From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58370) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYDrE-000842-7K for qemu-devel@nongnu.org; Wed, 18 Mar 2015 09:18:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YYDr6-0001wA-CF for qemu-devel@nongnu.org; Wed, 18 Mar 2015 09:18:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58861) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYDr6-0001w1-7T for qemu-devel@nongnu.org; Wed, 18 Mar 2015 09:17:52 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by mx1.redhat.com (Postfix) with ESMTPS id EBF80322DB5 for ; Wed, 18 Mar 2015 13:17:51 +0000 (UTC) From: Gerd Hoffmann Date: Wed, 18 Mar 2015 14:17:46 +0100 Message-Id: <1426684666-30629-10-git-send-email-kraxel@redhat.com> In-Reply-To: <1426684666-30629-1-git-send-email-kraxel@redhat.com> References: <1426684666-30629-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PULL 9/9] ui: ensure VNC websockets server checks the ACL if requested List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann From: "Daniel P. Berrange" If the x509verify option is requested, the VNC websockets server was failing to validate that the websockets client provided an x509 certificate matching the ACL rules. Signed-off-by: Daniel P. Berrange Signed-off-by: Gerd Hoffmann --- ui/vnc-ws.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/ui/vnc-ws.c b/ui/vnc-ws.c index 5f9fcc4..85dbb7e 100644 --- a/ui/vnc-ws.c +++ b/ui/vnc-ws.c @@ -45,6 +45,16 @@ static int vncws_start_tls_handshake(struct VncState *vs) return -1; } + if (vs->vd->tls.x509verify) { + if (vnc_tls_validate_certificate(vs) < 0) { + VNC_DEBUG("Client verification failed\n"); + vnc_client_error(vs); + return -1; + } else { + VNC_DEBUG("Client verification passed\n"); + } + } + VNC_DEBUG("Handshake done, switching to TLS data mode\n"); qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); -- 1.8.3.1