| blob | 9facc1ad811ef8e303821d1e32036c87ed72d268 |
1 Index: new/qemu-options.hx
2 ===================================================================
3 --- new.orig/qemu-options.hx 2014-11-20 06:45:06.000000000 +0100
4 +++ new/qemu-options.hx 2014-11-20 06:50:44.000000000 +0100
5 @@ -411,6 +411,9 @@
6 @table @option
7 ETEXI
9 +DEF("id", HAS_ARG, QEMU_OPTION_id,
10 + "-id n set the VMID\n", QEMU_ARCH_ALL)
11 +
12 DEF("fda", HAS_ARG, QEMU_OPTION_fda,
13 "-fda/-fdb file use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
14 DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
15 Index: new/vl.c
16 ===================================================================
17 --- new.orig/vl.c 2014-11-20 06:45:06.000000000 +0100
18 +++ new/vl.c 2014-11-20 06:50:44.000000000 +0100
19 @@ -2730,6 +2730,7 @@
20 int main(int argc, char **argv, char **envp)
21 {
22 int i;
23 + long int vm_id_long = 0;
24 int snapshot, linux_boot;
25 const char *initrd_filename;
26 const char *kernel_filename, *kernel_cmdline;
27 @@ -3477,6 +3478,14 @@
28 exit(1);
29 }
30 break;
31 + case QEMU_OPTION_id:
32 + vm_id_long = strtol(optarg, (char **) &optarg, 10);
33 + if (*optarg != 0 || vm_id_long < 100 || vm_id_long > INT_MAX) {
34 + fprintf(stderr, "Invalid ID\n");
35 + exit(1);
36 + }
37 + pve_auth_setup(vm_id_long);
38 + break;
39 case QEMU_OPTION_vnc:
40 {
41 #ifdef CONFIG_VNC
42 Index: new/include/ui/console.h
43 ===================================================================
44 --- new.orig/include/ui/console.h 2014-11-20 06:45:06.000000000 +0100
45 +++ new/include/ui/console.h 2014-11-20 06:50:55.000000000 +0100
46 @@ -328,6 +328,7 @@
47 void cocoa_display_init(DisplayState *ds, int full_screen);
49 /* vnc.c */
50 +void pve_auth_setup(int vmid);
51 void vnc_display_init(const char *id);
52 void vnc_display_open(const char *id, Error **errp);
53 void vnc_display_add_client(const char *id, int csock, bool skipauth);
54 Index: new/ui/vnc.c
55 ===================================================================
56 --- new.orig/ui/vnc.c 2014-11-20 06:50:51.000000000 +0100
57 +++ new/ui/vnc.c 2014-11-20 06:50:55.000000000 +0100
58 @@ -48,6 +48,125 @@
59 #include "vnc_keysym.h"
60 #include "crypto/cipher.h"
62 +static int pve_vmid = 0;
63 +
64 +void pve_auth_setup(int vmid) {
65 + pve_vmid = vmid;
66 +}
67 +
68 +static char *
69 +urlencode(char *buf, const char *value)
70 +{
71 + static const char *hexchar = "0123456789abcdef";
72 + char *p = buf;
73 + int i;
74 + int l = strlen(value);
75 + for (i = 0; i < l; i++) {
76 + char c = value[i];
77 + if (('a' <= c && c <= 'z') ||
78 + ('A' <= c && c <= 'Z') ||
79 + ('0' <= c && c <= '9')) {
80 + *p++ = c;
81 + } else if (c == 32) {
82 + *p++ = '+';
83 + } else {
84 + *p++ = '%';
85 + *p++ = hexchar[c >> 4];
86 + *p++ = hexchar[c & 15];
87 + }
88 + }
89 + *p = 0;
90 +
91 + return p;
92 +}
93 +
94 +int
95 +pve_auth_verify(const char *clientip, const char *username, const char *passwd)
96 +{
97 + struct sockaddr_in server;
98 +
99 + int sfd = socket(AF_INET, SOCK_STREAM, 0);
100 + if (sfd == -1) {
101 + perror("pve_auth_verify: socket failed");
102 + return -1;
103 + }
104 +
105 + struct hostent *he;
106 + if ((he = gethostbyname("localhost")) == NULL) {
107 + fprintf(stderr, "pve_auth_verify: error resolving hostname\n");
108 + goto err;
109 + }
110 +
111 + memcpy(&server.sin_addr, he->h_addr_list[0], he->h_length);
112 + server.sin_family = AF_INET;
113 + server.sin_port = htons(85);
114 +
115 + if (connect(sfd, (struct sockaddr *)&server, sizeof(server))) {
116 + perror("pve_auth_verify: error connecting to server");
117 + goto err;
118 + }
119 +
120 + char buf[8192];
121 + char form[8192];
122 +
123 + char *p = form;
124 + p = urlencode(p, "username");
125 + *p++ = '=';
126 + p = urlencode(p, username);
127 +
128 + *p++ = '&';
129 + p = urlencode(p, "password");
130 + *p++ = '=';
131 + p = urlencode(p, passwd);
132 +
133 + *p++ = '&';
134 + p = urlencode(p, "path");
135 + *p++ = '=';
136 + char authpath[256];
137 + sprintf(authpath, "/vms/%d", pve_vmid);
138 + p = urlencode(p, authpath);
139 +
140 + *p++ = '&';
141 + p = urlencode(p, "privs");
142 + *p++ = '=';
143 + p = urlencode(p, "VM.Console");
144 +
145 + sprintf(buf, "POST /api2/json/access/ticket HTTP/1.1\n"
146 + "Host: localhost:85\n"
147 + "Connection: close\n"
148 + "PVEClientIP: %s\n"
149 + "Content-Type: application/x-www-form-urlencoded\n"
150 + "Content-Length: %zd\n\n%s\n", clientip, strlen(form), form);
151 + ssize_t len = strlen(buf);
152 + ssize_t sb = send(sfd, buf, len, 0);
153 + if (sb < 0) {
154 + perror("pve_auth_verify: send failed");
155 + goto err;
156 + }
157 + if (sb != len) {
158 + fprintf(stderr, "pve_auth_verify: partial send error\n");
159 + goto err;
160 + }
161 +
162 + len = recv(sfd, buf, sizeof(buf) - 1, 0);
163 + if (len < 0) {
164 + perror("pve_auth_verify: recv failed");
165 + goto err;
166 + }
167 +
168 + buf[len] = 0;
169 +
170 + //printf("DATA:%s\n", buf);
171 +
172 + shutdown(sfd, SHUT_RDWR);
173 +
174 + return strncmp(buf, "HTTP/1.1 200 OK", 15);
175 +
176 +err:
177 + shutdown(sfd, SHUT_RDWR);
178 + return -1;
179 +}
180 +
181 static QTAILQ_HEAD(, VncDisplay) vnc_displays =
182 QTAILQ_HEAD_INITIALIZER(vnc_displays);
184 @@ -3393,10 +3512,10 @@
185 }
186 if (x509) {
187 VNC_DEBUG("Initializing VNC server with x509 password auth\n");
188 - vs->subauth = VNC_AUTH_VENCRYPT_X509VNC;
189 + vs->subauth = VNC_AUTH_VENCRYPT_X509PLAIN;
190 } else {
191 VNC_DEBUG("Initializing VNC server with TLS password auth\n");
192 - vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC;
193 + vs->subauth = VNC_AUTH_VENCRYPT_TLSPLAIN;
194 }
195 } else {
196 VNC_DEBUG("Initializing VNC server with password auth\n");
197 @@ -3557,7 +3676,14 @@
198 vs->tls.x509verify = true;
199 }
200 }
201 - if (path) {
202 + if (path && strcmp(path, "on") == 0) {
203 + x509 = true;
204 + tls = true;
205 + if (pve_tls_set_x509_creds_dir(vs) < 0) {
206 + error_setg(errp, "No certificate path provided");
207 + goto fail;
208 + }
209 + } else if (path) {
210 x509 = true;
211 if (vnc_tls_set_x509_creds_dir(vs, path) < 0) {
212 error_setg(errp, "Failed to find x509 certificates/keys in %s",
213 Index: new/ui/vnc-auth-vencrypt.c
214 ===================================================================
215 --- new.orig/ui/vnc-auth-vencrypt.c 2014-11-20 06:45:06.000000000 +0100
216 +++ new/ui/vnc-auth-vencrypt.c 2014-11-20 06:50:55.000000000 +0100
217 @@ -26,6 +26,107 @@
219 #include "vnc.h"
220 #include "qemu/main-loop.h"
221 +#include "qemu/sockets.h"
222 +
223 +static int protocol_client_auth_plain(VncState *vs, uint8_t *data, size_t len)
224 +{
225 + const char *err = NULL;
226 + char username[256];
227 + char passwd[512];
228 +
229 + char clientip[256];
230 + clientip[0] = 0;
231 + struct sockaddr_in client;
232 + socklen_t addrlen = sizeof(client);
233 + if (getpeername(vs->csock, &client, &addrlen) == 0) {
234 + inet_ntop(client.sin_family, &client.sin_addr,
235 + clientip, sizeof(clientip));
236 + }
237 +
238 + if ((len != (vs->username_len + vs->password_len)) ||
239 + (vs->username_len >= (sizeof(username)-1)) ||
240 + (vs->password_len >= (sizeof(passwd)-1)) ) {
241 + err = "Got unexpected data length";
242 + goto err;
243 + }
244 +
245 + strncpy(username, (char *)data, vs->username_len);
246 + username[vs->username_len] = 0;
247 + strncpy(passwd, (char *)data + vs->username_len, vs->password_len);
248 + passwd[vs->password_len] = 0;
249 +
250 + VNC_DEBUG("AUTH PLAIN username: %s pw: %s\n", username, passwd);
251 +
252 + if (pve_auth_verify(clientip, username, passwd) == 0) {
253 + vnc_write_u32(vs, 0); /* Accept auth completion */
254 + start_client_init(vs);
255 + return 0;
256 + }
257 +
258 + err = "Authentication failed";
259 +err:
260 + if (err) {
261 + VNC_DEBUG("AUTH PLAIN ERROR: %s\n", err);
262 + vnc_write_u32(vs, 1); /* Reject auth */
263 + if (vs->minor >= 8) {
264 + int elen = strlen(err);
265 + vnc_write_u32(vs, elen);
266 + vnc_write(vs, err, elen);
267 + }
268 + }
269 + vnc_flush(vs);
270 + vnc_client_error(vs);
271 +
272 + return 0;
273 +
274 +}
275 +
276 +static int protocol_client_auth_plain_start(VncState *vs, uint8_t *data, size_t len)
277 +{
278 + uint32_t ulen = read_u32(data, 0);
279 + uint32_t pwlen = read_u32(data, 4);
280 + const char *err = NULL;
281 +
282 + VNC_DEBUG("AUTH PLAIN START %u %u\n", ulen, pwlen);
283 +
284 + if (!ulen) {
285 + err = "No User name.";
286 + goto err;
287 + }
288 + if (ulen >= 255) {
289 + err = "User name too long.";
290 + goto err;
291 + }
292 + if (!pwlen) {
293 + err = "Password too short";
294 + goto err;
295 + }
296 + if (pwlen >= 511) {
297 + err = "Password too long.";
298 + goto err;
299 + }
300 +
301 + vs->username_len = ulen;
302 + vs->password_len = pwlen;
303 +
304 + vnc_read_when(vs, protocol_client_auth_plain, ulen + pwlen);
305 +
306 + return 0;
307 +err:
308 + if (err) {
309 + VNC_DEBUG("AUTH PLAIN ERROR: %s\n", err);
310 + vnc_write_u32(vs, 1); /* Reject auth */
311 + if (vs->minor >= 8) {
312 + int elen = strlen(err);
313 + vnc_write_u32(vs, elen);
314 + vnc_write(vs, err, elen);
315 + }
316 + }
317 + vnc_flush(vs);
318 + vnc_client_error(vs);
319 +
320 + return 0;
321 +}
323 static void start_auth_vencrypt_subauth(VncState *vs)
324 {
325 @@ -37,6 +138,12 @@
326 start_client_init(vs);
327 break;
329 + case VNC_AUTH_VENCRYPT_TLSPLAIN:
330 + case VNC_AUTH_VENCRYPT_X509PLAIN:
331 + VNC_DEBUG("Start TLS auth PLAIN\n");
332 + vnc_read_when(vs, protocol_client_auth_plain_start, 8);
333 + break;
334 +
335 case VNC_AUTH_VENCRYPT_TLSVNC:
336 case VNC_AUTH_VENCRYPT_X509VNC:
337 VNC_DEBUG("Start TLS auth VNC\n");
338 Index: new/ui/vnc.h
339 ===================================================================
340 --- new.orig/ui/vnc.h 2014-11-20 06:45:06.000000000 +0100
341 +++ new/ui/vnc.h 2014-11-20 06:50:55.000000000 +0100
342 @@ -288,6 +288,8 @@
343 int auth;
344 int subauth; /* Used by VeNCrypt */
345 char challenge[VNC_AUTH_CHALLENGE_SIZE];
346 + int username_len;
347 + int password_len;
348 #ifdef CONFIG_VNC_TLS
349 VncStateTLS tls;
350 #endif
351 @@ -603,4 +605,6 @@
352 int vnc_zywrle_send_framebuffer_update(VncState *vs, int x, int y, int w, int h);
353 void vnc_zrle_clear(VncState *vs);
355 +int pve_auth_verify(const char *clientip, const char *username, const char *passwd);
356 +
357 #endif /* __QEMU_VNC_H */
358 Index: new/ui/vnc-tls.c
359 ===================================================================
360 --- new.orig/ui/vnc-tls.c 2014-11-20 06:45:06.000000000 +0100
361 +++ new/ui/vnc-tls.c 2014-11-20 06:50:55.000000000 +0100
362 @@ -302,6 +302,14 @@
364 static int vnc_set_gnutls_priority(gnutls_session_t s, int x509)
365 {
366 + /* optimize for speed */
367 + static const int ciphers[] = {
368 + GNUTLS_CIPHER_ARCFOUR_128,
369 + GNUTLS_CIPHER_AES_128_CBC,
370 + GNUTLS_CIPHER_3DES_CBC,
371 + 0
372 + };
373 +
374 static const int cert_types[] = { GNUTLS_CRT_X509, 0 };
375 static const int protocols[] = {
376 GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0
377 @@ -313,6 +321,11 @@
378 };
379 int rc;
381 + rc = gnutls_cipher_set_priority(s, ciphers);
382 + if (rc != GNUTLS_E_SUCCESS) {
383 + return -1;
384 + }
385 +
386 rc = gnutls_kx_set_priority(s, x509 ? kx_x509 : kx_anon);
387 if (rc != GNUTLS_E_SUCCESS) {
388 return -1;
389 @@ -448,6 +460,24 @@
390 return 0;
391 }
393 +int pve_tls_set_x509_creds_dir(VncDisplay *vd)
394 +{
395 + if (vnc_set_x509_credential(vd, "/etc/pve", "pve-root-ca.pem", &vd->tls.x509cacert, 0) < 0)
396 + goto cleanup;
397 + if (vnc_set_x509_credential(vd, "/etc/pve/local", "pve-ssl.pem", &vd->tls.x509cert, 0) < 0)
398 + goto cleanup;
399 + if (vnc_set_x509_credential(vd, "/etc/pve/local", "pve-ssl.key", &vd->tls.x509key, 0) < 0)
400 + goto cleanup;
401 +
402 + return 0;
403 +
404 + cleanup:
405 + g_free(vd->tls.x509cacert);
406 + g_free(vd->tls.x509cert);
407 + g_free(vd->tls.x509key);
408 + vd->tls.x509cacert = vd->tls.x509cacrl = vd->tls.x509cert = vd->tls.x509key = NULL;
409 + return -1;
410 +}
412 int vnc_tls_set_x509_creds_dir(VncDisplay *vd,
413 const char *certdir)
414 Index: new/ui/vnc-tls.h
415 ===================================================================
416 --- new.orig/ui/vnc-tls.h 2014-11-20 06:45:06.000000000 +0100
417 +++ new/ui/vnc-tls.h 2014-11-20 06:50:55.000000000 +0100
418 @@ -61,6 +61,8 @@
420 int vnc_tls_validate_certificate(VncState *vs);
422 +int pve_tls_set_x509_creds_dir(VncDisplay *vd);
423 +
424 int vnc_tls_set_x509_creds_dir(VncDisplay *vd,
425 const char *path);