Merge lp:~cyphermox/ubuntu/maverick/gtk-vnc/lp634571 into lp:ubuntu/maverick/gtk-vnc

[Mathieu Trudel-Lapierre]

[Martin Pitt (pitti)]

Thanks! I'll merge this.

Mathieu, please use the correct changelog syntax for closing bugs (LP: #xxxxx), I'll fix that in the merge.

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2010-09-13 10:28:02 +0000
+++ debian/changelog	2010-10-04 04:31:43 +0000
@@ -1,3 +1,11 @@
+gtk-vnc (0.4.1-3ubuntu2) UNRELEASED; urgency=low
+
+  * Cherry-pick git commit 6800dd5 to fix authentication issues (LP: 634571)
+    - update debian/patches/series
+    - add debian/patches/lp634571_auth_subtype_logic_fix.patch
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Mon, 04 Oct 2010 00:09:33 -0400
+
 gtk-vnc (0.4.1-3ubuntu1) maverick; urgency=low
 
   * Merge with Debian unstable, remaining Ubuntu changes:

=== added file 'debian/patches/lp634571_auth_subtype_logic_fix.patch'
--- debian/patches/lp634571_auth_subtype_logic_fix.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/lp634571_auth_subtype_logic_fix.patch	2010-10-04 04:31:43 +0000
@@ -0,0 +1,193 @@
+From 6800dd5d7f665a3587f5f6eb4b44efee361d142c Mon Sep 17 00:00:00 2001
+From: Daniel P. Berrange <[e-mail]>
+Date: Fri, 17 Sep 2010 10:41:29 +0000
+Subject: Fix auth subtype choosing logic in vncdisplay
+
+The method for choosing auth subtypes was rather flawed. Rewrite
+it to work correctly. Introduce an explicit list of vencrypt
+subtypes, since these are distinct from main subtypes. Improve
+debug logging in auth choice code.
+
+* src/vncdisplay.c: Fix auth type choice
+* src/vncconnection.c: Improve auth debugging & invoke correct
+  signal for auth subtype choice
+---
+Index: gtk-vnc-0.4.1/src/vncconnection.c
+===================================================================
+--- gtk-vnc-0.4.1.orig/src/vncconnection.c	2010-10-04 00:11:36.487734999 -0400
++++ gtk-vnc-0.4.1/src/vncconnection.c	2010-10-04 00:11:36.517734999 -0400
+@@ -3675,7 +3675,7 @@
+ 
+ 	if (priv->has_error)
+ 		return FALSE;
+-	vnc_connection_choose_auth(conn, VNC_AUTH_CHOOSE_TYPE, nauth, auth);
++	vnc_connection_choose_auth(conn, VNC_AUTH_CHOOSE_SUBTYPE, nauth, auth);
+ 	if (priv->has_error)
+ 		return FALSE;
+ 
+@@ -4669,6 +4669,7 @@
+ 		}
+ 		g_free(tmp);
+ 	}
++	VNC_DEBUG("Failed to find certificate %s/%s", basedir, basefile);
+ 	return -1;
+ }
+ 
+@@ -4690,6 +4691,8 @@
+ #else
+ 	char *dirs[] = { sysdir };
+ #endif
++	for (int i = 0 ; i < sizeof(dirs)/sizeof(dirs[0]) ; i++)
++		VNC_DEBUG("Searching for certs in %s", dirs[i]);
+ 
+ 	if (vnc_connection_best_path(&priv->cred_x509_cacert, "CA", "cacert.pem",
+ 				     dirs, sizeof(dirs)/sizeof(dirs[0])) < 0)
+Index: gtk-vnc-0.4.1/src/vncdisplay.c
+===================================================================
+--- gtk-vnc-0.4.1.orig/src/vncdisplay.c	2010-10-04 00:11:25.857735000 -0400
++++ gtk-vnc-0.4.1/src/vncdisplay.c	2010-10-04 00:11:36.517734999 -0400
+@@ -84,6 +84,7 @@
+ 	gboolean force_size;
+ 
+ 	GSList *preferable_auths;
++	GSList *preferable_vencrypt_subauths;
+ 	const guint8 const *keycode_map;
+ 
+ 	VncGrabSequence *vncgrabseq; /* the configured key sequence */
+@@ -1113,7 +1114,7 @@
+ 	g_signal_emit(G_OBJECT(obj), signals[VNC_AUTH_CREDENTIAL], 0, creds);
+ }
+ 
+-static void on_auth_choose_type(VncConnection *conn G_GNUC_UNUSED,
++static void on_auth_choose_type(VncConnection *conn,
+ 				GValueArray *types,
+ 				gpointer opaque)
+ {
+@@ -1122,8 +1123,11 @@
+ 	GSList *l;
+ 	guint i;
+ 
+-	if (!types->n_values)
++	if (!types->n_values) {
++		VNC_DEBUG("No auth types available to choose from");
++		vnc_connection_shutdown(conn);
+ 		return;
++	}
+ 
+ 	for (l = priv->preferable_auths; l; l=l->next) {
+ 		int pref = GPOINTER_TO_UINT (l->data);
+@@ -1131,17 +1135,18 @@
+ 		for (i=0; i< types->n_values; i++) {
+ 			GValue *type = g_value_array_get_nth(types, i);
+ 			if (pref == g_value_get_enum(type)) {
+-				vnc_connection_set_auth_type(priv->conn, pref);
++				vnc_connection_set_auth_type(conn, pref);
+ 				return;
+ 			}
+ 		}
+ 	}
+ 
+-	GValue *type = g_value_array_get_nth(types, 0);
+-	vnc_connection_set_auth_type(priv->conn, g_value_get_enum(type));
++	/* No sub-auth matching our supported auth so have to give up */
++	VNC_DEBUG("No preferred auth type found");
++	vnc_connection_shutdown(conn);
+ }
+ 
+-static void on_auth_choose_subtype(VncConnection *conn G_GNUC_UNUSED,
++static void on_auth_choose_subtype(VncConnection *conn,
+ 				   unsigned int type,
+ 				   GValueArray *subtypes,
+ 				   gpointer opaque)
+@@ -1151,25 +1156,41 @@
+ 	GSList *l;
+ 	guint i;
+ 
+-	if (!subtypes->n_values)
++	if (!subtypes->n_values) {
++		VNC_DEBUG("No subtypes available to choose from");
++		vnc_connection_shutdown(conn);
+ 		return;
++	}
+ 
+ 	if (type == VNC_CONNECTION_AUTH_TLS) {
+-		for (l = priv->preferable_auths; l; l=l->next) {
+-			int pref = GPOINTER_TO_UINT (l->data);
++		l = priv->preferable_auths;
++	} else if (type == VNC_CONNECTION_AUTH_VENCRYPT) {
++		l = priv->preferable_vencrypt_subauths;
++	} else {
++		VNC_DEBUG("Unexpected stackable auth type %d", type);
++		vnc_connection_shutdown(conn);
++		return;
++	}
+ 
+-			for (i=0; i< subtypes->n_values; i++) {
+-				GValue *subtype = g_value_array_get_nth(subtypes, i);
+-				if (pref == g_value_get_enum(subtype)) {
+-					vnc_connection_set_auth_type(priv->conn, pref);
+-					return;
+-				}
++	for (; l; l=l->next) {
++		int pref = GPOINTER_TO_UINT (l->data);
++
++		/* Don't want to recursively do the same major auth */
++		if (pref == type)
++			continue;
++
++		for (i=0; i< subtypes->n_values; i++) {
++			GValue *subtype = g_value_array_get_nth(subtypes, i);
++			if (pref == g_value_get_enum(subtype)) {
++				vnc_connection_set_auth_subtype(conn, pref);
++				return;
+ 			}
+ 		}
+ 	}
+ 
+-	GValue *subtype = g_value_array_get_nth(subtypes, 0);
+-	vnc_connection_set_auth_subtype(priv->conn, g_value_get_enum(subtype));
++	/* No sub-auth matching our supported auth so have to give up */
++	VNC_DEBUG("No preferred auth subtype found");
++	vnc_connection_shutdown(conn);
+ }
+ 
+ static void on_auth_failure(VncConnection *conn G_GNUC_UNUSED,
+@@ -1523,6 +1544,7 @@
+ 	}
+ 
+ 	g_slist_free (priv->preferable_auths);
++	g_slist_free (priv->preferable_vencrypt_subauths);
+ 
+ 	vnc_display_keyval_free_entries();
+ 
+@@ -1906,6 +1928,30 @@
+ 	 */
+ 	priv->preferable_auths = g_slist_append (priv->preferable_auths, GUINT_TO_POINTER (VNC_CONNECTION_AUTH_NONE));
+ 
++
++	/* Prefered order for VeNCrypt subtypes */
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_X509SASL));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_X509PLAIN));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_X509VNC));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_X509NONE));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_TLSSASL));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_TLSPLAIN));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_TLSVNC));
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_TLSNONE));
++	/*
++	 * Refuse fully cleartext passwords
++	priv->preferable_vencrypt_subauths = g_slist_append(priv->preferable_vencrypt_subauths,
++							    GUINT_TO_POINTER(VNC_CONNECTION_AUTH_VENCRYPT_PLAIN));
++	*/
++
+ 	priv->conn = vnc_connection_new();
+ 
+ 	g_signal_connect(G_OBJECT(priv->conn), "vnc-cursor-changed",

=== modified file 'debian/patches/series'
--- debian/patches/series	2010-09-13 10:28:02 +0000
+++ debian/patches/series	2010-10-04 04:31:43 +0000
@@ -2,3 +2,4 @@
 0002-Reset-xmit_buffer-fields-to-fix-reconnect.patch
 0002-use-stdint.patch
 0003-fix-build-with-xulrunner-1.9.2.patch
+lp634571_auth_subtype_logic_fix.patch