[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v2 8/8] ui: ensure VNC websockets server checks the
From: |
Daniel P. Berrange |
Subject: |
[Qemu-devel] [PATCH v2 8/8] ui: ensure VNC websockets server checks the ACL if requested |
Date: |
Tue, 17 Mar 2015 13:43:00 +0000 |
If the x509verify option is requested, the VNC websockets server
was failing to validate that the websockets client provided an
x509 certificate matching the ACL rules.
Signed-off-by: Daniel P. Berrange <address@hidden>
---
ui/vnc-ws.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/ui/vnc-ws.c b/ui/vnc-ws.c
index 5f9fcc4..85dbb7e 100644
--- a/ui/vnc-ws.c
+++ b/ui/vnc-ws.c
@@ -45,6 +45,16 @@ static int vncws_start_tls_handshake(struct VncState *vs)
return -1;
}
+ if (vs->vd->tls.x509verify) {
+ if (vnc_tls_validate_certificate(vs) < 0) {
+ VNC_DEBUG("Client verification failed\n");
+ vnc_client_error(vs);
+ return -1;
+ } else {
+ VNC_DEBUG("Client verification passed\n");
+ }
+ }
+
VNC_DEBUG("Handshake done, switching to TLS data mode\n");
qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
--
2.1.0
- [Qemu-devel] [PATCH v2 0/8] Misc fixes for VNC, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 4/8] ui: split setup of VNC auth scheme into separate method, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 1/8] ui: remove unused 'wiremode' variable in VncState struct, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 2/8] ui: replace printf() calls with VNC_DEBUG, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 6/8] ui: enforce TLS when using websockets server, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 5/8] ui: fix setup of VNC websockets auth scheme with TLS, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 3/8] ui: report error if user requests VNC option that is unsupported, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 7/8] ui: remove separate gnutls_session for websockets server, Daniel P. Berrange, 2015/03/17
- [Qemu-devel] [PATCH v2 8/8] ui: ensure VNC websockets server checks the ACL if requested,
Daniel P. Berrange <=