1 /* 2 * QEMU VNC display driver: SASL auth protocol 3 * 4 * Copyright (C) 2009 Red Hat, Inc 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "qapi/error.h" 27 #include "authz/base.h" 28 #include "vnc.h" 29 #include "trace.h" 30 31 /* Max amount of data we send/recv for SASL steps to prevent DOS */ 32 #define SASL_DATA_MAX_LEN (1024 * 1024) 33 34 35 void vnc_sasl_client_cleanup(VncState *vs) 36 { 37 if (vs->sasl.conn) { 38 vs->sasl.runSSF = false; 39 vs->sasl.wantSSF = false; 40 vs->sasl.waitWriteSSF = 0; 41 vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; 42 vs->sasl.encoded = NULL; 43 g_free(vs->sasl.username); 44 g_free(vs->sasl.mechlist); 45 vs->sasl.username = vs->sasl.mechlist = NULL; 46 sasl_dispose(&vs->sasl.conn); 47 vs->sasl.conn = NULL; 48 } 49 } 50 51 52 size_t vnc_client_write_sasl(VncState *vs) 53 { 54 size_t ret; 55 56 VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd " 57 "Encoded: %p size %d offset %d\n", 58 vs->output.buffer, vs->output.capacity, vs->output.offset, 59 vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); 60 61 if (!vs->sasl.encoded) { 62 int err; 63 err = sasl_encode(vs->sasl.conn, 64 (char *)vs->output.buffer, 65 vs->output.offset, 66 (const char **)&vs->sasl.encoded, 67 &vs->sasl.encodedLength); 68 if (err != SASL_OK) 69 return vnc_client_io_error(vs, -1, NULL); 70 71 vs->sasl.encodedRawLength = vs->output.offset; 72 vs->sasl.encodedOffset = 0; 73 } 74 75 ret = vnc_client_write_buf(vs, 76 vs->sasl.encoded + vs->sasl.encodedOffset, 77 vs->sasl.encodedLength - vs->sasl.encodedOffset); 78 if (!ret) 79 return 0; 80 81 vs->sasl.encodedOffset += ret; 82 if (vs->sasl.encodedOffset == vs->sasl.encodedLength) { 83 bool throttled = vs->force_update_offset != 0; 84 size_t offset; 85 if (vs->sasl.encodedRawLength >= vs->force_update_offset) { 86 vs->force_update_offset = 0; 87 } else { 88 vs->force_update_offset -= vs->sasl.encodedRawLength; 89 } 90 if (throttled && vs->force_update_offset == 0) { 91 trace_vnc_client_unthrottle_forced(vs, vs->ioc); 92 } 93 offset = vs->output.offset; 94 buffer_advance(&vs->output, vs->sasl.encodedRawLength); 95 if (offset >= vs->throttle_output_offset && 96 vs->output.offset < vs->throttle_output_offset) { 97 trace_vnc_client_unthrottle_incremental(vs, vs->ioc, 98 vs->output.offset); 99 } 100 vs->sasl.encoded = NULL; 101 vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; 102 } 103 104 /* Can't merge this block with one above, because 105 * someone might have written more unencrypted 106 * data in vs->output while we were processing 107 * SASL encoded output 108 */ 109 if (vs->output.offset == 0) { 110 if (vs->ioc_tag) { 111 g_source_remove(vs->ioc_tag); 112 } 113 vs->ioc_tag = qio_channel_add_watch( 114 vs->ioc, G_IO_IN, vnc_client_io, vs, NULL); 115 } 116 117 return ret; 118 } 119 120 121 size_t vnc_client_read_sasl(VncState *vs) 122 { 123 size_t ret; 124 uint8_t encoded[4096]; 125 const char *decoded; 126 unsigned int decodedLen; 127 int err; 128 129 ret = vnc_client_read_buf(vs, encoded, sizeof(encoded)); 130 if (!ret) 131 return 0; 132 133 err = sasl_decode(vs->sasl.conn, 134 (char *)encoded, ret, 135 &decoded, &decodedLen); 136 137 if (err != SASL_OK) 138 return vnc_client_io_error(vs, -1, NULL); 139 VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n", 140 encoded, ret, decoded, decodedLen); 141 buffer_reserve(&vs->input, decodedLen); 142 buffer_append(&vs->input, decoded, decodedLen); 143 return decodedLen; 144 } 145 146 147 static int vnc_auth_sasl_check_access(VncState *vs) 148 { 149 const void *val; 150 int rv; 151 Error *err = NULL; 152 bool allow; 153 154 rv = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val); 155 if (rv != SASL_OK) { 156 trace_vnc_auth_fail(vs, vs->auth, "Cannot fetch SASL username", 157 sasl_errstring(rv, NULL, NULL)); 158 return -1; 159 } 160 if (val == NULL) { 161 trace_vnc_auth_fail(vs, vs->auth, "No SASL username set", ""); 162 return -1; 163 } 164 165 vs->sasl.username = g_strdup((const char*)val); 166 trace_vnc_auth_sasl_username(vs, vs->sasl.username); 167 168 if (vs->vd->sasl.authzid == NULL) { 169 trace_vnc_auth_sasl_acl(vs, 1); 170 return 0; 171 } 172 173 allow = qauthz_is_allowed_by_id(vs->vd->sasl.authzid, 174 vs->sasl.username, &err); 175 if (err) { 176 trace_vnc_auth_fail(vs, vs->auth, "Error from authz", 177 error_get_pretty(err)); 178 error_free(err); 179 return -1; 180 } 181 182 trace_vnc_auth_sasl_acl(vs, allow); 183 return allow ? 0 : -1; 184 } 185 186 static int vnc_auth_sasl_check_ssf(VncState *vs) 187 { 188 const void *val; 189 int err, ssf; 190 191 if (!vs->sasl.wantSSF) 192 return 1; 193 194 err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val); 195 if (err != SASL_OK) 196 return 0; 197 198 ssf = *(const int *)val; 199 200 trace_vnc_auth_sasl_ssf(vs, ssf); 201 202 if (ssf < 56) 203 return 0; /* 56 is good for Kerberos */ 204 205 /* Only setup for read initially, because we're about to send an RPC 206 * reply which must be in plain text. When the next incoming RPC 207 * arrives, we'll switch on writes too 208 * 209 * cf qemudClientReadSASL in qemud.c 210 */ 211 vs->sasl.runSSF = 1; 212 213 /* We have a SSF that's good enough */ 214 return 1; 215 } 216 217 /* 218 * Step Msg 219 * 220 * Input from client: 221 * 222 * u32 clientin-length 223 * u8-array clientin-string 224 * 225 * Output to client: 226 * 227 * u32 serverout-length 228 * u8-array serverout-strin 229 * u8 continue 230 */ 231 232 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len); 233 234 static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len) 235 { 236 uint32_t datalen = len; 237 const char *serverout; 238 unsigned int serveroutlen; 239 int err; 240 char *clientdata = NULL; 241 242 /* NB, distinction of NULL vs "" is *critical* in SASL */ 243 if (datalen) { 244 clientdata = (char*)data; 245 clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ 246 datalen--; /* Don't count NULL byte when passing to _start() */ 247 } 248 249 err = sasl_server_step(vs->sasl.conn, 250 clientdata, 251 datalen, 252 &serverout, 253 &serveroutlen); 254 trace_vnc_auth_sasl_step(vs, data, len, serverout, serveroutlen, err); 255 if (err != SASL_OK && 256 err != SASL_CONTINUE) { 257 trace_vnc_auth_fail(vs, vs->auth, "Cannot step SASL auth", 258 sasl_errdetail(vs->sasl.conn)); 259 sasl_dispose(&vs->sasl.conn); 260 vs->sasl.conn = NULL; 261 goto authabort; 262 } 263 264 if (serveroutlen > SASL_DATA_MAX_LEN) { 265 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", ""); 266 sasl_dispose(&vs->sasl.conn); 267 vs->sasl.conn = NULL; 268 goto authabort; 269 } 270 271 if (serveroutlen) { 272 vnc_write_u32(vs, serveroutlen + 1); 273 vnc_write(vs, serverout, serveroutlen + 1); 274 } else { 275 vnc_write_u32(vs, 0); 276 } 277 278 /* Whether auth is complete */ 279 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); 280 281 if (err == SASL_CONTINUE) { 282 /* Wait for step length */ 283 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); 284 } else { 285 if (!vnc_auth_sasl_check_ssf(vs)) { 286 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", ""); 287 goto authreject; 288 } 289 290 /* Check username whitelist ACL */ 291 if (vnc_auth_sasl_check_access(vs) < 0) { 292 goto authreject; 293 } 294 295 trace_vnc_auth_pass(vs, vs->auth); 296 vnc_write_u32(vs, 0); /* Accept auth */ 297 /* 298 * Delay writing in SSF encoded mode until pending output 299 * buffer is written 300 */ 301 if (vs->sasl.runSSF) 302 vs->sasl.waitWriteSSF = vs->output.offset; 303 start_client_init(vs); 304 } 305 306 return 0; 307 308 authreject: 309 vnc_write_u32(vs, 1); /* Reject auth */ 310 vnc_write_u32(vs, sizeof("Authentication failed")); 311 vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); 312 vnc_flush(vs); 313 vnc_client_error(vs); 314 return -1; 315 316 authabort: 317 vnc_client_error(vs); 318 return -1; 319 } 320 321 static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len) 322 { 323 uint32_t steplen = read_u32(data, 0); 324 325 if (steplen > SASL_DATA_MAX_LEN) { 326 trace_vnc_auth_fail(vs, vs->auth, "SASL step len too large", ""); 327 vnc_client_error(vs); 328 return -1; 329 } 330 331 if (steplen == 0) 332 return protocol_client_auth_sasl_step(vs, NULL, 0); 333 else 334 vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); 335 return 0; 336 } 337 338 /* 339 * Start Msg 340 * 341 * Input from client: 342 * 343 * u32 clientin-length 344 * u8-array clientin-string 345 * 346 * Output to client: 347 * 348 * u32 serverout-length 349 * u8-array serverout-strin 350 * u8 continue 351 */ 352 353 #define SASL_DATA_MAX_LEN (1024 * 1024) 354 355 static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len) 356 { 357 uint32_t datalen = len; 358 const char *serverout; 359 unsigned int serveroutlen; 360 int err; 361 char *clientdata = NULL; 362 363 /* NB, distinction of NULL vs "" is *critical* in SASL */ 364 if (datalen) { 365 clientdata = (char*)data; 366 clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ 367 datalen--; /* Don't count NULL byte when passing to _start() */ 368 } 369 370 err = sasl_server_start(vs->sasl.conn, 371 vs->sasl.mechlist, 372 clientdata, 373 datalen, 374 &serverout, 375 &serveroutlen); 376 trace_vnc_auth_sasl_start(vs, data, len, serverout, serveroutlen, err); 377 if (err != SASL_OK && 378 err != SASL_CONTINUE) { 379 trace_vnc_auth_fail(vs, vs->auth, "Cannot start SASL auth", 380 sasl_errdetail(vs->sasl.conn)); 381 sasl_dispose(&vs->sasl.conn); 382 vs->sasl.conn = NULL; 383 goto authabort; 384 } 385 if (serveroutlen > SASL_DATA_MAX_LEN) { 386 trace_vnc_auth_fail(vs, vs->auth, "SASL data too long", ""); 387 sasl_dispose(&vs->sasl.conn); 388 vs->sasl.conn = NULL; 389 goto authabort; 390 } 391 392 if (serveroutlen) { 393 vnc_write_u32(vs, serveroutlen + 1); 394 vnc_write(vs, serverout, serveroutlen + 1); 395 } else { 396 vnc_write_u32(vs, 0); 397 } 398 399 /* Whether auth is complete */ 400 vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); 401 402 if (err == SASL_CONTINUE) { 403 /* Wait for step length */ 404 vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); 405 } else { 406 if (!vnc_auth_sasl_check_ssf(vs)) { 407 trace_vnc_auth_fail(vs, vs->auth, "SASL SSF too weak", ""); 408 goto authreject; 409 } 410 411 /* Check username whitelist ACL */ 412 if (vnc_auth_sasl_check_access(vs) < 0) { 413 goto authreject; 414 } 415 416 trace_vnc_auth_pass(vs, vs->auth); 417 vnc_write_u32(vs, 0); /* Accept auth */ 418 start_client_init(vs); 419 } 420 421 return 0; 422 423 authreject: 424 vnc_write_u32(vs, 1); /* Reject auth */ 425 vnc_write_u32(vs, sizeof("Authentication failed")); 426 vnc_write(vs, "Authentication failed", sizeof("Authentication failed")); 427 vnc_flush(vs); 428 vnc_client_error(vs); 429 return -1; 430 431 authabort: 432 vnc_client_error(vs); 433 return -1; 434 } 435 436 static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len) 437 { 438 uint32_t startlen = read_u32(data, 0); 439 440 if (startlen > SASL_DATA_MAX_LEN) { 441 trace_vnc_auth_fail(vs, vs->auth, "SASL start len too large", ""); 442 vnc_client_error(vs); 443 return -1; 444 } 445 446 if (startlen == 0) 447 return protocol_client_auth_sasl_start(vs, NULL, 0); 448 449 vnc_read_when(vs, protocol_client_auth_sasl_start, startlen); 450 return 0; 451 } 452 453 static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len) 454 { 455 char *mechname = g_strndup((const char *) data, len); 456 trace_vnc_auth_sasl_mech_choose(vs, mechname); 457 458 if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { 459 if (vs->sasl.mechlist[len] != '\0' && 460 vs->sasl.mechlist[len] != ',') { 461 goto fail; 462 } 463 } else { 464 char *offset = strstr(vs->sasl.mechlist, mechname); 465 if (!offset) { 466 goto fail; 467 } 468 if (offset[-1] != ',' || 469 (offset[len] != '\0'&& 470 offset[len] != ',')) { 471 goto fail; 472 } 473 } 474 475 g_free(vs->sasl.mechlist); 476 vs->sasl.mechlist = mechname; 477 478 vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4); 479 return 0; 480 481 fail: 482 trace_vnc_auth_fail(vs, vs->auth, "Unsupported mechname", mechname); 483 vnc_client_error(vs); 484 g_free(mechname); 485 return -1; 486 } 487 488 static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len) 489 { 490 uint32_t mechlen = read_u32(data, 0); 491 492 if (mechlen > 100) { 493 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too long", ""); 494 vnc_client_error(vs); 495 return -1; 496 } 497 if (mechlen < 1) { 498 trace_vnc_auth_fail(vs, vs->auth, "SASL mechname too short", ""); 499 vnc_client_error(vs); 500 return -1; 501 } 502 vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen); 503 return 0; 504 } 505 506 static char * 507 vnc_socket_ip_addr_string(QIOChannelSocket *ioc, 508 bool local, 509 Error **errp) 510 { 511 SocketAddress *addr; 512 char *ret; 513 514 if (local) { 515 addr = qio_channel_socket_get_local_address(ioc, errp); 516 } else { 517 addr = qio_channel_socket_get_remote_address(ioc, errp); 518 } 519 if (!addr) { 520 return NULL; 521 } 522 523 if (addr->type != SOCKET_ADDRESS_TYPE_INET) { 524 error_setg(errp, "Not an inet socket type"); 525 qapi_free_SocketAddress(addr); 526 return NULL; 527 } 528 ret = g_strdup_printf("%s;%s", addr->u.inet.host, addr->u.inet.port); 529 qapi_free_SocketAddress(addr); 530 return ret; 531 } 532 533 void start_auth_sasl(VncState *vs) 534 { 535 const char *mechlist = NULL; 536 sasl_security_properties_t secprops; 537 int err; 538 Error *local_err = NULL; 539 char *localAddr, *remoteAddr; 540 int mechlistlen; 541 542 /* Get local & remote client addresses in form IPADDR;PORT */ 543 localAddr = vnc_socket_ip_addr_string(vs->sioc, true, &local_err); 544 if (!localAddr) { 545 trace_vnc_auth_fail(vs, vs->auth, "Cannot format local IP", 546 error_get_pretty(local_err)); 547 goto authabort; 548 } 549 550 remoteAddr = vnc_socket_ip_addr_string(vs->sioc, false, &local_err); 551 if (!remoteAddr) { 552 trace_vnc_auth_fail(vs, vs->auth, "Cannot format remote IP", 553 error_get_pretty(local_err)); 554 g_free(localAddr); 555 goto authabort; 556 } 557 558 err = sasl_server_new("vnc", 559 NULL, /* FQDN - just delegates to gethostname */ 560 NULL, /* User realm */ 561 localAddr, 562 remoteAddr, 563 NULL, /* Callbacks, not needed */ 564 SASL_SUCCESS_DATA, 565 &vs->sasl.conn); 566 g_free(localAddr); 567 g_free(remoteAddr); 568 localAddr = remoteAddr = NULL; 569 570 if (err != SASL_OK) { 571 trace_vnc_auth_fail(vs, vs->auth, "SASL context setup failed", 572 sasl_errstring(err, NULL, NULL)); 573 vs->sasl.conn = NULL; 574 goto authabort; 575 } 576 577 /* Inform SASL that we've got an external SSF layer from TLS/x509 */ 578 if (vs->auth == VNC_AUTH_VENCRYPT && 579 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) { 580 int keysize; 581 sasl_ssf_t ssf; 582 583 keysize = qcrypto_tls_session_get_key_size(vs->tls, 584 &local_err); 585 if (keysize < 0) { 586 trace_vnc_auth_fail(vs, vs->auth, "cannot TLS get cipher size", 587 error_get_pretty(local_err)); 588 sasl_dispose(&vs->sasl.conn); 589 vs->sasl.conn = NULL; 590 goto authabort; 591 } 592 ssf = keysize * CHAR_BIT; /* tls key size is bytes, sasl wants bits */ 593 594 err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); 595 if (err != SASL_OK) { 596 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL external SSF", 597 sasl_errstring(err, NULL, NULL)); 598 sasl_dispose(&vs->sasl.conn); 599 vs->sasl.conn = NULL; 600 goto authabort; 601 } 602 } else { 603 vs->sasl.wantSSF = 1; 604 } 605 606 memset (&secprops, 0, sizeof secprops); 607 /* Inform SASL that we've got an external SSF layer from TLS. 608 * 609 * Disable SSF, if using TLS+x509+SASL only. TLS without x509 610 * is not sufficiently strong 611 */ 612 if (vs->vd->is_unix || 613 (vs->auth == VNC_AUTH_VENCRYPT && 614 vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) { 615 /* If we've got TLS or UNIX domain sock, we don't care about SSF */ 616 secprops.min_ssf = 0; 617 secprops.max_ssf = 0; 618 secprops.maxbufsize = 8192; 619 secprops.security_flags = 0; 620 } else { 621 /* Plain TCP, better get an SSF layer */ 622 secprops.min_ssf = 56; /* Good enough to require kerberos */ 623 secprops.max_ssf = 100000; /* Arbitrary big number */ 624 secprops.maxbufsize = 8192; 625 /* Forbid any anonymous or trivially crackable auth */ 626 secprops.security_flags = 627 SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; 628 } 629 630 err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops); 631 if (err != SASL_OK) { 632 trace_vnc_auth_fail(vs, vs->auth, "cannot set SASL security props", 633 sasl_errstring(err, NULL, NULL)); 634 sasl_dispose(&vs->sasl.conn); 635 vs->sasl.conn = NULL; 636 goto authabort; 637 } 638 639 err = sasl_listmech(vs->sasl.conn, 640 NULL, /* Don't need to set user */ 641 "", /* Prefix */ 642 ",", /* Separator */ 643 "", /* Suffix */ 644 &mechlist, 645 NULL, 646 NULL); 647 if (err != SASL_OK) { 648 trace_vnc_auth_fail(vs, vs->auth, "cannot list SASL mechanisms", 649 sasl_errdetail(vs->sasl.conn)); 650 sasl_dispose(&vs->sasl.conn); 651 vs->sasl.conn = NULL; 652 goto authabort; 653 } 654 trace_vnc_auth_sasl_mech_list(vs, mechlist); 655 656 vs->sasl.mechlist = g_strdup(mechlist); 657 mechlistlen = strlen(mechlist); 658 vnc_write_u32(vs, mechlistlen); 659 vnc_write(vs, mechlist, mechlistlen); 660 vnc_flush(vs); 661 662 vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4); 663 664 return; 665 666 authabort: 667 error_free(local_err); 668 vnc_client_error(vs); 669 } 670 671 672