diff options
Diffstat (limited to 'js/gdm/util.js')
| -rw-r--r-- | js/gdm/util.js | 785 |
1 files changed, 785 insertions, 0 deletions
diff --git a/js/gdm/util.js b/js/gdm/util.js new file mode 100644 index 0000000..8d09356 --- /dev/null +++ b/js/gdm/util.js @@ -0,0 +1,785 @@ +// -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*- +/* exported BANNER_MESSAGE_KEY, BANNER_MESSAGE_TEXT_KEY, LOGO_KEY, + DISABLE_USER_LIST_KEY, fadeInActor, fadeOutActor, cloneAndFadeOutActor, + ShellUserVerifier */ + +const { Clutter, Gdm, Gio, GLib } = imports.gi; +const Signals = imports.misc.signals; + +const Batch = imports.gdm.batch; +const OVirt = imports.gdm.oVirt; +const Vmware = imports.gdm.vmware; +const Main = imports.ui.main; +const { loadInterfaceXML } = imports.misc.fileUtils; +const Params = imports.misc.params; +const SmartcardManager = imports.misc.smartcardManager; + +const FprintManagerIface = loadInterfaceXML('net.reactivated.Fprint.Manager'); +const FprintManagerProxy = Gio.DBusProxy.makeProxyWrapper(FprintManagerIface); +const FprintDeviceIface = loadInterfaceXML('net.reactivated.Fprint.Device'); +const FprintDeviceProxy = Gio.DBusProxy.makeProxyWrapper(FprintDeviceIface); + +Gio._promisify(Gdm.Client.prototype, 'open_reauthentication_channel'); +Gio._promisify(Gdm.Client.prototype, 'get_user_verifier'); +Gio._promisify(Gdm.UserVerifierProxy.prototype, + 'call_begin_verification_for_user'); +Gio._promisify(Gdm.UserVerifierProxy.prototype, 'call_begin_verification'); + +var PASSWORD_SERVICE_NAME = 'gdm-password'; +var FINGERPRINT_SERVICE_NAME = 'gdm-fingerprint'; +var SMARTCARD_SERVICE_NAME = 'gdm-smartcard'; +var FADE_ANIMATION_TIME = 160; +var CLONE_FADE_ANIMATION_TIME = 250; + +var LOGIN_SCREEN_SCHEMA = 'org.gnome.login-screen'; +var PASSWORD_AUTHENTICATION_KEY = 'enable-password-authentication'; +var FINGERPRINT_AUTHENTICATION_KEY = 'enable-fingerprint-authentication'; +var SMARTCARD_AUTHENTICATION_KEY = 'enable-smartcard-authentication'; +var BANNER_MESSAGE_KEY = 'banner-message-enable'; +var BANNER_MESSAGE_TEXT_KEY = 'banner-message-text'; +var ALLOWED_FAILURES_KEY = 'allowed-failures'; + +var LOGO_KEY = 'logo'; +var DISABLE_USER_LIST_KEY = 'disable-user-list'; + +// Give user 48ms to read each character of a PAM message +var USER_READ_TIME = 48; +const FINGERPRINT_ERROR_TIMEOUT_WAIT = 15; + +var MessageType = { + // Keep messages in order by priority + NONE: 0, + HINT: 1, + INFO: 2, + ERROR: 3, +}; + +const FingerprintReaderType = { + NONE: 0, + PRESS: 1, + SWIPE: 2, +}; + +function fadeInActor(actor) { + if (actor.opacity == 255 && actor.visible) + return null; + + let hold = new Batch.Hold(); + actor.show(); + let [, naturalHeight] = actor.get_preferred_height(-1); + + actor.opacity = 0; + actor.set_height(0); + actor.ease({ + opacity: 255, + height: naturalHeight, + duration: FADE_ANIMATION_TIME, + mode: Clutter.AnimationMode.EASE_OUT_QUAD, + onComplete: () => { + this.set_height(-1); + hold.release(); + }, + }); + + return hold; +} + +function fadeOutActor(actor) { + if (!actor.visible || actor.opacity == 0) { + actor.opacity = 0; + actor.hide(); + return null; + } + + let hold = new Batch.Hold(); + actor.ease({ + opacity: 0, + height: 0, + duration: FADE_ANIMATION_TIME, + mode: Clutter.AnimationMode.EASE_OUT_QUAD, + onComplete: () => { + this.hide(); + this.set_height(-1); + hold.release(); + }, + }); + return hold; +} + +function cloneAndFadeOutActor(actor) { + // Immediately hide actor so its sibling can have its space + // and position, but leave a non-reactive clone on-screen, + // so from the user's point of view it smoothly fades away + // and reveals its sibling. + actor.hide(); + + const clone = new Clutter.Clone({ + source: actor, + reactive: false, + }); + + Main.uiGroup.add_child(clone); + + let [x, y] = actor.get_transformed_position(); + clone.set_position(x, y); + + let hold = new Batch.Hold(); + clone.ease({ + opacity: 0, + duration: CLONE_FADE_ANIMATION_TIME, + mode: Clutter.AnimationMode.EASE_OUT_QUAD, + onComplete: () => { + clone.destroy(); + hold.release(); + }, + }); + return hold; +} + +var ShellUserVerifier = class extends Signals.EventEmitter { + constructor(client, params) { + super(); + params = Params.parse(params, { reauthenticationOnly: false }); + this._reauthOnly = params.reauthenticationOnly; + + this._client = client; + + this._defaultService = null; + this._preemptingService = null; + + this._settings = new Gio.Settings({ schema_id: LOGIN_SCREEN_SCHEMA }); + this._settings.connect('changed', + this._updateDefaultService.bind(this)); + this._updateDefaultService(); + + this._fprintManager = new FprintManagerProxy(Gio.DBus.system, + 'net.reactivated.Fprint', + '/net/reactivated/Fprint/Manager', + null, + null, + Gio.DBusProxyFlags.DO_NOT_LOAD_PROPERTIES); + this._smartcardManager = SmartcardManager.getSmartcardManager(); + + // We check for smartcards right away, since an inserted smartcard + // at startup should result in immediately initiating authentication. + // This is different than fingerprint readers, where we only check them + // after a user has been picked. + this.smartcardDetected = false; + this._checkForSmartcard(); + + this._smartcardManager.connectObject( + 'smartcard-inserted', this._checkForSmartcard.bind(this), + 'smartcard-removed', this._checkForSmartcard.bind(this), this); + + this._messageQueue = []; + this._messageQueueTimeoutId = 0; + this.reauthenticating = false; + + this._failCounter = 0; + this._unavailableServices = new Set(); + + this._credentialManagers = {}; + this._credentialManagers[OVirt.SERVICE_NAME] = OVirt.getOVirtCredentialsManager(); + this._credentialManagers[Vmware.SERVICE_NAME] = Vmware.getVmwareCredentialsManager(); + + for (let service in this._credentialManagers) { + if (this._credentialManagers[service].token) { + this._onCredentialManagerAuthenticated(this._credentialManagers[service], + this._credentialManagers[service].token); + } + + this._credentialManagers[service].connectObject('user-authenticated', + this._onCredentialManagerAuthenticated.bind(this), this); + } + } + + get hasPendingMessages() { + return !!this._messageQueue.length; + } + + get allowedFailures() { + return this._settings.get_int(ALLOWED_FAILURES_KEY); + } + + get currentMessage() { + return this._messageQueue ? this._messageQueue[0] : null; + } + + begin(userName, hold) { + this._cancellable = new Gio.Cancellable(); + this._hold = hold; + this._userName = userName; + this.reauthenticating = false; + + this._checkForFingerprintReader(); + + // If possible, reauthenticate an already running session, + // so any session specific credentials get updated appropriately + if (userName) + this._openReauthenticationChannel(userName); + else + this._getUserVerifier(); + } + + cancel() { + if (this._cancellable) + this._cancellable.cancel(); + + if (this._userVerifier) { + this._userVerifier.call_cancel_sync(null); + this.clear(); + } + } + + _clearUserVerifier() { + if (this._userVerifier) { + this._disconnectSignals(); + this._userVerifier.run_dispose(); + this._userVerifier = null; + if (this._userVerifierChoiceList) { + this._userVerifierChoiceList.run_dispose(); + this._userVerifierChoiceList = null; + } + } + } + + clear() { + if (this._cancellable) { + this._cancellable.cancel(); + this._cancellable = null; + } + + this._clearUserVerifier(); + this._clearMessageQueue(); + } + + destroy() { + this.cancel(); + + this._settings.run_dispose(); + this._settings = null; + + this._smartcardManager.disconnectObject(this); + this._smartcardManager = null; + + for (let service in this._credentialManagers) { + let credentialManager = this._credentialManagers[service]; + credentialManager.disconnectObject(this); + credentialManager = null; + } + } + + selectChoice(serviceName, key) { + this._userVerifierChoiceList.call_select_choice(serviceName, key, this._cancellable, null); + } + + async answerQuery(serviceName, answer) { + try { + await this._handlePendingMessages(); + this._userVerifier.call_answer_query(serviceName, answer, this._cancellable, null); + } catch (e) { + if (!e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED)) + logError(e); + } + } + + _getIntervalForMessage(message) { + if (!message) + return 0; + + // We probably could be smarter here + return message.length * USER_READ_TIME; + } + + finishMessageQueue() { + if (!this.hasPendingMessages) + return; + + this._messageQueue = []; + + this.emit('no-more-messages'); + } + + increaseCurrentMessageTimeout(interval) { + if (!this._messageQueueTimeoutId && interval > 0) + this._currentMessageExtraInterval = interval; + } + + _serviceHasPendingMessages(serviceName) { + return this._messageQueue.some(m => m.serviceName === serviceName); + } + + _filterServiceMessages(serviceName, messageType) { + // This function allows to remove queued messages for the @serviceName + // whose type has lower priority than @messageType, replacing them + // with a null message that will lead to clearing the prompt once done. + if (this._serviceHasPendingMessages(serviceName)) + this._queuePriorityMessage(serviceName, null, messageType); + } + + _queueMessageTimeout() { + if (this._messageQueueTimeoutId != 0) + return; + + const message = this.currentMessage; + + delete this._currentMessageExtraInterval; + this.emit('show-message', message.serviceName, message.text, message.type); + + this._messageQueueTimeoutId = GLib.timeout_add(GLib.PRIORITY_DEFAULT, + message.interval + (this._currentMessageExtraInterval | 0), () => { + this._messageQueueTimeoutId = 0; + + if (this._messageQueue.length > 1) { + this._messageQueue.shift(); + this._queueMessageTimeout(); + } else { + this.finishMessageQueue(); + } + + return GLib.SOURCE_REMOVE; + }); + GLib.Source.set_name_by_id(this._messageQueueTimeoutId, '[gnome-shell] this._queueMessageTimeout'); + } + + _queueMessage(serviceName, message, messageType) { + let interval = this._getIntervalForMessage(message); + + this._messageQueue.push({ serviceName, text: message, type: messageType, interval }); + this._queueMessageTimeout(); + } + + _queuePriorityMessage(serviceName, message, messageType) { + const newQueue = this._messageQueue.filter(m => { + if (m.serviceName !== serviceName || m.type >= messageType) + return m.text !== message; + return false; + }); + + if (!newQueue.includes(this.currentMessage)) + this._clearMessageQueue(); + + this._messageQueue = newQueue; + this._queueMessage(serviceName, message, messageType); + } + + _clearMessageQueue() { + this.finishMessageQueue(); + + if (this._messageQueueTimeoutId != 0) { + GLib.source_remove(this._messageQueueTimeoutId); + this._messageQueueTimeoutId = 0; + } + this.emit('show-message', null, null, MessageType.NONE); + } + + async _checkForFingerprintReader() { + this._fingerprintReaderType = FingerprintReaderType.NONE; + + if (!this._settings.get_boolean(FINGERPRINT_AUTHENTICATION_KEY) || + this._fprintManager == null) { + this._updateDefaultService(); + return; + } + + try { + const [device] = await this._fprintManager.GetDefaultDeviceAsync( + Gio.DBusCallFlags.NONE, this._cancellable); + const fprintDeviceProxy = new FprintDeviceProxy(Gio.DBus.system, + 'net.reactivated.Fprint', + device); + const fprintDeviceType = fprintDeviceProxy['scan-type']; + + this._fingerprintReaderType = fprintDeviceType === 'swipe' + ? FingerprintReaderType.SWIPE + : FingerprintReaderType.PRESS; + this._updateDefaultService(); + } catch (e) {} + } + + _onCredentialManagerAuthenticated(credentialManager, _token) { + this._preemptingService = credentialManager.service; + this.emit('credential-manager-authenticated'); + } + + _checkForSmartcard() { + let smartcardDetected; + + if (!this._settings.get_boolean(SMARTCARD_AUTHENTICATION_KEY)) + smartcardDetected = false; + else if (this._reauthOnly) + smartcardDetected = this._smartcardManager.hasInsertedLoginToken(); + else + smartcardDetected = this._smartcardManager.hasInsertedTokens(); + + if (smartcardDetected != this.smartcardDetected) { + this.smartcardDetected = smartcardDetected; + + if (this.smartcardDetected) + this._preemptingService = SMARTCARD_SERVICE_NAME; + else if (this._preemptingService == SMARTCARD_SERVICE_NAME) + this._preemptingService = null; + + this.emit('smartcard-status-changed'); + } + } + + _reportInitError(where, error, serviceName) { + logError(error, where); + this._hold.release(); + + this._queueMessage(serviceName, _('Authentication error'), MessageType.ERROR); + this._failCounter++; + this._verificationFailed(serviceName, false); + } + + async _openReauthenticationChannel(userName) { + try { + this._clearUserVerifier(); + this._userVerifier = await this._client.open_reauthentication_channel( + userName, this._cancellable); + } catch (e) { + if (e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED)) + return; + if (e.matches(Gio.DBusError, Gio.DBusError.ACCESS_DENIED) && + !this._reauthOnly) { + // Gdm emits org.freedesktop.DBus.Error.AccessDenied when there + // is no session to reauthenticate. Fall back to performing + // verification from this login session + this._getUserVerifier(); + return; + } + + this._reportInitError('Failed to open reauthentication channel', e); + return; + } + + if (this._client.get_user_verifier_choice_list) + this._userVerifierChoiceList = this._client.get_user_verifier_choice_list(); + else + this._userVerifierChoiceList = null; + + this.reauthenticating = true; + this._connectSignals(); + this._beginVerification(); + this._hold.release(); + } + + async _getUserVerifier() { + try { + this._clearUserVerifier(); + this._userVerifier = + await this._client.get_user_verifier(this._cancellable); + } catch (e) { + if (e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED)) + return; + this._reportInitError('Failed to obtain user verifier', e); + return; + } + + if (this._client.get_user_verifier_choice_list) + this._userVerifierChoiceList = this._client.get_user_verifier_choice_list(); + else + this._userVerifierChoiceList = null; + + this._connectSignals(); + this._beginVerification(); + this._hold.release(); + } + + _connectSignals() { + this._disconnectSignals(); + + this._userVerifier.connectObject( + 'info', this._onInfo.bind(this), + 'problem', this._onProblem.bind(this), + 'info-query', this._onInfoQuery.bind(this), + 'secret-info-query', this._onSecretInfoQuery.bind(this), + 'conversation-stopped', this._onConversationStopped.bind(this), + 'service-unavailable', this._onServiceUnavailable.bind(this), + 'reset', this._onReset.bind(this), + 'verification-complete', this._onVerificationComplete.bind(this), + this); + + if (this._userVerifierChoiceList) { + this._userVerifierChoiceList.connectObject('choice-query', + this._onChoiceListQuery.bind(this), this); + } + } + + _disconnectSignals() { + this._userVerifier?.disconnectObject(this); + this._userVerifierChoiceList?.disconnectObject(this); + } + + _getForegroundService() { + if (this._preemptingService) + return this._preemptingService; + + return this._defaultService; + } + + serviceIsForeground(serviceName) { + return serviceName == this._getForegroundService(); + } + + serviceIsDefault(serviceName) { + return serviceName == this._defaultService; + } + + serviceIsFingerprint(serviceName) { + return this._fingerprintReaderType !== FingerprintReaderType.NONE && + serviceName === FINGERPRINT_SERVICE_NAME; + } + + _updateDefaultService() { + if (this._settings.get_boolean(PASSWORD_AUTHENTICATION_KEY)) + this._defaultService = PASSWORD_SERVICE_NAME; + else if (this._settings.get_boolean(SMARTCARD_AUTHENTICATION_KEY)) + this._defaultService = SMARTCARD_SERVICE_NAME; + else if (this._fingerprintReaderType !== FingerprintReaderType.NONE) + this._defaultService = FINGERPRINT_SERVICE_NAME; + + if (!this._defaultService) { + log("no authentication service is enabled, using password authentication"); + this._defaultService = PASSWORD_SERVICE_NAME; + } + } + + async _startService(serviceName) { + this._hold.acquire(); + try { + if (this._userName) { + await this._userVerifier.call_begin_verification_for_user( + serviceName, this._userName, this._cancellable); + } else { + await this._userVerifier.call_begin_verification( + serviceName, this._cancellable); + } + } catch (e) { + if (e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED)) + return; + if (!this.serviceIsForeground(serviceName)) { + logError(e, + `Failed to start ${serviceName} for ${this._userName}`); + this._hold.release(); + return; + } + this._reportInitError( + this._userName + ? `Failed to start ${serviceName} verification for user` + : `Failed to start ${serviceName} verification`, + e, serviceName); + return; + } + this._hold.release(); + } + + _beginVerification() { + this._startService(this._getForegroundService()); + + if (this._userName && + this._fingerprintReaderType !== FingerprintReaderType.NONE && + !this.serviceIsForeground(FINGERPRINT_SERVICE_NAME)) + this._startService(FINGERPRINT_SERVICE_NAME); + } + + _onChoiceListQuery(client, serviceName, promptMessage, list) { + if (!this.serviceIsForeground(serviceName)) + return; + + this.emit('show-choice-list', serviceName, promptMessage, list.deepUnpack()); + } + + _onInfo(client, serviceName, info) { + if (this.serviceIsForeground(serviceName)) { + this._queueMessage(serviceName, info, MessageType.INFO); + } else if (this.serviceIsFingerprint(serviceName)) { + // We don't show fingerprint messages directly since it's + // not the main auth service. Instead we use the messages + // as a cue to display our own message. + if (this._fingerprintReaderType === FingerprintReaderType.SWIPE) { + // Translators: this message is shown below the password entry field + // to indicate the user can swipe their finger on the fingerprint reader + this._queueMessage(serviceName, _('(or swipe finger across reader)'), + MessageType.HINT); + } else { + // Translators: this message is shown below the password entry field + // to indicate the user can place their finger on the fingerprint reader instead + this._queueMessage(serviceName, _('(or place finger on reader)'), + MessageType.HINT); + } + } + } + + _onProblem(client, serviceName, problem) { + const isFingerprint = this.serviceIsFingerprint(serviceName); + + if (!this.serviceIsForeground(serviceName) && !isFingerprint) + return; + + this._queuePriorityMessage(serviceName, problem, MessageType.ERROR); + + if (isFingerprint) { + // pam_fprintd allows the user to retry multiple (maybe even infinite! + // times before failing the authentication conversation. + // We don't want this behavior to bypass the max-tries setting the user has set, + // so we count the problem messages to know how many times the user has failed. + // Once we hit the max number of failures we allow, it's time to failure the + // conversation from our side. We can't do that right away, however, because + // we may drop pending messages coming from pam_fprintd. In order to make sure + // the user sees everything, we queue the failure up to get handled in the + // near future, after we've finished up the current round of messages. + this._failCounter++; + + if (!this._canRetry()) { + if (this._fingerprintFailedId) + GLib.source_remove(this._fingerprintFailedId); + + const cancellable = this._cancellable; + this._fingerprintFailedId = GLib.timeout_add(GLib.PRIORITY_DEFAULT, + FINGERPRINT_ERROR_TIMEOUT_WAIT, () => { + this._fingerprintFailedId = 0; + if (!cancellable.is_cancelled()) + this._verificationFailed(serviceName, false); + return GLib.SOURCE_REMOVE; + }); + } + } + } + + _onInfoQuery(client, serviceName, question) { + if (!this.serviceIsForeground(serviceName)) + return; + + this.emit('ask-question', serviceName, question, false); + } + + _onSecretInfoQuery(client, serviceName, secretQuestion) { + if (!this.serviceIsForeground(serviceName)) + return; + + let token = null; + if (this._credentialManagers[serviceName]) + token = this._credentialManagers[serviceName].token; + + if (token) { + this.answerQuery(serviceName, token); + return; + } + + this.emit('ask-question', serviceName, secretQuestion, true); + } + + _onReset() { + // Clear previous attempts to authenticate + this._failCounter = 0; + this._unavailableServices.clear(); + this._updateDefaultService(); + + this.emit('reset'); + } + + _onVerificationComplete() { + this.emit('verification-complete'); + } + + _cancelAndReset() { + this.cancel(); + this._onReset(); + } + + _retry(serviceName) { + this._hold = new Batch.Hold(); + this._connectSignals(); + this._startService(serviceName); + } + + _canRetry() { + return this._userName && + (this._reauthOnly || this._failCounter < this.allowedFailures); + } + + async _verificationFailed(serviceName, shouldRetry) { + if (serviceName === FINGERPRINT_SERVICE_NAME) { + if (this._fingerprintFailedId) + GLib.source_remove(this._fingerprintFailedId); + } + + // For Not Listed / enterprise logins, immediately reset + // the dialog + // Otherwise, when in login mode we allow ALLOWED_FAILURES attempts. + // After that, we go back to the welcome screen. + this._filterServiceMessages(serviceName, MessageType.ERROR); + + const doneTrying = !shouldRetry || !this._canRetry(); + + this.emit('verification-failed', serviceName, !doneTrying); + try { + if (doneTrying) { + this._disconnectSignals(); + await this._handlePendingMessages(); + this._cancelAndReset(); + } else { + await this._handlePendingMessages(); + this._retry(serviceName); + } + } catch (e) { + if (!e.matches(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED)) + logError(e); + } + } + + _handlePendingMessages() { + if (!this.hasPendingMessage) + return Promise.resolve(); + + const cancellable = this._cancellable; + return new Promise((resolve, reject) => { + let signalId = this.connect('no-more-messages', () => { + this.disconnect(signalId); + if (cancellable.is_cancelled()) + reject(new GLib.Error(Gio.IOErrorEnum, Gio.IOErrorEnum.CANCELLED, 'Operation was cancelled')); + else + resolve(); + }); + }); + } + + _onServiceUnavailable(_client, serviceName, errorMessage) { + this._unavailableServices.add(serviceName); + + if (!errorMessage) + return; + + if (this.serviceIsForeground(serviceName) || this.serviceIsFingerprint(serviceName)) + this._queueMessage(serviceName, errorMessage, MessageType.ERROR); + } + + _onConversationStopped(client, serviceName) { + // If the login failed with the preauthenticated oVirt credentials + // then discard the credentials and revert to default authentication + // mechanism. + let foregroundService = Object.keys(this._credentialManagers).find(service => + this.serviceIsForeground(service)); + if (foregroundService) { + this._credentialManagers[foregroundService].token = null; + this._preemptingService = null; + this._verificationFailed(serviceName, false); + return; + } + + this._filterServiceMessages(serviceName, MessageType.ERROR); + + if (this._unavailableServices.has(serviceName)) + return; + + // if the password service fails, then cancel everything. + // But if, e.g., fingerprint fails, still give + // password authentication a chance to succeed + if (this.serviceIsForeground(serviceName)) + this._failCounter++; + + this._verificationFailed(serviceName, true); + } +}; |