[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 9/9] ui: ensure VNC websockets server checks the ACL
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 9/9] ui: ensure VNC websockets server checks the ACL if requested |
Date: |
Wed, 18 Mar 2015 14:17:46 +0100 |
From: "Daniel P. Berrange" <address@hidden>
If the x509verify option is requested, the VNC websockets server
was failing to validate that the websockets client provided an
x509 certificate matching the ACL rules.
Signed-off-by: Daniel P. Berrange <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
ui/vnc-ws.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/ui/vnc-ws.c b/ui/vnc-ws.c
index 5f9fcc4..85dbb7e 100644
--- a/ui/vnc-ws.c
+++ b/ui/vnc-ws.c
@@ -45,6 +45,16 @@ static int vncws_start_tls_handshake(struct VncState *vs)
return -1;
}
+ if (vs->vd->tls.x509verify) {
+ if (vnc_tls_validate_certificate(vs) < 0) {
+ VNC_DEBUG("Client verification failed\n");
+ vnc_client_error(vs);
+ return -1;
+ } else {
+ VNC_DEBUG("Client verification passed\n");
+ }
+ }
+
VNC_DEBUG("Handshake done, switching to TLS data mode\n");
qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs);
--
1.8.3.1
- [Qemu-devel] [PULL for-2.3 0/9] vnc patch queue., Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 1/9] vnc: Fix QMP change not to use funky error class, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 8/9] ui: remove separate gnutls_session for websockets server, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 7/9] ui: enforce TLS when using websockets server, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 3/9] ui: replace printf() calls with VNC_DEBUG, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 6/9] ui: fix setup of VNC websockets auth scheme with TLS, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 5/9] ui: split setup of VNC auth scheme into separate method, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 9/9] ui: ensure VNC websockets server checks the ACL if requested,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 4/9] ui: report error if user requests VNC option that is unsupported, Gerd Hoffmann, 2015/03/18
- [Qemu-devel] [PULL 2/9] ui: remove unused 'wiremode' variable in VncState struct, Gerd Hoffmann, 2015/03/18
- Re: [Qemu-devel] [PULL for-2.3 0/9] vnc patch queue., Peter Maydell, 2015/03/19