From nobody Wed Oct 23 00:25:55 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1729610781; cv=none; d=zohomail.com; s=zohoarc; b=SIcAaDjjGNQRnb9Nw4BTjLoT59+lx2MhoMu+Q8yGzTB1DJkBXcyYOZSkbL+/iU/9E4TtthnJ1oNHrAQnjg5TPOQCpL6+lDqwzoi1EPHlggLBPIZi8rSgmF6nhHwjxYqb0q0oX4C9KiMmNPOY7pJXe249wIKYX0FAJuyIn2ZSfXE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1729610781; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JhLwN1xcVc4bxUulw8IvjvSjWvFylTwzvGK5edzZaYw=; b=COJdjQUFspOlmRTxBp9Izq8qkAIQF+K0tn8t2lzeOGEU0wNSItAY2YQj1XsRpuK/M9PIXvIuozGF9d0j1ZpDT10wlFl/V7tC97ncD9RS5y58og7oHv02hKu0CB7Flo75gtmham8HbCYieJeG9zK2O9J6WJjZqOT+/hb42mTXH5Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1729610781254180.12357714061545; Tue, 22 Oct 2024 08:26:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1t3Gkf-0007wu-Su; Tue, 22 Oct 2024 11:24:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t3Gke-0007wZ-OF for qemu-devel@nongnu.org; Tue, 22 Oct 2024 11:24:52 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1t3Gkc-00050w-PP for qemu-devel@nongnu.org; Tue, 22 Oct 2024 11:24:52 -0400 Received: from mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-156-WdCBgWN9ONmlhphBk2-8CA-1; Tue, 22 Oct 2024 11:24:44 -0400 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D3D3B19332A9; Tue, 22 Oct 2024 15:24:42 +0000 (UTC) Received: from toolbox.redhat.com (unknown [10.42.28.59]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 096D419560A2; Tue, 22 Oct 2024 15:24:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1729610690; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JhLwN1xcVc4bxUulw8IvjvSjWvFylTwzvGK5edzZaYw=; b=ZDzQIZARvMVXdKoBRKCIh2Bkui+RFnllLj0T+TA6dHQbNYqoic1SQB6qxFpnr/PLXjE0xd 9jCOGMq8CuE8btRY2Z8FHv4Gtox8ACmVYDrX/K7Orcc6KXSqsNFHVsbBPbz57sM6895F43 yY/OHvCXRu27YriyK6YqtTElZGER67Y= X-MC-Unique: WdCBgWN9ONmlhphBk2-8CA-1 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: qemu-devel@nongnu.org Cc: Wainer dos Santos Moschetta , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= , =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Huth , =?UTF-8?q?Alex=20Benn=C3=A9e?= Subject: [PULL 08/14] ui/vnc: don't return an empty SASL mechlist to the client Date: Tue, 22 Oct 2024 16:24:09 +0100 Message-ID: <20241022152415.1632556-9-berrange@redhat.com> In-Reply-To: <20241022152415.1632556-1-berrange@redhat.com> References: <20241022152415.1632556-1-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.519, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1729610783251116600 The SASL initialization phase may determine that there are no valid mechanisms available to use. This may be because the host OS admin forgot to install some packages, or it might be because the requested SSF level is incompatible with available mechanisms, or other unknown reasons. If we return an empty mechlist to the client, they're going to get a failure from the SASL library on their end and drop the connection. Thus there is no point even sending this back to the client, we can just drop the connection immediately. Reviewed-by: Marc-Andr=C3=A9 Lureau Signed-off-by: Daniel P. Berrang=C3=A9 --- ui/vnc-auth-sasl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c index 47fdae5b21..7d9ca9e8ac 100644 --- a/ui/vnc-auth-sasl.c +++ b/ui/vnc-auth-sasl.c @@ -674,6 +674,13 @@ void start_auth_sasl(VncState *vs) } trace_vnc_auth_sasl_mech_list(vs, mechlist); =20 + if (g_str_equal(mechlist, "")) { + trace_vnc_auth_fail(vs, vs->auth, "no available SASL mechanisms", = ""); + sasl_dispose(&vs->sasl.conn); + vs->sasl.conn =3D NULL; + goto authabort; + } + vs->sasl.mechlist =3D g_strdup(mechlist); mechlistlen =3D strlen(mechlist); vnc_write_u32(vs, mechlistlen); --=20 2.46.0