xref: /openbmc/qemu/ui/vnc-auth-vencrypt.c (revision 05caa062)
1 /*
2  * QEMU VNC display driver: VeNCrypt authentication setup
3  *
4  * Copyright (C) 2006 Anthony Liguori <anthony@codemonkey.ws>
5  * Copyright (C) 2006 Fabrice Bellard
6  * Copyright (C) 2009 Red Hat, Inc
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "qemu/osdep.h"
28 #include "vnc.h"
29 #include "qapi/error.h"
30 #include "qemu/main-loop.h"
31 #include "trace.h"
32 
33 static void start_auth_vencrypt_subauth(VncState *vs)
34 {
35     switch (vs->subauth) {
36     case VNC_AUTH_VENCRYPT_TLSNONE:
37     case VNC_AUTH_VENCRYPT_X509NONE:
38        vnc_write_u32(vs, 0); /* Accept auth completion */
39        start_client_init(vs);
40        break;
41 
42     case VNC_AUTH_VENCRYPT_TLSVNC:
43     case VNC_AUTH_VENCRYPT_X509VNC:
44        start_auth_vnc(vs);
45        break;
46 
47 #ifdef CONFIG_VNC_SASL
48     case VNC_AUTH_VENCRYPT_TLSSASL:
49     case VNC_AUTH_VENCRYPT_X509SASL:
50       start_auth_sasl(vs);
51       break;
52 #endif /* CONFIG_VNC_SASL */
53 
54     default: /* Should not be possible, but just in case */
55        trace_vnc_auth_fail(vs, vs->auth, "Unhandled VeNCrypt subauth", "");
56        vnc_write_u8(vs, 1);
57        if (vs->minor >= 8) {
58            static const char err[] = "Unsupported authentication type";
59            vnc_write_u32(vs, sizeof(err));
60            vnc_write(vs, err, sizeof(err));
61        }
62        vnc_client_error(vs);
63     }
64 }
65 
66 static void vnc_tls_handshake_done(QIOTask *task,
67                                    gpointer user_data)
68 {
69     VncState *vs = user_data;
70     Error *err = NULL;
71 
72     if (qio_task_propagate_error(task, &err)) {
73         trace_vnc_auth_fail(vs, vs->auth, "TLS handshake failed",
74                             error_get_pretty(err));
75         vnc_client_error(vs);
76         error_free(err);
77     } else {
78         if (vs->ioc_tag) {
79             g_source_remove(vs->ioc_tag);
80         }
81         vs->ioc_tag = qio_channel_add_watch(
82             vs->ioc, G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_OUT,
83             vnc_client_io, vs, NULL);
84         start_auth_vencrypt_subauth(vs);
85     }
86 }
87 
88 
89 static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len)
90 {
91     int auth = read_u32(data, 0);
92 
93     trace_vnc_auth_vencrypt_subauth(vs, auth);
94     if (auth != vs->subauth) {
95         trace_vnc_auth_fail(vs, vs->auth, "Unsupported sub-auth version", "");
96         vnc_write_u8(vs, 0); /* Reject auth */
97         vnc_flush(vs);
98         vnc_client_error(vs);
99     } else {
100         Error *err = NULL;
101         QIOChannelTLS *tls;
102         vnc_write_u8(vs, 1); /* Accept auth */
103         vnc_flush(vs);
104 
105         if (vs->ioc_tag) {
106             g_source_remove(vs->ioc_tag);
107             vs->ioc_tag = 0;
108         }
109 
110         tls = qio_channel_tls_new_server(
111             vs->ioc,
112             vs->vd->tlscreds,
113             vs->vd->tlsauthzid,
114             &err);
115         if (!tls) {
116             trace_vnc_auth_fail(vs, vs->auth, "TLS setup failed",
117                                 error_get_pretty(err));
118             error_free(err);
119             vnc_client_error(vs);
120             return 0;
121         }
122 
123         qio_channel_set_name(QIO_CHANNEL(tls), "vnc-server-tls");
124         object_unref(OBJECT(vs->ioc));
125         vs->ioc = QIO_CHANNEL(tls);
126         trace_vnc_client_io_wrap(vs, vs->ioc, "tls");
127         vs->tls = qio_channel_tls_get_session(tls);
128 
129         qio_channel_tls_handshake(tls,
130                                   vnc_tls_handshake_done,
131                                   vs,
132                                   NULL,
133                                   NULL);
134     }
135     return 0;
136 }
137 
138 static int protocol_client_vencrypt_init(VncState *vs, uint8_t *data, size_t len)
139 {
140     trace_vnc_auth_vencrypt_version(vs, (int)data[0], (int)data[1]);
141     if (data[0] != 0 ||
142         data[1] != 2) {
143         trace_vnc_auth_fail(vs, vs->auth, "Unsupported version", "");
144         vnc_write_u8(vs, 1); /* Reject version */
145         vnc_flush(vs);
146         vnc_client_error(vs);
147     } else {
148         vnc_write_u8(vs, 0); /* Accept version */
149         vnc_write_u8(vs, 1); /* Number of sub-auths */
150         vnc_write_u32(vs, vs->subauth); /* The supported auth */
151         vnc_flush(vs);
152         vnc_read_when(vs, protocol_client_vencrypt_auth, 4);
153     }
154     return 0;
155 }
156 
157 
158 void start_auth_vencrypt(VncState *vs)
159 {
160     /* Send VeNCrypt version 0.2 */
161     vnc_write_u8(vs, 0);
162     vnc_write_u8(vs, 2);
163 
164     vnc_read_when(vs, protocol_client_vencrypt_init, 2);
165 }
166 
167