[pve-devel] r5412 - vncterm/pve2/vncpatches
svn-commits at proxmox.com
svn-commits at proxmox.com
Fri Jan 21 12:40:52 CET 2011
Author: dietmar
Date: 2011-01-21 12:40:51 +0100 (Fri, 21 Jan 2011)
New Revision: 5412
Modified:
vncterm/pve2/vncpatches/patch2.diff
Log:
implement x509
Modified: vncterm/pve2/vncpatches/patch2.diff
===================================================================
--- vncterm/pve2/vncpatches/patch2.diff 2011-01-21 11:02:08 UTC (rev 5411)
+++ vncterm/pve2/vncpatches/patch2.diff 2011-01-21 11:40:51 UTC (rev 5412)
@@ -115,8 +115,8 @@
Index: vnc/newterm/vncterm.c
===================================================================
--- vnc.orig/newterm/vncterm.c 2011-01-20 13:41:18.000000000 +0100
-+++ vnc/newterm/vncterm.c 2011-01-21 10:24:41.000000000 +0100
-@@ -37,6 +37,173 @@
++++ vnc/newterm/vncterm.c 2011-01-21 12:41:08.000000000 +0100
+@@ -37,6 +37,211 @@
#include "vncterm.h"
#include "glyphs.h"
@@ -126,6 +126,8 @@
+char *auth_path = "/";
+char *auth_perm = "VM.Console";
+
++int use_x509 = 1;
++
+/* launch expernal script to verify credential */
+int
+pve_auth_verify(const char *username, const char *passwd)
@@ -141,7 +143,7 @@
+
+ sprintf(pwenv, "PVE_PW_TICKET=%s", passwd);
+
-+ const char *script ="/usr/sbin/pveum";
++ const char *script = "/usr/sbin/pveum";
+
+ sigemptyset(&mask);
+ sigaddset(&mask, SIGCHLD);
@@ -278,7 +280,7 @@
+ int ret;
+
+ if ((ret = gnutls_anon_allocate_server_credentials(&anon_cred)) < 0) {
-+ fprintf(stderr, "can't allocate credentials %s\n", gnutls_strerror(ret));
++ rfbLog("can't allocate credentials: %s\n", gnutls_strerror(ret));
+ return NULL;
+ }
+
@@ -287,13 +289,51 @@
+ return anon_cred;
+}
+
++static gnutls_certificate_credentials_t
++tls_initialize_x509_cred(void)
++{
++ gnutls_certificate_credentials_t x509_cred;
++ int ret;
++
++ /* Paths to x509 certs/keys */
++ char *x509cacert = "/etc/pve/pve-root-ca.pem";
++ char *x509cert = "/etc/pve/local/pve-ssl.pem";
++ char *x509key = "/etc/pve/local/pve-ssl.key";
++
++
++ if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0) {
++ rfbLog("can't allocate credentials: %s\n", gnutls_strerror(ret));
++ return NULL;
++ }
++
++ if ((ret = gnutls_certificate_set_x509_trust_file
++ (x509_cred, x509cacert, GNUTLS_X509_FMT_PEM)) < 0) {
++ rfbLog("can't load CA certificate: %s\n", gnutls_strerror(ret));
++ gnutls_certificate_free_credentials(x509_cred);
++ return NULL;
++ }
++
++ if ((ret = gnutls_certificate_set_x509_key_file
++ (x509_cred, x509cert, x509key, GNUTLS_X509_FMT_PEM)) < 0) {
++ rfbLog("can't load certificate & key: %s\n", gnutls_strerror(ret));
++ gnutls_certificate_free_credentials(x509_cred);
++ return NULL;
++ }
++
++ gnutls_certificate_set_dh_params (x509_cred, dh_params);
++
++ return x509_cred;
++}
++
/* define this for debugging */
//#define DEBUG
-@@ -45,10 +212,275 @@
+@@ -44,11 +249,281 @@
+
#define rfbSecTypeVencrypt 19
#define rfbVencryptTlsPlain 259
-
++#define rfbVencryptX509Plain 262
++
+int rfbEncodeU32(char *buf, uint32_t value)
+{
+ buf[0] = (value >> 24) & 0xFF;
@@ -378,7 +418,7 @@
+ rfbCloseClient(cl);
+ return;
+}
-+
+
static void
rfbVncAuthVencrypt(rfbClientPtr cl)
{
@@ -390,14 +430,12 @@
+ buf[0] = 0;
+ buf[1] = 2;
+
-+ printf("TEST1\n");
+ if (rfbWriteExact(cl, buf, 2) < 0) {
+ rfbLogPerror("rfbVncAuthVencrypt: write");
+ rfbCloseClient(cl);
+ return;
+ }
-+
-+ printf("TEST2\n");
+
+ int n = rfbReadExact(cl, buf, 2);
+ if (n <= 0) {
+ if (n == 0)
@@ -408,8 +446,6 @@
+ return;
+ }
+
-+ printf("TEST3\n");
-+
+ if (buf[0] != 0 || buf[1] != 2) {
+ rfbLog("Unsupported VeNCrypt protocol %d.%d\n",
+ (int)buf[0], (int)buf[1]);
@@ -420,18 +456,17 @@
+ }
+
+ /* Sending allowed auth */
-+ printf("TEST4\n");
++ int req_auth = use_x509 ? rfbVencryptX509Plain : rfbVencryptTlsPlain;
+
+ buf[0] = 0; /* Accept version */
+ buf[1] = 1; /* number of sub auths */
-+ rfbEncodeU32(buf+2, rfbVencryptTlsPlain);
++ rfbEncodeU32(buf+2, req_auth);
+ if (rfbWriteExact(cl, buf, 6) < 0) {
+ rfbLogPerror("rfbVncAuthVencrypt: write");
+ rfbCloseClient(cl);
+ return;
+ }
-
-+ printf("TEST5\n");
++
+ n = rfbReadExact(cl, buf, 4);
+ if (n <= 0) {
+ if (n == 0)
@@ -443,15 +478,13 @@
+ }
+
+ int auth = rfbDecodeU32(buf, 0);
-+ printf("TEST6 %d\n", auth);
-+ if (auth != rfbVencryptTlsPlain) {
-+ buf[0] = 1; /* Reject version */
++ if (auth != req_auth) {
++ buf[0] = 1; /* Reject auth*/
+ rfbWriteExact(cl, buf, 1);
+ rfbCloseClient(cl);
+ return;
+ }
+
-+ printf("TEST7\n");
+ buf[0] = 1; /* Accept auth */
+ if (rfbWriteExact(cl, buf, 1) < 0) {
+ rfbLogPerror("rfbVncAuthVencrypt: write");
@@ -459,9 +492,6 @@
+ return;
+ }
+
-+ printf("TEST8\n");
-+
-+
+ tls_client_t *sd = calloc(1, sizeof(tls_client_t));
+
+ if (sd->session == NULL) {
@@ -494,7 +524,8 @@
+ }
+
+ static const int kx_anon[] = {GNUTLS_KX_ANON_DH, 0};
-+ if ((ret = gnutls_kx_set_priority(sd->session, kx_anon)) < 0) {
++ static const int kx_x509[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0};
++ if ((ret = gnutls_kx_set_priority(sd->session, use_x509 ? kx_x509 : kx_anon)) < 0) {
+ rfbLog("gnutls_kx_set_priority failed: %s\n", gnutls_strerror(ret));
+ sd->session = NULL;
+ rfbCloseClient(cl);
@@ -519,32 +550,47 @@
+ return;
+ }
+
-+ gnutls_anon_server_credentials anon_cred;
++ if (use_x509) {
++ gnutls_certificate_server_credentials x509_cred;
++
++ if (!(x509_cred = tls_initialize_x509_cred())) {
++ sd->session = NULL;
++ rfbCloseClient(cl);
++ return;
++ }
++
++ if (gnutls_credentials_set(sd->session, GNUTLS_CRD_CERTIFICATE, x509_cred) < 0) {
++ sd->session = NULL;
++ gnutls_certificate_free_credentials(x509_cred);
++ rfbCloseClient(cl);
++ return;
++ }
++
++ } else {
++ gnutls_anon_server_credentials anon_cred;
+
-+ if (!(anon_cred = tls_initialize_anon_cred())) {
-+ sd->session = NULL;
-+ rfbCloseClient(cl);
-+ return;
-+ }
++ if (!(anon_cred = tls_initialize_anon_cred())) {
++ sd->session = NULL;
++ rfbCloseClient(cl);
++ return;
++ }
+
-+ if ((ret = gnutls_credentials_set(sd->session, GNUTLS_CRD_ANON, anon_cred)) < 0) {
-+ rfbLog("gnutls_credentials_set failed: %s\n", gnutls_strerror(ret));
-+ gnutls_anon_free_server_credentials(anon_cred);
-+ sd->session = NULL;
-+ rfbCloseClient(cl);
-+ return;
++ if ((ret = gnutls_credentials_set(sd->session, GNUTLS_CRD_ANON, anon_cred)) < 0) {
++ rfbLog("gnutls_credentials_set failed: %s\n", gnutls_strerror(ret));
++ gnutls_anon_free_server_credentials(anon_cred);
++ sd->session = NULL;
++ rfbCloseClient(cl);
++ return;
++ }
+ }
+
+ gnutls_transport_set_ptr(sd->session, (gnutls_transport_ptr_t)cl);
+ gnutls_transport_set_push_function(sd->session, vnc_tls_push);
+ gnutls_transport_set_pull_function(sd->session, vnc_tls_pull);
-+ printf("TEST 9\n");
+ }
+
+
+retry:
-+ printf("TEST 10 %p\n", cl);
-+
+ if ((ret = gnutls_handshake(sd->session)) < 0) {
+ if (!gnutls_error_is_fatal(ret)) {
+ usleep(100000);
@@ -561,12 +607,10 @@
+ cl->sock_write_fn = &vnc_tls_write;
+
+ vencrypt_subauth_plain(cl);
-+
-+ printf("TEST end\n");
}
static rfbSecurityHandler VncSecurityHandlerVencrypt = {
-@@ -1759,6 +2191,21 @@
+@@ -1759,6 +2234,21 @@
time_t elapsed, cur_time;
struct winsize dimensions;
@@ -588,7 +632,7 @@
for (i = 1; i < argc; i++) {
if (!strcmp (argv[i], "-c")) {
command = argv[i+1];
-@@ -1784,6 +2231,8 @@
+@@ -1784,6 +2274,8 @@
#ifdef DEBUG
rfbLogEnable (1);
More information about the pve-devel
mailing list