// SPDX-License-Identifier: GPL-2.0+
/* NetworkManager Applet -- allow user control over networking
 *
 * Dan Williams <dcbw@redhat.com>
 *
 * Copyright 2004 - 2019 Red Hat, Inc.
 * (C) Copyright 2018 Lubomir Rintel
 */

#include "nm-default.h"

#include "applet-vpn-request.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>

#include "nma-vpn-password-dialog.h"
#include "nm-utils/nm-compat.h"
#include "nm-utils/nm-shared-utils.h"

/*****************************************************************************/

typedef struct {
	char *name;
	char *label;
	char *value;
	gboolean is_secret;
	gboolean should_ask;
} EuiSecret;

typedef struct {
	char *uuid;
	char *id;
	char *service_type;

	guint watch_id;
	GPid pid;

	int child_stdout;
	GString *child_response;
	GIOChannel *channel;
	guint channel_eventid;
	GVariantBuilder secrets_builder;
	gboolean external_ui_mode;

	/* These are just for the external UI mode */
	EuiSecret *eui_secrets;
	GtkDialog *dialog;
} RequestData;

typedef struct {
	SecretsRequest req;
	RequestData *req_data;
} VpnSecretsInfo;

/*****************************************************************************/

static void complete_request (VpnSecretsInfo *info);

/*****************************************************************************/

size_t
applet_vpn_request_get_secrets_size (void)
{
	return sizeof (VpnSecretsInfo);
}

/*****************************************************************************/

static void
external_ui_add_secrets (VpnSecretsInfo *info)
{
	RequestData *req_data = info->req_data;
	EuiSecret *secret;
	guint i;

	for (i = 0; req_data->eui_secrets[i].name; i++) {
		secret = &req_data->eui_secrets[i];
		if (   secret->is_secret
		    && secret->value
		    && secret->value[0]) {
			g_variant_builder_add (&req_data->secrets_builder, "{ss}",
			                       secret->name,
			                       secret->value);
		}
	}
}

static void
external_ui_dialog_response (GtkDialog *dialog, int response_id, gpointer user_data)
{
	VpnSecretsInfo *info = user_data;
	RequestData *req_data = info->req_data;
	NMAVpnPasswordDialog *vpn_dialog = NMA_VPN_PASSWORD_DIALOG (dialog);
	EuiSecret *secret;
	const char *value;
	guint i_secret, i_pw;

	for (i_secret = 0, i_pw = 0; req_data->eui_secrets[i_secret].name; i_secret++) {
		secret = &req_data->eui_secrets[i_secret];
		if (   secret->is_secret
		    && secret->should_ask) {
			switch (i_pw) {
			case 0:
				value = nma_vpn_password_dialog_get_password (vpn_dialog);
				break;
			case 1:
				value = nma_vpn_password_dialog_get_password_secondary (vpn_dialog);
				break;
			case 2:
				value = nma_vpn_password_dialog_get_password_ternary (vpn_dialog);
				break;
			default:
				continue;
			}
			g_free (secret->value);
			secret->value = g_strdup (value);
			i_pw++;
		}
	}

	gtk_widget_destroy (GTK_WIDGET (dialog));
	g_clear_object (&req_data->dialog);
	external_ui_add_secrets (info);
	complete_request (info);
}

static gboolean
external_ui_from_child_response (VpnSecretsInfo *info, GError **error)
{
	RequestData *req_data = info->req_data;
	gs_unref_keyfile GKeyFile *keyfile = NULL;
	gs_strfreev char **groups = NULL;
	NMAVpnPasswordDialog *dialog = NULL;
	gs_free char *version = NULL;
	gs_free char *title = NULL;
	gs_free char *message = NULL;
	gsize num_groups;
	guint num_ask = 0;
	guint i_group, i_secret, i_pw;

	/* Parse response key file */
	keyfile = g_key_file_new ();

	if (!g_key_file_load_from_data (keyfile,
	                                req_data->child_response->str,
	                                req_data->child_response->len,
	                                G_KEY_FILE_NONE,
	                                error)) {
		return FALSE;
	}

	groups = g_key_file_get_groups (keyfile, &num_groups);
	if (g_strcmp0 (groups[0], "VPN Plugin UI") != 0) {
		g_set_error_literal (error,
		                     NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_FAILED,
		                     "Expected [VPN Plugin UI]");
		return FALSE;
	}

	version = g_key_file_get_string (keyfile, "VPN Plugin UI", "Version", error);
	if (!version)
		return FALSE;
	if (strcmp (version, "2") != 0) {
		g_set_error_literal (error,
		                     NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_FAILED,
		                     "Expected Version=2");
		return FALSE;
	}

	title = g_key_file_get_string (keyfile, "VPN Plugin UI", "Title", error);
	if (!title)
		return FALSE;

	message = g_key_file_get_string (keyfile, "VPN Plugin UI", "Description", error);
	if (!message)
		return FALSE;

	/* Create a secret instance for each group */
	req_data->eui_secrets = g_new0 (EuiSecret, num_groups);
	for (i_group = 1, i_secret = 0; i_group < num_groups; i_group++) {
		EuiSecret *secret = &req_data->eui_secrets[i_secret];
		const char *group = groups[i_group];
		char *label;

		label = g_key_file_get_string (keyfile, group, "Label", NULL);
		if (!label) {
			g_warning ("Skipping entry: no label\n");
			continue;
		}

		secret->name = g_strdup (group);
		secret->label = label;
		secret->value = g_key_file_get_string (keyfile, group, "Value", NULL);
		secret->is_secret = g_key_file_get_boolean (keyfile, group, "IsSecret", NULL);
		secret->should_ask = g_key_file_get_boolean (keyfile, group, "ShouldAsk", NULL);

		i_secret++;

		if (secret->is_secret && secret->should_ask)
			num_ask++;
	}

	/* If there are any secrets that must be asked to user,
	 * create a dialog and display it. */
	if (num_ask > 0) {
		dialog = (NMAVpnPasswordDialog *) nma_vpn_password_dialog_new (title, message, NULL);
		req_data->dialog = g_object_ref_sink (dialog);

		nma_vpn_password_dialog_set_show_password (dialog, FALSE);
		nma_vpn_password_dialog_set_show_password_secondary (dialog, FALSE);
		nma_vpn_password_dialog_set_show_password_ternary (dialog, FALSE);

		for (i_secret = 0, i_pw = 0; req_data->eui_secrets[i_secret].name; i_secret++) {
			EuiSecret *secret = &req_data->eui_secrets[i_secret];

			if (   secret->is_secret
			    && secret->should_ask) {
				switch (i_pw) {
				case 0:
					nma_vpn_password_dialog_set_show_password (dialog, TRUE);
					nma_vpn_password_dialog_set_password_label (dialog, secret->label);
					if (secret->value)
						nma_vpn_password_dialog_set_password (dialog, secret->value);
					break;
				case 1:
					nma_vpn_password_dialog_set_show_password_secondary (dialog, TRUE);
					nma_vpn_password_dialog_set_password_secondary_label (dialog, secret->label);
					if (secret->value)
						nma_vpn_password_dialog_set_password_secondary (dialog, secret->value);
					break;
				case 2:
					nma_vpn_password_dialog_set_show_password_ternary (dialog, TRUE);
					nma_vpn_password_dialog_set_password_ternary_label (dialog, secret->label);
					if (secret->value)
						nma_vpn_password_dialog_set_password_ternary (dialog, secret->value);
					break;
				default:
					g_warning ("Skipping entry: more than 3 passwords not supported\n");
					continue;
				}
				i_pw++;
			}
		}
		g_signal_connect (dialog,
		                  "response",
		                  G_CALLBACK (external_ui_dialog_response),
		                  info);
		gtk_widget_show (GTK_WIDGET (dialog));
		return TRUE;
	}

	/* Nothing to ask, return known secrets */
	external_ui_add_secrets (info);
	complete_request (info);
	return TRUE;
}

/*****************************************************************************/

static void
complete_request (VpnSecretsInfo *info)
{
	SecretsRequest *req = (SecretsRequest *) info;
	RequestData *req_data = info->req_data;
	GVariantBuilder settings_builder, vpn_builder;
	gs_unref_variant GVariant *settings = NULL;

	g_variant_builder_init (&settings_builder, NM_VARIANT_TYPE_CONNECTION);
	g_variant_builder_init (&vpn_builder, NM_VARIANT_TYPE_SETTING);

	g_variant_builder_add (&vpn_builder, "{sv}",
	                       NM_SETTING_VPN_SECRETS,
	                       g_variant_builder_end (&req_data->secrets_builder));
	g_variant_builder_add (&settings_builder, "{sa{sv}}",
	                       NM_SETTING_VPN_SETTING_NAME,
	                       &vpn_builder);
	settings = g_variant_ref_sink (g_variant_builder_end (&settings_builder));

	applet_secrets_request_complete (req, settings, NULL);
	applet_secrets_request_free (req);
}

static void
process_child_response (VpnSecretsInfo *info)
{
	SecretsRequest *req = (SecretsRequest *) info;
	RequestData *req_data = info->req_data;
	gs_free_error GError *error = NULL;

	if (req_data->external_ui_mode) {
		if (!external_ui_from_child_response (info, &error)) {
			applet_secrets_request_complete (req, NULL, error);
			applet_secrets_request_free (req);
		}
	} else {
		char **lines = g_strsplit (req_data->child_response->str, "\n", -1);
		int i;

		for (i = 0; lines[i] && *(lines[i]); i += 2) {
			if (lines[i + 1] == NULL)
				break;
			g_variant_builder_add (&req_data->secrets_builder, "{ss}", lines[i], lines[i + 1]);
		}

		g_strfreev (lines);
		complete_request (info);
	}
}

static void
child_finished_cb (GPid pid, int status, gpointer user_data)
{
	VpnSecretsInfo *info = user_data;
	SecretsRequest *req = (SecretsRequest *) info;
	RequestData *req_data = info->req_data;
	gs_free_error GError *error = NULL;

	req_data->pid = 0;
	req_data->watch_id = 0;

	if (status) {
		error = g_error_new (NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_USER_CANCELED,
		                     "%s.%d (%s): canceled", __FILE__, __LINE__, __func__);

		applet_secrets_request_complete (req, NULL, error);
		applet_secrets_request_free (req);
	} else if (req_data->channel_eventid == 0) {
		/* We now have both the child response and its exit status. Process it. */
		process_child_response (info);
	}
}

static gboolean
child_stdout_data_cb (GIOChannel *source, GIOCondition condition, gpointer user_data)
{
	SecretsRequest *req = user_data;
	VpnSecretsInfo *info = (VpnSecretsInfo *) req;
	RequestData *req_data = info->req_data;
	GIOStatus status;
	char buf[4096];
	size_t bytes_read;
	gs_free_error GError *error = NULL;

	status = g_io_channel_read_chars (source, buf, sizeof (buf)-1, &bytes_read, &error);
	switch (status) {
	case G_IO_STATUS_ERROR:
		req_data->channel_eventid = 0;
		applet_secrets_request_complete (req, NULL, error);
		applet_secrets_request_free (req);
		return FALSE;
	case G_IO_STATUS_EOF:
		req_data->channel_eventid = 0;
		if (req_data->pid == 0) {
			/* We now have both the childe respons and
			 * its exit status. Process it. */
			process_child_response (info);
		}
		return FALSE;
	case G_IO_STATUS_NORMAL:
		g_string_append_len (req_data->child_response, buf, bytes_read);
		break;
	default:
		/* What just happened... */
		g_return_val_if_reached (FALSE);
	}

	return TRUE;
}

/*****************************************************************************/

static void
_str_append (GString *str,
             const char *tag,
             const char *val)
{
	const char *s;
	gsize i;

	nm_assert (str);
	nm_assert (tag && tag[0]);
	nm_assert (val);

	g_string_append (str, tag);
	g_string_append_c (str, '=');

	s = strchr (val, '\n');
	if (s) {
		gs_free char *val2 = g_strdup (val);

		for (i = 0; val2[i]; i++) {
			if (val2[i] == '\n')
				val2[i] = ' ';
		}
		g_string_append (str, val2);
	} else
		g_string_append (str, val);
	g_string_append_c (str, '\n');
}

static char *
connection_to_data (NMConnection *connection,
                    gsize *out_length,
                    GError **error)
{
	NMSettingVpn *s_vpn;
	GString *buf;
	const char **keys;
	guint i, len;

	g_return_val_if_fail (NM_IS_CONNECTION (connection), NULL);

	s_vpn = nm_connection_get_setting_vpn (connection);
	if (!s_vpn) {
		g_set_error_literal (error,
		                     NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_FAILED,
		                     _("Connection had no VPN setting"));
		return NULL;
	}

	buf = g_string_new_len (NULL, 100);

	keys = nm_setting_vpn_get_data_keys (s_vpn, &len);
	for (i = 0; i < len; i++) {
		_str_append (buf, "DATA_KEY", keys[i]);
		_str_append (buf, "DATA_VAL", nm_setting_vpn_get_data_item (s_vpn, keys[i]));
	}
	nm_clear_g_free (&keys);

	keys = nm_setting_vpn_get_secret_keys (s_vpn, &len);
	for (i = 0; i < len; i++) {
		_str_append (buf, "SECRET_KEY", keys[i]);
		_str_append (buf, "SECRET_VAL", nm_setting_vpn_get_secret (s_vpn, keys[i]));
	}
	nm_clear_g_free (&keys);

	g_string_append (buf, "DONE\n\nQUIT\n\n");
	NM_SET_OUT (out_length, buf->len);
	return g_string_free (buf, FALSE);
}

/*****************************************************************************/

static gboolean
connection_to_fd (NMConnection *connection,
                  int fd,
                  GError **error)
{
	gs_free char *data = NULL;
	gsize data_len;
	gssize w;
	int errsv;

	data = connection_to_data (connection, &data_len, error);
	if (!data)
		return FALSE;

again:
	w = write (fd, data, data_len);
	if (w < 0) {
		errsv = errno;
		if (errsv == EINTR)
			goto again;
		g_set_error (error,
		             NM_SECRET_AGENT_ERROR,
		             NM_SECRET_AGENT_ERROR_FAILED,
		             _("Failed to write connection to VPN UI: %s (%d)"), g_strerror (errsv), errsv);
		return FALSE;
	}

	if ((gsize) w != data_len) {
		g_set_error_literal (error,
		                     NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_FAILED,
		                     _("Failed to write connection to VPN UI: incomplete write"));
		return FALSE;
	}

	return TRUE;
}

/*****************************************************************************/

static void
vpn_child_setup (gpointer user_data)
{
	/* We are in the child process at this point */
	pid_t pid = getpid ();
	setpgid (pid, pid);
}

static gboolean
auth_dialog_spawn (const char *con_id,
                   const char *con_uuid,
                   const char *const*hints,
                   const char *auth_dialog,
                   const char *service_type,
                   gboolean supports_hints,
                   gboolean external_ui_mode,
                   guint32 flags,
                   GPid *out_pid,
                   int *out_stdin,
                   int *out_stdout,
                   GError **error)
{
	gsize hints_len;
	gsize i, j;
	gs_free const char **argv = NULL;
	gs_free const char **envp = NULL;
	gsize environ_len;

	g_return_val_if_fail (con_id, FALSE);
	g_return_val_if_fail (con_uuid, FALSE);
	g_return_val_if_fail (auth_dialog, FALSE);
	g_return_val_if_fail (service_type, FALSE);
	g_return_val_if_fail (out_pid, FALSE);
	g_return_val_if_fail (out_stdin, FALSE);
	g_return_val_if_fail (out_stdout, FALSE);

	hints_len = NM_PTRARRAY_LEN (hints);
	argv = g_new (const char *, 11 + (2 * hints_len));
	i = 0;
	argv[i++] = auth_dialog;
	argv[i++] = "-u";
	argv[i++] = con_uuid;
	argv[i++] = "-n";
	argv[i++] = con_id;
	argv[i++] = "-s";
	argv[i++] = service_type;
	if (flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_ALLOW_INTERACTION)
		argv[i++] = "-i";
	if (flags & NM_SECRET_AGENT_GET_SECRETS_FLAG_REQUEST_NEW)
		argv[i++] = "-r";
	for (j = 0; supports_hints && (j < hints_len); j++) {
		argv[i++] = "-t";
		argv[i++] = hints[j];
	}
	if (external_ui_mode)
		argv[i++] = "--external-ui-mode";
	nm_assert (i <= 10 + (2 * hints_len));
	argv[i++] = NULL;

	environ_len = NM_PTRARRAY_LEN (environ);
	envp = g_new (const char *, environ_len + 1);
	memcpy (envp, environ, sizeof (const char *) * environ_len);
	for (i = 0, j = 0; i < environ_len; i++) {
		const char *e = environ[i];

		if (g_str_has_prefix (e, "G_MESSAGES_DEBUG=")) {
			/* skip this environment variable. We interact with the auth-dialog via stdout.
			 * G_MESSAGES_DEBUG may enable additional debugging messages from GTK. */
			continue;
		}
		envp[j++] = e;
	}
	envp[j] = NULL;

	if (!g_spawn_async_with_pipes (NULL,
	                               (char **) argv,
	                               (char **) envp,
	                               G_SPAWN_DO_NOT_REAP_CHILD,
	                               vpn_child_setup,
	                               NULL,
	                               out_pid,
	                               out_stdin,
	                               out_stdout,
	                               NULL,
	                               error))
		return FALSE;

	return TRUE;
}

/*****************************************************************************/

static gboolean
ensure_killed (gpointer data)
{
	pid_t pid = GPOINTER_TO_INT (data);

	kill (pid, SIGKILL);
	waitpid (pid, NULL, 0);
	return FALSE;
}

static void
dialog_response_destroy (GtkDialog *dialog, int response_id, gpointer user_data)
{
	gtk_widget_destroy (GTK_WIDGET (dialog));
	g_object_unref (dialog);
}

static void
free_vpn_secrets_info (SecretsRequest *req)
{

	RequestData *req_data;
	guint i;

	req_data = ((VpnSecretsInfo *) req)->req_data;

	if (!req_data)
		return;

	g_free (req_data->uuid);
	g_free (req_data->id);
	g_free (req_data->service_type);

	nm_clear_g_source (&req_data->watch_id);

	nm_clear_g_source (&req_data->channel_eventid);
	if (req_data->channel)
		g_io_channel_unref (req_data->channel);

	if (req_data->pid) {
		if (kill (req_data->pid, SIGTERM) == 0)
			g_timeout_add_seconds (2, ensure_killed, GINT_TO_POINTER (req_data->pid));
		else {
			kill (req_data->pid, SIGKILL);
			waitpid (req_data->pid, NULL, 0);
		}
	}

	if (req_data->child_response)
		g_string_free (req_data->child_response, TRUE);

	g_variant_builder_clear (&req_data->secrets_builder);

	if (req_data->eui_secrets) {
		for (i = 0; req_data->eui_secrets[i].name; i++) {
			g_free (req_data->eui_secrets[i].name);
			g_free (req_data->eui_secrets[i].label);
			g_free (req_data->eui_secrets[i].value);
		}
		g_free (req_data->eui_secrets);
	}

	if (req_data->dialog) {
		g_signal_handlers_disconnect_by_func (req_data->dialog,
		                                      external_ui_dialog_response,
		                                      req);
		g_signal_connect (req_data->dialog,
		                  "response",
		                  G_CALLBACK (dialog_response_destroy),
		                  NULL);
		req_data->dialog = NULL;
	}

	g_slice_free (RequestData, req_data);
}

gboolean
applet_vpn_request_get_secrets (SecretsRequest *req, GError **error)
{
	VpnSecretsInfo *info = (VpnSecretsInfo *) req;
	RequestData *req_data;
	NMSettingConnection *s_con;
	NMSettingVpn *s_vpn;
	const char *connection_type;
	const char *service_type;
	const char *auth_dialog;
	gs_unref_object NMVpnPluginInfo *plugin = NULL;
	int child_stdin;

	applet_secrets_request_set_free_func (req, free_vpn_secrets_info);

	s_con = nm_connection_get_setting_connection (req->connection);
	s_vpn = nm_connection_get_setting_vpn (req->connection);

	connection_type = nm_setting_connection_get_connection_type (s_con);
	g_return_val_if_fail (nm_streq0 (connection_type, NM_SETTING_VPN_SETTING_NAME), FALSE);

	service_type = nm_setting_vpn_get_service_type (s_vpn);
	g_return_val_if_fail (service_type, FALSE);

	plugin = nm_vpn_plugin_info_new_search_file (NULL, service_type);
	auth_dialog = plugin ? nm_vpn_plugin_info_get_auth_dialog (plugin) : NULL;
	if (!auth_dialog) {
		g_set_error (error,
		             NM_SECRET_AGENT_ERROR,
		             NM_SECRET_AGENT_ERROR_FAILED,
		             "Could not find the authentication dialog for VPN connection type '%s'",
		             service_type);
		return FALSE;
	}

	info->req_data = g_slice_new0 (RequestData);
	if (!info->req_data) {
		g_set_error_literal (error,
		                     NM_SECRET_AGENT_ERROR,
		                     NM_SECRET_AGENT_ERROR_FAILED,
		                     "Could not create VPN secrets request object");
		return FALSE;
	}
	req_data = info->req_data;

	g_variant_builder_init (&req_data->secrets_builder, G_VARIANT_TYPE ("a{ss}"));

	req_data->external_ui_mode = _nm_utils_ascii_str_to_bool (
		nm_vpn_plugin_info_lookup_property (plugin,
		                                    "GNOME",
		                                    "supports-external-ui-mode"),
		FALSE);

	if (!auth_dialog_spawn (nm_setting_connection_get_id (s_con),
	                        nm_setting_connection_get_uuid (s_con),
	                        (const char *const*) req->hints,
	                        auth_dialog,
	                        service_type,
	                        nm_vpn_plugin_info_supports_hints (plugin),
	                        req_data->external_ui_mode,
	                        req->flags,
	                        &req_data->pid,
	                        &child_stdin,
	                        &req_data->child_stdout,
	                        error))
		return FALSE;

	/* catch when child is reaped */
	req_data->watch_id = g_child_watch_add (req_data->pid, child_finished_cb, info);

	/* listen to what child has to say */
	req_data->channel = g_io_channel_unix_new (req_data->child_stdout);
	req_data->child_response = g_string_sized_new (4096);
	req_data->channel_eventid = g_io_add_watch (req_data->channel,
	                                            G_IO_IN  | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
	                                            child_stdout_data_cb,
	                                            info);

	if (!connection_to_fd (req->connection, child_stdin, error))
		return FALSE;
	close (child_stdin);

	g_io_channel_set_encoding (req_data->channel, NULL, NULL);

	/* Dump parts of the connection to the child */
	return TRUE;
}