[pve-devel] r5594 - pve-qemu-kvm/pve2/debian/patches

svn-commits at proxmox.com svn-commits at proxmox.com
Wed Feb 23 11:53:17 CET 2011


Author: dietmar
Date: 2011-02-23 11:53:17 +0100 (Wed, 23 Feb 2011)
New Revision: 5594

Modified:
   pve-qemu-kvm/pve2/debian/patches/pve-auth.patch
Log:
fix auth


Modified: pve-qemu-kvm/pve2/debian/patches/pve-auth.patch
===================================================================
--- pve-qemu-kvm/pve2/debian/patches/pve-auth.patch	2011-02-23 10:30:54 UTC (rev 5593)
+++ pve-qemu-kvm/pve2/debian/patches/pve-auth.patch	2011-02-23 10:53:17 UTC (rev 5594)
@@ -1,7 +1,7 @@
 Index: new/ui/vnc.c
 ===================================================================
---- new.orig/ui/vnc.c	2011-01-28 06:26:40.000000000 +0100
-+++ new/ui/vnc.c	2011-01-28 06:27:22.000000000 +0100
+--- new.orig/ui/vnc.c	2011-02-16 10:57:41.000000000 +0100
++++ new/ui/vnc.c	2011-02-23 11:47:56.000000000 +0100
 @@ -31,6 +31,8 @@
  #include "qemu-timer.h"
  #include "acl.h"
@@ -11,7 +11,7 @@
  
  #define VNC_REFRESH_INTERVAL_BASE 30
  #define VNC_REFRESH_INTERVAL_INC  50
-@@ -46,6 +48,124 @@
+@@ -46,6 +48,125 @@
      } \
  }
  
@@ -48,7 +48,7 @@
 +}
 +
 +int
-+pve_auth_verify(const char *username, const char *passwd)
++pve_auth_verify(const char *clientip, const char *username, const char *passwd)
 +{
 +	struct sockaddr_in server;
 +
@@ -94,15 +94,16 @@
 +	p = urlencode(p, authpath);
 +
 + 	*p++ = '&';
-+ 	p = urlencode(p, "permissions");
++ 	p = urlencode(p, "privs");
 +	*p++ = '=';
 + 	p = urlencode(p, "VM.Console");
 +
-+	sprintf(buf, "POST /api2/json/ticket HTTP/1.1\n"
++	sprintf(buf, "POST /api2/json/access/ticket HTTP/1.1\n"
 +		"Host: localhost:85\n"
 +		"Connection: close\n"
++		"PVEClientIP: %s\n"
 +		"Content-Type: application/x-www-form-urlencoded\n"
-+		"Content-Length: %zd\n\n%s\n", strlen(form), form);
++		"Content-Length: %zd\n\n%s\n", clientip, strlen(form), form);
 +	ssize_t len = strlen(buf);
 +	ssize_t sb = send(sfd, buf, len, 0);
 +	if (sb < 0) {
@@ -136,7 +137,7 @@
  static VncDisplay *vnc_display; /* needed for info vnc */
  static DisplayChangeListener *dcl;
  
-@@ -1825,7 +1945,7 @@
+@@ -1825,7 +1946,7 @@
  static void set_pixel_conversion(VncState *vs)
  {
      if ((vs->clientds.flags & QEMU_BIG_ENDIAN_FLAG) ==
@@ -145,7 +146,7 @@
          !memcmp(&(vs->clientds.pf), &(vs->ds->surface->pf), sizeof(PixelFormat))) {
          vs->write_pixels = vnc_write_pixels_copy;
          vnc_hextile_set_pixel_conversion(vs, 0);
-@@ -1911,7 +2031,7 @@
+@@ -1911,7 +2032,7 @@
          vnc_write_u8(vs, VNC_MSG_SERVER_FRAMEBUFFER_UPDATE);
          vnc_write_u8(vs, 0);
          vnc_write_u16(vs, 1); /* number of rects */
@@ -154,7 +155,7 @@
                                 ds_get_height(vs->ds), VNC_ENCODING_WMVi);
          pixel_format_message(vs);
          vnc_unlock_output(vs);
-@@ -2541,7 +2661,7 @@
+@@ -2541,7 +2662,7 @@
  char *vnc_display_local_addr(DisplayState *ds)
  {
      VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display;
@@ -163,7 +164,7 @@
      return vnc_socket_local_addr("%s:%s", vs->lsock);
  }
  
-@@ -2588,6 +2708,7 @@
+@@ -2588,6 +2709,7 @@
              tls = 1; /* Require TLS */
          } else if (strncmp(options, "x509", 4) == 0) {
              char *start, *end;
@@ -171,7 +172,7 @@
              x509 = 1; /* Require x509 certificates */
              if (strncmp(options, "x509verify", 10) == 0)
                  vs->tls.x509verify = 1; /* ...and verify client certs */
-@@ -2610,10 +2731,12 @@
+@@ -2610,10 +2732,12 @@
                  }
                  qemu_free(path);
              } else {
@@ -188,7 +189,7 @@
              }
  #endif
          } else if (strncmp(options, "acl", 3) == 0) {
-@@ -2662,10 +2785,10 @@
+@@ -2662,10 +2786,10 @@
              vs->auth = VNC_AUTH_VENCRYPT;
              if (x509) {
                  VNC_DEBUG("Initializing VNC server with x509 password auth\n");
@@ -203,11 +204,13 @@
  #endif /* CONFIG_VNC_TLS */
 Index: new/ui/vnc-auth-vencrypt.c
 ===================================================================
---- new.orig/ui/vnc-auth-vencrypt.c	2011-01-28 06:26:16.000000000 +0100
-+++ new/ui/vnc-auth-vencrypt.c	2011-01-28 06:26:48.000000000 +0100
-@@ -26,6 +26,96 @@
+--- new.orig/ui/vnc-auth-vencrypt.c	2011-02-16 10:54:31.000000000 +0100
++++ new/ui/vnc-auth-vencrypt.c	2011-02-23 11:45:52.000000000 +0100
+@@ -25,7 +25,107 @@
+  */
  
  #include "vnc.h"
++#include "qemu_socket.h"
  
 +static int protocol_client_auth_plain(VncState *vs, uint8_t *data, size_t len)
 +{
@@ -215,6 +218,15 @@
 +	char username[256];
 +	char passwd[512];
 +
++	char clientip[256];
++	clientip[0] = 0;
++	struct sockaddr_in client;
++	socklen_t addrlen = sizeof(client);
++	if (getpeername(vs->csock, &client, &addrlen) == 0) {
++		inet_ntop(client.sin_family, &client.sin_addr, 
++			  clientip, sizeof(clientip));
++	}
++
 +	if ((len != (vs->username_len + vs->password_len)) ||
 +	    (vs->username_len >= (sizeof(username)-1)) ||
 +	    (vs->password_len >= (sizeof(passwd)-1))	) {
@@ -229,7 +241,7 @@
 +
 +	VNC_DEBUG("AUTH PLAIN username: %s pw: %s\n", username, passwd);
 +
-+	if (pve_auth_verify(username, passwd) == 0) {
++	if (pve_auth_verify(clientip, username, passwd) == 0) {
 +		vnc_write_u32(vs, 0); /* Accept auth completion */
 +		start_client_init(vs);
 +		return 0;
@@ -302,7 +314,7 @@
  
  static void start_auth_vencrypt_subauth(VncState *vs)
  {
-@@ -37,6 +127,12 @@
+@@ -37,6 +137,12 @@
         start_client_init(vs);
         break;
  
@@ -317,8 +329,8 @@
         VNC_DEBUG("Start TLS auth VNC\n");
 Index: new/ui/vnc.h
 ===================================================================
---- new.orig/ui/vnc.h	2011-01-28 06:26:17.000000000 +0100
-+++ new/ui/vnc.h	2011-01-28 06:26:48.000000000 +0100
+--- new.orig/ui/vnc.h	2011-02-16 10:54:31.000000000 +0100
++++ new/ui/vnc.h	2011-02-16 10:57:41.000000000 +0100
 @@ -216,6 +216,8 @@
  
      char challenge[VNC_AUTH_CHALLENGE_SIZE];
@@ -330,8 +342,8 @@
  #ifdef CONFIG_VNC_SASL
 Index: new/ui/vnc-tls.c
 ===================================================================
---- new.orig/ui/vnc-tls.c	2011-01-28 06:26:16.000000000 +0100
-+++ new/ui/vnc-tls.c	2011-01-28 06:26:48.000000000 +0100
+--- new.orig/ui/vnc-tls.c	2011-02-16 10:54:31.000000000 +0100
++++ new/ui/vnc-tls.c	2011-02-16 10:57:41.000000000 +0100
 @@ -291,6 +291,14 @@
      static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
      static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
@@ -388,8 +400,8 @@
                                 const char *certdir)
 Index: new/ui/vnc-tls.h
 ===================================================================
---- new.orig/ui/vnc-tls.h	2011-01-28 06:26:16.000000000 +0100
-+++ new/ui/vnc-tls.h	2011-01-28 06:26:48.000000000 +0100
+--- new.orig/ui/vnc-tls.h	2011-02-16 10:54:31.000000000 +0100
++++ new/ui/vnc-tls.h	2011-02-16 10:57:41.000000000 +0100
 @@ -68,6 +68,8 @@
  
  int vnc_tls_validate_certificate(VncState *vs);
@@ -401,8 +413,8 @@
  
 Index: new/vl.c
 ===================================================================
---- new.orig/vl.c	2011-02-16 10:41:59.000000000 +0100
-+++ new/vl.c	2011-02-16 10:42:32.000000000 +0100
+--- new.orig/vl.c	2011-02-16 10:54:38.000000000 +0100
++++ new/vl.c	2011-02-16 10:57:41.000000000 +0100
 @@ -2538,6 +2538,7 @@
                  break;
              case QEMU_OPTION_id:



More information about the pve-devel mailing list