LXR qemu/ui/vnc-auth-sasl.c

   1/*
   2 * QEMU VNC display driver: SASL auth protocol
   3 *
   4 * Copyright (C) 2009 Red Hat, Inc
   5 *
   6 * Permission is hereby granted, free of charge, to any person obtaining a copy
   7 * of this software and associated documentation files (the "Software"), to deal
   8 * in the Software without restriction, including without limitation the rights
   9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10 * copies of the Software, and to permit persons to whom the Software is
  11 * furnished to do so, subject to the following conditions:
  12 *
  13 * The above copyright notice and this permission notice shall be included in
  14 * all copies or substantial portions of the Software.
  15 *
  16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22 * THE SOFTWARE.
  23 */
  24
  25#include "vnc.h"
  26
  27/* Max amount of data we send/recv for SASL steps to prevent DOS */
  28#define SASL_DATA_MAX_LEN (1024 * 1024)
  29
  30
  31void vnc_sasl_client_cleanup(VncState *vs)
  32{
  33    if (vs->sasl.conn) {
  34        vs->sasl.runSSF = vs->sasl.waitWriteSSF = vs->sasl.wantSSF = 0;
  35        vs->sasl.encodedLength = vs->sasl.encodedOffset = 0;
  36        vs->sasl.encoded = NULL;
  37        free(vs->sasl.username);
  38        free(vs->sasl.mechlist);
  39        vs->sasl.username = vs->sasl.mechlist = NULL;
  40        sasl_dispose(&vs->sasl.conn);
  41        vs->sasl.conn = NULL;
  42    }
  43}
  44
  45
  46long vnc_client_write_sasl(VncState *vs)
  47{
  48    long ret;
  49
  50    VNC_DEBUG("Write SASL: Pending output %p size %zd offset %zd "
  51              "Encoded: %p size %d offset %d\n",
  52              vs->output.buffer, vs->output.capacity, vs->output.offset,
  53              vs->sasl.encoded, vs->sasl.encodedLength, vs->sasl.encodedOffset);
  54
  55    if (!vs->sasl.encoded) {
  56        int err;
  57        err = sasl_encode(vs->sasl.conn,
  58                          (char *)vs->output.buffer,
  59                          vs->output.offset,
  60                          (const char **)&vs->sasl.encoded,
  61                          &vs->sasl.encodedLength);
  62        if (err != SASL_OK)
  63            return vnc_client_io_error(vs, -1, EIO);
  64
  65        vs->sasl.encodedOffset = 0;
  66    }
  67
  68    ret = vnc_client_write_buf(vs,
  69                               vs->sasl.encoded + vs->sasl.encodedOffset,
  70                               vs->sasl.encodedLength - vs->sasl.encodedOffset);
  71    if (!ret)
  72        return 0;
  73
  74    vs->sasl.encodedOffset += ret;
  75    if (vs->sasl.encodedOffset == vs->sasl.encodedLength) {
  76        vs->output.offset = 0;
  77        vs->sasl.encoded = NULL;
  78        vs->sasl.encodedOffset = vs->sasl.encodedLength = 0;
  79    }
  80
  81    /* Can't merge this block with one above, because
  82     * someone might have written more unencrypted
  83     * data in vs->output while we were processing
  84     * SASL encoded output
  85     */
  86    if (vs->output.offset == 0) {
  87        qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs);
  88    }
  89
  90    return ret;
  91}
  92
  93
  94long vnc_client_read_sasl(VncState *vs)
  95{
  96    long ret;
  97    uint8_t encoded[4096];
  98    const char *decoded;
  99    unsigned int decodedLen;
 100    int err;
 101
 102    ret = vnc_client_read_buf(vs, encoded, sizeof(encoded));
 103    if (!ret)
 104        return 0;
 105
 106    err = sasl_decode(vs->sasl.conn,
 107                      (char *)encoded, ret,
 108                      &decoded, &decodedLen);
 109
 110    if (err != SASL_OK)
 111        return vnc_client_io_error(vs, -1, -EIO);
 112    VNC_DEBUG("Read SASL Encoded %p size %ld Decoded %p size %d\n",
 113              encoded, ret, decoded, decodedLen);
 114    buffer_reserve(&vs->input, decodedLen);
 115    buffer_append(&vs->input, decoded, decodedLen);
 116    return decodedLen;
 117}
 118
 119
 120static int vnc_auth_sasl_check_access(VncState *vs)
 121{
 122    const void *val;
 123    int err;
 124    int allow;
 125
 126    err = sasl_getprop(vs->sasl.conn, SASL_USERNAME, &val);
 127    if (err != SASL_OK) {
 128        VNC_DEBUG("cannot query SASL username on connection %d (%s), denying access\n",
 129                  err, sasl_errstring(err, NULL, NULL));
 130        return -1;
 131    }
 132    if (val == NULL) {
 133        VNC_DEBUG("no client username was found, denying access\n");
 134        return -1;
 135    }
 136    VNC_DEBUG("SASL client username %s\n", (const char *)val);
 137
 138    vs->sasl.username = qemu_strdup((const char*)val);
 139
 140    if (vs->vd->sasl.acl == NULL) {
 141        VNC_DEBUG("no ACL activated, allowing access\n");
 142        return 0;
 143    }
 144
 145    allow = qemu_acl_party_is_allowed(vs->vd->sasl.acl, vs->sasl.username);
 146
 147    VNC_DEBUG("SASL client %s %s by ACL\n", vs->sasl.username,
 148              allow ? "allowed" : "denied");
 149    return allow ? 0 : -1;
 150}
 151
 152static int vnc_auth_sasl_check_ssf(VncState *vs)
 153{
 154    const void *val;
 155    int err, ssf;
 156
 157    if (!vs->sasl.wantSSF)
 158        return 1;
 159
 160    err = sasl_getprop(vs->sasl.conn, SASL_SSF, &val);
 161    if (err != SASL_OK)
 162        return 0;
 163
 164    ssf = *(const int *)val;
 165    VNC_DEBUG("negotiated an SSF of %d\n", ssf);
 166    if (ssf < 56)
 167        return 0; /* 56 is good for Kerberos */
 168
 169    /* Only setup for read initially, because we're about to send an RPC
 170     * reply which must be in plain text. When the next incoming RPC
 171     * arrives, we'll switch on writes too
 172     *
 173     * cf qemudClientReadSASL  in qemud.c
 174     */
 175    vs->sasl.runSSF = 1;
 176
 177    /* We have a SSF that's good enough */
 178    return 1;
 179}
 180
 181/*
 182 * Step Msg
 183 *
 184 * Input from client:
 185 *
 186 * u32 clientin-length
 187 * u8-array clientin-string
 188 *
 189 * Output to client:
 190 *
 191 * u32 serverout-length
 192 * u8-array serverout-strin
 193 * u8 continue
 194 */
 195
 196static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len);
 197
 198static int protocol_client_auth_sasl_step(VncState *vs, uint8_t *data, size_t len)
 199{
 200    uint32_t datalen = len;
 201    const char *serverout;
 202    unsigned int serveroutlen;
 203    int err;
 204    char *clientdata = NULL;
 205
 206    /* NB, distinction of NULL vs "" is *critical* in SASL */
 207    if (datalen) {
 208        clientdata = (char*)data;
 209        clientdata[datalen-1] = '\0'; /* Wire includes '\0', but make sure */
 210        datalen--; /* Don't count NULL byte when passing to _start() */
 211    }
 212
 213    VNC_DEBUG("Step using SASL Data %p (%d bytes)\n",
 214              clientdata, datalen);
 215    err = sasl_server_step(vs->sasl.conn,
 216                           clientdata,
 217                           datalen,
 218                           &serverout,
 219                           &serveroutlen);
 220    if (err != SASL_OK &&
 221        err != SASL_CONTINUE) {
 222        VNC_DEBUG("sasl step failed %d (%s)\n",
 223                  err, sasl_errdetail(vs->sasl.conn));
 224        sasl_dispose(&vs->sasl.conn);
 225        vs->sasl.conn = NULL;
 226        goto authabort;
 227    }
 228
 229    if (serveroutlen > SASL_DATA_MAX_LEN) {
 230        VNC_DEBUG("sasl step reply data too long %d\n",
 231                  serveroutlen);
 232        sasl_dispose(&vs->sasl.conn);
 233        vs->sasl.conn = NULL;
 234        goto authabort;
 235    }
 236
 237    VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
 238              serveroutlen, serverout ? 0 : 1);
 239
 240    if (serveroutlen) {
 241        vnc_write_u32(vs, serveroutlen + 1);
 242        vnc_write(vs, serverout, serveroutlen + 1);
 243    } else {
 244        vnc_write_u32(vs, 0);
 245    }
 246
 247    /* Whether auth is complete */
 248    vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
 249
 250    if (err == SASL_CONTINUE) {
 251        VNC_DEBUG("%s", "Authentication must continue\n");
 252        /* Wait for step length */
 253        vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
 254    } else {
 255        if (!vnc_auth_sasl_check_ssf(vs)) {
 256            VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
 257            goto authreject;
 258        }
 259
 260        /* Check username whitelist ACL */
 261        if (vnc_auth_sasl_check_access(vs) < 0) {
 262            VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
 263            goto authreject;
 264        }
 265
 266        VNC_DEBUG("Authentication successful %d\n", vs->csock);
 267        vnc_write_u32(vs, 0); /* Accept auth */
 268        /*
 269         * Delay writing in SSF encoded mode until pending output
 270         * buffer is written
 271         */
 272        if (vs->sasl.runSSF)
 273            vs->sasl.waitWriteSSF = vs->output.offset;
 274        start_client_init(vs);
 275    }
 276
 277    return 0;
 278
 279 authreject:
 280    vnc_write_u32(vs, 1); /* Reject auth */
 281    vnc_write_u32(vs, sizeof("Authentication failed"));
 282    vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
 283    vnc_flush(vs);
 284    vnc_client_error(vs);
 285    return -1;
 286
 287 authabort:
 288    vnc_client_error(vs);
 289    return -1;
 290}
 291
 292static int protocol_client_auth_sasl_step_len(VncState *vs, uint8_t *data, size_t len)
 293{
 294    uint32_t steplen = read_u32(data, 0);
 295    VNC_DEBUG("Got client step len %d\n", steplen);
 296    if (steplen > SASL_DATA_MAX_LEN) {
 297        VNC_DEBUG("Too much SASL data %d\n", steplen);
 298        vnc_client_error(vs);
 299        return -1;
 300    }
 301
 302    if (steplen == 0)
 303        return protocol_client_auth_sasl_step(vs, NULL, 0);
 304    else
 305        vnc_read_when(vs, protocol_client_auth_sasl_step, steplen);
 306    return 0;
 307}
 308
 309/*
 310 * Start Msg
 311 *
 312 * Input from client:
 313 *
 314 * u32 clientin-length
 315 * u8-array clientin-string
 316 *
 317 * Output to client:
 318 *
 319 * u32 serverout-length
 320 * u8-array serverout-strin
 321 * u8 continue
 322 */
 323
 324#define SASL_DATA_MAX_LEN (1024 * 1024)
 325
 326static int protocol_client_auth_sasl_start(VncState *vs, uint8_t *data, size_t len)
 327{
 328    uint32_t datalen = len;
 329    const char *serverout;
 330    unsigned int serveroutlen;
 331    int err;
 332    char *clientdata = NULL;
 333
 334    /* NB, distinction of NULL vs "" is *critical* in SASL */
 335    if (datalen) {
 336        clientdata = (char*)data;
 337        clientdata[datalen-1] = '\0'; /* Should be on wire, but make sure */
 338        datalen--; /* Don't count NULL byte when passing to _start() */
 339    }
 340
 341    VNC_DEBUG("Start SASL auth with mechanism %s. Data %p (%d bytes)\n",
 342              vs->sasl.mechlist, clientdata, datalen);
 343    err = sasl_server_start(vs->sasl.conn,
 344                            vs->sasl.mechlist,
 345                            clientdata,
 346                            datalen,
 347                            &serverout,
 348                            &serveroutlen);
 349    if (err != SASL_OK &&
 350        err != SASL_CONTINUE) {
 351        VNC_DEBUG("sasl start failed %d (%s)\n",
 352                  err, sasl_errdetail(vs->sasl.conn));
 353        sasl_dispose(&vs->sasl.conn);
 354        vs->sasl.conn = NULL;
 355        goto authabort;
 356    }
 357    if (serveroutlen > SASL_DATA_MAX_LEN) {
 358        VNC_DEBUG("sasl start reply data too long %d\n",
 359                  serveroutlen);
 360        sasl_dispose(&vs->sasl.conn);
 361        vs->sasl.conn = NULL;
 362        goto authabort;
 363    }
 364
 365    VNC_DEBUG("SASL return data %d bytes, nil; %d\n",
 366              serveroutlen, serverout ? 0 : 1);
 367
 368    if (serveroutlen) {
 369        vnc_write_u32(vs, serveroutlen + 1);
 370        vnc_write(vs, serverout, serveroutlen + 1);
 371    } else {
 372        vnc_write_u32(vs, 0);
 373    }
 374
 375    /* Whether auth is complete */
 376    vnc_write_u8(vs, err == SASL_CONTINUE ? 0 : 1);
 377
 378    if (err == SASL_CONTINUE) {
 379        VNC_DEBUG("%s", "Authentication must continue\n");
 380        /* Wait for step length */
 381        vnc_read_when(vs, protocol_client_auth_sasl_step_len, 4);
 382    } else {
 383        if (!vnc_auth_sasl_check_ssf(vs)) {
 384            VNC_DEBUG("Authentication rejected for weak SSF %d\n", vs->csock);
 385            goto authreject;
 386        }
 387
 388        /* Check username whitelist ACL */
 389        if (vnc_auth_sasl_check_access(vs) < 0) {
 390            VNC_DEBUG("Authentication rejected for ACL %d\n", vs->csock);
 391            goto authreject;
 392        }
 393
 394        VNC_DEBUG("Authentication successful %d\n", vs->csock);
 395        vnc_write_u32(vs, 0); /* Accept auth */
 396        start_client_init(vs);
 397    }
 398
 399    return 0;
 400
 401 authreject:
 402    vnc_write_u32(vs, 1); /* Reject auth */
 403    vnc_write_u32(vs, sizeof("Authentication failed"));
 404    vnc_write(vs, "Authentication failed", sizeof("Authentication failed"));
 405    vnc_flush(vs);
 406    vnc_client_error(vs);
 407    return -1;
 408
 409 authabort:
 410    vnc_client_error(vs);
 411    return -1;
 412}
 413
 414static int protocol_client_auth_sasl_start_len(VncState *vs, uint8_t *data, size_t len)
 415{
 416    uint32_t startlen = read_u32(data, 0);
 417    VNC_DEBUG("Got client start len %d\n", startlen);
 418    if (startlen > SASL_DATA_MAX_LEN) {
 419        VNC_DEBUG("Too much SASL data %d\n", startlen);
 420        vnc_client_error(vs);
 421        return -1;
 422    }
 423
 424    if (startlen == 0)
 425        return protocol_client_auth_sasl_start(vs, NULL, 0);
 426
 427    vnc_read_when(vs, protocol_client_auth_sasl_start, startlen);
 428    return 0;
 429}
 430
 431static int protocol_client_auth_sasl_mechname(VncState *vs, uint8_t *data, size_t len)
 432{
 433    char *mechname = malloc(len + 1);
 434    if (!mechname) {
 435        VNC_DEBUG("Out of memory reading mechname\n");
 436        vnc_client_error(vs);
 437    }
 438    strncpy(mechname, (char*)data, len);
 439    mechname[len] = '\0';
 440    VNC_DEBUG("Got client mechname '%s' check against '%s'\n",
 441              mechname, vs->sasl.mechlist);
 442
 443    if (strncmp(vs->sasl.mechlist, mechname, len) == 0) {
 444        if (vs->sasl.mechlist[len] != '\0' &&
 445            vs->sasl.mechlist[len] != ',') {
 446            VNC_DEBUG("One %d", vs->sasl.mechlist[len]);
 447            vnc_client_error(vs);
 448            return -1;
 449        }
 450    } else {
 451        char *offset = strstr(vs->sasl.mechlist, mechname);
 452        VNC_DEBUG("Two %p\n", offset);
 453        if (!offset) {
 454            vnc_client_error(vs);
 455            return -1;
 456        }
 457        VNC_DEBUG("Two '%s'\n", offset);
 458        if (offset[-1] != ',' ||
 459            (offset[len] != '\0'&&
 460             offset[len] != ',')) {
 461            vnc_client_error(vs);
 462            return -1;
 463        }
 464    }
 465
 466    free(vs->sasl.mechlist);
 467    vs->sasl.mechlist = mechname;
 468
 469    VNC_DEBUG("Validated mechname '%s'\n", mechname);
 470    vnc_read_when(vs, protocol_client_auth_sasl_start_len, 4);
 471    return 0;
 472}
 473
 474static int protocol_client_auth_sasl_mechname_len(VncState *vs, uint8_t *data, size_t len)
 475{
 476    uint32_t mechlen = read_u32(data, 0);
 477    VNC_DEBUG("Got client mechname len %d\n", mechlen);
 478    if (mechlen > 100) {
 479        VNC_DEBUG("Too long SASL mechname data %d\n", mechlen);
 480        vnc_client_error(vs);
 481        return -1;
 482    }
 483    if (mechlen < 1) {
 484        VNC_DEBUG("Too short SASL mechname %d\n", mechlen);
 485        vnc_client_error(vs);
 486        return -1;
 487    }
 488    vnc_read_when(vs, protocol_client_auth_sasl_mechname,mechlen);
 489    return 0;
 490}
 491
 492#define USES_X509_AUTH(vs)                              \
 493    ((vs)->subauth == VNC_AUTH_VENCRYPT_X509NONE ||   \
 494     (vs)->subauth == VNC_AUTH_VENCRYPT_X509VNC ||    \
 495     (vs)->subauth == VNC_AUTH_VENCRYPT_X509PLAIN ||  \
 496     (vs)->subauth == VNC_AUTH_VENCRYPT_X509SASL)
 497
 498
 499void start_auth_sasl(VncState *vs)
 500{
 501    const char *mechlist = NULL;
 502    sasl_security_properties_t secprops;
 503    int err;
 504    char *localAddr, *remoteAddr;
 505    int mechlistlen;
 506
 507    VNC_DEBUG("Initialize SASL auth %d\n", vs->csock);
 508
 509    /* Get local & remote client addresses in form  IPADDR;PORT */
 510    if (!(localAddr = vnc_socket_local_addr("%s;%s", vs->csock)))
 511        goto authabort;
 512
 513    if (!(remoteAddr = vnc_socket_remote_addr("%s;%s", vs->csock))) {
 514        free(localAddr);
 515        goto authabort;
 516    }
 517
 518    err = sasl_server_new("vnc",
 519                          NULL, /* FQDN - just delegates to gethostname */
 520                          NULL, /* User realm */
 521                          localAddr,
 522                          remoteAddr,
 523                          NULL, /* Callbacks, not needed */
 524                          SASL_SUCCESS_DATA,
 525                          &vs->sasl.conn);
 526    free(localAddr);
 527    free(remoteAddr);
 528    localAddr = remoteAddr = NULL;
 529
 530    if (err != SASL_OK) {
 531        VNC_DEBUG("sasl context setup failed %d (%s)",
 532                  err, sasl_errstring(err, NULL, NULL));
 533        vs->sasl.conn = NULL;
 534        goto authabort;
 535    }
 536
 537#ifdef CONFIG_VNC_TLS
 538    /* Inform SASL that we've got an external SSF layer from TLS/x509 */
 539    if (vs->vd->auth == VNC_AUTH_VENCRYPT &&
 540        vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL) {
 541        gnutls_cipher_algorithm_t cipher;
 542        sasl_ssf_t ssf;
 543
 544        cipher = gnutls_cipher_get(vs->tls.session);
 545        if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) {
 546            VNC_DEBUG("%s", "cannot TLS get cipher size\n");
 547            sasl_dispose(&vs->sasl.conn);
 548            vs->sasl.conn = NULL;
 549            goto authabort;
 550        }
 551        ssf *= 8; /* tls key size is bytes, sasl wants bits */
 552
 553        err = sasl_setprop(vs->sasl.conn, SASL_SSF_EXTERNAL, &ssf);
 554        if (err != SASL_OK) {
 555            VNC_DEBUG("cannot set SASL external SSF %d (%s)\n",
 556                      err, sasl_errstring(err, NULL, NULL));
 557            sasl_dispose(&vs->sasl.conn);
 558            vs->sasl.conn = NULL;
 559            goto authabort;
 560        }
 561    } else
 562#endif /* CONFIG_VNC_TLS */
 563        vs->sasl.wantSSF = 1;
 564
 565    memset (&secprops, 0, sizeof secprops);
 566    /* Inform SASL that we've got an external SSF layer from TLS */
 567    if (strncmp(vs->vd->display, "unix:", 5) == 0
 568#ifdef CONFIG_VNC_TLS
 569        /* Disable SSF, if using TLS+x509+SASL only. TLS without x509
 570           is not sufficiently strong */
 571        || (vs->vd->auth == VNC_AUTH_VENCRYPT &&
 572            vs->vd->subauth == VNC_AUTH_VENCRYPT_X509SASL)
 573#endif /* CONFIG_VNC_TLS */
 574        ) {
 575        /* If we've got TLS or UNIX domain sock, we don't care about SSF */
 576        secprops.min_ssf = 0;
 577        secprops.max_ssf = 0;
 578        secprops.maxbufsize = 8192;
 579        secprops.security_flags = 0;
 580    } else {
 581        /* Plain TCP, better get an SSF layer */
 582        secprops.min_ssf = 56; /* Good enough to require kerberos */
 583        secprops.max_ssf = 100000; /* Arbitrary big number */
 584        secprops.maxbufsize = 8192;
 585        /* Forbid any anonymous or trivially crackable auth */
 586        secprops.security_flags =
 587            SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT;
 588    }
 589
 590    err = sasl_setprop(vs->sasl.conn, SASL_SEC_PROPS, &secprops);
 591    if (err != SASL_OK) {
 592        VNC_DEBUG("cannot set SASL security props %d (%s)\n",
 593                  err, sasl_errstring(err, NULL, NULL));
 594        sasl_dispose(&vs->sasl.conn);
 595        vs->sasl.conn = NULL;
 596        goto authabort;
 597    }
 598
 599    err = sasl_listmech(vs->sasl.conn,
 600                        NULL, /* Don't need to set user */
 601                        "", /* Prefix */
 602                        ",", /* Separator */
 603                        "", /* Suffix */
 604                        &mechlist,
 605                        NULL,
 606                        NULL);
 607    if (err != SASL_OK) {
 608        VNC_DEBUG("cannot list SASL mechanisms %d (%s)\n",
 609                  err, sasl_errdetail(vs->sasl.conn));
 610        sasl_dispose(&vs->sasl.conn);
 611        vs->sasl.conn = NULL;
 612        goto authabort;
 613    }
 614    VNC_DEBUG("Available mechanisms for client: '%s'\n", mechlist);
 615
 616    if (!(vs->sasl.mechlist = strdup(mechlist))) {
 617        VNC_DEBUG("Out of memory");
 618        sasl_dispose(&vs->sasl.conn);
 619        vs->sasl.conn = NULL;
 620        goto authabort;
 621    }
 622    mechlistlen = strlen(mechlist);
 623    vnc_write_u32(vs, mechlistlen);
 624    vnc_write(vs, mechlist, mechlistlen);
 625    vnc_flush(vs);
 626
 627    VNC_DEBUG("Wait for client mechname length\n");
 628    vnc_read_when(vs, protocol_client_auth_sasl_mechname_len, 4);
 629
 630    return;
 631
 632 authabort:
 633    vnc_client_error(vs);
 634    return;
 635}
 636
 637
 638