diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2024-09-11 13:13:01 +0100 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2024-10-22 11:44:23 +0100 |
| commit | c0a9c92bd5a9c410a2b981f4d88f5584b55c1dfd (patch) | |
| tree | c3d893bdcd9b5f4c5c1496166462ee10ab8fe821 /ui/vnc-auth-sasl.c | |
| parent | e9eabcc911a2056a91e37384f002610351ca0907 (diff) | |
ui/vnc: fix skipping SASL SSF on UNIX sockets
The 'is_unix' flag is set on the VNC server during startup, however,
a regression in:
commit 8bd22f477f68bbd7a9c88e926e7a58bf65605e39
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: Fri Feb 3 12:06:46 2017 +0000
ui: extract code to connect/listen from vnc_display_open
meant we stopped setting the 'is_unix' flag when QEMU listens for
VNC sockets, only setting when QEMU does a reverse VNC connection.
Rather than fixing setting of the 'is_unix' flag, remove it, and
directly check the live client socket address. This is more robust
to a possible situation where the VNC server was listening on a
mixture of INET and UNIX sockets.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'ui/vnc-auth-sasl.c')
| -rw-r--r-- | ui/vnc-auth-sasl.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index edf19deb3b..43515447fb 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -551,6 +551,13 @@ vnc_socket_ip_addr_string(QIOChannelSocket *ioc, return 0; } +static bool +vnc_socket_is_unix(QIOChannelSocket *ioc) +{ + SocketAddress *addr = qio_channel_socket_get_local_address(ioc, NULL); + return addr && addr->type == SOCKET_ADDRESS_TYPE_UNIX; +} + void start_auth_sasl(VncState *vs) { const char *mechlist = NULL; @@ -627,10 +634,11 @@ void start_auth_sasl(VncState *vs) memset (&secprops, 0, sizeof secprops); /* Inform SASL that we've got an external SSF layer from TLS. * - * Disable SSF, if using TLS+x509+SASL only. TLS without x509 - * is not sufficiently strong + * Disable SSF, if using TLS+x509+SASL only, or UNIX sockets. + * TLS without x509 is not sufficiently strong, nor is plain + * TCP */ - if (vs->vd->is_unix || + if (vnc_socket_is_unix(vs->sioc) || (vs->auth == VNC_AUTH_VENCRYPT && vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)) { /* If we've got TLS or UNIX domain sock, we don't care about SSF */ |