libxrdp, common: work on TLS mode

5 files changed, 528 insertions, 5 deletions

diff --git a/common/Makefile.am b/common/Makefile.am
index ab9c2bd5..9feac9fb 100644
--- a/common/Makefile.am
+++ b/common/Makefile.am
@@ -17,7 +17,7 @@ EXTRA_DIST = \
   trans.h \
   xrdp_client_info.h \
   xrdp_constants.h \
-  xrdp_rail.h
+  xrdp_rail.h 
 
 AM_CFLAGS = \
   -DXRDP_CFG_PATH=\"${sysconfdir}/xrdp\" \
@@ -39,7 +39,8 @@ libcommon_la_SOURCES = \
   os_calls.c \
   ssl_calls.c \
   thread_calls.c \
-  trans.c
+  trans.c \
+  xrdp_tls.c
 
 libcommon_la_LIBADD = \
   -lcrypto \
diff --git a/common/trans.c b/common/trans.c
index 421d5679..d58bdd91 100644
--- a/common/trans.c
+++ b/common/trans.c
@@ -38,8 +38,10 @@ trans_create(int mode, int in_size, int out_size)
         make_stream(self->out_s);
         init_stream(self->out_s, out_size);
         self->mode = mode;
-        self->do_tls = 0; /* default simple tcp layer */
         self->tls = 0;
+        /* assign tcp functions */
+        self->trans_read_call = trans_tcp_force_read_s;
+        self->trans_write_call = trans_tcp_force_write_s;
     }
 
     return self;
@@ -70,6 +72,11 @@ trans_delete(struct trans *self)
         g_free(self->listen_filename);
     }
 
+    if (self->tls != 0)
+    {
+    	xrdp_tls_delete(self->tls);
+    }
+
     g_free(self);
 }
 
@@ -301,11 +308,16 @@ trans_check_wait_objs(struct trans *self)
 
     return rv;
 }
-
 /*****************************************************************************/
 int APP_CC
 trans_force_read_s(struct trans *self, struct stream *in_s, int size)
 {
+	return self->trans_read_call(self, in_s, size);
+}
+/*****************************************************************************/
+int APP_CC
+trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size)
+{
     int rcvd;
 
     if (self->status != TRANS_STATUS_UP)
@@ -368,6 +380,10 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size)
 int APP_CC
 trans_force_read(struct trans *self, int size)
 {
+	if (self->tls != 0)
+	{
+		return xrdp_tls_force_read_s(self, self->in_s, size);
+	}
     return trans_force_read_s(self, self->in_s, size);
 }
 
@@ -375,6 +391,12 @@ trans_force_read(struct trans *self, int size)
 int APP_CC
 trans_force_write_s(struct trans *self, struct stream *out_s)
 {
+	return self->trans_write_call(self, out_s);
+}
+/*****************************************************************************/
+int APP_CC
+trans_tcp_force_write_s(struct trans *self, struct stream *out_s)
+{
     int size;
     int total;
     int sent;
@@ -632,3 +654,42 @@ trans_get_out_s(struct trans *self, int size)
 
     return rv;
 }
+/*****************************************************************************/
+/* returns error */
+int APP_CC
+trans_set_tls_mode(struct trans *self, const char *key, const char *cert)
+{
+	self->tls = xrdp_tls_create(self, key, cert);
+	if (self->tls == NULL)
+	{
+		g_writeln("trans_set_tls_mode: xrdp_tls_create malloc error");
+		return 1;
+	}
+
+	if (xrdp_tls_accept(self->tls) != 0)
+	{
+		g_writeln("trans_set_tls_mode: xrdp_tls_accept failed");
+		return 1;
+	}
+
+	/* assign tls functions */
+	self->trans_read_call = xrdp_tls_force_read_s;
+	self->trans_write_call = xrdp_tls_force_write_s;
+
+	return 0;
+}
+/*****************************************************************************/
+/* returns error */
+int APP_CC
+trans_shutdown_tls_mode(struct trans *self)
+{
+	if (self->tls != NULL)
+	{
+		return xrdp_tls_disconnect(self->tls);
+	}
+
+	/* set callback to tls */
+	self->trans_read_call = trans_tcp_force_read_s;
+	self->trans_write_call = trans_tcp_force_write_s;
+	return 0;
+}
diff --git a/common/trans.h b/common/trans.h
index a391309e..54566d85 100644
--- a/common/trans.h
+++ b/common/trans.h
@@ -23,6 +23,7 @@
 
 #include "arch.h"
 #include "parse.h"
+#include <openssl/ssl.h>
 
 #define TRANS_MODE_TCP 1
 #define TRANS_MODE_UNIX 2
@@ -35,11 +36,14 @@
 #define TRANS_STATUS_UP 1
 
 struct trans; /* forward declaration */
+struct xrdp_tls;
 
 typedef int (DEFAULT_CC *ttrans_data_in)(struct trans* self);
 typedef int (DEFAULT_CC *ttrans_conn_in)(struct trans* self,
                                          struct trans* new_self);
 typedef int (DEFAULT_CC *tis_term)(void);
+typedef int (APP_CC *trans_read_call) (struct trans *self, struct stream *in_s, int size);
+typedef int (APP_CC *trans_write_call) (struct trans *self, struct stream *out_s);
 
 struct trans
 {
@@ -60,10 +64,34 @@ struct trans
     char port[256];
     int no_stream_init_on_data_in;
     int extra_flags; /* user defined */
-    int do_tls; /* 0 - tcp, 1 - tls */
     struct xrdp_tls *tls;
+    trans_read_call trans_read_call;
+    trans_write_call trans_write_call;
 };
 
+/* xrdp_tls */
+struct xrdp_tls {
+	SSL *ssl;
+	SSL_CTX *ctx;
+	char *cert;
+	char *key;
+	struct trans *trans;
+};
+
+/* xrdp_tls.c */
+struct xrdp_tls *APP_CC
+xrdp_tls_create(struct trans *trans, const char *key, const char *cert);
+int APP_CC
+xrdp_tls_accept(struct xrdp_tls *self);
+int APP_CC
+xrdp_tls_disconnect(struct xrdp_tls *self);
+void APP_CC
+xrdp_tls_delete(struct xrdp_tls *self);
+int APP_CC
+xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size);
+int APP_CC
+xrdp_tls_force_write_s(struct trans *self, struct stream *out_s);
+
 struct trans* APP_CC
 trans_create(int mode, int in_size, int out_size);
 void APP_CC
@@ -97,5 +125,13 @@ struct stream* APP_CC
 trans_get_in_s(struct trans* self);
 struct stream* APP_CC
 trans_get_out_s(struct trans* self, int size);
+int APP_CC
+trans_set_tls_mode(struct trans *self, const char *key, const char *cert);
+int APP_CC
+trans_shutdown_tls_mode(struct trans *self);
+int APP_CC
+trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size);
+int APP_CC
+trans_tcp_force_write_s(struct trans *self, struct stream *out_s);
 
 #endif
diff --git a/common/xrdp_client_info.h b/common/xrdp_client_info.h
index 7a7aed92..954595d8 100644
--- a/common/xrdp_client_info.h
+++ b/common/xrdp_client_info.h
@@ -123,6 +123,9 @@ struct xrdp_client_info
 
   int max_fastpath_frag_bytes;
 
+  char certificate[1024];
+  char key_file[1024];
+
 };
 
 #endif
diff --git a/common/xrdp_tls.c b/common/xrdp_tls.c
new file mode 100644
index 00000000..4429ff5e
--- /dev/null
+++ b/common/xrdp_tls.c
@@ -0,0 +1,422 @@
+/**
+ * xrdp: A Remote Desktop Protocol server.
+ *
+ * Copyright (C) Idan Freiberg 2013-2014
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * transport layer security
+ */
+
+#include "trans.h"
+#include "ssl_calls.h"
+
+/*****************************************************************************/
+struct xrdp_tls *APP_CC
+xrdp_tls_create(struct trans *trans, const char *key, const char *cert)
+{
+    struct xrdp_tls *self;
+    self = (struct xrdp_tls *) g_malloc(sizeof(struct xrdp_tls), 1);
+
+    if (self != NULL)
+    {
+		self->trans = trans;
+		self->cert = (char *) cert;
+		self->key = (char *) key;
+    }
+
+    return self;
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_accept(struct xrdp_tls *self)
+{
+	int connection_status;
+	long options = 0;
+
+	/**
+	 * SSL_OP_NO_SSLv2:
+	 *
+	 * We only want SSLv3 and TLSv1, so disable SSLv2.
+	 * SSLv3 is used by, eg. Microsoft RDC for Mac OS X.
+	 */
+	options |= SSL_OP_NO_SSLv2;
+
+	/**
+	 * SSL_OP_NO_COMPRESSION:
+	 *
+	 * The Microsoft RDP server does not advertise support
+	 * for TLS compression, but alternative servers may support it.
+	 * This was observed between early versions of the FreeRDP server
+	 * and the FreeRDP client, and caused major performance issues,
+	 * which is why we're disabling it.
+	 */
+	options |= SSL_OP_NO_COMPRESSION;
+
+	/**
+	 * SSL_OP_TLS_BLOCK_PADDING_BUG:
+	 *
+	 * The Microsoft RDP server does *not* support TLS padding.
+	 * It absolutely needs to be disabled otherwise it won't work.
+	 */
+	options |= SSL_OP_TLS_BLOCK_PADDING_BUG;
+
+	/**
+	 * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS:
+	 *
+	 * Just like TLS padding, the Microsoft RDP server does not
+	 * support empty fragments. This needs to be disabled.
+	 */
+	options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+
+	self->ctx = SSL_CTX_new(SSLv23_server_method());
+	/* set context options */
+	SSL_CTX_set_mode(self->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_ENABLE_PARTIAL_WRITE);
+	SSL_CTX_set_options(self->ctx, options);
+	SSL_CTX_set_read_ahead(self->ctx, 1);
+
+	if (self->ctx == NULL) {
+		g_writeln("xrdp_tls_accept: SSL_CTX_new failed");
+		return 1;
+	}
+
+	if (SSL_CTX_use_RSAPrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM)
+			<= 0) {
+		g_writeln("xrdp_tls_accept: SSL_CTX_use_RSAPrivateKey_file failed");
+		return 1;
+	}
+
+	self->ssl = SSL_new(self->ctx);
+
+	if (self->ssl == NULL) {
+		g_writeln("xrdp_tls_accept: SSL_new failed");
+		return 1;
+	}
+
+	if (SSL_use_certificate_file(self->ssl, self->cert, SSL_FILETYPE_PEM) <= 0) {
+		g_writeln("xrdp_tls_accept: SSL_use_certificate_file failed");
+		return 1;
+	}
+
+	if (SSL_set_fd(self->ssl, self->trans->sck) < 1) {
+		g_writeln("xrdp_tls_accept: SSL_set_fd failed");
+		return 1;
+	}
+
+	connection_status = SSL_accept(self->ssl);
+
+	if (connection_status <= 0) {
+		if (xrdp_tls_print_error("SSL_accept", self->ssl, connection_status))
+		{
+			return 1;
+		}
+	}
+
+	g_writeln("xrdp_tls_accept: TLS connection accepted");
+
+	return 0;
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_print_error(char *func, SSL *connection, int value)
+{
+	switch (SSL_get_error(connection, value))
+	{
+		case SSL_ERROR_ZERO_RETURN:
+			g_writeln("xrdp_tls_print_error: %s: Server closed TLS connection", func);
+			return 1;
+
+		case SSL_ERROR_WANT_READ:
+			g_writeln("xrdp_tls_print_error: SSL_ERROR_WANT_READ");
+			return 0;
+
+		case SSL_ERROR_WANT_WRITE:
+			g_writeln("xrdp_tls_print_error: SSL_ERROR_WANT_WRITE");
+			return 0;
+
+		case SSL_ERROR_SYSCALL:
+			g_writeln("xrdp_tls_print_error: %s: I/O error", func);
+			return 1;
+
+		case SSL_ERROR_SSL:
+			g_writeln("xrdp_tls_print_error: %s: Failure in SSL library (protocol error?)", func);
+			return 1;
+
+		default:
+			g_writeln("xrdp_tls_print_error: %s: Unknown error", func);
+			return 1;
+	}
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_disconnect(struct xrdp_tls *self)
+{
+	int status = SSL_shutdown(self->ssl);
+	while (status != 1)
+	{
+		status = SSL_shutdown(self->ssl);
+
+		if (status <= 0) {
+			if (xrdp_tls_print_error("SSL_shutdown", self->ssl, status))
+			{
+				return 1;
+			}
+		}
+	}
+	return 0;
+}
+/*****************************************************************************/
+void APP_CC
+xrdp_tls_delete(struct xrdp_tls *self)
+{
+	if (self != NULL)
+	{
+		if (self->ssl)
+			SSL_free(self->ssl);
+
+		if (self->ctx)
+			SSL_CTX_free(self->ctx);
+
+		g_free(self);
+	}
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_read(struct xrdp_tls *tls, unsigned char *data, int length)
+{
+	int status;
+
+	status = SSL_read(tls->ssl, data, length);
+
+	switch (SSL_get_error(tls->ssl, status))
+	{
+		case SSL_ERROR_NONE:
+			break;
+
+		case SSL_ERROR_WANT_READ:
+		case SSL_ERROR_WANT_WRITE:
+			status = 0;
+			break;
+
+		default:
+			xrdp_tls_print_error("SSL_read", tls->ssl, status);
+			status = -1;
+			break;
+	}
+
+	return status;
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_write(struct xrdp_tls *tls, unsigned char *data, int length)
+{
+	int status;
+
+	status = SSL_write(tls->ssl, data, length);
+
+	switch (SSL_get_error(tls->ssl, status))
+	{
+		case SSL_ERROR_NONE:
+			break;
+
+		case SSL_ERROR_WANT_READ:
+		case SSL_ERROR_WANT_WRITE:
+			status = 0;
+			break;
+
+		default:
+			xrdp_tls_print_error("SSL_write", tls->ssl, status);
+			status = -1;
+			break;
+	}
+
+	return status;
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size)
+{
+    int rcvd;
+
+    if (self->status != TRANS_STATUS_UP)
+    {
+        return 1;
+    }
+
+    while (size > 0)
+    {
+        /* make sure stream has room */
+        if ((in_s->end + size) > (in_s->data + in_s->size))
+        {
+            return 1;
+        }
+
+		rcvd = xrdp_tls_read(self->tls, in_s->end, size);
+
+        if (rcvd == -1)
+        {
+            if (g_tcp_last_error_would_block(self->sck))
+            {
+                if (!g_tcp_can_recv(self->sck, 100))
+                {
+                    /* check for term here */
+                    if (self->is_term != 0)
+                    {
+                        if (self->is_term())
+                        {
+                            /* term */
+                            self->status = TRANS_STATUS_DOWN;
+                            return 1;
+                        }
+                    }
+                }
+            }
+            else
+            {
+                /* error */
+                self->status = TRANS_STATUS_DOWN;
+                return 1;
+            }
+        }
+        else if (rcvd == 0)
+        {
+            /* error */
+            self->status = TRANS_STATUS_DOWN;
+            return 1;
+        }
+        else
+        {
+            in_s->end += rcvd;
+            size -= rcvd;
+        }
+    }
+
+    return 0;
+}
+
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_force_write_s(struct trans *self, struct stream *out_s)
+{
+    int size;
+    int total;
+    int sent;
+
+    if (self->status != TRANS_STATUS_UP)
+    {
+        return 1;
+    }
+
+    size = (int)(out_s->end - out_s->data);
+    total = 0;
+
+    if (xrdp_tls_send_waiting(self, 1) != 0)
+    {
+        self->status = TRANS_STATUS_DOWN;
+        return 1;
+    }
+
+    while (total < size)
+    {
+		sent = xrdp_tls_write(self->tls, out_s->data + total, size - total);
+
+        if (sent == -1)
+        {
+            if (g_tcp_last_error_would_block(self->sck))
+            {
+                if (!g_tcp_can_send(self->sck, 100))
+                {
+                    /* check for term here */
+                    if (self->is_term != 0)
+                    {
+                        if (self->is_term())
+                        {
+                            /* term */
+                            self->status = TRANS_STATUS_DOWN;
+                            return 1;
+                        }
+                    }
+                }
+            }
+            else
+            {
+                /* error */
+                self->status = TRANS_STATUS_DOWN;
+                return 1;
+            }
+        }
+        else if (sent == 0)
+        {
+            /* error */
+            self->status = TRANS_STATUS_DOWN;
+            return 1;
+        }
+        else
+        {
+            total = total + sent;
+        }
+    }
+
+    return 0;
+}
+/*****************************************************************************/
+int APP_CC
+xrdp_tls_send_waiting(struct trans *self, int block)
+{
+    struct stream *temp_s;
+    int bytes;
+    int sent;
+    int timeout;
+    int cont;
+
+    timeout = block ? 100 : 0;
+    cont = 1;
+    while (cont)
+    {
+        if (self->wait_s != 0)
+        {
+            temp_s = self->wait_s;
+            if (g_tcp_can_send(self->sck, timeout))
+            {
+                bytes = (int) (temp_s->end - temp_s->p);
+                sent = xrdp_tls_write(self->tls, temp_s->p, bytes);
+                if (sent > 0)
+                {
+                    temp_s->p += sent;
+                    if (temp_s->p >= temp_s->end)
+                    {
+                        self->wait_s = (struct stream *) (temp_s->next_packet);
+                        free_stream(temp_s);
+                    }
+                }
+                else if (sent == 0)
+                {
+                    return 1;
+                }
+                else
+                {
+                    if (!g_tcp_last_error_would_block(self->sck))
+                    {
+                        return 1;
+                    }
+                }
+            }
+        }
+        else
+        {
+            break;
+        }
+        cont = block;
+    }
+    return 0;
+}