diff options
Diffstat (limited to 'common')
| -rw-r--r-- | common/Makefile.am | 5 | ||||
| -rw-r--r-- | common/trans.c | 67 | ||||
| -rw-r--r-- | common/trans.h | 38 | ||||
| -rw-r--r-- | common/xrdp_client_info.h | 3 | ||||
| -rw-r--r-- | common/xrdp_tls.c | 422 |
5 files changed, 530 insertions, 5 deletions
diff --git a/common/Makefile.am b/common/Makefile.am index ab9c2bd5..9feac9fb 100644 --- a/common/Makefile.am +++ b/common/Makefile.am @@ -17,7 +17,7 @@ EXTRA_DIST = \ trans.h \ xrdp_client_info.h \ xrdp_constants.h \ - xrdp_rail.h + xrdp_rail.h AM_CFLAGS = \ -DXRDP_CFG_PATH=\"${sysconfdir}/xrdp\" \ @@ -39,7 +39,8 @@ libcommon_la_SOURCES = \ os_calls.c \ ssl_calls.c \ thread_calls.c \ - trans.c + trans.c \ + xrdp_tls.c libcommon_la_LIBADD = \ -lcrypto \ diff --git a/common/trans.c b/common/trans.c index 6fd5a9d8..e13cd420 100644 --- a/common/trans.c +++ b/common/trans.c @@ -38,6 +38,10 @@ trans_create(int mode, int in_size, int out_size) make_stream(self->out_s); init_stream(self->out_s, out_size); self->mode = mode; + self->tls = 0; + /* assign tcp functions */ + self->trans_read_call = trans_tcp_force_read_s; + self->trans_write_call = trans_tcp_force_write_s; } return self; @@ -68,6 +72,11 @@ trans_delete(struct trans *self) g_free(self->listen_filename); } + if (self->tls != 0) + { + xrdp_tls_delete(self->tls); + } + g_free(self); } @@ -248,7 +257,7 @@ trans_check_wait_objs(struct trans *self) if (to_read > 0) { - read_bytes = g_tcp_recv(self->sck, self->in_s->end, to_read, 0); + read_bytes = g_tcp_recv(self->sck, self->in_s->end, to_read, 0); if (read_bytes == -1) { @@ -299,11 +308,16 @@ trans_check_wait_objs(struct trans *self) return rv; } - /*****************************************************************************/ int APP_CC trans_force_read_s(struct trans *self, struct stream *in_s, int size) { + return self->trans_read_call(self, in_s, size); +} +/*****************************************************************************/ +int APP_CC +trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size) +{ int rcvd; if (self->status != TRANS_STATUS_UP) @@ -318,7 +332,9 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size) { return 1; } + rcvd = g_tcp_recv(self->sck, in_s->end, size, 0); + if (rcvd == -1) { if (g_tcp_last_error_would_block(self->sck)) @@ -371,6 +387,12 @@ trans_force_read(struct trans *self, int size) int APP_CC trans_force_write_s(struct trans *self, struct stream *out_s) { + return self->trans_write_call(self, out_s); +} +/*****************************************************************************/ +int APP_CC +trans_tcp_force_write_s(struct trans *self, struct stream *out_s) +{ int size; int total; int sent; @@ -391,7 +413,7 @@ trans_force_write_s(struct trans *self, struct stream *out_s) while (total < size) { - sent = g_tcp_send(self->sck, out_s->data + total, size - total, 0); + sent = g_tcp_send(self->sck, out_s->data + total, size - total, 0); if (sent == -1) { @@ -628,3 +650,42 @@ trans_get_out_s(struct trans *self, int size) return rv; } +/*****************************************************************************/ +/* returns error */ +int APP_CC +trans_set_tls_mode(struct trans *self, const char *key, const char *cert) +{ + self->tls = xrdp_tls_create(self, key, cert); + if (self->tls == NULL) + { + g_writeln("trans_set_tls_mode: xrdp_tls_create malloc error"); + return 1; + } + + if (xrdp_tls_accept(self->tls) != 0) + { + g_writeln("trans_set_tls_mode: xrdp_tls_accept failed"); + return 1; + } + + /* assign tls functions */ + self->trans_read_call = xrdp_tls_force_read_s; + self->trans_write_call = xrdp_tls_force_write_s; + + return 0; +} +/*****************************************************************************/ +/* returns error */ +int APP_CC +trans_shutdown_tls_mode(struct trans *self) +{ + if (self->tls != NULL) + { + return xrdp_tls_disconnect(self->tls); + } + + /* set callback back to tcp */ + self->trans_read_call = trans_tcp_force_read_s; + self->trans_write_call = trans_tcp_force_write_s; + return 0; +} diff --git a/common/trans.h b/common/trans.h index 4a8b249c..54566d85 100644 --- a/common/trans.h +++ b/common/trans.h @@ -23,6 +23,7 @@ #include "arch.h" #include "parse.h" +#include <openssl/ssl.h> #define TRANS_MODE_TCP 1 #define TRANS_MODE_UNIX 2 @@ -35,11 +36,14 @@ #define TRANS_STATUS_UP 1 struct trans; /* forward declaration */ +struct xrdp_tls; typedef int (DEFAULT_CC *ttrans_data_in)(struct trans* self); typedef int (DEFAULT_CC *ttrans_conn_in)(struct trans* self, struct trans* new_self); typedef int (DEFAULT_CC *tis_term)(void); +typedef int (APP_CC *trans_read_call) (struct trans *self, struct stream *in_s, int size); +typedef int (APP_CC *trans_write_call) (struct trans *self, struct stream *out_s); struct trans { @@ -60,8 +64,34 @@ struct trans char port[256]; int no_stream_init_on_data_in; int extra_flags; /* user defined */ + struct xrdp_tls *tls; + trans_read_call trans_read_call; + trans_write_call trans_write_call; }; +/* xrdp_tls */ +struct xrdp_tls { + SSL *ssl; + SSL_CTX *ctx; + char *cert; + char *key; + struct trans *trans; +}; + +/* xrdp_tls.c */ +struct xrdp_tls *APP_CC +xrdp_tls_create(struct trans *trans, const char *key, const char *cert); +int APP_CC +xrdp_tls_accept(struct xrdp_tls *self); +int APP_CC +xrdp_tls_disconnect(struct xrdp_tls *self); +void APP_CC +xrdp_tls_delete(struct xrdp_tls *self); +int APP_CC +xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size); +int APP_CC +xrdp_tls_force_write_s(struct trans *self, struct stream *out_s); + struct trans* APP_CC trans_create(int mode, int in_size, int out_size); void APP_CC @@ -95,5 +125,13 @@ struct stream* APP_CC trans_get_in_s(struct trans* self); struct stream* APP_CC trans_get_out_s(struct trans* self, int size); +int APP_CC +trans_set_tls_mode(struct trans *self, const char *key, const char *cert); +int APP_CC +trans_shutdown_tls_mode(struct trans *self); +int APP_CC +trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size); +int APP_CC +trans_tcp_force_write_s(struct trans *self, struct stream *out_s); #endif diff --git a/common/xrdp_client_info.h b/common/xrdp_client_info.h index bccb4436..59915f37 100644 --- a/common/xrdp_client_info.h +++ b/common/xrdp_client_info.h @@ -125,6 +125,9 @@ struct xrdp_client_info int capture_code; int capture_format; + char certificate[1024]; + char key_file[1024]; + }; #endif diff --git a/common/xrdp_tls.c b/common/xrdp_tls.c new file mode 100644 index 00000000..4429ff5e --- /dev/null +++ b/common/xrdp_tls.c @@ -0,0 +1,422 @@ +/** + * xrdp: A Remote Desktop Protocol server. + * + * Copyright (C) Idan Freiberg 2013-2014 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * transport layer security + */ + +#include "trans.h" +#include "ssl_calls.h" + +/*****************************************************************************/ +struct xrdp_tls *APP_CC +xrdp_tls_create(struct trans *trans, const char *key, const char *cert) +{ + struct xrdp_tls *self; + self = (struct xrdp_tls *) g_malloc(sizeof(struct xrdp_tls), 1); + + if (self != NULL) + { + self->trans = trans; + self->cert = (char *) cert; + self->key = (char *) key; + } + + return self; +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_accept(struct xrdp_tls *self) +{ + int connection_status; + long options = 0; + + /** + * SSL_OP_NO_SSLv2: + * + * We only want SSLv3 and TLSv1, so disable SSLv2. + * SSLv3 is used by, eg. Microsoft RDC for Mac OS X. + */ + options |= SSL_OP_NO_SSLv2; + + /** + * SSL_OP_NO_COMPRESSION: + * + * The Microsoft RDP server does not advertise support + * for TLS compression, but alternative servers may support it. + * This was observed between early versions of the FreeRDP server + * and the FreeRDP client, and caused major performance issues, + * which is why we're disabling it. + */ + options |= SSL_OP_NO_COMPRESSION; + + /** + * SSL_OP_TLS_BLOCK_PADDING_BUG: + * + * The Microsoft RDP server does *not* support TLS padding. + * It absolutely needs to be disabled otherwise it won't work. + */ + options |= SSL_OP_TLS_BLOCK_PADDING_BUG; + + /** + * SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: + * + * Just like TLS padding, the Microsoft RDP server does not + * support empty fragments. This needs to be disabled. + */ + options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; + + self->ctx = SSL_CTX_new(SSLv23_server_method()); + /* set context options */ + SSL_CTX_set_mode(self->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_ENABLE_PARTIAL_WRITE); + SSL_CTX_set_options(self->ctx, options); + SSL_CTX_set_read_ahead(self->ctx, 1); + + if (self->ctx == NULL) { + g_writeln("xrdp_tls_accept: SSL_CTX_new failed"); + return 1; + } + + if (SSL_CTX_use_RSAPrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM) + <= 0) { + g_writeln("xrdp_tls_accept: SSL_CTX_use_RSAPrivateKey_file failed"); + return 1; + } + + self->ssl = SSL_new(self->ctx); + + if (self->ssl == NULL) { + g_writeln("xrdp_tls_accept: SSL_new failed"); + return 1; + } + + if (SSL_use_certificate_file(self->ssl, self->cert, SSL_FILETYPE_PEM) <= 0) { + g_writeln("xrdp_tls_accept: SSL_use_certificate_file failed"); + return 1; + } + + if (SSL_set_fd(self->ssl, self->trans->sck) < 1) { + g_writeln("xrdp_tls_accept: SSL_set_fd failed"); + return 1; + } + + connection_status = SSL_accept(self->ssl); + + if (connection_status <= 0) { + if (xrdp_tls_print_error("SSL_accept", self->ssl, connection_status)) + { + return 1; + } + } + + g_writeln("xrdp_tls_accept: TLS connection accepted"); + + return 0; +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_print_error(char *func, SSL *connection, int value) +{ + switch (SSL_get_error(connection, value)) + { + case SSL_ERROR_ZERO_RETURN: + g_writeln("xrdp_tls_print_error: %s: Server closed TLS connection", func); + return 1; + + case SSL_ERROR_WANT_READ: + g_writeln("xrdp_tls_print_error: SSL_ERROR_WANT_READ"); + return 0; + + case SSL_ERROR_WANT_WRITE: + g_writeln("xrdp_tls_print_error: SSL_ERROR_WANT_WRITE"); + return 0; + + case SSL_ERROR_SYSCALL: + g_writeln("xrdp_tls_print_error: %s: I/O error", func); + return 1; + + case SSL_ERROR_SSL: + g_writeln("xrdp_tls_print_error: %s: Failure in SSL library (protocol error?)", func); + return 1; + + default: + g_writeln("xrdp_tls_print_error: %s: Unknown error", func); + return 1; + } +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_disconnect(struct xrdp_tls *self) +{ + int status = SSL_shutdown(self->ssl); + while (status != 1) + { + status = SSL_shutdown(self->ssl); + + if (status <= 0) { + if (xrdp_tls_print_error("SSL_shutdown", self->ssl, status)) + { + return 1; + } + } + } + return 0; +} +/*****************************************************************************/ +void APP_CC +xrdp_tls_delete(struct xrdp_tls *self) +{ + if (self != NULL) + { + if (self->ssl) + SSL_free(self->ssl); + + if (self->ctx) + SSL_CTX_free(self->ctx); + + g_free(self); + } +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_read(struct xrdp_tls *tls, unsigned char *data, int length) +{ + int status; + + status = SSL_read(tls->ssl, data, length); + + switch (SSL_get_error(tls->ssl, status)) + { + case SSL_ERROR_NONE: + break; + + case SSL_ERROR_WANT_READ: + case SSL_ERROR_WANT_WRITE: + status = 0; + break; + + default: + xrdp_tls_print_error("SSL_read", tls->ssl, status); + status = -1; + break; + } + + return status; +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_write(struct xrdp_tls *tls, unsigned char *data, int length) +{ + int status; + + status = SSL_write(tls->ssl, data, length); + + switch (SSL_get_error(tls->ssl, status)) + { + case SSL_ERROR_NONE: + break; + + case SSL_ERROR_WANT_READ: + case SSL_ERROR_WANT_WRITE: + status = 0; + break; + + default: + xrdp_tls_print_error("SSL_write", tls->ssl, status); + status = -1; + break; + } + + return status; +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size) +{ + int rcvd; + + if (self->status != TRANS_STATUS_UP) + { + return 1; + } + + while (size > 0) + { + /* make sure stream has room */ + if ((in_s->end + size) > (in_s->data + in_s->size)) + { + return 1; + } + + rcvd = xrdp_tls_read(self->tls, in_s->end, size); + + if (rcvd == -1) + { + if (g_tcp_last_error_would_block(self->sck)) + { + if (!g_tcp_can_recv(self->sck, 100)) + { + /* check for term here */ + if (self->is_term != 0) + { + if (self->is_term()) + { + /* term */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + } + } + } + else + { + /* error */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + } + else if (rcvd == 0) + { + /* error */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + else + { + in_s->end += rcvd; + size -= rcvd; + } + } + + return 0; +} + +/*****************************************************************************/ +int APP_CC +xrdp_tls_force_write_s(struct trans *self, struct stream *out_s) +{ + int size; + int total; + int sent; + + if (self->status != TRANS_STATUS_UP) + { + return 1; + } + + size = (int)(out_s->end - out_s->data); + total = 0; + + if (xrdp_tls_send_waiting(self, 1) != 0) + { + self->status = TRANS_STATUS_DOWN; + return 1; + } + + while (total < size) + { + sent = xrdp_tls_write(self->tls, out_s->data + total, size - total); + + if (sent == -1) + { + if (g_tcp_last_error_would_block(self->sck)) + { + if (!g_tcp_can_send(self->sck, 100)) + { + /* check for term here */ + if (self->is_term != 0) + { + if (self->is_term()) + { + /* term */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + } + } + } + else + { + /* error */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + } + else if (sent == 0) + { + /* error */ + self->status = TRANS_STATUS_DOWN; + return 1; + } + else + { + total = total + sent; + } + } + + return 0; +} +/*****************************************************************************/ +int APP_CC +xrdp_tls_send_waiting(struct trans *self, int block) +{ + struct stream *temp_s; + int bytes; + int sent; + int timeout; + int cont; + + timeout = block ? 100 : 0; + cont = 1; + while (cont) + { + if (self->wait_s != 0) + { + temp_s = self->wait_s; + if (g_tcp_can_send(self->sck, timeout)) + { + bytes = (int) (temp_s->end - temp_s->p); + sent = xrdp_tls_write(self->tls, temp_s->p, bytes); + if (sent > 0) + { + temp_s->p += sent; + if (temp_s->p >= temp_s->end) + { + self->wait_s = (struct stream *) (temp_s->next_packet); + free_stream(temp_s); + } + } + else if (sent == 0) + { + return 1; + } + else + { + if (!g_tcp_last_error_would_block(self->sck)) + { + return 1; + } + } + } + } + else + { + break; + } + cont = block; + } + return 0; +} |