Method Authorize

src/sessionmgr/sessionmgr-session.cpp:514–612

const bool Session::Authorize(DBus::Authz::Request::Ptr authzreq)
{
    // Early sanity check to see if the backend VPN process is accesible or not
    if (be_prx && be_target)
    {
        // Check if the backend is still alive
        try
        {
            GVariant *r = be_prx->Call(be_target, "Ping", nullptr);
            glib2::Utils::checkParams(__func__, r, "(b)");
            if (!glib2::Value::Extract<bool>(r, 0))
            {
                sig_session->LogCritical("Backend VPN did not respond correctly "
                                         "- "
                                         + GetPath());
                close_session(true);
                throw DBus::Object::Method::Exception("Backend VPN process did not respond");
            }
            g_variant_unref(r);
        }
        catch (const DBus::Proxy::Exception &excp)
        {
            sig_session->LogCritical("Backend VPN did not respond: "
                                     + std::string(excp.GetRawError())
                                     + " - " + GetPath());
            close_session(true);
            throw DBus::Object::Method::Exception("Backend VPN process did not respond");
        }
    }
    else
    {
        // If there are no backends available, cleanup the session
        close_session(true);
        return false;
    }

    switch (authzreq->operation)
    {
    case DBus::Object::Operation::METHOD_CALL:
        {
            // These methods are always restricted to the owner only;
            // we don't provide sharing user admin rights to sessions
            for (const auto &method : {"net.openvpn.v3.sessions.AccessGrant",
                                       "net.openvpn.v3.sessions.AccessRevoke"})

            {
                if (method == authzreq->target)
                {
                    return object_acl->CheckOwnerAccess(authzreq->caller);
                }
            }
            if ("net.openvpn.v3.sessions.LogForward" == authzreq->target
                && restrict_log_access)
            {
                return object_acl->CheckOwnerAccess(authzreq->caller);
            }

            return object_acl->CheckACL(authzreq->caller, {object_acl->GetOwner()});