 1] = {

#define _METAGEN_DHCP_CONFIG(type, name) \

	[type] = NMC_META_GENERIC(name, .info_type = type, .get_fcn = _metagen_dhcp_config_get_fcn)

	_METAGEN_DHCP_CONFIG (NMC_GENERIC_INFO_TYPE_DHCP_CONFIG_OPTION, "OPTION"),

};

/*****************************************************************************/

gboolean

print_ip_config (NMIPConfig *cfg,

                 int addr_family,

                 const NmcConfig *nmc_config,

                 const char *one_field)

{

	gs_free_error GError *error = NULL;

	gs_free char *field_str = NULL;

	if (!cfg)

		return FALSE;

	if (one_field) {

		field_str = g_strdup_printf ("IP%c.%s",

		                             nm_utils_addr_family_to_char (addr_family),

		                             one_field);

	}

	if (!nmc_print (nmc_config,

	                (gpointer[]) { cfg, NULL },

	                NULL,

	                NULL,

	                addr_family == AF_INET

	                  ? NMC_META_GENERIC_GROUP ("IP4", metagen_ip4_config, N_("GROUP"))

	                  : NMC_META_GENERIC_GROUP ("IP6", metagen_ip6_config, N_("GROUP")),

	                field_str,

	                &error)) {

		return FALSE;

	}

	return TRUE;

}

gboolean

print_dhcp_config (NMDhcpConfig *dhcp,

                   int addr_family,

                   const NmcConfig *nmc_config,

                   const char *one_field)

{

	gs_free_error GError *error = NULL;

	gs_free char *field_str = NULL;

	if (!dhcp)

		return FALSE;

	if (one_field) {

		field_str = g_strdup_printf ("DHCP%c.%s",

		                             nm_utils_addr_family_to_char (addr_family),

		                             one_field);

	}

	if (!nmc_print (nmc_config,

	                (gpointer[]) { dhcp, NULL },

	                NULL,

	                NULL,

	                addr_family == AF_INET

	                  ? NMC_META_GENERIC_GROUP ("DHCP4", metagen_dhcp_config, N_("GROUP"))

	                  : NMC_META_GENERIC_GROUP ("DHCP6", metagen_dhcp_config, N_("GROUP")),

	                field_str,

	                &error)) {

		return FALSE;

	}

	return TRUE;

}

/*

 * nmc_find_connection:

 * @connections: array of NMConnections to search in

 * @filter_type: "id", "uuid", "path", "filename", or %NULL

 * @filter_val: connection to find (connection name, UUID or path)

 * @out_result: if not NULL, attach all matching connection to this

 *   list. If necessary, a new array will be allocated. If the array

 *   already contains a connection, it will not be added a second time.

 *   All object are referenced by the array. If the function allocates

 *   a new array, it will set the free function to g_object_unref.

 * @complete: print possible completions

 *

 * Find a connection in @list according to @filter_val. @filter_type determines

 * what property is used for comparison. When @filter_type is NULL, compare

 * @filter_val against all types. Otherwise, only compare against the specified

 * type. If 'path' filter type is specified, comparison against numeric index

 * (in addition to the whole path) is allowed.

 *

 * Returns: found connection, or %NULL

 */

NMConnection *

nmc_find_connection (const GPtrArray *connections,

                     const char *filter_type,

                     const char *filter_val,

                     GPtrArray **out_result,

                     gboolean complete)

{

	NMConnection *best_candidate_uuid = NULL;

	NMConnection *best_candidate = NULL;

	gs_unref_ptrarray GPtrArray *result_allocated = NULL;

	GPtrArray *result = out_result ? *out_result : NULL;

	const guint result_inital_len = result ? result->len : 0u;

	guint i, j;

	nm_assert (connections);

	nm_assert (filter_val);

	for (i = 0; i < connections->len; i++) {

		gboolean match_by_uuid = FALSE;

		NMConnection *connection;

		const char *v;

		const char *v_num;

		connection = NM_CONNECTION (connections->pdata[i]);

		if (NM_IN_STRSET (filter_type, NULL, "uuid")) {

			v = nm_connection_get_uuid (connection);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v)) {

				match_by_uuid = TRUE;

				goto found;

			}

		}

		if (NM_IN_STRSET (filter_type, NULL, "id")) {

			v = nm_connection_get_id (connection);

			if (complete)

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "path")) {

			v = nm_connection_get_path (connection);

			v_num = nm_utils_dbus_path_get_last_component (v);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v, (*filter_val ? v_num : NULL));

			if (   nm_streq0 (filter_val, v)

			    || (filter_type && nm_streq0 (filter_val, v_num)))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "filename")) {

			v = nm_remote_connection_get_filename (NM_REMOTE_CONNECTION (connections->pdata[i]));

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v))

				goto found;

		}

		continue;

found:

		if (match_by_uuid) {

			if (   !complete

			    && !out_result)

				return connection;

			best_candidate_uuid = connection;

		} else {

			if (!best_candidate)

				best_candidate = connection;

		}

		if (out_result) {

			gboolean already_tracked = FALSE;

			if (!result) {

				result_allocated = g_ptr_array_new_with_free_func (g_object_unref);

				result = result_allocated;

			} else {

				for (j = 0; j < result->len; j++) {

					if (connection == result->pdata[j]) {

						already_tracked = TRUE;

						break;

					}

				}

			}

			if (!already_tracked) {

				if (match_by_uuid) {

					/* the profile is matched exactly (by UUID). We prepend it

					 * to the list of all found profiles. */

					g_ptr_array_insert (result, result_inital_len, g_object_ref (connection));

				} else

					g_ptr_array_add (result, g_object_ref (connection));

			}

		}

	}

	if (result_allocated)

		*out_result = g_steal_pointer (&result_allocated);

	return best_candidate_uuid ?: best_candidate;

}

NMActiveConnection *

nmc_find_active_connection (const GPtrArray *active_cons,

                            const char *filter_type,

                            const char *filter_val,

                            GPtrArray **out_result,

                            gboolean complete)

{

	guint i, j;

	NMActiveConnection *best_candidate = NULL;

	GPtrArray *result = out_result ? *out_result : NULL;

	nm_assert (filter_val);

	for (i = 0; i < active_cons->len; i++) {

		NMRemoteConnection *con;

		NMActiveConnection *candidate = g_ptr_array_index (active_cons, i);

		const char *v, *v_num;

		con = nm_active_connection_get_connection (candidate);

		/* When filter_type is NULL, compare connection ID (filter_val)

		 * against all types. Otherwise, only compare against the specific

		 * type. If 'path' or 'apath' filter types are specified, comparison

		 * against numeric index (in addition to the whole path) is allowed.

		 */

		if (NM_IN_STRSET (filter_type, NULL, "id")) {

			v = nm_active_connection_get_id (candidate);

			if (complete)

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "uuid")) {

			v = nm_active_connection_get_uuid (candidate);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "path")) {

			v = con ? nm_connection_get_path (NM_CONNECTION (con)) : NULL;

			v_num = nm_utils_dbus_path_get_last_component (v);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v, filter_type ? v_num : NULL);

			if (   nm_streq0 (filter_val, v)

			    || (filter_type && nm_streq0 (filter_val, v_num)))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "filename")) {

			v = nm_remote_connection_get_filename (con);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v);

			if (nm_streq0 (filter_val, v))

				goto found;

		}

		if (NM_IN_STRSET (filter_type, NULL, "apath")) {

			v = nm_object_get_path (NM_OBJECT (candidate));

			v_num = nm_utils_dbus_path_get_last_component (v);

			if (complete && (filter_type || *filter_val))

				nmc_complete_strings (filter_val, v, filter_type ? v_num : NULL);

			if (   nm_streq0 (filter_val, v)

			    || (filter_type && nm_streq0 (filter_val, v_num)))

				goto found;

		}

		continue;

found:

		if (!out_result)

			return candidate;

		if (!best_candidate)

			best_candidate = candidate;

		if (!result)

			result = g_ptr_array_new_with_free_func (g_object_unref);

		for (j = 0; j < result->len; j++) {

			if (candidate == result->pdata[j])

				break;

		}

		if (j == result->len)

			g_ptr_array_add (result, g_object_ref (candidate));

	}

	NM_SET_OUT (out_result, result);

	return best_candidate;

}

static gboolean

vpn_openconnect_get_secrets (NMConnection *connection, GPtrArray *secrets)

{

	GError *error = NULL;

	NMSettingVpn *s_vpn;

	const char *gw, *port;

	gs_free char *cookie = NULL;

	gs_free char *gateway = NULL;

	gs_free char *gwcert = NULL;

	int status = 0;

	int i;

	gboolean ret;

	if (!connection)

		return FALSE;

	if (!nm_connection_is_type (connection, NM_SETTING_VPN_SETTING_NAME))

		return FALSE;

	s_vpn = nm_connection_get_setting_vpn (connection);

	if (!nm_streq0 (nm_setting_vpn_get_service_type (s_vpn), NM_SECRET_AGENT_VPN_TYPE_OPENCONNECT))

		return FALSE;

	/* Get gateway and port */

	gw = nm_setting_vpn_get_data_item (s_vpn, "gateway");

	port = gw ? strrchr (gw, ':') : NULL;

	/* Interactively authenticate to OpenConnect server and get secrets */

	ret = nm_vpn_openconnect_authenticate_helper (gw, &cookie, &gateway, &gwcert, &status, &error);

	if (!ret) {

		g_printerr (_("Error: openconnect failed: %s\n"), error->message);

		g_clear_error (&error);

		return FALSE;

	}

	if (WIFEXITED (status)) {

		if (WEXITSTATUS (status) != 0)

			g_printerr (_("Error: openconnect failed with status %d\n"), WEXITSTATUS (status));

	} else if (WIFSIGNALED (status))

		g_printerr (_("Error: openconnect failed with signal %d\n"), WTERMSIG (status));

	/* Append port to the host value */

	if (gateway && port) {

		gs_free char *tmp = gateway;

		gateway = g_strdup_printf ("%s%s", tmp, port);

	}

	/* Fill secrets to the array */

	for (i = 0; i < secrets->len; i++) {

		NMSecretAgentSimpleSecret *secret = secrets->pdata[i];

		if (secret->secret_type != NM_SECRET_AGENT_SECRET_TYPE_VPN_SECRET)

			continue;

		if (!nm_streq0 (secret->vpn_type, NM_SECRET_AGENT_VPN_TYPE_OPENCONNECT))

			continue;

		if (nm_streq0 (secret->entry_id, NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS "cookie")) {

			g_free (secret->value);

			secret->value = g_steal_pointer (&cookie);

		} else if (nm_streq0 (secret->entry_id, NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS "gateway")) {

			g_free (secret->value);

			secret->value = g_steal_pointer (&gateway);

		} else if (nm_streq0 (secret->entry_id, NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS "gwcert")) {

			g_free (secret->value);

			secret->value = g_steal_pointer (&gwcert);

		}

	}

	return TRUE;

}

static gboolean

get_secrets_from_user (const NmcConfig *nmc_config,

                       const char *request_id,

                       const char *title,

                       const char *msg,

                       NMConnection *connection,

                       gboolean ask,

                       GHashTable *pwds_hash,

                       GPtrArray *secrets)

{

	int i;

	/* Check if there is a VPN OpenConnect secret to ask for */

	if (ask)

		vpn_openconnect_get_secrets (connection, secrets);

	for (i = 0; i < secrets->len; i++) {

		NMSecretAgentSimpleSecret *secret = secrets->pdata[i];

		char *pwd = NULL;

		/* First try to find the password in provided passwords file,

		 * then ask user. */

		if (pwds_hash && (pwd = g_hash_table_lookup (pwds_hash, secret->entry_id))) {

			pwd = g_strdup (pwd);

		} else {

			if (ask) {

				gboolean echo_on;

				if (secret->value) {

					if (!g_strcmp0 (secret->vpn_type, NM_DBUS_INTERFACE ".openconnect")) {

						/* Do not present and ask user for openconnect secrets, we already have them */

						continue;

					} else {

						/* Prefill the password if we have it. */

						rl_startup_hook = nmc_rl_set_deftext;

						nmc_rl_pre_input_deftext = g_strdup (secret->value);

					}

				}

				if (msg)

					g_print ("%s\n", msg);

				echo_on = secret->is_secret

				          ? nmc_config->show_secrets

				          : TRUE;

				if (secret->no_prompt_entry_id)

					pwd = nmc_readline_echo (nmc_config, echo_on, "%s: ", secret->pretty_name);

				else

					pwd = nmc_readline_echo (nmc_config, echo_on, "%s (%s): ", secret->pretty_name, secret->entry_id);

				if (!pwd)

					pwd = g_strdup ("");

			} else {

				if (msg)

					g_print ("%s\n", msg);

				g_printerr (_("Warning: password for '%s' not given in 'passwd-file' "

				              "and nmcli cannot ask without '--ask' option.\n"),

				            secret->entry_id);

			}

		}

		/* No password provided, cancel the secrets. */

		if (!pwd)

			return FALSE;

		nm_free_secret (secret->value);

		secret->value = pwd;

	}

	return TRUE;

}

/**

 * nmc_secrets_requested:

 * @agent: the #NMSecretAgentSimple

 * @request_id: request ID, to eventually pass to

 *   nm_secret_agent_simple_response()

 * @title: a title for the password request

 * @msg: a prompt message for the password request

 * @secrets: (element-type #NMSecretAgentSimpleSecret): array of secrets

 *   being requested.

 * @user_data: user data passed to the function

 *

 * This function is used as a callback for "request-secrets" signal of

 * NMSecretAgentSimpleSecret.

*/

void

nmc_secrets_requested (NMSecretAgentSimple *agent,

                       const char          *request_id,

                       const char          *title,

                       const char          *msg,

                       GPtrArray           *secrets,

                       gpointer             user_data)

{

	NmCli *nmc = (NmCli *) user_data;

	NMConnection *connection = NULL;

	char *path, *p;

	gboolean success = FALSE;

	const GPtrArray *connections;

	if (nmc->nmc_config.print_output == NMC_PRINT_PRETTY)

		nmc_terminal_erase_line ();

	/* Find the connection for the request */

	path = g_strdup (request_id);

	if (path) {

		p = strrchr (path, '/');

		if (p)

			*p = '\0';

		connections = nm_client_get_connections (nmc->client);

		connection = nmc_find_connection (connections, "path", path, NULL, FALSE);

		g_free (path);

	}

	success = get_secrets_from_user (&nmc->nmc_config,

	                                 request_id,

	                                 title,

	                                 msg,

	                                 connection,

	                                 nmc->nmc_config.in_editor || nmc->ask,

	                                 nmc->pwds_hash,

	                                 secrets);

	if (success)

		nm_secret_agent_simple_response (agent, request_id, secrets);

	else {

		/* Unregister our secret agent on failure, so that another agent

		 * may be tried */

		if (nmc->secret_agent) {

			nm_secret_agent_old_unregister (NM_SECRET_AGENT_OLD (nmc->secret_agent), NULL, NULL);

			g_clear_object (&nmc->secret_agent);

		}

	}

}

char *

nmc_unique_connection_name (const GPtrArray *connections, const char *try_name)

{

	NMConnection *connection;

	const char *name;

	char *new_name;

	unsigned num = 1;

	int i = 0;

	new_name = g_strdup (try_name);

	while (i < connections->len) {

		connection = NM_CONNECTION (connections->pdata[i]);

		name = nm_connection_get_id (connection);

		if (g_strcmp0 (new_name, name) == 0) {

			g_free (new_name);

			new_name = g_strdup_printf ("%s-%d", try_name, num++);

			i = 0;

		} else

			i++;

	}

	return new_name;

}

/* readline state variables */

static gboolean nmcli_in_readline = FALSE;

static gboolean rl_got_line;

static char *rl_string;

/**

 * nmc_cleanup_readline:

 *

 * Cleanup readline when nmcli is terminated with a signal.

 * It makes sure the terminal is not garbled.

 */

void

nmc_cleanup_readline (void)

{

	rl_free_line_state ();

	rl_cleanup_after_signal ();

}

gboolean

nmc_get_in_readline (void)

{

	return nmcli_in_readline;

}

void

nmc_set_in_readline (gboolean in_readline)

{

	nmcli_in_readline = in_readline;

}

static void

readline_cb (char *line)

{

	rl_got_line = TRUE;

	rl_string = line;

	rl_callback_handler_remove ();

}

static gboolean

stdin_ready_cb (int fd,

                GIOCondition condition,

                gpointer data)

{

	rl_callback_read_char ();

	return TRUE;

}

static char *

nmc_readline_helper (const NmcConfig *nmc_config,

                     const char *prompt)

{

	GSource *io_source;