From patchwork Tue Oct 22 15:24:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= X-Patchwork-Id: 13845813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2BCF3D2C56E for ; Tue, 22 Oct 2024 15:26:21 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1t3Gkf-0007wu-Su; Tue, 22 Oct 2024 11:24:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t3Gke-0007wZ-OF for qemu-devel@nongnu.org; Tue, 22 Oct 2024 11:24:52 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t3Gkc-00050w-PP for qemu-devel@nongnu.org; Tue, 22 Oct 2024 11:24:52 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1729610690; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JhLwN1xcVc4bxUulw8IvjvSjWvFylTwzvGK5edzZaYw=; b=ZDzQIZARvMVXdKoBRKCIh2Bkui+RFnllLj0T+TA6dHQbNYqoic1SQB6qxFpnr/PLXjE0xd 9jCOGMq8CuE8btRY2Z8FHv4Gtox8ACmVYDrX/K7Orcc6KXSqsNFHVsbBPbz57sM6895F43 yY/OHvCXRu27YriyK6YqtTElZGER67Y= Received: from mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-156-WdCBgWN9ONmlhphBk2-8CA-1; Tue, 22 Oct 2024 11:24:44 -0400 X-MC-Unique: WdCBgWN9ONmlhphBk2-8CA-1 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D3D3B19332A9; Tue, 22 Oct 2024 15:24:42 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.42.28.59]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 096D419560A2; Tue, 22 Oct 2024 15:24:39 +0000 (UTC) From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Wainer dos Santos Moschetta , =?utf-8?q?Daniel_P=2E?= =?utf-8?q?_Berrang=C3=A9?= , =?utf-8?q?Marc-Andr=C3=A9?= =?utf-8?q?_Lureau?= , =?utf-8?q?Philippe_Mathi?= =?utf-8?q?eu-Daud=C3=A9?= , Thomas Huth , =?utf-8?q?Alex_Benn=C3=A9e?= Subject: [PULL 08/14] ui/vnc: don't return an empty SASL mechlist to the client Date: Tue, 22 Oct 2024 16:24:09 +0100 Message-ID: <20241022152415.1632556-9-berrange@redhat.com> In-Reply-To: <20241022152415.1632556-1-berrange@redhat.com> References: <20241022152415.1632556-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.519, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org The SASL initialization phase may determine that there are no valid mechanisms available to use. This may be because the host OS admin forgot to install some packages, or it might be because the requested SSF level is incompatible with available mechanisms, or other unknown reasons. If we return an empty mechlist to the client, they're going to get a failure from the SASL library on their end and drop the connection. Thus there is no point even sending this back to the client, we can just drop the connection immediately. Reviewed-by: Marc-André Lureau Signed-off-by: Daniel P. Berrangé --- ui/vnc-auth-sasl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index 47fdae5b21..7d9ca9e8ac 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -674,6 +674,13 @@ void start_auth_sasl(VncState *vs) } trace_vnc_auth_sasl_mech_list(vs, mechlist); + if (g_str_equal(mechlist, "")) { + trace_vnc_auth_fail(vs, vs->auth, "no available SASL mechanisms", ""); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn = NULL; + goto authabort; + } + vs->sasl.mechlist = g_strdup(mechlist); mechlistlen = strlen(mechlist); vnc_write_u32(vs, mechlistlen);