void vnc_sasl_client_cleanup(VncState *vs)
{
if (vs->sasl.conn) {
- vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
- vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
- vs->sasl.encoded = NULL;
- free(vs->sasl.username);
- free(vs->sasl.mechlist);
- vs->sasl.username = vs->sasl.mechlist = NULL;
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
+ vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
+ vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
+ vs->sasl.encoded = NULL;
+ free(vs->sasl.username);
+ free(vs->sasl.mechlist);
+ vs->sasl.username = vs->sasl.mechlist = NULL;
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
}
}
long ret;
VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n",
- vs->output.buffer, vs->output.capacity, vs->output.offset,
- vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
+ vs->output.buffer, vs->output.capacity, vs->output.offset,
+ vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
if (!vs->sasl.encoded) {
- int err;
- err = sasl_encode(vs->sasl.conn,
- (char *)vs->output.buffer,
- vs->output.offset,
- (const char **)&vs->sasl.encoded,
- &vs->sasl.encodedLength);
- if (err != SASL_OK)
- return vnc_client_io_error(vs, -1, EIO);
-
- vs->sasl.encodedOffset = 0;
+ int err;
+ err = sasl_encode(vs->sasl.conn,
+ (char *)vs->output.buffer,
+ vs->output.offset,
+ (const char **)&vs->sasl.encoded,
+ &vs->sasl.encodedLength);
+ if (err != SASL_OK)
+ return vnc_client_io_error(vs, -1, EIO);
+
+ vs->sasl.encodedOffset = 0;
}
ret = vnc_client_write_buf(vs,
- vs->sasl.encoded + vs->sasl.encodedOffset,
- vs->sasl.encodedLength - vs->sasl.encodedOffset);
+ vs->sasl.encoded + vs->sasl.encodedOffset,
+ vs->sasl.encodedLength - vs->sasl.encodedOffset);
if (!ret)
- return 0;
+ return 0;
vs->sasl.encodedOffset += ret;
if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
- vs->output.offset = 0;
- vs->sasl.encoded = NULL;
- vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
+ vs->output.offset = 0;
+ vs->sasl.encoded = NULL;
+ vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
}
/* Can't merge this block with one above, because
* SASL encoded output
*/
if (vs->output.offset == 0) {
- qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
+ qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
}
return ret;
ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
if (!ret)
- return 0;
+ return 0;
err = sasl_decode(vs->sasl.conn,
- (char *)encoded, ret,
- &decoded, &decodedLen);
+ (char *)encoded, ret,
+ &decoded, &decodedLen);
if (err != SASL_OK)
- return vnc_client_io_error(vs, -1, -EIO);
+ return vnc_client_io_error(vs, -1, -EIO);
VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
- encoded, ret, decoded, decodedLen);
+ encoded, ret, decoded, decodedLen);
buffer_reserve(&vs->input, decodedLen);
buffer_append(&vs->input, decoded, decodedLen);
return decodedLen;
err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
if (err != SASL_OK) {
- VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
- err, sasl_errstring(err, NULL, NULL));
- return -1;
+ VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
+ err, sasl_errstring(err, NULL, NULL));
+ return -1;
}
if (val == NULL) {
- VNC_DEBUG("no client username was found, denying access\n");
- return -1;
+ VNC_DEBUG("no client username was found, denying access\n");
+ return -1;
}
VNC_DEBUG("SASL client username %s\n", (const char *)val);
vs->sasl.username = qemu_strdup((const char*)val);
if (vs->vd->sasl.acl == NULL) {
- VNC_DEBUG("no ACL activated, allowing access\n");
- return 0;
+ VNC_DEBUG("no ACL activated, allowing access\n");
+ return 0;
}
allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
- allow ? "allowed" : "denied");
+ allow ? "allowed" : "denied");
return allow ? 0 : -1;
}
int err, ssf;
if (!vs->sasl.wantSSF)
- return 1;
+ return 1;
err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
if (err != SASL_OK)
- return 0;
+ return 0;
ssf = *(const int *)val;
VNC_DEBUG("negotiated an SSF of %d\n", ssf);
if (ssf < 56)
- return 0; /* 56 is good for Kerberos */
+ return 0; /* 56 is good for Kerberos */
/* Only setup for read initially, because we're about to send an RPC
* reply which must be in plain text. When the next incoming RPC
/* NB, distinction of NULL vs "" is *critical* in SASL */
if (datalen) {
- clientdata = (char*)data;
- clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
- datalen--; /* Don't count NULL byte when passing to _start() */
+ clientdata = (char*)data;
+ clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
+ datalen--; /* Don't count NULL byte when passing to _start() */
}
VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
- clientdata, datalen);
+ clientdata, datalen);
err = sasl_server_step(vs->sasl.conn,
- clientdata,
- datalen,
- &serverout,
- &serveroutlen);
+ clientdata,
+ datalen,
+ &serverout,
+ &serveroutlen);
if (err != SASL_OK &&
- err != SASL_CONTINUE) {
- VNC_DEBUG("sasl step failed %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ err != SASL_CONTINUE) {
+ VNC_DEBUG("sasl step failed %d (%s)\n",
+ err, sasl_errdetail(vs->sasl.conn));
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
if (serveroutlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("sasl step reply data too long %d\n",
- serveroutlen);
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("sasl step reply data too long %d\n",
+ serveroutlen);
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
- serveroutlen, serverout ? 0 : 1);
+ serveroutlen, serverout ? 0 : 1);
if (serveroutlen) {
- vnc_write_u32(vs, serveroutlen + 1);
- vnc_write(vs, serverout, serveroutlen + 1);
+ vnc_write_u32(vs, serveroutlen + 1);
+ vnc_write(vs, serverout, serveroutlen + 1);
} else {
- vnc_write_u32(vs, 0);
+ vnc_write_u32(vs, 0);
}
/* Whether auth is complete */
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
if (err == SASL_CONTINUE) {
- VNC_DEBUG("%s", "Authentication must continue\n");
- /* Wait for step length */
- vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
+ VNC_DEBUG("%s", "Authentication must continue\n");
+ /* Wait for step length */
+ vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
} else {
- if (!vnc_auth_sasl_check_ssf(vs)) {
- VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
- goto authreject;
- }
-
- /* Check username whitelist ACL */
- if (vnc_auth_sasl_check_access(vs) < 0) {
- VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
- goto authreject;
- }
-
- VNC_DEBUG("Authentication successful %d\n", vs->csock);
- vnc_write_u32(vs, 0); /* Accept auth */
- /*
- * Delay writing in SSF encoded mode until pending output
- * buffer is written
- */
- if (vs->sasl.runSSF)
- vs->sasl.waitWriteSSF = vs->output.offset;
- start_client_init(vs);
+ if (!vnc_auth_sasl_check_ssf(vs)) {
+ VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
+ goto authreject;
+ }
+
+ /* Check username whitelist ACL */
+ if (vnc_auth_sasl_check_access(vs) < 0) {
+ VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
+ goto authreject;
+ }
+
+ VNC_DEBUG("Authentication successful %d\n", vs->csock);
+ vnc_write_u32(vs, 0); /* Accept auth */
+ /*
+ * Delay writing in SSF encoded mode until pending output
+ * buffer is written
+ */
+ if (vs->sasl.runSSF)
+ vs->sasl.waitWriteSSF = vs->output.offset;
+ start_client_init(vs);
}
return 0;
uint32_t steplen = read_u32(data, 0);
VNC_DEBUG("Got client step len %d\n", steplen);
if (steplen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("Too much SASL data %d\n", steplen);
- vnc_client_error(vs);
- return -1;
+ VNC_DEBUG("Too much SASL data %d\n", steplen);
+ vnc_client_error(vs);
+ return -1;
}
if (steplen == 0)
- return protocol_client_auth_sasl_step(vs, NULL, 0);
+ return protocol_client_auth_sasl_step(vs, NULL, 0);
else
- vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
+ vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
return 0;
}
/* NB, distinction of NULL vs "" is *critical* in SASL */
if (datalen) {
- clientdata = (char*)data;
- clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
- datalen--; /* Don't count NULL byte when passing to _start() */
+ clientdata = (char*)data;
+ clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
+ datalen--; /* Don't count NULL byte when passing to _start() */
}
VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
- vs->sasl.mechlist, clientdata, datalen);
+ vs->sasl.mechlist, clientdata, datalen);
err = sasl_server_start(vs->sasl.conn,
- vs->sasl.mechlist,
- clientdata,
- datalen,
- &serverout,
- &serveroutlen);
+ vs->sasl.mechlist,
+ clientdata,
+ datalen,
+ &serverout,
+ &serveroutlen);
if (err != SASL_OK &&
- err != SASL_CONTINUE) {
- VNC_DEBUG("sasl start failed %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ err != SASL_CONTINUE) {
+ VNC_DEBUG("sasl start failed %d (%s)\n",
+ err, sasl_errdetail(vs->sasl.conn));
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
if (serveroutlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("sasl start reply data too long %d\n",
- serveroutlen);
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("sasl start reply data too long %d\n",
+ serveroutlen);
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
- serveroutlen, serverout ? 0 : 1);
+ serveroutlen, serverout ? 0 : 1);
if (serveroutlen) {
- vnc_write_u32(vs, serveroutlen + 1);
- vnc_write(vs, serverout, serveroutlen + 1);
+ vnc_write_u32(vs, serveroutlen + 1);
+ vnc_write(vs, serverout, serveroutlen + 1);
} else {
- vnc_write_u32(vs, 0);
+ vnc_write_u32(vs, 0);
}
/* Whether auth is complete */
vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
if (err == SASL_CONTINUE) {
- VNC_DEBUG("%s", "Authentication must continue\n");
- /* Wait for step length */
- vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
+ VNC_DEBUG("%s", "Authentication must continue\n");
+ /* Wait for step length */
+ vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
} else {
- if (!vnc_auth_sasl_check_ssf(vs)) {
- VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
- goto authreject;
- }
-
- /* Check username whitelist ACL */
- if (vnc_auth_sasl_check_access(vs) < 0) {
- VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
- goto authreject;
- }
-
- VNC_DEBUG("Authentication successful %d\n", vs->csock);
- vnc_write_u32(vs, 0); /* Accept auth */
- start_client_init(vs);
+ if (!vnc_auth_sasl_check_ssf(vs)) {
+ VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
+ goto authreject;
+ }
+
+ /* Check username whitelist ACL */
+ if (vnc_auth_sasl_check_access(vs) < 0) {
+ VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
+ goto authreject;
+ }
+
+ VNC_DEBUG("Authentication successful %d\n", vs->csock);
+ vnc_write_u32(vs, 0); /* Accept auth */
+ start_client_init(vs);
}
return 0;
uint32_t startlen = read_u32(data, 0);
VNC_DEBUG("Got client start len %d\n", startlen);
if (startlen > SASL_DATA_MAX_LEN) {
- VNC_DEBUG("Too much SASL data %d\n", startlen);
- vnc_client_error(vs);
- return -1;
+ VNC_DEBUG("Too much SASL data %d\n", startlen);
+ vnc_client_error(vs);
+ return -1;
}
if (startlen == 0)
- return protocol_client_auth_sasl_start(vs, NULL, 0);
+ return protocol_client_auth_sasl_start(vs, NULL, 0);
vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
return 0;
{
char *mechname = malloc(len + 1);
if (!mechname) {
- VNC_DEBUG("Out of memory reading mechname\n");
- vnc_client_error(vs);
+ VNC_DEBUG("Out of memory reading mechname\n");
+ vnc_client_error(vs);
}
strncpy(mechname, (char*)data, len);
mechname[len] = '\0';
VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
- mechname, vs->sasl.mechlist);
+ mechname, vs->sasl.mechlist);
if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
- if (vs->sasl.mechlist[len] != '\0' &&
- vs->sasl.mechlist[len] != ',') {
- VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
- vnc_client_error(vs);
- return -1;
- }
+ if (vs->sasl.mechlist[len] != '\0' &&
+ vs->sasl.mechlist[len] != ',') {
+ VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
+ vnc_client_error(vs);
+ return -1;
+ }
} else {
- char *offset = strstr(vs->sasl.mechlist, mechname);
- VNC_DEBUG("Two %p\n", offset);
- if (!offset) {
- vnc_client_error(vs);
- return -1;
- }
- VNC_DEBUG("Two '%s'\n", offset);
- if (offset[-1] != ',' ||
- (offset[len] != '\0'&&
- offset[len] != ',')) {
- vnc_client_error(vs);
- return -1;
- }
+ char *offset = strstr(vs->sasl.mechlist, mechname);
+ VNC_DEBUG("Two %p\n", offset);
+ if (!offset) {
+ vnc_client_error(vs);
+ return -1;
+ }
+ VNC_DEBUG("Two '%s'\n", offset);
+ if (offset[-1] != ',' ||
+ (offset[len] != '\0'&&
+ offset[len] != ',')) {
+ vnc_client_error(vs);
+ return -1;
+ }
}
free(vs->sasl.mechlist);
uint32_t mechlen = read_u32(data, 0);
VNC_DEBUG("Got client mechname len %d\n", mechlen);
if (mechlen > 100) {
- VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
- vnc_client_error(vs);
- return -1;
+ VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
+ vnc_client_error(vs);
+ return -1;
}
if (mechlen < 1) {
- VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
- vnc_client_error(vs);
- return -1;
+ VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
+ vnc_client_error(vs);
+ return -1;
}
vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
return 0;
}
-#define USES_X509_AUTH(vs) \
+#define USES_X509_AUTH(vs) \
((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \
(vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \
(vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \
/* Get local & remote client addresses in form IPADDR;PORT */
if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
- goto authabort;
+ goto authabort;
if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
- free(localAddr);
- goto authabort;
+ free(localAddr);
+ goto authabort;
}
err = sasl_server_new("vnc",
- NULL, /* FQDN - just delegates to gethostname */
- NULL, /* User realm */
- localAddr,
- remoteAddr,
- NULL, /* Callbacks, not needed */
- SASL_SUCCESS_DATA,
- &vs->sasl.conn);
+ NULL, /* FQDN - just delegates to gethostname */
+ NULL, /* User realm */
+ localAddr,
+ remoteAddr,
+ NULL, /* Callbacks, not needed */
+ SASL_SUCCESS_DATA,
+ &vs->sasl.conn);
free(localAddr);
free(remoteAddr);
localAddr = remoteAddr = NULL;
if (err != SASL_OK) {
- VNC_DEBUG("sasl context setup failed %d (%s)",
- err, sasl_errstring(err, NULL, NULL));
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("sasl context setup failed %d (%s)",
+ err, sasl_errstring(err, NULL, NULL));
+ vs->sasl.conn = NULL;
+ goto authabort;
}
#ifdef CONFIG_VNC_TLS
/* Inform SASL that we've got an external SSF layer from TLS/x509 */
if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
- vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
- gnutls_cipher_algorithm_t cipher;
- sasl_ssf_t ssf;
-
- cipher = gnutls_cipher_get(vs->tls.session);
- if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
- VNC_DEBUG("%s", "cannot TLS get cipher size\n");
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
- }
- ssf *= 8; /* tls key size is bytes, sasl wants bits */
-
- err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
- if (err != SASL_OK) {
- VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
- err, sasl_errstring(err, NULL, NULL));
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
- }
+ vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
+ gnutls_cipher_algorithm_t cipher;
+ sasl_ssf_t ssf;
+
+ cipher = gnutls_cipher_get(vs->tls.session);
+ if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
+ VNC_DEBUG("%s", "cannot TLS get cipher size\n");
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
+ }
+ ssf *= 8; /* tls key size is bytes, sasl wants bits */
+
+ err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
+ if (err != SASL_OK) {
+ VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
+ err, sasl_errstring(err, NULL, NULL));
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
+ }
} else
#endif /* CONFIG_VNC_TLS */
- vs->sasl.wantSSF = 1;
+ vs->sasl.wantSSF = 1;
memset (&secprops, 0, sizeof secprops);
/* Inform SASL that we've got an external SSF layer from TLS */
if (strncmp(vs->vd->display, "unix:", 5) == 0
#ifdef CONFIG_VNC_TLS
- /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
- is not sufficiently strong */
- || (vs->vd->auth == VNC_AUTH_VENCRYPT &&
- vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
+ /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
+ is not sufficiently strong */
+ || (vs->vd->auth == VNC_AUTH_VENCRYPT &&
+ vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
#endif /* CONFIG_VNC_TLS */
- ) {
- /* If we've got TLS or UNIX domain sock, we don't care about SSF */
- secprops.min_ssf = 0;
- secprops.max_ssf = 0;
- secprops.maxbufsize = 8192;
- secprops.security_flags = 0;
+ ) {
+ /* If we've got TLS or UNIX domain sock, we don't care about SSF */
+ secprops.min_ssf = 0;
+ secprops.max_ssf = 0;
+ secprops.maxbufsize = 8192;
+ secprops.security_flags = 0;
} else {
- /* Plain TCP, better get an SSF layer */
- secprops.min_ssf = 56; /* Good enough to require kerberos */
- secprops.max_ssf = 100000; /* Arbitrary big number */
- secprops.maxbufsize = 8192;
- /* Forbid any anonymous or trivially crackable auth */
- secprops.security_flags =
- SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
+ /* Plain TCP, better get an SSF layer */
+ secprops.min_ssf = 56; /* Good enough to require kerberos */
+ secprops.max_ssf = 100000; /* Arbitrary big number */
+ secprops.maxbufsize = 8192;
+ /* Forbid any anonymous or trivially crackable auth */
+ secprops.security_flags =
+ SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
}
err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
if (err != SASL_OK) {
- VNC_DEBUG("cannot set SASL security props %d (%s)\n",
- err, sasl_errstring(err, NULL, NULL));
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("cannot set SASL security props %d (%s)\n",
+ err, sasl_errstring(err, NULL, NULL));
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
err = sasl_listmech(vs->sasl.conn,
- NULL, /* Don't need to set user */
- "", /* Prefix */
- ",", /* Separator */
- "", /* Suffix */
- &mechlist,
- NULL,
- NULL);
+ NULL, /* Don't need to set user */
+ "", /* Prefix */
+ ",", /* Separator */
+ "", /* Suffix */
+ &mechlist,
+ NULL,
+ NULL);
if (err != SASL_OK) {
- VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
- err, sasl_errdetail(vs->sasl.conn));
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
+ err, sasl_errdetail(vs->sasl.conn));
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
if (!(vs->sasl.mechlist = strdup(mechlist))) {
- VNC_DEBUG("Out of memory");
- sasl_dispose(&vs->sasl.conn);
- vs->sasl.conn = NULL;
- goto authabort;
+ VNC_DEBUG("Out of memory");
+ sasl_dispose(&vs->sasl.conn);
+ vs->sasl.conn = NULL;
+ goto authabort;
}
mechlistlen = strlen(mechlist);
vnc_write_u32(vs, mechlistlen);
projects / qemu / blobdiff