1 /* 2 * QEMU VNC display driver: SASL auth protocol 3 * 4 * Copyright (C) 2009 Red Hat, Inc 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "qapi/error.h" 27 #include "vnc.h" 28 29 /* Max amount of data we send/recv for SASL steps to prevent DOS */ 30 #define SASL_DATA_MAX_LEN (1024 * 1024) 31 32 33 void vnc_sasl_client_cleanup(VncState *vs) 34 { 35 if (vs->sasl.conn) { 36 vs->sasl.runSSF = false; 37 vs->sasl.wantSSF = false; 38 vs->sasl.waitWriteSSF = 0; 39 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; 40 vs->sasl.encoded = NULL; 41 g_free(vs->sasl.username); 42 g_free(vs->sasl.mechlist); 43 vs->sasl.username = vs->sasl.mechlist = NULL; 44 sasl_dispose(&vs->sasl.conn); 45 vs->sasl.conn = NULL; 46 } 47 } 48 49 50 long vnc_client_write_sasl(VncState *vs) 51 { 52 long ret; 53 54 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd " 55 "Encoded: %p size %d offset %d\n", 56 vs->output.buffer, vs->output.capacity, vs->output.offset, 57 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); 58 59 if (!vs->sasl.encoded) { 60 int err; 61 err = sasl_encode(vs->sasl.conn, 62 (char *)vs->output.buffer, 63 vs->output.offset, 64 (const char **)&vs->sasl.encoded, 65 &vs->sasl.encodedLength); 66 if (err != SASL_OK) 67 return vnc_client_io_error(vs, -1, NULL); 68 69 vs->sasl.encodedOffset = 0; 70 } 71 72 ret = vnc_client_write_buf(vs, 73 vs->sasl.encoded + vs->sasl.encodedOffset, 74 vs->sasl.encodedLength - vs->sasl.encodedOffset); 75 if (!ret) 76 return 0; 77 78 vs->sasl.encodedOffset += ret; 79 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) { 80 vs->output.offset = 0; 81 vs->sasl.encoded = NULL; 82 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; 83 } 84 85 /* Can't merge this block with one above, because 86 * someone might have written more unencrypted 87 * data in vs->output while we were processing 88 * SASL encoded output 89 */ 90 if (vs->output.offset == 0) { 91 if (vs->ioc_tag) { 92 g_source_remove(vs->ioc_tag); 93 } 94 vs->ioc_tag = qio_channel_add_watch( 95 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 96 } 97 98 return ret; 99 } 100 101 102 long vnc_client_read_sasl(VncState *vs) 103 { 104 long ret; 105 uint8_t encoded[4096]; 106 const char *decoded; 107 unsigned int decodedLen; 108 int err; 109 110 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded)); 111 if (!ret) 112 return 0; 113 114 err = sasl_decode(vs->sasl.conn, 115 (char *)encoded, ret, 116 &decoded, &decodedLen); 117 118 if (err != SASL_OK) 119 return vnc_client_io_error(vs, -1, NULL); 120 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n", 121 encoded, ret, decoded, decodedLen); 122 buffer_reserve(&vs->input, decodedLen); 123 buffer_append(&vs->input, decoded, decodedLen); 124 return decodedLen; 125 } 126 127 128 static int vnc_auth_sasl_check_access(VncState *vs) 129 { 130 const void *val; 131 int err; 132 int allow; 133 134 err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val); 135 if (err != SASL_OK) { 136 VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n", 137 err, sasl_errstring(err, NULL, NULL)); 138 return -1; 139 } 140 if (val == NULL) { 141 VNC_DEBUG("no client username was found, denying access\n"); 142 return -1; 143 } 144 VNC_DEBUG("SASL client username %s\n", (const char *)val); 145 146 vs->sasl.username = g_strdup((const char*)val); 147 148 if (vs->vd->sasl.acl == NULL) { 149 VNC_DEBUG("no ACL activated, allowing access\n"); 150 return 0; 151 } 152 153 allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username); 154 155 VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username, 156 allow ? "allowed" : "denied"); 157 return allow ? 0 : -1; 158 } 159 160 static int vnc_auth_sasl_check_ssf(VncState *vs) 161 { 162 const void *val; 163 int err, ssf; 164 165 if (!vs->sasl.wantSSF) 166 return 1; 167 168 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val); 169 if (err != SASL_OK) 170 return 0; 171 172 ssf = *(const int *)val; 173 VNC_DEBUG("negotiated an SSF of %d\n", ssf); 174 if (ssf < 56) 175 return 0; /* 56 is good for Kerberos */ 176 177 /* Only setup for read initially, because we're about to send an RPC 178 * reply which must be in plain text. When the next incoming RPC 179 * arrives, we'll switch on writes too 180 * 181 * cf qemudClientReadSASL in qemud.c 182 */ 183 vs->sasl.runSSF = 1; 184 185 /* We have a SSF that's good enough */ 186 return 1; 187 } 188 189 /* 190 * Step Msg 191 * 192 * Input from client: 193 * 194 * u32 clientin-length 195 * u8-array clientin-string 196 * 197 * Output to client: 198 * 199 * u32 serverout-length 200 * u8-array serverout-strin 201 * u8 continue 202 */ 203 204 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len); 205 206 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len) 207 { 208 uint32_t datalen = len; 209 const char *serverout; 210 unsigned int serveroutlen; 211 int err; 212 char *clientdata = NULL; 213 214 /* NB, distinction of NULL vs "" is *critical* in SASL */ 215 if (datalen) { 216 clientdata = (char*)data; 217 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ 218 datalen--; /* Don't count NULL byte when passing to _start() */ 219 } 220 221 VNC_DEBUG("Step using SASL Data %p (%d bytes)\n", 222 clientdata, datalen); 223 err = sasl_server_step(vs->sasl.conn, 224 clientdata, 225 datalen, 226 &serverout, 227 &serveroutlen); 228 if (err != SASL_OK && 229 err != SASL_CONTINUE) { 230 VNC_DEBUG("sasl step failed %d (%s)\n", 231 err, sasl_errdetail(vs->sasl.conn)); 232 sasl_dispose(&vs->sasl.conn); 233 vs->sasl.conn = NULL; 234 goto authabort; 235 } 236 237 if (serveroutlen > SASL_DATA_MAX_LEN) { 238 VNC_DEBUG("sasl step reply data too long %d\n", 239 serveroutlen); 240 sasl_dispose(&vs->sasl.conn); 241 vs->sasl.conn = NULL; 242 goto authabort; 243 } 244 245 VNC_DEBUG("SASL return data %d bytes, nil; %d\n", 246 serveroutlen, serverout ? 0 : 1); 247 248 if (serveroutlen) { 249 vnc_write_u32(vs, serveroutlen + 1); 250 vnc_write(vs, serverout, serveroutlen + 1); 251 } else { 252 vnc_write_u32(vs, 0); 253 } 254 255 /* Whether auth is complete */ 256 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); 257 258 if (err == SASL_CONTINUE) { 259 VNC_DEBUG("%s", "Authentication must continue\n"); 260 /* Wait for step length */ 261 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); 262 } else { 263 if (!vnc_auth_sasl_check_ssf(vs)) { 264 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs->ioc); 265 goto authreject; 266 } 267 268 /* Check username whitelist ACL */ 269 if (vnc_auth_sasl_check_access(vs) < 0) { 270 VNC_DEBUG("Authentication rejected for ACL %p\n", vs->ioc); 271 goto authreject; 272 } 273 274 VNC_DEBUG("Authentication successful %p\n", vs->ioc); 275 vnc_write_u32(vs, 0); /* Accept auth */ 276 /* 277 * Delay writing in SSF encoded mode until pending output 278 * buffer is written 279 */ 280 if (vs->sasl.runSSF) 281 vs->sasl.waitWriteSSF = vs->output.offset; 282 start_client_init(vs); 283 } 284 285 return 0; 286 287 authreject: 288 vnc_write_u32(vs, 1); /* Reject auth */ 289 vnc_write_u32(vs, sizeof("Authentication failed")); 290 vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); 291 vnc_flush(vs); 292 vnc_client_error(vs); 293 return -1; 294 295 authabort: 296 vnc_client_error(vs); 297 return -1; 298 } 299 300 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len) 301 { 302 uint32_t steplen = read_u32(data, 0); 303 VNC_DEBUG("Got client step len %d\n", steplen); 304 if (steplen > SASL_DATA_MAX_LEN) { 305 VNC_DEBUG("Too much SASL data %d\n", steplen); 306 vnc_client_error(vs); 307 return -1; 308 } 309 310 if (steplen == 0) 311 return protocol_client_auth_sasl_step(vs, NULL, 0); 312 else 313 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); 314 return 0; 315 } 316 317 /* 318 * Start Msg 319 * 320 * Input from client: 321 * 322 * u32 clientin-length 323 * u8-array clientin-string 324 * 325 * Output to client: 326 * 327 * u32 serverout-length 328 * u8-array serverout-strin 329 * u8 continue 330 */ 331 332 #define SASL_DATA_MAX_LEN (1024 * 1024) 333 334 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len) 335 { 336 uint32_t datalen = len; 337 const char *serverout; 338 unsigned int serveroutlen; 339 int err; 340 char *clientdata = NULL; 341 342 /* NB, distinction of NULL vs "" is *critical* in SASL */ 343 if (datalen) { 344 clientdata = (char*)data; 345 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ 346 datalen--; /* Don't count NULL byte when passing to _start() */ 347 } 348 349 VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n", 350 vs->sasl.mechlist, clientdata, datalen); 351 err = sasl_server_start(vs->sasl.conn, 352 vs->sasl.mechlist, 353 clientdata, 354 datalen, 355 &serverout, 356 &serveroutlen); 357 if (err != SASL_OK && 358 err != SASL_CONTINUE) { 359 VNC_DEBUG("sasl start failed %d (%s)\n", 360 err, sasl_errdetail(vs->sasl.conn)); 361 sasl_dispose(&vs->sasl.conn); 362 vs->sasl.conn = NULL; 363 goto authabort; 364 } 365 if (serveroutlen > SASL_DATA_MAX_LEN) { 366 VNC_DEBUG("sasl start reply data too long %d\n", 367 serveroutlen); 368 sasl_dispose(&vs->sasl.conn); 369 vs->sasl.conn = NULL; 370 goto authabort; 371 } 372 373 VNC_DEBUG("SASL return data %d bytes, nil; %d\n", 374 serveroutlen, serverout ? 0 : 1); 375 376 if (serveroutlen) { 377 vnc_write_u32(vs, serveroutlen + 1); 378 vnc_write(vs, serverout, serveroutlen + 1); 379 } else { 380 vnc_write_u32(vs, 0); 381 } 382 383 /* Whether auth is complete */ 384 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); 385 386 if (err == SASL_CONTINUE) { 387 VNC_DEBUG("%s", "Authentication must continue\n"); 388 /* Wait for step length */ 389 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); 390 } else { 391 if (!vnc_auth_sasl_check_ssf(vs)) { 392 VNC_DEBUG("Authentication rejected for weak SSF %p\n", vs->ioc); 393 goto authreject; 394 } 395 396 /* Check username whitelist ACL */ 397 if (vnc_auth_sasl_check_access(vs) < 0) { 398 VNC_DEBUG("Authentication rejected for ACL %p\n", vs->ioc); 399 goto authreject; 400 } 401 402 VNC_DEBUG("Authentication successful %p\n", vs->ioc); 403 vnc_write_u32(vs, 0); /* Accept auth */ 404 start_client_init(vs); 405 } 406 407 return 0; 408 409 authreject: 410 vnc_write_u32(vs, 1); /* Reject auth */ 411 vnc_write_u32(vs, sizeof("Authentication failed")); 412 vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); 413 vnc_flush(vs); 414 vnc_client_error(vs); 415 return -1; 416 417 authabort: 418 vnc_client_error(vs); 419 return -1; 420 } 421 422 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len) 423 { 424 uint32_t startlen = read_u32(data, 0); 425 VNC_DEBUG("Got client start len %d\n", startlen); 426 if (startlen > SASL_DATA_MAX_LEN) { 427 VNC_DEBUG("Too much SASL data %d\n", startlen); 428 vnc_client_error(vs); 429 return -1; 430 } 431 432 if (startlen == 0) 433 return protocol_client_auth_sasl_start(vs, NULL, 0); 434 435 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen); 436 return 0; 437 } 438 439 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len) 440 { 441 char *mechname = g_strndup((const char *) data, len); 442 VNC_DEBUG("Got client mechname '%s' check against '%s'\n", 443 mechname, vs->sasl.mechlist); 444 445 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { 446 if (vs->sasl.mechlist[len] != '\0' && 447 vs->sasl.mechlist[len] != ',') { 448 VNC_DEBUG("One %d", vs->sasl.mechlist[len]); 449 goto fail; 450 } 451 } else { 452 char *offset = strstr(vs->sasl.mechlist, mechname); 453 VNC_DEBUG("Two %p\n", offset); 454 if (!offset) { 455 goto fail; 456 } 457 VNC_DEBUG("Two '%s'\n", offset); 458 if (offset[-1] != ',' || 459 (offset[len] != '\0'&& 460 offset[len] != ',')) { 461 goto fail; 462 } 463 } 464 465 g_free(vs->sasl.mechlist); 466 vs->sasl.mechlist = mechname; 467 468 VNC_DEBUG("Validated mechname '%s'\n", mechname); 469 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4); 470 return 0; 471 472 fail: 473 vnc_client_error(vs); 474 g_free(mechname); 475 return -1; 476 } 477 478 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len) 479 { 480 uint32_t mechlen = read_u32(data, 0); 481 VNC_DEBUG("Got client mechname len %d\n", mechlen); 482 if (mechlen > 100) { 483 VNC_DEBUG("Too long SASL mechname data %d\n", mechlen); 484 vnc_client_error(vs); 485 return -1; 486 } 487 if (mechlen < 1) { 488 VNC_DEBUG("Too short SASL mechname %d\n", mechlen); 489 vnc_client_error(vs); 490 return -1; 491 } 492 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen); 493 return 0; 494 } 495 496 static char * 497 vnc_socket_ip_addr_string(QIOChannelSocket *ioc, 498 bool local, 499 Error **errp) 500 { 501 SocketAddress *addr; 502 char *ret; 503 504 if (local) { 505 addr = qio_channel_socket_get_local_address(ioc, errp); 506 } else { 507 addr = qio_channel_socket_get_remote_address(ioc, errp); 508 } 509 if (!addr) { 510 return NULL; 511 } 512 513 if (addr->type != SOCKET_ADDRESS_TYPE_INET) { 514 error_setg(errp, "Not an inet socket type"); 515 return NULL; 516 } 517 ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port); 518 qapi_free_SocketAddress(addr); 519 return ret; 520 } 521 522 void start_auth_sasl(VncState *vs) 523 { 524 const char *mechlist = NULL; 525 sasl_security_properties_t secprops; 526 int err; 527 char *localAddr, *remoteAddr; 528 int mechlistlen; 529 530 VNC_DEBUG("Initialize SASL auth %p\n", vs->ioc); 531 532 /* Get local & remote client addresses in form IPADDR;PORT */ 533 localAddr = vnc_socket_ip_addr_string(vs->sioc, true, NULL); 534 if (!localAddr) { 535 goto authabort; 536 } 537 538 remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, NULL); 539 if (!remoteAddr) { 540 g_free(localAddr); 541 goto authabort; 542 } 543 544 err = sasl_server_new("vnc", 545 NULL, /* FQDN - just delegates to gethostname */ 546 NULL, /* User realm */ 547 localAddr, 548 remoteAddr, 549 NULL, /* Callbacks, not needed */ 550 SASL_SUCCESS_DATA, 551 &vs->sasl.conn); 552 g_free(localAddr); 553 g_free(remoteAddr); 554 localAddr = remoteAddr = NULL; 555 556 if (err != SASL_OK) { 557 VNC_DEBUG("sasl context setup failed %d (%s)", 558 err, sasl_errstring(err, NULL, NULL)); 559 vs->sasl.conn = NULL; 560 goto authabort; 561 } 562 563 /* Inform SASL that we've got an external SSF layer from TLS/x509 */ 564 if (vs->auth == VNC_AUTH_VENCRYPT && 565 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) { 566 Error *local_err = NULL; 567 int keysize; 568 sasl_ssf_t ssf; 569 570 keysize = qcrypto_tls_session_get_key_size(vs->tls, 571 &local_err); 572 if (keysize < 0) { 573 VNC_DEBUG("cannot TLS get cipher size: %s\n", 574 error_get_pretty(local_err)); 575 error_free(local_err); 576 sasl_dispose(&vs->sasl.conn); 577 vs->sasl.conn = NULL; 578 goto authabort; 579 } 580 ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */ 581 582 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); 583 if (err != SASL_OK) { 584 VNC_DEBUG("cannot set SASL external SSF %d (%s)\n", 585 err, sasl_errstring(err, NULL, NULL)); 586 sasl_dispose(&vs->sasl.conn); 587 vs->sasl.conn = NULL; 588 goto authabort; 589 } 590 } else { 591 vs->sasl.wantSSF = 1; 592 } 593 594 memset (&secprops, 0, sizeof secprops); 595 /* Inform SASL that we've got an external SSF layer from TLS. 596 * 597 * Disable SSF, if using TLS+x509+SASL only. TLS without x509 598 * is not sufficiently strong 599 */ 600 if (vs->vd->is_unix || 601 (vs->auth == VNC_AUTH_VENCRYPT && 602 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) { 603 /* If we've got TLS or UNIX domain sock, we don't care about SSF */ 604 secprops.min_ssf = 0; 605 secprops.max_ssf = 0; 606 secprops.maxbufsize = 8192; 607 secprops.security_flags = 0; 608 } else { 609 /* Plain TCP, better get an SSF layer */ 610 secprops.min_ssf = 56; /* Good enough to require kerberos */ 611 secprops.max_ssf = 100000; /* Arbitrary big number */ 612 secprops.maxbufsize = 8192; 613 /* Forbid any anonymous or trivially crackable auth */ 614 secprops.security_flags = 615 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; 616 } 617 618 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops); 619 if (err != SASL_OK) { 620 VNC_DEBUG("cannot set SASL security props %d (%s)\n", 621 err, sasl_errstring(err, NULL, NULL)); 622 sasl_dispose(&vs->sasl.conn); 623 vs->sasl.conn = NULL; 624 goto authabort; 625 } 626 627 err = sasl_listmech(vs->sasl.conn, 628 NULL, /* Don't need to set user */ 629 "", /* Prefix */ 630 ",", /* Separator */ 631 "", /* Suffix */ 632 &mechlist, 633 NULL, 634 NULL); 635 if (err != SASL_OK) { 636 VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n", 637 err, sasl_errdetail(vs->sasl.conn)); 638 sasl_dispose(&vs->sasl.conn); 639 vs->sasl.conn = NULL; 640 goto authabort; 641 } 642 VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist); 643 644 vs->sasl.mechlist = g_strdup(mechlist); 645 mechlistlen = strlen(mechlist); 646 vnc_write_u32(vs, mechlistlen); 647 vnc_write(vs, mechlist, mechlistlen); 648 vnc_flush(vs); 649 650 VNC_DEBUG("Wait for client mechname length\n"); 651 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4); 652 653 return; 654 655 authabort: 656 vnc_client_error(vs); 657 } 658 659 660