2 * QEMU VNC display driver: SASL auth protocol
4 * Copyright (C) 2009 Red Hat, Inc
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 /* Max amount of data we send/recv for SASL steps to prevent DOS */
28 #define SASL_DATA_MAX_LEN (1024 * 1024)
31 void vnc_sasl_client_cleanup(VncState
*vs
)
34 vs
->sasl
.runSSF
= false;
35 vs
->sasl
.wantSSF
= false;
36 vs
->sasl
.waitWriteSSF
= 0;
37 vs
->sasl
.encodedLength
= vs
->sasl
.encodedOffset
= 0;
38 vs
->sasl
.encoded
= NULL
;
39 g_free(vs
->sasl
.username
);
40 g_free(vs
->sasl
.mechlist
);
41 vs
->sasl
.username
= vs
->sasl
.mechlist
= NULL
;
42 sasl_dispose(&vs
->sasl
.conn
);
48 long vnc_client_write_sasl(VncState
*vs
)
52 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
53 "Encoded: %p size %d offset %d\n",
54 vs
->output
.buffer
, vs
->output
.capacity
, vs
->output
.offset
,
55 vs
->sasl
.encoded
, vs
->sasl
.encodedLength
, vs
->sasl
.encodedOffset
);
57 if (!vs
->sasl
.encoded
) {
59 err
= sasl_encode(vs
->sasl
.conn
,
60 (char *)vs
->output
.buffer
,
62 (const char **)&vs
->sasl
.encoded
,
63 &vs
->sasl
.encodedLength
);
65 return vnc_client_io_error(vs
, -1, NULL
);
67 vs
->sasl
.encodedOffset
= 0;
70 ret
= vnc_client_write_buf(vs
,
71 vs
->sasl
.encoded
+ vs
->sasl
.encodedOffset
,
72 vs
->sasl
.encodedLength
- vs
->sasl
.encodedOffset
);
76 vs
->sasl
.encodedOffset
+= ret
;
77 if (vs
->sasl
.encodedOffset
== vs
->sasl
.encodedLength
) {
78 vs
->output
.offset
= 0;
79 vs
->sasl
.encoded
= NULL
;
80 vs
->sasl
.encodedOffset
= vs
->sasl
.encodedLength
= 0;
83 /* Can't merge this block with one above, because
84 * someone might have written more unencrypted
85 * data in vs->output while we were processing
88 if (vs
->output
.offset
== 0) {
90 g_source_remove(vs
->ioc_tag
);
92 vs
->ioc_tag
= qio_channel_add_watch(
93 vs
->ioc
, G_IO_IN
, vnc_client_io
, vs
, NULL
);
100 long vnc_client_read_sasl(VncState
*vs
)
103 uint8_t encoded
[4096];
105 unsigned int decodedLen
;
108 ret
= vnc_client_read_buf(vs
, encoded
, sizeof(encoded
));
112 err
= sasl_decode(vs
->sasl
.conn
,
113 (char *)encoded
, ret
,
114 &decoded
, &decodedLen
);
117 return vnc_client_io_error(vs
, -1, NULL
);
118 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
119 encoded
, ret
, decoded
, decodedLen
);
120 buffer_reserve(&vs
->input
, decodedLen
);
121 buffer_append(&vs
->input
, decoded
, decodedLen
);
126 static int vnc_auth_sasl_check_access(VncState
*vs
)
132 err
= sasl_getprop(vs
->sasl
.conn
, SASL_USERNAME
, &val
);
133 if (err
!= SASL_OK
) {
134 VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
135 err
, sasl_errstring(err
, NULL
, NULL
));
139 VNC_DEBUG("no client username was found, denying access\n");
142 VNC_DEBUG("SASL client username %s\n", (const char *)val
);
144 vs
->sasl
.username
= g_strdup((const char*)val
);
146 if (vs
->vd
->sasl
.acl
== NULL
) {
147 VNC_DEBUG("no ACL activated, allowing access\n");
151 allow
= qemu_acl_party_is_allowed(vs
->vd
->sasl
.acl
, vs
->sasl
.username
);
153 VNC_DEBUG("SASL client %s %s by ACL\n", vs
->sasl
.username
,
154 allow
? "allowed" : "denied");
155 return allow
? 0 : -1;
158 static int vnc_auth_sasl_check_ssf(VncState
*vs
)
163 if (!vs
->sasl
.wantSSF
)
166 err
= sasl_getprop(vs
->sasl
.conn
, SASL_SSF
, &val
);
170 ssf
= *(const int *)val
;
171 VNC_DEBUG("negotiated an SSF of %d\n", ssf
);
173 return 0; /* 56 is good for Kerberos */
175 /* Only setup for read initially, because we're about to send an RPC
176 * reply which must be in plain text. When the next incoming RPC
177 * arrives, we'll switch on writes too
179 * cf qemudClientReadSASL in qemud.c
183 /* We have a SSF that's good enough */
192 * u32 clientin-length
193 * u8-array clientin-string
197 * u32 serverout-length
198 * u8-array serverout-strin
202 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
);
204 static int protocol_client_auth_sasl_step(VncState
*vs
, uint8_t *data
, size_t len
)
206 uint32_t datalen
= len
;
207 const char *serverout
;
208 unsigned int serveroutlen
;
210 char *clientdata
= NULL
;
212 /* NB, distinction of NULL vs "" is *critical* in SASL */
214 clientdata
= (char*)data
;
215 clientdata
[datalen
-1] = '\0'; /* Wire includes '\0', but make sure */
216 datalen
--; /* Don't count NULL byte when passing to _start() */
219 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
220 clientdata
, datalen
);
221 err
= sasl_server_step(vs
->sasl
.conn
,
226 if (err
!= SASL_OK
&&
227 err
!= SASL_CONTINUE
) {
228 VNC_DEBUG("sasl step failed %d (%s)\n",
229 err
, sasl_errdetail(vs
->sasl
.conn
));
230 sasl_dispose(&vs
->sasl
.conn
);
231 vs
->sasl
.conn
= NULL
;
235 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
236 VNC_DEBUG("sasl step reply data too long %d\n",
238 sasl_dispose(&vs
->sasl
.conn
);
239 vs
->sasl
.conn
= NULL
;
243 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
244 serveroutlen
, serverout
? 0 : 1);
247 vnc_write_u32(vs
, serveroutlen
+ 1);
248 vnc_write(vs
, serverout
, serveroutlen
+ 1);
250 vnc_write_u32(vs
, 0);
253 /* Whether auth is complete */
254 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
256 if (err
== SASL_CONTINUE
) {
257 VNC_DEBUG("%s", "Authentication must continue\n");
258 /* Wait for step length */
259 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
261 if (!vnc_auth_sasl_check_ssf(vs
)) {
262 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs
->ioc
);
266 /* Check username whitelist ACL */
267 if (vnc_auth_sasl_check_access(vs
) < 0) {
268 VNC_DEBUG("Authentication rejected for ACL %p\n", vs
->ioc
);
272 VNC_DEBUG("Authentication successful %p\n", vs
->ioc
);
273 vnc_write_u32(vs
, 0); /* Accept auth */
275 * Delay writing in SSF encoded mode until pending output
279 vs
->sasl
.waitWriteSSF
= vs
->output
.offset
;
280 start_client_init(vs
);
286 vnc_write_u32(vs
, 1); /* Reject auth */
287 vnc_write_u32(vs
, sizeof("Authentication failed"));
288 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
290 vnc_client_error(vs
);
294 vnc_client_error(vs
);
298 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
)
300 uint32_t steplen
= read_u32(data
, 0);
301 VNC_DEBUG("Got client step len %d\n", steplen
);
302 if (steplen
> SASL_DATA_MAX_LEN
) {
303 VNC_DEBUG("Too much SASL data %d\n", steplen
);
304 vnc_client_error(vs
);
309 return protocol_client_auth_sasl_step(vs
, NULL
, 0);
311 vnc_read_when(vs
, protocol_client_auth_sasl_step
, steplen
);
320 * u32 clientin-length
321 * u8-array clientin-string
325 * u32 serverout-length
326 * u8-array serverout-strin
330 #define SASL_DATA_MAX_LEN (1024 * 1024)
332 static int protocol_client_auth_sasl_start(VncState
*vs
, uint8_t *data
, size_t len
)
334 uint32_t datalen
= len
;
335 const char *serverout
;
336 unsigned int serveroutlen
;
338 char *clientdata
= NULL
;
340 /* NB, distinction of NULL vs "" is *critical* in SASL */
342 clientdata
= (char*)data
;
343 clientdata
[datalen
-1] = '\0'; /* Should be on wire, but make sure */
344 datalen
--; /* Don't count NULL byte when passing to _start() */
347 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
348 vs
->sasl
.mechlist
, clientdata
, datalen
);
349 err
= sasl_server_start(vs
->sasl
.conn
,
355 if (err
!= SASL_OK
&&
356 err
!= SASL_CONTINUE
) {
357 VNC_DEBUG("sasl start failed %d (%s)\n",
358 err
, sasl_errdetail(vs
->sasl
.conn
));
359 sasl_dispose(&vs
->sasl
.conn
);
360 vs
->sasl
.conn
= NULL
;
363 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
364 VNC_DEBUG("sasl start reply data too long %d\n",
366 sasl_dispose(&vs
->sasl
.conn
);
367 vs
->sasl
.conn
= NULL
;
371 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
372 serveroutlen
, serverout
? 0 : 1);
375 vnc_write_u32(vs
, serveroutlen
+ 1);
376 vnc_write(vs
, serverout
, serveroutlen
+ 1);
378 vnc_write_u32(vs
, 0);
381 /* Whether auth is complete */
382 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
384 if (err
== SASL_CONTINUE
) {
385 VNC_DEBUG("%s", "Authentication must continue\n");
386 /* Wait for step length */
387 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
389 if (!vnc_auth_sasl_check_ssf(vs
)) {
390 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs
->ioc
);
394 /* Check username whitelist ACL */
395 if (vnc_auth_sasl_check_access(vs
) < 0) {
396 VNC_DEBUG("Authentication rejected for ACL %p\n", vs
->ioc
);
400 VNC_DEBUG("Authentication successful %p\n", vs
->ioc
);
401 vnc_write_u32(vs
, 0); /* Accept auth */
402 start_client_init(vs
);
408 vnc_write_u32(vs
, 1); /* Reject auth */
409 vnc_write_u32(vs
, sizeof("Authentication failed"));
410 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
412 vnc_client_error(vs
);
416 vnc_client_error(vs
);
420 static int protocol_client_auth_sasl_start_len(VncState
*vs
, uint8_t *data
, size_t len
)
422 uint32_t startlen
= read_u32(data
, 0);
423 VNC_DEBUG("Got client start len %d\n", startlen
);
424 if (startlen
> SASL_DATA_MAX_LEN
) {
425 VNC_DEBUG("Too much SASL data %d\n", startlen
);
426 vnc_client_error(vs
);
431 return protocol_client_auth_sasl_start(vs
, NULL
, 0);
433 vnc_read_when(vs
, protocol_client_auth_sasl_start
, startlen
);
437 static int protocol_client_auth_sasl_mechname(VncState
*vs
, uint8_t *data
, size_t len
)
439 char *mechname
= g_strndup((const char *) data
, len
);
440 VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
441 mechname
, vs
->sasl
.mechlist
);
443 if (strncmp(vs
->sasl
.mechlist
, mechname
, len
) == 0) {
444 if (vs
->sasl
.mechlist
[len
] != '\0' &&
445 vs
->sasl
.mechlist
[len
] != ',') {
446 VNC_DEBUG("One %d", vs
->sasl
.mechlist
[len
]);
450 char *offset
= strstr(vs
->sasl
.mechlist
, mechname
);
451 VNC_DEBUG("Two %p\n", offset
);
455 VNC_DEBUG("Two '%s'\n", offset
);
456 if (offset
[-1] != ',' ||
457 (offset
[len
] != '\0'&&
458 offset
[len
] != ',')) {
463 g_free(vs
->sasl
.mechlist
);
464 vs
->sasl
.mechlist
= mechname
;
466 VNC_DEBUG("Validated mechname '%s'\n", mechname
);
467 vnc_read_when(vs
, protocol_client_auth_sasl_start_len
, 4);
471 vnc_client_error(vs
);
476 static int protocol_client_auth_sasl_mechname_len(VncState
*vs
, uint8_t *data
, size_t len
)
478 uint32_t mechlen
= read_u32(data
, 0);
479 VNC_DEBUG("Got client mechname len %d\n", mechlen
);
481 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen
);
482 vnc_client_error(vs
);
486 VNC_DEBUG("Too short SASL mechname %d\n", mechlen
);
487 vnc_client_error(vs
);
490 vnc_read_when(vs
, protocol_client_auth_sasl_mechname
,mechlen
);
495 vnc_socket_ip_addr_string(QIOChannelSocket
*ioc
,
503 addr
= qio_channel_socket_get_local_address(ioc
, errp
);
505 addr
= qio_channel_socket_get_remote_address(ioc
, errp
);
511 if (addr
->type
!= SOCKET_ADDRESS_KIND_INET
) {
512 error_setg(errp
, "Not an inet socket type");
515 ret
= g_strdup_printf("%s;%s", addr
->u
.inet
->host
, addr
->u
.inet
->port
);
516 qapi_free_SocketAddress(addr
);
520 void start_auth_sasl(VncState
*vs
)
522 const char *mechlist
= NULL
;
523 sasl_security_properties_t secprops
;
525 char *localAddr
, *remoteAddr
;
528 VNC_DEBUG("Initialize SASL auth %p\n", vs
->ioc
);
530 /* Get local & remote client addresses in form IPADDR;PORT */
531 localAddr
= vnc_socket_ip_addr_string(vs
->sioc
, true, NULL
);
536 remoteAddr
= vnc_socket_ip_addr_string(vs
->sioc
, false, NULL
);
542 err
= sasl_server_new("vnc",
543 NULL
, /* FQDN - just delegates to gethostname */
544 NULL
, /* User realm */
547 NULL
, /* Callbacks, not needed */
552 localAddr
= remoteAddr
= NULL
;
554 if (err
!= SASL_OK
) {
555 VNC_DEBUG("sasl context setup failed %d (%s)",
556 err
, sasl_errstring(err
, NULL
, NULL
));
557 vs
->sasl
.conn
= NULL
;
561 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
562 if (vs
->auth
== VNC_AUTH_VENCRYPT
&&
563 vs
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
) {
564 Error
*local_err
= NULL
;
568 keysize
= qcrypto_tls_session_get_key_size(vs
->tls
,
571 VNC_DEBUG("cannot TLS get cipher size: %s\n",
572 error_get_pretty(local_err
));
573 error_free(local_err
);
574 sasl_dispose(&vs
->sasl
.conn
);
575 vs
->sasl
.conn
= NULL
;
578 ssf
= keysize
* CHAR_BIT
; /* tls key size is bytes, sasl wants bits */
580 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SSF_EXTERNAL
, &ssf
);
581 if (err
!= SASL_OK
) {
582 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
583 err
, sasl_errstring(err
, NULL
, NULL
));
584 sasl_dispose(&vs
->sasl
.conn
);
585 vs
->sasl
.conn
= NULL
;
589 vs
->sasl
.wantSSF
= 1;
592 memset (&secprops
, 0, sizeof secprops
);
593 /* Inform SASL that we've got an external SSF layer from TLS.
595 * Disable SSF, if using TLS+x509+SASL only. TLS without x509
596 * is not sufficiently strong
598 if (vs
->vd
->is_unix
||
599 (vs
->auth
== VNC_AUTH_VENCRYPT
&&
600 vs
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
)) {
601 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
602 secprops
.min_ssf
= 0;
603 secprops
.max_ssf
= 0;
604 secprops
.maxbufsize
= 8192;
605 secprops
.security_flags
= 0;
607 /* Plain TCP, better get an SSF layer */
608 secprops
.min_ssf
= 56; /* Good enough to require kerberos */
609 secprops
.max_ssf
= 100000; /* Arbitrary big number */
610 secprops
.maxbufsize
= 8192;
611 /* Forbid any anonymous or trivially crackable auth */
612 secprops
.security_flags
=
613 SASL_SEC_NOANONYMOUS
| SASL_SEC_NOPLAINTEXT
;
616 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SEC_PROPS
, &secprops
);
617 if (err
!= SASL_OK
) {
618 VNC_DEBUG("cannot set SASL security props %d (%s)\n",
619 err
, sasl_errstring(err
, NULL
, NULL
));
620 sasl_dispose(&vs
->sasl
.conn
);
621 vs
->sasl
.conn
= NULL
;
625 err
= sasl_listmech(vs
->sasl
.conn
,
626 NULL
, /* Don't need to set user */
633 if (err
!= SASL_OK
) {
634 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
635 err
, sasl_errdetail(vs
->sasl
.conn
));
636 sasl_dispose(&vs
->sasl
.conn
);
637 vs
->sasl
.conn
= NULL
;
640 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist
);
642 vs
->sasl
.mechlist
= g_strdup(mechlist
);
643 mechlistlen
= strlen(mechlist
);
644 vnc_write_u32(vs
, mechlistlen
);
645 vnc_write(vs
, mechlist
, mechlistlen
);
648 VNC_DEBUG("Wait for client mechname length\n");
649 vnc_read_when(vs
, protocol_client_auth_sasl_mechname_len
, 4);
654 vnc_client_error(vs
);