/* SPDX-License-Identifier: GPL-2.0-or-later */

/*

 * Copyright (C) 2011 - 2015 Red Hat, Inc.

 * Copyright (C) 2011 Giovanni Campagna <scampa.giovanni@gmail.com>

 */

/**

 * SECTION:nm-secret-agent-simple

 * @short_description: A simple secret agent for NetworkManager

 *

 * #NMSecretAgentSimple is the secret agent used by nmtui-connect and nmcli.

 *

 * This is a stripped-down version of gnome-shell's ShellNetworkAgent,

 * with bits of the corresponding JavaScript code squished down into

 * it. It is intended to eventually be generic enough that it could

 * replace ShellNetworkAgent.

 */

#include "libnm/nm-default-client.h"

#include "nm-secret-agent-simple.h"

#include <gio/gunixoutputstream.h>

#include <gio/gunixinputstream.h>

#include "nm-vpn-service-plugin.h"

#include "nm-vpn-helpers.h"

#include "nm-glib-aux/nm-secret-utils.h"

/*****************************************************************************/

typedef struct {

    char *request_id;

    NMSecretAgentSimple *self;

    NMConnection *                 connection;

    const char *                   setting_name;

    char **                        hints;

    NMSecretAgentOldGetSecretsFunc callback;

    gpointer                       callback_data;

    GCancellable *                 cancellable;

    NMSecretAgentGetSecretsFlags   flags;

} RequestData;

enum {

    REQUEST_SECRETS,

    LAST_SIGNAL

};

static guint signals[LAST_SIGNAL] = {0};

typedef struct {

    GHashTable *requests;

    char *   path;

    gboolean enabled;

} NMSecretAgentSimplePrivate;

struct _NMSecretAgentSimple {

    NMSecretAgentOld           parent;

    NMSecretAgentSimplePrivate _priv;

};

struct _NMSecretAgentSimpleClass {

    NMSecretAgentOldClass parent;

};

G_DEFINE_TYPE(NMSecretAgentSimple, nm_secret_agent_simple, NM_TYPE_SECRET_AGENT_OLD)

#define NM_SECRET_AGENT_SIMPLE_GET_PRIVATE(self) \

    _NM_GET_PRIVATE(self, NMSecretAgentSimple, NM_IS_SECRET_AGENT_SIMPLE, NMSecretAgentOld)

/*****************************************************************************/

static void

_request_data_free(gpointer data)

{

    RequestData *request = data;

    g_free(request->request_id);

    nm_clear_g_cancellable(&request->cancellable);

    g_object_unref(request->connection);

    g_strfreev(request->hints);

    g_slice_free(RequestData, request);

}

static void

_request_data_complete(RequestData *   request,

                       GVariant *      secrets,

                       GError *        error,

                       GHashTableIter *iter_to_remove)

{

    NMSecretAgentSimple *       self = request->self;

    NMSecretAgentSimplePrivate *priv = NM_SECRET_AGENT_SIMPLE_GET_PRIVATE(self);

    nm_assert((secrets != NULL) != (error != NULL));

    request->callback(NM_SECRET_AGENT_OLD(request->self),

                      request->connection,

                      secrets,

                      error,

                      request->callback_data);

    if (iter_to_remove)

        g_hash_table_iter_remove(iter_to_remove);

    else

        g_hash_table_remove(priv->requests, request);

}

/*****************************************************************************/

/**

 * NMSecretAgentSimpleSecret:

 * @name: the user-visible name of the secret. Eg, "WEP Passphrase".

 * @value: the value of the secret

 * @password: %TRUE if this secret represents a password, %FALSE

 *   if it represents non-secret data.

 *

 * A single "secret" being requested.

 */

typedef struct {

    NMSecretAgentSimpleSecret base;

    NMSetting *               setting;

    char *                    property;

} SecretReal;

static void

_secret_real_free(NMSecretAgentSimpleSecret *secret)

{

    SecretReal *real = (SecretReal *) secret;

    g_free((char *) secret->pretty_name);

    g_free((char *) secret->entry_id);

    nm_free_secret(secret->value);

    g_free((char *) secret->vpn_type);

    g_free(real->property);

    g_clear_object(&real->setting);

    g_slice_free(SecretReal, real);

}

static NMSecretAgentSimpleSecret *

_secret_real_new_plain(NMSecretAgentSecretType secret_type,

                       const char *            pretty_name,

                       NMSetting *             setting,

                       const char *            property)

{

    SecretReal *  real;

    gs_free char *value = NULL;

    nm_assert(property);

    nm_assert(NM_IS_SETTING(setting));

    nm_assert(NM_IN_SET(secret_type,

                        NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,

                        NM_SECRET_AGENT_SECRET_TYPE_SECRET));

    nm_assert(g_object_class_find_property(G_OBJECT_GET_CLASS(setting), property));

    nm_assert((secret_type == NM_SECRET_AGENT_SECRET_TYPE_SECRET)

              == nm_setting_get_secret_flags(setting, property, NULL, NULL));

    g_object_get(setting, property, &value, NULL);

    real  = g_slice_new(SecretReal);

    *real = (SecretReal){

        .base.secret_type = secret_type,

        .base.pretty_name = g_strdup(pretty_name),

        .base.entry_id    = g_strdup_printf("%s.%s", nm_setting_get_name(setting), property),

        .base.value       = g_steal_pointer(&value),

        .base.is_secret   = (secret_type != NM_SECRET_AGENT_SECRET_TYPE_PROPERTY),

        .setting          = g_object_ref(setting),

        .property         = g_strdup(property),

    };

    return &real->base;

}

static NMSecretAgentSimpleSecret *

_secret_real_new_vpn_secret(const char *pretty_name,

                            NMSetting * setting,

                            const char *property,

                            const char *vpn_type)

{

    SecretReal *real;

    const char *value;

    nm_assert(property);

    nm_assert(NM_IS_SETTING_VPN(setting));

    nm_assert(vpn_type);

    value = nm_setting_vpn_get_secret(NM_SETTING_VPN(setting), property);

    real  = g_slice_new(SecretReal);

    *real = (SecretReal){

        .base.secret_type = NM_SECRET_AGENT_SECRET_TYPE_VPN_SECRET,

        .base.pretty_name = g_strdup(pretty_name),

        .base.entry_id =

            g_strdup_printf("%s%s", NM_SECRET_AGENT_ENTRY_ID_PREFX_VPN_SECRETS, property),

        .base.value     = g_strdup(value),

        .base.is_secret = TRUE,

        .base.vpn_type  = g_strdup(vpn_type),

        .setting        = g_object_ref(setting),

        .property       = g_strdup(property),

    };

    return &real->base;

}

static NMSecretAgentSimpleSecret *

_secret_real_new_wireguard_peer_psk(NMSettingWireGuard *s_wg,

                                    const char *        public_key,

                                    const char *        preshared_key)

{

    SecretReal *real;

    nm_assert(NM_IS_SETTING_WIREGUARD(s_wg));

    nm_assert(public_key);

    real  = g_slice_new(SecretReal);

    *real = (SecretReal){

        .base.secret_type        = NM_SECRET_AGENT_SECRET_TYPE_WIREGUARD_PEER_PSK,

        .base.pretty_name        = g_strdup_printf(_("Preshared-key for %s"), public_key),

        .base.entry_id           = g_strdup_printf(NM_SETTING_WIREGUARD_SETTING_NAME

                                         "." NM_SETTING_WIREGUARD_PEERS

                                         ".%s." NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY,

                                         public_key),

        .base.value              = g_strdup(preshared_key),

        .base.is_secret          = TRUE,

        .base.no_prompt_entry_id = TRUE,

        .setting                 = NM_SETTING(g_object_ref(s_wg)),

        .property                = g_strdup(public_key),

    };

    return &real->base;

}

/*****************************************************************************/

static gboolean

add_8021x_secrets(RequestData *request, GPtrArray *secrets)

{

    NMSetting8021x *           s_8021x = nm_connection_get_setting_802_1x(request->connection);

    const char *               eap_method;

    NMSecretAgentSimpleSecret *secret;

    /* If hints are given, then always ask for what the hints require */

    if (request->hints && request->hints[0]) {

        char **iter;

        for (iter = request->hints; *iter; iter++) {

            secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                            _(*iter),

                                            NM_SETTING(s_8021x),

                                            *iter);

            g_ptr_array_add(secrets, secret);

        }

        return TRUE;

    }

    eap_method = nm_setting_802_1x_get_eap_method(s_8021x, 0);

    if (!eap_method)

        return FALSE;

    if (NM_IN_STRSET(eap_method, "md5", "leap", "ttls", "peap")) {

        /* TTLS and PEAP are actually much more complicated, but this complication

         * is not visible here since we only care about phase2 authentication

         * (and don't even care of which one)

         */

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,

                                        _("Username"),

                                        NM_SETTING(s_8021x),

                                        NM_SETTING_802_1X_IDENTITY);

        g_ptr_array_add(secrets, secret);

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                        _("Password"),

                                        NM_SETTING(s_8021x),

                                        NM_SETTING_802_1X_PASSWORD);

        g_ptr_array_add(secrets, secret);

        return TRUE;

    }

    if (nm_streq(eap_method, "tls")) {

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,

                                        _("Identity"),

                                        NM_SETTING(s_8021x),

                                        NM_SETTING_802_1X_IDENTITY);

        g_ptr_array_add(secrets, secret);

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                        _("Private key password"),

                                        NM_SETTING(s_8021x),

                                        NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD);

        g_ptr_array_add(secrets, secret);

        return TRUE;

    }

    return FALSE;

}

static gboolean

add_wireless_secrets(RequestData *request, GPtrArray *secrets)

{

    NMSettingWirelessSecurity *s_wsec =

        nm_connection_get_setting_wireless_security(request->connection);

    const char *               key_mgmt = nm_setting_wireless_security_get_key_mgmt(s_wsec);

    NMSecretAgentSimpleSecret *secret;

    if (!key_mgmt || nm_streq(key_mgmt, "owe"))

        return FALSE;

    if (NM_IN_STRSET(key_mgmt, "wpa-psk", "sae")) {

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                        _("Password"),

                                        NM_SETTING(s_wsec),

                                        NM_SETTING_WIRELESS_SECURITY_PSK);

        g_ptr_array_add(secrets, secret);

        return TRUE;

    }

    if (nm_streq(key_mgmt, "none")) {

        guint32 index;

        char    key[100];

        index  = nm_setting_wireless_security_get_wep_tx_keyidx(s_wsec);

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                        _("Key"),

                                        NM_SETTING(s_wsec),

                                        nm_sprintf_buf(key, "wep-key%u", (guint) index));

        g_ptr_array_add(secrets, secret);

        return TRUE;

    }

    if (nm_streq(key_mgmt, "iee8021x")) {

        if (nm_streq0(nm_setting_wireless_security_get_auth_alg(s_wsec), "leap")) {

            secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                            _("Password"),

                                            NM_SETTING(s_wsec),

                                            NM_SETTING_WIRELESS_SECURITY_LEAP_PASSWORD);

            g_ptr_array_add(secrets, secret);

            return TRUE;

        } else

            return add_8021x_secrets(request, secrets);

    }

    if (nm_streq(key_mgmt, "wpa-eap") || nm_streq(key_mgmt, "wpa-eap-suite-b-192"))

        return add_8021x_secrets(request, secrets);

    return FALSE;

}

static gboolean

add_pppoe_secrets(RequestData *request, GPtrArray *secrets)

{

    NMSettingPppoe *           s_pppoe = nm_connection_get_setting_pppoe(request->connection);

    NMSecretAgentSimpleSecret *secret;

    secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,

                                    _("Username"),

                                    NM_SETTING(s_pppoe),

                                    NM_SETTING_PPPOE_USERNAME);

    g_ptr_array_add(secrets, secret);

    secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_PROPERTY,

                                    _("Service"),

                                    NM_SETTING(s_pppoe),

                                    NM_SETTING_PPPOE_SERVICE);

    g_ptr_array_add(secrets, secret);

    secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                    _("Password"),

                                    NM_SETTING(s_pppoe),

                                    NM_SETTING_PPPOE_PASSWORD);

    g_ptr_array_add(secrets, secret);

    return TRUE;

}

static NMSettingSecretFlags

get_vpn_secret_flags(NMSettingVpn *s_vpn, const char *secret_name)

{

    NMSettingSecretFlags flags = NM_SETTING_SECRET_FLAG_NONE;

    GHashTable *         vpn_data;

    g_object_get(s_vpn, NM_SETTING_VPN_DATA, &vpn_data, NULL);

    nm_vpn_service_plugin_get_secret_flags(vpn_data, secret_name, &flags);

    g_hash_table_unref(vpn_data);

    return flags;

}

static void

add_vpn_secret_helper(GPtrArray *   secrets,

                      NMSettingVpn *s_vpn,

                      const char *  name,

                      const char *  ui_name)

{

    NMSecretAgentSimpleSecret *secret;

    NMSettingSecretFlags       flags;

    int                        i;

    flags = get_vpn_secret_flags(s_vpn, name);

    if (flags & NM_SETTING_SECRET_FLAG_AGENT_OWNED || flags & NM_SETTING_SECRET_FLAG_NOT_SAVED) {

        secret = _secret_real_new_vpn_secret(ui_name,

                                             NM_SETTING(s_vpn),

                                             name,

                                             nm_setting_vpn_get_service_type(s_vpn));

        /* Check for duplicates */

        for (i = 0; i < secrets->len; i++) {

            NMSecretAgentSimpleSecret *s = secrets->pdata[i];

            if (s->secret_type == secret->secret_type && nm_streq0(s->vpn_type, secret->vpn_type)

                && nm_streq0(s->entry_id, secret->entry_id)) {

                _secret_real_free(secret);

                return;

            }

        }

        g_ptr_array_add(secrets, secret);

    }

}

#define VPN_MSG_TAG "x-vpn-message:"

static gboolean

add_vpn_secrets(RequestData *request, GPtrArray *secrets, char **msg)

{

    NMSettingVpn *            s_vpn = nm_connection_get_setting_vpn(request->connection);

    const NmcVpnPasswordName *p;

    const char *              vpn_msg = NULL;

    char **                   iter;

    /* If hints are given, then always ask for what the hints require */

    if (request->hints) {

        for (iter = request->hints; *iter; iter++) {

            if (!vpn_msg && g_str_has_prefix(*iter, VPN_MSG_TAG))

                vpn_msg = &(*iter)[NM_STRLEN(VPN_MSG_TAG)];

            else

                add_vpn_secret_helper(secrets, s_vpn, *iter, *iter);

        }

    }

    NM_SET_OUT(msg, g_strdup(vpn_msg));

    /* Now add what client thinks might be required, because hints may be empty or incomplete */

    p = nm_vpn_get_secret_names(nm_setting_vpn_get_service_type(s_vpn));

    while (p && p->name) {

        add_vpn_secret_helper(secrets, s_vpn, p->name, _(p->ui_name));

        p++;

    }

    return TRUE;

}

static gboolean

add_wireguard_secrets(RequestData *request, GPtrArray *secrets, char **msg, GError **error)

{

    NMSettingWireGuard *       s_wg;

    NMSecretAgentSimpleSecret *secret;

    guint                      i;

    s_wg = NM_SETTING_WIREGUARD(

        nm_connection_get_setting(request->connection, NM_TYPE_SETTING_WIREGUARD));

    if (!s_wg) {

        g_set_error(error,

                    NM_SECRET_AGENT_ERROR,

                    NM_SECRET_AGENT_ERROR_FAILED,

                    "Cannot service a WireGuard secrets request %s for a connection without "

                    "WireGuard settings",

                    request->request_id);

        return FALSE;

    }

    if (!request->hints || !request->hints[0]

        || g_strv_contains(NM_CAST_STRV_CC(request->hints), NM_SETTING_WIREGUARD_PRIVATE_KEY)) {

        secret = _secret_real_new_plain(NM_SECRET_AGENT_SECRET_TYPE_SECRET,

                                        _("WireGuard private-key"),

                                        NM_SETTING(s_wg),

                                        NM_SETTING_WIREGUARD_PRIVATE_KEY);

        g_ptr_array_add(secrets, secret);

    }

    if (request->hints) {

        for (i = 0; request->hints[i]; i++) {

            NMWireGuardPeer *peer;

            const char *     name       = request->hints[i];

            gs_free char *   public_key = NULL;

            if (nm_streq(name, NM_SETTING_WIREGUARD_PRIVATE_KEY))

                continue;

            if (NM_STR_HAS_PREFIX(name, NM_SETTING_WIREGUARD_PEERS ".")) {

                const char *tmp;

                tmp = &name[NM_STRLEN(NM_SETTING_WIREGUARD_PEERS ".")];

                if (NM_STR_HAS_SUFFIX(tmp, "." NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY)) {

                    public_key = g_strndup(

                        tmp,

                        strlen(tmp) - NM_STRLEN("." NM_WIREGUARD_PEER_ATTR_PRESHARED_KEY));

                }

            }

            if (!public_key)

                continue;

            peer = nm_setting_wireguard_get_peer_by_public_key(s_wg, public_key, NULL);

            g_ptr_array_add(secrets,

                            _secret_real_new_wireguard_peer_psk(

                                s_wg,

                                (peer ? nm_wireguard_peer_get_public_key(peer) : public_key),

                                (peer ? nm_wireguard_peer_get_preshared_key(peer) : NULL)));

        }

    }

    *msg = g_strdup_printf(_("Secrets are required to connect WireGuard VPN '%s'"),

                           nm_connection_get_id(request->connection));

    return TRUE;

}

typedef struct {

    GPid           auth_dialog_pid;

    GString *      auth_dialog_response;

    RequestData *  request;

    GPtrArray *    secrets;

    GCancellable * cancellable;

    gulong         cancellable_id;

    guint          child_watch_id;

    GInputStream * input_stream;

    GOutputStream *output_stream;

    char           read_buf[5];

} AuthDialogData;

static void

_auth_dialog_data_free(AuthDialogData *data)

{

    nm_clear_g_signal_handler(data->cancellable, &data->cancellable_id);

    g_clear_object(&data->cancellable);

    nm_clear_g_source(&data->child_watch_id);

    g_ptr_array_unref(data->secrets);

    g_spawn_close_pid(data->auth_dialog_pid);

    g_string_free(data->auth_dialog_response, TRUE);

    g_object_unref(data->input_stream);

    g_object_unref(data->output_stream);

    g_slice_free(AuthDialogData, data);

}

static void

_auth_dialog_exited(GPid pid, int status, gpointer user_data)

{

    AuthDialogData *      data              = user_data;

    RequestData *         request           = data->request;

    GPtrArray *           secrets           = data->secrets;

    NMSettingVpn *        s_vpn             = nm_connection_get_setting_vpn(request->connection);

    nm_auto_unref_keyfile GKeyFile *keyfile = NULL;

    gs_strfreev char **             groups  = NULL;

    gs_free char *                  title   = NULL;

    gs_free char *                  message = NULL;

    int                             i;

    gs_free_error GError *error = NULL;

    data->child_watch_id = 0;

    nm_clear_g_cancellable_disconnect(data->cancellable, &data->cancellable_id);

    if (status != 0) {

        g_set_error(&error,

                    NM_SECRET_AGENT_ERROR,

                    NM_SECRET_AGENT_ERROR_FAILED,

                    "Auth dialog failed with error code %d\n",

                    status);

        goto out;

    }

    keyfile = g_key_file_new();

    if (!g_key_file_load_from_data(keyfile,

                                   data->auth_dialog_response->str,

                                   data->auth_dialog_response->len,

                                   G_KEY_FILE_NONE,

                                   &error)) {

        goto out;

    }

    groups = g_key_file_get_groups(keyfile, NULL);

    if (!nm_streq0(groups[0], "VPN Plugin UI")) {

        g_set_error(&error,

                    NM_SECRET_AGENT_ERROR,

                    NM_SECRET_AGENT_ERROR_FAILED,

                    "Expected [VPN Plugin UI] in auth dialog response");

        goto out;

    }

    title = g_key_file_get_string(keyfile, "VPN Plugin UI", "Title", &error);

    if (!title)

        goto out;

    message = g_key_file_get_string(keyfile, "VPN Plugin UI", "Description", &error);

    if (!message)

        goto out;

    for (i = 1; groups[i]; i++) {

        gs_free char *pretty_name = NULL;

        if (!g_key_file_get_boolean(keyfile, groups[i], "IsSecret", NULL))

            continue;

        if (!g_key_file_get_boolean(keyfile, groups[i], "ShouldAsk", NULL))

            continue;

        pretty_name = g_key_file_get_string(keyfile, groups[i], "Label", NULL);

        g_ptr_array_add(secrets,

                        _secret_real_new_vpn_secret(pretty_name,

                                                    NM_SETTING(s_vpn),

                                                    groups[i],

                                                    nm_setting_vpn_get_service_type(s_vpn)));

    }

out:

    /* Try to fall back to the hardwired VPN support if the auth dialog fails.

     * We may eventually get rid of the whole hardwired secrets handling at some point,

     * when the auth helpers are goode enough.. */

    if (error && add_vpn_secrets(request, secrets, &message)) {

        g_clear_error(&error);

        if (!message) {

            message = g_strdup_printf(_("A password is required to connect to '%s'."),

                                      nm_connection_get_id(request->connection));

        }

    }

    if (error)

        _request_data_complete(request, NULL, error, NULL);

    else {

        g_signal_emit(request->self,

                      signals[REQUEST_SECRETS],

                      0,

                      request->request_id,

                      title,

                      message,

                      secrets);

    }

    _auth_dialog_data_free(data);

}

static void

_request_cancelled(GObject *object, gpointer user_data)

{

    _auth_dialog_data_free(user_data);

}

static void

_auth_dialog_read_done(GObject *source_object, GAsyncResult *res, gpointer user_data)

{

    GInputStream *  auth_dialog_out = G_INPUT_STREAM(source_object);

    AuthDialogData *data            = user_data;

    gssize          read_size;

    gs_free_error GError *error = NULL;

    read_size = g_input_stream_read_finish(auth_dialog_out, res, &error);

    switch (read_size) {

    case -1:

        if (!g_error_matches(error, G_IO_ERROR, G_IO_ERROR_CANCELLED))

            _request_data_complete(data->request, NULL, error, NULL);

        _auth_dialog_data_free(data);

        break;

    case 0:

        /* Done reading. Let's wait for the auth dialog to exit so that we're able to collect the status.

         * Remember we can be cancelled in between. */

        data->child_watch_id = g_child_watch_add(data->auth_dialog_pid, _auth_dialog_exited, data);

        data->cancellable    = g_object_ref(data->request->cancellable);

        data->cancellable_id =

            g_cancellable_connect(data->cancellable, G_CALLBACK(_request_cancelled), data, NULL);

        break;

    default:

        g_string_append_len(data->auth_dialog_response, data->read_buf, read_size);

        g_input_stream_read_async(auth_dialog_out,

                                  data->read_buf,

                                  sizeof(data->read_buf),

                                  G_PRIORITY_DEFAULT,

                                  NULL,

                                  _auth_dialog_read_done,

                                  data);

        return;

    }

    g_input_stream_close(auth_dialog_out, NULL, NULL);

}

static void

_auth_dialog_write_done(GObject *source_object, GAsyncResult *res, gpointer user_data)

{

    GOutputStream *auth_dialog_out                    = G_OUTPUT_STREAM(source_object);

    _nm_unused gs_free char *auth_dialog_request_free = user_data;

    /* We don't care about write errors. If there are any problems, the

     * reader shall notice. */

    g_output_stream_write_finish(auth_dialog_out, res, NULL);

    g_output_stream_close(auth_dialog_out, NULL, NULL);

}

static void

_add_to_string(GString *string, const char *key, const char *value)

{

    gs_strfreev char **lines = NULL;

    int                i;

    lines = g_strsplit(value, "\n", -1);

    g_string_append(string, key);

    for (i = 0; lines[i]; i++) {

        g_string_append_c(string, '=');

        g_string_append(string, lines[i]);

        g_string_append_c(string, '\n');

    }

}

static void

_add_data_item_to_string(const char *key, const char *value, gpointer user_data)

{

    GString *string = user_data;

    _add_to_string(string, "DATA_KEY", key);

    _add_to_string(string, "DATA_VAL", value);

    g_string_append_c(string, '\n');

}

static void

_add_secret_to_string(const char *key, const char *value, gpointer user_data)

{

    GString *string = user_data;

    _add_to_string(string, "SECRET_KEY", key);

    _add_to_string(string, "SECRET_VAL", value);

    g_string_append_c(string, '\n');

}

static gboolean

try_spawn_vpn_auth_helper(RequestData *request, GPtrArray *secrets)

{

    NMSettingVpn *    s_vpn = nm_connection_get_setting_vpn(request->connection);

    gs_unref_ptrarray GPtrArray *auth_dialog_argv = NULL;

    NMVpnPluginInfo *            plugin_info;

    const char *                 s;

    GPid                         auth_dialog_pid;

    int                          auth_dialog_in_fd;

    int                          auth_dialog_out_fd;

    GOutputStream *              auth_dialog_in;

    GInputStream *               auth_dialog_out;

    GError *                     error = NULL;

    GString *                    auth_dialog_request;

    char *                       auth_dialog_request_str;

    gsize                        auth_dialog_request_len;

    AuthDialogData *             data;

    int                          i;

    plugin_info = nm_vpn_plugin_info_list_find_by_service(nm_vpn_get_plugin_infos(),

                                                          nm_setting_vpn_get_service_type(s_vpn));

    if (!plugin_info)

        return FALSE;

    s = nm_vpn_plugin_info_lookup_property(plugin_info, "GNOME", "supports-external-ui-mode");

    if (!_nm_utils_ascii_str_to_bool(s, FALSE))

        return FALSE;

    auth_dialog_argv = g_ptr_array_new();

    s = nm_vpn_plugin_info_lookup_property(plugin_info, "GNOME", "auth-dialog");

    g_return_val_if_fail(s, FALSE);

    g_ptr_array_add(auth_dialog_argv, (gpointer) s);

    g_ptr_array_add(auth_dialog_argv, "-u");

    g_ptr_array_add(auth_dialog_argv, (gpointer) nm_connection_get_uuid(request->connection));

    g_ptr_array_add(auth_dialog_argv, "-n");

    g_ptr_array_add(auth_dialog_argv, (gpointer) nm_connection_get_id(request->connection));

    g_ptr_array_add(auth_dialog_argv, "-s");

    g_ptr_array_add(auth_dialog_argv, (gpointer) nm_setting_vpn_get_service_type(s_vpn));

    g_ptr_array_add(auth_dialog_argv, "--external-ui-mode");

    g_ptr_array_add(auth_dialog_argv, "-i");

    if (request->flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW)

        g_ptr_array_add(auth_dialog_argv, "-r");

    s = nm_vpn_plugin_info_lookup_property(plugin_info, "GNOME", "supports-hints");

    if (_nm_utils_ascii_str_to_bool(s, FALSE)) {

        for (i = 0; request->hints[i]; i++) {

            g_ptr_array_add(auth_dialog_argv, "-t");

            g_ptr_array_add(auth_dialog_argv, request->hints[i]);

        }

    }

    g_ptr_array_add(auth_dialog_argv, NULL);

    if (!g_spawn_async_with_pipes(NULL,

                                  (char **) auth_dialog_argv->pdata,

                                  NULL,

                                  G_SPAWN_DO_NOT_REAP_CHILD,

                                  NULL,

                                  NULL,

                                  &auth_dialog_pid,

                                  &auth_dialog_in_fd,

                                  &auth_dialog_out_fd,

                                  NULL,

                                  &error)) {

        g_warning("Failed to spawn the auth dialog%s\n", error->message);

        return FALSE;

    }

    auth_dialog_in  = g_unix_output_stream_new(auth_dialog_in_fd, TRUE);

    auth_dialog_out = g_unix_input_stream_new(auth_dialog_out_fd, TRUE);

    auth_dialog_request = g_string_new_len(NULL, 1024);

    nm_setting_vpn_foreach_data_item(s_vpn, _add_data_item_to_string, auth_dialog_request);

    nm_setting_vpn_foreach_secret(s_vpn, _add_secret_to_string, auth_dialog_request);

    g_string_append(auth_dialog_request, "DONE\nQUIT\n");

    auth_dialog_request_len = auth_dialog_request->len;

    auth_dialog_request_str = g_string_free(auth_dialog_request, FALSE);

    data  = g_slice_new(AuthDialogData);

    *data = (AuthDialogData){

        .auth_dialog_response = g_string_new_len(NULL, sizeof(data->read_buf)),

        .auth_dialog_pid      = auth_dialog_pid,

        .request              = request,

        .secrets              = g_ptr_array_ref(secrets),

        .input_stream         = auth_dialog_out,

        .output_stream        = auth_dialog_in,

    };

    g_output_stream_write_async(auth_dialog_in,

                                auth_dialog_request_str,

                                auth_dialog_request_len,

                                G_PRIORITY_DEFAULT,

                                request->cancellable,

                                _auth_dialog_write_done,

                                auth_dialog_request_str);

    g_input_stream_read_async(auth_dialog_out,

                              data->read_buf,

                              sizeof(data->read_buf),

                              G_PRIORITY_DEFAULT,

                              request->cancellable,

                              _auth_dialog_read_done,

                              data);

    return TRUE;

}

static void

request_secrets_from_ui(RequestData *request)

{

    gs_unref_ptrarray GPtrArray *secrets = NULL;

    gs_free_error GError *      error    = NULL;

    NMSecretAgentSimplePrivate *priv;

    NMSecretAgentSimpleSecret * secret;

    const char *                title;

    gs_free char *              msg = NULL;

    priv = NM_SECRET_AGENT_SIMPLE_GET_PRIVATE(request->self);

    g_return_if_fail(priv->enabled);

    /* We only handle requests for connection with @path if set. */

    if (priv->path && !g_str_has_prefix(request->request_id, priv->path)) {

        g_set_error(&error,

                    NM_SECRET_AGENT_ERROR,

                    NM_SECRET_AGENT_ERROR_FAILED,

                    "Request for %s secrets doesn't match path %s",

                    request->request_id,

                    priv->path);

        goto out_fail_error;

    }

    secrets = g_ptr_array_new_with_free_func((GDestroyNotify) _secret_real_free);

    if (nm_connection_is_type(request->connection, NM_SETTING_WIRELESS_SETTING_NAME)) {

        NMSettingWireless *s_wireless;

        GBytes *           ssid;

        char *             ssid_utf8;

        s_wireless = nm_connection_get_setting_wireless(request->connection);

        ssid       = nm_setting_wireless_get_ssid(s_wireless);

        ssid_utf8  = nm_utils_ssid_to_utf8(g_bytes_get_data(ssid, NULL), g_bytes_get_size(ssid));

        title = _("Authentication required by wireless network");

        msg   = g_strdup_printf(

            _("Passwords or encryption keys are required to access the wireless network '%s'."),

            ssid_utf8);