qemu

FORK: QEMU emulator
git clone https://git.neptards.moe/neptards/qemu.git
Log | Files | Refs | Submodules | LICENSE

vnc-auth-vencrypt.c (5346B)

      1 /*
      2  * QEMU VNC display driver: VeNCrypt authentication setup
      3  *
      4  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
      5  * Copyright (C) 2006 Fabrice Bellard
      6  * Copyright (C) 2009 Red Hat, Inc
      7  *
      8  * Permission is hereby granted, free of charge, to any person obtaining a copy
      9  * of this software and associated documentation files (the "Software"), to deal
     10  * in the Software without restriction, including without limitation the rights
     11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     12  * copies of the Software, and to permit persons to whom the Software is
     13  * furnished to do so, subject to the following conditions:
     14  *
     15  * The above copyright notice and this permission notice shall be included in
     16  * all copies or substantial portions of the Software.
     17  *
     18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     24  * THE SOFTWARE.
     25  */
     26 
     27 #include "qemu/osdep.h"
     28 #include "vnc.h"
     29 #include "qapi/error.h"
     30 #include "qemu/main-loop.h"
     31 #include "trace.h"
     32 
     33 static void start_auth_vencrypt_subauth(VncState *vs)
     34 {
     35     switch (vs->subauth) {
     36     case VNC_AUTH_VENCRYPT_TLSNONE:
     37     case VNC_AUTH_VENCRYPT_X509NONE:
     38        vnc_write_u32(vs, 0); /* Accept auth completion */
     39        start_client_init(vs);
     40        break;
     41 
     42     case VNC_AUTH_VENCRYPT_TLSVNC:
     43     case VNC_AUTH_VENCRYPT_X509VNC:
     44        start_auth_vnc(vs);
     45        break;
     46 
     47 #ifdef CONFIG_VNC_SASL
     48     case VNC_AUTH_VENCRYPT_TLSSASL:
     49     case VNC_AUTH_VENCRYPT_X509SASL:
     50       start_auth_sasl(vs);
     51       break;
     52 #endif /* CONFIG_VNC_SASL */
     53 
     54     default: /* Should not be possible, but just in case */
     55        trace_vnc_auth_fail(vs, vs->auth, "Unhandled VeNCrypt subauth", "");
     56        vnc_write_u8(vs, 1);
     57        if (vs->minor >= 8) {
     58            static const char err[] = "Unsupported authentication type";
     59            vnc_write_u32(vs, sizeof(err));
     60            vnc_write(vs, err, sizeof(err));
     61        }
     62        vnc_client_error(vs);
     63     }
     64 }
     65 
     66 static void vnc_tls_handshake_done(QIOTask *task,
     67                                    gpointer user_data)
     68 {
     69     VncState *vs = user_data;
     70     Error *err = NULL;
     71 
     72     if (qio_task_propagate_error(task, &err)) {
     73         trace_vnc_auth_fail(vs, vs->auth, "TLS handshake failed",
     74                             error_get_pretty(err));
     75         vnc_client_error(vs);
     76         error_free(err);
     77     } else {
     78         if (vs->ioc_tag) {
     79             g_source_remove(vs->ioc_tag);
     80         }
     81         vs->ioc_tag = qio_channel_add_watch(
     82             vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_OUT,
     83             vnc_client_io, vs, NULL);
     84         start_auth_vencrypt_subauth(vs);
     85     }
     86 }
     87 
     88 
     89 static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
     90 {
     91     int auth = read_u32(data, 0);
     92 
     93     trace_vnc_auth_vencrypt_subauth(vs, auth);
     94     if (auth != vs->subauth) {
     95         trace_vnc_auth_fail(vs, vs->auth, "Unsupported sub-auth version", "");
     96         vnc_write_u8(vs, 0); /* Reject auth */
     97         vnc_flush(vs);
     98         vnc_client_error(vs);
     99     } else {
    100         Error *err = NULL;
    101         QIOChannelTLS *tls;
    102         vnc_write_u8(vs, 1); /* Accept auth */
    103         vnc_flush(vs);
    104 
    105         if (vs->ioc_tag) {
    106             g_source_remove(vs->ioc_tag);
    107             vs->ioc_tag = 0;
    108         }
    109 
    110         tls = qio_channel_tls_new_server(
    111             vs->ioc,
    112             vs->vd->tlscreds,
    113             vs->vd->tlsauthzid,
    114             &err);
    115         if (!tls) {
    116             trace_vnc_auth_fail(vs, vs->auth, "TLS setup failed",
    117                                 error_get_pretty(err));
    118             error_free(err);
    119             vnc_client_error(vs);
    120             return 0;
    121         }
    122 
    123         qio_channel_set_name(QIO_CHANNEL(tls), "vnc-server-tls");
    124         object_unref(OBJECT(vs->ioc));
    125         vs->ioc = QIO_CHANNEL(tls);
    126         trace_vnc_client_io_wrap(vs, vs->ioc, "tls");
    127         vs->tls = qio_channel_tls_get_session(tls);
    128 
    129         qio_channel_tls_handshake(tls,
    130                                   vnc_tls_handshake_done,
    131                                   vs,
    132                                   NULL,
    133                                   NULL);
    134     }
    135     return 0;
    136 }
    137 
    138 static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
    139 {
    140     trace_vnc_auth_vencrypt_version(vs, (int)data[0], (int)data[1]);
    141     if (data[0] != 0 ||
    142         data[1] != 2) {
    143         trace_vnc_auth_fail(vs, vs->auth, "Unsupported version", "");
    144         vnc_write_u8(vs, 1); /* Reject version */
    145         vnc_flush(vs);
    146         vnc_client_error(vs);
    147     } else {
    148         vnc_write_u8(vs, 0); /* Accept version */
    149         vnc_write_u8(vs, 1); /* Number of sub-auths */
    150         vnc_write_u32(vs, vs->subauth); /* The supported auth */
    151         vnc_flush(vs);
    152         vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
    153     }
    154     return 0;
    155 }
    156 
    157 
    158 void start_auth_vencrypt(VncState *vs)
    159 {
    160     /* Send VeNCrypt version 0.2 */
    161     vnc_write_u8(vs, 0);
    162     vnc_write_u8(vs, 2);
    163 
    164     vnc_read_when(vs, protocol_client_vencrypt_init, 2);
    165 }
    166