2 * QEMU VNC display driver: VeNCrypt authentication setup
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
30 static void start_auth_vencrypt_subauth(VncState
*vs
)
32 switch (vs
->vd
->subauth
) {
33 case VNC_AUTH_VENCRYPT_TLSNONE
:
34 case VNC_AUTH_VENCRYPT_X509NONE
:
35 VNC_DEBUG("Accept TLS auth none\n");
36 vnc_write_u32(vs
, 0); /* Accept auth completion */
37 start_client_init(vs
);
40 case VNC_AUTH_VENCRYPT_TLSVNC
:
41 case VNC_AUTH_VENCRYPT_X509VNC
:
42 VNC_DEBUG("Start TLS auth VNC\n");
46 default: /* Should not be possible, but just in case */
47 VNC_DEBUG("Reject auth %d\n", vs
->vd
->auth
);
50 static const char err
[] = "Unsupported authentication type";
51 vnc_write_u32(vs
, sizeof(err
));
52 vnc_write(vs
, err
, sizeof(err
));
58 static void vnc_tls_handshake_io(void *opaque
);
60 static int vnc_start_vencrypt_handshake(struct VncState
*vs
) {
63 if ((ret
= gnutls_handshake(vs
->tls
.session
)) < 0) {
64 if (!gnutls_error_is_fatal(ret
)) {
65 VNC_DEBUG("Handshake interrupted (blocking)\n");
66 if (!gnutls_record_get_direction(vs
->tls
.session
))
67 qemu_set_fd_handler(vs
->csock
, vnc_tls_handshake_io
, NULL
, vs
);
69 qemu_set_fd_handler(vs
->csock
, NULL
, vnc_tls_handshake_io
, vs
);
72 VNC_DEBUG("Handshake failed %s\n", gnutls_strerror(ret
));
77 if (vs
->vd
->tls
.x509verify
) {
78 if (vnc_tls_validate_certificate(vs
) < 0) {
79 VNC_DEBUG("Client verification failed\n");
83 VNC_DEBUG("Client verification passed\n");
87 VNC_DEBUG("Handshake done, switching to TLS data mode\n");
88 vs
->tls
.wiremode
= VNC_WIREMODE_TLS
;
89 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, vnc_client_write
, vs
);
91 start_auth_vencrypt_subauth(vs
);
96 static void vnc_tls_handshake_io(void *opaque
) {
97 struct VncState
*vs
= (struct VncState
*)opaque
;
99 VNC_DEBUG("Handshake IO continue\n");
100 vnc_start_vencrypt_handshake(vs
);
105 #define NEED_X509_AUTH(vs) \
106 ((vs)->vd->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
107 (vs)->vd->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
108 (vs)->vd->subauth == VNC_AUTH_VENCRYPT_X509PLAIN)
111 static int protocol_client_vencrypt_auth(VncState
*vs
, uint8_t *data
, size_t len
)
113 int auth
= read_u32(data
, 0);
115 if (auth
!= vs
->vd
->subauth
) {
116 VNC_DEBUG("Rejecting auth %d\n", auth
);
117 vnc_write_u8(vs
, 0); /* Reject auth */
119 vnc_client_error(vs
);
121 VNC_DEBUG("Accepting auth %d, setting up TLS for handshake\n", auth
);
122 vnc_write_u8(vs
, 1); /* Accept auth */
125 if (vnc_tls_client_setup(vs
, NEED_X509_AUTH(vs
)) < 0) {
126 VNC_DEBUG("Failed to setup TLS\n");
130 VNC_DEBUG("Start TLS VeNCrypt handshake process\n");
131 if (vnc_start_vencrypt_handshake(vs
) < 0) {
132 VNC_DEBUG("Failed to start TLS handshake\n");
139 static int protocol_client_vencrypt_init(VncState
*vs
, uint8_t *data
, size_t len
)
143 VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data
[0], (int)data
[1]);
144 vnc_write_u8(vs
, 1); /* Reject version */
146 vnc_client_error(vs
);
148 VNC_DEBUG("Sending allowed auth %d\n", vs
->vd
->subauth
);
149 vnc_write_u8(vs
, 0); /* Accept version */
150 vnc_write_u8(vs
, 1); /* Number of sub-auths */
151 vnc_write_u32(vs
, vs
->vd
->subauth
); /* The supported auth */
153 vnc_read_when(vs
, protocol_client_vencrypt_auth
, 4);
159 void start_auth_vencrypt(VncState
*vs
)
161 /* Send VeNCrypt version 0.2 */
165 vnc_read_when(vs
, protocol_client_vencrypt_init
, 2);