bcm2835_dma: don't allow writes to registers documented as RO
[qemu/ar7.git] / ui / vnc-auth-sasl.c
blobde8abc96d48b8544e1aef96ae7cab406e6979fbc
1 /*
2 * QEMU VNC display driver: SASL auth protocol
4 * Copyright (C) 2009 Red Hat, Inc
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #include "vnc.h"
27 /* Max amount of data we send/recv for SASL steps to prevent DOS */
28 #define SASL_DATA_MAX_LEN (1024 * 1024)
31 void vnc_sasl_client_cleanup(VncState *vs)
33 if (vs->sasl.conn) {
34 vs->sasl.runSSF = false;
35 vs->sasl.wantSSF = false;
36 vs->sasl.waitWriteSSF = 0;
37 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
38 vs->sasl.encoded = NULL;
39 g_free(vs->sasl.username);
40 g_free(vs->sasl.mechlist);
41 vs->sasl.username = vs->sasl.mechlist = NULL;
42 sasl_dispose(&vs->sasl.conn);
43 vs->sasl.conn = NULL;
48 long vnc_client_write_sasl(VncState *vs)
50 long ret;
52 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
53 "Encoded: %p size %d offset %d\n",
54 vs->output.buffer, vs->output.capacity, vs->output.offset,
55 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
57 if (!vs->sasl.encoded) {
58 int err;
59 err = sasl_encode(vs->sasl.conn,
60 (char *)vs->output.buffer,
61 vs->output.offset,
62 (const char **)&vs->sasl.encoded,
63 &vs->sasl.encodedLength);
64 if (err != SASL_OK)
65 return vnc_client_io_error(vs, -1, NULL);
67 vs->sasl.encodedOffset = 0;
70 ret = vnc_client_write_buf(vs,
71 vs->sasl.encoded + vs->sasl.encodedOffset,
72 vs->sasl.encodedLength - vs->sasl.encodedOffset);
73 if (!ret)
74 return 0;
76 vs->sasl.encodedOffset += ret;
77 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
78 vs->output.offset = 0;
79 vs->sasl.encoded = NULL;
80 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
83 /* Can't merge this block with one above, because
84 * someone might have written more unencrypted
85 * data in vs->output while we were processing
86 * SASL encoded output
88 if (vs->output.offset == 0) {
89 if (vs->ioc_tag) {
90 g_source_remove(vs->ioc_tag);
92 vs->ioc_tag = qio_channel_add_watch(
93 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
96 return ret;
100 long vnc_client_read_sasl(VncState *vs)
102 long ret;
103 uint8_t encoded[4096];
104 const char *decoded;
105 unsigned int decodedLen;
106 int err;
108 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
109 if (!ret)
110 return 0;
112 err = sasl_decode(vs->sasl.conn,
113 (char *)encoded, ret,
114 &decoded, &decodedLen);
116 if (err != SASL_OK)
117 return vnc_client_io_error(vs, -1, NULL);
118 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
119 encoded, ret, decoded, decodedLen);
120 buffer_reserve(&vs->input, decodedLen);
121 buffer_append(&vs->input, decoded, decodedLen);
122 return decodedLen;
126 static int vnc_auth_sasl_check_access(VncState *vs)
128 const void *val;
129 int err;
130 int allow;
132 err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
133 if (err != SASL_OK) {
134 VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
135 err, sasl_errstring(err, NULL, NULL));
136 return -1;
138 if (val == NULL) {
139 VNC_DEBUG("no client username was found, denying access\n");
140 return -1;
142 VNC_DEBUG("SASL client username %s\n", (const char *)val);
144 vs->sasl.username = g_strdup((const char*)val);
146 if (vs->vd->sasl.acl == NULL) {
147 VNC_DEBUG("no ACL activated, allowing access\n");
148 return 0;
151 allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
153 VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
154 allow ? "allowed" : "denied");
155 return allow ? 0 : -1;
158 static int vnc_auth_sasl_check_ssf(VncState *vs)
160 const void *val;
161 int err, ssf;
163 if (!vs->sasl.wantSSF)
164 return 1;
166 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
167 if (err != SASL_OK)
168 return 0;
170 ssf = *(const int *)val;
171 VNC_DEBUG("negotiated an SSF of %d\n", ssf);
172 if (ssf < 56)
173 return 0; /* 56 is good for Kerberos */
175 /* Only setup for read initially, because we're about to send an RPC
176 * reply which must be in plain text. When the next incoming RPC
177 * arrives, we'll switch on writes too
179 * cf qemudClientReadSASL in qemud.c
181 vs->sasl.runSSF = 1;
183 /* We have a SSF that's good enough */
184 return 1;
188 * Step Msg
190 * Input from client:
192 * u32 clientin-length
193 * u8-array clientin-string
195 * Output to client:
197 * u32 serverout-length
198 * u8-array serverout-strin
199 * u8 continue
202 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
204 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
206 uint32_t datalen = len;
207 const char *serverout;
208 unsigned int serveroutlen;
209 int err;
210 char *clientdata = NULL;
212 /* NB, distinction of NULL vs "" is *critical* in SASL */
213 if (datalen) {
214 clientdata = (char*)data;
215 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
216 datalen--; /* Don't count NULL byte when passing to _start() */
219 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
220 clientdata, datalen);
221 err = sasl_server_step(vs->sasl.conn,
222 clientdata,
223 datalen,
224 &serverout,
225 &serveroutlen);
226 if (err != SASL_OK &&
227 err != SASL_CONTINUE) {
228 VNC_DEBUG("sasl step failed %d (%s)\n",
229 err, sasl_errdetail(vs->sasl.conn));
230 sasl_dispose(&vs->sasl.conn);
231 vs->sasl.conn = NULL;
232 goto authabort;
235 if (serveroutlen > SASL_DATA_MAX_LEN) {
236 VNC_DEBUG("sasl step reply data too long %d\n",
237 serveroutlen);
238 sasl_dispose(&vs->sasl.conn);
239 vs->sasl.conn = NULL;
240 goto authabort;
243 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
244 serveroutlen, serverout ? 0 : 1);
246 if (serveroutlen) {
247 vnc_write_u32(vs, serveroutlen + 1);
248 vnc_write(vs, serverout, serveroutlen + 1);
249 } else {
250 vnc_write_u32(vs, 0);
253 /* Whether auth is complete */
254 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
256 if (err == SASL_CONTINUE) {
257 VNC_DEBUG("%s", "Authentication must continue\n");
258 /* Wait for step length */
259 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
260 } else {
261 if (!vnc_auth_sasl_check_ssf(vs)) {
262 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs->ioc);
263 goto authreject;
266 /* Check username whitelist ACL */
267 if (vnc_auth_sasl_check_access(vs) < 0) {
268 VNC_DEBUG("Authentication rejected for ACL %p\n", vs->ioc);
269 goto authreject;
272 VNC_DEBUG("Authentication successful %p\n", vs->ioc);
273 vnc_write_u32(vs, 0); /* Accept auth */
275 * Delay writing in SSF encoded mode until pending output
276 * buffer is written
278 if (vs->sasl.runSSF)
279 vs->sasl.waitWriteSSF = vs->output.offset;
280 start_client_init(vs);
283 return 0;
285 authreject:
286 vnc_write_u32(vs, 1); /* Reject auth */
287 vnc_write_u32(vs, sizeof("Authentication failed"));
288 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
289 vnc_flush(vs);
290 vnc_client_error(vs);
291 return -1;
293 authabort:
294 vnc_client_error(vs);
295 return -1;
298 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
300 uint32_t steplen = read_u32(data, 0);
301 VNC_DEBUG("Got client step len %d\n", steplen);
302 if (steplen > SASL_DATA_MAX_LEN) {
303 VNC_DEBUG("Too much SASL data %d\n", steplen);
304 vnc_client_error(vs);
305 return -1;
308 if (steplen == 0)
309 return protocol_client_auth_sasl_step(vs, NULL, 0);
310 else
311 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
312 return 0;
316 * Start Msg
318 * Input from client:
320 * u32 clientin-length
321 * u8-array clientin-string
323 * Output to client:
325 * u32 serverout-length
326 * u8-array serverout-strin
327 * u8 continue
330 #define SASL_DATA_MAX_LEN (1024 * 1024)
332 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
334 uint32_t datalen = len;
335 const char *serverout;
336 unsigned int serveroutlen;
337 int err;
338 char *clientdata = NULL;
340 /* NB, distinction of NULL vs "" is *critical* in SASL */
341 if (datalen) {
342 clientdata = (char*)data;
343 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
344 datalen--; /* Don't count NULL byte when passing to _start() */
347 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
348 vs->sasl.mechlist, clientdata, datalen);
349 err = sasl_server_start(vs->sasl.conn,
350 vs->sasl.mechlist,
351 clientdata,
352 datalen,
353 &serverout,
354 &serveroutlen);
355 if (err != SASL_OK &&
356 err != SASL_CONTINUE) {
357 VNC_DEBUG("sasl start failed %d (%s)\n",
358 err, sasl_errdetail(vs->sasl.conn));
359 sasl_dispose(&vs->sasl.conn);
360 vs->sasl.conn = NULL;
361 goto authabort;
363 if (serveroutlen > SASL_DATA_MAX_LEN) {
364 VNC_DEBUG("sasl start reply data too long %d\n",
365 serveroutlen);
366 sasl_dispose(&vs->sasl.conn);
367 vs->sasl.conn = NULL;
368 goto authabort;
371 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
372 serveroutlen, serverout ? 0 : 1);
374 if (serveroutlen) {
375 vnc_write_u32(vs, serveroutlen + 1);
376 vnc_write(vs, serverout, serveroutlen + 1);
377 } else {
378 vnc_write_u32(vs, 0);
381 /* Whether auth is complete */
382 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
384 if (err == SASL_CONTINUE) {
385 VNC_DEBUG("%s", "Authentication must continue\n");
386 /* Wait for step length */
387 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
388 } else {
389 if (!vnc_auth_sasl_check_ssf(vs)) {
390 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs->ioc);
391 goto authreject;
394 /* Check username whitelist ACL */
395 if (vnc_auth_sasl_check_access(vs) < 0) {
396 VNC_DEBUG("Authentication rejected for ACL %p\n", vs->ioc);
397 goto authreject;
400 VNC_DEBUG("Authentication successful %p\n", vs->ioc);
401 vnc_write_u32(vs, 0); /* Accept auth */
402 start_client_init(vs);
405 return 0;
407 authreject:
408 vnc_write_u32(vs, 1); /* Reject auth */
409 vnc_write_u32(vs, sizeof("Authentication failed"));
410 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
411 vnc_flush(vs);
412 vnc_client_error(vs);
413 return -1;
415 authabort:
416 vnc_client_error(vs);
417 return -1;
420 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
422 uint32_t startlen = read_u32(data, 0);
423 VNC_DEBUG("Got client start len %d\n", startlen);
424 if (startlen > SASL_DATA_MAX_LEN) {
425 VNC_DEBUG("Too much SASL data %d\n", startlen);
426 vnc_client_error(vs);
427 return -1;
430 if (startlen == 0)
431 return protocol_client_auth_sasl_start(vs, NULL, 0);
433 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
434 return 0;
437 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
439 char *mechname = g_strndup((const char *) data, len);
440 VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
441 mechname, vs->sasl.mechlist);
443 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
444 if (vs->sasl.mechlist[len] != '\0' &&
445 vs->sasl.mechlist[len] != ',') {
446 VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
447 goto fail;
449 } else {
450 char *offset = strstr(vs->sasl.mechlist, mechname);
451 VNC_DEBUG("Two %p\n", offset);
452 if (!offset) {
453 goto fail;
455 VNC_DEBUG("Two '%s'\n", offset);
456 if (offset[-1] != ',' ||
457 (offset[len] != '\0'&&
458 offset[len] != ',')) {
459 goto fail;
463 g_free(vs->sasl.mechlist);
464 vs->sasl.mechlist = mechname;
466 VNC_DEBUG("Validated mechname '%s'\n", mechname);
467 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
468 return 0;
470 fail:
471 vnc_client_error(vs);
472 g_free(mechname);
473 return -1;
476 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
478 uint32_t mechlen = read_u32(data, 0);
479 VNC_DEBUG("Got client mechname len %d\n", mechlen);
480 if (mechlen > 100) {
481 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
482 vnc_client_error(vs);
483 return -1;
485 if (mechlen < 1) {
486 VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
487 vnc_client_error(vs);
488 return -1;
490 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
491 return 0;
494 static char *
495 vnc_socket_ip_addr_string(QIOChannelSocket *ioc,
496 bool local,
497 Error **errp)
499 SocketAddress *addr;
500 char *ret;
502 if (local) {
503 addr = qio_channel_socket_get_local_address(ioc, errp);
504 } else {
505 addr = qio_channel_socket_get_remote_address(ioc, errp);
507 if (!addr) {
508 return NULL;
511 if (addr->type != SOCKET_ADDRESS_KIND_INET) {
512 error_setg(errp, "Not an inet socket type");
513 return NULL;
515 ret = g_strdup_printf("%s;%s", addr->u.inet->host, addr->u.inet->port);
516 qapi_free_SocketAddress(addr);
517 return ret;
520 void start_auth_sasl(VncState *vs)
522 const char *mechlist = NULL;
523 sasl_security_properties_t secprops;
524 int err;
525 char *localAddr, *remoteAddr;
526 int mechlistlen;
528 VNC_DEBUG("Initialize SASL auth %p\n", vs->ioc);
530 /* Get local & remote client addresses in form IPADDR;PORT */
531 localAddr = vnc_socket_ip_addr_string(vs->sioc, true, NULL);
532 if (!localAddr) {
533 goto authabort;
536 remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, NULL);
537 if (!remoteAddr) {
538 g_free(localAddr);
539 goto authabort;
542 err = sasl_server_new("vnc",
543 NULL, /* FQDN - just delegates to gethostname */
544 NULL, /* User realm */
545 localAddr,
546 remoteAddr,
547 NULL, /* Callbacks, not needed */
548 SASL_SUCCESS_DATA,
549 &vs->sasl.conn);
550 g_free(localAddr);
551 g_free(remoteAddr);
552 localAddr = remoteAddr = NULL;
554 if (err != SASL_OK) {
555 VNC_DEBUG("sasl context setup failed %d (%s)",
556 err, sasl_errstring(err, NULL, NULL));
557 vs->sasl.conn = NULL;
558 goto authabort;
561 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
562 if (vs->auth == VNC_AUTH_VENCRYPT &&
563 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
564 Error *local_err = NULL;
565 int keysize;
566 sasl_ssf_t ssf;
568 keysize = qcrypto_tls_session_get_key_size(vs->tls,
569 &local_err);
570 if (keysize < 0) {
571 VNC_DEBUG("cannot TLS get cipher size: %s\n",
572 error_get_pretty(local_err));
573 error_free(local_err);
574 sasl_dispose(&vs->sasl.conn);
575 vs->sasl.conn = NULL;
576 goto authabort;
578 ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */
580 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
581 if (err != SASL_OK) {
582 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
583 err, sasl_errstring(err, NULL, NULL));
584 sasl_dispose(&vs->sasl.conn);
585 vs->sasl.conn = NULL;
586 goto authabort;
588 } else {
589 vs->sasl.wantSSF = 1;
592 memset (&secprops, 0, sizeof secprops);
593 /* Inform SASL that we've got an external SSF layer from TLS.
595 * Disable SSF, if using TLS+x509+SASL only. TLS without x509
596 * is not sufficiently strong
598 if (vs->vd->is_unix ||
599 (vs->auth == VNC_AUTH_VENCRYPT &&
600 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) {
601 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
602 secprops.min_ssf = 0;
603 secprops.max_ssf = 0;
604 secprops.maxbufsize = 8192;
605 secprops.security_flags = 0;
606 } else {
607 /* Plain TCP, better get an SSF layer */
608 secprops.min_ssf = 56; /* Good enough to require kerberos */
609 secprops.max_ssf = 100000; /* Arbitrary big number */
610 secprops.maxbufsize = 8192;
611 /* Forbid any anonymous or trivially crackable auth */
612 secprops.security_flags =
613 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
616 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
617 if (err != SASL_OK) {
618 VNC_DEBUG("cannot set SASL security props %d (%s)\n",
619 err, sasl_errstring(err, NULL, NULL));
620 sasl_dispose(&vs->sasl.conn);
621 vs->sasl.conn = NULL;
622 goto authabort;
625 err = sasl_listmech(vs->sasl.conn,
626 NULL, /* Don't need to set user */
627 "", /* Prefix */
628 ",", /* Separator */
629 "", /* Suffix */
630 &mechlist,
631 NULL,
632 NULL);
633 if (err != SASL_OK) {
634 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
635 err, sasl_errdetail(vs->sasl.conn));
636 sasl_dispose(&vs->sasl.conn);
637 vs->sasl.conn = NULL;
638 goto authabort;
640 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
642 vs->sasl.mechlist = g_strdup(mechlist);
643 mechlistlen = strlen(mechlist);
644 vnc_write_u32(vs, mechlistlen);
645 vnc_write(vs, mechlist, mechlistlen);
646 vnc_flush(vs);
648 VNC_DEBUG("Wait for client mechname length\n");
649 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
651 return;
653 authabort:
654 vnc_client_error(vs);