flimflam: add support for multiple profiles

src/profile.c

 /*
  *
  *  Connection Manager
  *
  *  Copyright (C) 2007-2009  Intel Corporation. All rights reserved.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  *
@@ skipping 10 matching lines @@
 
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
 
 #include <string.h>
 
 #include <glib.h>
 #include <gdbus.h>
 
+#include <connman/assert.h>
+
 #include "connman.h"
 
 #define PROFILE_DEFAULT_IDENT  "default"
+#define PROFILE_MAX             3               /* 2 is probably sufficient */
 
 #define _DBG_PROFILE(fmt, arg...)       DBG(DBG_PROFILE, fmt, ## arg)
 
 struct connman_profile {
-        char *ident;
+        struct connman_storage_ident ident;
         char *path;
         char *name;
         connman_bool_t offlinemode;
 };
 
 static GHashTable *profile_hash = NULL;
+
+static struct connman_profile *profile_stack[PROFILE_MAX];
+static int cur_profile = -1;
+
+static struct connman_storage_ident default_ident = {
+        .ident = PROFILE_DEFAULT_IDENT
+};
 static struct connman_profile *default_profile = NULL;
 
 static DBusConnection *connection = NULL;
 
+static int ident_equal(const struct connman_storage_ident *a,
+                       const struct connman_storage_ident *b)
+{
+        return (g_strcmp0(a->user, b->user) == 0 &&
+                g_strcmp0(a->ident, b->ident) == 0);
+}
+
 static void append_path(gpointer key, gpointer value, gpointer user_data)
 {
         struct connman_profile *profile = value;
         DBusMessageIter *iter = user_data;
 
         dbus_message_iter_append_basic(iter, DBUS_TYPE_OBJECT_PATH,
                                                         &profile->path);
 }
 
 void __connman_profile_list(DBusMessageIter *iter, void *arg)
 {
-        _DBG_PROFILE("");
-
         g_hash_table_foreach(profile_hash, append_path, iter);
 }
 
 static void profiles_changed(void)
 {
-        _DBG_PROFILE("");
-
         connman_dbus_send_property_changed_array(CONNMAN_MANAGER_PATH,
             CONNMAN_MANAGER_INTERFACE, "Profiles",
             DBUS_TYPE_OBJECT_PATH, __connman_profile_list, NULL);
 }
 
-static void name_changed(struct connman_profile *profile)
-{
-        _DBG_PROFILE("profile %p", profile);
-
-        connman_dbus_send_property_changed_variant(profile->path,
-            CONNMAN_PROFILE_INTERFACE, "Name",
-            DBUS_TYPE_STRING, &profile->name);
-}
-
-static void offlinemode_changed(struct connman_profile *profile)
-{
-        _DBG_PROFILE("profile %p", profile);
-
-        connman_dbus_send_property_changed_variant(profile->path,
-            CONNMAN_PROFILE_INTERFACE, "OfflineMode",
-            DBUS_TYPE_BOOLEAN, &profile->offlinemode);
-}
-
 connman_bool_t __connman_profile_get_offlinemode(void)
 {
-        if (default_profile == NULL)
-                return FALSE;
-
-        _DBG_PROFILE("offlinemode %d", default_profile->offlinemode);
-
-        return default_profile->offlinemode;
+        return (default_profile == NULL) ? FALSE : default_profile->offlinemode;
 }
 
 int __connman_profile_set_offlinemode(connman_bool_t offlinemode)
 {
         _DBG_PROFILE("offlinemode %d", offlinemode);
 
-        if (default_profile == NULL)
-                return -EINVAL;
-
-        if (default_profile->offlinemode == offlinemode)
-                return -EALREADY;
-
-        default_profile->offlinemode = offlinemode;
-        offlinemode_changed(default_profile);
-
-        __connman_device_set_offlinemode(offlinemode);
-
+        /* TODO(sleffler) disallow if no default profile? */
+        if (default_profile != NULL) {
+                /*
+                 * OfflineMode is only saved to the default profile;
+                 * this ensures it is preserved across user changes.
+                 */
+                if (default_profile->offlinemode == offlinemode)
+                        return -EALREADY;
+
+                default_profile->offlinemode = offlinemode;
+
+                connman_dbus_send_property_changed_variant(
+                    default_profile->path,
+                    CONNMAN_PROFILE_INTERFACE, "OfflineMode",
+                    DBUS_TYPE_BOOLEAN, &offlinemode);
+        }
+        return __connman_device_set_offlinemode(offlinemode);
+}
+
+/*
+ * Return the active profile; it's on the top of the stack.
+ */
+static inline struct connman_profile *active_profile(void)
+{
+        return cur_profile >= 0 ? profile_stack[cur_profile] : NULL;
+}
+
+/*
+ * Load/Save objects.  When loading we walk the stack of profiles
+ * until we find a successful load.  Saving always happens to the
+ * top-most/active profile.
+ */
+
+static inline int load_continue(int err)
+{
+        /* NB: ENXIO for no file, ESRCH for no group/key */
+        return (err == -ENXIO || err == -ESRCH);
+}
+
+int __connman_profile_load_service(struct connman_service *service)
+{
+        int i, err;
+
+        _DBG_PROFILE("service %p", service);
+
+        err = 0;
+        for (i = cur_profile; i >= 0; i--) {
+                const struct connman_profile *profile = profile_stack[i];
+
+                err = __connman_storage_load_service(service, &profile->ident);
+                if (!load_continue(err))
+                        break;
+        }
+        return err;
+}
+
+int __connman_profile_save_service(struct connman_service *service)
+{
+        struct connman_profile *profile = active_profile();
+
+        _DBG_PROFILE("service %p profile %p", service, profile);
+
+        return (profile == NULL) ? 0 :
+            __connman_storage_save_service(service, &profile->ident);
+}
+
+int __connman_profile_load_device(struct connman_device *device)
+{
+        int i, err;
+
+        _DBG_PROFILE("device %p", device);
+
+        err = 0;
+        for (i = cur_profile; i >= 0; i--) {
+                const struct connman_profile *profile = profile_stack[i];
+
+                err = __connman_storage_load_device(device, &profile->ident);
+                if (!load_continue(err))
+                        break;
+        }
+        return err;
+}
+
+int __connman_profile_save_device(struct connman_device *device)
+{
+        struct connman_profile *profile = active_profile();
+
+        _DBG_PROFILE("device %p profile %p", device, profile);
+
+        return (profile == NULL) ? 0:
+            __connman_storage_save_device(device, &profile->ident);
+}
+
+int __connman_profile_load_ipconfig(struct connman_ipconfig *ipconfig)
+{
+        int i, err;
+
+        _DBG_PROFILE("ipconfig %p", ipconfig);
+
+        err = 0;
+        for (i = cur_profile; i >= 0; i--) {
+                const struct connman_profile *profile = profile_stack[i];
+
+                err = __connman_storage_load_ipconfig(ipconfig,
+                    &profile->ident);
+                if (!load_continue(err))
+                        break;
+        }
+        return err;
+}
+
+int __connman_profile_save_ipconfig(const struct connman_ipconfig *ipconfig)
+{
+        struct connman_profile *profile = active_profile();
+
+        _DBG_PROFILE("ipconfig %p profile %p", ipconfig, profile);
+
+        return (profile == NULL) ? 0 :
+            __connman_storage_save_ipconfig(ipconfig, &profile->ident);
+}
+
+int __connman_profile_append_hidden_ssids(GSList **hidden_ssids,
+    void (*append_hidden_ssids)(GKeyFile *keyfile, GSList **hidden_ssids))
+{
+        int i;
+
+        _DBG_PROFILE("");
+
+        for (i = cur_profile; i >= 0; i--) {
+                const struct connman_profile *profile = profile_stack[i];
+                GKeyFile *keyfile;
+
+                keyfile = __connman_storage_open(&profile->ident);
+                if (keyfile != NULL) {
+                        append_hidden_ssids(keyfile, hidden_ssids);
+                        __connman_storage_close(&profile->ident, keyfile,
+                            FALSE);
+                }
+        }
         return 0;
 }
 
+/*
+ * Save the default profile if registered.
+ */
 int __connman_profile_save_default(void)
 {
-        _DBG_PROFILE("");
-
         if (default_profile != NULL)
                 __connman_storage_save_profile(default_profile);
-
         return 0;
 }
 
-const char *__connman_profile_active_ident(void)
-{
-        _DBG_PROFILE("");
-
-        return PROFILE_DEFAULT_IDENT;
-}
-
+/*
+ * Save the active profile (if any).
+ */
+int __connman_profile_save_active(void)
+{
+        struct connman_profile *profile = active_profile();
+        return (profile == NULL) ? -EINVAL :
+            __connman_storage_save_profile(profile);
+}
+
+/*
+ * Return the identifier for the active profile or NULL
+ * if there is none.
+ */
+const struct connman_storage_ident *__connman_profile_active_ident(void)
+{
+        struct connman_profile *profile = active_profile();
+        return profile != NULL ? &profile->ident : NULL;
+}
+
+/*
+ * Return the object path for the active profile or NULL
+ * if there is none.
+ */
 const char *__connman_profile_active_path(void)
 {
-        _DBG_PROFILE("");
-
-        if (default_profile == NULL)
-                return NULL;
-
-        return default_profile->path;
+        struct connman_profile *profile = active_profile();
+        return profile != NULL ? profile->path : NULL;
 }
 
 static guint changed_timeout = 0;
 
+static void clear_timeout(void)
+{
+        if (changed_timeout > 0) {
+                g_source_remove(changed_timeout);
+                changed_timeout = 0;
+        }
+}
+
 static void append_services(DBusMessageIter *iter, void *arg)
 {
-        const struct connman_profile *profile = arg;
-        if (g_strcmp0(profile->ident, PROFILE_DEFAULT_IDENT) == 0)
-                __connman_service_list(iter, arg);
+        __connman_service_list(iter, arg);
 }
 static gboolean services_changed(gpointer user_data)
 {
-        struct connman_profile *profile = default_profile;
+        struct connman_profile *profile = active_profile();
 
         changed_timeout = 0;
 
         if (profile != NULL) {
                 connman_dbus_send_property_changed_array(profile->path,
                     CONNMAN_PROFILE_INTERFACE, "Services",
-                    DBUS_TYPE_OBJECT_PATH, append_services, profile);
-
-                if (g_strcmp0(profile->ident, PROFILE_DEFAULT_IDENT) == 0)
-                        connman_dbus_send_property_changed_array(
-                            CONNMAN_MANAGER_PATH, CONNMAN_MANAGER_INTERFACE,
-                            "Services",
-                            DBUS_TYPE_OBJECT_PATH, append_services, profile);
-        }
+                    DBUS_TYPE_OBJECT_PATH, append_services, NULL);
+        }
+
+        connman_dbus_send_property_changed_array(CONNMAN_MANAGER_PATH,
+            CONNMAN_MANAGER_INTERFACE, "Services",
+            DBUS_TYPE_OBJECT_PATH, append_services, NULL);
         return FALSE;
 }
 
+/*
+ * Handle changes to the profile.  Generate PropertyChanged signals
+ * on Manager.Services and Profile.Services for the currently active
+ * profile.  To minimize overhead requests may be coalesced using a
+ * 1 second delay on the signals.
+ */
 void __connman_profile_changed(gboolean delayed)
 {
-        _DBG_PROFILE("");
-
-        if (changed_timeout > 0) {
-                g_source_remove(changed_timeout);
-                changed_timeout = 0;
-        }
-
-        if (delayed == FALSE) {
+        _DBG_PROFILE("delayed %d changed_timeout %d", delayed, changed_timeout);
+
+        clear_timeout();
+
+        if (delayed == TRUE) {
+                changed_timeout = g_timeout_add_seconds(1, services_changed,
+                    NULL);
+        } else
                 services_changed(NULL);
-                return;
-        }
-
-        changed_timeout = g_timeout_add_seconds(1, services_changed, NULL);
 }
 
 int __connman_profile_add_device(struct connman_device *device)
 {
         struct connman_service *service;
 
         _DBG_PROFILE("device %p", device);
 
         service = __connman_service_create_from_device(device);
         if (service == NULL)
@@ skipping 67 matching lines @@
 
 static void __profile_entry_list(DBusMessageIter *iter, void *arg)
 {
         struct connman_profile *profile = arg;
         GKeyFile *keyfile;
         gchar **groups;
         int i;
 
         _DBG_PROFILE("profile %p", profile);
 
-        keyfile = __connman_storage_open(profile->ident);
+        keyfile = __connman_storage_open(&profile->ident);
         if (keyfile == NULL)
                 return;
 
         groups = g_key_file_get_groups(keyfile, NULL);
         for (i = 0; groups[i] != NULL; i++) {
                 const char *gname = groups[i];
                 switch (get_service_type(gname)) {
                 case CONNMAN_SERVICE_TYPE_UNKNOWN:
                 case CONNMAN_SERVICE_TYPE_ETHERNET:
                         break;
                 case CONNMAN_SERVICE_TYPE_BLUETOOTH:
                 case CONNMAN_SERVICE_TYPE_WIMAX:
                         /* NB: don't care about these right now */
                         break;
                 case CONNMAN_SERVICE_TYPE_CELLULAR:
                 case CONNMAN_SERVICE_TYPE_WIFI:
                         dbus_message_iter_append_basic(iter, DBUS_TYPE_STRING,
                             &gname);
                         break;
                 }
         }
         g_strfreev(groups);
-        __connman_storage_close(profile->ident, keyfile, FALSE);
+        __connman_storage_close(&profile->ident, keyfile, FALSE);
 }
 
 static DBusMessage *get_properties(DBusConnection *conn,
                                         DBusMessage *msg, void *data)
 {
         struct connman_profile *profile = data;
         DBusMessage *reply;
         DBusMessageIter array, dict;
 
         _DBG_PROFILE("conn %p", conn);
 
         reply = dbus_message_new_method_return(msg);
         if (reply == NULL)
                 return NULL;
 
         dbus_message_iter_init_append(reply, &array);
 
         dbus_message_iter_open_container(&array, DBUS_TYPE_ARRAY,
                         DBUS_DICT_ENTRY_BEGIN_CHAR_AS_STRING
                         DBUS_TYPE_STRING_AS_STRING DBUS_TYPE_VARIANT_AS_STRING
                         DBUS_DICT_ENTRY_END_CHAR_AS_STRING, &dict);
 
         if (profile->name != NULL)
                 connman_dbus_dict_append_variant(&dict, "Name",
                     DBUS_TYPE_STRING, &profile->name);
 
-        connman_dbus_dict_append_variant(&dict, "OfflineMode",
-            DBUS_TYPE_BOOLEAN, &profile->offlinemode);
+        if (profile == default_profile)
+                connman_dbus_dict_append_variant(&dict, "OfflineMode",
+                    DBUS_TYPE_BOOLEAN, &profile->offlinemode);
 
-        connman_dbus_dict_append_variant_array(&dict, "Services",
-            DBUS_TYPE_OBJECT_PATH, __connman_service_list, NULL);
+        if (profile == active_profile())
+                connman_dbus_dict_append_variant_array(&dict, "Services",
+                    DBUS_TYPE_OBJECT_PATH, __connman_service_list, NULL);
 
         connman_dbus_dict_append_variant_array(&dict, "Entries",
             DBUS_TYPE_STRING, __profile_entry_list, profile);
 
         dbus_message_iter_close_container(&array, &dict);
 
         return reply;
 }
 
 static DBusMessage *set_property(DBusConnection *conn,
@@ skipping 23 matching lines @@
                 const char *name;
 
                 if (type != DBUS_TYPE_STRING)
                         return __connman_error_invalid_arguments(msg);
 
                 dbus_message_iter_get_basic(&value, &name);
 
                 g_free(profile->name);
                 profile->name = g_strdup(name);
 
-                if (profile->name != NULL)
-                        name_changed(profile);
-
-                __connman_storage_save_profile(profile);
-        } else if (g_str_equal(name, "OfflineMode") == TRUE) {
-                connman_bool_t offlinemode;
-
-                if (type != DBUS_TYPE_BOOLEAN)
-                        return __connman_error_invalid_arguments(msg);
-
-                dbus_message_iter_get_basic(&value, &offlinemode);
-
-                if (profile->offlinemode == offlinemode)
-                        return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
-
-                profile->offlinemode = offlinemode;
-                offlinemode_changed(profile);
+                if (profile->name != NULL) {
+                        connman_dbus_send_property_changed_variant(
+                            profile->path, CONNMAN_PROFILE_INTERFACE, "Name",
+                            DBUS_TYPE_STRING, &profile->name);
+                }
 
                 __connman_storage_save_profile(profile);
         } else
                 return __connman_error_invalid_property(msg);
 
         return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
 }
 
 static DBusMessage *get_entry(DBusConnection *conn,
                                         DBusMessage *msg, void *data)
 {
 #define ADD_STR(name, val) do { \
         connman_dbus_dict_append_variant(&dict, name, DBUS_TYPE_STRING, val); \
 } while (0)
 #define VAL_STR(name) do { \
         val = g_key_file_get_string(keyfile, ident, name, NULL); \
         if (val != NULL) \
                 ADD_STR(name, &val); \
 } while (0)
         struct connman_profile *profile = data;
         GKeyFile *keyfile;
         const char *ident, *val;
         gchar **tokens;
         DBusMessageIter iter, array, dict;
         DBusMessage *reply;
         connman_bool_t autoconnect, hidden_ssid;
+        int len;
 
         _DBG_PROFILE("profile %p", profile);
 
         if (dbus_message_iter_init(msg, &iter) == FALSE)
                 return __connman_error_invalid_arguments(msg);
 
         dbus_message_iter_get_basic(&iter, &ident);
 
-        keyfile = __connman_storage_open(profile->ident);
+        keyfile = __connman_storage_open(&profile->ident);
         if (keyfile == NULL) {
-                _DBG_PROFILE("cannot open keyfile %s", profile->ident);
+                _DBG_PROFILE("cannot open keyfile %s:%s",
+                    profile->ident.user, profile->ident.ident);
                 return __connman_error_not_found(msg);  /* XXX */
         }
 
         if (g_key_file_has_group(keyfile, ident) == FALSE) {
                 _DBG_PROFILE("ident %s not found", ident);
-                __connman_storage_close(profile->ident, keyfile, FALSE);
+                __connman_storage_close(&profile->ident, keyfile, FALSE);
                 return __connman_error_not_found(msg);
         }
 
         /*
          * Split group name into components; e.g.
          * <type>_<device>_<ssid>_<mode>_<security> for wifi
          */
         tokens = g_strsplit(ident, "_", 0);
-        /* NB: tokens[0] is NULL if ident is "" */
-        if (tokens == NULL || tokens[0] == NULL) {
-                _DBG_PROFILE("ident %s malformed", ident);
-                __connman_storage_close(profile->ident, keyfile, FALSE);
+        len = g_strv_length(tokens);
+        if (len < 2) {
+                _DBG_PROFILE("ident %s malformed, len %d", ident, len);
+                g_strfreev(tokens);
+                __connman_storage_close(&profile->ident, keyfile, FALSE);
                 return __connman_error_invalid_arguments(msg);
         }
 
         reply = dbus_message_new_method_return(msg);
         if (reply == NULL) {
                 _DBG_PROFILE("cannot allocate reply");
                 g_strfreev(tokens);
-                __connman_storage_close(profile->ident, keyfile, FALSE);
+                __connman_storage_close(&profile->ident, keyfile, FALSE);
                 return NULL;
         }
 
         dbus_message_iter_init_append(reply, &array);
 
         dbus_message_iter_open_container(&array, DBUS_TYPE_ARRAY,
                         DBUS_DICT_ENTRY_BEGIN_CHAR_AS_STRING
                         DBUS_TYPE_STRING_AS_STRING DBUS_TYPE_VARIANT_AS_STRING
                         DBUS_DICT_ENTRY_END_CHAR_AS_STRING, &dict);
 
         val = tokens[0];
         connman_dbus_dict_append_variant(&dict, "Type", DBUS_TYPE_STRING, &val);
 
         switch (__connman_service_string2type(val)) {
         case CONNMAN_SERVICE_TYPE_WIFI:
-                if (g_strv_length(tokens) != 5) {
-                        /* TODO(sleffler) accept > 5? */
-                        _DBG_PROFILE("bad token cnt %d", g_strv_length(tokens));
+                if (len != 5 && len != 6) {
+                        _DBG_PROFILE("bad token cnt %d for ident %s",
+                            len, ident);
                         break;
                 }
                 val = tokens[3];
                 ADD_STR("Mode", &val);
                 val = tokens[4];
+                /* NB: g_strsplit breaks 802_1x into 802+1x; restore */
+                if (g_strcmp0(val, "802") == 0)
+                        val = "802_1x";
                 ADD_STR("Security", &val);
                 break;
         case CONNMAN_SERVICE_TYPE_CELLULAR:
                 /* TODO(sleffler) extract cellular attributes */
                 break;
         default:
                 break;
         }
 
         /* NB: always set AutoConnect in reply */
         val = g_key_file_get_string(keyfile, ident, "AutoConnect", NULL);
         autoconnect = (g_strcmp0(val, "true") == 0 ? TRUE : FALSE);
         connman_dbus_dict_append_variant(&dict, "AutoConnect",
                                 DBUS_TYPE_BOOLEAN, &autoconnect);
 
         VAL_STR("Name");
         VAL_STR("Passphrase");
         VAL_STR("Failure");
         VAL_STR("Modified");
 
         val = g_key_file_get_string(keyfile, ident, "WiFi.HiddenSSID", NULL);
         hidden_ssid = (g_strcmp0(val, "true") == 0 ? TRUE : FALSE);
         connman_dbus_dict_append_variant(&dict, "WiFi.HiddenSSID",
                                 DBUS_TYPE_BOOLEAN, &hidden_ssid);
 
         dbus_message_iter_close_container(&array, &dict);
 
         g_strfreev(tokens);
-        __connman_storage_close(profile->ident, keyfile, FALSE);
+        __connman_storage_close(&profile->ident, keyfile, FALSE);
 
         return reply;
 #undef VAL_STR
 #undef ADD_STR
 }
 
 static DBusMessage *delete_entry(DBusConnection *conn,
                                         DBusMessage *msg, void *data)
 {
         struct connman_profile *profile = data;
         DBusMessageIter iter;
         const char *identifier;
         struct connman_service *service;
         GKeyFile *keyfile;
         gboolean status;
 
-        _DBG_PROFILE("profile %s", profile->ident);
+        _DBG_PROFILE("profile %s:%s", profile->ident.user,
+            profile->ident.ident);
 
         if (dbus_message_iter_init(msg, &iter) == FALSE)
                 return __connman_error_invalid_arguments(msg);
 
         dbus_message_iter_get_basic(&iter, &identifier);
 
         if (__connman_security_check_privilege(msg,
                                         CONNMAN_SECURITY_PRIVILEGE_MODIFY) < 0)
                 return __connman_error_permission_denied(msg);
 
         service = __connman_service_lookup(identifier);
         if (service != NULL) {
                 /* NB: this does not remove the service */
                 __connman_service_reset(service);
         }
 
         /* Remove directly from profile */
-        keyfile = __connman_storage_open(profile->ident);
+        keyfile = __connman_storage_open(&profile->ident);
         if (keyfile == NULL) {
                 _DBG_PROFILE("cannot open key file");
                 return __connman_error_invalid_arguments(msg);
         }
 
         status = g_key_file_remove_group(keyfile, identifier, NULL);
-        __connman_storage_close(profile->ident, keyfile, status);
+        __connman_storage_close(&profile->ident, keyfile, status);
 
         if (status == FALSE) {
                 _DBG_PROFILE("cannot remove %s", identifier);
                 return __connman_error_not_found(msg);
         }
 
         return g_dbus_create_reply(msg, DBUS_TYPE_INVALID);
 }
 
 static GDBusMethodTable profile_methods[] = {
         { "GetProperties", "",   "a{sv}", get_properties },
         { "SetProperty",   "sv", "",      set_property   },
         { "GetEntry",      "s",  "a{sv}", get_entry },
         { "DeleteEntry",   "s",  "",      delete_entry },
         { },
 };
 
 static GDBusSignalTable profile_signals[] = {
         { "PropertyChanged", "sv" },
         { },
 };
 
+static void free_ident(struct connman_storage_ident *ident)
+{
+        /* NB: blech, don't reclaim, it's statically allocated */
+        if (!ident_equal(ident, &default_ident)) {
+                g_free(ident->user);
+                g_free(ident->ident);
+        }
+}
+
 static void free_profile(struct connman_profile *profile)
 {
+        free_ident(&profile->ident);
+        g_free(profile->path);
         g_free(profile->name);
-        g_free(profile->path);
-        g_free(profile->ident);
         g_free(profile);
 }
 
 static void unregister_profile(gpointer data)
 {
         struct connman_profile *profile = data;
 
         _DBG_PROFILE("profile %p", profile);
 
-        connman_info("Removing profile %s", profile->ident);
+        connman_info("Remove profile %s:%s", profile->ident.user,
+            profile->ident.ident);
 
         g_dbus_unregister_interface(connection, profile->path,
                                                 CONNMAN_PROFILE_INTERFACE);
 
-        if (g_strcmp0(profile->ident, PROFILE_DEFAULT_IDENT) == 0)
+        if (profile == default_profile)
                 default_profile = NULL;
 
         free_profile(profile);
 }
 
-static int create_profile(const char *ident, const char *name,
-                                                        const char **path)
+static char *getpath(const struct connman_storage_ident *ident)
+{
+        if (ident->user != NULL) {
+                /* NB: check for two tokens done in validate_ident */
+                return g_strdup_printf("/profile/%s/%s",
+                    ident->user, ident->ident);
+        } else
+                return g_strdup_printf("/profile/%s", ident->ident);
+}
+
+/*
+ * Create an in-memory profile using the specified identifier
+ * and name.  The object path and a reference to the profile
+ * data structure are returned on success.
+ */
+static int create_profile(struct connman_storage_ident *ident,
+    const char *name, const char **path, struct connman_profile **pprofile)
 {
         struct connman_profile *profile;
 
-        _DBG_PROFILE("ident %s name %s", ident, name);
+        _DBG_PROFILE("ident %s:%s name %s", ident->user, ident->ident, name);
 
         profile = g_try_new0(struct connman_profile, 1);
-        if (profile == NULL)
+        if (profile == NULL) {
+                free_ident(ident);
                 return -ENOMEM;
+        }
 
-        profile->ident = g_strdup(ident);
-        profile->path = g_strdup_printf("/profile/%s", ident);
-
-        if (profile->ident == NULL || profile->path == NULL) {
+        profile->ident = *ident;
+        profile->path = getpath(ident);
+        /* TODO(sleffler) check ident.user */
+        if (profile->ident.ident == NULL || profile->path == NULL) {
                 free_profile(profile);
                 return -ENOMEM;
         }
 
         if (g_hash_table_lookup(profile_hash, profile->path) != NULL) {
                 free_profile(profile);
                 return -EEXIST;
         }
 
         profile->name = g_strdup(name);
 
         __connman_storage_load_profile(profile);
 
         g_hash_table_insert(profile_hash, g_strdup(profile->path), profile);
 
-        connman_info("Adding profile %s", ident);
+        connman_info("Add profile %s:%s", ident->user, ident->ident);
 
-        if (g_strcmp0(ident, PROFILE_DEFAULT_IDENT) == 0)
+        if (ident_equal(ident, &default_ident))
                 default_profile = profile;
 
         g_dbus_register_interface(connection, profile->path,
                                         CONNMAN_PROFILE_INTERFACE,
                                         profile_methods, profile_signals,
                                                         NULL, profile, NULL);
 
         if (path != NULL)
                 *path = profile->path;
 
         _DBG_PROFILE("profile %p path %s", profile, profile->path);
 
+        *pprofile = profile;
         return 0;
 }
 
-static gboolean validate_ident(const char *ident)
+/*
+ * Check a profile identifier token.  This must be non-null and
+ * made up of alpha-numeric chars suitable for use in a D-bus
+ * object path.
+ */
+static gboolean validate_token(const char *ident)
 {
         unsigned int i;
         unsigned int len = strlen(ident);
 
         if (len < 1)
                 return FALSE;
 
         for (i = 0; i < len; i++) {
                 if (ident[i] >= '0' && ident[i] <= '9')
                         continue;
                 if (ident[i] >= 'a' && ident[i] <= 'z')
                         continue;
                 if (ident[i] >= 'A' && ident[i] <= 'Z')
                         continue;
                 return FALSE;
         }
 
         return TRUE;
 }
 
+/*
+ * Validate the profile identifier.  It must be suitable
+ * for use in a D-Bus object path and, optionally, be of
+ * the form ~user/ident to signify a per-user profile.
+ */ 
+static gboolean parse_ident(const char *str,
+    struct connman_storage_ident *ident)
+{
+        gboolean is_valid;
+
+        if (str[0] == '~') {
+                /* syntax is ~user/name for profile in cryptohome */
+                gchar **tokens = g_strsplit_set(str, "~/", 4);
+                if (g_strv_length(tokens) == 3) {
+                        is_valid = (validate_token(tokens[1]) == TRUE &&
+                                    validate_token(tokens[2]) == TRUE);
+                        if (is_valid) {
+                                ident->user = g_strdup(tokens[1]);
+                                ident->ident = g_strdup(tokens[2]);
+                        }
+                } else
+                        is_valid = FALSE;
+                g_strfreev(tokens);
+        } else {
+                is_valid = validate_token(str);
+                if (is_valid) {
+                        ident->user = NULL;
+                        ident->ident = g_strdup(str);
+                }
+        }
+        return is_valid;
+}
+
+/*
+ * Lookup a profile on the stack by object path.
+ */
+static struct connman_profile *lookup_stack_by_path(const char *path)
+{
+        int i;
+
+        for (i = cur_profile; i >= 0; i--)
+                if (g_strcmp0(profile_stack[i]->path, path) == 0)
+                        return profile_stack[i];
+        return NULL;
+}
+
+/*
+ * Push a profile on the stack and make it the ``active profile''.
+ * The profile may be currently registered in memory or previously
+ * created by CreateProfile.  The profile may not already be on
+ * the stack.
+ */
+int __connman_profile_push(const char *ident, const char *name,
+    const char **path)
+{
+        struct connman_profile *profile;
+        struct connman_storage_ident sid;
+        char *tmp_path;
+        int err;
+
+        _DBG_PROFILE("ident %s name %s", ident, name);
+
+        if (parse_ident(ident, &sid) == FALSE) {
+                connman_error("%s: invalid profile name %s", __func__, ident);
+                return -EINVAL;
+        }
+
+        if (cur_profile+1 >= PROFILE_MAX) {
+                connman_error("%s: too many profiles (max %d)", __func__,
+                    PROFILE_MAX);
+                free_ident(&sid);
+                return -EMFILE;
+        }
+
+        /*
+         * Check for in-memory profile by way of a CreateProfile request.
+         */
+        tmp_path = getpath(&sid);
+        if (tmp_path == NULL) {
+                connman_error("%s: no memory for %s", __func__, ident);
+                free_ident(&sid);
+                return -ENOMEM;
+        }
+
+        profile = g_hash_table_lookup(profile_hash, tmp_path);
+        g_free(tmp_path);
+        if (profile == NULL) {
+                /*
+                 * Not in memory; accept an existing file.
+                 */
+                if (__connman_storage_exists(&sid) == FALSE) {
+                        connman_error("%s: profile %s does not exist",
+                            __func__, ident);
+                        free_ident(&sid);
+                        return -ENOENT;
+                }
+
+                err = create_profile(&sid, name, path, &profile);
+                if (err < 0) {
+                        connman_error("%s: cannot open, error %d",
+                            __func__, err);
+                        /* NB: create_profile reclaims sid */
+                        return err;
+                }
+        } else {
+                free_ident(&sid);       /* NB: not needed below */
+                /*
+                 * Check this profile is not already on the stack.
+                 */
+                if (lookup_stack_by_path(profile->path) != NULL) {
+                        connman_error("%s: already pushed", __func__);
+                        return -EEXIST;
+                }
+                if (path != NULL)
+                        *path = profile->path;
+        }
+
+        profile_stack[++cur_profile] = profile;
+
+        profiles_changed();
+
+        /* NB: this is a noop if we are online (or trying to get online) */
+        __connman_service_auto_connect_any();
+
+        return 0;
+}
+
+/*
+ * Pop the profile from the top of the stack and remove it from
+ * the in-memory table.  Any associated services are invalidated
+ * (credentials revoked and connections closed). After a pop we
+ * generate a PropertyChanged signal for Manager.Profiles.
+ *
+ * An optional identifier may be specified.  If specified it is
+ * checked against the active profile and if not the same then
+ * the request is rejected.  This is useful to ensure the right
+ * profile is pop'd (as might happen on logout if an associated
+ * push failed for some reason).
+ */
+int __connman_profile_pop(const char *ident)
+{
+        struct connman_profile *profile;
+
+        _DBG_PROFILE("ident %s", ident);
+
+        if (cur_profile < 0) {
+                connman_error("%s: profile stack empty", __func__);
+                return -EINVAL;
+        }
+
+        profile = profile_stack[cur_profile];
+
+        if (ident != NULL) {
+                struct connman_storage_ident sid;
+
+                if (parse_ident(ident, &sid) == FALSE) {
+                        connman_error("%s: invalid profile name %s",
+                            __func__, ident);
+                        return -EINVAL;
+                }
+                if (ident_equal(&profile->ident, &sid) == FALSE) {
+                        connman_error("%s: %s is not the active profile",
+                            __func__, ident);
+                        free_ident(&sid);
+                        return -ENXIO;
+                }
+                free_ident(&sid);
+        }
+
+        __connman_service_invalidate_profile(&profile->ident);
+
+        g_hash_table_remove(profile_hash, profile->path);
+        cur_profile--;
+
+        profiles_changed();
+
+        /* NB: no need to kick auto-connect; it will happen due to invalidate */
+
+        return 0;
+}
+
+/*
+ * Create a profile file and register it in memory.  The
+ * file is created with minimal contents.
+ * TODO(sleffler) disallow overwriting an existing file?
+ */
 int __connman_profile_create(const char *name, const char **path)
 {
         struct connman_profile *profile;
+        struct connman_storage_ident sid;
         int err;
 
         _DBG_PROFILE("name %s", name);
 
-        if (validate_ident(name) == FALSE)
-                return -EINVAL;
-
-        err = create_profile(name, NULL, path);
-        if (err < 0)
+        if (parse_ident(name, &sid) == FALSE) {
+                connman_error("%s: invalid profile name %s)", __func__, name);
+                return -EINVAL;
+        }
+
+        err = create_profile(&sid, NULL, path, &profile);
+        if (err < 0) {
+                connman_error("%s: cannot open, error %d", __func__, err);
+                /* NB: create_profile reclaims sid */
                 return err;
-
-        profile = g_hash_table_lookup(profile_hash, *path);
-        if (profile == NULL)
-                return -EIO;
+        }
 
         __connman_storage_save_profile(profile);
 
         profiles_changed();
 
         return 0;
 }
 
-int __connman_profile_remove(const char *path)
-{
-        struct connman_profile *profile;
-
-        _DBG_PROFILE("path %s", path);
-
-        if (default_profile != NULL &&
-                                g_strcmp0(path, default_profile->path) == 0)
-                return -EINVAL;
-
-        profile = g_hash_table_lookup(profile_hash, path);
-        if (profile == NULL)
-                return -ENXIO;
-
-        __connman_storage_delete(profile->ident);
-
-        g_hash_table_remove(profile_hash, path);
-
-        profiles_changed();
-
-        return 0;
-}
-
+/*
+ * Delete a profile and remove from memory.  The default
+ * profile may not be removed/deleted.  Likewise, one
+ * cannot remove a profile pushed on the stack.
+ */
+int __connman_profile_remove(const char *ident)
+{
+        struct connman_profile *profile;
+        struct connman_storage_ident sid;
+        char *tmp_path;
+        int err = 0;
+
+        _DBG_PROFILE("ident %s", ident);
+
+        if (parse_ident(ident, &sid) == FALSE) {
+                connman_error("%s: invalid profile name %s)", __func__, ident);
+                return -EINVAL;
+        }
+
+        if (ident_equal(&sid, &default_ident)) {
+                /* TODO(sleffler) should this be permitted? */
+                connman_error("%s: cannot delete default profile", __func__);
+                err = -EINVAL;
+                goto done;
+        }
+
+        /*
+         * Check for in-memory profile by way of a CreateProfile request.
+         */
+        tmp_path = getpath(&sid);
+        if (tmp_path == NULL) {
+                connman_error("%s: no memory for %s", __func__, ident);
+                err = -ENOMEM;
+                goto done;
+        }
+        profile = g_hash_table_lookup(profile_hash, tmp_path);
+        g_free(tmp_path);
+
+        if (profile != NULL) {
+                /*
+                 * Check this profile is not on the stack.
+                 */
+                if (lookup_stack_by_path(profile->path) != NULL) {
+                        connman_error("%s: cannot delete (on the stack)",
+                            __func__);
+                        err = -EEXIST;
+                        goto done;
+                }
+                g_hash_table_remove(profile_hash, profile->path);
+
+                profiles_changed();
+        }
+
+        __connman_storage_delete(&sid);
+done:
+        free_ident(&sid);
+        return err;
+}
+
+/*
+ * Initialize the profile stack by pushing the default
+ * (global) profile.  Unlike connman we do not read in
+ * all available .profile's in the global dir.
+ */
 static int profile_init(void)
 {
-        GDir *dir;
-        const gchar *file;
-
-        _DBG_PROFILE("");
-
-        dir = g_dir_open(STORAGEDIR, 0, NULL);
-        if (dir != NULL) {
-                while ((file = g_dir_read_name(dir)) != NULL) {
-                        GString *str;
-                        gchar *ident;
-
-                        if (g_str_has_suffix(file, ".profile") == FALSE)
-                                continue;
-
-                        ident = g_strrstr(file, ".profile");
-                        if (ident == NULL)
-                                continue;
-
-                        str = g_string_new_len(file, ident - file);
-                        if (str == NULL)
-                                continue;
-
-                        ident = g_string_free(str, FALSE);
-
-                        if (validate_ident(ident) == TRUE)
-                                create_profile(ident, NULL, NULL);
-
-                        g_free(ident);
-                }
-
-                g_dir_close(dir);
-        }
-
-        if (g_hash_table_size(profile_hash) == 0)
-                create_profile(PROFILE_DEFAULT_IDENT, "Default", NULL);
-
-        profiles_changed();
-
-        return 0;
+        struct connman_profile *profile;
+        int err;
+
+        err = create_profile(&default_ident, "Default", NULL, &profile);
+        if (err == 0)
+                profile_stack[++cur_profile] = profile;
+        return err;
 }
 
 static int profile_load(struct connman_profile *profile)
 {
         GKeyFile *keyfile;
         GError *error = NULL;
         connman_bool_t offlinemode;
         char *name;
 
         _DBG_PROFILE("profile %p", profile);
 
-        keyfile = __connman_storage_open(profile->ident);
+        keyfile = __connman_storage_open(&profile->ident);
         if (keyfile == NULL)
                 return -EIO;
 
         name = g_key_file_get_string(keyfile, "global", "Name", NULL);
         if (name != NULL) {
                 g_free(profile->name);
                 profile->name = name;
         }
 
         offlinemode = g_key_file_get_boolean(keyfile, "global",
                                                 "OfflineMode", &error);
         if (error == NULL)
                 profile->offlinemode = offlinemode;
         g_clear_error(&error);
 
-        __connman_storage_close(profile->ident, keyfile, FALSE);
+        __connman_storage_close(&profile->ident, keyfile, FALSE);
 
         return 0;
 }
 
 static int profile_save(struct connman_profile *profile)
 {
         GKeyFile *keyfile;
 
         _DBG_PROFILE("profile %p", profile);
 
-        keyfile = __connman_storage_open(profile->ident);
+        keyfile = __connman_storage_open(&profile->ident);
         if (keyfile == NULL)
                 return -EIO;
 
         if (profile->name != NULL)
                 g_key_file_set_string(keyfile, "global",
                                                 "Name", profile->name);
 
         g_key_file_set_boolean(keyfile, "global",
                                         "OfflineMode", profile->offlinemode);
 
-        __connman_storage_close(profile->ident, keyfile, TRUE);
+        __connman_storage_close(&profile->ident, keyfile, TRUE);
 
         return 0;
 }
 
 static struct connman_storage profile_storage = {
         .name           = "profile",
         .priority       = CONNMAN_STORAGE_PRIORITY_LOW,
         .profile_init   = profile_init,
         .profile_load   = profile_load,
         .profile_save   = profile_save,
 };
 
 int __connman_profile_init(void)
 {
         _DBG_PROFILE("");
 
         connection = connman_dbus_get_connection();
         if (connection == NULL)
                 return -1;
 
         if (connman_storage_register(&profile_storage) < 0)
                 connman_error("Failed to register profile storage");
 
         profile_hash = g_hash_table_new_full(g_str_hash, g_str_equal,
                                                 g_free, unregister_profile);
 
         return 0;
 }
 
+int __connman_profile_push_batch(char **profiles)
+{
+        int i;
+
+        if (profiles == NULL)
+                return 0;
+
+        for (i = 0; profiles[i] != NULL; i++) {
+                int err = __connman_profile_push(profiles[i], NULL, NULL);
+                if (err != 0)
+                        return err;
+        }
+        return 0;
+}
+
 void __connman_profile_cleanup(void)
 {
         _DBG_PROFILE("");
 
         if (connection == NULL)
                 return;
 
+        while (cur_profile >= 0)
+                __connman_profile_pop(NULL);
+
         g_hash_table_destroy(profile_hash);
         profile_hash = NULL;
 
+        clear_timeout();                /* cancel any pending timer */
+
         connman_storage_unregister(&profile_storage);
 
         dbus_connection_unref(connection);
 }