x11vnc: make -allow work in -ssl mode.

7 files changed, 124 insertions, 48 deletions

diff --git a/x11vnc/ChangeLog b/x11vnc/ChangeLog
index ca77aea..9dfcbc3 100644
--- a/x11vnc/ChangeLog
+++ b/x11vnc/ChangeLog
@@ -1,3 +1,6 @@
+2008-09-17  Karl Runge <runge@karlrunge.com>
+	* x11vnc: make -allow work in -ssl mode.
+
 2008-09-14  Karl Runge <runge@karlrunge.com>
 	* x11vnc: -sleepin m-n for random sleep. More mktemp and mkstemp
 	  protections. SSL_INIT_TIMEOUT=n env. var.  Fix macosx console
diff --git a/x11vnc/README b/x11vnc/README
index dbbf5d0..83ef17b 100644
--- a/x11vnc/README
+++ b/x11vnc/README
@@ -1,5 +1,5 @@
 
-x11vnc README file                         Date: Sun Sep 14 15:20:38 EDT 2008
+x11vnc README file                         Date: Tue Sep 16 10:02:40 EDT 2008
 
 The following information is taken from these URLs:
 
@@ -11808,7 +11808,7 @@ x11vnc: a VNC server for real X displays
    Here are all of x11vnc command line options:
 % x11vnc -opts      (see below for -help long descriptions)
 
-x11vnc: allow VNC connections to real X11 displays. 0.9.4 lastmod: 2008-09-14
+x11vnc: allow VNC connections to real X11 displays. 0.9.4 lastmod: 2008-09-16
 
 x11vnc options:
   -display disp            -auth file               -N                     
@@ -11928,7 +11928,7 @@ libvncserver-tight-extension options:
 
 % x11vnc -help
 
-x11vnc: allow VNC connections to real X11 displays. 0.9.4 lastmod: 2008-09-14
+x11vnc: allow VNC connections to real X11 displays. 0.9.4 lastmod: 2008-09-16
 
 (type "x11vnc -opts" to just list the options.)
 
@@ -12475,10 +12475,13 @@ e
                        Can also be a numerical IP prefix, e.g. "192.168.100."
                        to match a simple subnet, for more control build
                        libvncserver with libwrap support (See the FAQ).  If the
-                       list contains a "/" it instead is a interpreted as a
-                       file containing addresses or prefixes that is re-read
-                       each time a new client connects.  Lines can be commented
-                       out with the "#" character in the usual way.
+                       list contains a "/" it instead is a interpreted
+                       as a file containing addresses or prefixes that is
+                       re-read each time a new client connects.  Lines can be
+                       commented out with the "#" character in the usual way.
+
+                       -allow applies in -ssl mode, but not in -stunnel mode.
+
 -localhost             Basically the same as "-allow 127.0.0.1".
 
                        Note: if you want to restrict which network interface
@@ -13601,7 +13604,7 @@ e
 
                        For Windows, stunnel has been ported to it and there
                        are probably other such tools available.  See the FAQ
-                       for more examples.
+                       and SSVNC for more examples.
 
 -stunnel3  [pem]       Use version 3.x stunnel command line syntax instead of
                        version 4.x
@@ -15769,7 +15772,9 @@ n
                        proxy:host:port set reverse connection proxy (empty to
                                        disable).
                        allowonce:host  For the next connection only, allow
-                                       connection from "host".
+                                       connection from "host". In -ssl mode
+                                       two connections are allowed (i.e. Fetch
+                                       Cert) unless X11VNC_NO_SSL_ALLOW_TWICE=1
                        allow:hostlist  set -allow list to (comma separated)
                                        "hostlist". See -allow and -localhost.
                                        Do not use with -allow /path/to/file
@@ -16100,14 +16105,14 @@ n
                        nowfl wirecopyrect wcr nowirecopyrect nowcr scr_area
                        scr_skip scr_inc scr_keys scr_term scr_keyrepeat
                        scr_parms scrollcopyrect scr noscrollcopyrect noscr
-                       fixscreen noxrecord xrecord reset_record pointer_mode
-                       pm input_skip allinput noallinput input grabkbd
-                       nograbkbd grabptr nograbptr grabalways nograbalways
+                       fixscreen noxrecord xrecord reset_record pointer_mode pm
+                       input_skip allinput noallinput input grabkbd nograbkbd
+                       grabptr nograbptr grabalways nograbalways grablocal
                        client_input ssltimeout speeds wmdt debug_pointer dp
                        nodebug_pointer nodp debug_keyboard dk nodebug_keyboard
-                       nodk deferupdate defer wait_ui wait_bog nowait_bog
-                       slow_fb xrefresh wait readtimeout nap nonap sb
-                       screen_blank fbpm nofbpm dpms nodpms clientdpms
+                       nodk keycode deferupdate defer wait_ui wait_bog
+                       nowait_bog slow_fb xrefresh wait readtimeout nap nonap
+                       sb screen_blank fbpm nofbpm dpms nodpms clientdpms
                        noclientdpms forcedpms noforcedpms noserverdpms
                        serverdpms noultraext ultraext fs gaps grow fuzz snapfb
                        nosnapfb rawfb uinput_accel uinput_thresh uinput_reset
@@ -16123,7 +16128,7 @@ n
                        nodbg macnosaver macsaver nomacnosaver macnowait macwait
                        nomacnowait macwheel macnoswap macswap nomacnoswap
                        macnoresize macresize nomacnoresize maciconanim macmenu
-                       macnomenu nomacmenu noremote
+                       macnomenu nomacmenu macuskbd nomacuskbd noremote
 
                        aro=  noop display vncdisplay desktopname guess_desktop
                        http_url auth xauth users rootshift clipshift
@@ -16141,7 +16146,6 @@ n
                        dpy_x dpy_y wdpy_x wdpy_y off_x off_y cdpy_x cdpy_y
                        coff_x coff_y rfbauth passwd viewpasswd
 
-
 -QD variable           Just like -query variable, but returns the default
                        value for that parameter (no running x11vnc server
                        is consulted)
diff --git a/x11vnc/connections.c b/x11vnc/connections.c
index aa656df..1f06f3a 100644
--- a/x11vnc/connections.c
+++ b/x11vnc/connections.c
@@ -55,10 +55,10 @@ void check_new_clients(void);
 int accept_client(rfbClientPtr client);
 int run_user_command(char *cmd, rfbClientPtr client, char *mode, char *input,
     int len, FILE *output);
+int check_access(char *addr);
 
 static rfbClientPtr *client_match(char *str);
 static void free_client_data(rfbClientPtr client);
-static int check_access(char *addr);
 static void ugly_geom(char *p, int *x, int *y);
 static int ugly_window(char *addr, char *userhost, int X, int Y,
     int timeout, char *mode, int accept);
@@ -800,10 +800,14 @@ void client_gone(rfbClientPtr client) {
  * Simple routine to limit access via string compare.  A power user will
  * want to compile libvncserver with libwrap support and use /etc/hosts.allow.
  */
-static int check_access(char *addr) {
+int check_access(char *addr) {
 	int allowed = 0;
+	int ssl = 0;
 	char *p, *list;
 
+	if (use_openssl || use_stunnel) {
+		ssl = 1;
+	}
 	if (deny_all) {
 		rfbLog("check_access: new connections are currently "
 		    "blocked.\n");
@@ -842,6 +846,10 @@ static int check_access(char *addr) {
 			len2 = strlen(allow_once) + 2;
 			len += len2;
 		}
+		if (ssl) {
+			len2 = strlen("127.0.0.1") + 2;
+			len += len2;
+		}
 		list = (char *) malloc(len);
 		list[0] = '\0';
 		
@@ -869,11 +877,19 @@ static int check_access(char *addr) {
 			strcat(list, allow_once);
 			strcat(list, "\n");
 		}
+		if (ssl) {
+			strcat(list, "\n");
+			strcat(list, "127.0.0.1");
+			strcat(list, "\n");
+		}
 	} else {
 		int len = strlen(allow_list) + 1;
 		if (allow_once) {
 			len += strlen(allow_once) + 1;
 		}
+		if (ssl) {
+			len += strlen("127.0.0.1") + 1;
+		}
 		list = (char *) malloc(len);
 		list[0] = '\0';
 		strcat(list, allow_list);
@@ -881,6 +897,10 @@ static int check_access(char *addr) {
 			strcat(list, ",");
 			strcat(list, allow_once);
 		}
+		if (ssl) {
+			strcat(list, ",");
+			strcat(list, "127.0.0.1");
+		}
 	}
 
 	if (allow_once) {
diff --git a/x11vnc/help.c b/x11vnc/help.c
index 0e185c4..06ce6a3 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -566,10 +566,13 @@ void print_help(int mode) {
 "                       Can also be a numerical IP prefix, e.g. \"192.168.100.\"\n"
 "                       to match a simple subnet, for more control build\n"
 "                       libvncserver with libwrap support (See the FAQ).  If the\n"
-"                       list contains a \"/\" it instead is a interpreted as a\n"
-"                       file containing addresses or prefixes that is re-read\n"
-"                       each time a new client connects.  Lines can be commented\n"
-"                       out with the \"#\" character in the usual way.\n"
+"                       list contains a \"/\" it instead is a interpreted\n"
+"                       as a file containing addresses or prefixes that is\n"
+"                       re-read each time a new client connects.  Lines can be\n"
+"                       commented out with the \"#\" character in the usual way.\n"
+"\n"
+"                       -allow applies in -ssl mode, but not in -stunnel mode.\n"
+"\n"
 "-localhost             Basically the same as \"-allow 127.0.0.1\".\n"
 "\n"
 "                       Note: if you want to restrict which network interface\n"
@@ -1707,7 +1710,7 @@ void print_help(int mode) {
 "\n"
 "                       For Windows, stunnel has been ported to it and there\n"
 "                       are probably other such tools available.  See the FAQ\n"
-"                       for more examples.\n"
+"                       and SSVNC for more examples.\n"
 "\n"
 "-stunnel3  [pem]       Use version 3.x stunnel command line syntax instead of\n"
 "                       version 4.x\n"
@@ -3879,7 +3882,9 @@ void print_help(int mode) {
 "                                       disable).\n"
 /* access */
 "                       allowonce:host  For the next connection only, allow\n"
-"                                       connection from \"host\".\n"
+"                                       connection from \"host\". In -ssl mode\n"
+"                                       two connections are allowed (i.e. Fetch\n"
+"                                       Cert) unless X11VNC_NO_SSL_ALLOW_TWICE=1\n"
 /* access */
 "                       allow:hostlist  set -allow list to (comma separated)\n"
 "                                       \"hostlist\". See -allow and -localhost.\n"
@@ -4212,14 +4217,14 @@ void print_help(int mode) {
 "                       nowfl wirecopyrect wcr nowirecopyrect nowcr scr_area\n"
 "                       scr_skip scr_inc scr_keys scr_term scr_keyrepeat\n"
 "                       scr_parms scrollcopyrect scr noscrollcopyrect noscr\n"
-"                       fixscreen noxrecord xrecord reset_record pointer_mode\n"
-"                       pm input_skip allinput noallinput input grabkbd\n"
-"                       nograbkbd grabptr nograbptr grabalways nograbalways\n"
+"                       fixscreen noxrecord xrecord reset_record pointer_mode pm\n"
+"                       input_skip allinput noallinput input grabkbd nograbkbd\n"
+"                       grabptr nograbptr grabalways nograbalways grablocal\n"
 "                       client_input ssltimeout speeds wmdt debug_pointer dp\n"
 "                       nodebug_pointer nodp debug_keyboard dk nodebug_keyboard\n"
-"                       nodk deferupdate defer wait_ui wait_bog nowait_bog\n"
-"                       slow_fb xrefresh wait readtimeout nap nonap sb\n"
-"                       screen_blank fbpm nofbpm dpms nodpms clientdpms\n"
+"                       nodk keycode deferupdate defer wait_ui wait_bog\n"
+"                       nowait_bog slow_fb xrefresh wait readtimeout nap nonap\n"
+"                       sb screen_blank fbpm nofbpm dpms nodpms clientdpms\n"
 "                       noclientdpms forcedpms noforcedpms noserverdpms\n"
 "                       serverdpms noultraext ultraext fs gaps grow fuzz snapfb\n"
 "                       nosnapfb rawfb uinput_accel uinput_thresh uinput_reset\n"
@@ -4235,7 +4240,7 @@ void print_help(int mode) {
 "                       nodbg macnosaver macsaver nomacnosaver macnowait macwait\n"
 "                       nomacnowait macwheel macnoswap macswap nomacnoswap\n"
 "                       macnoresize macresize nomacnoresize maciconanim macmenu\n"
-"                       macnomenu nomacmenu noremote\n"
+"                       macnomenu nomacmenu macuskbd nomacuskbd noremote\n"
 "\n"
 "                       aro=  noop display vncdisplay desktopname guess_desktop\n"
 "                       http_url auth xauth users rootshift clipshift\n"
@@ -4253,7 +4258,6 @@ void print_help(int mode) {
 "                       dpy_x dpy_y wdpy_x wdpy_y off_x off_y cdpy_x cdpy_y\n"
 "                       coff_x coff_y rfbauth passwd viewpasswd\n"
 "\n"
-"\n"
 "-QD variable           Just like -query variable, but returns the default\n"
 "                       value for that parameter (no running x11vnc server\n"
 "                       is consulted)\n"
diff --git a/x11vnc/sslhelper.c b/x11vnc/sslhelper.c
index 2b07535..d7fb06b 100644
--- a/x11vnc/sslhelper.c
+++ b/x11vnc/sslhelper.c
@@ -1227,6 +1227,9 @@ static void csock_timeout (int sig) {
 	}
 }
 
+#define PROXY_HACK 0
+#if PROXY_HACK
+
 static int wait_conn(int sock) {
 	int conn;
 	struct sockaddr_in addr;
@@ -1247,6 +1250,8 @@ static int wait_conn(int sock) {
 	return conn;
 }
 
+/* no longer used */
+
 int proxy_hack(int vncsock, int listen, int s_in, int s_out, char *cookie,
     int mode) {
 	int sock1, db = 0;
@@ -1321,6 +1326,31 @@ if (db) fprintf(stderr, "buf: '%s'\n", buf);
 
 	return 1;
 }
+#endif	/* PROXY_HACK */
+
+static int check_ssl_access(char *addr) {
+	static char *save_allow_once = NULL;
+	static time_t time_allow_once = 0;
+
+	/* due to "Fetch Cert" activities for SSL really need to "allow twice" */
+	if (allow_once != NULL) {
+		save_allow_once = strdup(allow_once);
+		time_allow_once = time(NULL);
+	} else if (save_allow_once != NULL) {
+		if (getenv("X11VNC_NO_SSL_ALLOW_TWICE")) {
+			;
+		} else if (time(NULL) < time_allow_once + 30) {
+			/* give them 30 secs to check and save the fetched cert. */
+			allow_once = save_allow_once; 
+			rfbLog("SSL: Permitting 30 sec grace period for allowonce.\n");
+			rfbLog("SSL: Set X11VNC_NO_SSL_ALLOW_TWICE=1 to disable.\n");
+		}
+		save_allow_once = NULL;
+		time_allow_once = 0;
+	}
+
+	return check_access(addr);
+}
 
 void accept_openssl(int mode, int presock) {
 	int sock = -1, listen = -1, cport, csock, vsock;	
@@ -1407,6 +1437,17 @@ void accept_openssl(int mode, int presock) {
 		openssl_last_ip = get_remote_host(sock);
 	}
 
+	if (!check_ssl_access(openssl_last_ip)) {
+		rfbLog("SSL: accept_openssl: denying client %s\n", openssl_last_ip);
+		rfbLog("SSL: accept_openssl: does not match -allow (or other reason).\n");
+		close(sock);
+		sock = -1;
+		if (ssl_no_fail) {
+			clean_up_exit(1);
+		}
+		return;
+	}
+
 	/* now make a listening socket for child to connect back to us by: */
 
 	cport = find_free_port(20000, 0);
diff --git a/x11vnc/x11vnc.1 b/x11vnc/x11vnc.1
index c3ba2bb..5317c1a 100644
--- a/x11vnc/x11vnc.1
+++ b/x11vnc/x11vnc.1
@@ -2,7 +2,7 @@
 .TH X11VNC "1" "September 2008" "x11vnc " "User Commands"
 .SH NAME
 x11vnc - allow VNC connections to real X11 displays
-         version: 0.9.4, lastmod: 2008-09-14
+         version: 0.9.4, lastmod: 2008-09-16
 .SH SYNOPSIS
 .B x11vnc
 [OPTION]...
@@ -657,10 +657,12 @@ the comma separated list of hostnames or IP addresses.
 Can also be a numerical IP prefix, e.g. "192.168.100."
 to match a simple subnet, for more control build
 libvncserver with libwrap support (See the FAQ).  If the
-list contains a "/" it instead is a interpreted as a
-file containing addresses or prefixes that is re-read
-each time a new client connects.  Lines can be commented
-out with the "#" character in the usual way.
+list contains a "/" it instead is a interpreted
+as a file containing addresses or prefixes that is
+re-read each time a new client connects.  Lines can be
+commented out with the "#" character in the usual way.
+.IP
+\fB-allow\fR applies in \fB-ssl\fR mode, but not in \fB-stunnel\fR mode.
 .PP
 \fB-localhost\fR
 .IP
@@ -1923,7 +1925,7 @@ on Unix using stunnel 3.x is:
 .IP
 For Windows, stunnel has been ported to it and there
 are probably other such tools available.  See the FAQ
-for more examples.
+and SSVNC for more examples.
 .PP
 \fB-stunnel3\fR \fI[pem]\fR
 .IP
@@ -4553,7 +4555,9 @@ proxy:host:port set reverse connection proxy (empty to
 disable).
 .IP
 allowonce:host  For the next connection only, allow
-connection from "host".
+connection from "host". In \fB-ssl\fR mode
+two connections are allowed (i.e. Fetch
+Cert) unless X11VNC_NO_SSL_ALLOW_TWICE=1
 .IP
 allow:hostlist  set \fB-allow\fR list to (comma separated)
 "hostlist". See \fB-allow\fR and \fB-localhost.\fR
@@ -5129,14 +5133,14 @@ nowireframe nowf wireframelocal wfl nowireframelocal
 nowfl wirecopyrect wcr nowirecopyrect nowcr scr_area
 scr_skip scr_inc scr_keys scr_term scr_keyrepeat
 scr_parms scrollcopyrect scr noscrollcopyrect noscr
-fixscreen noxrecord xrecord reset_record pointer_mode
-pm input_skip allinput noallinput input grabkbd
-nograbkbd grabptr nograbptr grabalways nograbalways
+fixscreen noxrecord xrecord reset_record pointer_mode pm
+input_skip allinput noallinput input grabkbd nograbkbd
+grabptr nograbptr grabalways nograbalways grablocal
 client_input ssltimeout speeds wmdt debug_pointer dp
 nodebug_pointer nodp debug_keyboard dk nodebug_keyboard
-nodk deferupdate defer wait_ui wait_bog nowait_bog
-slow_fb xrefresh wait readtimeout nap nonap sb
-screen_blank fbpm nofbpm dpms nodpms clientdpms
+nodk keycode deferupdate defer wait_ui wait_bog
+nowait_bog slow_fb xrefresh wait readtimeout nap nonap
+sb screen_blank fbpm nofbpm dpms nodpms clientdpms
 noclientdpms forcedpms noforcedpms noserverdpms
 serverdpms noultraext ultraext fs gaps grow fuzz snapfb
 nosnapfb rawfb uinput_accel uinput_thresh uinput_reset
@@ -5152,7 +5156,7 @@ debug_grabs nodebug_grabs debug_sel nodebug_sel dbg
 nodbg macnosaver macsaver nomacnosaver macnowait macwait
 nomacnowait macwheel macnoswap macswap nomacnoswap
 macnoresize macresize nomacnoresize maciconanim macmenu
-macnomenu nomacmenu noremote
+macnomenu nomacmenu macuskbd nomacuskbd noremote
 .IP
 aro=  noop display vncdisplay desktopname guess_desktop
 http_url auth xauth users rootshift clipshift
diff --git a/x11vnc/x11vnc_defs.c b/x11vnc/x11vnc_defs.c
index 4674c2e..d7448d4 100644
--- a/x11vnc/x11vnc_defs.c
+++ b/x11vnc/x11vnc_defs.c
@@ -15,7 +15,7 @@ int xtrap_base_event_type = 0;
 int xdamage_base_event_type = 0;
 
 /*               date +'lastmod: %Y-%m-%d' */
-char lastmod[] = "0.9.4 lastmod: 2008-09-14";
+char lastmod[] = "0.9.4 lastmod: 2008-09-16";
 
 /* X display info */