From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:59137) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RxHdn-00066Q-6P for qemu-devel@nongnu.org; Tue, 14 Feb 2012 07:37:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RxHdh-0006rr-J5 for qemu-devel@nongnu.org; Tue, 14 Feb 2012 07:37:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:55310) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RxHdh-0006rg-Ca for qemu-devel@nongnu.org; Tue, 14 Feb 2012 07:37:45 -0500 From: "Daniel P. Berrange" Date: Tue, 14 Feb 2012 12:37:29 +0000 Message-Id: <1329223049-26896-1-git-send-email-berrange@redhat.com> Subject: [Qemu-devel] [PATCH] vnc: Don't demote authentication scheme when changing password/disabling login List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Anthony Liguori , Gerd Hoffmann From: "Daniel P. Berrange" Currently when disabling login in VNC, the password is cleared out and the authentication protocol is forced to AUTH_VNC. If you're using a stronger authentication protocol, this has the effect of downgrading your security protocol. Fix this by only changing the authentication protocol if the current authentication protocol is AUTH_NONE. That ensures we're never downgrading. Signed-off-by: Daniel P. Berrange Signed-off-by: Anthony Liguori -- NB. This patch is derived from one posted by Anthony last year, which got accidentally lost after Luiz took over the QMP series work https://lists.gnu.org/archive/html/qemu-devel/2011-09/msg00392.html v1 -> v2 - Make sure to not demote when changing password (Daniel) v2 -> v3 - Rebase to latest GIT master wrt QMP changes --- ui/vnc.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 16b79ec..c449fcd 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2679,7 +2679,9 @@ int vnc_display_disable_login(DisplayState *ds) } vs->password = NULL; - vs->auth = VNC_AUTH_VNC; + if (vs->auth == VNC_AUTH_NONE) { + vs->auth = VNC_AUTH_VNC; + } return 0; } @@ -2703,7 +2705,9 @@ int vnc_display_password(DisplayState *ds, const char *password) vs->password = NULL; } vs->password = g_strdup(password); - vs->auth = VNC_AUTH_VNC; + if (vs->auth == VNC_AUTH_NONE) { + vs->auth = VNC_AUTH_VNC; + } return 0; } -- 1.7.7.6