void start_auth_sasl(VncState *vs)

{

    const char *mechlist = NULL;

    sasl_security_properties_t secprops;

    int err;

    char *localAddr, *remoteAddr;

    int mechlistlen;



    VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);



    /* Get local & remote client addresses in form  IPADDR;PORT */

    if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))

        goto authabort;



    if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {

        g_free(localAddr);

        goto authabort;

    }



    err = sasl_server_new("vnc",

                          NULL, /* FQDN - just delegates to gethostname */

                          NULL, /* User realm */

                          localAddr,

                          remoteAddr,

                          NULL, /* Callbacks, not needed */

                          SASL_SUCCESS_DATA,

                          &vs->sasl.conn);

    g_free(localAddr);

    g_free(remoteAddr);

    localAddr = remoteAddr = NULL;



    if (err != SASL_OK) {

        VNC_DEBUG("sasl context setup failed %d (%s)",

                  err, sasl_errstring(err, NULL, NULL));

        vs->sasl.conn = NULL;

        goto authabort;

    }



#ifdef CONFIG_VNC_TLS

    /* Inform SASL that we've got an external SSF layer from TLS/x509 */

    if (vs->auth == VNC_AUTH_VENCRYPT &&

        vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {

        gnutls_cipher_algorithm_t cipher;

        sasl_ssf_t ssf;



        cipher = gnutls_cipher_get(vs->tls.session);

        if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {

            VNC_DEBUG("%s", "cannot TLS get cipher size\n");

            sasl_dispose(&vs->sasl.conn);

            vs->sasl.conn = NULL;

            goto authabort;

        }

        ssf *= 8; /* tls key size is bytes, sasl wants bits */



        err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);

        if (err != SASL_OK) {

            VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",

                      err, sasl_errstring(err, NULL, NULL));

            sasl_dispose(&vs->sasl.conn);

            vs->sasl.conn = NULL;

            goto authabort;

        }

    } else

#endif /* CONFIG_VNC_TLS */

        vs->sasl.wantSSF = 1;



    memset (&secprops, 0, sizeof secprops);

    /* Inform SASL that we've got an external SSF layer from TLS */

    if (vs->vd->is_unix

#ifdef CONFIG_VNC_TLS

        /* Disable SSF, if using TLS+x509+SASL only. TLS without x509

           is not sufficiently strong */

        || (vs->auth == VNC_AUTH_VENCRYPT &&

            vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)

#endif /* CONFIG_VNC_TLS */

        ) {

        /* If we've got TLS or UNIX domain sock, we don't care about SSF */

        secprops.min_ssf = 0;

        secprops.max_ssf = 0;

        secprops.maxbufsize = 8192;

        secprops.security_flags = 0;

    } else {

        /* Plain TCP, better get an SSF layer */

        secprops.min_ssf = 56; /* Good enough to require kerberos */

        secprops.max_ssf = 100000; /* Arbitrary big number */

        secprops.maxbufsize = 8192;

        /* Forbid any anonymous or trivially crackable auth */

        secprops.security_flags =

            SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;

    }



    err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);

    if (err != SASL_OK) {

        VNC_DEBUG("cannot set SASL security props %d (%s)\n",

                  err, sasl_errstring(err, NULL, NULL));

        sasl_dispose(&vs->sasl.conn);

        vs->sasl.conn = NULL;

        goto authabort;

    }



    err = sasl_listmech(vs->sasl.conn,

                        NULL, /* Don't need to set user */

                        "", /* Prefix */

                        ",", /* Separator */

                        "", /* Suffix */

                        &mechlist,

                        NULL,

                        NULL);

    if (err != SASL_OK) {

        VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",

                  err, sasl_errdetail(vs->sasl.conn));

        sasl_dispose(&vs->sasl.conn);

        vs->sasl.conn = NULL;

        goto authabort;

    }

    VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);



    vs->sasl.mechlist = g_strdup(mechlist);

    mechlistlen = strlen(mechlist);

    vnc_write_u32(vs, mechlistlen);

    vnc_write(vs, mechlist, mechlistlen);

    vnc_flush(vs);



    VNC_DEBUG("Wait for client mechname length\n");

    vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);



    return;



 authabort:

    vnc_client_error(vs);

}

void start_auth_sasl(VncState *vs)

{

    const char *mechlist = NULL;

    sasl_security_properties_t secprops;

    int err;

    char *localAddr, *remoteAddr;

    int mechlistlen;



    VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);



    

    if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))

        goto authabort;



    if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {

        g_free(localAddr);

        goto authabort;

    }



    err = sasl_server_new("vnc",

                          NULL, 

                          NULL, 

                          localAddr,

                          remoteAddr,

                          NULL, 

                          SASL_SUCCESS_DATA,

                          &vs->sasl.conn);

    g_free(localAddr);

    g_free(remoteAddr);

    localAddr = remoteAddr = NULL;



    if (err != SASL_OK) {

        VNC_DEBUG("sasl context setup failed %d (%s)",

                  err, sasl_errstring(err, NULL, NULL));

        vs->sasl.conn = NULL;

        goto authabort;

    }



#ifdef CONFIG_VNC_TLS

    

    if (vs->auth == VNC_AUTH_VENCRYPT &&

        vs->subauth == VNC_AUTH_VENCRYPT_X509SASL) {

        gnutls_cipher_algorithm_t cipher;

        sasl_ssf_t ssf;



        cipher = gnutls_cipher_get(vs->tls.session);

        if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {

            VNC_DEBUG("%s", "cannot TLS get cipher size\n");

            sasl_dispose(&vs->sasl.conn);

            vs->sasl.conn = NULL;

            goto authabort;

        }

        ssf *= 8; 



        err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);

        if (err != SASL_OK) {

            VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",

                      err, sasl_errstring(err, NULL, NULL));

            sasl_dispose(&vs->sasl.conn);

            vs->sasl.conn = NULL;

            goto authabort;

        }

    } else

#endif 

        vs->sasl.wantSSF = 1;



    memset (&secprops, 0, sizeof secprops);

    

    if (vs->vd->is_unix

#ifdef CONFIG_VNC_TLS

        



        || (vs->auth == VNC_AUTH_VENCRYPT &&

            vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)

#endif 

        ) {

        

        secprops.min_ssf = 0;

        secprops.max_ssf = 0;

        secprops.maxbufsize = 8192;

        secprops.security_flags = 0;

    } else {

        

        secprops.min_ssf = 56; 

        secprops.max_ssf = 100000; 

        secprops.maxbufsize = 8192;

        

        secprops.security_flags =

            SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;

    }



    err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);

    if (err != SASL_OK) {

        VNC_DEBUG("cannot set SASL security props %d (%s)\n",

                  err, sasl_errstring(err, NULL, NULL));

        sasl_dispose(&vs->sasl.conn);

        vs->sasl.conn = NULL;

        goto authabort;

    }



    err = sasl_listmech(vs->sasl.conn,

                        NULL, 

                        "", 

                        ",", 

                        "", 

                        &mechlist,

                        NULL,

                        NULL);

    if (err != SASL_OK) {

        VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",

                  err, sasl_errdetail(vs->sasl.conn));

        sasl_dispose(&vs->sasl.conn);

        vs->sasl.conn = NULL;

        goto authabort;

    }

    VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);



    vs->sasl.mechlist = g_strdup(mechlist);

    mechlistlen = strlen(mechlist);

    vnc_write_u32(vs, mechlistlen);

    vnc_write(vs, mechlist, mechlistlen);

    vnc_flush(vs);



    VNC_DEBUG("Wait for client mechname length\n");

    vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);



    return;



 authabort:

    vnc_client_error(vs);

}

#ifdef CONFIG_VNC_TLS         gnutls_cipher_algorithm_t cipher;         cipher = gnutls_cipher_get(vs->tls.session);         if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {             VNC_DEBUG("%s", "cannot TLS get cipher size\n");     } else     if (vs->vd->is_unix #ifdef CONFIG_VNC_TLS         || (vs->auth == VNC_AUTH_VENCRYPT &&             vs->subauth == VNC_AUTH_VENCRYPT_X509SASL)         ) {     } else { #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS #ifdef CONFIG_VNC_TLS
void FUNC_0(VncState *VAR_0)

{

    const char *VAR_1 = NULL;

    sasl_security_properties_t secprops;

    int VAR_2;

    char *VAR_3, *VAR_4;

    int VAR_5;



    VNC_DEBUG("Initialize SASL auth %d\n", VAR_0->csock);



    

    if (!(VAR_3 = vnc_socket_local_addr("%s;%s", VAR_0->csock)))

        goto authabort;



    if (!(VAR_4 = vnc_socket_remote_addr("%s;%s", VAR_0->csock))) {

        g_free(VAR_3);

        goto authabort;

    }



    VAR_2 = sasl_server_new("vnc",

                          NULL, 

                          NULL, 

                          VAR_3,

                          VAR_4,

                          NULL, 

                          SASL_SUCCESS_DATA,

                          &VAR_0->sasl.conn);

    g_free(VAR_3);

    g_free(VAR_4);

    VAR_3 = VAR_4 = NULL;



    if (VAR_2 != SASL_OK) {

        VNC_DEBUG("sasl context setup failed %d (%s)",

                  VAR_2, sasl_errstring(VAR_2, NULL, NULL));

        VAR_0->sasl.conn = NULL;

        goto authabort;

    }



#ifdef CONFIG_VNC_TLS

    

    if (VAR_0->auth == VNC_AUTH_VENCRYPT &&

        VAR_0->subauth == VNC_AUTH_VENCRYPT_X509SASL) {

        gnutls_cipher_algorithm_t cipher;

        sasl_ssf_t ssf;



        cipher = gnutls_cipher_get(VAR_0->tls.session);

        if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {

            VNC_DEBUG("%s", "cannot TLS get cipher size\n");

            sasl_dispose(&VAR_0->sasl.conn);

            VAR_0->sasl.conn = NULL;

            goto authabort;

        }

        ssf *= 8; 



        VAR_2 = sasl_setprop(VAR_0->sasl.conn, SASL_SSF_EXTERNAL, &ssf);

        if (VAR_2 != SASL_OK) {

            VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",

                      VAR_2, sasl_errstring(VAR_2, NULL, NULL));

            sasl_dispose(&VAR_0->sasl.conn);

            VAR_0->sasl.conn = NULL;

            goto authabort;

        }

    } else

#endif 

        VAR_0->sasl.wantSSF = 1;



    memset (&secprops, 0, sizeof secprops);

    

    if (VAR_0->vd->is_unix

#ifdef CONFIG_VNC_TLS

        



        || (VAR_0->auth == VNC_AUTH_VENCRYPT &&

            VAR_0->subauth == VNC_AUTH_VENCRYPT_X509SASL)

#endif 

        ) {

        

        secprops.min_ssf = 0;

        secprops.max_ssf = 0;

        secprops.maxbufsize = 8192;

        secprops.security_flags = 0;

    } else {

        

        secprops.min_ssf = 56; 

        secprops.max_ssf = 100000; 

        secprops.maxbufsize = 8192;

        

        secprops.security_flags =

            SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;

    }



    VAR_2 = sasl_setprop(VAR_0->sasl.conn, SASL_SEC_PROPS, &secprops);

    if (VAR_2 != SASL_OK) {

        VNC_DEBUG("cannot set SASL security props %d (%s)\n",

                  VAR_2, sasl_errstring(VAR_2, NULL, NULL));

        sasl_dispose(&VAR_0->sasl.conn);

        VAR_0->sasl.conn = NULL;

        goto authabort;

    }



    VAR_2 = sasl_listmech(VAR_0->sasl.conn,

                        NULL, 

                        "", 

                        ",", 

                        "", 

                        &VAR_1,

                        NULL,

                        NULL);

    if (VAR_2 != SASL_OK) {

        VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",

                  VAR_2, sasl_errdetail(VAR_0->sasl.conn));

        sasl_dispose(&VAR_0->sasl.conn);

        VAR_0->sasl.conn = NULL;

        goto authabort;

    }

    VNC_DEBUG("Available mechanisms for client: '%s'\n", VAR_1);



    VAR_0->sasl.VAR_1 = g_strdup(VAR_1);

    VAR_5 = strlen(VAR_1);

    vnc_write_u32(VAR_0, VAR_5);

    vnc_write(VAR_0, VAR_1, VAR_5);

    vnc_flush(VAR_0);



    VNC_DEBUG("Wait for client mechname length\n");

    vnc_read_when(VAR_0, protocol_client_auth_sasl_mechname_len, 4);



    return;



 authabort:

    vnc_client_error(VAR_0);

}

void FUNC_0(VncState *VAR_0)
{ const char *VAR_1 = NULL; sasl_security_properties_t secprops; int VAR_2; char *VAR_3, *VAR_4; int VAR_5; VNC_DEBUG("Initialize SASL auth %d\n", VAR_0->csock); if (!(VAR_3 = vnc_socket_local_addr("%s;%s", VAR_0->csock))) goto authabort; if (!(VAR_4 = vnc_socket_remote_addr("%s;%s", VAR_0->csock))) { g_free(VAR_3); goto authabort; } VAR_2 = sasl_server_new("vnc",
NULL,
NULL,
VAR_3,
VAR_4,
NULL,
SASL_SUCCESS_DATA,
&VAR_0->sasl.conn); g_free(VAR_3); g_free(VAR_4); VAR_3 = VAR_4 = NULL; if (VAR_2 != SASL_OK) { VNC_DEBUG("sasl context setup failed %d (%s)",
VAR_2, sasl_errstring(VAR_2, NULL, NULL)); VAR_0->sasl.conn = NULL; goto authabort; } #ifdef CONFIG_VNC_TLS
if (VAR_0->auth == VNC_AUTH_VENCRYPT &&
VAR_0->subauth == VNC_AUTH_VENCRYPT_X509SASL) { gnutls_cipher_algorithm_t cipher; sasl_ssf_t ssf; cipher = gnutls_cipher_get(VAR_0->tls.session); if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { VNC_DEBUG("%s", "cannot TLS get cipher size\n"); sasl_dispose(&VAR_0->sasl.conn); VAR_0->sasl.conn = NULL; goto authabort; } ssf *= 8; VAR_2 = sasl_setprop(VAR_0->sasl.conn, SASL_SSF_EXTERNAL, &ssf); if (VAR_2 != SASL_OK) { VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
VAR_2, sasl_errstring(VAR_2, NULL, NULL)); sasl_dispose(&VAR_0->sasl.conn); VAR_0->sasl.conn = NULL; goto authabort; } } else #endif
VAR_0->sasl.wantSSF = 1; memset (&secprops, 0, sizeof secprops); if (VAR_0->vd->is_unix
#ifdef CONFIG_VNC_TLS
|| (VAR_0->auth == VNC_AUTH_VENCRYPT &&
VAR_0->subauth == VNC_AUTH_VENCRYPT_X509SASL)
#endif
) { secprops.min_ssf = 0; secprops.max_ssf = 0; secprops.maxbufsize = 8192; secprops.security_flags = 0; } else { secprops.min_ssf = 56; secprops.max_ssf = 100000; secprops.maxbufsize = 8192; secprops.security_flags =
SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; } VAR_2 = sasl_setprop(VAR_0->sasl.conn, SASL_SEC_PROPS, &secprops); if (VAR_2 != SASL_OK) { VNC_DEBUG("cannot set SASL security props %d (%s)\n",
VAR_2, sasl_errstring(VAR_2, NULL, NULL)); sasl_dispose(&VAR_0->sasl.conn); VAR_0->sasl.conn = NULL; goto authabort; } VAR_2 = sasl_listmech(VAR_0->sasl.conn,
NULL,
"",
",",
"",
&VAR_1,
NULL,
NULL); if (VAR_2 != SASL_OK) { VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
VAR_2, sasl_errdetail(VAR_0->sasl.conn)); sasl_dispose(&VAR_0->sasl.conn); VAR_0->sasl.conn = NULL; goto authabort; } VNC_DEBUG("Available mechanisms for client: '%s'\n", VAR_1); VAR_0->sasl.VAR_1 = g_strdup(VAR_1); VAR_5 = strlen(VAR_1); vnc_write_u32(VAR_0, VAR_5); vnc_write(VAR_0, VAR_1, VAR_5); vnc_flush(VAR_0); VNC_DEBUG("Wait for client mechname length\n"); vnc_read_when(VAR_0, protocol_client_auth_sasl_mechname_len, 4); return; authabort:
vnc_client_error(VAR_0); }