mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-09-09 00:07:57 -06:00
Remove tabs introduced from VNC ACL series
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6727 c046a42c-6fe2-441c-8c8c-71466251a162
This commit is contained in:
aliguori
parent
76655d6dec
commit
28a76be8f4
4 changed files with 711 additions and 711 deletions
470
vnc-auth-sasl.c
470
vnc-auth-sasl.c
|
|
@ -31,14 +31,14 @@
|
|||
void vnc_sasl_client_cleanup(VncState *vs)
|
||||
{
|
||||
if (vs->sasl.conn) {
|
||||
vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
|
||||
vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
|
||||
vs->sasl.encoded = NULL;
|
||||
free(vs->sasl.username);
|
||||
free(vs->sasl.mechlist);
|
||||
vs->sasl.username = vs->sasl.mechlist = NULL;
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
|
||||
vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
|
||||
vs->sasl.encoded = NULL;
|
||||
free(vs->sasl.username);
|
||||
free(vs->sasl.mechlist);
|
||||
vs->sasl.username = vs->sasl.mechlist = NULL;
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -48,33 +48,33 @@ long vnc_client_write_sasl(VncState *vs)
|
|||
long ret;
|
||||
|
||||
VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
|
||||
vs->output.buffer, vs->output.capacity, vs->output.offset,
|
||||
vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
|
||||
vs->output.buffer, vs->output.capacity, vs->output.offset,
|
||||
vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
|
||||
|
||||
if (!vs->sasl.encoded) {
|
||||
int err;
|
||||
err = sasl_encode(vs->sasl.conn,
|
||||
(char *)vs->output.buffer,
|
||||
vs->output.offset,
|
||||
(const char **)&vs->sasl.encoded,
|
||||
&vs->sasl.encodedLength);
|
||||
if (err != SASL_OK)
|
||||
return vnc_client_io_error(vs, -1, EIO);
|
||||
int err;
|
||||
err = sasl_encode(vs->sasl.conn,
|
||||
(char *)vs->output.buffer,
|
||||
vs->output.offset,
|
||||
(const char **)&vs->sasl.encoded,
|
||||
&vs->sasl.encodedLength);
|
||||
if (err != SASL_OK)
|
||||
return vnc_client_io_error(vs, -1, EIO);
|
||||
|
||||
vs->sasl.encodedOffset = 0;
|
||||
vs->sasl.encodedOffset = 0;
|
||||
}
|
||||
|
||||
ret = vnc_client_write_buf(vs,
|
||||
vs->sasl.encoded + vs->sasl.encodedOffset,
|
||||
vs->sasl.encodedLength - vs->sasl.encodedOffset);
|
||||
vs->sasl.encoded + vs->sasl.encodedOffset,
|
||||
vs->sasl.encodedLength - vs->sasl.encodedOffset);
|
||||
if (!ret)
|
||||
return 0;
|
||||
return 0;
|
||||
|
||||
vs->sasl.encodedOffset += ret;
|
||||
if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
|
||||
vs->output.offset = 0;
|
||||
vs->sasl.encoded = NULL;
|
||||
vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
|
||||
vs->output.offset = 0;
|
||||
vs->sasl.encoded = NULL;
|
||||
vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
|
||||
}
|
||||
|
||||
/* Can't merge this block with one above, because
|
||||
|
|
@ -83,7 +83,7 @@ long vnc_client_write_sasl(VncState *vs)
|
|||
* SASL encoded output
|
||||
*/
|
||||
if (vs->output.offset == 0) {
|
||||
qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
|
||||
qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
|
||||
}
|
||||
|
||||
return ret;
|
||||
|
|
@ -100,16 +100,16 @@ long vnc_client_read_sasl(VncState *vs)
|
|||
|
||||
ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
|
||||
if (!ret)
|
||||
return 0;
|
||||
return 0;
|
||||
|
||||
err = sasl_decode(vs->sasl.conn,
|
||||
(char *)encoded, ret,
|
||||
&decoded, &decodedLen);
|
||||
(char *)encoded, ret,
|
||||
&decoded, &decodedLen);
|
||||
|
||||
if (err != SASL_OK)
|
||||
return vnc_client_io_error(vs, -1, -EIO);
|
||||
return vnc_client_io_error(vs, -1, -EIO);
|
||||
VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
|
||||
encoded, ret, decoded, decodedLen);
|
||||
encoded, ret, decoded, decodedLen);
|
||||
buffer_reserve(&vs->input, decodedLen);
|
||||
buffer_append(&vs->input, decoded, decodedLen);
|
||||
return decodedLen;
|
||||
|
|
@ -124,27 +124,27 @@ static int vnc_auth_sasl_check_access(VncState *vs)
|
|||
|
||||
err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
return -1;
|
||||
VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
return -1;
|
||||
}
|
||||
if (val == NULL) {
|
||||
VNC_DEBUG("no client username was found, denying access\n");
|
||||
return -1;
|
||||
VNC_DEBUG("no client username was found, denying access\n");
|
||||
return -1;
|
||||
}
|
||||
VNC_DEBUG("SASL client username %s\n", (const char *)val);
|
||||
|
||||
vs->sasl.username = qemu_strdup((const char*)val);
|
||||
|
||||
if (vs->vd->sasl.acl == NULL) {
|
||||
VNC_DEBUG("no ACL activated, allowing access\n");
|
||||
return 0;
|
||||
VNC_DEBUG("no ACL activated, allowing access\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
|
||||
|
||||
VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
|
||||
allow ? "allowed" : "denied");
|
||||
allow ? "allowed" : "denied");
|
||||
return allow ? 0 : -1;
|
||||
}
|
||||
|
||||
|
|
@ -154,16 +154,16 @@ static int vnc_auth_sasl_check_ssf(VncState *vs)
|
|||
int err, ssf;
|
||||
|
||||
if (!vs->sasl.wantSSF)
|
||||
return 1;
|
||||
return 1;
|
||||
|
||||
err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
|
||||
if (err != SASL_OK)
|
||||
return 0;
|
||||
return 0;
|
||||
|
||||
ssf = *(const int *)val;
|
||||
VNC_DEBUG("negotiated an SSF of %d\n", ssf);
|
||||
if (ssf < 56)
|
||||
return 0; /* 56 is good for Kerberos */
|
||||
return 0; /* 56 is good for Kerberos */
|
||||
|
||||
/* Only setup for read initially, because we're about to send an RPC
|
||||
* reply which must be in plain text. When the next incoming RPC
|
||||
|
|
@ -204,73 +204,73 @@ static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t le
|
|||
|
||||
/* NB, distinction of NULL vs "" is *critical* in SASL */
|
||||
if (datalen) {
|
||||
clientdata = (char*)data;
|
||||
clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
|
||||
datalen--; /* Don't count NULL byte when passing to _start() */
|
||||
clientdata = (char*)data;
|
||||
clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
|
||||
datalen--; /* Don't count NULL byte when passing to _start() */
|
||||
}
|
||||
|
||||
VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
|
||||
clientdata, datalen);
|
||||
clientdata, datalen);
|
||||
err = sasl_server_step(vs->sasl.conn,
|
||||
clientdata,
|
||||
datalen,
|
||||
&serverout,
|
||||
&serveroutlen);
|
||||
clientdata,
|
||||
datalen,
|
||||
&serverout,
|
||||
&serveroutlen);
|
||||
if (err != SASL_OK &&
|
||||
err != SASL_CONTINUE) {
|
||||
VNC_DEBUG("sasl step failed %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
err != SASL_CONTINUE) {
|
||||
VNC_DEBUG("sasl step failed %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
if (serveroutlen > SASL_DATA_MAX_LEN) {
|
||||
VNC_DEBUG("sasl step reply data too long %d\n",
|
||||
serveroutlen);
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("sasl step reply data too long %d\n",
|
||||
serveroutlen);
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
|
||||
serveroutlen, serverout ? 0 : 1);
|
||||
serveroutlen, serverout ? 0 : 1);
|
||||
|
||||
if (serveroutlen) {
|
||||
vnc_write_u32(vs, serveroutlen + 1);
|
||||
vnc_write(vs, serverout, serveroutlen + 1);
|
||||
vnc_write_u32(vs, serveroutlen + 1);
|
||||
vnc_write(vs, serverout, serveroutlen + 1);
|
||||
} else {
|
||||
vnc_write_u32(vs, 0);
|
||||
vnc_write_u32(vs, 0);
|
||||
}
|
||||
|
||||
/* Whether auth is complete */
|
||||
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
|
||||
|
||||
if (err == SASL_CONTINUE) {
|
||||
VNC_DEBUG("%s", "Authentication must continue\n");
|
||||
/* Wait for step length */
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
|
||||
VNC_DEBUG("%s", "Authentication must continue\n");
|
||||
/* Wait for step length */
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
|
||||
} else {
|
||||
if (!vnc_auth_sasl_check_ssf(vs)) {
|
||||
VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
if (!vnc_auth_sasl_check_ssf(vs)) {
|
||||
VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
|
||||
/* Check username whitelist ACL */
|
||||
if (vnc_auth_sasl_check_access(vs) < 0) {
|
||||
VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
/* Check username whitelist ACL */
|
||||
if (vnc_auth_sasl_check_access(vs) < 0) {
|
||||
VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
|
||||
VNC_DEBUG("Authentication successful %d\n", vs->csock);
|
||||
vnc_write_u32(vs, 0); /* Accept auth */
|
||||
/*
|
||||
* Delay writing in SSF encoded mode until pending output
|
||||
* buffer is written
|
||||
*/
|
||||
if (vs->sasl.runSSF)
|
||||
vs->sasl.waitWriteSSF = vs->output.offset;
|
||||
start_client_init(vs);
|
||||
VNC_DEBUG("Authentication successful %d\n", vs->csock);
|
||||
vnc_write_u32(vs, 0); /* Accept auth */
|
||||
/*
|
||||
* Delay writing in SSF encoded mode until pending output
|
||||
* buffer is written
|
||||
*/
|
||||
if (vs->sasl.runSSF)
|
||||
vs->sasl.waitWriteSSF = vs->output.offset;
|
||||
start_client_init(vs);
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
|
@ -293,15 +293,15 @@ static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_
|
|||
uint32_t steplen = read_u32(data, 0);
|
||||
VNC_DEBUG("Got client step len %d\n", steplen);
|
||||
if (steplen > SASL_DATA_MAX_LEN) {
|
||||
VNC_DEBUG("Too much SASL data %d\n", steplen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
VNC_DEBUG("Too much SASL data %d\n", steplen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (steplen == 0)
|
||||
return protocol_client_auth_sasl_step(vs, NULL, 0);
|
||||
return protocol_client_auth_sasl_step(vs, NULL, 0);
|
||||
else
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -332,67 +332,67 @@ static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t l
|
|||
|
||||
/* NB, distinction of NULL vs "" is *critical* in SASL */
|
||||
if (datalen) {
|
||||
clientdata = (char*)data;
|
||||
clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
|
||||
datalen--; /* Don't count NULL byte when passing to _start() */
|
||||
clientdata = (char*)data;
|
||||
clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
|
||||
datalen--; /* Don't count NULL byte when passing to _start() */
|
||||
}
|
||||
|
||||
VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
|
||||
vs->sasl.mechlist, clientdata, datalen);
|
||||
vs->sasl.mechlist, clientdata, datalen);
|
||||
err = sasl_server_start(vs->sasl.conn,
|
||||
vs->sasl.mechlist,
|
||||
clientdata,
|
||||
datalen,
|
||||
&serverout,
|
||||
&serveroutlen);
|
||||
vs->sasl.mechlist,
|
||||
clientdata,
|
||||
datalen,
|
||||
&serverout,
|
||||
&serveroutlen);
|
||||
if (err != SASL_OK &&
|
||||
err != SASL_CONTINUE) {
|
||||
VNC_DEBUG("sasl start failed %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
err != SASL_CONTINUE) {
|
||||
VNC_DEBUG("sasl start failed %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
if (serveroutlen > SASL_DATA_MAX_LEN) {
|
||||
VNC_DEBUG("sasl start reply data too long %d\n",
|
||||
serveroutlen);
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("sasl start reply data too long %d\n",
|
||||
serveroutlen);
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
|
||||
serveroutlen, serverout ? 0 : 1);
|
||||
serveroutlen, serverout ? 0 : 1);
|
||||
|
||||
if (serveroutlen) {
|
||||
vnc_write_u32(vs, serveroutlen + 1);
|
||||
vnc_write(vs, serverout, serveroutlen + 1);
|
||||
vnc_write_u32(vs, serveroutlen + 1);
|
||||
vnc_write(vs, serverout, serveroutlen + 1);
|
||||
} else {
|
||||
vnc_write_u32(vs, 0);
|
||||
vnc_write_u32(vs, 0);
|
||||
}
|
||||
|
||||
/* Whether auth is complete */
|
||||
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
|
||||
|
||||
if (err == SASL_CONTINUE) {
|
||||
VNC_DEBUG("%s", "Authentication must continue\n");
|
||||
/* Wait for step length */
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
|
||||
VNC_DEBUG("%s", "Authentication must continue\n");
|
||||
/* Wait for step length */
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
|
||||
} else {
|
||||
if (!vnc_auth_sasl_check_ssf(vs)) {
|
||||
VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
if (!vnc_auth_sasl_check_ssf(vs)) {
|
||||
VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
|
||||
/* Check username whitelist ACL */
|
||||
if (vnc_auth_sasl_check_access(vs) < 0) {
|
||||
VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
/* Check username whitelist ACL */
|
||||
if (vnc_auth_sasl_check_access(vs) < 0) {
|
||||
VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
|
||||
goto authreject;
|
||||
}
|
||||
|
||||
VNC_DEBUG("Authentication successful %d\n", vs->csock);
|
||||
vnc_write_u32(vs, 0); /* Accept auth */
|
||||
start_client_init(vs);
|
||||
VNC_DEBUG("Authentication successful %d\n", vs->csock);
|
||||
vnc_write_u32(vs, 0); /* Accept auth */
|
||||
start_client_init(vs);
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
|
@ -415,13 +415,13 @@ static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size
|
|||
uint32_t startlen = read_u32(data, 0);
|
||||
VNC_DEBUG("Got client start len %d\n", startlen);
|
||||
if (startlen > SASL_DATA_MAX_LEN) {
|
||||
VNC_DEBUG("Too much SASL data %d\n", startlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
VNC_DEBUG("Too much SASL data %d\n", startlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (startlen == 0)
|
||||
return protocol_client_auth_sasl_start(vs, NULL, 0);
|
||||
return protocol_client_auth_sasl_start(vs, NULL, 0);
|
||||
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
|
||||
return 0;
|
||||
|
|
@ -431,35 +431,35 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_
|
|||
{
|
||||
char *mechname = malloc(len + 1);
|
||||
if (!mechname) {
|
||||
VNC_DEBUG("Out of memory reading mechname\n");
|
||||
vnc_client_error(vs);
|
||||
VNC_DEBUG("Out of memory reading mechname\n");
|
||||
vnc_client_error(vs);
|
||||
}
|
||||
strncpy(mechname, (char*)data, len);
|
||||
mechname[len] = '\0';
|
||||
VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
|
||||
mechname, vs->sasl.mechlist);
|
||||
mechname, vs->sasl.mechlist);
|
||||
|
||||
if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
|
||||
if (vs->sasl.mechlist[len] != '\0' &&
|
||||
vs->sasl.mechlist[len] != ',') {
|
||||
VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
if (vs->sasl.mechlist[len] != '\0' &&
|
||||
vs->sasl.mechlist[len] != ',') {
|
||||
VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
} else {
|
||||
char *offset = strstr(vs->sasl.mechlist, mechname);
|
||||
VNC_DEBUG("Two %p\n", offset);
|
||||
if (!offset) {
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
VNC_DEBUG("Two '%s'\n", offset);
|
||||
if (offset[-1] != ',' ||
|
||||
(offset[len] != '\0'&&
|
||||
offset[len] != ',')) {
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
char *offset = strstr(vs->sasl.mechlist, mechname);
|
||||
VNC_DEBUG("Two %p\n", offset);
|
||||
if (!offset) {
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
VNC_DEBUG("Two '%s'\n", offset);
|
||||
if (offset[-1] != ',' ||
|
||||
(offset[len] != '\0'&&
|
||||
offset[len] != ',')) {
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
}
|
||||
|
||||
free(vs->sasl.mechlist);
|
||||
|
|
@ -475,20 +475,20 @@ static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, s
|
|||
uint32_t mechlen = read_u32(data, 0);
|
||||
VNC_DEBUG("Got client mechname len %d\n", mechlen);
|
||||
if (mechlen > 100) {
|
||||
VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
if (mechlen < 1) {
|
||||
VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
|
||||
vnc_client_error(vs);
|
||||
return -1;
|
||||
}
|
||||
vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
|
||||
return 0;
|
||||
}
|
||||
|
||||
#define USES_X509_AUTH(vs) \
|
||||
#define USES_X509_AUTH(vs) \
|
||||
((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
|
||||
(vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
|
||||
(vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \
|
||||
|
|
@ -507,116 +507,116 @@ void start_auth_sasl(VncState *vs)
|
|||
|
||||
/* Get local & remote client addresses in form IPADDR;PORT */
|
||||
if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
|
||||
goto authabort;
|
||||
goto authabort;
|
||||
|
||||
if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
|
||||
free(localAddr);
|
||||
goto authabort;
|
||||
free(localAddr);
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
err = sasl_server_new("vnc",
|
||||
NULL, /* FQDN - just delegates to gethostname */
|
||||
NULL, /* User realm */
|
||||
localAddr,
|
||||
remoteAddr,
|
||||
NULL, /* Callbacks, not needed */
|
||||
SASL_SUCCESS_DATA,
|
||||
&vs->sasl.conn);
|
||||
NULL, /* FQDN - just delegates to gethostname */
|
||||
NULL, /* User realm */
|
||||
localAddr,
|
||||
remoteAddr,
|
||||
NULL, /* Callbacks, not needed */
|
||||
SASL_SUCCESS_DATA,
|
||||
&vs->sasl.conn);
|
||||
free(localAddr);
|
||||
free(remoteAddr);
|
||||
localAddr = remoteAddr = NULL;
|
||||
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("sasl context setup failed %d (%s)",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("sasl context setup failed %d (%s)",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
#ifdef CONFIG_VNC_TLS
|
||||
/* Inform SASL that we've got an external SSF layer from TLS/x509 */
|
||||
if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
|
||||
vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
|
||||
gnutls_cipher_algorithm_t cipher;
|
||||
sasl_ssf_t ssf;
|
||||
vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
|
||||
gnutls_cipher_algorithm_t cipher;
|
||||
sasl_ssf_t ssf;
|
||||
|
||||
cipher = gnutls_cipher_get(vs->tls.session);
|
||||
if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
|
||||
VNC_DEBUG("%s", "cannot TLS get cipher size\n");
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
ssf *= 8; /* tls key size is bytes, sasl wants bits */
|
||||
cipher = gnutls_cipher_get(vs->tls.session);
|
||||
if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
|
||||
VNC_DEBUG("%s", "cannot TLS get cipher size\n");
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
ssf *= 8; /* tls key size is bytes, sasl wants bits */
|
||||
|
||||
err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
} else
|
||||
#endif /* CONFIG_VNC_TLS */
|
||||
vs->sasl.wantSSF = 1;
|
||||
vs->sasl.wantSSF = 1;
|
||||
|
||||
memset (&secprops, 0, sizeof secprops);
|
||||
/* Inform SASL that we've got an external SSF layer from TLS */
|
||||
if (strncmp(vs->vd->display, "unix:", 5) == 0
|
||||
#ifdef CONFIG_VNC_TLS
|
||||
/* Disable SSF, if using TLS+x509+SASL only. TLS without x509
|
||||
is not sufficiently strong */
|
||||
|| (vs->vd->auth == VNC_AUTH_VENCRYPT &&
|
||||
vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
|
||||
/* Disable SSF, if using TLS+x509+SASL only. TLS without x509
|
||||
is not sufficiently strong */
|
||||
|| (vs->vd->auth == VNC_AUTH_VENCRYPT &&
|
||||
vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
|
||||
#endif /* CONFIG_VNC_TLS */
|
||||
) {
|
||||
/* If we've got TLS or UNIX domain sock, we don't care about SSF */
|
||||
secprops.min_ssf = 0;
|
||||
secprops.max_ssf = 0;
|
||||
secprops.maxbufsize = 8192;
|
||||
secprops.security_flags = 0;
|
||||
) {
|
||||
/* If we've got TLS or UNIX domain sock, we don't care about SSF */
|
||||
secprops.min_ssf = 0;
|
||||
secprops.max_ssf = 0;
|
||||
secprops.maxbufsize = 8192;
|
||||
secprops.security_flags = 0;
|
||||
} else {
|
||||
/* Plain TCP, better get an SSF layer */
|
||||
secprops.min_ssf = 56; /* Good enough to require kerberos */
|
||||
secprops.max_ssf = 100000; /* Arbitrary big number */
|
||||
secprops.maxbufsize = 8192;
|
||||
/* Forbid any anonymous or trivially crackable auth */
|
||||
secprops.security_flags =
|
||||
SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
|
||||
/* Plain TCP, better get an SSF layer */
|
||||
secprops.min_ssf = 56; /* Good enough to require kerberos */
|
||||
secprops.max_ssf = 100000; /* Arbitrary big number */
|
||||
secprops.maxbufsize = 8192;
|
||||
/* Forbid any anonymous or trivially crackable auth */
|
||||
secprops.security_flags =
|
||||
SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
|
||||
}
|
||||
|
||||
err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("cannot set SASL security props %d (%s)\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("cannot set SASL security props %d (%s)\n",
|
||||
err, sasl_errstring(err, NULL, NULL));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
|
||||
err = sasl_listmech(vs->sasl.conn,
|
||||
NULL, /* Don't need to set user */
|
||||
"", /* Prefix */
|
||||
",", /* Separator */
|
||||
"", /* Suffix */
|
||||
&mechlist,
|
||||
NULL,
|
||||
NULL);
|
||||
NULL, /* Don't need to set user */
|
||||
"", /* Prefix */
|
||||
",", /* Separator */
|
||||
"", /* Suffix */
|
||||
&mechlist,
|
||||
NULL,
|
||||
NULL);
|
||||
if (err != SASL_OK) {
|
||||
VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
|
||||
err, sasl_errdetail(vs->sasl.conn));
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
|
||||
|
||||
if (!(vs->sasl.mechlist = strdup(mechlist))) {
|
||||
VNC_DEBUG("Out of memory");
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
VNC_DEBUG("Out of memory");
|
||||
sasl_dispose(&vs->sasl.conn);
|
||||
vs->sasl.conn = NULL;
|
||||
goto authabort;
|
||||
}
|
||||
mechlistlen = strlen(mechlist);
|
||||
vnc_write_u32(vs, mechlistlen);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue