From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50496) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXrmJ-0000xb-8u for qemu-devel@nongnu.org; Tue, 17 Mar 2015 09:43:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YXrmC-0006JR-SB for qemu-devel@nongnu.org; Tue, 17 Mar 2015 09:43:27 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46952) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YXrmC-0006JE-NP for qemu-devel@nongnu.org; Tue, 17 Mar 2015 09:43:20 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id 5BF128E3E5 for ; Tue, 17 Mar 2015 13:43:20 +0000 (UTC) From: "Daniel P. Berrange" Date: Tue, 17 Mar 2015 13:43:00 +0000 Message-Id: <1426599780-3264-9-git-send-email-berrange@redhat.com> In-Reply-To: <1426599780-3264-1-git-send-email-berrange@redhat.com> References: <1426599780-3264-1-git-send-email-berrange@redhat.com> Subject: [Qemu-devel] [PATCH v2 8/8] ui: ensure VNC websockets server checks the ACL if requested List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann If the x509verify option is requested, the VNC websockets server was failing to validate that the websockets client provided an x509 certificate matching the ACL rules. Signed-off-by: Daniel P. Berrange --- ui/vnc-ws.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/ui/vnc-ws.c b/ui/vnc-ws.c index 5f9fcc4..85dbb7e 100644 --- a/ui/vnc-ws.c +++ b/ui/vnc-ws.c @@ -45,6 +45,16 @@ static int vncws_start_tls_handshake(struct VncState *vs) return -1; } + if (vs->vd->tls.x509verify) { + if (vnc_tls_validate_certificate(vs) < 0) { + VNC_DEBUG("Client verification failed\n"); + vnc_client_error(vs); + return -1; + } else { + VNC_DEBUG("Client verification passed\n"); + } + } + VNC_DEBUG("Handshake done, switching to TLS data mode\n"); qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); -- 2.1.0