aboutsummaryrefslogtreecommitdiff
path: root/ui
AgeCommit message (Collapse)Author
2015-04-01CVE-2015-1779: limit size of HTTP headers from websockets clientsDaniel P. Berrange
The VNC server websockets decoder will read and buffer data from websockets clients until it sees the end of the HTTP headers, as indicated by \r\n\r\n. In theory this allows a malicious to trick QEMU into consuming an arbitrary amount of RAM. In practice, because QEMU runs g_strstr_len() across the buffered header data, it will spend increasingly long burning CPU time searching for the substring match and less & less time reading data. So while this does cause arbitrary memory growth, the bigger problem is that QEMU will be burning 100% of available CPU time. A novnc websockets client typically sends headers of around 512 bytes in length. As such it is reasonable to place a 4096 byte limit on the amount of data buffered while searching for the end of HTTP headers. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-04-01CVE-2015-1779: incrementally decode websocket framesDaniel P. Berrange
The logic for decoding websocket frames wants to fully decode the frame header and payload, before allowing the VNC server to see any of the payload data. There is no size limit on websocket payloads, so this allows a malicious network client to consume 2^64 bytes in memory in QEMU. It can trigger this denial of service before the VNC server even performs any authentication. The fix is to decode the header, and then incrementally decode the payload data as it is needed. With this fix the websocket decoder will allow at most 4k of data to be buffered before decoding and processing payload. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> [ kraxel: fix frequent spurious disconnects, suggested by Peter Maydell ] @@ -361,7 +361,7 @@ int vncws_decode_frame_payload(Buffer *input, - *payload_size = input->offset; + *payload_size = *payload_remain; [ kraxel: fix 32bit build ] @@ -306,7 +306,7 @@ struct VncState - uint64_t ws_payload_remain; + size_t ws_payload_remain; Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-26gtk: do not call gtk_widget_get_window if drawing area is not initializedHervé Poussineau
This prevents gtk_widget_get_window to return a NULL pointer. Signed-off-by: Hervé Poussineau <hpoussin@reactos.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: ensure VNC websockets server checks the ACL if requestedDaniel P. Berrange
If the x509verify option is requested, the VNC websockets server was failing to validate that the websockets client provided an x509 certificate matching the ACL rules. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: remove separate gnutls_session for websockets serverDaniel P. Berrange
The previous change to the auth scheme handling guarantees we can never have nested TLS sessions in the VNC websockets server. Thus we can remove the separate gnutls_session instance. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: enforce TLS when using websockets serverDaniel P. Berrange
When TLS is required, the primary VNC server considers it to be mandatory. ie the server admin decides whether or not TLS is used, and the client has to comply with this decision. The websockets server, however, treated it as optional, allowing non-TLS clients to connect to a server which had setup TLS. Thus enabling websockets lowers the security of the VNC server leaving the admin no way to enforce use of TLS. This removes the code that allows non-TLS fallback in the websockets server, so that if TLS is requested for VNC it is now mandatory for both the primary VNC server and the websockets VNC server. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: fix setup of VNC websockets auth scheme with TLSDaniel P. Berrange
The way the websockets TLS code was integrated into the VNC server made it essentially useless. The only time that the websockets TLS support could be used is if the primary VNC server had its existing TLS support disabled. ie QEMU had to be launched with: # qemu -vnc localhost:1,websockets=5902,x509=/path/to/certs Note the absence of the 'tls' flag. This is already a bug, because the docs indicate that 'x509' is ignored unless 'tls' is given. If the primary VNC server had TLS turned on via the 'tls' flag, then this prevented the websockets TLS support from being used, because it activates the VeNCrypt auth which would have resulted in TLS being run over a TLS session. Of course no websockets VNC client supported VeNCrypt so in practice, since the browser clients cannot setup a nested TLS session over the main HTTPS connection, so it would not even get past auth. This patch causes us to decide our auth scheme separately for the main VNC server vs the websockets VNC server. We take account of the fact that if TLS is enabled, then the websockets client will use https, so setting up VeNCrypt is thus redundant as it would lead to nested TLS sessions. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: split setup of VNC auth scheme into separate methodDaniel P. Berrange
The vnc_display_open method is quite long and complex, so move the VNC auth scheme decision logic into a separate method for clarity. Also update the comment to better describe what we are trying to achieve. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: report error if user requests VNC option that is unsupportedDaniel P. Berrange
If the VNC server is built without tls, sasl or websocket support and the user requests one of these features, they are just silently ignored. This is bad because it means the VNC server ends up running in a configuration that is less secure than the user asked for. It also leads to an tangled mass of preprocessor conditionals when configuring the VNC server. This ensures that the tls, sasl & websocket options are always processed and an error is reported back to the user if any of them were disabled at build time. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: replace printf() calls with VNC_DEBUGDaniel P. Berrange
Handling of VNC audio messages results in printfs to the console. This is of no use to anyone in production, so should be using the normal VNC_DEBUG macro instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-18ui: remove unused 'wiremode' variable in VncState structDaniel P. Berrange
Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-17vnc: Fix QMP change not to use funky error classMarkus Armbruster
Error classes are a leftover from the days of "rich" error objects. New code should always use ERROR_CLASS_GENERIC_ERROR. Commit 1d0d59f added a use of ERROR_CLASS_DEVICE_NOT_FOUND. Replace it. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-13Merge remote-tracking branch 'remotes/kraxel/tags/pull-sdl-20150312-2' into ↵Peter Maydell
staging misc ui patches, mostly sdl related. # gpg: Signature made Thu Mar 12 14:51:07 2015 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-sdl-20150312-2: pixman: add a bunch of PIXMAN_BE_* defines for 32bpp Allow the use of X11 from a non standard location. configure: opengl overhaul sdl: Fix crash when calling sdl_switch() with NULL surface sdl: Refresh debug statements Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-12sdl: Fix crash when calling sdl_switch() with NULL surfaceBenjamin Herrenschmidt
This happens for example when doing ctrl-alt-u and segfaults Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12sdl: Refresh debug statementsBenjamin Herrenschmidt
Put them under a #define similar to the VGA model and make them actually compile. Add a couple too. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: fix segmentation fault when invalid vnc parameters are specifiedGonglei
Reproducer: #./qemu-system-x86_64 -vnc :0,ip qemu-system-x86_64: -vnc :1,ip: Invalid parameter 'ip' Segmentation fault (core dumped) Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: avoid possible file handler leakGonglei
vs->lsock may equal to 0, modify the check condition, avoid possible vs->lsock leak. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12ui/console: fix OVERFLOW_BEFORE_WIDENGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12ui: fix regression in x509verify parameter for VNC serverDaniel P. Berrange
The 'x509verify' parameter is documented as taking a path to the x509 certificates, ie the same syntax as the 'x509' parameter. commit 4db14629c38611061fc19ec6927405923de84f08 Author: Gerd Hoffmann <kraxel@redhat.com> Date: Tue Sep 16 12:33:03 2014 +0200 vnc: switch to QemuOpts, allow multiple servers caused a regression by turning 'x509verify' into a boolean parameter instead. This breaks setup from libvirt and is not consistent with the docs. Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-12vnc: switch to inet_listen_optsGerd Hoffmann
Use inet_listen_opts instead of inet_listen. Allows us to drop some pointless indirection: Format strings just to parse them again later on. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-12vnc: remove dead codeGerd Hoffmann
If vs->ws_enabled is set ws_display is non-NULL. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-12vnc: drop display+ws_display from VncDisplayGerd Hoffmann
Nobody cares about those strings, they are only used to check whenever the vnc server / websocket support is enabled or not. Add bools for this and drop the strings. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-03-10Merge remote-tracking branch 'remotes/kraxel/tags/pull-vnc-20150310-1' into ↵Peter Maydell
staging vnc bugfixes. # gpg: Signature made Tue Mar 10 10:37:51 2015 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-vnc-20150310-1: Fix crash when connecting to VNC through websocket vnc: -readconfig fix vnc: set id at parse time not init time Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-03-10Fix crash when connecting to VNC through websocketJorge Acereda Maciá
Connecting to VNC through websocket crashes in vnc_flush() when trying to acquire a mutex that hasn't been initialized (vnc_init_state(vs) hasn't been called at this point). Signed-off-by: Jorge Acereda Macia <jacereda@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-10vnc: set id at parse time not init timeGerd Hoffmann
This way the generated id will be stored in -writeconfig cfg files. Also we can make vnc_auto_assign_id() local to vnc.c. Tested-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-03-10qemu-char: add cyrillic characters 'numerosign' to VNC keysymsWang Xin
This patch adds missing cyrillic character 'numerosign' to the VNC keysym table, it's needed by Russian keyboard. And I get the keysym from '<X11/keysymdef.h>', the current keysym table in Qemu was generated from it. Signed-off-by: Wang xin <wangxinxin.wang@huawei.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-10ui/vnc: Remove vnc_stop_worker_thread()Thomas Huth
This function is not used anymore, let's remove it. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-03-10ui: Removed unused functionsThomas Huth
Remove qemu_console_displaystate(), qemu_remove_kbd_event_handler(), qemu_different_endianness_pixelformat() and cpkey(), since they are completely unused. Signed-off-by: Thomas Huth <thuth@linux.vnet.ibm.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-02-25Merge remote-tracking branch 'remotes/armbru/tags/pull-monitor-2015-02-18' ↵Peter Maydell
into staging hmp: Normalize HMP command handler names # gpg: Signature made Wed Feb 18 10:59:44 2015 GMT using RSA key ID EB918653 # gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" # gpg: aka "Markus Armbruster <armbru@pond.sub.org>" * remotes/armbru/tags/pull-monitor-2015-02-18: hmp: Name HMP info handler functions hmp_info_SUBCOMMAND() hmp: Name HMP command handler functions hmp_COMMAND() hmp: Clean up declarations for long-gone info handlers Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-02-18hmp: Name HMP command handler functions hmp_COMMAND()Markus Armbruster
Some are called do_COMMAND() (old ones, usually), some hmp_COMMAND(), and sometimes COMMAND pointlessly differs in spelling. Normalize to hmp_COMMAND(), where COMMAND is exactly the command name with '-' replaced by '_'. Exceptions: * do_device_add() and client_migrate_info() *not* renamed to hmp_device_add(), hmp_client_migrate_info(), because they're also QMP handlers. They still need to be converted to QAPI. * do_memory_dump(), do_physical_memory_dump(), do_ioport_read(), do_ioport_write() renamed do hmp_* instead of hmp_x(), hmp_xp(), hmp_i(), hmp_o(), because those names are too cryptic for my taste. * do_info_help() renamed to hmp_info_help() instead of hmp_info(), because it only covers help. Signed-off-by: Markus Armbruster <armbru@redhat.com>
2015-02-16vnc: fix coverity warningGerd Hoffmann
vnc_display_local_addr will not be called with an invalid display id. Add assert() to silence coverity warning about a null pointer dereference. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16ui/vnc: optimize full scanline updatesPeter Lieven
in case we send and update for a complete scanline increment the y offset to avoid running to find_next_bit for that lines twice. Signed-off-by: Peter Lieven <pl@kamp.de> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: introduce an wrapper for auto assign vnc idGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: using bool type instead of int for QEMU_OPT_BOOLGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: correct missing property about vnc_displayGonglei
Missing three property for vnc socket connection, revalue display variable with correct way. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-16vnc: fix qemu crash when not configure vnc optionGonglei
Add missing vnc options: to, ipv4, ipv6 and fix qemu crash. Reproducer: $ x86_64-softmmu/qemu-system-x86_64 qemu-system-x86_64: Invalid parameter 'to' Segmentation fault (core dumped) BTW the patch fix the below bug: https://bugs.launchpad.net/qemu/+bug/1414222 Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Don Slutz <dslutz@verizon.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-02-10vnc: g_realloc() can't fail, bury dead error handlingMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Thomas Huth <thuth@linux.vnet.ibm.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2015-01-22Merge remote-tracking branch 'remotes/spice/tags/pull-spice-20150122-1' into ↵Peter Maydell
staging spice: fix coverity defect, add unix address support # gpg: Signature made Thu 22 Jan 2015 11:17:24 GMT using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/spice/tags/pull-spice-20150122-1: spice: fix coverity reported defect in display code spice: add unix address support Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2015-01-22monitor: add vnc websocketsGerd Hoffmann
Add websockets bool to VncBasicInfo, report websocket server sockets, flag websocket client connections. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22monitor: add query-vnc-servers commandGerd Hoffmann
Add new query vnc qmp command, for the lack of better ideas just name it "query-vnc-servers". Changes over query-vnc: * It returns a list of vnc servers, so multiple vnc server instances are covered. * Each vnc server returns a list of server sockets. Followup patch will use that to also report websockets. In case we add support for multiple server sockets server sockets (to better support ipv4+ipv6 dualstack) we can add them to the list too. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: factor out qmp_query_client_listGerd Hoffmann
so we can reuse it for the new vnc query command. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: track & limit connectionsGerd Hoffmann
Also track the number of connections in "connecting" and "shared" state (in addition to the "exclusive" state). Apply a configurable limit to these connections. The logic to apply the limit to connections in "shared" state is pretty simple: When the limit is reached no new connections are allowed. The logic to apply the limit to connections in "connecting" state (this is the state you are in *before* successful authentication) is slightly different: A new connect kicks out the oldest client which is still in "connecting" state. This avoids a easy DoS by unauthenticated users by simply opening connections until the limit is reached. Cc: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: allow binding servers to qemu consolesGerd Hoffmann
This patch adds a display= parameter to the vnc options. This allows to bind a vnc server instance to a specific display, allowing to create a multiseat setup with a vnc server for each seat. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: switch to QemuOpts, allow multiple serversGerd Hoffmann
This patch switches vnc over to QemuOpts, and it (more or less as side effect) allows multiple vnc server instances. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22vnc: add display id to acl namesGerd Hoffmann
In case the display id is "default" (which is the one you get if you don't explicitly assign one) we keep the old name scheme, without display, for backward compatibility reasons. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-01-22vnc: remove unused DisplayState parameter, add id instead.Gerd Hoffmann
DisplayState isn't used anywhere, drop it. Add the vnc server ID as parameter instead, so it is possible to specify the server instance. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-01-22vnc: remove vnc_display globalGerd Hoffmann
Replace with a vnc_displays list, so we can have multiple vnc server instances. Add vnc_server_find function to lookup a display by id. With no id supplied return the first vnc server, for backward compatibility reasons. It is not possible (yet) to actually create multiple vnc server instances. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gonglei <arei.gonglei@huawei.com>
2015-01-22spice: fix coverity reported defect in display codeGerd Hoffmann
Report: 1. Condition surface, taking false branch 406 if (surface && ssd->surface && 407 surface_width(surface) == pixman_image_get_width(ssd->surface) && 408 surface_height(surface) == pixman_image_get_height(ssd->surface)) { 409 /* no-resize fast path: just swap backing store */ ... 10. alias_transfer: Assigning: ssd->ds = surface. 440 ssd->ds = surface; 11. var_deref_op: Dereferencing null pointer ssd->ds. CID 1264334 (#1 of 1): Dereference after null check (FORWARD_NULL) 441 ssd->surface = pixman_image_ref(ssd->ds->image); Fix: Move code block dereferencing ssd->ds into the already existing if (ssd->ds) { ... } block. Cc: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-22spice: add unix address supportMarc-André Lureau
Teach qemu to set up a Spice server with a UNIX socket using the following arguments -spice unix,addr=path. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2015-01-19ui/sdl2: Support shared surface for more pixman formatsGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2024-12-30 18:39:55 +0000