* THE SOFTWARE.
*/
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "authz/base.h"
#include "vnc.h"
+#include "trace.h"
+
+/*
+ * Apple has deprecated sasl.h functions in OS X 10.11. Therefore,
+ * files that use SASL API need to disable -Wdeprecated-declarations.
+ */
+#ifdef CONFIG_DARWIN
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
/* Max amount of data we send/recv for SASL steps to prevent DOS */
#define SASL_DATA_MAX_LEN (1024 * 1024)
+bool vnc_sasl_server_init(Error **errp)
+{
+ int saslErr = sasl_server_init(NULL, "qemu");
+
+ if (saslErr != SASL_OK) {
+ error_setg(errp, "Failed to initialize SASL auth: %s",
+ sasl_errstring(saslErr, NULL, NULL));
+ return false;
+ }
+ return true;
+}
+
void vnc_sasl_client_cleanup(VncState *vs)
{
if (vs->sasl.conn) {
}
-long vnc_client_write_sasl(VncState *vs)
+size_t vnc_client_write_sasl(VncState *vs)
{
- long ret;
+ size_t ret;
VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
"Encoded: %p size %d offset %d\n",
(const char **)&vs->sasl.encoded,
&vs->sasl.encodedLength);
if (err != SASL_OK)
- return vnc_client_io_error(vs, -1, EIO);
+ return vnc_client_io_error(vs, -1, NULL);
+ vs->sasl.encodedRawLength = vs->output.offset;
vs->sasl.encodedOffset = 0;
}
vs->sasl.encodedOffset += ret;
if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
- vs->output.offset = 0;
+ bool throttled = vs->force_update_offset != 0;
+ size_t offset;
+ if (vs->sasl.encodedRawLength >= vs->force_update_offset) {
+ vs->force_update_offset = 0;
+ } else {
+ vs->force_update_offset -= vs->sasl.encodedRawLength;
+ }
+ if (throttled && vs->force_update_offset == 0) {
+ trace_vnc_client_unthrottle_forced(vs, vs->ioc);
+ }
+ offset = vs->output.offset;
+ buffer_advance(&vs->output, vs->sasl.encodedRawLength);
+ if (offset >= vs->throttle_output_offset &&
+ vs->output.offset < vs->throttle_output_offset) {
+ trace_vnc_client_unthrottle_incremental(vs, vs->ioc,
+ vs->output.offset);
+ }
vs->sasl.encoded = NULL;
vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
}
* SASL encoded output
*/
if (vs->output.offset == 0) {
- qemu_set_fd_handler(vs->csock, vnc_client_read, NULL, vs);
+ if (vs->ioc_tag) {
+ g_source_remove(vs->ioc_tag);
+ }
+ vs->ioc_tag = qio_channel_add_watch(
+ vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
+ vnc_client_io, vs, NULL);
}
return ret;
}
-long vnc_client_read_sasl(VncState *vs)
+size_t vnc_client_read_sasl(VncState *vs)
{
- long ret;
+ size_t ret;
uint8_t encoded[4096];
const char *decoded;
unsigned int decodedLen;
&decoded, &decodedLen);
if (err != SASL_OK)
- return vnc_client_io_error(vs, -1, -EIO);
+ return vnc_client_io_error(vs, -1, NULL);
VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
encoded, ret, decoded, decodedLen);
buffer_reserve(&vs->input, decodedLen);
static int vnc_auth_sasl_check_access(VncState *vs)
{
const void *val;
- int err;
- int allow;
-
- err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
- if (err != SASL_OK) {
- VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
- err, sasl_errstring(err, NULL, NULL));
+ int rv;
+ Error *err = NULL;
+ bool allow;
+
+ rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
+ if (rv != SASL_OK) {
+ trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username",
+ sasl_errstring(rv, NULL, NULL));
return -1;
}
if (val == NULL) {
- VNC_DEBUG("no client username was found, denying access\n");
+ trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", "");
return -1;
}
- VNC_DEBUG("SASL client username %s\n", (const char *)val);
vs->sasl.username = g_strdup((const char*)val);
+ trace_vnc_auth_sasl_username(vs, vs->sasl.username);
- if (vs->vd->sasl.acl == NULL) {
- VNC_DEBUG("no ACL activated, allowing access\n");
+ if (vs->vd->sasl.authzid == NULL) {
+ trace_vnc_auth_sasl_acl(vs, 1);
return 0;
}
- allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
+ allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid,
+ vs->sasl.username, &err);
+ if (err) {
+ trace_vnc_auth_fail(vs, vs->auth, "Error from authz",
+ error_get_pretty(err));
+ error_free(err);
+ return -1;
+ }
- VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
- allow ? "allowed" : "denied");
+ trace_vnc_auth_sasl_acl(vs, allow);
return allow ? 0 : -1;
}
return 0;
ssf = *(const int *)val;
- VNC_DEBUG("negotiated an SSF of %d\n", ssf);
+
+ trace_vnc_auth_sasl_ssf(vs, ssf);
+
if (ssf < 56)
return 0; /* 56 is good for Kerberos */
datalen--; /* Don't count NULL byte when passing to _start() */
}
- VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
- clientdata, datalen);
err = sasl_server_step(vs->sasl.conn,
clientdata,
datalen,
&serverout,
&serveroutlen);
+ trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err);
if (err != SASL_OK &&
err != SASL_CONTINUE) {
- VNC_DEBUG("sasl step failed %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
+ trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth",
+ sasl_errdetail(vs->sasl.conn));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
if (serveroutlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("sasl step reply data too long %d\n",
- serveroutlen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
- VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
- serveroutlen, serverout ? 0 : 1);
-
if (serveroutlen) {
vnc_write_u32(vs, serveroutlen + 1);
vnc_write(vs, serverout, serveroutlen + 1);
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
if (err == SASL_CONTINUE) {
- VNC_DEBUG("%s", "Authentication must continue\n");
/* Wait for step length */
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
} else {
if (!vnc_auth_sasl_check_ssf(vs)) {
- VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
goto authreject;
}
- /* Check username whitelist ACL */
+ /* Check the username access control list */
if (vnc_auth_sasl_check_access(vs) < 0) {
- VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
goto authreject;
}
- VNC_DEBUG("Authentication successful %d\n", vs->csock);
+ trace_vnc_auth_pass(vs, vs->auth);
vnc_write_u32(vs, 0); /* Accept auth */
/*
* Delay writing in SSF encoded mode until pending output
static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
{
uint32_t steplen = read_u32(data, 0);
- VNC_DEBUG("Got client step len %d\n", steplen);
+
if (steplen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("Too much SASL data %d\n", steplen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", "");
vnc_client_error(vs);
return -1;
}
datalen--; /* Don't count NULL byte when passing to _start() */
}
- VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
- vs->sasl.mechlist, clientdata, datalen);
err = sasl_server_start(vs->sasl.conn,
vs->sasl.mechlist,
clientdata,
datalen,
&serverout,
&serveroutlen);
+ trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err);
if (err != SASL_OK &&
err != SASL_CONTINUE) {
- VNC_DEBUG("sasl start failed %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
+ trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth",
+ sasl_errdetail(vs->sasl.conn));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
if (serveroutlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("sasl start reply data too long %d\n",
- serveroutlen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
- VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
- serveroutlen, serverout ? 0 : 1);
-
if (serveroutlen) {
vnc_write_u32(vs, serveroutlen + 1);
vnc_write(vs, serverout, serveroutlen + 1);
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
if (err == SASL_CONTINUE) {
- VNC_DEBUG("%s", "Authentication must continue\n");
/* Wait for step length */
vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
} else {
if (!vnc_auth_sasl_check_ssf(vs)) {
- VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
goto authreject;
}
- /* Check username whitelist ACL */
+ /* Check the username access control list */
if (vnc_auth_sasl_check_access(vs) < 0) {
- VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
goto authreject;
}
- VNC_DEBUG("Authentication successful %d\n", vs->csock);
+ trace_vnc_auth_pass(vs, vs->auth);
vnc_write_u32(vs, 0); /* Accept auth */
start_client_init(vs);
}
static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
{
uint32_t startlen = read_u32(data, 0);
- VNC_DEBUG("Got client start len %d\n", startlen);
+
if (startlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("Too much SASL data %d\n", startlen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", "");
vnc_client_error(vs);
return -1;
}
static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
{
char *mechname = g_strndup((const char *) data, len);
- VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
- mechname, vs->sasl.mechlist);
+ trace_vnc_auth_sasl_mech_choose(vs, mechname);
if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
if (vs->sasl.mechlist[len] != '\0' &&
vs->sasl.mechlist[len] != ',') {
- VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
goto fail;
}
} else {
char *offset = strstr(vs->sasl.mechlist, mechname);
- VNC_DEBUG("Two %p\n", offset);
if (!offset) {
goto fail;
}
- VNC_DEBUG("Two '%s'\n", offset);
if (offset[-1] != ',' ||
(offset[len] != '\0'&&
offset[len] != ',')) {
g_free(vs->sasl.mechlist);
vs->sasl.mechlist = mechname;
- VNC_DEBUG("Validated mechname '%s'\n", mechname);
vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
return 0;
fail:
+ trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname);
vnc_client_error(vs);
g_free(mechname);
return -1;
static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
{
uint32_t mechlen = read_u32(data, 0);
- VNC_DEBUG("Got client mechname len %d\n", mechlen);
+
if (mechlen > 100) {
- VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", "");
vnc_client_error(vs);
return -1;
}
if (mechlen < 1) {
- VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
+ trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", "");
vnc_client_error(vs);
return -1;
}
return 0;
}
+static char *
+vnc_socket_ip_addr_string(QIOChannelSocket *ioc,
+ bool local,
+ Error **errp)
+{
+ SocketAddress *addr;
+ char *ret;
+
+ if (local) {
+ addr = qio_channel_socket_get_local_address(ioc, errp);
+ } else {
+ addr = qio_channel_socket_get_remote_address(ioc, errp);
+ }
+ if (!addr) {
+ return NULL;
+ }
+
+ if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
+ error_setg(errp, "Not an inet socket type");
+ qapi_free_SocketAddress(addr);
+ return NULL;
+ }
+ ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port);
+ qapi_free_SocketAddress(addr);
+ return ret;
+}
+
void start_auth_sasl(VncState *vs)
{
const char *mechlist = NULL;
sasl_security_properties_t secprops;
int err;
+ Error *local_err = NULL;
char *localAddr, *remoteAddr;
int mechlistlen;
- VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);
-
/* Get local & remote client addresses in form IPADDR;PORT */
- if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
+ localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err);
+ if (!localAddr) {
+ trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP",
+ error_get_pretty(local_err));
goto authabort;
+ }
- if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
+ remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err);
+ if (!remoteAddr) {
+ trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP",
+ error_get_pretty(local_err));
g_free(localAddr);
goto authabort;
}
localAddr = remoteAddr = NULL;
if (err != SASL_OK) {
- VNC_DEBUG("sasl context setup failed %d (%s)",
- err, sasl_errstring(err, NULL, NULL));
+ trace_vnc_auth_fail(vs, vs->auth, "SASL context setup failed",
+ sasl_errstring(err, NULL, NULL));
vs->sasl.conn = NULL;
goto authabort;
}
-#ifdef CONFIG_VNC_TLS
/* Inform SASL that we've got an external SSF layer from TLS/x509 */
if (vs->auth == VNC_AUTH_VENCRYPT &&
vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
- gnutls_cipher_algorithm_t cipher;
+ int keysize;
sasl_ssf_t ssf;
- cipher = gnutls_cipher_get(vs->tls.session);
- if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
- VNC_DEBUG("%s", "cannot TLS get cipher size\n");
+ keysize = qcrypto_tls_session_get_key_size(vs->tls,
+ &local_err);
+ if (keysize < 0) {
+ trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size",
+ error_get_pretty(local_err));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
- ssf *= 8; /* tls key size is bytes, sasl wants bits */
+ ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */
err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
if (err != SASL_OK) {
- VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
- err, sasl_errstring(err, NULL, NULL));
+ trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF",
+ sasl_errstring(err, NULL, NULL));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
- } else
-#endif /* CONFIG_VNC_TLS */
+ } else {
vs->sasl.wantSSF = 1;
+ }
memset (&secprops, 0, sizeof secprops);
- /* Inform SASL that we've got an external SSF layer from TLS */
- if (vs->vd->is_unix
-#ifdef CONFIG_VNC_TLS
- /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
- is not sufficiently strong */
- || (vs->auth == VNC_AUTH_VENCRYPT &&
- vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)
-#endif /* CONFIG_VNC_TLS */
- ) {
+ /* Inform SASL that we've got an external SSF layer from TLS.
+ *
+ * Disable SSF, if using TLS+x509+SASL only. TLS without x509
+ * is not sufficiently strong
+ */
+ if (vs->vd->is_unix ||
+ (vs->auth == VNC_AUTH_VENCRYPT &&
+ vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) {
/* If we've got TLS or UNIX domain sock, we don't care about SSF */
secprops.min_ssf = 0;
secprops.max_ssf = 0;
err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
if (err != SASL_OK) {
- VNC_DEBUG("cannot set SASL security props %d (%s)\n",
- err, sasl_errstring(err, NULL, NULL));
+ trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props",
+ sasl_errstring(err, NULL, NULL));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
NULL,
NULL);
if (err != SASL_OK) {
- VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
+ trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms",
+ sasl_errdetail(vs->sasl.conn));
sasl_dispose(&vs->sasl.conn);
vs->sasl.conn = NULL;
goto authabort;
}
- VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
+ trace_vnc_auth_sasl_mech_list(vs, mechlist);
vs->sasl.mechlist = g_strdup(mechlist);
mechlistlen = strlen(mechlist);
vnc_write(vs, mechlist, mechlistlen);
vnc_flush(vs);
- VNC_DEBUG("Wait for client mechname length\n");
vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
return;
authabort:
+ error_free(local_err);
vnc_client_error(vs);
}
projects / mirror_qemu.git / blobdiff