Disable preadv/pwritev support
[qemu-kvm/fedora.git] / vnc-auth-sasl.c
blobacaac0cc4cb62a5618c599c5c6a8505f9c0a4f08
1 /*
2 * QEMU VNC display driver: SASL auth protocol
4 * Copyright (C) 2009 Red Hat, Inc
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #include "vnc.h"
27 /* Max amount of data we send/recv for SASL steps to prevent DOS */
28 #define SASL_DATA_MAX_LEN (1024 * 1024)
31 void vnc_sasl_client_cleanup(VncState *vs)
33 if (vs->sasl.conn) {
34 vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
35 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
36 vs->sasl.encoded = NULL;
37 free(vs->sasl.username);
38 free(vs->sasl.mechlist);
39 vs->sasl.username = vs->sasl.mechlist = NULL;
40 sasl_dispose(&vs->sasl.conn);
41 vs->sasl.conn = NULL;
46 long vnc_client_write_sasl(VncState *vs)
48 long ret;
50 VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
51 vs->output.buffer, vs->output.capacity, vs->output.offset,
52 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
54 if (!vs->sasl.encoded) {
55 int err;
56 err = sasl_encode(vs->sasl.conn,
57 (char *)vs->output.buffer,
58 vs->output.offset,
59 (const char **)&vs->sasl.encoded,
60 &vs->sasl.encodedLength);
61 if (err != SASL_OK)
62 return vnc_client_io_error(vs, -1, EIO);
64 vs->sasl.encodedOffset = 0;
67 ret = vnc_client_write_buf(vs,
68 vs->sasl.encoded + vs->sasl.encodedOffset,
69 vs->sasl.encodedLength - vs->sasl.encodedOffset);
70 if (!ret)
71 return 0;
73 vs->sasl.encodedOffset += ret;
74 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
75 vs->output.offset = 0;
76 vs->sasl.encoded = NULL;
77 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
80 /* Can't merge this block with one above, because
81 * someone might have written more unencrypted
82 * data in vs->output while we were processing
83 * SASL encoded output
85 if (vs->output.offset == 0) {
86 qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
89 return ret;
93 long vnc_client_read_sasl(VncState *vs)
95 long ret;
96 uint8_t encoded[4096];
97 const char *decoded;
98 unsigned int decodedLen;
99 int err;
101 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
102 if (!ret)
103 return 0;
105 err = sasl_decode(vs->sasl.conn,
106 (char *)encoded, ret,
107 &decoded, &decodedLen);
109 if (err != SASL_OK)
110 return vnc_client_io_error(vs, -1, -EIO);
111 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
112 encoded, ret, decoded, decodedLen);
113 buffer_reserve(&vs->input, decodedLen);
114 buffer_append(&vs->input, decoded, decodedLen);
115 return decodedLen;
119 static int vnc_auth_sasl_check_access(VncState *vs)
121 const void *val;
122 int err;
123 int allow;
125 err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
126 if (err != SASL_OK) {
127 VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
128 err, sasl_errstring(err, NULL, NULL));
129 return -1;
131 if (val == NULL) {
132 VNC_DEBUG("no client username was found, denying access\n");
133 return -1;
135 VNC_DEBUG("SASL client username %s\n", (const char *)val);
137 vs->sasl.username = qemu_strdup((const char*)val);
139 if (vs->vd->sasl.acl == NULL) {
140 VNC_DEBUG("no ACL activated, allowing access\n");
141 return 0;
144 allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
146 VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
147 allow ? "allowed" : "denied");
148 return allow ? 0 : -1;
151 static int vnc_auth_sasl_check_ssf(VncState *vs)
153 const void *val;
154 int err, ssf;
156 if (!vs->sasl.wantSSF)
157 return 1;
159 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
160 if (err != SASL_OK)
161 return 0;
163 ssf = *(const int *)val;
164 VNC_DEBUG("negotiated an SSF of %d\n", ssf);
165 if (ssf < 56)
166 return 0; /* 56 is good for Kerberos */
168 /* Only setup for read initially, because we're about to send an RPC
169 * reply which must be in plain text. When the next incoming RPC
170 * arrives, we'll switch on writes too
172 * cf qemudClientReadSASL in qemud.c
174 vs->sasl.runSSF = 1;
176 /* We have a SSF that's good enough */
177 return 1;
181 * Step Msg
183 * Input from client:
185 * u32 clientin-length
186 * u8-array clientin-string
188 * Output to client:
190 * u32 serverout-length
191 * u8-array serverout-strin
192 * u8 continue
195 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
197 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
199 uint32_t datalen = len;
200 const char *serverout;
201 unsigned int serveroutlen;
202 int err;
203 char *clientdata = NULL;
205 /* NB, distinction of NULL vs "" is *critical* in SASL */
206 if (datalen) {
207 clientdata = (char*)data;
208 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
209 datalen--; /* Don't count NULL byte when passing to _start() */
212 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
213 clientdata, datalen);
214 err = sasl_server_step(vs->sasl.conn,
215 clientdata,
216 datalen,
217 &serverout,
218 &serveroutlen);
219 if (err != SASL_OK &&
220 err != SASL_CONTINUE) {
221 VNC_DEBUG("sasl step failed %d (%s)\n",
222 err, sasl_errdetail(vs->sasl.conn));
223 sasl_dispose(&vs->sasl.conn);
224 vs->sasl.conn = NULL;
225 goto authabort;
228 if (serveroutlen > SASL_DATA_MAX_LEN) {
229 VNC_DEBUG("sasl step reply data too long %d\n",
230 serveroutlen);
231 sasl_dispose(&vs->sasl.conn);
232 vs->sasl.conn = NULL;
233 goto authabort;
236 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
237 serveroutlen, serverout ? 0 : 1);
239 if (serveroutlen) {
240 vnc_write_u32(vs, serveroutlen + 1);
241 vnc_write(vs, serverout, serveroutlen + 1);
242 } else {
243 vnc_write_u32(vs, 0);
246 /* Whether auth is complete */
247 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
249 if (err == SASL_CONTINUE) {
250 VNC_DEBUG("%s", "Authentication must continue\n");
251 /* Wait for step length */
252 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
253 } else {
254 if (!vnc_auth_sasl_check_ssf(vs)) {
255 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
256 goto authreject;
259 /* Check username whitelist ACL */
260 if (vnc_auth_sasl_check_access(vs) < 0) {
261 VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
262 goto authreject;
265 VNC_DEBUG("Authentication successful %d\n", vs->csock);
266 vnc_write_u32(vs, 0); /* Accept auth */
268 * Delay writing in SSF encoded mode until pending output
269 * buffer is written
271 if (vs->sasl.runSSF)
272 vs->sasl.waitWriteSSF = vs->output.offset;
273 start_client_init(vs);
276 return 0;
278 authreject:
279 vnc_write_u32(vs, 1); /* Reject auth */
280 vnc_write_u32(vs, sizeof("Authentication failed"));
281 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
282 vnc_flush(vs);
283 vnc_client_error(vs);
284 return -1;
286 authabort:
287 vnc_client_error(vs);
288 return -1;
291 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
293 uint32_t steplen = read_u32(data, 0);
294 VNC_DEBUG("Got client step len %d\n", steplen);
295 if (steplen > SASL_DATA_MAX_LEN) {
296 VNC_DEBUG("Too much SASL data %d\n", steplen);
297 vnc_client_error(vs);
298 return -1;
301 if (steplen == 0)
302 return protocol_client_auth_sasl_step(vs, NULL, 0);
303 else
304 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
305 return 0;
309 * Start Msg
311 * Input from client:
313 * u32 clientin-length
314 * u8-array clientin-string
316 * Output to client:
318 * u32 serverout-length
319 * u8-array serverout-strin
320 * u8 continue
323 #define SASL_DATA_MAX_LEN (1024 * 1024)
325 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
327 uint32_t datalen = len;
328 const char *serverout;
329 unsigned int serveroutlen;
330 int err;
331 char *clientdata = NULL;
333 /* NB, distinction of NULL vs "" is *critical* in SASL */
334 if (datalen) {
335 clientdata = (char*)data;
336 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
337 datalen--; /* Don't count NULL byte when passing to _start() */
340 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
341 vs->sasl.mechlist, clientdata, datalen);
342 err = sasl_server_start(vs->sasl.conn,
343 vs->sasl.mechlist,
344 clientdata,
345 datalen,
346 &serverout,
347 &serveroutlen);
348 if (err != SASL_OK &&
349 err != SASL_CONTINUE) {
350 VNC_DEBUG("sasl start failed %d (%s)\n",
351 err, sasl_errdetail(vs->sasl.conn));
352 sasl_dispose(&vs->sasl.conn);
353 vs->sasl.conn = NULL;
354 goto authabort;
356 if (serveroutlen > SASL_DATA_MAX_LEN) {
357 VNC_DEBUG("sasl start reply data too long %d\n",
358 serveroutlen);
359 sasl_dispose(&vs->sasl.conn);
360 vs->sasl.conn = NULL;
361 goto authabort;
364 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
365 serveroutlen, serverout ? 0 : 1);
367 if (serveroutlen) {
368 vnc_write_u32(vs, serveroutlen + 1);
369 vnc_write(vs, serverout, serveroutlen + 1);
370 } else {
371 vnc_write_u32(vs, 0);
374 /* Whether auth is complete */
375 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
377 if (err == SASL_CONTINUE) {
378 VNC_DEBUG("%s", "Authentication must continue\n");
379 /* Wait for step length */
380 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
381 } else {
382 if (!vnc_auth_sasl_check_ssf(vs)) {
383 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
384 goto authreject;
387 /* Check username whitelist ACL */
388 if (vnc_auth_sasl_check_access(vs) < 0) {
389 VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
390 goto authreject;
393 VNC_DEBUG("Authentication successful %d\n", vs->csock);
394 vnc_write_u32(vs, 0); /* Accept auth */
395 start_client_init(vs);
398 return 0;
400 authreject:
401 vnc_write_u32(vs, 1); /* Reject auth */
402 vnc_write_u32(vs, sizeof("Authentication failed"));
403 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
404 vnc_flush(vs);
405 vnc_client_error(vs);
406 return -1;
408 authabort:
409 vnc_client_error(vs);
410 return -1;
413 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
415 uint32_t startlen = read_u32(data, 0);
416 VNC_DEBUG("Got client start len %d\n", startlen);
417 if (startlen > SASL_DATA_MAX_LEN) {
418 VNC_DEBUG("Too much SASL data %d\n", startlen);
419 vnc_client_error(vs);
420 return -1;
423 if (startlen == 0)
424 return protocol_client_auth_sasl_start(vs, NULL, 0);
426 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
427 return 0;
430 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
432 char *mechname = malloc(len + 1);
433 if (!mechname) {
434 VNC_DEBUG("Out of memory reading mechname\n");
435 vnc_client_error(vs);
437 strncpy(mechname, (char*)data, len);
438 mechname[len] = '\0';
439 VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
440 mechname, vs->sasl.mechlist);
442 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
443 if (vs->sasl.mechlist[len] != '\0' &&
444 vs->sasl.mechlist[len] != ',') {
445 VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
446 vnc_client_error(vs);
447 return -1;
449 } else {
450 char *offset = strstr(vs->sasl.mechlist, mechname);
451 VNC_DEBUG("Two %p\n", offset);
452 if (!offset) {
453 vnc_client_error(vs);
454 return -1;
456 VNC_DEBUG("Two '%s'\n", offset);
457 if (offset[-1] != ',' ||
458 (offset[len] != '\0'&&
459 offset[len] != ',')) {
460 vnc_client_error(vs);
461 return -1;
465 free(vs->sasl.mechlist);
466 vs->sasl.mechlist = mechname;
468 VNC_DEBUG("Validated mechname '%s'\n", mechname);
469 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
470 return 0;
473 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
475 uint32_t mechlen = read_u32(data, 0);
476 VNC_DEBUG("Got client mechname len %d\n", mechlen);
477 if (mechlen > 100) {
478 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
479 vnc_client_error(vs);
480 return -1;
482 if (mechlen < 1) {
483 VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
484 vnc_client_error(vs);
485 return -1;
487 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
488 return 0;
491 #define USES_X509_AUTH(vs) \
492 ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
493 (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
494 (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \
495 (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
498 void start_auth_sasl(VncState *vs)
500 const char *mechlist = NULL;
501 sasl_security_properties_t secprops;
502 int err;
503 char *localAddr, *remoteAddr;
504 int mechlistlen;
506 VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);
508 /* Get local & remote client addresses in form IPADDR;PORT */
509 if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
510 goto authabort;
512 if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
513 free(localAddr);
514 goto authabort;
517 err = sasl_server_new("vnc",
518 NULL, /* FQDN - just delegates to gethostname */
519 NULL, /* User realm */
520 localAddr,
521 remoteAddr,
522 NULL, /* Callbacks, not needed */
523 SASL_SUCCESS_DATA,
524 &vs->sasl.conn);
525 free(localAddr);
526 free(remoteAddr);
527 localAddr = remoteAddr = NULL;
529 if (err != SASL_OK) {
530 VNC_DEBUG("sasl context setup failed %d (%s)",
531 err, sasl_errstring(err, NULL, NULL));
532 vs->sasl.conn = NULL;
533 goto authabort;
536 #ifdef CONFIG_VNC_TLS
537 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
538 if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
539 vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
540 gnutls_cipher_algorithm_t cipher;
541 sasl_ssf_t ssf;
543 cipher = gnutls_cipher_get(vs->tls.session);
544 if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
545 VNC_DEBUG("%s", "cannot TLS get cipher size\n");
546 sasl_dispose(&vs->sasl.conn);
547 vs->sasl.conn = NULL;
548 goto authabort;
550 ssf *= 8; /* tls key size is bytes, sasl wants bits */
552 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
553 if (err != SASL_OK) {
554 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
555 err, sasl_errstring(err, NULL, NULL));
556 sasl_dispose(&vs->sasl.conn);
557 vs->sasl.conn = NULL;
558 goto authabort;
560 } else
561 #endif /* CONFIG_VNC_TLS */
562 vs->sasl.wantSSF = 1;
564 memset (&secprops, 0, sizeof secprops);
565 /* Inform SASL that we've got an external SSF layer from TLS */
566 if (strncmp(vs->vd->display, "unix:", 5) == 0
567 #ifdef CONFIG_VNC_TLS
568 /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
569 is not sufficiently strong */
570 || (vs->vd->auth == VNC_AUTH_VENCRYPT &&
571 vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
572 #endif /* CONFIG_VNC_TLS */
574 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
575 secprops.min_ssf = 0;
576 secprops.max_ssf = 0;
577 secprops.maxbufsize = 8192;
578 secprops.security_flags = 0;
579 } else {
580 /* Plain TCP, better get an SSF layer */
581 secprops.min_ssf = 56; /* Good enough to require kerberos */
582 secprops.max_ssf = 100000; /* Arbitrary big number */
583 secprops.maxbufsize = 8192;
584 /* Forbid any anonymous or trivially crackable auth */
585 secprops.security_flags =
586 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
589 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
590 if (err != SASL_OK) {
591 VNC_DEBUG("cannot set SASL security props %d (%s)\n",
592 err, sasl_errstring(err, NULL, NULL));
593 sasl_dispose(&vs->sasl.conn);
594 vs->sasl.conn = NULL;
595 goto authabort;
598 err = sasl_listmech(vs->sasl.conn,
599 NULL, /* Don't need to set user */
600 "", /* Prefix */
601 ",", /* Separator */
602 "", /* Suffix */
603 &mechlist,
604 NULL,
605 NULL);
606 if (err != SASL_OK) {
607 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
608 err, sasl_errdetail(vs->sasl.conn));
609 sasl_dispose(&vs->sasl.conn);
610 vs->sasl.conn = NULL;
611 goto authabort;
613 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
615 if (!(vs->sasl.mechlist = strdup(mechlist))) {
616 VNC_DEBUG("Out of memory");
617 sasl_dispose(&vs->sasl.conn);
618 vs->sasl.conn = NULL;
619 goto authabort;
621 mechlistlen = strlen(mechlist);
622 vnc_write_u32(vs, mechlistlen);
623 vnc_write(vs, mechlist, mechlistlen);
624 vnc_flush(vs);
626 VNC_DEBUG("Wait for client mechname length\n");
627 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
629 return;
631 authabort:
632 vnc_client_error(vs);
633 return;