diff options
Diffstat (limited to 'vnc-auth-sasl.c')
| -rw-r--r-- | vnc-auth-sasl.c | 484 |
1 files changed, 242 insertions, 242 deletions
diff --git a/vnc-auth-sasl.c b/vnc-auth-sasl.c index 4b4aca9475..acaac0cc4c 100644 --- a/vnc-auth-sasl.c +++ b/vnc-auth-sasl.c @@ -31,14 +31,14 @@ void vnc_sasl_client_cleanup(VncState *vs) { if (vs->sasl.conn) { - vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0; - vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; - vs->sasl.encoded = NULL; - free(vs->sasl.username); - free(vs->sasl.mechlist); - vs->sasl.username = vs->sasl.mechlist = NULL; - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; + vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0; + vs->sasl.encodedLength = vs->sasl.encodedOffset = 0; + vs->sasl.encoded = NULL; + free(vs->sasl.username); + free(vs->sasl.mechlist); + vs->sasl.username = vs->sasl.mechlist = NULL; + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; } } @@ -48,33 +48,33 @@ long vnc_client_write_sasl(VncState *vs) long ret; VNC_DEBUG("Write SASL: Pending output %p size %d offset %d Encoded: %p size %d offset %d\n", - vs->output.buffer, vs->output.capacity, vs->output.offset, - vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); + vs->output.buffer, vs->output.capacity, vs->output.offset, + vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset); if (!vs->sasl.encoded) { - int err; - err = sasl_encode(vs->sasl.conn, - (char *)vs->output.buffer, - vs->output.offset, - (const char **)&vs->sasl.encoded, - &vs->sasl.encodedLength); - if (err != SASL_OK) - return vnc_client_io_error(vs, -1, EIO); - - vs->sasl.encodedOffset = 0; + int err; + err = sasl_encode(vs->sasl.conn, + (char *)vs->output.buffer, + vs->output.offset, + (const char **)&vs->sasl.encoded, + &vs->sasl.encodedLength); + if (err != SASL_OK) + return vnc_client_io_error(vs, -1, EIO); + + vs->sasl.encodedOffset = 0; } ret = vnc_client_write_buf(vs, - vs->sasl.encoded + vs->sasl.encodedOffset, - vs->sasl.encodedLength - vs->sasl.encodedOffset); + vs->sasl.encoded + vs->sasl.encodedOffset, + vs->sasl.encodedLength - vs->sasl.encodedOffset); if (!ret) - return 0; + return 0; vs->sasl.encodedOffset += ret; if (vs->sasl.encodedOffset == vs->sasl.encodedLength) { - vs->output.offset = 0; - vs->sasl.encoded = NULL; - vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; + vs->output.offset = 0; + vs->sasl.encoded = NULL; + vs->sasl.encodedOffset = vs->sasl.encodedLength = 0; } /* Can't merge this block with one above, because @@ -83,7 +83,7 @@ long vnc_client_write_sasl(VncState *vs) * SASL encoded output */ if (vs->output.offset == 0) { - qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); + qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); } return ret; @@ -100,16 +100,16 @@ long vnc_client_read_sasl(VncState *vs) ret = vnc_client_read_buf(vs, encoded, sizeof(encoded)); if (!ret) - return 0; + return 0; err = sasl_decode(vs->sasl.conn, - (char *)encoded, ret, - &decoded, &decodedLen); + (char *)encoded, ret, + &decoded, &decodedLen); if (err != SASL_OK) - return vnc_client_io_error(vs, -1, -EIO); + return vnc_client_io_error(vs, -1, -EIO); VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n", - encoded, ret, decoded, decodedLen); + encoded, ret, decoded, decodedLen); buffer_reserve(&vs->input, decodedLen); buffer_append(&vs->input, decoded, decodedLen); return decodedLen; @@ -124,27 +124,27 @@ static int vnc_auth_sasl_check_access(VncState *vs) err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val); if (err != SASL_OK) { - VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n", - err, sasl_errstring(err, NULL, NULL)); - return -1; + VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n", + err, sasl_errstring(err, NULL, NULL)); + return -1; } if (val == NULL) { - VNC_DEBUG("no client username was found, denying access\n"); - return -1; + VNC_DEBUG("no client username was found, denying access\n"); + return -1; } VNC_DEBUG("SASL client username %s\n", (const char *)val); vs->sasl.username = qemu_strdup((const char*)val); if (vs->vd->sasl.acl == NULL) { - VNC_DEBUG("no ACL activated, allowing access\n"); - return 0; + VNC_DEBUG("no ACL activated, allowing access\n"); + return 0; } allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username); VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username, - allow ? "allowed" : "denied"); + allow ? "allowed" : "denied"); return allow ? 0 : -1; } @@ -154,16 +154,16 @@ static int vnc_auth_sasl_check_ssf(VncState *vs) int err, ssf; if (!vs->sasl.wantSSF) - return 1; + return 1; err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val); if (err != SASL_OK) - return 0; + return 0; ssf = *(const int *)val; VNC_DEBUG("negotiated an SSF of %d\n", ssf); if (ssf < 56) - return 0; /* 56 is good for Kerberos */ + return 0; /* 56 is good for Kerberos */ /* Only setup for read initially, because we're about to send an RPC * reply which must be in plain text. When the next incoming RPC @@ -204,73 +204,73 @@ static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t le /* NB, distinction of NULL vs "" is *critical* in SASL */ if (datalen) { - clientdata = (char*)data; - clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ - datalen--; /* Don't count NULL byte when passing to _start() */ + clientdata = (char*)data; + clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */ + datalen--; /* Don't count NULL byte when passing to _start() */ } VNC_DEBUG("Step using SASL Data %p (%d bytes)\n", - clientdata, datalen); + clientdata, datalen); err = sasl_server_step(vs->sasl.conn, - clientdata, - datalen, - &serverout, - &serveroutlen); + clientdata, + datalen, + &serverout, + &serveroutlen); if (err != SASL_OK && - err != SASL_CONTINUE) { - VNC_DEBUG("sasl step failed %d (%s)\n", - err, sasl_errdetail(vs->sasl.conn)); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + err != SASL_CONTINUE) { + VNC_DEBUG("sasl step failed %d (%s)\n", + err, sasl_errdetail(vs->sasl.conn)); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } if (serveroutlen > SASL_DATA_MAX_LEN) { - VNC_DEBUG("sasl step reply data too long %d\n", - serveroutlen); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("sasl step reply data too long %d\n", + serveroutlen); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } VNC_DEBUG("SASL return data %d bytes, nil; %d\n", - serveroutlen, serverout ? 0 : 1); + serveroutlen, serverout ? 0 : 1); if (serveroutlen) { - vnc_write_u32(vs, serveroutlen + 1); - vnc_write(vs, serverout, serveroutlen + 1); + vnc_write_u32(vs, serveroutlen + 1); + vnc_write(vs, serverout, serveroutlen + 1); } else { - vnc_write_u32(vs, 0); + vnc_write_u32(vs, 0); } /* Whether auth is complete */ vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); if (err == SASL_CONTINUE) { - VNC_DEBUG("%s", "Authentication must continue\n"); - /* Wait for step length */ - vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); + VNC_DEBUG("%s", "Authentication must continue\n"); + /* Wait for step length */ + vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); } else { - if (!vnc_auth_sasl_check_ssf(vs)) { - VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); - goto authreject; - } - - /* Check username whitelist ACL */ - if (vnc_auth_sasl_check_access(vs) < 0) { - VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); - goto authreject; - } - - VNC_DEBUG("Authentication successful %d\n", vs->csock); - vnc_write_u32(vs, 0); /* Accept auth */ - /* - * Delay writing in SSF encoded mode until pending output - * buffer is written - */ - if (vs->sasl.runSSF) - vs->sasl.waitWriteSSF = vs->output.offset; - start_client_init(vs); + if (!vnc_auth_sasl_check_ssf(vs)) { + VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); + goto authreject; + } + + /* Check username whitelist ACL */ + if (vnc_auth_sasl_check_access(vs) < 0) { + VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); + goto authreject; + } + + VNC_DEBUG("Authentication successful %d\n", vs->csock); + vnc_write_u32(vs, 0); /* Accept auth */ + /* + * Delay writing in SSF encoded mode until pending output + * buffer is written + */ + if (vs->sasl.runSSF) + vs->sasl.waitWriteSSF = vs->output.offset; + start_client_init(vs); } return 0; @@ -293,15 +293,15 @@ static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_ uint32_t steplen = read_u32(data, 0); VNC_DEBUG("Got client step len %d\n", steplen); if (steplen > SASL_DATA_MAX_LEN) { - VNC_DEBUG("Too much SASL data %d\n", steplen); - vnc_client_error(vs); - return -1; + VNC_DEBUG("Too much SASL data %d\n", steplen); + vnc_client_error(vs); + return -1; } if (steplen == 0) - return protocol_client_auth_sasl_step(vs, NULL, 0); + return protocol_client_auth_sasl_step(vs, NULL, 0); else - vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); + vnc_read_when(vs, protocol_client_auth_sasl_step, steplen); return 0; } @@ -332,67 +332,67 @@ static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t l /* NB, distinction of NULL vs "" is *critical* in SASL */ if (datalen) { - clientdata = (char*)data; - clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ - datalen--; /* Don't count NULL byte when passing to _start() */ + clientdata = (char*)data; + clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */ + datalen--; /* Don't count NULL byte when passing to _start() */ } VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n", - vs->sasl.mechlist, clientdata, datalen); + vs->sasl.mechlist, clientdata, datalen); err = sasl_server_start(vs->sasl.conn, - vs->sasl.mechlist, - clientdata, - datalen, - &serverout, - &serveroutlen); + vs->sasl.mechlist, + clientdata, + datalen, + &serverout, + &serveroutlen); if (err != SASL_OK && - err != SASL_CONTINUE) { - VNC_DEBUG("sasl start failed %d (%s)\n", - err, sasl_errdetail(vs->sasl.conn)); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + err != SASL_CONTINUE) { + VNC_DEBUG("sasl start failed %d (%s)\n", + err, sasl_errdetail(vs->sasl.conn)); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } if (serveroutlen > SASL_DATA_MAX_LEN) { - VNC_DEBUG("sasl start reply data too long %d\n", - serveroutlen); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("sasl start reply data too long %d\n", + serveroutlen); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } VNC_DEBUG("SASL return data %d bytes, nil; %d\n", - serveroutlen, serverout ? 0 : 1); + serveroutlen, serverout ? 0 : 1); if (serveroutlen) { - vnc_write_u32(vs, serveroutlen + 1); - vnc_write(vs, serverout, serveroutlen + 1); + vnc_write_u32(vs, serveroutlen + 1); + vnc_write(vs, serverout, serveroutlen + 1); } else { - vnc_write_u32(vs, 0); + vnc_write_u32(vs, 0); } /* Whether auth is complete */ vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1); if (err == SASL_CONTINUE) { - VNC_DEBUG("%s", "Authentication must continue\n"); - /* Wait for step length */ - vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); + VNC_DEBUG("%s", "Authentication must continue\n"); + /* Wait for step length */ + vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4); } else { - if (!vnc_auth_sasl_check_ssf(vs)) { - VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); - goto authreject; - } - - /* Check username whitelist ACL */ - if (vnc_auth_sasl_check_access(vs) < 0) { - VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); - goto authreject; - } - - VNC_DEBUG("Authentication successful %d\n", vs->csock); - vnc_write_u32(vs, 0); /* Accept auth */ - start_client_init(vs); + if (!vnc_auth_sasl_check_ssf(vs)) { + VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock); + goto authreject; + } + + /* Check username whitelist ACL */ + if (vnc_auth_sasl_check_access(vs) < 0) { + VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock); + goto authreject; + } + + VNC_DEBUG("Authentication successful %d\n", vs->csock); + vnc_write_u32(vs, 0); /* Accept auth */ + start_client_init(vs); } return 0; @@ -415,13 +415,13 @@ static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size uint32_t startlen = read_u32(data, 0); VNC_DEBUG("Got client start len %d\n", startlen); if (startlen > SASL_DATA_MAX_LEN) { - VNC_DEBUG("Too much SASL data %d\n", startlen); - vnc_client_error(vs); - return -1; + VNC_DEBUG("Too much SASL data %d\n", startlen); + vnc_client_error(vs); + return -1; } if (startlen == 0) - return protocol_client_auth_sasl_start(vs, NULL, 0); + return protocol_client_auth_sasl_start(vs, NULL, 0); vnc_read_when(vs, protocol_client_auth_sasl_start, startlen); return 0; @@ -431,35 +431,35 @@ static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_ { char *mechname = malloc(len + 1); if (!mechname) { - VNC_DEBUG("Out of memory reading mechname\n"); - vnc_client_error(vs); + VNC_DEBUG("Out of memory reading mechname\n"); + vnc_client_error(vs); } strncpy(mechname, (char*)data, len); mechname[len] = '\0'; VNC_DEBUG("Got client mechname '%s' check against '%s'\n", - mechname, vs->sasl.mechlist); + mechname, vs->sasl.mechlist); if (strncmp(vs->sasl.mechlist, mechname, len) == 0) { - if (vs->sasl.mechlist[len] != '\0' && - vs->sasl.mechlist[len] != ',') { - VNC_DEBUG("One %d", vs->sasl.mechlist[len]); - vnc_client_error(vs); - return -1; - } + if (vs->sasl.mechlist[len] != '\0' && + vs->sasl.mechlist[len] != ',') { + VNC_DEBUG("One %d", vs->sasl.mechlist[len]); + vnc_client_error(vs); + return -1; + } } else { - char *offset = strstr(vs->sasl.mechlist, mechname); - VNC_DEBUG("Two %p\n", offset); - if (!offset) { - vnc_client_error(vs); - return -1; - } - VNC_DEBUG("Two '%s'\n", offset); - if (offset[-1] != ',' || - (offset[len] != '\0'&& - offset[len] != ',')) { - vnc_client_error(vs); - return -1; - } + char *offset = strstr(vs->sasl.mechlist, mechname); + VNC_DEBUG("Two %p\n", offset); + if (!offset) { + vnc_client_error(vs); + return -1; + } + VNC_DEBUG("Two '%s'\n", offset); + if (offset[-1] != ',' || + (offset[len] != '\0'&& + offset[len] != ',')) { + vnc_client_error(vs); + return -1; + } } free(vs->sasl.mechlist); @@ -475,20 +475,20 @@ static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, s uint32_t mechlen = read_u32(data, 0); VNC_DEBUG("Got client mechname len %d\n", mechlen); if (mechlen > 100) { - VNC_DEBUG("Too long SASL mechname data %d\n", mechlen); - vnc_client_error(vs); - return -1; + VNC_DEBUG("Too long SASL mechname data %d\n", mechlen); + vnc_client_error(vs); + return -1; } if (mechlen < 1) { - VNC_DEBUG("Too short SASL mechname %d\n", mechlen); - vnc_client_error(vs); - return -1; + VNC_DEBUG("Too short SASL mechname %d\n", mechlen); + vnc_client_error(vs); + return -1; } vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen); return 0; } -#define USES_X509_AUTH(vs) \ +#define USES_X509_AUTH(vs) \ ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE || \ (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC || \ (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN || \ @@ -507,116 +507,116 @@ void start_auth_sasl(VncState *vs) /* Get local & remote client addresses in form IPADDR;PORT */ if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock))) - goto authabort; + goto authabort; if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) { - free(localAddr); - goto authabort; + free(localAddr); + goto authabort; } err = sasl_server_new("vnc", - NULL, /* FQDN - just delegates to gethostname */ - NULL, /* User realm */ - localAddr, - remoteAddr, - NULL, /* Callbacks, not needed */ - SASL_SUCCESS_DATA, - &vs->sasl.conn); + NULL, /* FQDN - just delegates to gethostname */ + NULL, /* User realm */ + localAddr, + remoteAddr, + NULL, /* Callbacks, not needed */ + SASL_SUCCESS_DATA, + &vs->sasl.conn); free(localAddr); free(remoteAddr); localAddr = remoteAddr = NULL; if (err != SASL_OK) { - VNC_DEBUG("sasl context setup failed %d (%s)", - err, sasl_errstring(err, NULL, NULL)); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("sasl context setup failed %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + vs->sasl.conn = NULL; + goto authabort; } #ifdef CONFIG_VNC_TLS /* Inform SASL that we've got an external SSF layer from TLS/x509 */ if (vs->vd->auth == VNC_AUTH_VENCRYPT && - vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) { - gnutls_cipher_algorithm_t cipher; - sasl_ssf_t ssf; - - cipher = gnutls_cipher_get(vs->tls.session); - if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { - VNC_DEBUG("%s", "cannot TLS get cipher size\n"); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; - } - ssf *= 8; /* tls key size is bytes, sasl wants bits */ - - err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); - if (err != SASL_OK) { - VNC_DEBUG("cannot set SASL external SSF %d (%s)\n", - err, sasl_errstring(err, NULL, NULL)); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; - } + vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) { + gnutls_cipher_algorithm_t cipher; + sasl_ssf_t ssf; + + cipher = gnutls_cipher_get(vs->tls.session); + if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { + VNC_DEBUG("%s", "cannot TLS get cipher size\n"); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; + } + ssf *= 8; /* tls key size is bytes, sasl wants bits */ + + err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf); + if (err != SASL_OK) { + VNC_DEBUG("cannot set SASL external SSF %d (%s)\n", + err, sasl_errstring(err, NULL, NULL)); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; + } } else #endif /* CONFIG_VNC_TLS */ - vs->sasl.wantSSF = 1; + vs->sasl.wantSSF = 1; memset (&secprops, 0, sizeof secprops); /* Inform SASL that we've got an external SSF layer from TLS */ if (strncmp(vs->vd->display, "unix:", 5) == 0 #ifdef CONFIG_VNC_TLS - /* Disable SSF, if using TLS+x509+SASL only. TLS without x509 - is not sufficiently strong */ - || (vs->vd->auth == VNC_AUTH_VENCRYPT && - vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) + /* Disable SSF, if using TLS+x509+SASL only. TLS without x509 + is not sufficiently strong */ + || (vs->vd->auth == VNC_AUTH_VENCRYPT && + vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) #endif /* CONFIG_VNC_TLS */ - ) { - /* If we've got TLS or UNIX domain sock, we don't care about SSF */ - secprops.min_ssf = 0; - secprops.max_ssf = 0; - secprops.maxbufsize = 8192; - secprops.security_flags = 0; + ) { + /* If we've got TLS or UNIX domain sock, we don't care about SSF */ + secprops.min_ssf = 0; + secprops.max_ssf = 0; + secprops.maxbufsize = 8192; + secprops.security_flags = 0; } else { - /* Plain TCP, better get an SSF layer */ - secprops.min_ssf = 56; /* Good enough to require kerberos */ - secprops.max_ssf = 100000; /* Arbitrary big number */ - secprops.maxbufsize = 8192; - /* Forbid any anonymous or trivially crackable auth */ - secprops.security_flags = - SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; + /* Plain TCP, better get an SSF layer */ + secprops.min_ssf = 56; /* Good enough to require kerberos */ + secprops.max_ssf = 100000; /* Arbitrary big number */ + secprops.maxbufsize = 8192; + /* Forbid any anonymous or trivially crackable auth */ + secprops.security_flags = + SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; } err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops); if (err != SASL_OK) { - VNC_DEBUG("cannot set SASL security props %d (%s)\n", - err, sasl_errstring(err, NULL, NULL)); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("cannot set SASL security props %d (%s)\n", + err, sasl_errstring(err, NULL, NULL)); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } err = sasl_listmech(vs->sasl.conn, - NULL, /* Don't need to set user */ - "", /* Prefix */ - ",", /* Separator */ - "", /* Suffix */ - &mechlist, - NULL, - NULL); + NULL, /* Don't need to set user */ + "", /* Prefix */ + ",", /* Separator */ + "", /* Suffix */ + &mechlist, + NULL, + NULL); if (err != SASL_OK) { - VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n", - err, sasl_errdetail(vs->sasl.conn)); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n", + err, sasl_errdetail(vs->sasl.conn)); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist); if (!(vs->sasl.mechlist = strdup(mechlist))) { - VNC_DEBUG("Out of memory"); - sasl_dispose(&vs->sasl.conn); - vs->sasl.conn = NULL; - goto authabort; + VNC_DEBUG("Out of memory"); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; } mechlistlen = strlen(mechlist); vnc_write_u32(vs, mechlistlen); |