x11vnc: add -ssl mode using libssl. Include Xdummy in misc.

1 files changed, 134 insertions, 53 deletions

diff --git a/x11vnc/help.c b/x11vnc/help.c
index 65edf94..81e5f46 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -14,7 +14,7 @@ void nopassword_warning_msg(int gotloc);
 
 
 void print_help(int mode) {
-#if !SMALL_FOOTPRINT
+#if !SKIP_HELP
 	char help[] = 
 "\n"
 "x11vnc: allow VNC connections to real X11 displays. %s\n"
@@ -423,9 +423,9 @@ void print_help(int mode) {
 "                       send one before a 25 second timeout.  Existing clients\n"
 "                       are view-only during this period.\n"
 "\n"
-"                       Since the detailed behavior of su(1) can vary from\n"
-"                       OS to OS and for local configurations, please test\n"
-"                       the mode carefully on your systems before using it.\n"
+"                       Since the detailed behavior of su(1) can vary from OS\n"
+"                       to OS and for local configurations, please test the mode\n"
+"                       carefully on your systems before using it in production.\n"
 "                       E.g. try different combinations of valid/invalid\n"
 "                       usernames and valid/invalid passwords to see if it\n"
 "                       behaves correctly.  x11vnc will be conservative and\n"
@@ -443,53 +443,64 @@ void print_help(int mode) {
 "                       e.g. password aging modules.  These logins will fail\n"
 "                       as well even when the correct password is supplied.\n"
 "\n"
-"                       *IMPORTANT*: to prevent the Unix password being sent in\n"
-"                       *clear text* over the network, two x11vnc options are\n"
-"                       enforced: 1) -localhost and 2) -stunnel.  The former\n"
-"                       requires the viewer connection to appear to come from\n"
-"                       the same machine x11vnc is running on (e.g. from a ssh\n"
-"                       -L port redirection).  The latter requires the -stunnel\n"
-"                       SSL mode be used (see the description below).\n"
+"                       **IMPORTANT**: to prevent the Unix password being sent\n"
+"                       in *clear text* over the network, one of two schemes\n"
+"                       will be enforced: 1) the -ssl builtin SSL mode, or 2)\n"
+"                       require both -localhost and -stunnel be enabled.\n"
 "\n"
-"                       To override these restrictions you can set environment\n"
-"                       variables before starting x11vnc:\n"
+"                       Method 1) ensures the traffic is encrypted between\n"
+"                       viewer and server.  A PEM file will be required, see the\n"
+"                       discussion under -ssl below (under some circumstances\n"
+"                       a temporary one can be automatically generated).\n"
 "\n"
-"                       Set UNIXPW_DISABLE_STUNNEL=1 to disable using -stunnel.\n"
-"                       Evidently you will be using a different method to\n"
-"                       encrypt the data between the vncviewer and x11vnc:\n"
-"                       e.g. ssh(1) or a VPN.  Note that use of -localhost\n"
-"                       with ssh(1) is roughly the same as requiring a Unix\n"
-"                       user login (since a Unix password or the user's public\n"
-"                       key authentication is used by ssh on the machine where\n"
-"                       x11vnc runs and only local connections are accepted)\n"
+"                       Method 2) requires the viewer connection to appear\n"
+"                       to come from the same machine x11vnc is running on\n"
+"                       (e.g. from a ssh -L port redirection).  And that the\n"
+"                       -stunnel SSL mode be used for encryption over the\n"
+"                       network.(see the description of -stunnel below).\n"
 "\n"
 "                       As a convenience, if you ssh(1) in and start x11vnc it\n"
 "                       will check if the environment variable SSH_CONNECTION\n"
 "                       is set and appears reasonable.  If it does, then the\n"
-"                       stunnel requirement is dropped since it is assumed\n"
-"                       you are using ssh for the encrypted tunnelling.\n"
-"                       Use -stunnel to force stunnel usage for this case.\n"
+"                       -ssl or -stunnel requirement will be dropped since it is\n"
+"                       assumed you are using ssh for the encrypted tunnelling.\n"
+"                       -localhost is still enforced.  Use -ssl or -stunnel to\n"
+"                       force SSL usage for this case.\n"
+"\n"
+"                       To override these restrictions you can set environment\n"
+"                       variables before starting x11vnc:\n"
+"\n"
+"                       Set UNIXPW_DISABLE_SSL=1 to disable requiring either\n"
+"                       -ssl or -stunnel.  Evidently you will be using a\n"
+"                       different method to encrypt the data between the\n"
+"                       vncviewer and x11vnc: e.g. ssh(1) or a VPN.  Note that\n"
+"                       use of -localhost with ssh(1) is roughly the same as\n"
+"                       requiring a Unix user login (since a Unix password or\n"
+"                       the user's public key authentication is used by sshd on\n"
+"                       the machine where x11vnc runs and only local connections\n"
+"                       are accepted)\n"
 "\n"
 "                       Set UNIXPW_DISABLE_LOCALHOST=1 to disable the -localhost\n"
-"                       requirement.  One should never do this (i.e. allow the\n"
-"                       Unix passwords to be sniffed on the network).\n"
+"                       requirement in Method 2).  One should never do this\n"
+"                       (i.e. allow the Unix passwords to be sniffed on the\n"
+"                       network).\n"
 "\n"
 "                       Regarding reverse connections (e.g. -R connect:host),\n"
-"                       the -localhost constraint is in effect and the reverse\n"
+"                       if the -localhost constraint is in effect then reverse\n"
 "                       connections can only be used to connect to the same\n"
 "                       machine x11vnc is running on (default port 5500).\n"
 "                       Please use a ssh or stunnel port redirection to the\n"
 "                       viewer machine to tunnel the reverse connection over\n"
-"                       an encrypted channel.  Note that Unix username and\n"
-"                       password *will* be prompted for (unlike VNC passwords\n"
-"                       that are skipped for reverse connections).\n"
+"                       an encrypted channel. Note that in -ssl mode reverse\n"
+"                       connection are disabled.\n"
 "\n"
-"                       NOTE: in -inetd mode the two settings are attempted\n"
-"                       to be enforced for reverse connections.  Be sure to\n"
+"                       XXX -inetd + -ssl\n"
+"                       In -inetd mode the two settings are attempted to be\n"
+"                       enforced for reverse connections.  Be sure to also\n"
 "                       use encryption from the viewer to inetd since x11vnc\n"
-"                       cannot guess easily if it is encrpyted.  Note: you can\n"
+"                       cannot guess easily if it is encrpyted.  Tip: you can\n"
 "                       also have your own stunnel spawn x11vnc in -inetd mode\n"
-"                       (i.e. bypassing inetd).  See the FAQ.\n"
+"                       (i.e. bypassing inetd).  See the FAQ for details.\n"
 "\n"
 "                       The user names in the comma separated [list] can have\n"
 "                       per-user options after a \":\", e.g. \"fred:opts\"\n"
@@ -521,17 +532,84 @@ void print_help(int mode) {
 "                       other environment.  All of the -unixpw options and\n"
 "                       contraints apply.\n"
 "\n"
-"-stunnel [pem]         Use the stunnel(1) (www.stunnel.org) to provide\n"
+"-ssl [pem]             Use the openssl library (www.openssl.org) to provide a\n"
+"                       built-in encrypted SSL tunnel between VNC viewers and\n"
+"                       x11vnc.  This requires libssl support to be compiled\n"
+"                       into x11vnc at build time.  If x11vnc is not built\n"
+"                       with libssl support it will exit immediately when -ssl\n"
+"                       is prescribed.\n"
+"\n"
+"                       [pem] is optional, use \"-ssl /path/to/mycert.pem\" to\n"
+"                       specify a PEM certificate file to use to identify and\n"
+"                       provide a key for this server.\n"
+"\n"
+"                       Connecting VNC viewer SSL tunnels can authenticate\n"
+"                       this server if they have the public key part of the\n"
+"                       certificate (or a common certificate authority, CA,\n"
+"                       verifies this server's cert).  This is used to prevent\n"
+"                       man-in-the-middle attacks.  Otherwise, if the VNC viewer\n"
+"                       accepts this server's key without verification, at\n"
+"                       least the traffic is protected from passive sniffing\n"
+"                       on the network.\n"
+"\n"
+"                       If [pem] is not supplied and the openssl(1) utility\n"
+"                       command exists in PATH, then a temporary, self-signed\n"
+"                       certificate will be generated for this session (this\n"
+"                       may take 5-20 seconds on slow machines).  If openssl(1)\n"
+"                       cannot be used to generate a temporary certificate\n"
+"                       x11vnc exits immediately.\n"
+"\n"
+"                       If successful in using openssl(1) to generate a\n"
+"                       certificate, the public part of it will be displayed\n"
+"                       to stdout (e.g. one could copy it to the client-side\n"
+"                       to provide authentication of the server to VNC viewers.)\n"
+"\n"
+"                       Set the env. var. X11VNC_SHOW_TMP_PEM=1 to have x11vnc\n"
+"                       print out the entire certificate, including the PRIVATE\n"
+"                       KEY part, to stderr.  One could reuse this cert if saved\n"
+"                       in a [pem] file.  Similarly, set X11VNC_KEEP_TMP_PEM=1\n"
+"                       to not delete the temporary PEM file: the file name\n"
+"                       will be printed to stderr (so one could move it to a\n"
+"                       safe place for reuse).\n"
+"\n"
+"                       Reverse connections are disabled in -ssl\n"
+"                       mode because the data cannot be encrypted.\n"
+"                       Set X11VNC_SSL_ALLOW_REVERSE=1 to override this.\n"
+"\n"
+"                       Your VNC viewer will also need to be able to connect\n"
+"                       via SSL.  See the discussion below under -stunnel and\n"
+"                       the FAQ for how this might be achieved.  E.g. on Unix it\n"
+"                       is easy to write a shell script that starts up stunnel\n"
+"                       and then vncviewer.\n"
+"\n"
+"-sslverify [path]      For either of the -ssl or -stunnel modes, use [path]\n"
+"                       to provide certificates to authenticate incoming VNC\n"
+"                       client connections.  This can be used as a method to\n"
+"                       replace standard password authentication.\n"
+"\n"
+"                       If [path] is a directory it contains the client (or CA)\n"
+"                       certificates in separate files.  If [path] is a file, it\n"
+"                       contains multiple certificates.  These correspond to the\n"
+"                       \"CApath = dir\" and \"CAfile = file\" stunnel options.\n"
+"                       See the stunnel(8) manpage for details.\n"
+"\n"
+"                       To create certificates for all sorts of authentications\n"
+"                       (clients, servers, via CA, etc) see the openssl(1)\n"
+"                       command.  Of particular usefulness is the x509\n"
+"                       subcommand of openssl(1).\n"
+"\n"
+"-stunnel [pem]         Use the stunnel(8) (www.stunnel.org) to provide\n"
 "                       an encrypted SSL tunnel between viewers and x11vnc.\n"
 "                       This requires stunnel to be installed on the system and\n"
 "                       available via PATH (n.b. stunnel is often installed in\n"
-"                       sbin directories).  Version 4.x of stunnel is assumed;\n"
-"                       see -stunnel3 below.\n"
+"                       sbin directories).  Version 4.x of stunnel is assumed\n"
+"                       (but see -stunnel3 below.)\n"
 "\n"
 "                       [pem] is optional, use \"-stunnel /path/to/stunnel.pem\"\n"
 "                       to specify a PEM certificate file to pass to stunnel.\n"
 "                       Whether one is needed or not depends on your stunnel\n"
-"                       configuration.\n"
+"                       configuration.  stunnel often generates one at install\n"
+"                       time.\n"
 "\n"
 "                       stunnel is started up as a child process of x11vnc and\n"
 "                       any SSL connections stunnel receives are decrypted and\n"
@@ -543,14 +621,15 @@ void print_help(int mode) {
 "                       avoid people routing around the SSL channel.  Set\n"
 "                       STUNNEL_DISABLE_LOCALHOST=1 to disable the requirement.\n"
 "\n"
-"                       Your VNC viewer will need to be able to connect via SSL.\n"
-"                       Unfortunately not too many do this.  UltraVNC seems to\n"
-"                       have a SSL plugin.  It is not too difficult to set up\n"
-"                       an stunnel or other SSL tunnel on the viewer side.\n"
+"                       Your VNC viewer will also need to be able to connect\n"
+"                       via SSL.  Unfortunately not too many do this.  UltraVNC\n"
+"                       seems to have an encryption plugin.  It is not too\n"
+"                       difficult to set up an stunnel or other SSL tunnel on\n"
+"                       the viewer side.\n"
 "\n"
 "                       A simple example on Unix using stunnel 3.x is:\n"
 "\n"
-"                         %% stunnel -c -d localhost:5901 -r remote:5900\n"
+"                         %% stunnel -c -d localhost:5901 -r remotehost:5900\n"
 "                         %% vncviewer localhost:1\n"
 "\n"
 "                       For Windows, stunnel has been ported to it and there\n"
@@ -2175,22 +2254,24 @@ void print_help(int mode) {
 "                       debug_xdamage debug_wireframe nodebug_wireframe\n"
 "                       debug_wireframe debug_scroll nodebug_scroll debug_scroll\n"
 "                       debug_tiles dbt nodebug_tiles nodbt debug_tiles\n"
-"                       debug_grabs nodebug_grabs dbg nodbg noremote\n"
+"                       debug_grabs nodebug_grabs debug_sel nodebug_sel dbg\n"
+"                       nodbg noremote\n"
 "\n"
 "                       aro=  noop display vncdisplay desktopname guess_desktop\n"
 "                       http_url auth xauth users rootshift clipshift\n"
 "                       scale_str scaled_x scaled_y scale_numer scale_denom\n"
 "                       scale_fac scaling_blend scaling_nomult4 scaling_pad\n"
 "                       scaling_interpolate inetd privremote unsafe safer\n"
-"                       nocmds passwdfile unixpw unixpw_nis unixpw_list stunnel\n"
-"                       stunnel_pem using_shm logfile o flag rc norc h help\n"
-"                       V version lastmod bg sigpipe threads readrate netrate\n"
-"                       netlatency pipeinput clients client_count pid ext_xtest\n"
-"                       ext_xtrap ext_xrecord ext_xkb ext_xshm ext_xinerama\n"
-"                       ext_overlay ext_xfixes ext_xdamage ext_xrandr rootwin\n"
-"                       num_buttons button_mask mouse_x mouse_y bpp depth\n"
-"                       indexed_color dpy_x dpy_y wdpy_x wdpy_y off_x off_y\n"
-"                       cdpy_x cdpy_y coff_x coff_y rfbauth passwd viewpasswd\n"
+"                       nocmds passwdfile unixpw unixpw_nis unixpw_list ssl\n"
+"                       ssl_pem sslverify stunnel stunnel_pem usepw using_shm\n"
+"                       logfile o flag rc norc h help V version lastmod bg\n"
+"                       sigpipe threads readrate netrate netlatency pipeinput\n"
+"                       clients client_count pid ext_xtest ext_xtrap ext_xrecord\n"
+"                       ext_xkb ext_xshm ext_xinerama ext_overlay ext_xfixes\n"
+"                       ext_xdamage ext_xrandr rootwin num_buttons button_mask\n"
+"                       mouse_x mouse_y bpp depth indexed_color dpy_x dpy_y\n"
+"                       wdpy_x wdpy_y off_x off_y cdpy_x cdpy_y coff_x coff_y\n"
+"                       rfbauth passwd viewpasswd\n"
 "\n"
 "-QD variable           Just like -query variable, but returns the default\n"
 "                       value for that parameter (no running x11vnc server\n"