35aa518
Index: qemu-kvm-0.10.4/vnc-tls.c
Glauber Costa 47b0758
===================================================================
Glauber Costa 47b0758
--- qemu-kvm-0.10.orig/qemu/vnc-tls.c
35aa518
+++ qemu-kvm-0.10.4/vnc-tls.c
Glauber Costa 47b0758
@@ -241,6 +241,22 @@ int vnc_tls_validate_certificate(struct 
Glauber Costa 47b0758
 	    return -1;
Glauber Costa 47b0758
 	}
Glauber Costa 47b0758
 
Glauber Costa 47b0758
+	if (i == 0) {
Glauber Costa 47b0758
+	    size_t dnameSize = 1024;
Glauber Costa 47b0758
+	    vs->tls.dname = qemu_malloc(dnameSize);
Glauber Costa 47b0758
+	requery:
Glauber Costa 47b0758
+	    if ((ret = gnutls_x509_crt_get_dn (cert, vs->tls.dname, &dnameSize)) != 0) {
Glauber Costa 47b0758
+		if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
Glauber Costa 47b0758
+		    vs->tls.dname = qemu_realloc(vs->tls.dname, dnameSize);
Glauber Costa 47b0758
+		    goto requery;
Glauber Costa 47b0758
+		}
Glauber Costa 47b0758
+		gnutls_x509_crt_deinit (cert);
Glauber Costa 47b0758
+		VNC_DEBUG("Cannot get client distinguished name: %s",
Glauber Costa 47b0758
+			  gnutls_strerror (ret));
Glauber Costa 47b0758
+		return -1;
Glauber Costa 47b0758
+	    }
Glauber Costa 47b0758
+	}
Glauber Costa 47b0758
+
Glauber Costa 47b0758
 	gnutls_x509_crt_deinit (cert);
Glauber Costa 47b0758
     }
Glauber Costa 47b0758
 
Glauber Costa 47b0758
@@ -347,6 +363,7 @@ void vnc_tls_client_cleanup(struct VncSt
Glauber Costa 47b0758
 	vs->tls.session = NULL;
Glauber Costa 47b0758
     }
Glauber Costa 47b0758
     vs->tls.wiremode = VNC_WIREMODE_CLEAR;
Glauber Costa 47b0758
+    free(vs->tls.dname);
Glauber Costa 47b0758
 }
Glauber Costa 47b0758
 
Glauber Costa 47b0758
 
35aa518
Index: qemu-kvm-0.10.4/vnc-tls.h
Glauber Costa 47b0758
===================================================================
Glauber Costa 47b0758
--- qemu-kvm-0.10.orig/qemu/vnc-tls.h
35aa518
+++ qemu-kvm-0.10.4/vnc-tls.h
Glauber Costa 47b0758
@@ -55,6 +55,9 @@ struct VncStateTLS {
Glauber Costa 47b0758
     /* Whether data is being TLS encrypted yet */
Glauber Costa 47b0758
     int wiremode;
Glauber Costa 47b0758
     gnutls_session_t session;
Glauber Costa 47b0758
+
Glauber Costa 47b0758
+    /* Client's Distinguished Name from the x509 cert */
Glauber Costa 47b0758
+    char *dname;
Glauber Costa 47b0758
 };
Glauber Costa 47b0758
 
Glauber Costa 47b0758
 int vnc_tls_client_setup(VncState *vs, int x509Creds);
35aa518
Index: qemu-kvm-0.10.4/vnc.c
Glauber Costa 47b0758
===================================================================
Glauber Costa 47b0758
--- qemu-kvm-0.10.orig/qemu/vnc.c
35aa518
+++ qemu-kvm-0.10.4/vnc.c
Glauber Costa 47b0758
@@ -156,6 +156,21 @@ static void do_info_vnc_client(VncState 
Glauber Costa 47b0758
     term_puts("Client:\n");
Glauber Costa 47b0758
     term_puts(clientAddr);
Glauber Costa 47b0758
     free(clientAddr);
Glauber Costa 47b0758
+
Glauber Costa 47b0758
+#ifdef CONFIG_VNC_TLS
Glauber Costa 47b0758
+    if (client->tls.session &&
Glauber Costa 47b0758
+	client->tls.dname)
Glauber Costa 47b0758
+	term_printf("  x509 dname: %s\n", client->tls.dname);
Glauber Costa 47b0758
+    else
Glauber Costa 47b0758
+	term_puts("  x509 dname: none\n");
Glauber Costa 47b0758
+#endif
Glauber Costa 47b0758
+#ifdef CONFIG_VNC_SASL
Glauber Costa 47b0758
+    if (client->sasl.conn &&
Glauber Costa 47b0758
+	client->sasl.username)
Glauber Costa 47b0758
+	term_printf("    username: %s\n", client->sasl.username);
Glauber Costa 47b0758
+    else
Glauber Costa 47b0758
+	term_puts("    username: none\n");
Glauber Costa 47b0758
+#endif
Glauber Costa 47b0758
 }
Glauber Costa 47b0758
 
Glauber Costa 47b0758
 void do_info_vnc(void)
Glauber Costa 47b0758
@@ -1823,7 +1838,7 @@ static int protocol_client_auth(VncState
Glauber Costa 47b0758
     /* We only advertise 1 auth scheme at a time, so client
Glauber Costa 47b0758
      * must pick the one we sent. Verify this */
Glauber Costa 47b0758
     if (data[0] != vs->vd->auth) { /* Reject auth */
Glauber Costa 47b0758
-       VNC_DEBUG("Reject auth %d\n", (int)data[0]);
Glauber Costa 47b0758
+       VNC_DEBUG("Reject auth %d because it didn't match advertized\n", (int)data[0]);
Glauber Costa 47b0758
        vnc_write_u32(vs, 1);
Glauber Costa 47b0758
        if (vs->minor >= 8) {
Glauber Costa 47b0758
            static const char err[] = "Authentication failed";
Glauber Costa 47b0758
@@ -1863,7 +1878,7 @@ static int protocol_client_auth(VncState
Glauber Costa 47b0758
 #endif /* CONFIG_VNC_SASL */
Glauber Costa 47b0758
 
Glauber Costa 47b0758
        default: /* Should not be possible, but just in case */
Glauber Costa 47b0758
-           VNC_DEBUG("Reject auth %d\n", vs->vd->auth);
Glauber Costa 47b0758
+           VNC_DEBUG("Reject auth %d server code bug\n", vs->vd->auth);
Glauber Costa 47b0758
            vnc_write_u8(vs, 1);
Glauber Costa 47b0758
            if (vs->minor >= 8) {
Glauber Costa 47b0758
                static const char err[] = "Authentication failed";