2 * QEMU VNC display driver: SASL auth protocol
4 * Copyright (C) 2009 Red Hat, Inc
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 /* Max amount of data we send/recv for SASL steps to prevent DOS */
28 #define SASL_DATA_MAX_LEN (1024 * 1024)
31 void vnc_sasl_client_cleanup(VncState
*vs
)
34 vs
->sasl
.runSSF
= vs
->sasl
.waitWriteSSF
= vs
->sasl
.wantSSF
= 0;
35 vs
->sasl
.encodedLength
= vs
->sasl
.encodedOffset
= 0;
36 vs
->sasl
.encoded
= NULL
;
37 free(vs
->sasl
.username
);
38 free(vs
->sasl
.mechlist
);
39 vs
->sasl
.username
= vs
->sasl
.mechlist
= NULL
;
40 sasl_dispose(&vs
->sasl
.conn
);
46 long vnc_client_write_sasl(VncState
*vs
)
50 VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
51 vs
->output
.buffer
, vs
->output
.capacity
, vs
->output
.offset
,
52 vs
->sasl
.encoded
, vs
->sasl
.encodedLength
, vs
->sasl
.encodedOffset
);
54 if (!vs
->sasl
.encoded
) {
56 err
= sasl_encode(vs
->sasl
.conn
,
57 (char *)vs
->output
.buffer
,
59 (const char **)&vs
->sasl
.encoded
,
60 &vs
->sasl
.encodedLength
);
62 return vnc_client_io_error(vs
, -1, EIO
);
64 vs
->sasl
.encodedOffset
= 0;
67 ret
= vnc_client_write_buf(vs
,
68 vs
->sasl
.encoded
+ vs
->sasl
.encodedOffset
,
69 vs
->sasl
.encodedLength
- vs
->sasl
.encodedOffset
);
73 vs
->sasl
.encodedOffset
+= ret
;
74 if (vs
->sasl
.encodedOffset
== vs
->sasl
.encodedLength
) {
75 vs
->output
.offset
= 0;
76 vs
->sasl
.encoded
= NULL
;
77 vs
->sasl
.encodedOffset
= vs
->sasl
.encodedLength
= 0;
80 /* Can't merge this block with one above, because
81 * someone might have written more unencrypted
82 * data in vs->output while we were processing
85 if (vs
->output
.offset
== 0) {
86 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
93 long vnc_client_read_sasl(VncState
*vs
)
96 uint8_t encoded
[4096];
98 unsigned int decodedLen
;
101 ret
= vnc_client_read_buf(vs
, encoded
, sizeof(encoded
));
105 err
= sasl_decode(vs
->sasl
.conn
,
106 (char *)encoded
, ret
,
107 &decoded
, &decodedLen
);
110 return vnc_client_io_error(vs
, -1, -EIO
);
111 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
112 encoded
, ret
, decoded
, decodedLen
);
113 buffer_reserve(&vs
->input
, decodedLen
);
114 buffer_append(&vs
->input
, decoded
, decodedLen
);
119 static int vnc_auth_sasl_check_access(VncState
*vs
)
124 err
= sasl_getprop(vs
->sasl
.conn
, SASL_USERNAME
, &val
);
125 if (err
!= SASL_OK
) {
126 VNC_DEBUG("cannot query SASL username on connection %d (%s)\n",
127 err
, sasl_errstring(err
, NULL
, NULL
));
131 VNC_DEBUG("no client username was found\n");
134 VNC_DEBUG("SASL client username %s\n", (const char *)val
);
136 vs
->sasl
.username
= qemu_strdup((const char*)val
);
141 static int vnc_auth_sasl_check_ssf(VncState
*vs
)
146 if (!vs
->sasl
.wantSSF
)
149 err
= sasl_getprop(vs
->sasl
.conn
, SASL_SSF
, &val
);
153 ssf
= *(const int *)val
;
154 VNC_DEBUG("negotiated an SSF of %d\n", ssf
);
156 return 0; /* 56 is good for Kerberos */
158 /* Only setup for read initially, because we're about to send an RPC
159 * reply which must be in plain text. When the next incoming RPC
160 * arrives, we'll switch on writes too
162 * cf qemudClientReadSASL in qemud.c
166 /* We have a SSF that's good enough */
175 * u32 clientin-length
176 * u8-array clientin-string
180 * u32 serverout-length
181 * u8-array serverout-strin
185 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
);
187 static int protocol_client_auth_sasl_step(VncState
*vs
, uint8_t *data
, size_t len
)
189 uint32_t datalen
= len
;
190 const char *serverout
;
191 unsigned int serveroutlen
;
193 char *clientdata
= NULL
;
195 /* NB, distinction of NULL vs "" is *critical* in SASL */
197 clientdata
= (char*)data
;
198 clientdata
[datalen
-1] = '\0'; /* Wire includes '\0', but make sure */
199 datalen
--; /* Don't count NULL byte when passing to _start() */
202 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
203 clientdata
, datalen
);
204 err
= sasl_server_step(vs
->sasl
.conn
,
209 if (err
!= SASL_OK
&&
210 err
!= SASL_CONTINUE
) {
211 VNC_DEBUG("sasl step failed %d (%s)\n",
212 err
, sasl_errdetail(vs
->sasl
.conn
));
213 sasl_dispose(&vs
->sasl
.conn
);
214 vs
->sasl
.conn
= NULL
;
218 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
219 VNC_DEBUG("sasl step reply data too long %d\n",
221 sasl_dispose(&vs
->sasl
.conn
);
222 vs
->sasl
.conn
= NULL
;
226 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
227 serveroutlen
, serverout
? 0 : 1);
230 vnc_write_u32(vs
, serveroutlen
+ 1);
231 vnc_write(vs
, serverout
, serveroutlen
+ 1);
233 vnc_write_u32(vs
, 0);
236 /* Whether auth is complete */
237 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
239 if (err
== SASL_CONTINUE
) {
240 VNC_DEBUG("%s", "Authentication must continue\n");
241 /* Wait for step length */
242 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
244 if (!vnc_auth_sasl_check_ssf(vs
)) {
245 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs
->csock
);
249 /* Check username whitelist ACL */
250 if (vnc_auth_sasl_check_access(vs
) < 0) {
251 VNC_DEBUG("Authentication rejected for ACL %d\n", vs
->csock
);
255 VNC_DEBUG("Authentication successful %d\n", vs
->csock
);
256 vnc_write_u32(vs
, 0); /* Accept auth */
258 * Delay writing in SSF encoded mode until pending output
262 vs
->sasl
.waitWriteSSF
= vs
->output
.offset
;
263 start_client_init(vs
);
269 vnc_write_u32(vs
, 1); /* Reject auth */
270 vnc_write_u32(vs
, sizeof("Authentication failed"));
271 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
273 vnc_client_error(vs
);
277 vnc_client_error(vs
);
281 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
)
283 uint32_t steplen
= read_u32(data
, 0);
284 VNC_DEBUG("Got client step len %d\n", steplen
);
285 if (steplen
> SASL_DATA_MAX_LEN
) {
286 VNC_DEBUG("Too much SASL data %d\n", steplen
);
287 vnc_client_error(vs
);
292 return protocol_client_auth_sasl_step(vs
, NULL
, 0);
294 vnc_read_when(vs
, protocol_client_auth_sasl_step
, steplen
);
303 * u32 clientin-length
304 * u8-array clientin-string
308 * u32 serverout-length
309 * u8-array serverout-strin
313 #define SASL_DATA_MAX_LEN (1024 * 1024)
315 static int protocol_client_auth_sasl_start(VncState
*vs
, uint8_t *data
, size_t len
)
317 uint32_t datalen
= len
;
318 const char *serverout
;
319 unsigned int serveroutlen
;
321 char *clientdata
= NULL
;
323 /* NB, distinction of NULL vs "" is *critical* in SASL */
325 clientdata
= (char*)data
;
326 clientdata
[datalen
-1] = '\0'; /* Should be on wire, but make sure */
327 datalen
--; /* Don't count NULL byte when passing to _start() */
330 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
331 vs
->sasl
.mechlist
, clientdata
, datalen
);
332 err
= sasl_server_start(vs
->sasl
.conn
,
338 if (err
!= SASL_OK
&&
339 err
!= SASL_CONTINUE
) {
340 VNC_DEBUG("sasl start failed %d (%s)\n",
341 err
, sasl_errdetail(vs
->sasl
.conn
));
342 sasl_dispose(&vs
->sasl
.conn
);
343 vs
->sasl
.conn
= NULL
;
346 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
347 VNC_DEBUG("sasl start reply data too long %d\n",
349 sasl_dispose(&vs
->sasl
.conn
);
350 vs
->sasl
.conn
= NULL
;
354 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
355 serveroutlen
, serverout
? 0 : 1);
358 vnc_write_u32(vs
, serveroutlen
+ 1);
359 vnc_write(vs
, serverout
, serveroutlen
+ 1);
361 vnc_write_u32(vs
, 0);
364 /* Whether auth is complete */
365 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
367 if (err
== SASL_CONTINUE
) {
368 VNC_DEBUG("%s", "Authentication must continue\n");
369 /* Wait for step length */
370 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
372 if (!vnc_auth_sasl_check_ssf(vs
)) {
373 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs
->csock
);
377 /* Check username whitelist ACL */
378 if (vnc_auth_sasl_check_access(vs
) < 0) {
379 VNC_DEBUG("Authentication rejected for ACL %d\n", vs
->csock
);
383 VNC_DEBUG("Authentication successful %d\n", vs
->csock
);
384 vnc_write_u32(vs
, 0); /* Accept auth */
385 start_client_init(vs
);
391 vnc_write_u32(vs
, 1); /* Reject auth */
392 vnc_write_u32(vs
, sizeof("Authentication failed"));
393 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
395 vnc_client_error(vs
);
399 vnc_client_error(vs
);
403 static int protocol_client_auth_sasl_start_len(VncState
*vs
, uint8_t *data
, size_t len
)
405 uint32_t startlen
= read_u32(data
, 0);
406 VNC_DEBUG("Got client start len %d\n", startlen
);
407 if (startlen
> SASL_DATA_MAX_LEN
) {
408 VNC_DEBUG("Too much SASL data %d\n", startlen
);
409 vnc_client_error(vs
);
414 return protocol_client_auth_sasl_start(vs
, NULL
, 0);
416 vnc_read_when(vs
, protocol_client_auth_sasl_start
, startlen
);
420 static int protocol_client_auth_sasl_mechname(VncState
*vs
, uint8_t *data
, size_t len
)
422 char *mechname
= malloc(len
+ 1);
424 VNC_DEBUG("Out of memory reading mechname\n");
425 vnc_client_error(vs
);
427 strncpy(mechname
, (char*)data
, len
);
428 mechname
[len
] = '\0';
429 VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
430 mechname
, vs
->sasl
.mechlist
);
432 if (strncmp(vs
->sasl
.mechlist
, mechname
, len
) == 0) {
433 if (vs
->sasl
.mechlist
[len
] != '\0' &&
434 vs
->sasl
.mechlist
[len
] != ',') {
435 VNC_DEBUG("One %d", vs
->sasl
.mechlist
[len
]);
436 vnc_client_error(vs
);
440 char *offset
= strstr(vs
->sasl
.mechlist
, mechname
);
441 VNC_DEBUG("Two %p\n", offset
);
443 vnc_client_error(vs
);
446 VNC_DEBUG("Two '%s'\n", offset
);
447 if (offset
[-1] != ',' ||
448 (offset
[len
] != '\0'&&
449 offset
[len
] != ',')) {
450 vnc_client_error(vs
);
455 free(vs
->sasl
.mechlist
);
456 vs
->sasl
.mechlist
= mechname
;
458 VNC_DEBUG("Validated mechname '%s'\n", mechname
);
459 vnc_read_when(vs
, protocol_client_auth_sasl_start_len
, 4);
463 static int protocol_client_auth_sasl_mechname_len(VncState
*vs
, uint8_t *data
, size_t len
)
465 uint32_t mechlen
= read_u32(data
, 0);
466 VNC_DEBUG("Got client mechname len %d\n", mechlen
);
468 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen
);
469 vnc_client_error(vs
);
473 VNC_DEBUG("Too short SASL mechname %d\n", mechlen
);
474 vnc_client_error(vs
);
477 vnc_read_when(vs
, protocol_client_auth_sasl_mechname
,mechlen
);
481 #define USES_X509_AUTH(vs) \
482 ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
483 (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
484 (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \
485 (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
488 void start_auth_sasl(VncState
*vs
)
490 const char *mechlist
= NULL
;
491 sasl_security_properties_t secprops
;
493 char *localAddr
, *remoteAddr
;
496 VNC_DEBUG("Initialize SASL auth %d\n", vs
->csock
);
498 /* Get local & remote client addresses in form IPADDR;PORT */
499 if (!(localAddr
= vnc_socket_local_addr("%s;%s", vs
->csock
)))
502 if (!(remoteAddr
= vnc_socket_remote_addr("%s;%s", vs
->csock
))) {
507 err
= sasl_server_new("vnc",
508 NULL
, /* FQDN - just delegates to gethostname */
509 NULL
, /* User realm */
512 NULL
, /* Callbacks, not needed */
517 localAddr
= remoteAddr
= NULL
;
519 if (err
!= SASL_OK
) {
520 VNC_DEBUG("sasl context setup failed %d (%s)",
521 err
, sasl_errstring(err
, NULL
, NULL
));
522 vs
->sasl
.conn
= NULL
;
526 #ifdef CONFIG_VNC_TLS
527 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
528 if (vs
->vd
->auth
== VNC_AUTH_VENCRYPT
&&
529 vs
->vd
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
) {
530 gnutls_cipher_algorithm_t cipher
;
533 cipher
= gnutls_cipher_get(vs
->tls
.session
);
534 if (!(ssf
= (sasl_ssf_t
)gnutls_cipher_get_key_size(cipher
))) {
535 VNC_DEBUG("%s", "cannot TLS get cipher size\n");
536 sasl_dispose(&vs
->sasl
.conn
);
537 vs
->sasl
.conn
= NULL
;
540 ssf
*= 8; /* tls key size is bytes, sasl wants bits */
542 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SSF_EXTERNAL
, &ssf
);
543 if (err
!= SASL_OK
) {
544 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
545 err
, sasl_errstring(err
, NULL
, NULL
));
546 sasl_dispose(&vs
->sasl
.conn
);
547 vs
->sasl
.conn
= NULL
;
551 #endif /* CONFIG_VNC_TLS */
552 vs
->sasl
.wantSSF
= 1;
554 memset (&secprops
, 0, sizeof secprops
);
555 /* Inform SASL that we've got an external SSF layer from TLS */
556 if (strncmp(vs
->vd
->display
, "unix:", 5) == 0
557 #ifdef CONFIG_VNC_TLS
558 /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
559 is not sufficiently strong */
560 || (vs
->vd
->auth
== VNC_AUTH_VENCRYPT
&&
561 vs
->vd
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
)
562 #endif /* CONFIG_VNC_TLS */
564 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
565 secprops
.min_ssf
= 0;
566 secprops
.max_ssf
= 0;
567 secprops
.maxbufsize
= 8192;
568 secprops
.security_flags
= 0;
570 /* Plain TCP, better get an SSF layer */
571 secprops
.min_ssf
= 56; /* Good enough to require kerberos */
572 secprops
.max_ssf
= 100000; /* Arbitrary big number */
573 secprops
.maxbufsize
= 8192;
574 /* Forbid any anonymous or trivially crackable auth */
575 secprops
.security_flags
=
576 SASL_SEC_NOANONYMOUS
| SASL_SEC_NOPLAINTEXT
;
579 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SEC_PROPS
, &secprops
);
580 if (err
!= SASL_OK
) {
581 VNC_DEBUG("cannot set SASL security props %d (%s)\n",
582 err
, sasl_errstring(err
, NULL
, NULL
));
583 sasl_dispose(&vs
->sasl
.conn
);
584 vs
->sasl
.conn
= NULL
;
588 err
= sasl_listmech(vs
->sasl
.conn
,
589 NULL
, /* Don't need to set user */
596 if (err
!= SASL_OK
) {
597 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
598 err
, sasl_errdetail(vs
->sasl
.conn
));
599 sasl_dispose(&vs
->sasl
.conn
);
600 vs
->sasl
.conn
= NULL
;
603 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist
);
605 if (!(vs
->sasl
.mechlist
= strdup(mechlist
))) {
606 VNC_DEBUG("Out of memory");
607 sasl_dispose(&vs
->sasl
.conn
);
608 vs
->sasl
.conn
= NULL
;
611 mechlistlen
= strlen(mechlist
);
612 vnc_write_u32(vs
, mechlistlen
);
613 vnc_write(vs
, mechlist
, mechlistlen
);
616 VNC_DEBUG("Wait for client mechname length\n");
617 vnc_read_when(vs
, protocol_client_auth_sasl_mechname_len
, 4);
622 vnc_client_error(vs
);