2009-08-04 15:35:42 +00:00
|
|
|
From e61c19737387273e305a2da5c9b28fe42e2eef67 Mon Sep 17 00:00:00 2001
|
2009-06-24 16:43:44 +00:00
|
|
|
From: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
|
|
|
|
Date: Fri, 6 Mar 2009 20:27:32 +0000
|
2009-08-04 15:35:42 +00:00
|
|
|
Subject: [PATCH] Include auth credentials in 'info vnc' ("Daniel P. Berrange")
|
2009-06-24 16:43:44 +00:00
|
|
|
|
|
|
|
This patch extends the 'info vnc' monitor output to include information
|
|
|
|
about the VNC client authentication credentials.
|
|
|
|
|
|
|
|
For clients authenticated using SASL, this will output the username.
|
|
|
|
|
|
|
|
For clients authenticated using x509 certificates, this will output
|
|
|
|
the x509 distinguished name.
|
|
|
|
|
|
|
|
Auth can be stacked, so both username & x509 dname may be shown.
|
|
|
|
|
|
|
|
Server:
|
|
|
|
address: 0.0.0.0:5902
|
|
|
|
auth: vencrypt+x509+sasl
|
|
|
|
Client:
|
|
|
|
address: 10.33.6.67:38621
|
|
|
|
x509 dname: C=GB,O=ACME,L=London,ST=London,CN=localhost
|
|
|
|
username: admin
|
|
|
|
Client:
|
|
|
|
address: 10.33.6.63:38620
|
|
|
|
x509 dname: C=GB,O=ACME,L=London,ST=London,CN=localhost
|
|
|
|
username: admin
|
|
|
|
|
|
|
|
(cherry picked from commit 1263b7d6131cdaed2c460cf03757aaaf5696ec47)
|
|
|
|
|
|
|
|
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
|
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
|
|
|
|
Signed-off-by: Mark McLoughlin <markmc@redhat.com>
|
2009-08-04 15:35:42 +00:00
|
|
|
Fedora-patch: 07-vnc-monitor-authinfo.patch
|
2009-06-24 16:43:44 +00:00
|
|
|
---
|
|
|
|
vnc-tls.c | 17 +++++++++++++++++
|
|
|
|
vnc-tls.h | 3 +++
|
|
|
|
vnc.c | 19 +++++++++++++++++--
|
|
|
|
3 files changed, 37 insertions(+), 2 deletions(-)
|
|
|
|
|
|
|
|
diff --git a/vnc-tls.c b/vnc-tls.c
|
|
|
|
index 666aa07..a37a0b4 100644
|
|
|
|
--- a/vnc-tls.c
|
|
|
|
+++ b/vnc-tls.c
|
|
|
|
@@ -241,6 +241,22 @@ int vnc_tls_validate_certificate(struct VncState *vs)
|
2009-04-02 01:07:39 +00:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
|
|
|
+ if (i == 0) {
|
|
|
|
+ size_t dnameSize = 1024;
|
|
|
|
+ vs->tls.dname = qemu_malloc(dnameSize);
|
|
|
|
+ requery:
|
|
|
|
+ if ((ret = gnutls_x509_crt_get_dn (cert, vs->tls.dname, &dnameSize)) != 0) {
|
|
|
|
+ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
|
|
|
|
+ vs->tls.dname = qemu_realloc(vs->tls.dname, dnameSize);
|
|
|
|
+ goto requery;
|
|
|
|
+ }
|
|
|
|
+ gnutls_x509_crt_deinit (cert);
|
|
|
|
+ VNC_DEBUG("Cannot get client distinguished name: %s",
|
|
|
|
+ gnutls_strerror (ret));
|
|
|
|
+ return -1;
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
gnutls_x509_crt_deinit (cert);
|
|
|
|
}
|
|
|
|
|
2009-06-24 16:43:44 +00:00
|
|
|
@@ -347,6 +363,7 @@ void vnc_tls_client_cleanup(struct VncState *vs)
|
2009-04-02 01:07:39 +00:00
|
|
|
vs->tls.session = NULL;
|
|
|
|
}
|
|
|
|
vs->tls.wiremode = VNC_WIREMODE_CLEAR;
|
|
|
|
+ free(vs->tls.dname);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-06-24 16:43:44 +00:00
|
|
|
diff --git a/vnc-tls.h b/vnc-tls.h
|
|
|
|
index cda95b9..fd0a2d9 100644
|
|
|
|
--- a/vnc-tls.h
|
|
|
|
+++ b/vnc-tls.h
|
2009-04-02 01:07:39 +00:00
|
|
|
@@ -55,6 +55,9 @@ struct VncStateTLS {
|
|
|
|
/* Whether data is being TLS encrypted yet */
|
|
|
|
int wiremode;
|
|
|
|
gnutls_session_t session;
|
|
|
|
+
|
|
|
|
+ /* Client's Distinguished Name from the x509 cert */
|
|
|
|
+ char *dname;
|
|
|
|
};
|
|
|
|
|
|
|
|
int vnc_tls_client_setup(VncState *vs, int x509Creds);
|
2009-06-24 16:43:44 +00:00
|
|
|
diff --git a/vnc.c b/vnc.c
|
2009-08-04 15:35:42 +00:00
|
|
|
index 3c315d6..9f0e16b 100644
|
2009-06-24 16:43:44 +00:00
|
|
|
--- a/vnc.c
|
|
|
|
+++ b/vnc.c
|
|
|
|
@@ -156,6 +156,21 @@ static void do_info_vnc_client(VncState *client)
|
2009-04-02 01:07:39 +00:00
|
|
|
term_puts("Client:\n");
|
|
|
|
term_puts(clientAddr);
|
|
|
|
free(clientAddr);
|
|
|
|
+
|
|
|
|
+#ifdef CONFIG_VNC_TLS
|
|
|
|
+ if (client->tls.session &&
|
|
|
|
+ client->tls.dname)
|
|
|
|
+ term_printf(" x509 dname: %s\n", client->tls.dname);
|
|
|
|
+ else
|
|
|
|
+ term_puts(" x509 dname: none\n");
|
|
|
|
+#endif
|
|
|
|
+#ifdef CONFIG_VNC_SASL
|
|
|
|
+ if (client->sasl.conn &&
|
|
|
|
+ client->sasl.username)
|
|
|
|
+ term_printf(" username: %s\n", client->sasl.username);
|
|
|
|
+ else
|
|
|
|
+ term_puts(" username: none\n");
|
|
|
|
+#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
void do_info_vnc(void)
|
2009-06-24 16:43:44 +00:00
|
|
|
@@ -1832,7 +1847,7 @@ static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
|
2009-04-02 01:07:39 +00:00
|
|
|
/* We only advertise 1 auth scheme at a time, so client
|
|
|
|
* must pick the one we sent. Verify this */
|
|
|
|
if (data[0] != vs->vd->auth) { /* Reject auth */
|
|
|
|
- VNC_DEBUG("Reject auth %d\n", (int)data[0]);
|
|
|
|
+ VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
|
|
|
|
vnc_write_u32(vs, 1);
|
|
|
|
if (vs->minor >= 8) {
|
|
|
|
static const char err[] = "Authentication failed";
|
2009-06-24 16:43:44 +00:00
|
|
|
@@ -1872,7 +1887,7 @@ static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)
|
2009-04-02 01:07:39 +00:00
|
|
|
#endif /* CONFIG_VNC_SASL */
|
|
|
|
|
|
|
|
default: /* Should not be possible, but just in case */
|
|
|
|
- VNC_DEBUG("Reject auth %d\n", vs->vd->auth);
|
|
|
|
+ VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
|
|
|
|
vnc_write_u8(vs, 1);
|
|
|
|
if (vs->minor >= 8) {
|
|
|
|
static const char err[] = "Authentication failed";
|
2009-06-24 16:43:44 +00:00
|
|
|
--
|
2009-08-04 15:35:42 +00:00
|
|
|
1.6.2.5
|
2009-06-24 16:43:44 +00:00
|
|
|
|