1From 1964e244caee4f8acaeb43a032ea2f0cf96f3e2d Mon Sep 17 00:00:00 2001 2From: Philipp Zabel <philipp.zabel@gmail.com> 3Date: Sat, 19 Nov 2022 09:52:05 +0100 4Subject: [PATCH 89/92] backend-vnc: Add user authentication 5 6Let VNC clients authenticate using the local username and password of 7the user weston is running as. To avoid transmitting the password in 8cleartext, make TLS security mandatory. 9 10Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com> 11(cherry picked from commit 133417b016c5dfbfea850ad6a2f29b1ad7162401) 12Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> 13--- 14 libweston/backend-vnc/vnc.c | 60 ++++++++++++++++++++++++------------- 15 man/weston-vnc.man | 4 +-- 16 2 files changed, 41 insertions(+), 23 deletions(-) 17 18diff --git a/libweston/backend-vnc/vnc.c b/libweston/backend-vnc/vnc.c 19index e57e377..6cb05d7 100644 20--- a/libweston/backend-vnc/vnc.c 21+++ b/libweston/backend-vnc/vnc.c 22@@ -36,6 +36,7 @@ 23 #include <errno.h> 24 #include <linux/input.h> 25 #include <netinet/in.h> 26+#include <pwd.h> 27 #include <sys/types.h> 28 #include <sys/socket.h> 29 #include <unistd.h> 30@@ -411,6 +412,19 @@ vnc_pointer_event(struct nvnc_client *client, uint16_t x, uint16_t y, 31 notify_pointer_frame(peer->seat); 32 } 33 34+static bool 35+vnc_handle_auth(const char *username, const char *password, void *userdata) 36+{ 37+ struct passwd *pw = getpwnam(username); 38+ 39+ if (!pw || pw->pw_uid != getuid()) { 40+ weston_log("VNC: wrong user '%s'\n", username); 41+ return false; 42+ } 43+ 44+ return weston_authenticate_user(username, password); 45+} 46+ 47 static void 48 vnc_client_cleanup(struct nvnc_client *client) 49 { 50@@ -997,30 +1011,34 @@ vnc_backend_create(struct weston_compositor *compositor, 51 nvnc_set_userdata(backend->server, backend, NULL); 52 nvnc_set_name(backend->server, "Weston VNC backend"); 53 54- if (config->server_cert || config->server_key) { 55- if (!nvnc_has_auth()) { 56- weston_log("Neat VNC built without TLS support\n"); 57- goto err_output; 58- } 59- if (!config->server_cert) { 60- weston_log("Missing TLS certificate (--vnc-tls-cert)\n"); 61- goto err_output; 62- } 63- if (!config->server_key) { 64- weston_log("Missing TLS key (--vnc-tls-key)\n"); 65- goto err_output; 66- } 67- 68- ret = nvnc_enable_auth(backend->server, config->server_key, 69- config->server_cert, NULL, NULL); 70- if (ret) { 71- weston_log("Failed to enable TLS support\n"); 72- goto err_output; 73- } 74+ if (!nvnc_has_auth()) { 75+ weston_log("Neat VNC built without TLS support\n"); 76+ goto err_output; 77+ } 78+ if (!config->server_cert && !config->server_key) { 79+ weston_log("The VNC backend requires a key and a certificate for TLS security" 80+ " (--vnc-tls-cert/--vnc-tls-key)\n"); 81+ goto err_output; 82+ } 83+ if (!config->server_cert) { 84+ weston_log("Missing TLS certificate (--vnc-tls-cert)\n"); 85+ goto err_output; 86+ } 87+ if (!config->server_key) { 88+ weston_log("Missing TLS key (--vnc-tls-key)\n"); 89+ goto err_output; 90+ } 91 92- weston_log("TLS support activated\n"); 93+ ret = nvnc_enable_auth(backend->server, config->server_key, 94+ config->server_cert, vnc_handle_auth, 95+ NULL); 96+ if (ret) { 97+ weston_log("Failed to enable TLS support\n"); 98+ goto err_output; 99 } 100 101+ weston_log("TLS support activated\n"); 102+ 103 ret = weston_plugin_api_register(compositor, WESTON_VNC_OUTPUT_API_NAME, 104 &api, sizeof(api)); 105 if (ret < 0) { 106diff --git a/man/weston-vnc.man b/man/weston-vnc.man 107index 582fe28..5232aac 100644 108--- a/man/weston-vnc.man 109+++ b/man/weston-vnc.man 110@@ -19,8 +19,8 @@ the graphical content, depending on what is supported by the VNC client. 111 The VNC backend is not multi-seat aware, so if a second client connects to the 112 backend, the first client will be disconnected. 113 114-Note that authentication is not supported yet. Anyone with access to the port 115-can get control of the desktop via the VNC output. 116+The VNC client has to authenticate as the user running weston. This requires a PAM configuration file 117+.BR /etc/pam.d/weston-remote-access . 118 119 .\" *************************************************************** 120 .SH CONFIGURATION 121-- 1222.20.1 123 124