From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LXcw6-0006OP-Iu for qemu-devel@nongnu.org; Thu, 12 Feb 2009 09:53:06 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LXcw4-0006NI-O9 for qemu-devel@nongnu.org; Thu, 12 Feb 2009 09:53:06 -0500 Received: from [199.232.76.173] (port=53212 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LXcw4-0006N9-GN for qemu-devel@nongnu.org; Thu, 12 Feb 2009 09:53:04 -0500 Received: from mx1.redhat.com ([66.187.233.31]:34879) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LXcw4-0005sa-2l for qemu-devel@nongnu.org; Thu, 12 Feb 2009 09:53:04 -0500 Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n1CEr3WD019271 for ; Thu, 12 Feb 2009 09:53:03 -0500 Received: from file.fab.redhat.com (file.fab.redhat.com [10.33.63.6]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1CEr52c015745 for ; Thu, 12 Feb 2009 09:53:05 -0500 Received: from file.fab.redhat.com (localhost.localdomain [127.0.0.1]) by file.fab.redhat.com (8.13.1/8.13.1) with ESMTP id n1CEr2Lw027190 for ; Thu, 12 Feb 2009 14:53:02 GMT Received: (from berrange@localhost) by file.fab.redhat.com (8.13.1/8.13.1/Submit) id n1CEr2S5027159 for qemu-devel@nongnu.org; Thu, 12 Feb 2009 14:53:02 GMT Date: Thu, 12 Feb 2009 14:53:02 +0000 From: "Daniel P. Berrange" Message-ID: <20090212145302.GO9894@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] PATCH: 0/7: Support SASL authentication in VNC server Reply-To: "Daniel P. Berrange" , qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Previously I provided patches for QEMU's VNC server to support SSL/TLS and x509 certificates. This provides good encryption capabilities for the VNC session. It doesn't really address the authentication problem though. I have been working to create a new authentication type in the RFB protocol to address this need in a generic, extendable way, by mapping the SASL API into the RFB protocol. Since SASL is a generic plugin based API, this will allow use of a huge range of auth mechanims over VNC, without us having to add any more auth code. For example, PAM, Digest-MD5, GSSAPI/Kerberos, One-time key/password, LDAP password lookup, SQL db password lookup, and more. I have got a VNC auth type assigned by the RFB spec maintainers: http://realvnc.com/pipermail/vnc-list/2008-December/059463.html With the full current spec for the SASL extension currently documented here: http://realvnc.com/pipermail/vnc-list/2008-December/059462.html This is the 2nd version of the patches I initially posted here http://lists.gnu.org/archive/html/qemu-devel/2009-02/msg00255.html Changes since last time - Re-factor the code to move TLS and SASL methods into separate files, vnc-tls.c, vnc-auth-vencrypt.c and vnc-auth-vencrypt.h - Added simple access control lists for authorization of client users on either SASL username, or x509 distinguished name - Added proof of concept external file format for persisting ACLs - Extend 'info vnc' to show much more information about clients and auth - Tested with SASL + Digest-MD5, SASL + GSSAPI. TLS + SASL + Digest-MD5 and TLS + SASL + GSSAPI. This gives coverage off all interesting code paths and/or I/O encryption combinations. The combined diffstat for all 7 patches about to follow, is .hgignore | 16 Makefile | 27 + Makefile.target | 5 b/acl.c | 264 ++++++++++++ b/acl.h | 71 +++ b/keymaps.h | 60 ++ b/qemu.sasl | 34 + b/vnc-auth-sasl.c | 640 +++++++++++++++++++++++++++++ b/vnc-auth-sasl.h | 76 +++ b/vnc-auth-vencrypt.c | 175 +++++++ b/vnc-auth-vencrypt.h | 33 + b/vnc-tls.c | 456 ++++++++++++++++++++ b/vnc-tls.h | 76 +++ configure | 34 + curses.c | 3 curses_keys.h | 9 keymaps.c | 45 -- monitor.c | 80 +++ qemu-doc.texi | 109 ++++ sdl.c | 3 sdl_keysym.h | 7 vl.c | 12 vnc.c | 1100 ++++++++++++++++++-------------------------------- vnc.h | 215 +++++++++ vnc_keysym.h | 5 25 files changed, 2795 insertions(+), 760 deletions(-) Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|