Commit message: [gsm] Delay the creation of the GsmXSMPClient until it really exists

We used to create the GsmXSMPClient before the XSMP connection is really
accepted. This can lead to some issues, though. An example is:
https://bugzilla.gnome.org/show_bug.cgi?id=598211#c19. Quoting:

 "What is happening is that a new client (probably metacity in your
 case) is opening an ICE connection in the GSM_MANAGER_PHASE_END_SESSION
 phase, which causes a new GsmXSMPClient to be added to the client
 store. The GSM_MANAGER_PHASE_EXIT phase then begins before the client
 has had a chance to establish a xsmp connection, which means that
 client->priv->conn will not be initialized at the point that xsmp_stop
 is called on the new unregistered client."

The fix is to create the GsmXSMPClient object when there's a real XSMP
connection. This implies moving the timeout that makes sure we don't
have an empty client to the XSMP server.

https://bugzilla.gnome.org/show_bug.cgi?id=598211
CVE: CVE-2017-11171
CWE: CWE-835
Vulnerability description: Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.

Project: gnome-session
File: gsm-xsmp-client.c

gsm_xsmp_client_connect (GsmXSMPClient *client,
                         SmsConn        conn,
                         unsigned long *mask_ret,
                         SmsCallbacks  *callbacks_ret)
 {
         client->priv->conn = conn;
 
         g_debug ("GsmXSMPClient: Initializing client %s", client->priv->description);
 
         *mask_ret = 0;

        *mask_ret |= SmsRegisterClientProcMask;
        callbacks_ret->register_client.callback = register_client_callback;
        callbacks_ret->register_client.manager_data  = client;

        *mask_ret |= SmsInteractRequestProcMask;
        callbacks_ret->interact_request.callback = interact_request_callback;
        callbacks_ret->interact_request.manager_data = client;

        *mask_ret |= SmsInteractDoneProcMask;
        callbacks_ret->interact_done.callback = interact_done_callback;
        callbacks_ret->interact_done.manager_data = client;

        *mask_ret |= SmsSaveYourselfRequestProcMask;
        callbacks_ret->save_yourself_request.callback = save_yourself_request_callback;
        callbacks_ret->save_yourself_request.manager_data = client;

        *mask_ret |= SmsSaveYourselfP2RequestProcMask;
        callbacks_ret->save_yourself_phase2_request.callback = save_yourself_phase2_request_callback;
        callbacks_ret->save_yourself_phase2_request.manager_data = client;

        *mask_ret |= SmsSaveYourselfDoneProcMask;
        callbacks_ret->save_yourself_done.callback = save_yourself_done_callback;
        callbacks_ret->save_yourself_done.manager_data = client;

        *mask_ret |= SmsCloseConnectionProcMask;
        callbacks_ret->close_connection.callback = close_connection_callback;
        callbacks_ret->close_connection.manager_data  = client;

        *mask_ret |= SmsSetPropertiesProcMask;
        callbacks_ret->set_properties.callback = set_properties_callback;
        callbacks_ret->set_properties.manager_data = client;

        *mask_ret |= SmsDeletePropertiesProcMask;
        callbacks_ret->delete_properties.callback = delete_properties_callback;
        callbacks_ret->delete_properties.manager_data = client;

        *mask_ret |= SmsGetPropertiesProcMask;
        callbacks_ret->get_properties.callback = get_properties_callback;
        callbacks_ret->get_properties.manager_data = client;
}

Project: gnome-session
File: gsm-xsmp-client.c

setup_connection (GsmXSMPClient *client)
{
        GIOChannel    *channel;
        int            fd;

        g_debug ("GsmXSMPClient: Setting up new connection");

        fd = IceConnectionNumber (client->priv->ice_connection);
        fcntl (fd, F_SETFD, fcntl (fd, F_GETFD, 0) | FD_CLOEXEC);
        channel = g_io_channel_unix_new (fd);
        client->priv->watch_id = g_io_add_watch (channel,
                                                 G_IO_IN | G_IO_ERR,
                                                 (GIOFunc)client_iochannel_watch,
                                                  client);
         g_io_channel_unref (channel);
 
         set_description (client);
 
         g_debug ("GsmXSMPClient: New client '%s'", client->priv->description);
}

Project: gnome-session
File: gsm-xsmp-server.c

 accept_ice_connection (GIOChannel           *source,
                        GIOCondition          condition,
                        GsmIceConnectionData *data)
 {
         IceConn         ice_conn;
         IceAcceptStatus status;
 
         g_debug ("GsmXsmpServer: accept_ice_connection()");
 
        ice_conn = IceAcceptConnection (data->listener, &status);
         if (status != IceAcceptSuccess) {
                 g_debug ("GsmXsmpServer: IceAcceptConnection returned %d", status);
                 return TRUE;
         }
 
        auth_ice_connection (ice_conn);
 
         return TRUE;
 }

Project: gnome-session
File: gsm-xsmp-server.c

accept_xsmp_connection (SmsConn        sms_conn,
                        GsmXsmpServer *server,
                        unsigned long *mask_ret,
                         SmsCallbacks  *callbacks_ret,
                         char         **failure_reason_ret)
 {
        IceConn                ice_conn;
        GsmClient             *client;
        GsmIceConnectionWatch *data;
 
         /* FIXME: what about during shutdown but before gsm_xsmp_shutdown? */
         if (server->priv->xsmp_sockets == NULL) {
                g_debug ("GsmXsmpServer: In shutdown, rejecting new client");

                *failure_reason_ret = strdup (_("Refusing new client connection because the session is currently being shut down\n"));
                return FALSE;
         }
 
         ice_conn = SmsGetIceConnection (sms_conn);
        data = ice_conn->context;
 
        /* Each GsmXSMPClient has its own IceConn watcher */
        free_ice_connection_watch (data);

        client = gsm_xsmp_client_new (ice_conn);

        gsm_store_add (server->priv->client_store, gsm_client_peek_id (client), G_OBJECT (client));
        /* the store will own the ref */
        g_object_unref (client);
 
        gsm_xsmp_client_connect (GSM_XSMP_CLIENT (client), sms_conn, mask_ret, callbacks_ret);
 
         return TRUE;
 }