Add more trace points to VNC code
cover Add more trace points to VNC code
Add many more trace points to the VNC server, removing a bunch of VNC_DEBUG lines where appropriate
Daniel P. Berrange (2):
ui: add tracing of VNC operations related to QIOChannel
ui: add tracing of VNC authentication process
ui/trace-events | 21 +++++++++ ui/vnc-auth-sasl.c | 113 ++++++++++++++++++++++--------------------------- ui/vnc-auth-vencrypt.c | 23 +++++----- ui/vnc-ws.c | 6 +-- ui/vnc.c | 47 +++++++++++--------- 5 files changed, 111 insertions(+), 99 deletions(-)
Signature · 1 line
2.13.5
PATCH 1/2 ui: add tracing of VNC operations related to QIOChannel
Trace anything which opens/closes/wraps a QIOChannel in the VNC server.
Signed-off-by Daniel P. Berrange <[email protected]>
--- ui/trace-events | 6 ++++++ ui/vnc-auth-vencrypt.c | 2 ++ ui/vnc-ws.c | 6 +++--- ui/vnc.c | 11 ++++++++--- 4 files changed, 19 insertions(+), 6 deletions(-)
ui/trace-events +6 -0
@@ -29,6 +29,12 @@ vnc_key_event_ext(bool down, int sym, int keycode, const char *name) "down %d, s vnc_key_event_map(bool down, int sym, int keycode, const char *name) "down %d, sym 0x%x -> keycode 0x%x [%s]" vnc_key_sync_numlock(bool on) "%d" vnc_key_sync_capslock(bool on) "%d" +vnc_client_eof(void *state, void *ioc) "VNC client EOF state=%p ioc=%p" +vnc_client_io_error(void *state, void *ioc, const char *msg) "VNC client I/O error state=%p ioc=%p errmsg=%s" +vnc_client_connect(void *state, void *ioc) "VNC client connect state=%p ioc=%p" +vnc_client_disconnect_start(void *state, void *ioc) "VNC client disconnect start state=%p ioc=%p" +vnc_client_disconnect_finish(void *state, void *ioc) "VNC client disconnect finish state=%p ioc=%p" +vnc_client_io_wrap(void *state, void *ioc, const char *type) "VNC client I/O wrap state=%p ioc=%p type=%s" # ui/input.c input_event_key_number(int conidx, int number, const char *qcode, bool down) "con %d, key number 0x%x [%s], down %d"
ui/vnc-auth-vencrypt.c +2 -0
@@ -28,6 +28,7 @@#include "vnc.h" #include "qapi/error.h" #include "qemu/main-loop.h" +#include "trace.h" static void start_auth_vencrypt_subauth (VncState *vs) {
@@ -124,6 +125,7 @@ static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t lenVNC_DEBUG ("Start TLS VeNCrypt handshake process\n" );object_unref (OBJECT (vs->ioc)); vs->ioc =QIO_CHANNEL (tls); +trace_vnc_client_io_wrap (vs, vs->ioc,"tls" ); vs->tls =qio_channel_tls_get_session (tls); qio_channel_tls_handshake(tls,
ui/vnc-ws.c +3 -3
@@ -23,6 +23,7 @@#include "vnc.h" #include "io/channel-websock.h" #include "qemu/bswap.h" +#include "trace.h" static void vncws_tls_handshake_done (QIOTask *task,gpointer user_data)
@@ -53,7 +54,6 @@ gboolean vncws_tls_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,QIOChannelTLS *tls;Error *err =NULL ; -VNC_DEBUG ("TLS Websocket connection required\n" );if (vs->ioc_tag) {g_source_remove (vs->ioc_tag); vs->ioc_tag =0 ;
@@ -73,9 +73,9 @@ gboolean vncws_tls_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,qio_channel_set_name (QIO_CHANNEL (tls),"vnc-ws-server-tls" ); -VNC_DEBUG ("Start TLS WS handshake process\n" );object_unref (OBJECT (vs->ioc)); vs->ioc =QIO_CHANNEL (tls); +trace_vnc_client_io_wrap (vs, vs->ioc,"tls" ); vs->tls =qio_channel_tls_get_session (tls); qio_channel_tls_handshake(tls,
@@ -116,7 +116,6 @@ gboolean vncws_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,VncState *vs = opaque;QIOChannelWebsock *wioc; -VNC_DEBUG ("Websocket negotiate starting\n" );if (vs->ioc_tag) {g_source_remove (vs->ioc_tag); vs->ioc_tag =0 ;
@@ -127,6 +126,7 @@ gboolean vncws_handshake_io(QIOChannel *ioc G_GNUC_UNUSED,object_unref (OBJECT (vs->ioc)); vs->ioc =QIO_CHANNEL (wioc); +trace_vnc_client_io_wrap (vs, vs->ioc,"websock" ); qio_channel_websock_handshake(wioc, vncws_handshake_done,
ui/vnc.c +8 -3
@@ -1118,6 +1118,7 @@ static void vnc_disconnect_start(VncState *vs)if (vs->disconnecting) {return ; } +trace_vnc_client_disconnect_start (vs, vs->ioc);vnc_set_share_mode (vs,VNC_SHARE_MODE_DISCONNECTED );if (vs->ioc_tag) {g_source_remove (vs->ioc_tag);
@@ -1131,6 +1132,8 @@ void vnc_disconnect_finish(VncState *vs) {int i; +trace_vnc_client_disconnect_finish (vs, vs->ioc); +vnc_jobs_join (vs);/* Wait encoding jobs */ vnc_lock_output (vs);
@@ -1184,11 +1187,12 @@ ssize_t vnc_client_io_error(VncState *vs, ssize_t ret, Error **errp) {if (ret <=0 ) {if (ret ==0 ) { -VNC_DEBUG ("Closing down client sock: EOF\n" ); +trace_vnc_client_eof (vs, vs->ioc);vnc_disconnect_start (vs); }else if (ret !=QIO_CHANNEL_ERR_BLOCK ) { -VNC_DEBUG ("Closing down client sock: ret %zd (%s)\n" , - ret, errp ?error_get_pretty (*errp) :"Unknown" ); +trace_vnc_client_io_error (vs, vs->ioc, + errp ?error_get_pretty (*errp) : +"Unknown" );vnc_disconnect_start (vs); }
@@ -2885,6 +2889,7 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,bool first_client =QTAILQ_EMPTY (&vd->clients);int i; +trace_vnc_client_connect (vs, sioc); vs->sioc = sioc;object_ref (OBJECT (vs->sioc)); vs->ioc =QIO_CHANNEL (sioc);
Signature · 1 line
2.13.5
PATCH 2/2 ui: add tracing of VNC authentication process
In reply to Daniel P. BerrangeTrace anything related to authentication in the VNC protocol handshake
Signed-off-by Daniel P. Berrange <[email protected]>
--- ui/trace-events | 15 +++++++ ui/vnc-auth-sasl.c | 113 ++++++++++++++++++++++--------------------------- ui/vnc-auth-vencrypt.c | 21 ++++----- ui/vnc.c | 36 ++++++++-------- 4 files changed, 92 insertions(+), 93 deletions(-)
ui/trace-events +15 -0
@@ -35,6 +35,21 @@ vnc_client_connect(void *state, void *ioc) "VNC client connect state=%p ioc=%p" vnc_client_disconnect_start(void *state, void *ioc) "VNC client disconnect start state=%p ioc=%p" vnc_client_disconnect_finish(void *state, void *ioc) "VNC client disconnect finish state=%p ioc=%p" vnc_client_io_wrap(void *state, void *ioc, const char *type) "VNC client I/O wrap state=%p ioc=%p type=%s" +vnc_auth_init(void *display, int websock, int auth, int subauth) "VNC auth init state=%p websock=%d auth=%d subauth=%d" +vnc_auth_start(void *state, int method) "VNC client auth start state=%p method=%d" +vnc_auth_pass(void *state, int method) "VNC client auth passed state=%p method=%d" +vnc_auth_fail(void *state, int method, const char *message, const char *reason) "VNC client auth failed state=%p method=%d message=%s reason=%s" +vnc_auth_reject(void *state, int expect, int got) "VNC client auth rejected state=%p method expected=%d got=%d" +vnc_auth_vencrypt_version(void *state, int major, int minor) "VNC client auth vencrypt version state=%p major=%d minor=%d" +vnc_auth_vencrypt_subauth(void *state, int auth) "VNC client auth vencrypt subauth state=%p auth=%d" +vnc_auth_sasl_mech_list(void *state, const char *mechs) "VNC client auth SASL state=%p mechlist=%s" +vnc_auth_sasl_mech_choose(void *state, const char *mech) "VNC client auth SASL state=%p mech=%s" +vnc_auth_sasl_start(void *state, const void *clientdata, size_t clientlen, const void *serverdata, size_t severlen, int ret) "VNC client auth SASL start state=%p clientdata=%p clientlen=%zu serverdata=%p serverlen=%zu ret=%d" +vnc_auth_sasl_step(void *state, const void *clientdata, size_t clientlen, const void *serverdata, size_t severlen, int ret) "VNC client auth SASL step state=%p clientdata=%p clientlen=%zu serverdata=%p serverlen=%zu ret=%d" +vnc_auth_sasl_ssf(void *state, int ssf) "VNC client auth SASL SSF state=%p size=%d" +vnc_auth_sasl_username(void *state, const char *name) "VNC client auth SASL user state=%p name=%s" +vnc_auth_sasl_acl(void *state, int allow) "VNC client auth SASL ACL state=%p allow=%d" + # ui/input.c input_event_key_number(int conidx, int number, const char *qcode, bool down) "con %d, key number 0x%x [%s], down %d"
ui/vnc-auth-sasl.c +50 -63
341 lines not on this page · raw message
ui/vnc-auth-vencrypt.c +9 -12
@@ -35,27 +35,24 @@ static void start_auth_vencrypt_subauth(VncState *vs)switch (vs->subauth) {case VNC_AUTH_VENCRYPT_TLSNONE :case VNC_AUTH_VENCRYPT_X509NONE : -VNC_DEBUG ("Accept TLS auth none\n" );vnc_write_u32 (vs,0 );/* Accept auth completion */ start_client_init (vs);break ;case VNC_AUTH_VENCRYPT_TLSVNC :case VNC_AUTH_VENCRYPT_X509VNC : -VNC_DEBUG ("Start TLS auth VNC\n" );start_auth_vnc (vs);break ;#ifdef CONFIG_VNC_SASL case VNC_AUTH_VENCRYPT_TLSSASL :case VNC_AUTH_VENCRYPT_X509SASL : -VNC_DEBUG ("Start TLS auth SASL\n" );start_auth_sasl (vs);break ;#endif /* CONFIG_VNC_SASL */ default :/* Should not be possible, but just in case */ -VNC_DEBUG ("Reject subauth %d server bug\n" , vs->auth); +trace_vnc_auth_fail (vs, vs->auth,"Unhandled VeNCrypt subauth" ,"" );vnc_write_u8 (vs,1 );if (vs->minor >=8 ) {static const char err[] ="Unsupported authentication type" ;
@@ -73,8 +70,8 @@ static void vnc_tls_handshake_done(QIOTask *task,Error *err =NULL ;if (qio_task_propagate_error (task, &err)) { -VNC_DEBUG ("Handshake failed %s\n" , -error_get_pretty (err)); +trace_vnc_auth_fail (vs, vs->auth,"TLS handshake failed" , +error_get_pretty (err));vnc_client_error (vs);error_free (err); }else {
@@ -92,15 +89,15 @@ static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len {int auth =read_u32 (data,0 ); +trace_vnc_auth_vencrypt_subauth (vs, auth);if (auth != vs->subauth) { -VNC_DEBUG ("Rejecting auth %d\n" , auth); +trace_vnc_auth_fail (vs, vs->auth,"Unsupported sub-auth version" ,"" );vnc_write_u8 (vs,0 );/* Reject auth */ vnc_flush (vs);vnc_client_error (vs); }else {Error *err =NULL ;QIOChannelTLS *tls; -VNC_DEBUG ("Accepting auth %d, setting up TLS for handshake\n" , auth);vnc_write_u8 (vs,1 );/* Accept auth */ vnc_flush (vs);
@@ -115,14 +112,14 @@ static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t len vs->vd->tlsaclname, &err);if (!tls) { -VNC_DEBUG ("Failed to setup TLS %s\n" ,error_get_pretty (err)); +trace_vnc_auth_fail (vs, vs->auth,"TLS setup failed" , +error_get_pretty (err));error_free (err);vnc_client_error (vs);return 0 ; }qio_channel_set_name (QIO_CHANNEL (tls),"vnc-server-tls" ); -VNC_DEBUG ("Start TLS VeNCrypt handshake process\n" );object_unref (OBJECT (vs->ioc)); vs->ioc =QIO_CHANNEL (tls);trace_vnc_client_io_wrap (vs, vs->ioc,"tls" );
@@ -138,14 +135,14 @@ static int protocol_client_vencrypt_auth(VncState *vs, uint8_t *data, size_t lenstatic int protocol_client_vencrypt_init (VncState *vs,uint8_t *data,size_t len) { +trace_vnc_auth_vencrypt_version (vs, (int )data[0 ], (int )data[1 ]);if (data[0 ] !=0 || data[1 ] !=2 ) { -VNC_DEBUG ("Unsupported VeNCrypt protocol %d.%d\n" , (int )data[0 ], (int )data[1 ]); +trace_vnc_auth_fail (vs, vs->auth,"Unsupported version" ,"" );vnc_write_u8 (vs,1 );/* Reject version */ vnc_flush (vs);vnc_client_error (vs); }else { -VNC_DEBUG ("Sending allowed auth %d\n" , vs->subauth);vnc_write_u8 (vs,0 );/* Accept version */ vnc_write_u8 (vs,1 );/* Number of sub-auths */ vnc_write_u32 (vs, vs->subauth);/* The supported auth */
ui/vnc.c +18 -18
@@ -2407,11 +2407,11 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len)Error *err =NULL ;if (!vs->vd->password) { -VNC_DEBUG ("No password configured on server" ); +trace_vnc_auth_fail (vs, vs->auth,"password is not set" ,"" ); goto reject; }if (vs->vd->expires < now) { -VNC_DEBUG ("Password is expired" ); +trace_vnc_auth_fail (vs, vs->auth,"password is expired" ,"" ); goto reject; }
@@ -2428,8 +2428,8 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) key,G_N_ELEMENTS (key), &err);if (!cipher) { -VNC_DEBUG ("Cannot initialize cipher %s" , -error_get_pretty (err)); +trace_vnc_auth_fail (vs, vs->auth,"cannot create cipher" , +error_get_pretty (err));error_free (err); goto reject; }
@@ -2439,18 +2439,18 @@ static int protocol_client_auth_vnc(VncState *vs, uint8_t *data, size_t len) response, VNC_AUTH_CHALLENGE_SIZE, &err) < 0) { -VNC_DEBUG ("Cannot encrypt challenge %s" , -error_get_pretty (err)); +trace_vnc_auth_fail (vs, vs->auth,"cannot encrypt challenge response" , +error_get_pretty (err));error_free (err); goto reject; }/* Compare expected vs actual challenge response */ if (memcmp (response, data,VNC_AUTH_CHALLENGE_SIZE ) !=0 ) { -VNC_DEBUG ("Client challenge response did not match\n" ); +trace_vnc_auth_fail (vs, vs->auth,"mis-matched challenge response" ,"" ); goto reject; }else { -VNC_DEBUG ("Accepting VNC challenge response\n" ); +trace_vnc_auth_pass (vs, vs->auth);vnc_write_u32 (vs,0 );/* Accept auth */ vnc_flush (vs);
@@ -2489,7 +2489,7 @@ static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len)/* We only advertise 1 auth scheme at a time, so client * must pick the one we sent. Verify this */ if (data[0 ] != vs->auth) {/* Reject auth */ -VNC_DEBUG ("Reject auth %d because it didn't match advertized\n" , (int )data[0 ]); +trace_vnc_auth_reject (vs, vs->auth, (int )data[0 ]);vnc_write_u32 (vs,1 );if (vs->minor >=8 ) {static const char err[] ="Authentication failed" ;
@@ -2498,36 +2498,33 @@ static int protocol_client_auth(VncState *vs, uint8_t *data, size_t len) }vnc_client_error (vs); }else {/* Accept requested auth */ -VNC_DEBUG ("Client requested auth %d\n" , (int )data[0 ]); +trace_vnc_auth_start (vs, vs->auth);switch (vs->auth) {case VNC_AUTH_NONE : -VNC_DEBUG ("Accept auth none\n" );if (vs->minor >=8 ) {vnc_write_u32 (vs,0 );/* Accept auth completion */ vnc_flush (vs); } +trace_vnc_auth_pass (vs, vs->auth);start_client_init (vs);break ;case VNC_AUTH_VNC : -VNC_DEBUG ("Start VNC auth\n" );start_auth_vnc (vs);break ;case VNC_AUTH_VENCRYPT : -VNC_DEBUG ("Accept VeNCrypt auth\n" );start_auth_vencrypt (vs);break ;#ifdef CONFIG_VNC_SASL case VNC_AUTH_SASL : -VNC_DEBUG ("Accept SASL auth\n" );start_auth_sasl (vs);break ;#endif /* CONFIG_VNC_SASL */ default :/* Should not be possible, but just in case */ -VNC_DEBUG ("Reject auth %d server code bug\n" , vs->auth); +trace_vnc_auth_fail (vs, vs->auth,"Unhandled auth method" ,"" );vnc_write_u8 (vs,1 );if (vs->minor >=8 ) {static const char err[] ="Authentication failed" ;
@@ -2572,10 +2569,11 @@ static int protocol_version(VncState *vs, uint8_t *version, size_t len) vs->minor =3 ;if (vs->minor ==3 ) { +trace_vnc_auth_start (vs, vs->auth);if (vs->auth ==VNC_AUTH_NONE ) { -VNC_DEBUG ("Tell client auth none\n" );vnc_write_u32 (vs, vs->auth);vnc_flush (vs); +trace_vnc_auth_pass (vs, vs->auth);start_client_init (vs); }else if (vs->auth ==VNC_AUTH_VNC ) {VNC_DEBUG ("Tell client VNC auth\n" );
@@ -2583,13 +2581,13 @@ static int protocol_version(VncState *vs, uint8_t *version, size_t len)vnc_flush (vs);start_auth_vnc (vs); }else { -VNC_DEBUG ("Unsupported auth %d for protocol 3.3\n" , vs->auth); +trace_vnc_auth_fail (vs, vs->auth, +"Unsupported auth method for v3.3" ,"" );vnc_write_u32 (vs,VNC_AUTH_INVALID );vnc_flush (vs);vnc_client_error (vs); } }else { -VNC_DEBUG ("Telling client we support auth %d\n" , vs->auth);vnc_write_u8 (vs,1 );/* num auth */ vnc_write_u8 (vs, vs->auth);vnc_read_when (vs, protocol_client_auth,1 );
@@ -3946,12 +3944,14 @@ void vnc_display_open(const char *id, Error **errp) sasl, false, errp) < 0) { goto fail; } +trace_vnc_auth_init (vd,0 , vd->auth, vd->subauth);if (vnc_display_setup_auth (&vd->ws_auth, &vd->ws_subauth, vd->tlscreds, password, sasl, true, errp) <0 ) { goto fail; } +trace_vnc_auth_init (vd,1 , vd->ws_auth, vd->ws_subauth);#ifdef CONFIG_VNC_SASL if ((saslErr =sasl_server_init (NULL ,"qemu" )) !=SASL_OK ) {
Signature · 1 line
2.13.5