2 * QEMU VNC display driver: VeNCrypt authentication setup
4 * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5 * Copyright (C) 2006 Fabrice Bellard
6 * Copyright (C) 2009 Red Hat, Inc
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
28 #include "qemu/main-loop.h"
30 static void start_auth_vencrypt_subauth(VncState
*vs
)
32 switch (vs
->subauth
) {
33 case VNC_AUTH_VENCRYPT_TLSNONE
:
34 case VNC_AUTH_VENCRYPT_X509NONE
:
35 VNC_DEBUG("Accept TLS auth none\n");
36 vnc_write_u32(vs
, 0); /* Accept auth completion */
37 start_client_init(vs
);
40 case VNC_AUTH_VENCRYPT_TLSVNC
:
41 case VNC_AUTH_VENCRYPT_X509VNC
:
42 VNC_DEBUG("Start TLS auth VNC\n");
46 #ifdef CONFIG_VNC_SASL
47 case VNC_AUTH_VENCRYPT_TLSSASL
:
48 case VNC_AUTH_VENCRYPT_X509SASL
:
49 VNC_DEBUG("Start TLS auth SASL\n");
52 #endif /* CONFIG_VNC_SASL */
54 default: /* Should not be possible, but just in case */
55 VNC_DEBUG("Reject subauth %d server bug\n", vs
->auth
);
58 static const char err
[] = "Unsupported authentication type";
59 vnc_write_u32(vs
, sizeof(err
));
60 vnc_write(vs
, err
, sizeof(err
));
66 static gboolean
vnc_tls_handshake_io(QIOChannel
*ioc
,
67 GIOCondition condition
,
70 static int vnc_start_vencrypt_handshake(VncState
*vs
)
74 if (qcrypto_tls_session_handshake(vs
->tls
, &err
) < 0) {
78 switch (qcrypto_tls_session_get_handshake_status(vs
->tls
)) {
79 case QCRYPTO_TLS_HANDSHAKE_COMPLETE
:
80 VNC_DEBUG("Handshake done, checking credentials\n");
81 if (qcrypto_tls_session_check_credentials(vs
->tls
, &err
) < 0) {
84 VNC_DEBUG("Client verification passed, starting TLS I/O\n");
86 g_source_remove(vs
->ioc_tag
);
88 vs
->ioc_tag
= qio_channel_add_watch(
89 vs
->ioc
, G_IO_IN
| G_IO_OUT
, vnc_client_io
, vs
, NULL
);
91 start_auth_vencrypt_subauth(vs
);
94 case QCRYPTO_TLS_HANDSHAKE_RECVING
:
95 VNC_DEBUG("Handshake interrupted (blocking read)\n");
97 g_source_remove(vs
->ioc_tag
);
99 vs
->ioc_tag
= qio_channel_add_watch(
100 vs
->ioc
, G_IO_IN
, vnc_tls_handshake_io
, vs
, NULL
);
103 case QCRYPTO_TLS_HANDSHAKE_SENDING
:
104 VNC_DEBUG("Handshake interrupted (blocking write)\n");
106 g_source_remove(vs
->ioc_tag
);
108 vs
->ioc_tag
= qio_channel_add_watch(
109 vs
->ioc
, G_IO_OUT
, vnc_tls_handshake_io
, vs
, NULL
);
116 VNC_DEBUG("Handshake failed %s\n", error_get_pretty(err
));
118 vnc_client_error(vs
);
122 static gboolean
vnc_tls_handshake_io(QIOChannel
*ioc G_GNUC_UNUSED
,
123 GIOCondition condition G_GNUC_UNUSED
,
126 VncState
*vs
= (VncState
*)opaque
;
128 VNC_DEBUG("Handshake IO continue\n");
129 vnc_start_vencrypt_handshake(vs
);
134 static int protocol_client_vencrypt_auth(VncState
*vs
, uint8_t *data
, size_t len
)
136 int auth
= read_u32(data
, 0);
138 if (auth
!= vs
->subauth
) {
139 VNC_DEBUG("Rejecting auth %d\n", auth
);
140 vnc_write_u8(vs
, 0); /* Reject auth */
142 vnc_client_error(vs
);
145 VNC_DEBUG("Accepting auth %d, setting up TLS for handshake\n", auth
);
146 vnc_write_u8(vs
, 1); /* Accept auth */
149 vs
->tls
= qcrypto_tls_session_new(vs
->vd
->tlscreds
,
152 QCRYPTO_TLS_CREDS_ENDPOINT_SERVER
,
155 VNC_DEBUG("Failed to setup TLS %s\n",
156 error_get_pretty(err
));
158 vnc_client_error(vs
);
162 qcrypto_tls_session_set_callbacks(vs
->tls
,
167 VNC_DEBUG("Start TLS VeNCrypt handshake process\n");
168 if (vnc_start_vencrypt_handshake(vs
) < 0) {
169 VNC_DEBUG("Failed to start TLS handshake\n");
176 static int protocol_client_vencrypt_init(VncState
*vs
, uint8_t *data
, size_t len
)
180 VNC_DEBUG("Unsupported VeNCrypt protocol %d.%d\n", (int)data
[0], (int)data
[1]);
181 vnc_write_u8(vs
, 1); /* Reject version */
183 vnc_client_error(vs
);
185 VNC_DEBUG("Sending allowed auth %d\n", vs
->subauth
);
186 vnc_write_u8(vs
, 0); /* Accept version */
187 vnc_write_u8(vs
, 1); /* Number of sub-auths */
188 vnc_write_u32(vs
, vs
->subauth
); /* The supported auth */
190 vnc_read_when(vs
, protocol_client_vencrypt_auth
, 4);
196 void start_auth_vencrypt(VncState
*vs
)
198 /* Send VeNCrypt version 0.2 */
202 vnc_read_when(vs
, protocol_client_vencrypt_init
, 2);