]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * QEMU VNC display driver: SASL auth protocol | |
3 | * | |
4 | * Copyright (C) 2009 Red Hat, Inc | |
5 | * | |
6 | * Permission is hereby granted, free of charge, to any person obtaining a copy | |
7 | * of this software and associated documentation files (the "Software"), to deal | |
8 | * in the Software without restriction, including without limitation the rights | |
9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
10 | * copies of the Software, and to permit persons to whom the Software is | |
11 | * furnished to do so, subject to the following conditions: | |
12 | * | |
13 | * The above copyright notice and this permission notice shall be included in | |
14 | * all copies or substantial portions of the Software. | |
15 | * | |
16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |
19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | |
22 | * THE SOFTWARE. | |
23 | */ | |
24 | ||
25 | #include "qemu/osdep.h" | |
26 | #include "qapi/error.h" | |
27 | #include "authz/base.h" | |
28 | #include "vnc.h" | |
29 | #include "trace.h" | |
30 | ||
31 | /* Max amount of data we send/recv for SASL steps to prevent DOS */ | |
32 | #define SASL_DATA_MAX_LEN (1024 * 1024) | |
33 | ||
34 | ||
35 | void vnc_sasl_client_cleanup(VncState *vs) | |
36 | { | |
37 | if (vs->sasl.conn) { | |
38 | vs->sasl.runSSF = false; | |
39 | vs->sasl.wantSSF = false; | |
40 | vs->sasl.waitWriteSSF = 0; | |
41 | vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; | |
42 | vs->sasl.encoded = NULL; | |
43 | g_free(vs->sasl.username); | |
44 | g_free(vs->sasl.mechlist); | |
45 | vs->sasl.username = vs->sasl.mechlist = NULL; | |
46 | sasl_dispose(&vs->sasl.conn); | |
47 | vs->sasl.conn = NULL; | |
48 | } | |
49 | } | |
50 | ||
51 | ||
52 | size_t vnc_client_write_sasl(VncState *vs) | |
53 | { | |
54 | size_t ret; | |
55 | ||
56 | VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd " | |
57 | "Encoded: %p size %d offset %d\n", | |
58 | vs->output.buffer, vs->output.capacity, vs->output.offset, | |
59 | vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); | |
60 | ||
61 | if (!vs->sasl.encoded) { | |
62 | int err; | |
63 | err = sasl_encode(vs->sasl.conn, | |
64 | (char *)vs->output.buffer, | |
65 | vs->output.offset, | |
66 | (const char **)&vs->sasl.encoded, | |
67 | &vs->sasl.encodedLength); | |
68 | if (err != SASL_OK) | |
69 | return vnc_client_io_error(vs, -1, NULL); | |
70 | ||
71 | vs->sasl.encodedRawLength = vs->output.offset; | |
72 | vs->sasl.encodedOffset = 0; | |
73 | } | |
74 | ||
75 | ret = vnc_client_write_buf(vs, | |
76 | vs->sasl.encoded + vs->sasl.encodedOffset, | |
77 | vs->sasl.encodedLength - vs->sasl.encodedOffset); | |
78 | if (!ret) | |
79 | return 0; | |
80 | ||
81 | vs->sasl.encodedOffset += ret; | |
82 | if (vs->sasl.encodedOffset == vs->sasl.encodedLength) { | |
83 | bool throttled = vs->force_update_offset != 0; | |
84 | size_t offset; | |
85 | if (vs->sasl.encodedRawLength >= vs->force_update_offset) { | |
86 | vs->force_update_offset = 0; | |
87 | } else { | |
88 | vs->force_update_offset -= vs->sasl.encodedRawLength; | |
89 | } | |
90 | if (throttled && vs->force_update_offset == 0) { | |
91 | trace_vnc_client_unthrottle_forced(vs, vs->ioc); | |
92 | } | |
93 | offset = vs->output.offset; | |
94 | buffer_advance(&vs->output, vs->sasl.encodedRawLength); | |
95 | if (offset >= vs->throttle_output_offset && | |
96 | vs->output.offset < vs->throttle_output_offset) { | |
97 | trace_vnc_client_unthrottle_incremental(vs, vs->ioc, | |
98 | vs->output.offset); | |
99 | } | |
100 | vs->sasl.encoded = NULL; | |
101 | vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; | |
102 | } | |
103 | ||
104 | /* Can't merge this block with one above, because | |
105 | * someone might have written more unencrypted | |
106 | * data in vs->output while we were processing | |
107 | * SASL encoded output | |
108 | */ | |
109 | if (vs->output.offset == 0) { | |
110 | if (vs->ioc_tag) { | |
111 | g_source_remove(vs->ioc_tag); | |
112 | } | |
113 | vs->ioc_tag = qio_channel_add_watch( | |
114 | vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); | |
115 | } | |
116 | ||
117 | return ret; | |
118 | } | |
119 | ||
120 | ||
121 | size_t vnc_client_read_sasl(VncState *vs) | |
122 | { | |
123 | size_t ret; | |
124 | uint8_t encoded[4096]; | |
125 | const char *decoded; | |
126 | unsigned int decodedLen; | |
127 | int err; | |
128 | ||
129 | ret = vnc_client_read_buf(vs, encoded, sizeof(encoded)); | |
130 | if (!ret) | |
131 | return 0; | |
132 | ||
133 | err = sasl_decode(vs->sasl.conn, | |
134 | (char *)encoded, ret, | |
135 | &decoded, &decodedLen); | |
136 | ||
137 | if (err != SASL_OK) | |
138 | return vnc_client_io_error(vs, -1, NULL); | |
139 | VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n", | |
140 | encoded, ret, decoded, decodedLen); | |
141 | buffer_reserve(&vs->input, decodedLen); | |
142 | buffer_append(&vs->input, decoded, decodedLen); | |
143 | return decodedLen; | |
144 | } | |
145 | ||
146 | ||
147 | static int vnc_auth_sasl_check_access(VncState *vs) | |
148 | { | |
149 | const void *val; | |
150 | int rv; | |
151 | Error *err = NULL; | |
152 | bool allow; | |
153 | ||
154 | rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val); | |
155 | if (rv != SASL_OK) { | |
156 | trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username", | |
157 | sasl_errstring(rv, NULL, NULL)); | |
158 | return -1; | |
159 | } | |
160 | if (val == NULL) { | |
161 | trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", ""); | |
162 | return -1; | |
163 | } | |
164 | ||
165 | vs->sasl.username = g_strdup((const char*)val); | |
166 | trace_vnc_auth_sasl_username(vs, vs->sasl.username); | |
167 | ||
168 | if (vs->vd->sasl.authzid == NULL) { | |
169 | trace_vnc_auth_sasl_acl(vs, 1); | |
170 | return 0; | |
171 | } | |
172 | ||
173 | allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid, | |
174 | vs->sasl.username, &err); | |
175 | if (err) { | |
176 | trace_vnc_auth_fail(vs, vs->auth, "Error from authz", | |
177 | error_get_pretty(err)); | |
178 | error_free(err); | |
179 | return -1; | |
180 | } | |
181 | ||
182 | trace_vnc_auth_sasl_acl(vs, allow); | |
183 | return allow ? 0 : -1; | |
184 | } | |
185 | ||
186 | static int vnc_auth_sasl_check_ssf(VncState *vs) | |
187 | { | |
188 | const void *val; | |
189 | int err, ssf; | |
190 | ||
191 | if (!vs->sasl.wantSSF) | |
192 | return 1; | |
193 | ||
194 | err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val); | |
195 | if (err != SASL_OK) | |
196 | return 0; | |
197 | ||
198 | ssf = *(const int *)val; | |
199 | ||
200 | trace_vnc_auth_sasl_ssf(vs, ssf); | |
201 | ||
202 | if (ssf < 56) | |
203 | return 0; /* 56 is good for Kerberos */ | |
204 | ||
205 | /* Only setup for read initially, because we're about to send an RPC | |
206 | * reply which must be in plain text. When the next incoming RPC | |
207 | * arrives, we'll switch on writes too | |
208 | * | |
209 | * cf qemudClientReadSASL in qemud.c | |
210 | */ | |
211 | vs->sasl.runSSF = 1; | |
212 | ||
213 | /* We have a SSF that's good enough */ | |
214 | return 1; | |
215 | } | |
216 | ||
217 | /* | |
218 | * Step Msg | |
219 | * | |
220 | * Input from client: | |
221 | * | |
222 | * u32 clientin-length | |
223 | * u8-array clientin-string | |
224 | * | |
225 | * Output to client: | |
226 | * | |
227 | * u32 serverout-length | |
228 | * u8-array serverout-strin | |
229 | * u8 continue | |
230 | */ | |
231 | ||
232 | static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len); | |
233 | ||
234 | static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len) | |
235 | { | |
236 | uint32_t datalen = len; | |
237 | const char *serverout; | |
238 | unsigned int serveroutlen; | |
239 | int err; | |
240 | char *clientdata = NULL; | |
241 | ||
242 | /* NB, distinction of NULL vs "" is *critical* in SASL */ | |
243 | if (datalen) { | |
244 | clientdata = (char*)data; | |
245 | clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ | |
246 | datalen--; /* Don't count NULL byte when passing to _start() */ | |
247 | } | |
248 | ||
249 | err = sasl_server_step(vs->sasl.conn, | |
250 | clientdata, | |
251 | datalen, | |
252 | &serverout, | |
253 | &serveroutlen); | |
254 | trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err); | |
255 | if (err != SASL_OK && | |
256 | err != SASL_CONTINUE) { | |
257 | trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth", | |
258 | sasl_errdetail(vs->sasl.conn)); | |
259 | sasl_dispose(&vs->sasl.conn); | |
260 | vs->sasl.conn = NULL; | |
261 | goto authabort; | |
262 | } | |
263 | ||
264 | if (serveroutlen > SASL_DATA_MAX_LEN) { | |
265 | trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", ""); | |
266 | sasl_dispose(&vs->sasl.conn); | |
267 | vs->sasl.conn = NULL; | |
268 | goto authabort; | |
269 | } | |
270 | ||
271 | if (serveroutlen) { | |
272 | vnc_write_u32(vs, serveroutlen + 1); | |
273 | vnc_write(vs, serverout, serveroutlen + 1); | |
274 | } else { | |
275 | vnc_write_u32(vs, 0); | |
276 | } | |
277 | ||
278 | /* Whether auth is complete */ | |
279 | vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); | |
280 | ||
281 | if (err == SASL_CONTINUE) { | |
282 | /* Wait for step length */ | |
283 | vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); | |
284 | } else { | |
285 | if (!vnc_auth_sasl_check_ssf(vs)) { | |
286 | trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", ""); | |
287 | goto authreject; | |
288 | } | |
289 | ||
290 | /* Check username whitelist ACL */ | |
291 | if (vnc_auth_sasl_check_access(vs) < 0) { | |
292 | goto authreject; | |
293 | } | |
294 | ||
295 | trace_vnc_auth_pass(vs, vs->auth); | |
296 | vnc_write_u32(vs, 0); /* Accept auth */ | |
297 | /* | |
298 | * Delay writing in SSF encoded mode until pending output | |
299 | * buffer is written | |
300 | */ | |
301 | if (vs->sasl.runSSF) | |
302 | vs->sasl.waitWriteSSF = vs->output.offset; | |
303 | start_client_init(vs); | |
304 | } | |
305 | ||
306 | return 0; | |
307 | ||
308 | authreject: | |
309 | vnc_write_u32(vs, 1); /* Reject auth */ | |
310 | vnc_write_u32(vs, sizeof("Authentication failed")); | |
311 | vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); | |
312 | vnc_flush(vs); | |
313 | vnc_client_error(vs); | |
314 | return -1; | |
315 | ||
316 | authabort: | |
317 | vnc_client_error(vs); | |
318 | return -1; | |
319 | } | |
320 | ||
321 | static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len) | |
322 | { | |
323 | uint32_t steplen = read_u32(data, 0); | |
324 | ||
325 | if (steplen > SASL_DATA_MAX_LEN) { | |
326 | trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", ""); | |
327 | vnc_client_error(vs); | |
328 | return -1; | |
329 | } | |
330 | ||
331 | if (steplen == 0) | |
332 | return protocol_client_auth_sasl_step(vs, NULL, 0); | |
333 | else | |
334 | vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); | |
335 | return 0; | |
336 | } | |
337 | ||
338 | /* | |
339 | * Start Msg | |
340 | * | |
341 | * Input from client: | |
342 | * | |
343 | * u32 clientin-length | |
344 | * u8-array clientin-string | |
345 | * | |
346 | * Output to client: | |
347 | * | |
348 | * u32 serverout-length | |
349 | * u8-array serverout-strin | |
350 | * u8 continue | |
351 | */ | |
352 | ||
353 | #define SASL_DATA_MAX_LEN (1024 * 1024) | |
354 | ||
355 | static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len) | |
356 | { | |
357 | uint32_t datalen = len; | |
358 | const char *serverout; | |
359 | unsigned int serveroutlen; | |
360 | int err; | |
361 | char *clientdata = NULL; | |
362 | ||
363 | /* NB, distinction of NULL vs "" is *critical* in SASL */ | |
364 | if (datalen) { | |
365 | clientdata = (char*)data; | |
366 | clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ | |
367 | datalen--; /* Don't count NULL byte when passing to _start() */ | |
368 | } | |
369 | ||
370 | err = sasl_server_start(vs->sasl.conn, | |
371 | vs->sasl.mechlist, | |
372 | clientdata, | |
373 | datalen, | |
374 | &serverout, | |
375 | &serveroutlen); | |
376 | trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err); | |
377 | if (err != SASL_OK && | |
378 | err != SASL_CONTINUE) { | |
379 | trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth", | |
380 | sasl_errdetail(vs->sasl.conn)); | |
381 | sasl_dispose(&vs->sasl.conn); | |
382 | vs->sasl.conn = NULL; | |
383 | goto authabort; | |
384 | } | |
385 | if (serveroutlen > SASL_DATA_MAX_LEN) { | |
386 | trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", ""); | |
387 | sasl_dispose(&vs->sasl.conn); | |
388 | vs->sasl.conn = NULL; | |
389 | goto authabort; | |
390 | } | |
391 | ||
392 | if (serveroutlen) { | |
393 | vnc_write_u32(vs, serveroutlen + 1); | |
394 | vnc_write(vs, serverout, serveroutlen + 1); | |
395 | } else { | |
396 | vnc_write_u32(vs, 0); | |
397 | } | |
398 | ||
399 | /* Whether auth is complete */ | |
400 | vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); | |
401 | ||
402 | if (err == SASL_CONTINUE) { | |
403 | /* Wait for step length */ | |
404 | vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); | |
405 | } else { | |
406 | if (!vnc_auth_sasl_check_ssf(vs)) { | |
407 | trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", ""); | |
408 | goto authreject; | |
409 | } | |
410 | ||
411 | /* Check username whitelist ACL */ | |
412 | if (vnc_auth_sasl_check_access(vs) < 0) { | |
413 | goto authreject; | |
414 | } | |
415 | ||
416 | trace_vnc_auth_pass(vs, vs->auth); | |
417 | vnc_write_u32(vs, 0); /* Accept auth */ | |
418 | start_client_init(vs); | |
419 | } | |
420 | ||
421 | return 0; | |
422 | ||
423 | authreject: | |
424 | vnc_write_u32(vs, 1); /* Reject auth */ | |
425 | vnc_write_u32(vs, sizeof("Authentication failed")); | |
426 | vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); | |
427 | vnc_flush(vs); | |
428 | vnc_client_error(vs); | |
429 | return -1; | |
430 | ||
431 | authabort: | |
432 | vnc_client_error(vs); | |
433 | return -1; | |
434 | } | |
435 | ||
436 | static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len) | |
437 | { | |
438 | uint32_t startlen = read_u32(data, 0); | |
439 | ||
440 | if (startlen > SASL_DATA_MAX_LEN) { | |
441 | trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", ""); | |
442 | vnc_client_error(vs); | |
443 | return -1; | |
444 | } | |
445 | ||
446 | if (startlen == 0) | |
447 | return protocol_client_auth_sasl_start(vs, NULL, 0); | |
448 | ||
449 | vnc_read_when(vs, protocol_client_auth_sasl_start, startlen); | |
450 | return 0; | |
451 | } | |
452 | ||
453 | static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len) | |
454 | { | |
455 | char *mechname = g_strndup((const char *) data, len); | |
456 | trace_vnc_auth_sasl_mech_choose(vs, mechname); | |
457 | ||
458 | if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { | |
459 | if (vs->sasl.mechlist[len] != '\0' && | |
460 | vs->sasl.mechlist[len] != ',') { | |
461 | goto fail; | |
462 | } | |
463 | } else { | |
464 | char *offset = strstr(vs->sasl.mechlist, mechname); | |
465 | if (!offset) { | |
466 | goto fail; | |
467 | } | |
468 | if (offset[-1] != ',' || | |
469 | (offset[len] != '\0'&& | |
470 | offset[len] != ',')) { | |
471 | goto fail; | |
472 | } | |
473 | } | |
474 | ||
475 | g_free(vs->sasl.mechlist); | |
476 | vs->sasl.mechlist = mechname; | |
477 | ||
478 | vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4); | |
479 | return 0; | |
480 | ||
481 | fail: | |
482 | trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname); | |
483 | vnc_client_error(vs); | |
484 | g_free(mechname); | |
485 | return -1; | |
486 | } | |
487 | ||
488 | static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len) | |
489 | { | |
490 | uint32_t mechlen = read_u32(data, 0); | |
491 | ||
492 | if (mechlen > 100) { | |
493 | trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", ""); | |
494 | vnc_client_error(vs); | |
495 | return -1; | |
496 | } | |
497 | if (mechlen < 1) { | |
498 | trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", ""); | |
499 | vnc_client_error(vs); | |
500 | return -1; | |
501 | } | |
502 | vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen); | |
503 | return 0; | |
504 | } | |
505 | ||
506 | static char * | |
507 | vnc_socket_ip_addr_string(QIOChannelSocket *ioc, | |
508 | bool local, | |
509 | Error **errp) | |
510 | { | |
511 | SocketAddress *addr; | |
512 | char *ret; | |
513 | ||
514 | if (local) { | |
515 | addr = qio_channel_socket_get_local_address(ioc, errp); | |
516 | } else { | |
517 | addr = qio_channel_socket_get_remote_address(ioc, errp); | |
518 | } | |
519 | if (!addr) { | |
520 | return NULL; | |
521 | } | |
522 | ||
523 | if (addr->type != SOCKET_ADDRESS_TYPE_INET) { | |
524 | error_setg(errp, "Not an inet socket type"); | |
525 | return NULL; | |
526 | } | |
527 | ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port); | |
528 | qapi_free_SocketAddress(addr); | |
529 | return ret; | |
530 | } | |
531 | ||
532 | void start_auth_sasl(VncState *vs) | |
533 | { | |
534 | const char *mechlist = NULL; | |
535 | sasl_security_properties_t secprops; | |
536 | int err; | |
537 | Error *local_err = NULL; | |
538 | char *localAddr, *remoteAddr; | |
539 | int mechlistlen; | |
540 | ||
541 | /* Get local & remote client addresses in form IPADDR;PORT */ | |
542 | localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err); | |
543 | if (!localAddr) { | |
544 | trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP", | |
545 | error_get_pretty(local_err)); | |
546 | goto authabort; | |
547 | } | |
548 | ||
549 | remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err); | |
550 | if (!remoteAddr) { | |
551 | trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP", | |
552 | error_get_pretty(local_err)); | |
553 | g_free(localAddr); | |
554 | goto authabort; | |
555 | } | |
556 | ||
557 | err = sasl_server_new("vnc", | |
558 | NULL, /* FQDN - just delegates to gethostname */ | |
559 | NULL, /* User realm */ | |
560 | localAddr, | |
561 | remoteAddr, | |
562 | NULL, /* Callbacks, not needed */ | |
563 | SASL_SUCCESS_DATA, | |
564 | &vs->sasl.conn); | |
565 | g_free(localAddr); | |
566 | g_free(remoteAddr); | |
567 | localAddr = remoteAddr = NULL; | |
568 | ||
569 | if (err != SASL_OK) { | |
570 | trace_vnc_auth_fail(vs, vs->auth, "SASL context setup failed", | |
571 | sasl_errstring(err, NULL, NULL)); | |
572 | vs->sasl.conn = NULL; | |
573 | goto authabort; | |
574 | } | |
575 | ||
576 | /* Inform SASL that we've got an external SSF layer from TLS/x509 */ | |
577 | if (vs->auth == VNC_AUTH_VENCRYPT && | |
578 | vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) { | |
579 | int keysize; | |
580 | sasl_ssf_t ssf; | |
581 | ||
582 | keysize = qcrypto_tls_session_get_key_size(vs->tls, | |
583 | &local_err); | |
584 | if (keysize < 0) { | |
585 | trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size", | |
586 | error_get_pretty(local_err)); | |
587 | sasl_dispose(&vs->sasl.conn); | |
588 | vs->sasl.conn = NULL; | |
589 | goto authabort; | |
590 | } | |
591 | ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */ | |
592 | ||
593 | err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); | |
594 | if (err != SASL_OK) { | |
595 | trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF", | |
596 | sasl_errstring(err, NULL, NULL)); | |
597 | sasl_dispose(&vs->sasl.conn); | |
598 | vs->sasl.conn = NULL; | |
599 | goto authabort; | |
600 | } | |
601 | } else { | |
602 | vs->sasl.wantSSF = 1; | |
603 | } | |
604 | ||
605 | memset (&secprops, 0, sizeof secprops); | |
606 | /* Inform SASL that we've got an external SSF layer from TLS. | |
607 | * | |
608 | * Disable SSF, if using TLS+x509+SASL only. TLS without x509 | |
609 | * is not sufficiently strong | |
610 | */ | |
611 | if (vs->vd->is_unix || | |
612 | (vs->auth == VNC_AUTH_VENCRYPT && | |
613 | vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) { | |
614 | /* If we've got TLS or UNIX domain sock, we don't care about SSF */ | |
615 | secprops.min_ssf = 0; | |
616 | secprops.max_ssf = 0; | |
617 | secprops.maxbufsize = 8192; | |
618 | secprops.security_flags = 0; | |
619 | } else { | |
620 | /* Plain TCP, better get an SSF layer */ | |
621 | secprops.min_ssf = 56; /* Good enough to require kerberos */ | |
622 | secprops.max_ssf = 100000; /* Arbitrary big number */ | |
623 | secprops.maxbufsize = 8192; | |
624 | /* Forbid any anonymous or trivially crackable auth */ | |
625 | secprops.security_flags = | |
626 | SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; | |
627 | } | |
628 | ||
629 | err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops); | |
630 | if (err != SASL_OK) { | |
631 | trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props", | |
632 | sasl_errstring(err, NULL, NULL)); | |
633 | sasl_dispose(&vs->sasl.conn); | |
634 | vs->sasl.conn = NULL; | |
635 | goto authabort; | |
636 | } | |
637 | ||
638 | err = sasl_listmech(vs->sasl.conn, | |
639 | NULL, /* Don't need to set user */ | |
640 | "", /* Prefix */ | |
641 | ",", /* Separator */ | |
642 | "", /* Suffix */ | |
643 | &mechlist, | |
644 | NULL, | |
645 | NULL); | |
646 | if (err != SASL_OK) { | |
647 | trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms", | |
648 | sasl_errdetail(vs->sasl.conn)); | |
649 | sasl_dispose(&vs->sasl.conn); | |
650 | vs->sasl.conn = NULL; | |
651 | goto authabort; | |
652 | } | |
653 | trace_vnc_auth_sasl_mech_list(vs, mechlist); | |
654 | ||
655 | vs->sasl.mechlist = g_strdup(mechlist); | |
656 | mechlistlen = strlen(mechlist); | |
657 | vnc_write_u32(vs, mechlistlen); | |
658 | vnc_write(vs, mechlist, mechlistlen); | |
659 | vnc_flush(vs); | |
660 | ||
661 | vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4); | |
662 | ||
663 | return; | |
664 | ||
665 | authabort: | |
666 | error_free(local_err); | |
667 | vnc_client_error(vs); | |
668 | } | |
669 | ||
670 |