Update version for v5.1.0 release
[qemu.git] / ui / vnc-auth-sasl.c
1 /*
2 * QEMU VNC display driver: SASL auth protocol
3 *
4 * Copyright (C) 2009 Red Hat, Inc
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25 #include "qemu/osdep.h"
26 #include "qapi/error.h"
27 #include "authz/base.h"
28 #include "vnc.h"
29 #include "trace.h"
30
31 /* Max amount of data we send/recv for SASL steps to prevent DOS */
32 #define SASL_DATA_MAX_LEN (1024 * 1024)
33
34
35 void vnc_sasl_client_cleanup(VncState *vs)
36 {
37 if (vs->sasl.conn) {
38 vs->sasl.runSSF = false;
39 vs->sasl.wantSSF = false;
40 vs->sasl.waitWriteSSF = 0;
41 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
42 vs->sasl.encoded = NULL;
43 g_free(vs->sasl.username);
44 g_free(vs->sasl.mechlist);
45 vs->sasl.username = vs->sasl.mechlist = NULL;
46 sasl_dispose(&vs->sasl.conn);
47 vs->sasl.conn = NULL;
48 }
49 }
50
51
52 size_t vnc_client_write_sasl(VncState *vs)
53 {
54 size_t ret;
55
56 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
57 "Encoded: %p size %d offset %d\n",
58 vs->output.buffer, vs->output.capacity, vs->output.offset,
59 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
60
61 if (!vs->sasl.encoded) {
62 int err;
63 err = sasl_encode(vs->sasl.conn,
64 (char *)vs->output.buffer,
65 vs->output.offset,
66 (const char **)&vs->sasl.encoded,
67 &vs->sasl.encodedLength);
68 if (err != SASL_OK)
69 return vnc_client_io_error(vs, -1, NULL);
70
71 vs->sasl.encodedRawLength = vs->output.offset;
72 vs->sasl.encodedOffset = 0;
73 }
74
75 ret = vnc_client_write_buf(vs,
76 vs->sasl.encoded + vs->sasl.encodedOffset,
77 vs->sasl.encodedLength - vs->sasl.encodedOffset);
78 if (!ret)
79 return 0;
80
81 vs->sasl.encodedOffset += ret;
82 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
83 bool throttled = vs->force_update_offset != 0;
84 size_t offset;
85 if (vs->sasl.encodedRawLength >= vs->force_update_offset) {
86 vs->force_update_offset = 0;
87 } else {
88 vs->force_update_offset -= vs->sasl.encodedRawLength;
89 }
90 if (throttled && vs->force_update_offset == 0) {
91 trace_vnc_client_unthrottle_forced(vs, vs->ioc);
92 }
93 offset = vs->output.offset;
94 buffer_advance(&vs->output, vs->sasl.encodedRawLength);
95 if (offset >= vs->throttle_output_offset &&
96 vs->output.offset < vs->throttle_output_offset) {
97 trace_vnc_client_unthrottle_incremental(vs, vs->ioc,
98 vs->output.offset);
99 }
100 vs->sasl.encoded = NULL;
101 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
102 }
103
104 /* Can't merge this block with one above, because
105 * someone might have written more unencrypted
106 * data in vs->output while we were processing
107 * SASL encoded output
108 */
109 if (vs->output.offset == 0) {
110 if (vs->ioc_tag) {
111 g_source_remove(vs->ioc_tag);
112 }
113 vs->ioc_tag = qio_channel_add_watch(
114 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL);
115 }
116
117 return ret;
118 }
119
120
121 size_t vnc_client_read_sasl(VncState *vs)
122 {
123 size_t ret;
124 uint8_t encoded[4096];
125 const char *decoded;
126 unsigned int decodedLen;
127 int err;
128
129 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
130 if (!ret)
131 return 0;
132
133 err = sasl_decode(vs->sasl.conn,
134 (char *)encoded, ret,
135 &decoded, &decodedLen);
136
137 if (err != SASL_OK)
138 return vnc_client_io_error(vs, -1, NULL);
139 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
140 encoded, ret, decoded, decodedLen);
141 buffer_reserve(&vs->input, decodedLen);
142 buffer_append(&vs->input, decoded, decodedLen);
143 return decodedLen;
144 }
145
146
147 static int vnc_auth_sasl_check_access(VncState *vs)
148 {
149 const void *val;
150 int rv;
151 Error *err = NULL;
152 bool allow;
153
154 rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
155 if (rv != SASL_OK) {
156 trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username",
157 sasl_errstring(rv, NULL, NULL));
158 return -1;
159 }
160 if (val == NULL) {
161 trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", "");
162 return -1;
163 }
164
165 vs->sasl.username = g_strdup((const char*)val);
166 trace_vnc_auth_sasl_username(vs, vs->sasl.username);
167
168 if (vs->vd->sasl.authzid == NULL) {
169 trace_vnc_auth_sasl_acl(vs, 1);
170 return 0;
171 }
172
173 allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid,
174 vs->sasl.username, &err);
175 if (err) {
176 trace_vnc_auth_fail(vs, vs->auth, "Error from authz",
177 error_get_pretty(err));
178 error_free(err);
179 return -1;
180 }
181
182 trace_vnc_auth_sasl_acl(vs, allow);
183 return allow ? 0 : -1;
184 }
185
186 static int vnc_auth_sasl_check_ssf(VncState *vs)
187 {
188 const void *val;
189 int err, ssf;
190
191 if (!vs->sasl.wantSSF)
192 return 1;
193
194 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
195 if (err != SASL_OK)
196 return 0;
197
198 ssf = *(const int *)val;
199
200 trace_vnc_auth_sasl_ssf(vs, ssf);
201
202 if (ssf < 56)
203 return 0; /* 56 is good for Kerberos */
204
205 /* Only setup for read initially, because we're about to send an RPC
206 * reply which must be in plain text. When the next incoming RPC
207 * arrives, we'll switch on writes too
208 *
209 * cf qemudClientReadSASL in qemud.c
210 */
211 vs->sasl.runSSF = 1;
212
213 /* We have a SSF that's good enough */
214 return 1;
215 }
216
217 /*
218 * Step Msg
219 *
220 * Input from client:
221 *
222 * u32 clientin-length
223 * u8-array clientin-string
224 *
225 * Output to client:
226 *
227 * u32 serverout-length
228 * u8-array serverout-strin
229 * u8 continue
230 */
231
232 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
233
234 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
235 {
236 uint32_t datalen = len;
237 const char *serverout;
238 unsigned int serveroutlen;
239 int err;
240 char *clientdata = NULL;
241
242 /* NB, distinction of NULL vs "" is *critical* in SASL */
243 if (datalen) {
244 clientdata = (char*)data;
245 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
246 datalen--; /* Don't count NULL byte when passing to _start() */
247 }
248
249 err = sasl_server_step(vs->sasl.conn,
250 clientdata,
251 datalen,
252 &serverout,
253 &serveroutlen);
254 trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err);
255 if (err != SASL_OK &&
256 err != SASL_CONTINUE) {
257 trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth",
258 sasl_errdetail(vs->sasl.conn));
259 sasl_dispose(&vs->sasl.conn);
260 vs->sasl.conn = NULL;
261 goto authabort;
262 }
263
264 if (serveroutlen > SASL_DATA_MAX_LEN) {
265 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
266 sasl_dispose(&vs->sasl.conn);
267 vs->sasl.conn = NULL;
268 goto authabort;
269 }
270
271 if (serveroutlen) {
272 vnc_write_u32(vs, serveroutlen + 1);
273 vnc_write(vs, serverout, serveroutlen + 1);
274 } else {
275 vnc_write_u32(vs, 0);
276 }
277
278 /* Whether auth is complete */
279 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
280
281 if (err == SASL_CONTINUE) {
282 /* Wait for step length */
283 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
284 } else {
285 if (!vnc_auth_sasl_check_ssf(vs)) {
286 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
287 goto authreject;
288 }
289
290 /* Check username whitelist ACL */
291 if (vnc_auth_sasl_check_access(vs) < 0) {
292 goto authreject;
293 }
294
295 trace_vnc_auth_pass(vs, vs->auth);
296 vnc_write_u32(vs, 0); /* Accept auth */
297 /*
298 * Delay writing in SSF encoded mode until pending output
299 * buffer is written
300 */
301 if (vs->sasl.runSSF)
302 vs->sasl.waitWriteSSF = vs->output.offset;
303 start_client_init(vs);
304 }
305
306 return 0;
307
308 authreject:
309 vnc_write_u32(vs, 1); /* Reject auth */
310 vnc_write_u32(vs, sizeof("Authentication failed"));
311 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
312 vnc_flush(vs);
313 vnc_client_error(vs);
314 return -1;
315
316 authabort:
317 vnc_client_error(vs);
318 return -1;
319 }
320
321 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
322 {
323 uint32_t steplen = read_u32(data, 0);
324
325 if (steplen > SASL_DATA_MAX_LEN) {
326 trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", "");
327 vnc_client_error(vs);
328 return -1;
329 }
330
331 if (steplen == 0)
332 return protocol_client_auth_sasl_step(vs, NULL, 0);
333 else
334 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
335 return 0;
336 }
337
338 /*
339 * Start Msg
340 *
341 * Input from client:
342 *
343 * u32 clientin-length
344 * u8-array clientin-string
345 *
346 * Output to client:
347 *
348 * u32 serverout-length
349 * u8-array serverout-strin
350 * u8 continue
351 */
352
353 #define SASL_DATA_MAX_LEN (1024 * 1024)
354
355 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
356 {
357 uint32_t datalen = len;
358 const char *serverout;
359 unsigned int serveroutlen;
360 int err;
361 char *clientdata = NULL;
362
363 /* NB, distinction of NULL vs "" is *critical* in SASL */
364 if (datalen) {
365 clientdata = (char*)data;
366 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
367 datalen--; /* Don't count NULL byte when passing to _start() */
368 }
369
370 err = sasl_server_start(vs->sasl.conn,
371 vs->sasl.mechlist,
372 clientdata,
373 datalen,
374 &serverout,
375 &serveroutlen);
376 trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err);
377 if (err != SASL_OK &&
378 err != SASL_CONTINUE) {
379 trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth",
380 sasl_errdetail(vs->sasl.conn));
381 sasl_dispose(&vs->sasl.conn);
382 vs->sasl.conn = NULL;
383 goto authabort;
384 }
385 if (serveroutlen > SASL_DATA_MAX_LEN) {
386 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", "");
387 sasl_dispose(&vs->sasl.conn);
388 vs->sasl.conn = NULL;
389 goto authabort;
390 }
391
392 if (serveroutlen) {
393 vnc_write_u32(vs, serveroutlen + 1);
394 vnc_write(vs, serverout, serveroutlen + 1);
395 } else {
396 vnc_write_u32(vs, 0);
397 }
398
399 /* Whether auth is complete */
400 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
401
402 if (err == SASL_CONTINUE) {
403 /* Wait for step length */
404 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
405 } else {
406 if (!vnc_auth_sasl_check_ssf(vs)) {
407 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", "");
408 goto authreject;
409 }
410
411 /* Check username whitelist ACL */
412 if (vnc_auth_sasl_check_access(vs) < 0) {
413 goto authreject;
414 }
415
416 trace_vnc_auth_pass(vs, vs->auth);
417 vnc_write_u32(vs, 0); /* Accept auth */
418 start_client_init(vs);
419 }
420
421 return 0;
422
423 authreject:
424 vnc_write_u32(vs, 1); /* Reject auth */
425 vnc_write_u32(vs, sizeof("Authentication failed"));
426 vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
427 vnc_flush(vs);
428 vnc_client_error(vs);
429 return -1;
430
431 authabort:
432 vnc_client_error(vs);
433 return -1;
434 }
435
436 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
437 {
438 uint32_t startlen = read_u32(data, 0);
439
440 if (startlen > SASL_DATA_MAX_LEN) {
441 trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", "");
442 vnc_client_error(vs);
443 return -1;
444 }
445
446 if (startlen == 0)
447 return protocol_client_auth_sasl_start(vs, NULL, 0);
448
449 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
450 return 0;
451 }
452
453 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
454 {
455 char *mechname = g_strndup((const char *) data, len);
456 trace_vnc_auth_sasl_mech_choose(vs, mechname);
457
458 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
459 if (vs->sasl.mechlist[len] != '\0' &&
460 vs->sasl.mechlist[len] != ',') {
461 goto fail;
462 }
463 } else {
464 char *offset = strstr(vs->sasl.mechlist, mechname);
465 if (!offset) {
466 goto fail;
467 }
468 if (offset[-1] != ',' ||
469 (offset[len] != '\0'&&
470 offset[len] != ',')) {
471 goto fail;
472 }
473 }
474
475 g_free(vs->sasl.mechlist);
476 vs->sasl.mechlist = mechname;
477
478 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
479 return 0;
480
481 fail:
482 trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname);
483 vnc_client_error(vs);
484 g_free(mechname);
485 return -1;
486 }
487
488 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
489 {
490 uint32_t mechlen = read_u32(data, 0);
491
492 if (mechlen > 100) {
493 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", "");
494 vnc_client_error(vs);
495 return -1;
496 }
497 if (mechlen < 1) {
498 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", "");
499 vnc_client_error(vs);
500 return -1;
501 }
502 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
503 return 0;
504 }
505
506 static char *
507 vnc_socket_ip_addr_string(QIOChannelSocket *ioc,
508 bool local,
509 Error **errp)
510 {
511 SocketAddress *addr;
512 char *ret;
513
514 if (local) {
515 addr = qio_channel_socket_get_local_address(ioc, errp);
516 } else {
517 addr = qio_channel_socket_get_remote_address(ioc, errp);
518 }
519 if (!addr) {
520 return NULL;
521 }
522
523 if (addr->type != SOCKET_ADDRESS_TYPE_INET) {
524 error_setg(errp, "Not an inet socket type");
525 return NULL;
526 }
527 ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port);
528 qapi_free_SocketAddress(addr);
529 return ret;
530 }
531
532 void start_auth_sasl(VncState *vs)
533 {
534 const char *mechlist = NULL;
535 sasl_security_properties_t secprops;
536 int err;
537 Error *local_err = NULL;
538 char *localAddr, *remoteAddr;
539 int mechlistlen;
540
541 /* Get local & remote client addresses in form IPADDR;PORT */
542 localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err);
543 if (!localAddr) {
544 trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP",
545 error_get_pretty(local_err));
546 goto authabort;
547 }
548
549 remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err);
550 if (!remoteAddr) {
551 trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP",
552 error_get_pretty(local_err));
553 g_free(localAddr);
554 goto authabort;
555 }
556
557 err = sasl_server_new("vnc",
558 NULL, /* FQDN - just delegates to gethostname */
559 NULL, /* User realm */
560 localAddr,
561 remoteAddr,
562 NULL, /* Callbacks, not needed */
563 SASL_SUCCESS_DATA,
564 &vs->sasl.conn);
565 g_free(localAddr);
566 g_free(remoteAddr);
567 localAddr = remoteAddr = NULL;
568
569 if (err != SASL_OK) {
570 trace_vnc_auth_fail(vs, vs->auth, "SASL context setup failed",
571 sasl_errstring(err, NULL, NULL));
572 vs->sasl.conn = NULL;
573 goto authabort;
574 }
575
576 /* Inform SASL that we've got an external SSF layer from TLS/x509 */
577 if (vs->auth == VNC_AUTH_VENCRYPT &&
578 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
579 int keysize;
580 sasl_ssf_t ssf;
581
582 keysize = qcrypto_tls_session_get_key_size(vs->tls,
583 &local_err);
584 if (keysize < 0) {
585 trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size",
586 error_get_pretty(local_err));
587 sasl_dispose(&vs->sasl.conn);
588 vs->sasl.conn = NULL;
589 goto authabort;
590 }
591 ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */
592
593 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
594 if (err != SASL_OK) {
595 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF",
596 sasl_errstring(err, NULL, NULL));
597 sasl_dispose(&vs->sasl.conn);
598 vs->sasl.conn = NULL;
599 goto authabort;
600 }
601 } else {
602 vs->sasl.wantSSF = 1;
603 }
604
605 memset (&secprops, 0, sizeof secprops);
606 /* Inform SASL that we've got an external SSF layer from TLS.
607 *
608 * Disable SSF, if using TLS+x509+SASL only. TLS without x509
609 * is not sufficiently strong
610 */
611 if (vs->vd->is_unix ||
612 (vs->auth == VNC_AUTH_VENCRYPT &&
613 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) {
614 /* If we've got TLS or UNIX domain sock, we don't care about SSF */
615 secprops.min_ssf = 0;
616 secprops.max_ssf = 0;
617 secprops.maxbufsize = 8192;
618 secprops.security_flags = 0;
619 } else {
620 /* Plain TCP, better get an SSF layer */
621 secprops.min_ssf = 56; /* Good enough to require kerberos */
622 secprops.max_ssf = 100000; /* Arbitrary big number */
623 secprops.maxbufsize = 8192;
624 /* Forbid any anonymous or trivially crackable auth */
625 secprops.security_flags =
626 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
627 }
628
629 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
630 if (err != SASL_OK) {
631 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props",
632 sasl_errstring(err, NULL, NULL));
633 sasl_dispose(&vs->sasl.conn);
634 vs->sasl.conn = NULL;
635 goto authabort;
636 }
637
638 err = sasl_listmech(vs->sasl.conn,
639 NULL, /* Don't need to set user */
640 "", /* Prefix */
641 ",", /* Separator */
642 "", /* Suffix */
643 &mechlist,
644 NULL,
645 NULL);
646 if (err != SASL_OK) {
647 trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms",
648 sasl_errdetail(vs->sasl.conn));
649 sasl_dispose(&vs->sasl.conn);
650 vs->sasl.conn = NULL;
651 goto authabort;
652 }
653 trace_vnc_auth_sasl_mech_list(vs, mechlist);
654
655 vs->sasl.mechlist = g_strdup(mechlist);
656 mechlistlen = strlen(mechlist);
657 vnc_write_u32(vs, mechlistlen);
658 vnc_write(vs, mechlist, mechlistlen);
659 vnc_flush(vs);
660
661 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
662
663 return;
664
665 authabort:
666 error_free(local_err);
667 vnc_client_error(vs);
668 }
669
670