aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 1 | /* |
| 2 | * QEMU VNC display driver: SASL auth protocol |
| 3 | * |
| 4 | * Copyright (C) 2009 Red Hat, Inc |
| 5 | * |
| 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy |
| 7 | * of this software and associated documentation files (the "Software"), to deal |
| 8 | * in the Software without restriction, including without limitation the rights |
| 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 10 | * copies of the Software, and to permit persons to whom the Software is |
| 11 | * furnished to do so, subject to the following conditions: |
| 12 | * |
| 13 | * The above copyright notice and this permission notice shall be included in |
| 14 | * all copies or substantial portions of the Software. |
| 15 | * |
| 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL |
| 19 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
| 22 | * THE SOFTWARE. |
| 23 | */ |
| 24 | |
| 25 | #include "vnc.h" |
| 26 | |
| 27 | /* Max amount of data we send/recv for SASL steps to prevent DOS */ |
| 28 | #define SASL_DATA_MAX_LEN (1024 * 1024) |
| 29 | |
| 30 | |
| 31 | void vnc_sasl_client_cleanup(VncState *vs) |
| 32 | { |
| 33 | if (vs->sasl.conn) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 34 | vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0; |
| 35 | vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; |
| 36 | vs->sasl.encoded = NULL; |
| 37 | free(vs->sasl.username); |
| 38 | free(vs->sasl.mechlist); |
| 39 | vs->sasl.username = vs->sasl.mechlist = NULL; |
| 40 | sasl_dispose(&vs->sasl.conn); |
| 41 | vs->sasl.conn = NULL; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 42 | } |
| 43 | } |
| 44 | |
| 45 | |
| 46 | long vnc_client_write_sasl(VncState *vs) |
| 47 | { |
| 48 | long ret; |
| 49 | |
Corentin Chary | bc47d20 | 2010-05-03 14:31:18 +0200 | [diff] [blame] | 50 | VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd " |
| 51 | "Encoded: %p size %d offset %d\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 52 | vs->output.buffer, vs->output.capacity, vs->output.offset, |
| 53 | vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 54 | |
| 55 | if (!vs->sasl.encoded) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 56 | int err; |
| 57 | err = sasl_encode(vs->sasl.conn, |
| 58 | (char *)vs->output.buffer, |
| 59 | vs->output.offset, |
| 60 | (const char **)&vs->sasl.encoded, |
| 61 | &vs->sasl.encodedLength); |
| 62 | if (err != SASL_OK) |
| 63 | return vnc_client_io_error(vs, -1, EIO); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 64 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 65 | vs->sasl.encodedOffset = 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 66 | } |
| 67 | |
| 68 | ret = vnc_client_write_buf(vs, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 69 | vs->sasl.encoded + vs->sasl.encodedOffset, |
| 70 | vs->sasl.encodedLength - vs->sasl.encodedOffset); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 71 | if (!ret) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 72 | return 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 73 | |
| 74 | vs->sasl.encodedOffset += ret; |
| 75 | if (vs->sasl.encodedOffset == vs->sasl.encodedLength) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 76 | vs->output.offset = 0; |
| 77 | vs->sasl.encoded = NULL; |
| 78 | vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 79 | } |
| 80 | |
| 81 | /* Can't merge this block with one above, because |
| 82 | * someone might have written more unencrypted |
| 83 | * data in vs->output while we were processing |
| 84 | * SASL encoded output |
| 85 | */ |
| 86 | if (vs->output.offset == 0) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 87 | qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 88 | } |
| 89 | |
| 90 | return ret; |
| 91 | } |
| 92 | |
| 93 | |
| 94 | long vnc_client_read_sasl(VncState *vs) |
| 95 | { |
| 96 | long ret; |
| 97 | uint8_t encoded[4096]; |
| 98 | const char *decoded; |
| 99 | unsigned int decodedLen; |
| 100 | int err; |
| 101 | |
| 102 | ret = vnc_client_read_buf(vs, encoded, sizeof(encoded)); |
| 103 | if (!ret) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 104 | return 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 105 | |
| 106 | err = sasl_decode(vs->sasl.conn, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 107 | (char *)encoded, ret, |
| 108 | &decoded, &decodedLen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 109 | |
| 110 | if (err != SASL_OK) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 111 | return vnc_client_io_error(vs, -1, -EIO); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 112 | VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 113 | encoded, ret, decoded, decodedLen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 114 | buffer_reserve(&vs->input, decodedLen); |
| 115 | buffer_append(&vs->input, decoded, decodedLen); |
| 116 | return decodedLen; |
| 117 | } |
| 118 | |
| 119 | |
| 120 | static int vnc_auth_sasl_check_access(VncState *vs) |
| 121 | { |
| 122 | const void *val; |
| 123 | int err; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 124 | int allow; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 125 | |
| 126 | err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val); |
| 127 | if (err != SASL_OK) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 128 | VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n", |
| 129 | err, sasl_errstring(err, NULL, NULL)); |
| 130 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 131 | } |
| 132 | if (val == NULL) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 133 | VNC_DEBUG("no client username was found, denying access\n"); |
| 134 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 135 | } |
| 136 | VNC_DEBUG("SASL client username %s\n", (const char *)val); |
| 137 | |
| 138 | vs->sasl.username = qemu_strdup((const char*)val); |
| 139 | |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 140 | if (vs->vd->sasl.acl == NULL) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 141 | VNC_DEBUG("no ACL activated, allowing access\n"); |
| 142 | return 0; |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 143 | } |
| 144 | |
| 145 | allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username); |
| 146 | |
| 147 | VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 148 | allow ? "allowed" : "denied"); |
aliguori | 76655d6 | 2009-03-06 20:27:37 +0000 | [diff] [blame] | 149 | return allow ? 0 : -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 150 | } |
| 151 | |
| 152 | static int vnc_auth_sasl_check_ssf(VncState *vs) |
| 153 | { |
| 154 | const void *val; |
| 155 | int err, ssf; |
| 156 | |
| 157 | if (!vs->sasl.wantSSF) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 158 | return 1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 159 | |
| 160 | err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val); |
| 161 | if (err != SASL_OK) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 162 | return 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 163 | |
| 164 | ssf = *(const int *)val; |
| 165 | VNC_DEBUG("negotiated an SSF of %d\n", ssf); |
| 166 | if (ssf < 56) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 167 | return 0; /* 56 is good for Kerberos */ |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 168 | |
| 169 | /* Only setup for read initially, because we're about to send an RPC |
| 170 | * reply which must be in plain text. When the next incoming RPC |
| 171 | * arrives, we'll switch on writes too |
| 172 | * |
| 173 | * cf qemudClientReadSASL in qemud.c |
| 174 | */ |
| 175 | vs->sasl.runSSF = 1; |
| 176 | |
| 177 | /* We have a SSF that's good enough */ |
| 178 | return 1; |
| 179 | } |
| 180 | |
| 181 | /* |
| 182 | * Step Msg |
| 183 | * |
| 184 | * Input from client: |
| 185 | * |
| 186 | * u32 clientin-length |
| 187 | * u8-array clientin-string |
| 188 | * |
| 189 | * Output to client: |
| 190 | * |
| 191 | * u32 serverout-length |
| 192 | * u8-array serverout-strin |
| 193 | * u8 continue |
| 194 | */ |
| 195 | |
| 196 | static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len); |
| 197 | |
| 198 | static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len) |
| 199 | { |
| 200 | uint32_t datalen = len; |
| 201 | const char *serverout; |
| 202 | unsigned int serveroutlen; |
| 203 | int err; |
| 204 | char *clientdata = NULL; |
| 205 | |
| 206 | /* NB, distinction of NULL vs "" is *critical* in SASL */ |
| 207 | if (datalen) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 208 | clientdata = (char*)data; |
| 209 | clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ |
| 210 | datalen--; /* Don't count NULL byte when passing to _start() */ |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 211 | } |
| 212 | |
| 213 | VNC_DEBUG("Step using SASL Data %p (%d bytes)\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 214 | clientdata, datalen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 215 | err = sasl_server_step(vs->sasl.conn, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 216 | clientdata, |
| 217 | datalen, |
| 218 | &serverout, |
| 219 | &serveroutlen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 220 | if (err != SASL_OK && |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 221 | err != SASL_CONTINUE) { |
| 222 | VNC_DEBUG("sasl step failed %d (%s)\n", |
| 223 | err, sasl_errdetail(vs->sasl.conn)); |
| 224 | sasl_dispose(&vs->sasl.conn); |
| 225 | vs->sasl.conn = NULL; |
| 226 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 227 | } |
| 228 | |
| 229 | if (serveroutlen > SASL_DATA_MAX_LEN) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 230 | VNC_DEBUG("sasl step reply data too long %d\n", |
| 231 | serveroutlen); |
| 232 | sasl_dispose(&vs->sasl.conn); |
| 233 | vs->sasl.conn = NULL; |
| 234 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 235 | } |
| 236 | |
| 237 | VNC_DEBUG("SASL return data %d bytes, nil; %d\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 238 | serveroutlen, serverout ? 0 : 1); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 239 | |
| 240 | if (serveroutlen) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 241 | vnc_write_u32(vs, serveroutlen + 1); |
| 242 | vnc_write(vs, serverout, serveroutlen + 1); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 243 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 244 | vnc_write_u32(vs, 0); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 245 | } |
| 246 | |
| 247 | /* Whether auth is complete */ |
| 248 | vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); |
| 249 | |
| 250 | if (err == SASL_CONTINUE) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 251 | VNC_DEBUG("%s", "Authentication must continue\n"); |
| 252 | /* Wait for step length */ |
| 253 | vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 254 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 255 | if (!vnc_auth_sasl_check_ssf(vs)) { |
| 256 | VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); |
| 257 | goto authreject; |
| 258 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 259 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 260 | /* Check username whitelist ACL */ |
| 261 | if (vnc_auth_sasl_check_access(vs) < 0) { |
| 262 | VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); |
| 263 | goto authreject; |
| 264 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 265 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 266 | VNC_DEBUG("Authentication successful %d\n", vs->csock); |
| 267 | vnc_write_u32(vs, 0); /* Accept auth */ |
| 268 | /* |
| 269 | * Delay writing in SSF encoded mode until pending output |
| 270 | * buffer is written |
| 271 | */ |
| 272 | if (vs->sasl.runSSF) |
| 273 | vs->sasl.waitWriteSSF = vs->output.offset; |
| 274 | start_client_init(vs); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 275 | } |
| 276 | |
| 277 | return 0; |
| 278 | |
| 279 | authreject: |
| 280 | vnc_write_u32(vs, 1); /* Reject auth */ |
| 281 | vnc_write_u32(vs, sizeof("Authentication failed")); |
| 282 | vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); |
| 283 | vnc_flush(vs); |
| 284 | vnc_client_error(vs); |
| 285 | return -1; |
| 286 | |
| 287 | authabort: |
| 288 | vnc_client_error(vs); |
| 289 | return -1; |
| 290 | } |
| 291 | |
| 292 | static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len) |
| 293 | { |
| 294 | uint32_t steplen = read_u32(data, 0); |
| 295 | VNC_DEBUG("Got client step len %d\n", steplen); |
| 296 | if (steplen > SASL_DATA_MAX_LEN) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 297 | VNC_DEBUG("Too much SASL data %d\n", steplen); |
| 298 | vnc_client_error(vs); |
| 299 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 300 | } |
| 301 | |
| 302 | if (steplen == 0) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 303 | return protocol_client_auth_sasl_step(vs, NULL, 0); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 304 | else |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 305 | vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 306 | return 0; |
| 307 | } |
| 308 | |
| 309 | /* |
| 310 | * Start Msg |
| 311 | * |
| 312 | * Input from client: |
| 313 | * |
| 314 | * u32 clientin-length |
| 315 | * u8-array clientin-string |
| 316 | * |
| 317 | * Output to client: |
| 318 | * |
| 319 | * u32 serverout-length |
| 320 | * u8-array serverout-strin |
| 321 | * u8 continue |
| 322 | */ |
| 323 | |
| 324 | #define SASL_DATA_MAX_LEN (1024 * 1024) |
| 325 | |
| 326 | static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len) |
| 327 | { |
| 328 | uint32_t datalen = len; |
| 329 | const char *serverout; |
| 330 | unsigned int serveroutlen; |
| 331 | int err; |
| 332 | char *clientdata = NULL; |
| 333 | |
| 334 | /* NB, distinction of NULL vs "" is *critical* in SASL */ |
| 335 | if (datalen) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 336 | clientdata = (char*)data; |
| 337 | clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ |
| 338 | datalen--; /* Don't count NULL byte when passing to _start() */ |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 339 | } |
| 340 | |
| 341 | VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 342 | vs->sasl.mechlist, clientdata, datalen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 343 | err = sasl_server_start(vs->sasl.conn, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 344 | vs->sasl.mechlist, |
| 345 | clientdata, |
| 346 | datalen, |
| 347 | &serverout, |
| 348 | &serveroutlen); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 349 | if (err != SASL_OK && |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 350 | err != SASL_CONTINUE) { |
| 351 | VNC_DEBUG("sasl start failed %d (%s)\n", |
| 352 | err, sasl_errdetail(vs->sasl.conn)); |
| 353 | sasl_dispose(&vs->sasl.conn); |
| 354 | vs->sasl.conn = NULL; |
| 355 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 356 | } |
| 357 | if (serveroutlen > SASL_DATA_MAX_LEN) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 358 | VNC_DEBUG("sasl start reply data too long %d\n", |
| 359 | serveroutlen); |
| 360 | sasl_dispose(&vs->sasl.conn); |
| 361 | vs->sasl.conn = NULL; |
| 362 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 363 | } |
| 364 | |
| 365 | VNC_DEBUG("SASL return data %d bytes, nil; %d\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 366 | serveroutlen, serverout ? 0 : 1); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 367 | |
| 368 | if (serveroutlen) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 369 | vnc_write_u32(vs, serveroutlen + 1); |
| 370 | vnc_write(vs, serverout, serveroutlen + 1); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 371 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 372 | vnc_write_u32(vs, 0); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 373 | } |
| 374 | |
| 375 | /* Whether auth is complete */ |
| 376 | vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); |
| 377 | |
| 378 | if (err == SASL_CONTINUE) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 379 | VNC_DEBUG("%s", "Authentication must continue\n"); |
| 380 | /* Wait for step length */ |
| 381 | vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 382 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 383 | if (!vnc_auth_sasl_check_ssf(vs)) { |
| 384 | VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); |
| 385 | goto authreject; |
| 386 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 387 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 388 | /* Check username whitelist ACL */ |
| 389 | if (vnc_auth_sasl_check_access(vs) < 0) { |
| 390 | VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); |
| 391 | goto authreject; |
| 392 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 393 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 394 | VNC_DEBUG("Authentication successful %d\n", vs->csock); |
| 395 | vnc_write_u32(vs, 0); /* Accept auth */ |
| 396 | start_client_init(vs); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 397 | } |
| 398 | |
| 399 | return 0; |
| 400 | |
| 401 | authreject: |
| 402 | vnc_write_u32(vs, 1); /* Reject auth */ |
| 403 | vnc_write_u32(vs, sizeof("Authentication failed")); |
| 404 | vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); |
| 405 | vnc_flush(vs); |
| 406 | vnc_client_error(vs); |
| 407 | return -1; |
| 408 | |
| 409 | authabort: |
| 410 | vnc_client_error(vs); |
| 411 | return -1; |
| 412 | } |
| 413 | |
| 414 | static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len) |
| 415 | { |
| 416 | uint32_t startlen = read_u32(data, 0); |
| 417 | VNC_DEBUG("Got client start len %d\n", startlen); |
| 418 | if (startlen > SASL_DATA_MAX_LEN) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 419 | VNC_DEBUG("Too much SASL data %d\n", startlen); |
| 420 | vnc_client_error(vs); |
| 421 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 422 | } |
| 423 | |
| 424 | if (startlen == 0) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 425 | return protocol_client_auth_sasl_start(vs, NULL, 0); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 426 | |
| 427 | vnc_read_when(vs, protocol_client_auth_sasl_start, startlen); |
| 428 | return 0; |
| 429 | } |
| 430 | |
| 431 | static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len) |
| 432 | { |
| 433 | char *mechname = malloc(len + 1); |
| 434 | if (!mechname) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 435 | VNC_DEBUG("Out of memory reading mechname\n"); |
| 436 | vnc_client_error(vs); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 437 | } |
| 438 | strncpy(mechname, (char*)data, len); |
| 439 | mechname[len] = '\0'; |
| 440 | VNC_DEBUG("Got client mechname '%s' check against '%s'\n", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 441 | mechname, vs->sasl.mechlist); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 442 | |
| 443 | if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 444 | if (vs->sasl.mechlist[len] != '\0' && |
| 445 | vs->sasl.mechlist[len] != ',') { |
| 446 | VNC_DEBUG("One %d", vs->sasl.mechlist[len]); |
Blue Swirl | 8ce7d35 | 2011-01-12 19:48:56 +0000 | [diff] [blame] | 447 | goto fail; |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 448 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 449 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 450 | char *offset = strstr(vs->sasl.mechlist, mechname); |
| 451 | VNC_DEBUG("Two %p\n", offset); |
| 452 | if (!offset) { |
Blue Swirl | 8ce7d35 | 2011-01-12 19:48:56 +0000 | [diff] [blame] | 453 | goto fail; |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 454 | } |
| 455 | VNC_DEBUG("Two '%s'\n", offset); |
| 456 | if (offset[-1] != ',' || |
| 457 | (offset[len] != '\0'&& |
| 458 | offset[len] != ',')) { |
Blue Swirl | 8ce7d35 | 2011-01-12 19:48:56 +0000 | [diff] [blame] | 459 | goto fail; |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 460 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 461 | } |
| 462 | |
| 463 | free(vs->sasl.mechlist); |
| 464 | vs->sasl.mechlist = mechname; |
| 465 | |
| 466 | VNC_DEBUG("Validated mechname '%s'\n", mechname); |
| 467 | vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4); |
| 468 | return 0; |
Blue Swirl | 8ce7d35 | 2011-01-12 19:48:56 +0000 | [diff] [blame] | 469 | |
| 470 | fail: |
| 471 | vnc_client_error(vs); |
| 472 | free(mechname); |
| 473 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 474 | } |
| 475 | |
| 476 | static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len) |
| 477 | { |
| 478 | uint32_t mechlen = read_u32(data, 0); |
| 479 | VNC_DEBUG("Got client mechname len %d\n", mechlen); |
| 480 | if (mechlen > 100) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 481 | VNC_DEBUG("Too long SASL mechname data %d\n", mechlen); |
| 482 | vnc_client_error(vs); |
| 483 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 484 | } |
| 485 | if (mechlen < 1) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 486 | VNC_DEBUG("Too short SASL mechname %d\n", mechlen); |
| 487 | vnc_client_error(vs); |
| 488 | return -1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 489 | } |
| 490 | vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen); |
| 491 | return 0; |
| 492 | } |
| 493 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 494 | #define USES_X509_AUTH(vs) \ |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 495 | ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \ |
| 496 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \ |
| 497 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \ |
| 498 | (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL) |
| 499 | |
| 500 | |
| 501 | void start_auth_sasl(VncState *vs) |
| 502 | { |
| 503 | const char *mechlist = NULL; |
| 504 | sasl_security_properties_t secprops; |
| 505 | int err; |
| 506 | char *localAddr, *remoteAddr; |
| 507 | int mechlistlen; |
| 508 | |
| 509 | VNC_DEBUG("Initialize SASL auth %d\n", vs->csock); |
| 510 | |
| 511 | /* Get local & remote client addresses in form IPADDR;PORT */ |
| 512 | if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock))) |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 513 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 514 | |
| 515 | if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 516 | free(localAddr); |
| 517 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 518 | } |
| 519 | |
| 520 | err = sasl_server_new("vnc", |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 521 | NULL, /* FQDN - just delegates to gethostname */ |
| 522 | NULL, /* User realm */ |
| 523 | localAddr, |
| 524 | remoteAddr, |
| 525 | NULL, /* Callbacks, not needed */ |
| 526 | SASL_SUCCESS_DATA, |
| 527 | &vs->sasl.conn); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 528 | free(localAddr); |
| 529 | free(remoteAddr); |
| 530 | localAddr = remoteAddr = NULL; |
| 531 | |
| 532 | if (err != SASL_OK) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 533 | VNC_DEBUG("sasl context setup failed %d (%s)", |
| 534 | err, sasl_errstring(err, NULL, NULL)); |
| 535 | vs->sasl.conn = NULL; |
| 536 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 537 | } |
| 538 | |
| 539 | #ifdef CONFIG_VNC_TLS |
| 540 | /* Inform SASL that we've got an external SSF layer from TLS/x509 */ |
| 541 | if (vs->vd->auth == VNC_AUTH_VENCRYPT && |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 542 | vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) { |
| 543 | gnutls_cipher_algorithm_t cipher; |
| 544 | sasl_ssf_t ssf; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 545 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 546 | cipher = gnutls_cipher_get(vs->tls.session); |
| 547 | if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { |
| 548 | VNC_DEBUG("%s", "cannot TLS get cipher size\n"); |
| 549 | sasl_dispose(&vs->sasl.conn); |
| 550 | vs->sasl.conn = NULL; |
| 551 | goto authabort; |
| 552 | } |
| 553 | ssf *= 8; /* tls key size is bytes, sasl wants bits */ |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 554 | |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 555 | err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); |
| 556 | if (err != SASL_OK) { |
| 557 | VNC_DEBUG("cannot set SASL external SSF %d (%s)\n", |
| 558 | err, sasl_errstring(err, NULL, NULL)); |
| 559 | sasl_dispose(&vs->sasl.conn); |
| 560 | vs->sasl.conn = NULL; |
| 561 | goto authabort; |
| 562 | } |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 563 | } else |
| 564 | #endif /* CONFIG_VNC_TLS */ |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 565 | vs->sasl.wantSSF = 1; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 566 | |
| 567 | memset (&secprops, 0, sizeof secprops); |
| 568 | /* Inform SASL that we've got an external SSF layer from TLS */ |
| 569 | if (strncmp(vs->vd->display, "unix:", 5) == 0 |
| 570 | #ifdef CONFIG_VNC_TLS |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 571 | /* Disable SSF, if using TLS+x509+SASL only. TLS without x509 |
| 572 | is not sufficiently strong */ |
| 573 | || (vs->vd->auth == VNC_AUTH_VENCRYPT && |
| 574 | vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 575 | #endif /* CONFIG_VNC_TLS */ |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 576 | ) { |
| 577 | /* If we've got TLS or UNIX domain sock, we don't care about SSF */ |
| 578 | secprops.min_ssf = 0; |
| 579 | secprops.max_ssf = 0; |
| 580 | secprops.maxbufsize = 8192; |
| 581 | secprops.security_flags = 0; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 582 | } else { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 583 | /* Plain TCP, better get an SSF layer */ |
| 584 | secprops.min_ssf = 56; /* Good enough to require kerberos */ |
| 585 | secprops.max_ssf = 100000; /* Arbitrary big number */ |
| 586 | secprops.maxbufsize = 8192; |
| 587 | /* Forbid any anonymous or trivially crackable auth */ |
| 588 | secprops.security_flags = |
| 589 | SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 590 | } |
| 591 | |
| 592 | err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops); |
| 593 | if (err != SASL_OK) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 594 | VNC_DEBUG("cannot set SASL security props %d (%s)\n", |
| 595 | err, sasl_errstring(err, NULL, NULL)); |
| 596 | sasl_dispose(&vs->sasl.conn); |
| 597 | vs->sasl.conn = NULL; |
| 598 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 599 | } |
| 600 | |
| 601 | err = sasl_listmech(vs->sasl.conn, |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 602 | NULL, /* Don't need to set user */ |
| 603 | "", /* Prefix */ |
| 604 | ",", /* Separator */ |
| 605 | "", /* Suffix */ |
| 606 | &mechlist, |
| 607 | NULL, |
| 608 | NULL); |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 609 | if (err != SASL_OK) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 610 | VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n", |
| 611 | err, sasl_errdetail(vs->sasl.conn)); |
| 612 | sasl_dispose(&vs->sasl.conn); |
| 613 | vs->sasl.conn = NULL; |
| 614 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 615 | } |
| 616 | VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist); |
| 617 | |
| 618 | if (!(vs->sasl.mechlist = strdup(mechlist))) { |
aliguori | 28a76be | 2009-03-06 20:27:40 +0000 | [diff] [blame] | 619 | VNC_DEBUG("Out of memory"); |
| 620 | sasl_dispose(&vs->sasl.conn); |
| 621 | vs->sasl.conn = NULL; |
| 622 | goto authabort; |
aliguori | 2f9606b | 2009-03-06 20:27:28 +0000 | [diff] [blame] | 623 | } |
| 624 | mechlistlen = strlen(mechlist); |
| 625 | vnc_write_u32(vs, mechlistlen); |
| 626 | vnc_write(vs, mechlist, mechlistlen); |
| 627 | vnc_flush(vs); |
| 628 | |
| 629 | VNC_DEBUG("Wait for client mechname length\n"); |
| 630 | vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4); |
| 631 | |
| 632 | return; |
| 633 | |
| 634 | authabort: |
| 635 | vnc_client_error(vs); |
| 636 | return; |
| 637 | } |
| 638 | |
| 639 | |