[qemu.git] / vnc-auth-sasl.c

/*
 * QEMU VNC display driver: SASL auth protocol
 *
 * Copyright (C) 2009 Red Hat, Inc
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

#include "vnc.h"

/* Max amount of data we send/recv for SASL steps to prevent DOS */
#define SASL_DATA_MAX_LEN (1024 * 1024)


void vnc_sasl_client_cleanup(VncState *vs)
{
    if (vs->sasl.conn) {
        vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
        vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
        vs->sasl.encoded = NULL;
        free(vs->sasl.username);
        free(vs->sasl.mechlist);
        vs->sasl.username = vs->sasl.mechlist = NULL;
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
    }
}


long vnc_client_write_sasl(VncState *vs)
{
    long ret;

    VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
              vs->output.buffer, vs->output.capacity, vs->output.offset,
              vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);

    if (!vs->sasl.encoded) {
        int err;
        err = sasl_encode(vs->sasl.conn,
                          (char *)vs->output.buffer,
                          vs->output.offset,
                          (const char **)&vs->sasl.encoded,
                          &vs->sasl.encodedLength);
        if (err != SASL_OK)
            return vnc_client_io_error(vs, -1, EIO);

        vs->sasl.encodedOffset = 0;
    }

    ret = vnc_client_write_buf(vs,
                               vs->sasl.encoded + vs->sasl.encodedOffset,
                               vs->sasl.encodedLength - vs->sasl.encodedOffset);
    if (!ret)
        return 0;

    vs->sasl.encodedOffset += ret;
    if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
        vs->output.offset = 0;
        vs->sasl.encoded = NULL;
        vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
    }

    /* Can't merge this block with one above, because
     * someone might have written more unencrypted
     * data in vs->output while we were processing
     * SASL encoded output
     */
    if (vs->output.offset == 0) {
        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
    }

    return ret;
}


long vnc_client_read_sasl(VncState *vs)
{
    long ret;
    uint8_t encoded[4096];
    const char *decoded;
    unsigned int decodedLen;
    int err;

    ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
    if (!ret)
        return 0;

    err = sasl_decode(vs->sasl.conn,
                      (char *)encoded, ret,
                      &decoded, &decodedLen);

    if (err != SASL_OK)
        return vnc_client_io_error(vs, -1, -EIO);
    VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
              encoded, ret, decoded, decodedLen);
    buffer_reserve(&vs->input, decodedLen);
    buffer_append(&vs->input, decoded, decodedLen);
    return decodedLen;
}


static int vnc_auth_sasl_check_access(VncState *vs)
{
    const void *val;
    int err;
    int allow;

    err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
    if (err != SASL_OK) {
        VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
                  err, sasl_errstring(err, NULL, NULL));
        return -1;
    }
    if (val == NULL) {
        VNC_DEBUG("no client username was found, denying access\n");
        return -1;
    }
    VNC_DEBUG("SASL client username %s\n", (const char *)val);

    vs->sasl.username = qemu_strdup((const char*)val);

    if (vs->vd->sasl.acl == NULL) {
        VNC_DEBUG("no ACL activated, allowing access\n");
        return 0;
    }

    allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);

    VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
              allow ? "allowed" : "denied");
    return allow ? 0 : -1;
}

static int vnc_auth_sasl_check_ssf(VncState *vs)
{
    const void *val;
    int err, ssf;

    if (!vs->sasl.wantSSF)
        return 1;

    err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
    if (err != SASL_OK)
        return 0;

    ssf = *(const int *)val;
    VNC_DEBUG("negotiated an SSF of %d\n", ssf);
    if (ssf < 56)
        return 0; /* 56 is good for Kerberos */

    /* Only setup for read initially, because we're about to send an RPC
     * reply which must be in plain text. When the next incoming RPC
     * arrives, we'll switch on writes too
     *
     * cf qemudClientReadSASL  in qemud.c
     */
    vs->sasl.runSSF = 1;

    /* We have a SSF that's good enough */
    return 1;
}

/*
 * Step Msg
 *
 * Input from client:
 *
 * u32 clientin-length
 * u8-array clientin-string
 *
 * Output to client:
 *
 * u32 serverout-length
 * u8-array serverout-strin
 * u8 continue
 */

static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);

static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
{
    uint32_t datalen = len;
    const char *serverout;
    unsigned int serveroutlen;
    int err;
    char *clientdata = NULL;

    /* NB, distinction of NULL vs "" is *critical* in SASL */
    if (datalen) {
        clientdata = (char*)data;
        clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
        datalen--; /* Don't count NULL byte when passing to _start() */
    }

    VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
              clientdata, datalen);
    err = sasl_server_step(vs->sasl.conn,
                           clientdata,
                           datalen,
                           &serverout,
                           &serveroutlen);
    if (err != SASL_OK &&
        err != SASL_CONTINUE) {
        VNC_DEBUG("sasl step failed %d (%s)\n",
                  err, sasl_errdetail(vs->sasl.conn));
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }

    if (serveroutlen > SASL_DATA_MAX_LEN) {
        VNC_DEBUG("sasl step reply data too long %d\n",
                  serveroutlen);
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }

    VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
              serveroutlen, serverout ? 0 : 1);

    if (serveroutlen) {
        vnc_write_u32(vs, serveroutlen + 1);
        vnc_write(vs, serverout, serveroutlen + 1);
    } else {
        vnc_write_u32(vs, 0);
    }

    /* Whether auth is complete */
    vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);

    if (err == SASL_CONTINUE) {
        VNC_DEBUG("%s", "Authentication must continue\n");
        /* Wait for step length */
        vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
    } else {
        if (!vnc_auth_sasl_check_ssf(vs)) {
            VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
            goto authreject;
        }

        /* Check username whitelist ACL */
        if (vnc_auth_sasl_check_access(vs) < 0) {
            VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
            goto authreject;
        }

        VNC_DEBUG("Authentication successful %d\n", vs->csock);
        vnc_write_u32(vs, 0); /* Accept auth */
        /*
         * Delay writing in SSF encoded mode until pending output
         * buffer is written
         */
        if (vs->sasl.runSSF)
            vs->sasl.waitWriteSSF = vs->output.offset;
        start_client_init(vs);
    }

    return 0;

 authreject:
    vnc_write_u32(vs, 1); /* Reject auth */
    vnc_write_u32(vs, sizeof("Authentication failed"));
    vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
    vnc_flush(vs);
    vnc_client_error(vs);
    return -1;

 authabort:
    vnc_client_error(vs);
    return -1;
}

static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
{
    uint32_t steplen = read_u32(data, 0);
    VNC_DEBUG("Got client step len %d\n", steplen);
    if (steplen > SASL_DATA_MAX_LEN) {
        VNC_DEBUG("Too much SASL data %d\n", steplen);
        vnc_client_error(vs);
        return -1;
    }

    if (steplen == 0)
        return protocol_client_auth_sasl_step(vs, NULL, 0);
    else
        vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
    return 0;
}

/*
 * Start Msg
 *
 * Input from client:
 *
 * u32 clientin-length
 * u8-array clientin-string
 *
 * Output to client:
 *
 * u32 serverout-length
 * u8-array serverout-strin
 * u8 continue
 */

#define SASL_DATA_MAX_LEN (1024 * 1024)

static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
{
    uint32_t datalen = len;
    const char *serverout;
    unsigned int serveroutlen;
    int err;
    char *clientdata = NULL;

    /* NB, distinction of NULL vs "" is *critical* in SASL */
    if (datalen) {
        clientdata = (char*)data;
        clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
        datalen--; /* Don't count NULL byte when passing to _start() */
    }

    VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
              vs->sasl.mechlist, clientdata, datalen);
    err = sasl_server_start(vs->sasl.conn,
                            vs->sasl.mechlist,
                            clientdata,
                            datalen,
                            &serverout,
                            &serveroutlen);
    if (err != SASL_OK &&
        err != SASL_CONTINUE) {
        VNC_DEBUG("sasl start failed %d (%s)\n",
                  err, sasl_errdetail(vs->sasl.conn));
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }
    if (serveroutlen > SASL_DATA_MAX_LEN) {
        VNC_DEBUG("sasl start reply data too long %d\n",
                  serveroutlen);
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }

    VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
              serveroutlen, serverout ? 0 : 1);

    if (serveroutlen) {
        vnc_write_u32(vs, serveroutlen + 1);
        vnc_write(vs, serverout, serveroutlen + 1);
    } else {
        vnc_write_u32(vs, 0);
    }

    /* Whether auth is complete */
    vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);

    if (err == SASL_CONTINUE) {
        VNC_DEBUG("%s", "Authentication must continue\n");
        /* Wait for step length */
        vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
    } else {
        if (!vnc_auth_sasl_check_ssf(vs)) {
            VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
            goto authreject;
        }

        /* Check username whitelist ACL */
        if (vnc_auth_sasl_check_access(vs) < 0) {
            VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
            goto authreject;
        }

        VNC_DEBUG("Authentication successful %d\n", vs->csock);
        vnc_write_u32(vs, 0); /* Accept auth */
        start_client_init(vs);
    }

    return 0;

 authreject:
    vnc_write_u32(vs, 1); /* Reject auth */
    vnc_write_u32(vs, sizeof("Authentication failed"));
    vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
    vnc_flush(vs);
    vnc_client_error(vs);
    return -1;

 authabort:
    vnc_client_error(vs);
    return -1;
}

static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
{
    uint32_t startlen = read_u32(data, 0);
    VNC_DEBUG("Got client start len %d\n", startlen);
    if (startlen > SASL_DATA_MAX_LEN) {
        VNC_DEBUG("Too much SASL data %d\n", startlen);
        vnc_client_error(vs);
        return -1;
    }

    if (startlen == 0)
        return protocol_client_auth_sasl_start(vs, NULL, 0);

    vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
    return 0;
}

static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
{
    char *mechname = malloc(len + 1);
    if (!mechname) {
        VNC_DEBUG("Out of memory reading mechname\n");
        vnc_client_error(vs);
    }
    strncpy(mechname, (char*)data, len);
    mechname[len] = '\0';
    VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
              mechname, vs->sasl.mechlist);

    if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
        if (vs->sasl.mechlist[len] != '\0' &&
            vs->sasl.mechlist[len] != ',') {
            VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
            vnc_client_error(vs);
            return -1;
        }
    } else {
        char *offset = strstr(vs->sasl.mechlist, mechname);
        VNC_DEBUG("Two %p\n", offset);
        if (!offset) {
            vnc_client_error(vs);
            return -1;
        }
        VNC_DEBUG("Two '%s'\n", offset);
        if (offset[-1] != ',' ||
            (offset[len] != '\0'&&
             offset[len] != ',')) {
            vnc_client_error(vs);
            return -1;
        }
    }

    free(vs->sasl.mechlist);
    vs->sasl.mechlist = mechname;

    VNC_DEBUG("Validated mechname '%s'\n", mechname);
    vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
    return 0;
}

static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
{
    uint32_t mechlen = read_u32(data, 0);
    VNC_DEBUG("Got client mechname len %d\n", mechlen);
    if (mechlen > 100) {
        VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
        vnc_client_error(vs);
        return -1;
    }
    if (mechlen < 1) {
        VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
        vnc_client_error(vs);
        return -1;
    }
    vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
    return 0;
}

#define USES_X509_AUTH(vs)                              \
    ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE ||   \
     (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC ||    \
     (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN ||  \
     (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)


void start_auth_sasl(VncState *vs)
{
    const char *mechlist = NULL;
    sasl_security_properties_t secprops;
    int err;
    char *localAddr, *remoteAddr;
    int mechlistlen;

    VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);

    /* Get local & remote client addresses in form  IPADDR;PORT */
    if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
        goto authabort;

    if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
        free(localAddr);
        goto authabort;
    }

    err = sasl_server_new("vnc",
                          NULL, /* FQDN - just delegates to gethostname */
                          NULL, /* User realm */
                          localAddr,
                          remoteAddr,
                          NULL, /* Callbacks, not needed */
                          SASL_SUCCESS_DATA,
                          &vs->sasl.conn);
    free(localAddr);
    free(remoteAddr);
    localAddr = remoteAddr = NULL;

    if (err != SASL_OK) {
        VNC_DEBUG("sasl context setup failed %d (%s)",
                  err, sasl_errstring(err, NULL, NULL));
        vs->sasl.conn = NULL;
        goto authabort;
    }

#ifdef CONFIG_VNC_TLS
    /* Inform SASL that we've got an external SSF layer from TLS/x509 */
    if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
        vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
        gnutls_cipher_algorithm_t cipher;
        sasl_ssf_t ssf;

        cipher = gnutls_cipher_get(vs->tls.session);
        if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
            VNC_DEBUG("%s", "cannot TLS get cipher size\n");
            sasl_dispose(&vs->sasl.conn);
            vs->sasl.conn = NULL;
            goto authabort;
        }
        ssf *= 8; /* tls key size is bytes, sasl wants bits */

        err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
        if (err != SASL_OK) {
            VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
                      err, sasl_errstring(err, NULL, NULL));
            sasl_dispose(&vs->sasl.conn);
            vs->sasl.conn = NULL;
            goto authabort;
        }
    } else
#endif /* CONFIG_VNC_TLS */
        vs->sasl.wantSSF = 1;

    memset (&secprops, 0, sizeof secprops);
    /* Inform SASL that we've got an external SSF layer from TLS */
    if (strncmp(vs->vd->display, "unix:", 5) == 0
#ifdef CONFIG_VNC_TLS
        /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
           is not sufficiently strong */
        || (vs->vd->auth == VNC_AUTH_VENCRYPT &&
            vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
#endif /* CONFIG_VNC_TLS */
        ) {
        /* If we've got TLS or UNIX domain sock, we don't care about SSF */
        secprops.min_ssf = 0;
        secprops.max_ssf = 0;
        secprops.maxbufsize = 8192;
        secprops.security_flags = 0;
    } else {
        /* Plain TCP, better get an SSF layer */
        secprops.min_ssf = 56; /* Good enough to require kerberos */
        secprops.max_ssf = 100000; /* Arbitrary big number */
        secprops.maxbufsize = 8192;
        /* Forbid any anonymous or trivially crackable auth */
        secprops.security_flags =
            SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
    }

    err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
    if (err != SASL_OK) {
        VNC_DEBUG("cannot set SASL security props %d (%s)\n",
                  err, sasl_errstring(err, NULL, NULL));
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }

    err = sasl_listmech(vs->sasl.conn,
                        NULL, /* Don't need to set user */
                        "", /* Prefix */
                        ",", /* Separator */
                        "", /* Suffix */
                        &mechlist,
                        NULL,
                        NULL);
    if (err != SASL_OK) {
        VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
                  err, sasl_errdetail(vs->sasl.conn));
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }
    VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);

    if (!(vs->sasl.mechlist = strdup(mechlist))) {
        VNC_DEBUG("Out of memory");
        sasl_dispose(&vs->sasl.conn);
        vs->sasl.conn = NULL;
        goto authabort;
    }
    mechlistlen = strlen(mechlist);
    vnc_write_u32(vs, mechlistlen);
    vnc_write(vs, mechlist, mechlistlen);
    vnc_flush(vs);

    VNC_DEBUG("Wait for client mechname length\n");
    vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);

    return;

 authabort:
    vnc_client_error(vs);
    return;
}
Commit	Line	Data
2f9606b3 AL	1	/*
	2	* QEMU VNC display driver: SASL auth protocol
	3	*
	4	* Copyright (C) 2009 Red Hat, Inc
	5	*
	6	* Permission is hereby granted, free of charge, to any person obtaining a copy
	7	* of this software and associated documentation files (the "Software"), to deal
	8	* in the Software without restriction, including without limitation the rights
	9	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	10	* copies of the Software, and to permit persons to whom the Software is
	11	* furnished to do so, subject to the following conditions:
	12	*
	13	* The above copyright notice and this permission notice shall be included in
	14	* all copies or substantial portions of the Software.
	15	*
	16	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	17	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	18	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	19	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	20	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	21	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
	22	* THE SOFTWARE.
	23	*/
	24
	25	#include "vnc.h"
	26
	27	/* Max amount of data we send/recv for SASL steps to prevent DOS */
	28	#define SASL_DATA_MAX_LEN (1024 * 1024)
	29
	30
	31	void vnc_sasl_client_cleanup(VncState *vs)
	32	{
	33	if (vs->sasl.conn) {
28a76be8 AL	34	vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
	35	vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
	36	vs->sasl.encoded = NULL;
	37	free(vs->sasl.username);
	38	free(vs->sasl.mechlist);
	39	vs->sasl.username = vs->sasl.mechlist = NULL;
	40	sasl_dispose(&vs->sasl.conn);
	41	vs->sasl.conn = NULL;
2f9606b3 AL	42	}
	43	}
	44
	45
	46	long vnc_client_write_sasl(VncState *vs)
	47	{
	48	long ret;
	49
	50	VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
28a76be8 AL	51	vs->output.buffer, vs->output.capacity, vs->output.offset,
28a76be8 AL	52	vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
2f9606b3 AL	53
2f9606b3 AL	54	if (!vs->sasl.encoded) {
28a76be8 AL	55	int err;
	56	err = sasl_encode(vs->sasl.conn,
	57	(char *)vs->output.buffer,
	58	vs->output.offset,
	59	(const char **)&vs->sasl.encoded,
	60	&vs->sasl.encodedLength);
	61	if (err != SASL_OK)
	62	return vnc_client_io_error(vs, -1, EIO);
	63
	64	vs->sasl.encodedOffset = 0;
2f9606b3 AL	65	}
	66
	67	ret = vnc_client_write_buf(vs,
28a76be8 AL	68	vs->sasl.encoded + vs->sasl.encodedOffset,
28a76be8 AL	69	vs->sasl.encodedLength - vs->sasl.encodedOffset);
2f9606b3	70	if (!ret)
28a76be8	71	return 0;
2f9606b3 AL	72
	73	vs->sasl.encodedOffset += ret;
	74	if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
28a76be8 AL	75	vs->output.offset = 0;
	76	vs->sasl.encoded = NULL;
	77	vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
2f9606b3 AL	78	}
	79
	80	/* Can't merge this block with one above, because
	81	* someone might have written more unencrypted
	82	* data in vs->output while we were processing
	83	* SASL encoded output
	84	*/
	85	if (vs->output.offset == 0) {
28a76be8	86	qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
2f9606b3 AL	87	}
	88
	89	return ret;
	90	}
	91
	92
	93	long vnc_client_read_sasl(VncState *vs)
	94	{
	95	long ret;
	96	uint8_t encoded[4096];
	97	const char *decoded;
	98	unsigned int decodedLen;
	99	int err;
	100
	101	ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
	102	if (!ret)
28a76be8	103	return 0;
2f9606b3 AL	104
2f9606b3 AL	105	err = sasl_decode(vs->sasl.conn,
28a76be8 AL	106	(char *)encoded, ret,
28a76be8 AL	107	&decoded, &decodedLen);
2f9606b3 AL	108
2f9606b3 AL	109	if (err != SASL_OK)
28a76be8	110	return vnc_client_io_error(vs, -1, -EIO);
2f9606b3	111	VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
28a76be8	112	encoded, ret, decoded, decodedLen);
2f9606b3 AL	113	buffer_reserve(&vs->input, decodedLen);
	114	buffer_append(&vs->input, decoded, decodedLen);
	115	return decodedLen;
	116	}
	117
	118
	119	static int vnc_auth_sasl_check_access(VncState *vs)
	120	{
	121	const void *val;
	122	int err;
76655d6d	123	int allow;
2f9606b3 AL	124
	125	err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
	126	if (err != SASL_OK) {
28a76be8 AL	127	VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
	128	err, sasl_errstring(err, NULL, NULL));
	129	return -1;
2f9606b3 AL	130	}
2f9606b3 AL	131	if (val == NULL) {
28a76be8 AL	132	VNC_DEBUG("no client username was found, denying access\n");
28a76be8 AL	133	return -1;
2f9606b3 AL	134	}
	135	VNC_DEBUG("SASL client username %s\n", (const char *)val);
	136
	137	vs->sasl.username = qemu_strdup((const char*)val);
	138
76655d6d	139	if (vs->vd->sasl.acl == NULL) {
28a76be8 AL	140	VNC_DEBUG("no ACL activated, allowing access\n");
28a76be8 AL	141	return 0;
76655d6d AL	142	}
	143
	144	allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
	145
	146	VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
28a76be8	147	allow ? "allowed" : "denied");
76655d6d	148	return allow ? 0 : -1;
2f9606b3 AL	149	}
	150
	151	static int vnc_auth_sasl_check_ssf(VncState *vs)
	152	{
	153	const void *val;
	154	int err, ssf;
	155
	156	if (!vs->sasl.wantSSF)
28a76be8	157	return 1;
2f9606b3 AL	158
	159	err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
	160	if (err != SASL_OK)
28a76be8	161	return 0;
2f9606b3 AL	162
	163	ssf = (const int )val;
	164	VNC_DEBUG("negotiated an SSF of %d\n", ssf);
	165	if (ssf < 56)
28a76be8	166	return 0; /* 56 is good for Kerberos */
2f9606b3 AL	167
	168	/* Only setup for read initially, because we're about to send an RPC
	169	* reply which must be in plain text. When the next incoming RPC
	170	* arrives, we'll switch on writes too
	171	*
	172	* cf qemudClientReadSASL in qemud.c
	173	*/
	174	vs->sasl.runSSF = 1;
	175
	176	/* We have a SSF that's good enough */
	177	return 1;
	178	}
	179
	180	/*
	181	* Step Msg
	182	*
	183	* Input from client:
	184	*
	185	* u32 clientin-length
	186	* u8-array clientin-string
	187	*
	188	* Output to client:
	189	*
	190	* u32 serverout-length
	191	* u8-array serverout-strin
	192	* u8 continue
	193	*/
	194
	195	static int protocol_client_auth_sasl_step_len(VncState vs, uint8_t data, size_t len);
	196
	197	static int protocol_client_auth_sasl_step(VncState vs, uint8_t data, size_t len)
	198	{
	199	uint32_t datalen = len;
	200	const char *serverout;
	201	unsigned int serveroutlen;
	202	int err;
	203	char *clientdata = NULL;
	204
	205	/* NB, distinction of NULL vs "" is critical in SASL */
	206	if (datalen) {
28a76be8 AL	207	clientdata = (char*)data;
	208	clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
	209	datalen--; /* Don't count NULL byte when passing to _start() */
2f9606b3 AL	210	}
	211
	212	VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
28a76be8	213	clientdata, datalen);
2f9606b3	214	err = sasl_server_step(vs->sasl.conn,
28a76be8 AL	215	clientdata,
	216	datalen,
	217	&serverout,
	218	&serveroutlen);
2f9606b3	219	if (err != SASL_OK &&
28a76be8 AL	220	err != SASL_CONTINUE) {
	221	VNC_DEBUG("sasl step failed %d (%s)\n",
	222	err, sasl_errdetail(vs->sasl.conn));
	223	sasl_dispose(&vs->sasl.conn);
	224	vs->sasl.conn = NULL;
	225	goto authabort;
2f9606b3 AL	226	}
	227
	228	if (serveroutlen > SASL_DATA_MAX_LEN) {
28a76be8 AL	229	VNC_DEBUG("sasl step reply data too long %d\n",
	230	serveroutlen);
	231	sasl_dispose(&vs->sasl.conn);
	232	vs->sasl.conn = NULL;
	233	goto authabort;
2f9606b3 AL	234	}
	235
	236	VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
28a76be8	237	serveroutlen, serverout ? 0 : 1);
2f9606b3 AL	238
2f9606b3 AL	239	if (serveroutlen) {
28a76be8 AL	240	vnc_write_u32(vs, serveroutlen + 1);
28a76be8 AL	241	vnc_write(vs, serverout, serveroutlen + 1);
2f9606b3	242	} else {
28a76be8	243	vnc_write_u32(vs, 0);
2f9606b3 AL	244	}
	245
	246	/* Whether auth is complete */
	247	vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
	248
	249	if (err == SASL_CONTINUE) {
28a76be8 AL	250	VNC_DEBUG("%s", "Authentication must continue\n");
	251	/* Wait for step length */
	252	vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
2f9606b3	253	} else {
28a76be8 AL	254	if (!vnc_auth_sasl_check_ssf(vs)) {
	255	VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
	256	goto authreject;
	257	}
	258
	259	/* Check username whitelist ACL */
	260	if (vnc_auth_sasl_check_access(vs) < 0) {
	261	VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
	262	goto authreject;
	263	}
	264
	265	VNC_DEBUG("Authentication successful %d\n", vs->csock);
	266	vnc_write_u32(vs, 0); /* Accept auth */
	267	/*
	268	* Delay writing in SSF encoded mode until pending output
	269	* buffer is written
	270	*/
	271	if (vs->sasl.runSSF)
	272	vs->sasl.waitWriteSSF = vs->output.offset;
	273	start_client_init(vs);
2f9606b3 AL	274	}
	275
	276	return 0;
	277
	278	authreject:
	279	vnc_write_u32(vs, 1); /* Reject auth */
	280	vnc_write_u32(vs, sizeof("Authentication failed"));
	281	vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
	282	vnc_flush(vs);
	283	vnc_client_error(vs);
	284	return -1;
	285
	286	authabort:
	287	vnc_client_error(vs);
	288	return -1;
	289	}
	290
	291	static int protocol_client_auth_sasl_step_len(VncState vs, uint8_t data, size_t len)
	292	{
	293	uint32_t steplen = read_u32(data, 0);
	294	VNC_DEBUG("Got client step len %d\n", steplen);
	295	if (steplen > SASL_DATA_MAX_LEN) {
28a76be8 AL	296	VNC_DEBUG("Too much SASL data %d\n", steplen);
	297	vnc_client_error(vs);
	298	return -1;
2f9606b3 AL	299	}
	300
	301	if (steplen == 0)
28a76be8	302	return protocol_client_auth_sasl_step(vs, NULL, 0);
2f9606b3	303	else
28a76be8	304	vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
2f9606b3 AL	305	return 0;
	306	}
	307
	308	/*
	309	* Start Msg
	310	*
	311	* Input from client:
	312	*
	313	* u32 clientin-length
	314	* u8-array clientin-string
	315	*
	316	* Output to client:
	317	*
	318	* u32 serverout-length
	319	* u8-array serverout-strin
	320	* u8 continue
	321	*/
	322
	323	#define SASL_DATA_MAX_LEN (1024 * 1024)
	324
	325	static int protocol_client_auth_sasl_start(VncState vs, uint8_t data, size_t len)
	326	{
	327	uint32_t datalen = len;
	328	const char *serverout;
	329	unsigned int serveroutlen;
	330	int err;
	331	char *clientdata = NULL;
	332
	333	/* NB, distinction of NULL vs "" is critical in SASL */
	334	if (datalen) {
28a76be8 AL	335	clientdata = (char*)data;
	336	clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
	337	datalen--; /* Don't count NULL byte when passing to _start() */
2f9606b3 AL	338	}
	339
	340	VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
28a76be8	341	vs->sasl.mechlist, clientdata, datalen);
2f9606b3	342	err = sasl_server_start(vs->sasl.conn,
28a76be8 AL	343	vs->sasl.mechlist,
	344	clientdata,
	345	datalen,
	346	&serverout,
	347	&serveroutlen);
2f9606b3	348	if (err != SASL_OK &&
28a76be8 AL	349	err != SASL_CONTINUE) {
	350	VNC_DEBUG("sasl start failed %d (%s)\n",
	351	err, sasl_errdetail(vs->sasl.conn));
	352	sasl_dispose(&vs->sasl.conn);
	353	vs->sasl.conn = NULL;
	354	goto authabort;
2f9606b3 AL	355	}
2f9606b3 AL	356	if (serveroutlen > SASL_DATA_MAX_LEN) {
28a76be8 AL	357	VNC_DEBUG("sasl start reply data too long %d\n",
	358	serveroutlen);
	359	sasl_dispose(&vs->sasl.conn);
	360	vs->sasl.conn = NULL;
	361	goto authabort;
2f9606b3 AL	362	}
	363
	364	VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
28a76be8	365	serveroutlen, serverout ? 0 : 1);
2f9606b3 AL	366
2f9606b3 AL	367	if (serveroutlen) {
28a76be8 AL	368	vnc_write_u32(vs, serveroutlen + 1);
28a76be8 AL	369	vnc_write(vs, serverout, serveroutlen + 1);
2f9606b3	370	} else {
28a76be8	371	vnc_write_u32(vs, 0);
2f9606b3 AL	372	}
	373
	374	/* Whether auth is complete */
	375	vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
	376
	377	if (err == SASL_CONTINUE) {
28a76be8 AL	378	VNC_DEBUG("%s", "Authentication must continue\n");
	379	/* Wait for step length */
	380	vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
2f9606b3	381	} else {
28a76be8 AL	382	if (!vnc_auth_sasl_check_ssf(vs)) {
	383	VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
	384	goto authreject;
	385	}
	386
	387	/* Check username whitelist ACL */
	388	if (vnc_auth_sasl_check_access(vs) < 0) {
	389	VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
	390	goto authreject;
	391	}
	392
	393	VNC_DEBUG("Authentication successful %d\n", vs->csock);
	394	vnc_write_u32(vs, 0); /* Accept auth */
	395	start_client_init(vs);
2f9606b3 AL	396	}
	397
	398	return 0;
	399
	400	authreject:
	401	vnc_write_u32(vs, 1); /* Reject auth */
	402	vnc_write_u32(vs, sizeof("Authentication failed"));
	403	vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
	404	vnc_flush(vs);
	405	vnc_client_error(vs);
	406	return -1;
	407
	408	authabort:
	409	vnc_client_error(vs);
	410	return -1;
	411	}
	412
	413	static int protocol_client_auth_sasl_start_len(VncState vs, uint8_t data, size_t len)
	414	{
	415	uint32_t startlen = read_u32(data, 0);
	416	VNC_DEBUG("Got client start len %d\n", startlen);
	417	if (startlen > SASL_DATA_MAX_LEN) {
28a76be8 AL	418	VNC_DEBUG("Too much SASL data %d\n", startlen);
	419	vnc_client_error(vs);
	420	return -1;
2f9606b3 AL	421	}
	422
	423	if (startlen == 0)
28a76be8	424	return protocol_client_auth_sasl_start(vs, NULL, 0);
2f9606b3 AL	425
	426	vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
	427	return 0;
	428	}
	429
	430	static int protocol_client_auth_sasl_mechname(VncState vs, uint8_t data, size_t len)
	431	{
	432	char *mechname = malloc(len + 1);
	433	if (!mechname) {
28a76be8 AL	434	VNC_DEBUG("Out of memory reading mechname\n");
28a76be8 AL	435	vnc_client_error(vs);
2f9606b3 AL	436	}
	437	strncpy(mechname, (char*)data, len);
	438	mechname[len] = '\0';
	439	VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
28a76be8	440	mechname, vs->sasl.mechlist);
2f9606b3 AL	441
2f9606b3 AL	442	if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
28a76be8 AL	443	if (vs->sasl.mechlist[len] != '\0' &&
	444	vs->sasl.mechlist[len] != ',') {
	445	VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
	446	vnc_client_error(vs);
	447	return -1;
	448	}
2f9606b3	449	} else {
28a76be8 AL	450	char *offset = strstr(vs->sasl.mechlist, mechname);
	451	VNC_DEBUG("Two %p\n", offset);
	452	if (!offset) {
	453	vnc_client_error(vs);
	454	return -1;
	455	}
	456	VNC_DEBUG("Two '%s'\n", offset);
	457	if (offset[-1] != ',' \|\|
	458	(offset[len] != '\0'&&
	459	offset[len] != ',')) {
	460	vnc_client_error(vs);
	461	return -1;
	462	}
2f9606b3 AL	463	}
	464
	465	free(vs->sasl.mechlist);
	466	vs->sasl.mechlist = mechname;
	467
	468	VNC_DEBUG("Validated mechname '%s'\n", mechname);
	469	vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
	470	return 0;
	471	}
	472
	473	static int protocol_client_auth_sasl_mechname_len(VncState vs, uint8_t data, size_t len)
	474	{
	475	uint32_t mechlen = read_u32(data, 0);
	476	VNC_DEBUG("Got client mechname len %d\n", mechlen);
	477	if (mechlen > 100) {
28a76be8 AL	478	VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
	479	vnc_client_error(vs);
	480	return -1;
2f9606b3 AL	481	}
2f9606b3 AL	482	if (mechlen < 1) {
28a76be8 AL	483	VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
	484	vnc_client_error(vs);
	485	return -1;
2f9606b3 AL	486	}
	487	vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
	488	return 0;
	489	}
	490
28a76be8	491	#define USES_X509_AUTH(vs) \
2f9606b3 AL	492	((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE \|\| \
	493	(vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC \|\| \
	494	(vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN \|\| \
	495	(vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
	496
	497
	498	void start_auth_sasl(VncState *vs)
	499	{
	500	const char *mechlist = NULL;
	501	sasl_security_properties_t secprops;
	502	int err;
	503	char localAddr, remoteAddr;
	504	int mechlistlen;
	505
	506	VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);
	507
	508	/* Get local & remote client addresses in form IPADDR;PORT */
	509	if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
28a76be8	510	goto authabort;
2f9606b3 AL	511
2f9606b3 AL	512	if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
28a76be8 AL	513	free(localAddr);
28a76be8 AL	514	goto authabort;
2f9606b3 AL	515	}
	516
	517	err = sasl_server_new("vnc",
28a76be8 AL	518	NULL, /* FQDN - just delegates to gethostname */
	519	NULL, /* User realm */
	520	localAddr,
	521	remoteAddr,
	522	NULL, /* Callbacks, not needed */
	523	SASL_SUCCESS_DATA,
	524	&vs->sasl.conn);
2f9606b3 AL	525	free(localAddr);
	526	free(remoteAddr);
	527	localAddr = remoteAddr = NULL;
	528
	529	if (err != SASL_OK) {
28a76be8 AL	530	VNC_DEBUG("sasl context setup failed %d (%s)",
	531	err, sasl_errstring(err, NULL, NULL));
	532	vs->sasl.conn = NULL;
	533	goto authabort;
2f9606b3 AL	534	}
	535
	536	#ifdef CONFIG_VNC_TLS
	537	/* Inform SASL that we've got an external SSF layer from TLS/x509 */
	538	if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
28a76be8 AL	539	vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
	540	gnutls_cipher_algorithm_t cipher;
	541	sasl_ssf_t ssf;
	542
	543	cipher = gnutls_cipher_get(vs->tls.session);
	544	if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
	545	VNC_DEBUG("%s", "cannot TLS get cipher size\n");
	546	sasl_dispose(&vs->sasl.conn);
	547	vs->sasl.conn = NULL;
	548	goto authabort;
	549	}
	550	ssf = 8; / tls key size is bytes, sasl wants bits */
	551
	552	err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
	553	if (err != SASL_OK) {
	554	VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
	555	err, sasl_errstring(err, NULL, NULL));
	556	sasl_dispose(&vs->sasl.conn);
	557	vs->sasl.conn = NULL;
	558	goto authabort;
	559	}
2f9606b3 AL	560	} else
2f9606b3 AL	561	#endif /* CONFIG_VNC_TLS */
28a76be8	562	vs->sasl.wantSSF = 1;
2f9606b3 AL	563
	564	memset (&secprops, 0, sizeof secprops);
	565	/* Inform SASL that we've got an external SSF layer from TLS */
	566	if (strncmp(vs->vd->display, "unix:", 5) == 0
	567	#ifdef CONFIG_VNC_TLS
28a76be8 AL	568	/* Disable SSF, if using TLS+x509+SASL only. TLS without x509
	569	is not sufficiently strong */
	570	\|\| (vs->vd->auth == VNC_AUTH_VENCRYPT &&
	571	vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
2f9606b3	572	#endif /* CONFIG_VNC_TLS */
28a76be8 AL	573	) {
	574	/* If we've got TLS or UNIX domain sock, we don't care about SSF */
	575	secprops.min_ssf = 0;
	576	secprops.max_ssf = 0;
	577	secprops.maxbufsize = 8192;
	578	secprops.security_flags = 0;
2f9606b3	579	} else {
28a76be8 AL	580	/* Plain TCP, better get an SSF layer */
	581	secprops.min_ssf = 56; /* Good enough to require kerberos */
	582	secprops.max_ssf = 100000; /* Arbitrary big number */
	583	secprops.maxbufsize = 8192;
	584	/* Forbid any anonymous or trivially crackable auth */
	585	secprops.security_flags =
	586	SASL_SEC_NOANONYMOUS \| SASL_SEC_NOPLAINTEXT;
2f9606b3 AL	587	}
	588
	589	err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
	590	if (err != SASL_OK) {
28a76be8 AL	591	VNC_DEBUG("cannot set SASL security props %d (%s)\n",
	592	err, sasl_errstring(err, NULL, NULL));
	593	sasl_dispose(&vs->sasl.conn);
	594	vs->sasl.conn = NULL;
	595	goto authabort;
2f9606b3 AL	596	}
	597
	598	err = sasl_listmech(vs->sasl.conn,
28a76be8 AL	599	NULL, /* Don't need to set user */
	600	"", /* Prefix */
	601	",", /* Separator */
	602	"", /* Suffix */
	603	&mechlist,
	604	NULL,
	605	NULL);
2f9606b3	606	if (err != SASL_OK) {
28a76be8 AL	607	VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
	608	err, sasl_errdetail(vs->sasl.conn));
	609	sasl_dispose(&vs->sasl.conn);
	610	vs->sasl.conn = NULL;
	611	goto authabort;
2f9606b3 AL	612	}
	613	VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
	614
	615	if (!(vs->sasl.mechlist = strdup(mechlist))) {
28a76be8 AL	616	VNC_DEBUG("Out of memory");
	617	sasl_dispose(&vs->sasl.conn);
	618	vs->sasl.conn = NULL;
	619	goto authabort;
2f9606b3 AL	620	}
	621	mechlistlen = strlen(mechlist);
	622	vnc_write_u32(vs, mechlistlen);
	623	vnc_write(vs, mechlist, mechlistlen);
	624	vnc_flush(vs);
	625
	626	VNC_DEBUG("Wait for client mechname length\n");
	627	vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
	628
	629	return;
	630
	631	authabort:
	632	vnc_client_error(vs);
	633	return;
	634	}
	635
	636