]>
Commit | Line | Data |
---|---|---|
274b6fcc AL |
1 | /* |
2 | * QEMU VNC display driver: VeNCrypt authentication setup | |
3 | * | |
4 | * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws> | |
5 | * Copyright (C) 2006 Fabrice Bellard | |
6 | * Copyright (C) 2009 Red Hat, Inc | |
7 | * | |
8 | * Permission is hereby granted, free of charge, to any person obtaining a copy | |
9 | * of this software and associated documentation files (the "Software"), to deal | |
10 | * in the Software without restriction, including without limitation the rights | |
11 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
12 | * copies of the Software, and to permit persons to whom the Software is | |
13 | * furnished to do so, subject to the following conditions: | |
14 | * | |
15 | * The above copyright notice and this permission notice shall be included in | |
16 | * all copies or substantial portions of the Software. | |
17 | * | |
18 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
19 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
20 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |
21 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
22 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
23 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | |
24 | * THE SOFTWARE. | |
25 | */ | |
26 | ||
27 | #include "vnc.h" | |
6a1751b7 | 28 | #include "qemu/main-loop.h" |
274b6fcc AL |
29 | |
30 | static void start_auth_vencrypt_subauth(VncState *vs) | |
31 | { | |
7e7e2ebc | 32 | switch (vs->subauth) { |
274b6fcc AL |
33 | case VNC_AUTH_VENCRYPT_TLSNONE: |
34 | case VNC_AUTH_VENCRYPT_X509NONE: | |
35 | VNC_DEBUG("Accept TLS auth none\n"); | |
36 | vnc_write_u32(vs, 0); /* Accept auth completion */ | |
37 | start_client_init(vs); | |
38 | break; | |
39 | ||
40 | case VNC_AUTH_VENCRYPT_TLSVNC: | |
41 | case VNC_AUTH_VENCRYPT_X509VNC: | |
42 | VNC_DEBUG("Start TLS auth VNC\n"); | |
43 | start_auth_vnc(vs); | |
44 | break; | |
45 | ||
46 | #ifdef CONFIG_VNC_SASL | |
47 | case VNC_AUTH_VENCRYPT_TLSSASL: | |
48 | case VNC_AUTH_VENCRYPT_X509SASL: | |
49 | VNC_DEBUG("Start TLS auth SASL\n"); | |
0ed8b6f6 BS |
50 | start_auth_sasl(vs); |
51 | break; | |
274b6fcc AL |
52 | #endif /* CONFIG_VNC_SASL */ |
53 | ||
54 | default: /* Should not be possible, but just in case */ | |
7e7e2ebc | 55 | VNC_DEBUG("Reject subauth %d server bug\n", vs->auth); |
274b6fcc AL |
56 | vnc_write_u8(vs, 1); |
57 | if (vs->minor >= 8) { | |
58 | static const char err[] = "Unsupported authentication type"; | |
59 | vnc_write_u32(vs, sizeof(err)); | |
60 | vnc_write(vs, err, sizeof(err)); | |
61 | } | |
62 | vnc_client_error(vs); | |
63 | } | |
64 | } | |
65 | ||
66 | static void vnc_tls_handshake_io(void *opaque); | |
67 | ||
4769a881 | 68 | static int vnc_start_vencrypt_handshake(VncState *vs) |
494cb817 | 69 | { |
274b6fcc AL |
70 | int ret; |
71 | ||
72 | if ((ret = gnutls_handshake(vs->tls.session)) < 0) { | |
73 | if (!gnutls_error_is_fatal(ret)) { | |
74 | VNC_DEBUG("Handshake interrupted (blocking)\n"); | |
75 | if (!gnutls_record_get_direction(vs->tls.session)) | |
76 | qemu_set_fd_handler(vs->csock, vnc_tls_handshake_io, NULL, vs); | |
77 | else | |
78 | qemu_set_fd_handler(vs->csock, NULL, vnc_tls_handshake_io, vs); | |
79 | return 0; | |
80 | } | |
81 | VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret)); | |
82 | vnc_client_error(vs); | |
83 | return -1; | |
84 | } | |
85 | ||
86 | if (vs->vd->tls.x509verify) { | |
87 | if (vnc_tls_validate_certificate(vs) < 0) { | |
88 | VNC_DEBUG("Client verification failed\n"); | |
89 | vnc_client_error(vs); | |
90 | return -1; | |
91 | } else { | |
92 | VNC_DEBUG("Client verification passed\n"); | |
93 | } | |
94 | } | |
95 | ||
96 | VNC_DEBUG("Handshake done, switching to TLS data mode\n"); | |
82e1cc4b | 97 | qemu_set_fd_handler(vs->csock, vnc_client_read, vnc_client_write, vs); |
274b6fcc AL |
98 | |
99 | start_auth_vencrypt_subauth(vs); | |
100 | ||
101 | return 0; | |
102 | } | |
103 | ||
494cb817 CMC |
104 | static void vnc_tls_handshake_io(void *opaque) |
105 | { | |
4769a881 | 106 | VncState *vs = (VncState *)opaque; |
274b6fcc AL |
107 | |
108 | VNC_DEBUG("Handshake IO continue\n"); | |
109 | vnc_start_vencrypt_handshake(vs); | |
110 | } | |
111 | ||
112 | ||
113 | ||
114 | #define NEED_X509_AUTH(vs) \ | |
7e7e2ebc DB |
115 | ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \ |
116 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \ | |
117 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \ | |
118 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL) | |
274b6fcc AL |
119 | |
120 | ||
121 | static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len) | |
122 | { | |
123 | int auth = read_u32(data, 0); | |
124 | ||
7e7e2ebc | 125 | if (auth != vs->subauth) { |
274b6fcc AL |
126 | VNC_DEBUG("Rejecting auth %d\n", auth); |
127 | vnc_write_u8(vs, 0); /* Reject auth */ | |
128 | vnc_flush(vs); | |
129 | vnc_client_error(vs); | |
130 | } else { | |
131 | VNC_DEBUG("Accepting auth %d, setting up TLS for handshake\n", auth); | |
132 | vnc_write_u8(vs, 1); /* Accept auth */ | |
133 | vnc_flush(vs); | |
134 | ||
135 | if (vnc_tls_client_setup(vs, NEED_X509_AUTH(vs)) < 0) { | |
136 | VNC_DEBUG("Failed to setup TLS\n"); | |
137 | return 0; | |
138 | } | |
139 | ||
140 | VNC_DEBUG("Start TLS VeNCrypt handshake process\n"); | |
141 | if (vnc_start_vencrypt_handshake(vs) < 0) { | |
142 | VNC_DEBUG("Failed to start TLS handshake\n"); | |
143 | return 0; | |
144 | } | |
145 | } | |
146 | return 0; | |
147 | } | |
148 | ||
149 | static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len) | |
150 | { | |
151 | if (data[0] != 0 || | |
152 | data[1] != 2) { | |
153 | VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data[0], (int)data[1]); | |
154 | vnc_write_u8(vs, 1); /* Reject version */ | |
155 | vnc_flush(vs); | |
156 | vnc_client_error(vs); | |
157 | } else { | |
7e7e2ebc | 158 | VNC_DEBUG("Sending allowed auth %d\n", vs->subauth); |
274b6fcc AL |
159 | vnc_write_u8(vs, 0); /* Accept version */ |
160 | vnc_write_u8(vs, 1); /* Number of sub-auths */ | |
7e7e2ebc | 161 | vnc_write_u32(vs, vs->subauth); /* The supported auth */ |
274b6fcc AL |
162 | vnc_flush(vs); |
163 | vnc_read_when(vs, protocol_client_vencrypt_auth, 4); | |
164 | } | |
165 | return 0; | |
166 | } | |
167 | ||
168 | ||
169 | void start_auth_vencrypt(VncState *vs) | |
170 | { | |
171 | /* Send VeNCrypt version 0.2 */ | |
172 | vnc_write_u8(vs, 0); | |
173 | vnc_write_u8(vs, 2); | |
174 | ||
175 | vnc_read_when(vs, protocol_client_vencrypt_init, 2); | |
176 | } | |
177 |