blob: 47fdae5b215b93b7ea3c9c52ce7bdeee051e9dfc [file] [log] [blame]
aliguori2f9606b2009-03-06 20:27:28 +00001/*
2 * QEMU VNC display driver: SASL auth protocol
3 *
4 * Copyright (C) 2009 Red Hat, Inc
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
Peter Maydelle16f4c82016-01-29 17:49:51 +000025#include "qemu/osdep.h"
Markus Armbrusterda34e652016-03-14 09:01:28 +010026#include "qapi/error.h"
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +000027#include "authz/base.h"
aliguori2f9606b2009-03-06 20:27:28 +000028#include "vnc.h"
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +010029#include "trace.h"
aliguori2f9606b2009-03-06 20:27:28 +000030
Paolo Bonzinib65310a2021-06-04 14:09:15 +020031/*
32 * Apple has deprecated sasl.h functions in OS X 10.11. Therefore,
33 * files that use SASL API need to disable -Wdeprecated-declarations.
34 */
35#ifdef CONFIG_DARWIN
36#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
37#endif
38
aliguori2f9606b2009-03-06 20:27:28 +000039/* Max amount of data we send/recv for SASL steps to prevent DOS */
40#define SASL_DATA_MAX_LEN (1024 * 1024)
41
42
Paolo Bonzinib65310a2021-06-04 14:09:15 +020043bool vnc_sasl_server_init(Error **errp)
44{
45 int saslErr = sasl_server_init(NULL, "qemu");
46
47 if (saslErr != SASL_OK) {
48 error_setg(errp, "Failed to initialize SASL auth: %s",
49 sasl_errstring(saslErr, NULL, NULL));
50 return false;
51 }
52 return true;
53}
54
aliguori2f9606b2009-03-06 20:27:28 +000055void vnc_sasl_client_cleanup(VncState *vs)
56{
57 if (vs->sasl.conn) {
Stefan Weilee032ca2012-03-08 22:58:06 +010058 vs->sasl.runSSF = false;
59 vs->sasl.wantSSF = false;
60 vs->sasl.waitWriteSSF = 0;
aliguori28a76be2009-03-06 20:27:40 +000061 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
62 vs->sasl.encoded = NULL;
Stefan Weilae878b12011-10-07 21:15:20 +020063 g_free(vs->sasl.username);
Markus Armbruster302d9d62011-11-08 13:45:21 +010064 g_free(vs->sasl.mechlist);
aliguori28a76be2009-03-06 20:27:40 +000065 vs->sasl.username = vs->sasl.mechlist = NULL;
66 sasl_dispose(&vs->sasl.conn);
67 vs->sasl.conn = NULL;
aliguori2f9606b2009-03-06 20:27:28 +000068 }
69}
70
71
Daniel P. Berrange30b80fd2017-12-18 19:12:28 +000072size_t vnc_client_write_sasl(VncState *vs)
aliguori2f9606b2009-03-06 20:27:28 +000073{
Daniel P. Berrange30b80fd2017-12-18 19:12:28 +000074 size_t ret;
aliguori2f9606b2009-03-06 20:27:28 +000075
Corentin Charybc47d202010-05-03 14:31:18 +020076 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
77 "Encoded: %p size %d offset %d\n",
aliguori28a76be2009-03-06 20:27:40 +000078 vs->output.buffer, vs->output.capacity, vs->output.offset,
79 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
aliguori2f9606b2009-03-06 20:27:28 +000080
81 if (!vs->sasl.encoded) {
aliguori28a76be2009-03-06 20:27:40 +000082 int err;
83 err = sasl_encode(vs->sasl.conn,
84 (char *)vs->output.buffer,
85 vs->output.offset,
86 (const char **)&vs->sasl.encoded,
87 &vs->sasl.encodedLength);
88 if (err != SASL_OK)
Daniel P. Berrange04d25292015-02-27 16:20:57 +000089 return vnc_client_io_error(vs, -1, NULL);
aliguori2f9606b2009-03-06 20:27:28 +000090
Daniel P. Berrange8f61f1c2017-12-18 19:12:20 +000091 vs->sasl.encodedRawLength = vs->output.offset;
aliguori28a76be2009-03-06 20:27:40 +000092 vs->sasl.encodedOffset = 0;
aliguori2f9606b2009-03-06 20:27:28 +000093 }
94
95 ret = vnc_client_write_buf(vs,
aliguori28a76be2009-03-06 20:27:40 +000096 vs->sasl.encoded + vs->sasl.encodedOffset,
97 vs->sasl.encodedLength - vs->sasl.encodedOffset);
aliguori2f9606b2009-03-06 20:27:28 +000098 if (!ret)
aliguori28a76be2009-03-06 20:27:40 +000099 return 0;
aliguori2f9606b2009-03-06 20:27:28 +0000100
101 vs->sasl.encodedOffset += ret;
102 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
Daniel P. Berrangéd50f09f2018-02-05 11:49:38 +0000103 bool throttled = vs->force_update_offset != 0;
104 size_t offset;
Daniel P. Berrangeada8d2e2017-12-18 19:12:25 +0000105 if (vs->sasl.encodedRawLength >= vs->force_update_offset) {
106 vs->force_update_offset = 0;
107 } else {
108 vs->force_update_offset -= vs->sasl.encodedRawLength;
109 }
Daniel P. Berrangéd50f09f2018-02-05 11:49:38 +0000110 if (throttled && vs->force_update_offset == 0) {
111 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
112 }
113 offset = vs->output.offset;
Daniel P. Berrangé627ebec2018-02-01 15:58:41 +0000114 buffer_advance(&vs->output, vs->sasl.encodedRawLength);
Daniel P. Berrangéd50f09f2018-02-05 11:49:38 +0000115 if (offset >= vs->throttle_output_offset &&
116 vs->output.offset < vs->throttle_output_offset) {
117 trace_vnc_client_unthrottle_incremental(vs, vs->ioc,
118 vs->output.offset);
119 }
aliguori28a76be2009-03-06 20:27:40 +0000120 vs->sasl.encoded = NULL;
121 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
aliguori2f9606b2009-03-06 20:27:28 +0000122 }
123
124 /* Can't merge this block with one above, because
125 * someone might have written more unencrypted
126 * data in vs->output while we were processing
127 * SASL encoded output
128 */
129 if (vs->output.offset == 0) {
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000130 if (vs->ioc_tag) {
131 g_source_remove(vs->ioc_tag);
132 }
133 vs->ioc_tag = qio_channel_add_watch(
Ding Hui2ddafce2020-10-29 11:22:41 +0800134 vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR,
135 vnc_client_io, vs, NULL);
aliguori2f9606b2009-03-06 20:27:28 +0000136 }
137
138 return ret;
139}
140
141
Daniel P. Berrange30b80fd2017-12-18 19:12:28 +0000142size_t vnc_client_read_sasl(VncState *vs)
aliguori2f9606b2009-03-06 20:27:28 +0000143{
Daniel P. Berrange30b80fd2017-12-18 19:12:28 +0000144 size_t ret;
aliguori2f9606b2009-03-06 20:27:28 +0000145 uint8_t encoded[4096];
146 const char *decoded;
147 unsigned int decodedLen;
148 int err;
149
150 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
151 if (!ret)
aliguori28a76be2009-03-06 20:27:40 +0000152 return 0;
aliguori2f9606b2009-03-06 20:27:28 +0000153
154 err = sasl_decode(vs->sasl.conn,
aliguori28a76be2009-03-06 20:27:40 +0000155 (char *)encoded, ret,
156 &decoded, &decodedLen);
aliguori2f9606b2009-03-06 20:27:28 +0000157
158 if (err != SASL_OK)
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000159 return vnc_client_io_error(vs, -1, NULL);
aliguori2f9606b2009-03-06 20:27:28 +0000160 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
aliguori28a76be2009-03-06 20:27:40 +0000161 encoded, ret, decoded, decodedLen);
aliguori2f9606b2009-03-06 20:27:28 +0000162 buffer_reserve(&vs->input, decodedLen);
163 buffer_append(&vs->input, decoded, decodedLen);
164 return decodedLen;
165}
166
167
168static int vnc_auth_sasl_check_access(VncState *vs)
169{
170 const void *val;
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +0000171 int rv;
172 Error *err = NULL;
173 bool allow;
aliguori2f9606b2009-03-06 20:27:28 +0000174
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +0000175 rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
176 if (rv != SASL_OK) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100177 trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username",
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +0000178 sasl_errstring(rv, NULL, NULL));
aliguori28a76be2009-03-06 20:27:40 +0000179 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000180 }
181 if (val == NULL) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100182 trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", "");
aliguori28a76be2009-03-06 20:27:40 +0000183 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000184 }
aliguori2f9606b2009-03-06 20:27:28 +0000185
Anthony Liguori7267c092011-08-20 22:09:37 -0500186 vs->sasl.username = g_strdup((const char*)val);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100187 trace_vnc_auth_sasl_username(vs, vs->sasl.username);
aliguori2f9606b2009-03-06 20:27:28 +0000188
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +0000189 if (vs->vd->sasl.authzid == NULL) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100190 trace_vnc_auth_sasl_acl(vs, 1);
aliguori28a76be2009-03-06 20:27:40 +0000191 return 0;
aliguori76655d62009-03-06 20:27:37 +0000192 }
193
Daniel P. Berrangeb76806d2016-02-18 18:40:24 +0000194 allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid,
195 vs->sasl.username, &err);
196 if (err) {
197 trace_vnc_auth_fail(vs, vs->auth, "Error from authz",
198 error_get_pretty(err));
199 error_free(err);
200 return -1;
201 }
aliguori76655d62009-03-06 20:27:37 +0000202
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100203 trace_vnc_auth_sasl_acl(vs, allow);
aliguori76655d62009-03-06 20:27:37 +0000204 return allow ? 0 : -1;
aliguori2f9606b2009-03-06 20:27:28 +0000205}
206
207static int vnc_auth_sasl_check_ssf(VncState *vs)
208{
209 const void *val;
210 int err, ssf;
211
212 if (!vs->sasl.wantSSF)
aliguori28a76be2009-03-06 20:27:40 +0000213 return 1;
aliguori2f9606b2009-03-06 20:27:28 +0000214
215 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
216 if (err != SASL_OK)
aliguori28a76be2009-03-06 20:27:40 +0000217 return 0;
aliguori2f9606b2009-03-06 20:27:28 +0000218
219 ssf = *(const int *)val;
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100220
221 trace_vnc_auth_sasl_ssf(vs, ssf);
222
aliguori2f9606b2009-03-06 20:27:28 +0000223 if (ssf < 56)
aliguori28a76be2009-03-06 20:27:40 +0000224 return 0; /* 56 is good for Kerberos */
aliguori2f9606b2009-03-06 20:27:28 +0000225
226 /* Only setup for read initially, because we're about to send an RPC
227 * reply which must be in plain text. When the next incoming RPC
228 * arrives, we'll switch on writes too
229 *
230 * cf qemudClientReadSASL in qemud.c
231 */
232 vs->sasl.runSSF = 1;
233
234 /* We have a SSF that's good enough */
235 return 1;
236}
237
238/*
239 * Step Msg
240 *
241 * Input from client:
242 *
243 * u32 clientin-length
244 * u8-array clientin-string
245 *
246 * Output to client:
247 *
248 * u32 serverout-length
249 * u8-array serverout-strin
250 * u8 continue
251 */
252
253static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
254
255static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
256{
257 uint32_t datalen = len;
258 const char *serverout;
259 unsigned int serveroutlen;
260 int err;
261 char *clientdata = NULL;
262
263 /* NB, distinction of NULL vs "" is *critical* in SASL */
264 if (datalen) {
aliguori28a76be2009-03-06 20:27:40 +0000265 clientdata = (char*)data;
266 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
267 datalen--; /* Don't count NULL byte when passing to _start() */
aliguori2f9606b2009-03-06 20:27:28 +0000268 }
269
aliguori2f9606b2009-03-06 20:27:28 +0000270 err = sasl_server_step(vs->sasl.conn,
aliguori28a76be2009-03-06 20:27:40 +0000271 clientdata,
272 datalen,
273 &serverout,
274 &serveroutlen);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100275 trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err);
aliguori2f9606b2009-03-06 20:27:28 +0000276 if (err != SASL_OK &&
aliguori28a76be2009-03-06 20:27:40 +0000277 err != SASL_CONTINUE) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100278 trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth",
279 sasl_errdetail(vs->sasl.conn));
aliguori28a76be2009-03-06 20:27:40 +0000280 sasl_dispose(&vs->sasl.conn);
281 vs->sasl.conn = NULL;
282 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000283 }
284
285 if (serveroutlen > SASL_DATA_MAX_LEN) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100286 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
aliguori28a76be2009-03-06 20:27:40 +0000287 sasl_dispose(&vs->sasl.conn);
288 vs->sasl.conn = NULL;
289 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000290 }
291
aliguori2f9606b2009-03-06 20:27:28 +0000292 if (serveroutlen) {
aliguori28a76be2009-03-06 20:27:40 +0000293 vnc_write_u32(vs, serveroutlen + 1);
294 vnc_write(vs, serverout, serveroutlen + 1);
aliguori2f9606b2009-03-06 20:27:28 +0000295 } else {
aliguori28a76be2009-03-06 20:27:40 +0000296 vnc_write_u32(vs, 0);
aliguori2f9606b2009-03-06 20:27:28 +0000297 }
298
299 /* Whether auth is complete */
300 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
301
302 if (err == SASL_CONTINUE) {
aliguori28a76be2009-03-06 20:27:40 +0000303 /* Wait for step length */
304 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
aliguori2f9606b2009-03-06 20:27:28 +0000305 } else {
aliguori28a76be2009-03-06 20:27:40 +0000306 if (!vnc_auth_sasl_check_ssf(vs)) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100307 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
aliguori28a76be2009-03-06 20:27:40 +0000308 goto authreject;
309 }
aliguori2f9606b2009-03-06 20:27:28 +0000310
Philippe Mathieu-Daudé75ae7c42021-03-03 19:46:40 +0100311 /* Check the username access control list */
aliguori28a76be2009-03-06 20:27:40 +0000312 if (vnc_auth_sasl_check_access(vs) < 0) {
aliguori28a76be2009-03-06 20:27:40 +0000313 goto authreject;
314 }
aliguori2f9606b2009-03-06 20:27:28 +0000315
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100316 trace_vnc_auth_pass(vs, vs->auth);
aliguori28a76be2009-03-06 20:27:40 +0000317 vnc_write_u32(vs, 0); /* Accept auth */
318 /*
319 * Delay writing in SSF encoded mode until pending output
320 * buffer is written
321 */
322 if (vs->sasl.runSSF)
323 vs->sasl.waitWriteSSF = vs->output.offset;
324 start_client_init(vs);
aliguori2f9606b2009-03-06 20:27:28 +0000325 }
326
327 return 0;
328
329 authreject:
330 vnc_write_u32(vs, 1); /* Reject auth */
331 vnc_write_u32(vs, sizeof("Authentication failed"));
332 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
333 vnc_flush(vs);
334 vnc_client_error(vs);
335 return -1;
336
337 authabort:
338 vnc_client_error(vs);
339 return -1;
340}
341
342static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
343{
344 uint32_t steplen = read_u32(data, 0);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100345
aliguori2f9606b2009-03-06 20:27:28 +0000346 if (steplen > SASL_DATA_MAX_LEN) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100347 trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", "");
aliguori28a76be2009-03-06 20:27:40 +0000348 vnc_client_error(vs);
349 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000350 }
351
352 if (steplen == 0)
aliguori28a76be2009-03-06 20:27:40 +0000353 return protocol_client_auth_sasl_step(vs, NULL, 0);
aliguori2f9606b2009-03-06 20:27:28 +0000354 else
aliguori28a76be2009-03-06 20:27:40 +0000355 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
aliguori2f9606b2009-03-06 20:27:28 +0000356 return 0;
357}
358
359/*
360 * Start Msg
361 *
362 * Input from client:
363 *
364 * u32 clientin-length
365 * u8-array clientin-string
366 *
367 * Output to client:
368 *
369 * u32 serverout-length
370 * u8-array serverout-strin
371 * u8 continue
372 */
373
374#define SASL_DATA_MAX_LEN (1024 * 1024)
375
376static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
377{
378 uint32_t datalen = len;
379 const char *serverout;
380 unsigned int serveroutlen;
381 int err;
382 char *clientdata = NULL;
383
384 /* NB, distinction of NULL vs "" is *critical* in SASL */
385 if (datalen) {
aliguori28a76be2009-03-06 20:27:40 +0000386 clientdata = (char*)data;
387 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
388 datalen--; /* Don't count NULL byte when passing to _start() */
aliguori2f9606b2009-03-06 20:27:28 +0000389 }
390
aliguori2f9606b2009-03-06 20:27:28 +0000391 err = sasl_server_start(vs->sasl.conn,
aliguori28a76be2009-03-06 20:27:40 +0000392 vs->sasl.mechlist,
393 clientdata,
394 datalen,
395 &serverout,
396 &serveroutlen);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100397 trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err);
aliguori2f9606b2009-03-06 20:27:28 +0000398 if (err != SASL_OK &&
aliguori28a76be2009-03-06 20:27:40 +0000399 err != SASL_CONTINUE) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100400 trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth",
401 sasl_errdetail(vs->sasl.conn));
aliguori28a76be2009-03-06 20:27:40 +0000402 sasl_dispose(&vs->sasl.conn);
403 vs->sasl.conn = NULL;
404 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000405 }
406 if (serveroutlen > SASL_DATA_MAX_LEN) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100407 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
aliguori28a76be2009-03-06 20:27:40 +0000408 sasl_dispose(&vs->sasl.conn);
409 vs->sasl.conn = NULL;
410 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000411 }
412
aliguori2f9606b2009-03-06 20:27:28 +0000413 if (serveroutlen) {
aliguori28a76be2009-03-06 20:27:40 +0000414 vnc_write_u32(vs, serveroutlen + 1);
415 vnc_write(vs, serverout, serveroutlen + 1);
aliguori2f9606b2009-03-06 20:27:28 +0000416 } else {
aliguori28a76be2009-03-06 20:27:40 +0000417 vnc_write_u32(vs, 0);
aliguori2f9606b2009-03-06 20:27:28 +0000418 }
419
420 /* Whether auth is complete */
421 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
422
423 if (err == SASL_CONTINUE) {
aliguori28a76be2009-03-06 20:27:40 +0000424 /* Wait for step length */
425 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
aliguori2f9606b2009-03-06 20:27:28 +0000426 } else {
aliguori28a76be2009-03-06 20:27:40 +0000427 if (!vnc_auth_sasl_check_ssf(vs)) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100428 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
aliguori28a76be2009-03-06 20:27:40 +0000429 goto authreject;
430 }
aliguori2f9606b2009-03-06 20:27:28 +0000431
Philippe Mathieu-Daudé75ae7c42021-03-03 19:46:40 +0100432 /* Check the username access control list */
aliguori28a76be2009-03-06 20:27:40 +0000433 if (vnc_auth_sasl_check_access(vs) < 0) {
aliguori28a76be2009-03-06 20:27:40 +0000434 goto authreject;
435 }
aliguori2f9606b2009-03-06 20:27:28 +0000436
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100437 trace_vnc_auth_pass(vs, vs->auth);
aliguori28a76be2009-03-06 20:27:40 +0000438 vnc_write_u32(vs, 0); /* Accept auth */
439 start_client_init(vs);
aliguori2f9606b2009-03-06 20:27:28 +0000440 }
441
442 return 0;
443
444 authreject:
445 vnc_write_u32(vs, 1); /* Reject auth */
446 vnc_write_u32(vs, sizeof("Authentication failed"));
447 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
448 vnc_flush(vs);
449 vnc_client_error(vs);
450 return -1;
451
452 authabort:
453 vnc_client_error(vs);
454 return -1;
455}
456
457static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
458{
459 uint32_t startlen = read_u32(data, 0);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100460
aliguori2f9606b2009-03-06 20:27:28 +0000461 if (startlen > SASL_DATA_MAX_LEN) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100462 trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", "");
aliguori28a76be2009-03-06 20:27:40 +0000463 vnc_client_error(vs);
464 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000465 }
466
467 if (startlen == 0)
aliguori28a76be2009-03-06 20:27:40 +0000468 return protocol_client_auth_sasl_start(vs, NULL, 0);
aliguori2f9606b2009-03-06 20:27:28 +0000469
470 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
471 return 0;
472}
473
474static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
475{
Jim Meyering5847d9e2012-10-04 13:09:54 +0200476 char *mechname = g_strndup((const char *) data, len);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100477 trace_vnc_auth_sasl_mech_choose(vs, mechname);
aliguori2f9606b2009-03-06 20:27:28 +0000478
479 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
aliguori28a76be2009-03-06 20:27:40 +0000480 if (vs->sasl.mechlist[len] != '\0' &&
481 vs->sasl.mechlist[len] != ',') {
Blue Swirl8ce7d352011-01-12 19:48:56 +0000482 goto fail;
aliguori28a76be2009-03-06 20:27:40 +0000483 }
aliguori2f9606b2009-03-06 20:27:28 +0000484 } else {
aliguori28a76be2009-03-06 20:27:40 +0000485 char *offset = strstr(vs->sasl.mechlist, mechname);
aliguori28a76be2009-03-06 20:27:40 +0000486 if (!offset) {
Blue Swirl8ce7d352011-01-12 19:48:56 +0000487 goto fail;
aliguori28a76be2009-03-06 20:27:40 +0000488 }
aliguori28a76be2009-03-06 20:27:40 +0000489 if (offset[-1] != ',' ||
490 (offset[len] != '\0'&&
491 offset[len] != ',')) {
Blue Swirl8ce7d352011-01-12 19:48:56 +0000492 goto fail;
aliguori28a76be2009-03-06 20:27:40 +0000493 }
aliguori2f9606b2009-03-06 20:27:28 +0000494 }
495
Markus Armbruster302d9d62011-11-08 13:45:21 +0100496 g_free(vs->sasl.mechlist);
aliguori2f9606b2009-03-06 20:27:28 +0000497 vs->sasl.mechlist = mechname;
498
aliguori2f9606b2009-03-06 20:27:28 +0000499 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
500 return 0;
Blue Swirl8ce7d352011-01-12 19:48:56 +0000501
502 fail:
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100503 trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname);
Blue Swirl8ce7d352011-01-12 19:48:56 +0000504 vnc_client_error(vs);
Markus Armbruster302d9d62011-11-08 13:45:21 +0100505 g_free(mechname);
Blue Swirl8ce7d352011-01-12 19:48:56 +0000506 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000507}
508
509static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
510{
511 uint32_t mechlen = read_u32(data, 0);
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100512
aliguori2f9606b2009-03-06 20:27:28 +0000513 if (mechlen > 100) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100514 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", "");
aliguori28a76be2009-03-06 20:27:40 +0000515 vnc_client_error(vs);
516 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000517 }
518 if (mechlen < 1) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100519 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", "");
aliguori28a76be2009-03-06 20:27:40 +0000520 vnc_client_error(vs);
521 return -1;
aliguori2f9606b2009-03-06 20:27:28 +0000522 }
523 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
524 return 0;
525}
526
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000527static char *
528vnc_socket_ip_addr_string(QIOChannelSocket *ioc,
529 bool local,
530 Error **errp)
531{
Markus Armbrusterbd269eb2017-04-26 09:36:41 +0200532 SocketAddress *addr;
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000533 char *ret;
534
535 if (local) {
536 addr = qio_channel_socket_get_local_address(ioc, errp);
537 } else {
538 addr = qio_channel_socket_get_remote_address(ioc, errp);
539 }
540 if (!addr) {
541 return NULL;
542 }
543
Markus Armbrusterbd269eb2017-04-26 09:36:41 +0200544 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000545 error_setg(errp, "Not an inet socket type");
Pan Nengyuan7791aca2020-08-31 09:43:15 -0400546 qapi_free_SocketAddress(addr);
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000547 return NULL;
548 }
Markus Armbrusterbd269eb2017-04-26 09:36:41 +0200549 ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port);
550 qapi_free_SocketAddress(addr);
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000551 return ret;
552}
553
aliguori2f9606b2009-03-06 20:27:28 +0000554void start_auth_sasl(VncState *vs)
555{
556 const char *mechlist = NULL;
557 sasl_security_properties_t secprops;
558 int err;
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100559 Error *local_err = NULL;
aliguori2f9606b2009-03-06 20:27:28 +0000560 char *localAddr, *remoteAddr;
561 int mechlistlen;
562
aliguori2f9606b2009-03-06 20:27:28 +0000563 /* Get local & remote client addresses in form IPADDR;PORT */
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100564 localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err);
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000565 if (!localAddr) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100566 trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP",
567 error_get_pretty(local_err));
aliguori28a76be2009-03-06 20:27:40 +0000568 goto authabort;
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000569 }
aliguori2f9606b2009-03-06 20:27:28 +0000570
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100571 remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err);
Daniel P. Berrange04d25292015-02-27 16:20:57 +0000572 if (!remoteAddr) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100573 trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP",
574 error_get_pretty(local_err));
Stefan Weilae878b12011-10-07 21:15:20 +0200575 g_free(localAddr);
aliguori28a76be2009-03-06 20:27:40 +0000576 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000577 }
578
579 err = sasl_server_new("vnc",
aliguori28a76be2009-03-06 20:27:40 +0000580 NULL, /* FQDN - just delegates to gethostname */
581 NULL, /* User realm */
582 localAddr,
583 remoteAddr,
584 NULL, /* Callbacks, not needed */
585 SASL_SUCCESS_DATA,
586 &vs->sasl.conn);
Stefan Weilae878b12011-10-07 21:15:20 +0200587 g_free(localAddr);
588 g_free(remoteAddr);
aliguori2f9606b2009-03-06 20:27:28 +0000589 localAddr = remoteAddr = NULL;
590
591 if (err != SASL_OK) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100592 trace_vnc_auth_fail(vs, vs->auth, "SASL context setup failed",
593 sasl_errstring(err, NULL, NULL));
aliguori28a76be2009-03-06 20:27:40 +0000594 vs->sasl.conn = NULL;
595 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000596 }
597
aliguori2f9606b2009-03-06 20:27:28 +0000598 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
Daniel P. Berrange7e7e2eb2011-06-23 13:31:41 +0100599 if (vs->auth == VNC_AUTH_VENCRYPT &&
600 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100601 int keysize;
aliguori28a76be2009-03-06 20:27:40 +0000602 sasl_ssf_t ssf;
aliguori2f9606b2009-03-06 20:27:28 +0000603
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100604 keysize = qcrypto_tls_session_get_key_size(vs->tls,
605 &local_err);
606 if (keysize < 0) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100607 trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size",
608 error_get_pretty(local_err));
aliguori28a76be2009-03-06 20:27:40 +0000609 sasl_dispose(&vs->sasl.conn);
610 vs->sasl.conn = NULL;
611 goto authabort;
612 }
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100613 ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */
aliguori2f9606b2009-03-06 20:27:28 +0000614
aliguori28a76be2009-03-06 20:27:40 +0000615 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
616 if (err != SASL_OK) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100617 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF",
618 sasl_errstring(err, NULL, NULL));
aliguori28a76be2009-03-06 20:27:40 +0000619 sasl_dispose(&vs->sasl.conn);
620 vs->sasl.conn = NULL;
621 goto authabort;
622 }
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100623 } else {
aliguori28a76be2009-03-06 20:27:40 +0000624 vs->sasl.wantSSF = 1;
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100625 }
aliguori2f9606b2009-03-06 20:27:28 +0000626
627 memset (&secprops, 0, sizeof secprops);
Daniel P. Berrange3e305e42015-08-06 14:39:32 +0100628 /* Inform SASL that we've got an external SSF layer from TLS.
629 *
630 * Disable SSF, if using TLS+x509+SASL only. TLS without x509
631 * is not sufficiently strong
632 */
633 if (vs->vd->is_unix ||
634 (vs->auth == VNC_AUTH_VENCRYPT &&
635 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) {
aliguori28a76be2009-03-06 20:27:40 +0000636 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
637 secprops.min_ssf = 0;
638 secprops.max_ssf = 0;
639 secprops.maxbufsize = 8192;
640 secprops.security_flags = 0;
aliguori2f9606b2009-03-06 20:27:28 +0000641 } else {
aliguori28a76be2009-03-06 20:27:40 +0000642 /* Plain TCP, better get an SSF layer */
643 secprops.min_ssf = 56; /* Good enough to require kerberos */
644 secprops.max_ssf = 100000; /* Arbitrary big number */
645 secprops.maxbufsize = 8192;
646 /* Forbid any anonymous or trivially crackable auth */
647 secprops.security_flags =
648 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
aliguori2f9606b2009-03-06 20:27:28 +0000649 }
650
651 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
652 if (err != SASL_OK) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100653 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props",
654 sasl_errstring(err, NULL, NULL));
aliguori28a76be2009-03-06 20:27:40 +0000655 sasl_dispose(&vs->sasl.conn);
656 vs->sasl.conn = NULL;
657 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000658 }
659
660 err = sasl_listmech(vs->sasl.conn,
aliguori28a76be2009-03-06 20:27:40 +0000661 NULL, /* Don't need to set user */
662 "", /* Prefix */
663 ",", /* Separator */
664 "", /* Suffix */
665 &mechlist,
666 NULL,
667 NULL);
aliguori2f9606b2009-03-06 20:27:28 +0000668 if (err != SASL_OK) {
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100669 trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms",
670 sasl_errdetail(vs->sasl.conn));
aliguori28a76be2009-03-06 20:27:40 +0000671 sasl_dispose(&vs->sasl.conn);
672 vs->sasl.conn = NULL;
673 goto authabort;
aliguori2f9606b2009-03-06 20:27:28 +0000674 }
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100675 trace_vnc_auth_sasl_mech_list(vs, mechlist);
aliguori2f9606b2009-03-06 20:27:28 +0000676
Markus Armbruster302d9d62011-11-08 13:45:21 +0100677 vs->sasl.mechlist = g_strdup(mechlist);
aliguori2f9606b2009-03-06 20:27:28 +0000678 mechlistlen = strlen(mechlist);
679 vnc_write_u32(vs, mechlistlen);
680 vnc_write(vs, mechlist, mechlistlen);
681 vnc_flush(vs);
682
aliguori2f9606b2009-03-06 20:27:28 +0000683 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
684
685 return;
686
687 authabort:
Daniel P. Berrange7364dbd2017-09-21 13:15:28 +0100688 error_free(local_err);
aliguori2f9606b2009-03-06 20:27:28 +0000689 vnc_client_error(vs);
aliguori2f9606b2009-03-06 20:27:28 +0000690}
691
692