Re: [Qemu-devel] PATCH 3/8: VNC password authentication

[Anthony Liguori <anthony@codemonkey.ws>]

Daniel P. Berrange wrote:
> This patch introduces support for VNC protocols upto 3.8 and with
> it, support for password based authentication. VNC's password based
> authentication is not entirely secure, but it is a standard and the
> RFB spec requires that all clients support it. The password can be
> provided by using the monitor 'change vnc :1' and it will prompt for
> a password to be entered. Passwords have upto 8 letters of context.
> Pressing 'enter' without entering any characters disables password
> auth in the server. NB, we need a custom copy of d3des here because
> VNC uses a 'special' modification of the algorithm. This d3des code
> is public domain & in all other VNC servers & clients.
>   

I think it may be better to have a command to explicitly set the vnc 
password.  Issuing "change vnc :1" just to change the password is a 
little awkward IMHO.

> -
> -    vnc_write_u32(vs, 1); /* None */
> -    vnc_flush(vs);
> -
> -    vnc_read_when(vs, protocol_client_init, 1);
> +    VNC_DEBUG("Client request protocol version %d.%d\n", vs->major, vs->minor);
> +    if (vs->major != 3 ||
> +	(vs->minor != 3 &&
> +	 vs->minor != 7 &&
> +	 vs->minor != 8)) {
> +	VNC_DEBUG("Unsupported client version\n");
> +	vnc_write_u32(vs, VNC_AUTH_INVALID);
> +	vnc_flush(vs);
> +	vnc_client_error(vs);
> +	return 0;
> +    }
>   

A very popular VNC client uses 3.5 as the protocol version.  I believe 
the specification requires that 3.5 be treated at 3.3 because of that.

Regards,

Anthony Liguori