// SPDX-License-Identifier: GPL-2.0+
/* NetworkManager Applet -- allow user control over networking
 *
 * Dan Williams <dcbw@redhat.com>
 *
 * Copyright 2007 - 2014 Red Hat, Inc.
 */

#include "nm-default.h"

#include <ctype.h>
#include <string.h>

#include "eap-method.h"
#include "wireless-security.h"
#include "helpers.h"
#include "nma-ui-utils.h"
#include "utils.h"

struct _EAPMethodSimple {
	EAPMethod parent;

	WirelessSecurity *ws_parent;

	const char *password_flags_name;
	EAPMethodSimpleType type;
	EAPMethodSimpleFlags flags;

	gboolean username_requested;
	gboolean password_requested;
	gboolean pkey_passphrase_requested;
	GtkEntry *username_entry;
	GtkEntry *password_entry;
	GtkToggleButton *show_password;
	GtkEntry *pkey_passphrase_entry;
	GtkToggleButton *show_pkey_passphrase;
	guint idle_func_id;
};

static void
show_password_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
{
	gboolean visible;

	visible = gtk_toggle_button_get_active (button);
	gtk_entry_set_visibility (method->password_entry, visible);
}

static void
show_pkey_passphrase_toggled_cb (GtkToggleButton *button, EAPMethodSimple *method)
{
	gboolean visible;

	visible = gtk_toggle_button_get_active (button);
	gtk_entry_set_visibility (method->pkey_passphrase_entry, visible);
}

static gboolean
always_ask_selected (GtkEntry *passwd_entry)
{
	return !!(  nma_utils_menu_to_secret_flags (GTK_WIDGET (passwd_entry))
	          & NM_SETTING_SECRET_FLAG_NOT_SAVED);
}

static gboolean
validate (EAPMethod *parent, GError **error)
{
	EAPMethodSimple *method = (EAPMethodSimple *)parent;
	const char *text;
	gboolean ret = TRUE;

	if (method->username_requested) {
		text = gtk_entry_get_text (method->username_entry);
		if (!text || !strlen (text)) {
			widget_set_error (GTK_WIDGET (method->username_entry));
			g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC, _("missing EAP username"));
			ret = FALSE;
		} else
			widget_unset_error (GTK_WIDGET (method->username_entry));
	}

	/* Check if the password should always be requested */
	if (method->password_requested) {
		if (always_ask_selected (method->password_entry))
			widget_unset_error (GTK_WIDGET (method->password_entry));
		else {
			text = gtk_entry_get_text (method->password_entry);
			if (!text || !strlen (text)) {
				widget_set_error (GTK_WIDGET (method->password_entry));
				if (ret) {
					g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC,
					                     _("missing EAP password"));
					ret = FALSE;
				}
			} else
				widget_unset_error (GTK_WIDGET (method->password_entry));
		}
	}

	if (method->pkey_passphrase_requested) {
		text = gtk_entry_get_text (method->pkey_passphrase_entry);
		if (!text || !strlen (text)) {
			widget_set_error (GTK_WIDGET (method->pkey_passphrase_entry));
			if (ret) {
				g_set_error_literal (error, NMA_ERROR, NMA_ERROR_GENERIC,
				                     _("missing EAP client Private Key passphrase"));
				ret = FALSE;
			}
		} else
			widget_unset_error (GTK_WIDGET (method->pkey_passphrase_entry));
	}

	return ret;
}

static void
add_to_size_group (EAPMethod *parent, GtkSizeGroup *group)
{
	EAPMethodSimple *method = (EAPMethodSimple *) parent;
	GtkWidget *widget;

	if (method->username_requested) {
		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_label"));
		g_assert (widget);
		gtk_size_group_add_widget (group, widget);
	}

	if (method->password_requested) {
		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_label"));
		g_assert (widget);
		gtk_size_group_add_widget (group, widget);
	}

	if (method->pkey_passphrase_requested) {
		widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_label"));
		g_assert (widget);
		gtk_size_group_add_widget (group, widget);
	}
}

typedef struct {
	const char *name;
	gboolean autheap_allowed;
} EapType;

/* Indexed by EAP_METHOD_SIMPLE_TYPE_* */
static const EapType eap_table[EAP_METHOD_SIMPLE_TYPE_LAST] = {
	[EAP_METHOD_SIMPLE_TYPE_PAP]             = { "pap",      FALSE },
	[EAP_METHOD_SIMPLE_TYPE_MSCHAP]          = { "mschap",   FALSE },
	[EAP_METHOD_SIMPLE_TYPE_MSCHAP_V2]       = { "mschapv2", TRUE  },
	[EAP_METHOD_SIMPLE_TYPE_PLAIN_MSCHAP_V2] = { "mschapv2", FALSE },
	[EAP_METHOD_SIMPLE_TYPE_MD5]             = { "md5",      TRUE  },
	[EAP_METHOD_SIMPLE_TYPE_PWD]             = { "pwd",      TRUE  },
	[EAP_METHOD_SIMPLE_TYPE_CHAP]            = { "chap",     FALSE },
	[EAP_METHOD_SIMPLE_TYPE_GTC]             = { "gtc",      TRUE  },
	[EAP_METHOD_SIMPLE_TYPE_UNKNOWN]         = { "unknown",  TRUE  },
};

static void
fill_connection (EAPMethod *parent, NMConnection *connection)
{
	EAPMethodSimple *method = (EAPMethodSimple *) parent;
	NMSetting8021x *s_8021x;
	gboolean not_saved = FALSE;
	NMSettingSecretFlags flags;
	const EapType *eap_type;

	s_8021x = nm_connection_get_setting_802_1x (connection);
	g_assert (s_8021x);

	if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)) {
		/* If this is the main EAP method, clear any existing methods because the
		 * user-selected one will replace it.
		 */
		if (parent->phase2 == FALSE)
			nm_setting_802_1x_clear_eap_methods (s_8021x);

		eap_type = &eap_table[method->type];
		if (parent->phase2) {
			/* If the outer EAP method (TLS, TTLS, PEAP, etc) allows inner/phase2
			 * EAP methods (which only TTLS allows) *and* the inner/phase2 method
			 * supports being an inner EAP method, then set PHASE2_AUTHEAP.
			 * Otherwise the inner/phase2 method goes into PHASE2_AUTH.
			 */
			if ((method->flags & EAP_METHOD_SIMPLE_FLAG_AUTHEAP_ALLOWED) && eap_type->autheap_allowed) {
				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, eap_type->name, NULL);
				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, NULL, NULL);
			} else {
				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTH, eap_type->name, NULL);
				g_object_set (s_8021x, NM_SETTING_802_1X_PHASE2_AUTHEAP, NULL, NULL);
			}
		} else
			nm_setting_802_1x_add_eap_method (s_8021x, eap_type->name);
	}

	if (method->username_requested)
		g_object_set (s_8021x, NM_SETTING_802_1X_IDENTITY, gtk_entry_get_text (method->username_entry), NULL);

	if (method->password_requested) {
		/* Save the password always ask setting */
		not_saved = always_ask_selected (method->password_entry);
		flags = nma_utils_menu_to_secret_flags (GTK_WIDGET (method->password_entry));
		nm_setting_set_secret_flags (NM_SETTING (s_8021x), method->password_flags_name, flags, NULL);

		/* Fill the connection's password if we're in the applet so that it'll get
		 * back to NM.  From the editor though, since the connection isn't going
		 * back to NM in response to a GetSecrets() call, we don't save it if the
		 * user checked "Always Ask".
		 */
		if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_IS_EDITOR) || not_saved == FALSE) {
			g_object_set (s_8021x, NM_SETTING_802_1X_PASSWORD,
			              gtk_entry_get_text (method->password_entry), NULL);
		}

		/* Update secret flags and popup when editing the connection */
		if (!(method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)) {
			GtkWidget *passwd_entry = GTK_WIDGET (gtk_builder_get_object (parent->builder,
			                                                              "eap_simple_password_entry"));
			g_assert (passwd_entry);

			nma_utils_update_password_storage (passwd_entry, flags,
			                                   NM_SETTING (s_8021x), method->password_flags_name);
		}
	}

	if (method->pkey_passphrase_requested) {
		g_object_set (s_8021x, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD,
		              gtk_entry_get_text (method->pkey_passphrase_entry), NULL);
	}
}

static void
update_secrets (EAPMethod *parent, NMConnection *connection)
{
	helper_fill_secret_entry (connection,
	                          parent->builder,
	                          "eap_simple_password_entry",
	                          NM_TYPE_SETTING_802_1X,
	                          (HelperSecretFunc) nm_setting_802_1x_get_password);
	helper_fill_secret_entry (connection,
	                          parent->builder,
	                          "eap_simple_pkey_passphrase_entry",
	                          NM_TYPE_SETTING_802_1X,
	                          (HelperSecretFunc) nm_setting_802_1x_get_private_key_password);
}

static gboolean
stuff_changed (EAPMethodSimple *method)
{
	wireless_security_changed_cb (NULL, method->ws_parent);
	method->idle_func_id = 0;
	return FALSE;
}

static void
password_storage_changed (GObject *entry,
                          GParamSpec *pspec,
                          EAPMethodSimple *method)
{
	gboolean always_ask;
	gboolean secrets_only = method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY;

	always_ask = always_ask_selected (method->password_entry);

	if (always_ask && !secrets_only) {
		/* we always clear this button and do not restore it
		 * (because we want to hide the password). */
		gtk_toggle_button_set_active (method->show_password, FALSE);
	}

	gtk_widget_set_sensitive (GTK_WIDGET (method->show_password),
	                          !always_ask || secrets_only);

	if (!method->idle_func_id)
		method->idle_func_id = g_idle_add ((GSourceFunc) stuff_changed, method);
}

/* Set the UI fields for user, password, always_ask and show_password to the
 * values as provided by method->ws_parent. */
static void
set_userpass_ui (EAPMethodSimple *method)
{
	if (method->ws_parent->username)
		gtk_entry_set_text (method->username_entry, method->ws_parent->username);
	else
		gtk_entry_set_text (method->username_entry, "");

	if (method->ws_parent->password && !method->ws_parent->always_ask)
		gtk_entry_set_text (method->password_entry, method->ws_parent->password);
	else
		gtk_entry_set_text (method->password_entry, "");

	gtk_toggle_button_set_active (method->show_password, method->ws_parent->show_password);
	password_storage_changed (NULL, NULL, method);
}

static void
widgets_realized (GtkWidget *widget, EAPMethodSimple *method)
{
	set_userpass_ui (method);
}

static void
widgets_unrealized (GtkWidget *widget, EAPMethodSimple *method)
{
	wireless_security_set_userpass (method->ws_parent,
	                                gtk_entry_get_text (method->username_entry),
	                                gtk_entry_get_text (method->password_entry),
	                                always_ask_selected (method->password_entry),
	                                gtk_toggle_button_get_active (method->show_password));
}

static void
destroy (EAPMethod *parent)
{
	EAPMethodSimple *method = (EAPMethodSimple *) parent;
	GtkWidget *widget;

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_notebook"));
	g_assert (widget);
	g_signal_handlers_disconnect_by_data (widget, method);

	g_signal_handlers_disconnect_by_data (method->username_entry, method->ws_parent);
	g_signal_handlers_disconnect_by_data (method->password_entry, method->ws_parent);
	g_signal_handlers_disconnect_by_data (method->password_entry, method);
	g_signal_handlers_disconnect_by_data (method->show_password, method);
	g_signal_handlers_disconnect_by_data (method->pkey_passphrase_entry, method->ws_parent);
	g_signal_handlers_disconnect_by_data (method->show_pkey_passphrase, method);

	nm_clear_g_source (&method->idle_func_id);
}

static void
hide_row (GtkWidget **widgets, size_t num)
{
	while (num--)
		gtk_widget_hide (*widgets++);
}

EAPMethodSimple *
eap_method_simple_new (WirelessSecurity *ws_parent,
                       NMConnection *connection,
                       EAPMethodSimpleType type,
                       EAPMethodSimpleFlags flags,
                       const char *const*hints)
{
	EAPMethod *parent;
	EAPMethodSimple *method;
	GtkWidget *widget;
	NMSetting8021x *s_8021x = NULL;
	GtkWidget *widget_row[10];

	parent = eap_method_init (sizeof (EAPMethodSimple),
	                          validate,
	                          add_to_size_group,
	                          fill_connection,
	                          update_secrets,
	                          destroy,
	                          "/org/freedesktop/network-manager-applet/eap-method-simple.ui",
	                          "eap_simple_notebook",
	                          "eap_simple_username_entry",
	                          flags & EAP_METHOD_SIMPLE_FLAG_PHASE2);
	if (!parent)
		return NULL;

	method = (EAPMethodSimple *) parent;
	method->password_flags_name = NM_SETTING_802_1X_PASSWORD;
	method->ws_parent = ws_parent;
	method->flags = flags;
	method->type = type;
	g_assert (type < EAP_METHOD_SIMPLE_TYPE_LAST);
	g_assert (   type != EAP_METHOD_SIMPLE_TYPE_UNKNOWN
	          || hints);

	if (hints) {
		for (; *hints; hints++) {
			if (!strcmp (*hints, NM_SETTING_802_1X_IDENTITY))
				method->username_requested = TRUE;
			else if (!strcmp (*hints, NM_SETTING_802_1X_PASSWORD)) {
				method->password_requested = TRUE;
				method->password_flags_name = NM_SETTING_802_1X_PASSWORD;
			} else if (!strcmp (*hints, NM_SETTING_802_1X_PRIVATE_KEY_PASSWORD))
				method->pkey_passphrase_requested = TRUE;
		}
	} else {
		method->username_requested = TRUE;
		method->password_requested = TRUE;
	}

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_notebook"));
	g_assert (widget);
	g_signal_connect (G_OBJECT (widget), "realize",
	                  (GCallback) widgets_realized,
	                  method);
	g_signal_connect (G_OBJECT (widget), "unrealize",
	                  (GCallback) widgets_unrealized,
	                  method);

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_entry"));
	g_assert (widget);
	method->username_entry = GTK_ENTRY (widget);
	g_signal_connect (G_OBJECT (widget), "changed",
	                  (GCallback) wireless_security_changed_cb,
	                  ws_parent);

	if (   (method->flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY)
	    && !method->username_requested)
		gtk_widget_set_sensitive (widget, FALSE);

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_entry"));
	g_assert (widget);
	method->password_entry = GTK_ENTRY (widget);
	g_signal_connect (G_OBJECT (widget), "changed",
	                  (GCallback) wireless_security_changed_cb,
	                  ws_parent);

	/* Create password-storage popup menu for password entry under entry's secondary icon */
	if (connection)
		s_8021x = nm_connection_get_setting_802_1x (connection);
	nma_utils_setup_password_storage (widget, 0, (NMSetting *) s_8021x, method->password_flags_name,
	                                  FALSE, flags & EAP_METHOD_SIMPLE_FLAG_SECRETS_ONLY);

	g_signal_connect (method->password_entry, "notify::secondary-icon-name",
	                  G_CALLBACK (password_storage_changed),
	                  method);

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "show_checkbutton_eapsimple"));
	g_assert (widget);
	method->show_password = GTK_TOGGLE_BUTTON (widget);
	g_signal_connect (G_OBJECT (widget), "toggled",
	                  (GCallback) show_password_toggled_cb,
	                  method);

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_entry"));
	g_assert (widget);
	method->pkey_passphrase_entry = GTK_ENTRY (widget);
	g_signal_connect (G_OBJECT (widget), "changed",
	                  (GCallback) wireless_security_changed_cb,
	                  ws_parent);

	widget = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_show_pkey_passphrase_checkbutton"));
	g_assert (widget);
	method->show_pkey_passphrase = GTK_TOGGLE_BUTTON (widget);
	g_signal_connect (G_OBJECT (widget), "toggled",
	                  (GCallback) show_pkey_passphrase_toggled_cb,
	                  method);

	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_label"));
	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_username_entry"));
	if (!method->username_requested)
		hide_row (widget_row, 2);

	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_label"));
	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_password_entry"));
	widget_row[2] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "show_checkbutton_eapsimple"));
	if (!method->password_requested)
		hide_row (widget_row, 3);

	widget_row[0] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_label"));
	widget_row[1] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_pkey_passphrase_entry"));
	widget_row[2] = GTK_WIDGET (gtk_builder_get_object (parent->builder, "eap_simple_show_pkey_passphrase_checkbutton"));
	if (!method->pkey_passphrase_requested)
		hide_row (widget_row, 3);

	/* Initialize the UI fields with the security settings from method->ws_parent.
	 * This will be done again when the widget gets realized. It must be done here as well,
	 * because the outer dialog will ask to 'validate' the connection before the security tab
	 * is shown/realized (to enable the 'Apply' button).
	 * As 'validate' accesses the contents of the UI fields, they must be initialized now, even
	 * if the widgets are not yet visible. */
	set_userpass_ui (method);

	return method;
}