2 * QEMU VNC display driver: SASL auth protocol
4 * Copyright (C) 2009 Red Hat, Inc
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 /* Max amount of data we send/recv for SASL steps to prevent DOS */
28 #define SASL_DATA_MAX_LEN (1024 * 1024)
31 void vnc_sasl_client_cleanup(VncState
*vs
)
34 vs
->sasl
.runSSF
= vs
->sasl
.waitWriteSSF
= vs
->sasl
.wantSSF
= 0;
35 vs
->sasl
.encodedLength
= vs
->sasl
.encodedOffset
= 0;
36 vs
->sasl
.encoded
= NULL
;
37 free(vs
->sasl
.username
);
38 free(vs
->sasl
.mechlist
);
39 vs
->sasl
.username
= vs
->sasl
.mechlist
= NULL
;
40 sasl_dispose(&vs
->sasl
.conn
);
46 long vnc_client_write_sasl(VncState
*vs
)
50 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
51 "Encoded: %p size %d offset %d\n",
52 vs
->output
.buffer
, vs
->output
.capacity
, vs
->output
.offset
,
53 vs
->sasl
.encoded
, vs
->sasl
.encodedLength
, vs
->sasl
.encodedOffset
);
55 if (!vs
->sasl
.encoded
) {
57 err
= sasl_encode(vs
->sasl
.conn
,
58 (char *)vs
->output
.buffer
,
60 (const char **)&vs
->sasl
.encoded
,
61 &vs
->sasl
.encodedLength
);
63 return vnc_client_io_error(vs
, -1, EIO
);
65 vs
->sasl
.encodedOffset
= 0;
68 ret
= vnc_client_write_buf(vs
,
69 vs
->sasl
.encoded
+ vs
->sasl
.encodedOffset
,
70 vs
->sasl
.encodedLength
- vs
->sasl
.encodedOffset
);
74 vs
->sasl
.encodedOffset
+= ret
;
75 if (vs
->sasl
.encodedOffset
== vs
->sasl
.encodedLength
) {
76 vs
->output
.offset
= 0;
77 vs
->sasl
.encoded
= NULL
;
78 vs
->sasl
.encodedOffset
= vs
->sasl
.encodedLength
= 0;
81 /* Can't merge this block with one above, because
82 * someone might have written more unencrypted
83 * data in vs->output while we were processing
86 if (vs
->output
.offset
== 0) {
87 qemu_set_fd_handler2(vs
->csock
, NULL
, vnc_client_read
, NULL
, vs
);
94 long vnc_client_read_sasl(VncState
*vs
)
97 uint8_t encoded
[4096];
99 unsigned int decodedLen
;
102 ret
= vnc_client_read_buf(vs
, encoded
, sizeof(encoded
));
106 err
= sasl_decode(vs
->sasl
.conn
,
107 (char *)encoded
, ret
,
108 &decoded
, &decodedLen
);
111 return vnc_client_io_error(vs
, -1, -EIO
);
112 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
113 encoded
, ret
, decoded
, decodedLen
);
114 buffer_reserve(&vs
->input
, decodedLen
);
115 buffer_append(&vs
->input
, decoded
, decodedLen
);
120 static int vnc_auth_sasl_check_access(VncState
*vs
)
126 err
= sasl_getprop(vs
->sasl
.conn
, SASL_USERNAME
, &val
);
127 if (err
!= SASL_OK
) {
128 VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
129 err
, sasl_errstring(err
, NULL
, NULL
));
133 VNC_DEBUG("no client username was found, denying access\n");
136 VNC_DEBUG("SASL client username %s\n", (const char *)val
);
138 vs
->sasl
.username
= qemu_strdup((const char*)val
);
140 if (vs
->vd
->sasl
.acl
== NULL
) {
141 VNC_DEBUG("no ACL activated, allowing access\n");
145 allow
= qemu_acl_party_is_allowed(vs
->vd
->sasl
.acl
, vs
->sasl
.username
);
147 VNC_DEBUG("SASL client %s %s by ACL\n", vs
->sasl
.username
,
148 allow
? "allowed" : "denied");
149 return allow
? 0 : -1;
152 static int vnc_auth_sasl_check_ssf(VncState
*vs
)
157 if (!vs
->sasl
.wantSSF
)
160 err
= sasl_getprop(vs
->sasl
.conn
, SASL_SSF
, &val
);
164 ssf
= *(const int *)val
;
165 VNC_DEBUG("negotiated an SSF of %d\n", ssf
);
167 return 0; /* 56 is good for Kerberos */
169 /* Only setup for read initially, because we're about to send an RPC
170 * reply which must be in plain text. When the next incoming RPC
171 * arrives, we'll switch on writes too
173 * cf qemudClientReadSASL in qemud.c
177 /* We have a SSF that's good enough */
186 * u32 clientin-length
187 * u8-array clientin-string
191 * u32 serverout-length
192 * u8-array serverout-strin
196 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
);
198 static int protocol_client_auth_sasl_step(VncState
*vs
, uint8_t *data
, size_t len
)
200 uint32_t datalen
= len
;
201 const char *serverout
;
202 unsigned int serveroutlen
;
204 char *clientdata
= NULL
;
206 /* NB, distinction of NULL vs "" is *critical* in SASL */
208 clientdata
= (char*)data
;
209 clientdata
[datalen
-1] = '\0'; /* Wire includes '\0', but make sure */
210 datalen
--; /* Don't count NULL byte when passing to _start() */
213 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
214 clientdata
, datalen
);
215 err
= sasl_server_step(vs
->sasl
.conn
,
220 if (err
!= SASL_OK
&&
221 err
!= SASL_CONTINUE
) {
222 VNC_DEBUG("sasl step failed %d (%s)\n",
223 err
, sasl_errdetail(vs
->sasl
.conn
));
224 sasl_dispose(&vs
->sasl
.conn
);
225 vs
->sasl
.conn
= NULL
;
229 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
230 VNC_DEBUG("sasl step reply data too long %d\n",
232 sasl_dispose(&vs
->sasl
.conn
);
233 vs
->sasl
.conn
= NULL
;
237 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
238 serveroutlen
, serverout
? 0 : 1);
241 vnc_write_u32(vs
, serveroutlen
+ 1);
242 vnc_write(vs
, serverout
, serveroutlen
+ 1);
244 vnc_write_u32(vs
, 0);
247 /* Whether auth is complete */
248 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
250 if (err
== SASL_CONTINUE
) {
251 VNC_DEBUG("%s", "Authentication must continue\n");
252 /* Wait for step length */
253 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
255 if (!vnc_auth_sasl_check_ssf(vs
)) {
256 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs
->csock
);
260 /* Check username whitelist ACL */
261 if (vnc_auth_sasl_check_access(vs
) < 0) {
262 VNC_DEBUG("Authentication rejected for ACL %d\n", vs
->csock
);
266 VNC_DEBUG("Authentication successful %d\n", vs
->csock
);
267 vnc_write_u32(vs
, 0); /* Accept auth */
269 * Delay writing in SSF encoded mode until pending output
273 vs
->sasl
.waitWriteSSF
= vs
->output
.offset
;
274 start_client_init(vs
);
280 vnc_write_u32(vs
, 1); /* Reject auth */
281 vnc_write_u32(vs
, sizeof("Authentication failed"));
282 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
284 vnc_client_error(vs
);
288 vnc_client_error(vs
);
292 static int protocol_client_auth_sasl_step_len(VncState
*vs
, uint8_t *data
, size_t len
)
294 uint32_t steplen
= read_u32(data
, 0);
295 VNC_DEBUG("Got client step len %d\n", steplen
);
296 if (steplen
> SASL_DATA_MAX_LEN
) {
297 VNC_DEBUG("Too much SASL data %d\n", steplen
);
298 vnc_client_error(vs
);
303 return protocol_client_auth_sasl_step(vs
, NULL
, 0);
305 vnc_read_when(vs
, protocol_client_auth_sasl_step
, steplen
);
314 * u32 clientin-length
315 * u8-array clientin-string
319 * u32 serverout-length
320 * u8-array serverout-strin
324 #define SASL_DATA_MAX_LEN (1024 * 1024)
326 static int protocol_client_auth_sasl_start(VncState
*vs
, uint8_t *data
, size_t len
)
328 uint32_t datalen
= len
;
329 const char *serverout
;
330 unsigned int serveroutlen
;
332 char *clientdata
= NULL
;
334 /* NB, distinction of NULL vs "" is *critical* in SASL */
336 clientdata
= (char*)data
;
337 clientdata
[datalen
-1] = '\0'; /* Should be on wire, but make sure */
338 datalen
--; /* Don't count NULL byte when passing to _start() */
341 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
342 vs
->sasl
.mechlist
, clientdata
, datalen
);
343 err
= sasl_server_start(vs
->sasl
.conn
,
349 if (err
!= SASL_OK
&&
350 err
!= SASL_CONTINUE
) {
351 VNC_DEBUG("sasl start failed %d (%s)\n",
352 err
, sasl_errdetail(vs
->sasl
.conn
));
353 sasl_dispose(&vs
->sasl
.conn
);
354 vs
->sasl
.conn
= NULL
;
357 if (serveroutlen
> SASL_DATA_MAX_LEN
) {
358 VNC_DEBUG("sasl start reply data too long %d\n",
360 sasl_dispose(&vs
->sasl
.conn
);
361 vs
->sasl
.conn
= NULL
;
365 VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
366 serveroutlen
, serverout
? 0 : 1);
369 vnc_write_u32(vs
, serveroutlen
+ 1);
370 vnc_write(vs
, serverout
, serveroutlen
+ 1);
372 vnc_write_u32(vs
, 0);
375 /* Whether auth is complete */
376 vnc_write_u8(vs
, err
== SASL_CONTINUE
? 0 : 1);
378 if (err
== SASL_CONTINUE
) {
379 VNC_DEBUG("%s", "Authentication must continue\n");
380 /* Wait for step length */
381 vnc_read_when(vs
, protocol_client_auth_sasl_step_len
, 4);
383 if (!vnc_auth_sasl_check_ssf(vs
)) {
384 VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs
->csock
);
388 /* Check username whitelist ACL */
389 if (vnc_auth_sasl_check_access(vs
) < 0) {
390 VNC_DEBUG("Authentication rejected for ACL %d\n", vs
->csock
);
394 VNC_DEBUG("Authentication successful %d\n", vs
->csock
);
395 vnc_write_u32(vs
, 0); /* Accept auth */
396 start_client_init(vs
);
402 vnc_write_u32(vs
, 1); /* Reject auth */
403 vnc_write_u32(vs
, sizeof("Authentication failed"));
404 vnc_write(vs
, "Authentication failed", sizeof("Authentication failed"));
406 vnc_client_error(vs
);
410 vnc_client_error(vs
);
414 static int protocol_client_auth_sasl_start_len(VncState
*vs
, uint8_t *data
, size_t len
)
416 uint32_t startlen
= read_u32(data
, 0);
417 VNC_DEBUG("Got client start len %d\n", startlen
);
418 if (startlen
> SASL_DATA_MAX_LEN
) {
419 VNC_DEBUG("Too much SASL data %d\n", startlen
);
420 vnc_client_error(vs
);
425 return protocol_client_auth_sasl_start(vs
, NULL
, 0);
427 vnc_read_when(vs
, protocol_client_auth_sasl_start
, startlen
);
431 static int protocol_client_auth_sasl_mechname(VncState
*vs
, uint8_t *data
, size_t len
)
433 char *mechname
= malloc(len
+ 1);
435 VNC_DEBUG("Out of memory reading mechname\n");
436 vnc_client_error(vs
);
438 strncpy(mechname
, (char*)data
, len
);
439 mechname
[len
] = '\0';
440 VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
441 mechname
, vs
->sasl
.mechlist
);
443 if (strncmp(vs
->sasl
.mechlist
, mechname
, len
) == 0) {
444 if (vs
->sasl
.mechlist
[len
] != '\0' &&
445 vs
->sasl
.mechlist
[len
] != ',') {
446 VNC_DEBUG("One %d", vs
->sasl
.mechlist
[len
]);
450 char *offset
= strstr(vs
->sasl
.mechlist
, mechname
);
451 VNC_DEBUG("Two %p\n", offset
);
455 VNC_DEBUG("Two '%s'\n", offset
);
456 if (offset
[-1] != ',' ||
457 (offset
[len
] != '\0'&&
458 offset
[len
] != ',')) {
463 free(vs
->sasl
.mechlist
);
464 vs
->sasl
.mechlist
= mechname
;
466 VNC_DEBUG("Validated mechname '%s'\n", mechname
);
467 vnc_read_when(vs
, protocol_client_auth_sasl_start_len
, 4);
471 vnc_client_error(vs
);
476 static int protocol_client_auth_sasl_mechname_len(VncState
*vs
, uint8_t *data
, size_t len
)
478 uint32_t mechlen
= read_u32(data
, 0);
479 VNC_DEBUG("Got client mechname len %d\n", mechlen
);
481 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen
);
482 vnc_client_error(vs
);
486 VNC_DEBUG("Too short SASL mechname %d\n", mechlen
);
487 vnc_client_error(vs
);
490 vnc_read_when(vs
, protocol_client_auth_sasl_mechname
,mechlen
);
494 #define USES_X509_AUTH(vs) \
495 ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
496 (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
497 (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \
498 (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
501 void start_auth_sasl(VncState
*vs
)
503 const char *mechlist
= NULL
;
504 sasl_security_properties_t secprops
;
506 char *localAddr
, *remoteAddr
;
509 VNC_DEBUG("Initialize SASL auth %d\n", vs
->csock
);
511 /* Get local & remote client addresses in form IPADDR;PORT */
512 if (!(localAddr
= vnc_socket_local_addr("%s;%s", vs
->csock
)))
515 if (!(remoteAddr
= vnc_socket_remote_addr("%s;%s", vs
->csock
))) {
520 err
= sasl_server_new("vnc",
521 NULL
, /* FQDN - just delegates to gethostname */
522 NULL
, /* User realm */
525 NULL
, /* Callbacks, not needed */
530 localAddr
= remoteAddr
= NULL
;
532 if (err
!= SASL_OK
) {
533 VNC_DEBUG("sasl context setup failed %d (%s)",
534 err
, sasl_errstring(err
, NULL
, NULL
));
535 vs
->sasl
.conn
= NULL
;
539 #ifdef CONFIG_VNC_TLS
540 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
541 if (vs
->vd
->auth
== VNC_AUTH_VENCRYPT
&&
542 vs
->vd
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
) {
543 gnutls_cipher_algorithm_t cipher
;
546 cipher
= gnutls_cipher_get(vs
->tls
.session
);
547 if (!(ssf
= (sasl_ssf_t
)gnutls_cipher_get_key_size(cipher
))) {
548 VNC_DEBUG("%s", "cannot TLS get cipher size\n");
549 sasl_dispose(&vs
->sasl
.conn
);
550 vs
->sasl
.conn
= NULL
;
553 ssf
*= 8; /* tls key size is bytes, sasl wants bits */
555 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SSF_EXTERNAL
, &ssf
);
556 if (err
!= SASL_OK
) {
557 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
558 err
, sasl_errstring(err
, NULL
, NULL
));
559 sasl_dispose(&vs
->sasl
.conn
);
560 vs
->sasl
.conn
= NULL
;
564 #endif /* CONFIG_VNC_TLS */
565 vs
->sasl
.wantSSF
= 1;
567 memset (&secprops
, 0, sizeof secprops
);
568 /* Inform SASL that we've got an external SSF layer from TLS */
569 if (strncmp(vs
->vd
->display
, "unix:", 5) == 0
570 #ifdef CONFIG_VNC_TLS
571 /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
572 is not sufficiently strong */
573 || (vs
->vd
->auth
== VNC_AUTH_VENCRYPT
&&
574 vs
->vd
->subauth
== VNC_AUTH_VENCRYPT_X509SASL
)
575 #endif /* CONFIG_VNC_TLS */
577 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
578 secprops
.min_ssf
= 0;
579 secprops
.max_ssf
= 0;
580 secprops
.maxbufsize
= 8192;
581 secprops
.security_flags
= 0;
583 /* Plain TCP, better get an SSF layer */
584 secprops
.min_ssf
= 56; /* Good enough to require kerberos */
585 secprops
.max_ssf
= 100000; /* Arbitrary big number */
586 secprops
.maxbufsize
= 8192;
587 /* Forbid any anonymous or trivially crackable auth */
588 secprops
.security_flags
=
589 SASL_SEC_NOANONYMOUS
| SASL_SEC_NOPLAINTEXT
;
592 err
= sasl_setprop(vs
->sasl
.conn
, SASL_SEC_PROPS
, &secprops
);
593 if (err
!= SASL_OK
) {
594 VNC_DEBUG("cannot set SASL security props %d (%s)\n",
595 err
, sasl_errstring(err
, NULL
, NULL
));
596 sasl_dispose(&vs
->sasl
.conn
);
597 vs
->sasl
.conn
= NULL
;
601 err
= sasl_listmech(vs
->sasl
.conn
,
602 NULL
, /* Don't need to set user */
609 if (err
!= SASL_OK
) {
610 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
611 err
, sasl_errdetail(vs
->sasl
.conn
));
612 sasl_dispose(&vs
->sasl
.conn
);
613 vs
->sasl
.conn
= NULL
;
616 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist
);
618 if (!(vs
->sasl
.mechlist
= strdup(mechlist
))) {
619 VNC_DEBUG("Out of memory");
620 sasl_dispose(&vs
->sasl
.conn
);
621 vs
->sasl
.conn
= NULL
;
624 mechlistlen
= strlen(mechlist
);
625 vnc_write_u32(vs
, mechlistlen
);
626 vnc_write(vs
, mechlist
, mechlistlen
);
629 VNC_DEBUG("Wait for client mechname length\n");
630 vnc_read_when(vs
, protocol_client_auth_sasl_mechname_len
, 4);
635 vnc_client_error(vs
);