)]}' { "commit": "2f9606b3736c3be4dbd606c46525c7b770ced119", "tree": "c68a38d8b691e5235f1f2afc833aae9fea961d8b", "parents": [ "5fb6c7a8b26eab1a22207d24b4784bd2b39ab54b" ], "author": { "name": "aliguori", "email": "aliguori@c046a42c-6fe2-441c-8c8c-71466251a162", "time": "Fri Mar 06 20:27:28 2009 +0000" }, "committer": { "name": "aliguori", "email": "aliguori@c046a42c-6fe2-441c-8c8c-71466251a162", "time": "Fri Mar 06 20:27:28 2009 +0000" }, "message": "Add SASL authentication support (\"Daniel P. Berrange\")\n\nThis patch adds the new SASL authentication protocol to the VNC server.\n\nIt is enabled by setting the \u0027sasl\u0027 flag when launching VNC. SASL can\noptionally provide encryption via its SSF layer, if a suitable mechanism\nis configured (eg, GSSAPI/Kerberos, or Digest-MD5). If an SSF layer is\nnot available, then it should be combined with the x509 VNC authentication\nprotocol which provides encryption.\n\neg, if using GSSAPI\n\n qemu -vnc localhost:1,sasl\n\neg if using TLS/x509 for encryption\n\n qemu -vnc localhost:1,sasl,tls,x509\n\n\nBy default the Cyrus SASL library will look for its configuration in\nthe file /etc/sasl2/qemu.conf. For non-root users, this can be overridden\nby setting the SASL_CONF_PATH environment variable, eg to make it look in\n$HOME/.sasl2. NB unprivileged users may not have access to the full range\nof SASL mechanisms, since some of them require some administrative privileges\nto configure. The patch includes an example SASL configuration file which\nillustrates config for GSSAPI and Digest-MD5, though it should be noted that\nthe latter is not really considered secure any more.\n\nMost of the SASL authentication code is located in a separate source file,\nvnc-auth-sasl.c. The main vnc.c file only contains minimal integration\nglue, specifically parsing of command line flags / setup, and calls to\nstart the SASL auth process, to do encoding/decoding for data.\n\nThere are several possible stacks for reading \u0026 writing of data, depending\non the combo of VNC authentication methods in use\n\n - Clear. read/write straight to socket\n - TLS. read/write via GNUTLS helpers\n - SASL. encode/decode via SASL SSF layer, then read/write to socket\n - SASL+TLS. encode/decode via SASL SSF layer, then read/write via GNUTLS\n\nHence, the vnc_client_read \u0026 vnc_client_write methods have been refactored\na little.\n\n vnc_client_read: main entry point for reading, calls either\n\n - vnc_client_read_plain reading, with no intermediate decoding\n - vnc_client_read_sasl reading, with SASL SSF decoding\n\n These two methods, then call vnc_client_read_buf(). This decides\n whether to write to the socket directly or write via GNUTLS.\n\nThe situation is the same for writing data. More extensive comments\nhave been added in the code / patch. The vnc_client_read_sasl and\nvnc_client_write_sasl method implementations live in the separate\nvnc-auth-sasl.c file.\n\nThe state required for the SASL auth mechanism is kept in a separate\nVncStateSASL struct, defined in vnc-auth-sasl.h and included in the\nmain VncState.\n\nThe configure script probes for SASL and automatically enables it\nif found, unless --disable-vnc-sasl was given to override it.\n\n\n Makefile | 7 \n Makefile.target | 5 \n b/qemu.sasl | 34 ++\n b/vnc-auth-sasl.c | 626 ++++++++++++++++++++++++++++++++++++++++++++++++++++\n b/vnc-auth-sasl.h | 67 +++++\n configure | 34 ++\n qemu-doc.texi | 97 ++++++++\n vnc-auth-vencrypt.c | 12 \n vnc.c | 249 ++++++++++++++++++--\n vnc.h | 31 ++\n 10 files changed, 1129 insertions(+), 33 deletions(-)\n\n Signed-off-by: Daniel P. Berrange \u003cberrange@redhat.com\u003e\nSigned-off-by: Anthony Liguori \u003caliguori@us.ibm.com\u003e\n\n\ngit-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6724 c046a42c-6fe2-441c-8c8c-71466251a162\n", "tree_diff": [ { "type": "modify", "old_id": "e8d1a5cdc2ee05f6251690be9721efa665d5448e", "old_mode": 33188, "old_path": "Makefile", "new_id": "e9a75c422f459cb2015cab2b74166c1a1d0a3137", "new_mode": 33188, "new_path": "Makefile" }, { "type": "modify", "old_id": "f33f7621f7ec23dace5ff36f15bbddf7d8632cad", "old_mode": 33188, "old_path": "Makefile.target", "new_id": "9a2f123d36b998eea52b3c10de3387dd50552cd6", "new_mode": 33188, "new_path": "Makefile.target" }, { "type": "modify", "old_id": "faacb8de0957632ad56c9e8b2b9d8fe85195b098", "old_mode": 33261, "old_path": "configure", "new_id": "5c2b15447fd1f97793ceca0ace4937012190eb58", "new_mode": 33261, "new_path": "configure" }, { "type": "modify", "old_id": "616de48c0c4e921ab8c41dd9b4760c7f2fde7cbe", "old_mode": 33188, "old_path": "qemu-doc.texi", "new_id": "1528f39cf499c4a8127dbbd3c0ae125c36b05ffa", "new_mode": 33188, "new_path": "qemu-doc.texi" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "cf19cf8d079e81fa05841a12f62016560966a7e2", "new_mode": 33188, "new_path": "qemu.sasl" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "2882a357d8963dc3fce8ef58bab4bf5106e2c92f", "new_mode": 33188, "new_path": "vnc-auth-sasl.c" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "a72973a26b2ec2f75cb625ab9d01cf3c468e46a8", "new_mode": 33188, "new_path": "vnc-auth-sasl.h" }, { "type": "modify", "old_id": "f4d8fe60ee9f5bde4b16622f86d69e67a838ff6e", "old_mode": 33188, "old_path": "vnc.c", "new_id": "074238790b2d03ee861a3a3f508a75a62725141e", "new_mode": 33188, "new_path": "vnc.c" }, { "type": "modify", "old_id": "b5ae1f951bd0d5d64b381f9ae99fee71ffd6a4e3", "old_mode": 33188, "old_path": "vnc.h", "new_id": "59a1b4ab9d3a80d0f93e33c6fd9e93e0f6bab1f5", "new_mode": 33188, "new_path": "vnc.h" } ] }