ui/vnc-auth-sasl.c

   1 /*
   2  * QEMU VNC display driver: SASL auth protocol
   3  *
   4  * Copyright (C) 2009 Red Hat, Inc
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "qapi/error.h"
  27 #include "authz/base.h"
  28 #include "vnc.h"
  29 #include "trace.h"
  30
  31 /* Max amount of data we send/recv for SASL steps to prevent DOS */
  32 #define SASL_DATA_MAX_LEN (1024 * 1024)
  33
  34
  35 void vnc_sasl_client_cleanup(VncState *vs)
  36 {
  37     if (vs->sasl.conn) {
  38         vs->sasl.runSSF = false;
  39         vs->sasl.wantSSF = false;
  40         vs->sasl.waitWriteSSF = 0;
  41         vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
  42         vs->sasl.encoded = NULL;
  43         g_free(vs->sasl.username);
  44         g_free(vs->sasl.mechlist);
  45         vs->sasl.username = vs->sasl.mechlist = NULL;
  46         sasl_dispose(&vs->sasl.conn);
  47         vs->sasl.conn = NULL;
  48     }
  49 }
  50
  51
  52 size_t vnc_client_write_sasl(VncState *vs)
  53 {
  54     size_t ret;
  55
  56     VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
  57               "Encoded: %p size %d offset %d\n",
  58               vs->output.buffer, vs->output.capacity, vs->output.offset,
  59               vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
  60
  61     if (!vs->sasl.encoded) {
  62         int err;
  63         err = sasl_encode(vs->sasl.conn,
  64                           (char *)vs->output.buffer,
  65                           vs->output.offset,
  66                           (const char **)&vs->sasl.encoded,
  67                           &vs->sasl.encodedLength);
  68         if (err != SASL_OK)
  69             return vnc_client_io_error(vs, -1, NULL);
  70
  71         vs->sasl.encodedRawLength = vs->output.offset;
  72         vs->sasl.encodedOffset = 0;
  73     }
  74
  75     ret = vnc_client_write_buf(vs,
  76                                vs->sasl.encoded + vs->sasl.encodedOffset,
  77                                vs->sasl.encodedLength - vs->sasl.encodedOffset);
  78     if (!ret)
  79         return 0;
  80
  81     vs->sasl.encodedOffset += ret;
  82     if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
  83         bool throttled = vs->force_update_offset != 0;
  84         size_t offset;
  85         if (vs->sasl.encodedRawLength >= vs->force_update_offset) {
  86             vs->force_update_offset = 0;
  87         } else {
  88             vs->force_update_offset -= vs->sasl.encodedRawLength;
  89         }
  90         if (throttled && vs->force_update_offset == 0) {
  91             trace_vnc_client_unthrottle_forced(vs, vs->ioc);
  92         }
  93         offset = vs->output.offset;
  94         buffer_advance(&vs->output, vs->sasl.encodedRawLength);
  95         if (offset >= vs->throttle_output_offset &&
  96             vs->output.offset < vs->throttle_output_offset) {
  97             trace_vnc_client_unthrottle_incremental(vs, vs->ioc,
  98                                                     vs->output.offset);
  99         }
 100         vs->sasl.encoded = NULL;
 101         vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
 102     }
 103
 104     /* Can't merge this block with one above, because
 105      * someone might have written more unencrypted
 106      * data in vs->output while we were processing
 107      * SASL encoded output
 108      */
 109     if (vs->output.offset == 0) {
 110         if (vs->ioc_tag) {
 111             g_source_remove(vs->ioc_tag);
 112         }
 113         vs->ioc_tag = qio_channel_add_watch(
 114             vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
 115     }
 116
 117     return ret;
 118 }
 119
 120
 121 size_t vnc_client_read_sasl(VncState *vs)
 122 {
 123     size_t ret;
 124     uint8_t encoded[4096];
 125     const char *decoded;
 126     unsigned int decodedLen;
 127     int err;
 128
 129     ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
 130     if (!ret)
 131         return 0;
 132
 133     err = sasl_decode(vs->sasl.conn,
 134                       (char *)encoded, ret,
 135                       &decoded, &decodedLen);
 136
 137     if (err != SASL_OK)
 138         return vnc_client_io_error(vs, -1, NULL);
 139     VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
 140               encoded, ret, decoded, decodedLen);
 141     buffer_reserve(&vs->input, decodedLen);
 142     buffer_append(&vs->input, decoded, decodedLen);
 143     return decodedLen;
 144 }
 145
 146
 147 static int vnc_auth_sasl_check_access(VncState *vs)
 148 {
 149     const void *val;
 150     int rv;
 151     Error *err = NULL;
 152     bool allow;
 153
 154     rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
 155     if (rv != SASL_OK) {
 156         trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username",
 157                             sasl_errstring(rv, NULL, NULL));
 158         return -1;
 159     }
 160     if (val == NULL) {
 161         trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", "");
 162         return -1;
 163     }
 164
 165     vs->sasl.username = g_strdup((const char*)val);
 166     trace_vnc_auth_sasl_username(vs, vs->sasl.username);
 167
 168     if (vs->vd->sasl.authzid == NULL) {
 169         trace_vnc_auth_sasl_acl(vs, 1);
 170         return 0;
 171     }
 172
 173     allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid,
 174                                     vs->sasl.username, &err);
 175     if (err) {
 176         trace_vnc_auth_fail(vs, vs->auth, "Error from authz",
 177                             error_get_pretty(err));
 178         error_free(err);
 179         return -1;
 180     }
 181
 182     trace_vnc_auth_sasl_acl(vs, allow);
 183     return allow ? 0 : -1;
 184 }
 185
 186 static int vnc_auth_sasl_check_ssf(VncState *vs)
 187 {
 188     const void *val;
 189     int err, ssf;
 190
 191     if (!vs->sasl.wantSSF)
 192         return 1;
 193
 194     err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
 195     if (err != SASL_OK)
 196         return 0;
 197
 198     ssf = *(const int *)val;
 199
 200     trace_vnc_auth_sasl_ssf(vs, ssf);
 201
 202     if (ssf < 56)
 203         return 0; /* 56 is good for Kerberos */
 204
 205     /* Only setup for read initially, because we're about to send an RPC
 206      * reply which must be in plain text. When the next incoming RPC
 207      * arrives, we'll switch on writes too
 208      *
 209      * cf qemudClientReadSASL  in qemud.c
 210      */
 211     vs->sasl.runSSF = 1;
 212
 213     /* We have a SSF that's good enough */
 214     return 1;
 215 }
 216
 217 /*
 218  * Step Msg
 219  *
 220  * Input from client:
 221  *
 222  * u32 clientin-length
 223  * u8-array clientin-string
 224  *
 225  * Output to client:
 226  *
 227  * u32 serverout-length
 228  * u8-array serverout-strin
 229  * u8 continue
 230  */
 231
 232 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
 233
 234 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
 235 {
 236     uint32_t datalen = len;
 237     const char *serverout;
 238     unsigned int serveroutlen;
 239     int err;
 240     char *clientdata = NULL;
 241
 242     /* NB, distinction of NULL vs "" is *critical* in SASL */
 243     if (datalen) {
 244         clientdata = (char*)data;
 245         clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
 246         datalen--; /* Don't count NULL byte when passing to _start() */
 247     }
 248
 249     err = sasl_server_step(vs->sasl.conn,
 250                            clientdata,
 251                            datalen,
 252                            &serverout,
 253                            &serveroutlen);
 254     trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err);
 255     if (err != SASL_OK &&
 256         err != SASL_CONTINUE) {
 257         trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth",
 258                             sasl_errdetail(vs->sasl.conn));
 259         sasl_dispose(&vs->sasl.conn);
 260         vs->sasl.conn = NULL;
 261         goto authabort;
 262     }
 263
 264     if (serveroutlen > SASL_DATA_MAX_LEN) {
 265         trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
 266         sasl_dispose(&vs->sasl.conn);
 267         vs->sasl.conn = NULL;
 268         goto authabort;
 269     }
 270
 271     if (serveroutlen) {
 272         vnc_write_u32(vs, serveroutlen + 1);
 273         vnc_write(vs, serverout, serveroutlen + 1);
 274     } else {
 275         vnc_write_u32(vs, 0);
 276     }
 277
 278     /* Whether auth is complete */
 279     vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
 280
 281     if (err == SASL_CONTINUE) {
 282         /* Wait for step length */
 283         vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
 284     } else {
 285         if (!vnc_auth_sasl_check_ssf(vs)) {
 286             trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
 287             goto authreject;
 288         }
 289
 290         /* Check username whitelist ACL */
 291         if (vnc_auth_sasl_check_access(vs) < 0) {
 292             goto authreject;
 293         }
 294
 295         trace_vnc_auth_pass(vs, vs->auth);
 296         vnc_write_u32(vs, 0); /* Accept auth */
 297         /*
 298          * Delay writing in SSF encoded mode until pending output
 299          * buffer is written
 300          */
 301         if (vs->sasl.runSSF)
 302             vs->sasl.waitWriteSSF = vs->output.offset;
 303         start_client_init(vs);
 304     }
 305
 306     return 0;
 307
 308  authreject:
 309     vnc_write_u32(vs, 1); /* Reject auth */
 310     vnc_write_u32(vs, sizeof("Authentication failed"));
 311     vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
 312     vnc_flush(vs);
 313     vnc_client_error(vs);
 314     return -1;
 315
 316  authabort:
 317     vnc_client_error(vs);
 318     return -1;
 319 }
 320
 321 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
 322 {
 323     uint32_t steplen = read_u32(data, 0);
 324
 325     if (steplen > SASL_DATA_MAX_LEN) {
 326         trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", "");
 327         vnc_client_error(vs);
 328         return -1;
 329     }
 330
 331     if (steplen == 0)
 332         return protocol_client_auth_sasl_step(vs, NULL, 0);
 333     else
 334         vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
 335     return 0;
 336 }
 337
 338 /*
 339  * Start Msg
 340  *
 341  * Input from client:
 342  *
 343  * u32 clientin-length
 344  * u8-array clientin-string
 345  *
 346  * Output to client:
 347  *
 348  * u32 serverout-length
 349  * u8-array serverout-strin
 350  * u8 continue
 351  */
 352
 353 #define SASL_DATA_MAX_LEN (1024 * 1024)
 354
 355 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
 356 {
 357     uint32_t datalen = len;
 358     const char *serverout;
 359     unsigned int serveroutlen;
 360     int err;
 361     char *clientdata = NULL;
 362
 363     /* NB, distinction of NULL vs "" is *critical* in SASL */
 364     if (datalen) {
 365         clientdata = (char*)data;
 366         clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
 367         datalen--; /* Don't count NULL byte when passing to _start() */
 368     }
 369
 370     err = sasl_server_start(vs->sasl.conn,
 371                             vs->sasl.mechlist,
 372                             clientdata,
 373                             datalen,
 374                             &serverout,
 375                             &serveroutlen);
 376     trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err);
 377     if (err != SASL_OK &&
 378         err != SASL_CONTINUE) {
 379         trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth",
 380                             sasl_errdetail(vs->sasl.conn));
 381         sasl_dispose(&vs->sasl.conn);
 382         vs->sasl.conn = NULL;
 383         goto authabort;
 384     }
 385     if (serveroutlen > SASL_DATA_MAX_LEN) {
 386         trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
 387         sasl_dispose(&vs->sasl.conn);
 388         vs->sasl.conn = NULL;
 389         goto authabort;
 390     }
 391
 392     if (serveroutlen) {
 393         vnc_write_u32(vs, serveroutlen + 1);
 394         vnc_write(vs, serverout, serveroutlen + 1);
 395     } else {
 396         vnc_write_u32(vs, 0);
 397     }
 398
 399     /* Whether auth is complete */
 400     vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
 401
 402     if (err == SASL_CONTINUE) {
 403         /* Wait for step length */
 404         vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
 405     } else {
 406         if (!vnc_auth_sasl_check_ssf(vs)) {
 407             trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
 408             goto authreject;
 409         }
 410
 411         /* Check username whitelist ACL */
 412         if (vnc_auth_sasl_check_access(vs) < 0) {
 413             goto authreject;
 414         }
 415
 416         trace_vnc_auth_pass(vs, vs->auth);
 417         vnc_write_u32(vs, 0); /* Accept auth */
 418         start_client_init(vs);
 419     }
 420
 421     return 0;
 422
 423  authreject:
 424     vnc_write_u32(vs, 1); /* Reject auth */
 425     vnc_write_u32(vs, sizeof("Authentication failed"));
 426     vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
 427     vnc_flush(vs);
 428     vnc_client_error(vs);
 429     return -1;
 430
 431  authabort:
 432     vnc_client_error(vs);
 433     return -1;
 434 }
 435
 436 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
 437 {
 438     uint32_t startlen = read_u32(data, 0);
 439
 440     if (startlen > SASL_DATA_MAX_LEN) {
 441         trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", "");
 442         vnc_client_error(vs);
 443         return -1;
 444     }
 445
 446     if (startlen == 0)
 447         return protocol_client_auth_sasl_start(vs, NULL, 0);
 448
 449     vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
 450     return 0;
 451 }
 452
 453 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
 454 {
 455     char *mechname = g_strndup((const char *) data, len);
 456     trace_vnc_auth_sasl_mech_choose(vs, mechname);
 457
 458     if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
 459         if (vs->sasl.mechlist[len] != '\0' &&
 460             vs->sasl.mechlist[len] != ',') {
 461             goto fail;
 462         }
 463     } else {
 464         char *offset = strstr(vs->sasl.mechlist, mechname);
 465         if (!offset) {
 466             goto fail;
 467         }
 468         if (offset[-1] != ',' ||
 469             (offset[len] != '\0'&&
 470              offset[len] != ',')) {
 471             goto fail;
 472         }
 473     }
 474
 475     g_free(vs->sasl.mechlist);
 476     vs->sasl.mechlist = mechname;
 477
 478     vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
 479     return 0;
 480
 481  fail:
 482     trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname);
 483     vnc_client_error(vs);
 484     g_free(mechname);
 485     return -1;
 486 }
 487
 488 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
 489 {
 490     uint32_t mechlen = read_u32(data, 0);
 491
 492     if (mechlen > 100) {
 493         trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", "");
 494         vnc_client_error(vs);
 495         return -1;
 496     }
 497     if (mechlen < 1) {
 498         trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", "");
 499         vnc_client_error(vs);
 500         return -1;
 501     }
 502     vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
 503     return 0;
 504 }
 505
 506 static char *
 507 vnc_socket_ip_addr_string(QIOChannelSocket *ioc,
 508                           bool local,
 509                           Error **errp)
 510 {
 511     SocketAddress *addr;
 512     char *ret;
 513
 514     if (local) {
 515         addr = qio_channel_socket_get_local_address(ioc, errp);
 516     } else {
 517         addr = qio_channel_socket_get_remote_address(ioc, errp);
 518     }
 519     if (!addr) {
 520         return NULL;
 521     }
 522
 523     if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
 524         error_setg(errp, "Not an inet socket type");
 525         qapi_free_SocketAddress(addr);
 526         return NULL;
 527     }
 528     ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port);
 529     qapi_free_SocketAddress(addr);
 530     return ret;
 531 }
 532
 533 void start_auth_sasl(VncState *vs)
 534 {
 535     const char *mechlist = NULL;
 536     sasl_security_properties_t secprops;
 537     int err;
 538     Error *local_err = NULL;
 539     char *localAddr, *remoteAddr;
 540     int mechlistlen;
 541
 542     /* Get local & remote client addresses in form  IPADDR;PORT */
 543     localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err);
 544     if (!localAddr) {
 545         trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP",
 546                             error_get_pretty(local_err));
 547         goto authabort;
 548     }
 549
 550     remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err);
 551     if (!remoteAddr) {
 552         trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP",
 553                             error_get_pretty(local_err));
 554         g_free(localAddr);
 555         goto authabort;
 556     }
 557
 558     err = sasl_server_new("vnc",
 559                           NULL, /* FQDN - just delegates to gethostname */
 560                           NULL, /* User realm */
 561                           localAddr,
 562                           remoteAddr,
 563                           NULL, /* Callbacks, not needed */
 564                           SASL_SUCCESS_DATA,
 565                           &vs->sasl.conn);
 566     g_free(localAddr);
 567     g_free(remoteAddr);
 568     localAddr = remoteAddr = NULL;
 569
 570     if (err != SASL_OK) {
 571         trace_vnc_auth_fail(vs, vs->auth,  "SASL context setup failed",
 572                             sasl_errstring(err, NULL, NULL));
 573         vs->sasl.conn = NULL;
 574         goto authabort;
 575     }
 576
 577     /* Inform SASL that we've got an external SSF layer from TLS/x509 */
 578     if (vs->auth == VNC_AUTH_VENCRYPT &&
 579         vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
 580         int keysize;
 581         sasl_ssf_t ssf;
 582
 583         keysize = qcrypto_tls_session_get_key_size(vs->tls,
 584                                                    &local_err);
 585         if (keysize < 0) {
 586             trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size",
 587                                 error_get_pretty(local_err));
 588             sasl_dispose(&vs->sasl.conn);
 589             vs->sasl.conn = NULL;
 590             goto authabort;
 591         }
 592         ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */
 593
 594         err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
 595         if (err != SASL_OK) {
 596             trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF",
 597                                 sasl_errstring(err, NULL, NULL));
 598             sasl_dispose(&vs->sasl.conn);
 599             vs->sasl.conn = NULL;
 600             goto authabort;
 601         }
 602     } else {
 603         vs->sasl.wantSSF = 1;
 604     }
 605
 606     memset (&secprops, 0, sizeof secprops);
 607     /* Inform SASL that we've got an external SSF layer from TLS.
 608      *
 609      * Disable SSF, if using TLS+x509+SASL only. TLS without x509
 610      * is not sufficiently strong
 611      */
 612     if (vs->vd->is_unix ||
 613         (vs->auth == VNC_AUTH_VENCRYPT &&
 614          vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) {
 615         /* If we've got TLS or UNIX domain sock, we don't care about SSF */
 616         secprops.min_ssf = 0;
 617         secprops.max_ssf = 0;
 618         secprops.maxbufsize = 8192;
 619         secprops.security_flags = 0;
 620     } else {
 621         /* Plain TCP, better get an SSF layer */
 622         secprops.min_ssf = 56; /* Good enough to require kerberos */
 623         secprops.max_ssf = 100000; /* Arbitrary big number */
 624         secprops.maxbufsize = 8192;
 625         /* Forbid any anonymous or trivially crackable auth */
 626         secprops.security_flags =
 627             SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
 628     }
 629
 630     err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
 631     if (err != SASL_OK) {
 632         trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props",
 633                             sasl_errstring(err, NULL, NULL));
 634         sasl_dispose(&vs->sasl.conn);
 635         vs->sasl.conn = NULL;
 636         goto authabort;
 637     }
 638
 639     err = sasl_listmech(vs->sasl.conn,
 640                         NULL, /* Don't need to set user */
 641                         "", /* Prefix */
 642                         ",", /* Separator */
 643                         "", /* Suffix */
 644                         &mechlist,
 645                         NULL,
 646                         NULL);
 647     if (err != SASL_OK) {
 648         trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms",
 649                             sasl_errdetail(vs->sasl.conn));
 650         sasl_dispose(&vs->sasl.conn);
 651         vs->sasl.conn = NULL;
 652         goto authabort;
 653     }
 654     trace_vnc_auth_sasl_mech_list(vs, mechlist);
 655
 656     vs->sasl.mechlist = g_strdup(mechlist);
 657     mechlistlen = strlen(mechlist);
 658     vnc_write_u32(vs, mechlistlen);
 659     vnc_write(vs, mechlist, mechlistlen);
 660     vnc_flush(vs);
 661
 662     vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
 663
 664     return;
 665
 666  authabort:
 667     error_free(local_err);
 668     vnc_client_error(vs);
 669 }
 670
 671