summaryrefslogtreecommitdiffstats
path: root/sesman
diff options
context:
space:
mode:
Diffstat (limited to 'sesman')
-rw-r--r--sesman/libscp/libscp_session.c3
-rw-r--r--sesman/libscp/libscp_types.h4
-rw-r--r--sesman/libscp/libscp_v0.c63
-rw-r--r--sesman/libscp/libscp_v0.h9
-rw-r--r--sesman/scp_v0.c46
5 files changed, 117 insertions, 8 deletions
diff --git a/sesman/libscp/libscp_session.c b/sesman/libscp/libscp_session.c
index 244f188a..3ed5070a 100644
--- a/sesman/libscp/libscp_session.c
+++ b/sesman/libscp/libscp_session.c
@@ -60,6 +60,9 @@ scp_session_set_type(struct SCP_SESSION* s, tui8 type)
case SCP_SESSION_TYPE_XRDP:
s->type = SCP_SESSION_TYPE_XRDP;
break;
+ case SCP_GW_AUTHENTICATION:
+ s->type = SCP_GW_AUTHENTICATION;
+ break;
case SCP_SESSION_TYPE_MANAGE:
s->type = SCP_SESSION_TYPE_MANAGE;
s->mng = (struct SCP_MNG_DATA*)g_malloc(sizeof(struct SCP_MNG_DATA), 1);
diff --git a/sesman/libscp/libscp_types.h b/sesman/libscp/libscp_types.h
index 7a54545a..e6521741 100644
--- a/sesman/libscp/libscp_types.h
+++ b/sesman/libscp/libscp_types.h
@@ -42,6 +42,10 @@
#define SCP_SESSION_TYPE_XVNC 0x00
#define SCP_SESSION_TYPE_XRDP 0x01
#define SCP_SESSION_TYPE_MANAGE 0x02
+/* SCP_GW_AUTHENTICATION can be used when XRDP + sesman act as a gateway
+ * XRDP sends this command to let sesman verify if the user is allowed
+ * to use the gateway */
+#define SCP_GW_AUTHENTICATION 0x04
#define SCP_ADDRESS_TYPE_IPV4 0x00
#define SCP_ADDRESS_TYPE_IPV6 0x01
diff --git a/sesman/libscp/libscp_v0.c b/sesman/libscp/libscp_v0.c
index 69dd4afa..f92383d4 100644
--- a/sesman/libscp/libscp_v0.c
+++ b/sesman/libscp/libscp_v0.c
@@ -277,6 +277,42 @@ scp_v0s_accept(struct SCP_CONNECTION* c, struct SCP_SESSION** s, int skipVchk)
}
}
}
+ if (code == SCP_GW_AUTHENTICATION)
+ {
+ /* g_writeln("Command is SCP_GW_AUTHENTICATION"); */
+ session = scp_session_create();
+ if (0 == session)
+ {
+ /* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: network error", __LINE__);*/
+ return SCP_SERVER_STATE_INTERNAL_ERR;
+ }
+
+ scp_session_set_version(session, version);
+ scp_session_set_type(session, SCP_GW_AUTHENTICATION);
+ /* reading username */
+ in_uint16_be(c->in_s, sz);
+ buf[sz]='\0';
+ in_uint8a(c->in_s, buf, sz);
+ /* g_writeln("Received user name: %s",buf); */
+ if (0 != scp_session_set_username(session, buf))
+ {
+ scp_session_destroy(session);
+ /* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting username", __LINE__);*/
+ return SCP_SERVER_STATE_INTERNAL_ERR;
+ }
+
+ /* reading password */
+ in_uint16_be(c->in_s, sz);
+ buf[sz]='\0';
+ in_uint8a(c->in_s, buf, sz);
+ /* g_writeln("Received password: %s",buf); */
+ if (0 != scp_session_set_password(session, buf))
+ {
+ scp_session_destroy(session);
+ /* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: error setting password", __LINE__); */
+ return SCP_SERVER_STATE_INTERNAL_ERR;
+ }
+ }
else
{
log_message(LOG_LEVEL_WARNING, "[v0:%d] connection aborted: sequence error", __LINE__);
@@ -315,8 +351,8 @@ scp_v0s_deny_connection(struct SCP_CONNECTION* c)
out_uint32_be(c->out_s, 0); /* version */
out_uint32_be(c->out_s, 14); /* size */
out_uint16_be(c->out_s, 3); /* cmd */
- out_uint16_be(c->out_s, 0); /* data */
- out_uint16_be(c->out_s, 0); /* data */
+ out_uint16_be(c->out_s, 0); /* data = 0 - means NOT ok*/
+ out_uint16_be(c->out_s, 0); /* reserved for display number*/
s_mark_end(c->out_s);
if (0 != scp_tcp_force_send(c->in_sck, c->out_s->data, c->out_s->end - c->out_s->data))
@@ -328,3 +364,26 @@ scp_v0s_deny_connection(struct SCP_CONNECTION* c)
LOG_DBG("[v0:%d] connection terminated (denied)", __LINE__);
return SCP_SERVER_STATE_OK;
}
+
+/******************************************************************************/
+enum SCP_SERVER_STATES_E
+scp_v0s_replyauthentication(struct SCP_CONNECTION* c, unsigned short int value)
+{
+ out_uint32_be(c->out_s, 0); /* version */
+ out_uint32_be(c->out_s, 14); /* size */
+ /* cmd SCP_GW_AUTHENTICATION means authentication reply */
+ out_uint16_be(c->out_s, SCP_GW_AUTHENTICATION);
+ out_uint16_be(c->out_s, value); /* reply code */
+ out_uint16_be(c->out_s, 0); /* dummy data */
+ s_mark_end(c->out_s);
+
+ /* g_writeln("Total number of bytes that will be sent %d",c->out_s->end - c->out_s->data);*/
+ if (0 != scp_tcp_force_send(c->in_sck, c->out_s->data, c->out_s->end - c->out_s->data))
+ {
+ /* until syslog merge log_message(s_log, LOG_LEVEL_WARNING, "[v0:%d] connection aborted: network error", __LINE__); */
+ return SCP_SERVER_STATE_NETWORK_ERR;
+ }
+
+ /* until syslog merge LOG_DBG(s_log, "[v0:%d] connection terminated (scp_v0s_deny_authentication)", __LINE__);*/
+ return SCP_SERVER_STATE_OK;
+}
diff --git a/sesman/libscp/libscp_v0.h b/sesman/libscp/libscp_v0.h
index 7c6fd4b2..92b835f0 100644
--- a/sesman/libscp/libscp_v0.h
+++ b/sesman/libscp/libscp_v0.h
@@ -73,5 +73,14 @@ scp_v0s_allow_connection(struct SCP_CONNECTION* c, SCP_DISPLAY d);
enum SCP_SERVER_STATES_E
scp_v0s_deny_connection(struct SCP_CONNECTION* c);
+/**
+ * @brief send reply to an authentication request
+ * @param c connection descriptor
+ * @param value the reply code 0 means ok
+ * @return
+ */
+enum SCP_SERVER_STATES_E
+scp_v0s_replyauthentication(struct SCP_CONNECTION* c, unsigned short int value);
+
#endif
diff --git a/sesman/scp_v0.c b/sesman/scp_v0.c
index e36aeaf6..b4e1a845 100644
--- a/sesman/scp_v0.c
+++ b/sesman/scp_v0.c
@@ -38,20 +38,52 @@ scp_v0_process(struct SCP_CONNECTION* c, struct SCP_SESSION* s)
struct session_item* s_item;
data = auth_userpass(s->username, s->password);
-
- if (data)
+ if(s->type==SCP_GW_AUTHENTICATION)
{
+ /* this is just authentication in a gateway situation */
+ /* g_writeln("SCP_GW_AUTHENTICATION message received"); */
+ if(data)
+ {
+ if (1 == access_login_allowed(s->username))
+ {
+ /* the user is member of the correct groups. */
+ scp_v0s_replyauthentication(c,0);
+ log_message( LOG_LEVEL_INFO,"Access permitted for user: %s",
+ s->username);
+ /* g_writeln("Connection allowed"); */
+ }
+ else
+ {
+ scp_v0s_replyauthentication(c,3);
+ log_message( LOG_LEVEL_INFO,"Username okey but group problem for user: %s",
+ s->username);
+ /* g_writeln("user password ok, but group problem"); */
+ }
+ }
+ else
+ {
+ /* g_writeln("username or password error"); */
+ log_message( LOG_LEVEL_INFO,"Username or password error for user: %s",
+ s->username);
+ scp_v0s_replyauthentication(c,2);
+ }
+ auth_end(data);
+ }
+ else if (data)
+ {
s_item = session_get_bydata(s->username, s->width, s->height, s->bpp, s->type);
if (s_item != 0)
{
display = s_item->display;
if (0 != s->client_ip)
{
- log_message( LOG_LEVEL_INFO, "++ reconnected session: username %s, display :%d.0, session_pid %d, ip %s", s->username, display, s_item->pid, s->client_ip);
+ log_message( LOG_LEVEL_INFO, "++ reconnected session: username %s, display :%d.0, "
+ "session_pid %d, ip %s", s->username, display, s_item->pid, s->client_ip);
}
else
{
- log_message(LOG_LEVEL_INFO, "++ reconnected session: username %s, display :%d.0, session_pid %d", s->username, display, s_item->pid);
+ log_message(LOG_LEVEL_INFO, "++ reconnected session: username %s, display :%d.0, "
+ "session_pid %d", s->username, display, s_item->pid);
}
auth_end(data);
/* don't set data to null here */
@@ -63,11 +95,13 @@ scp_v0_process(struct SCP_CONNECTION* c, struct SCP_SESSION* s)
{
if (0 != s->client_ip)
{
- log_message(LOG_LEVEL_INFO, "++ created session (access granted): username %s, ip %s", s->username, s->client_ip);
+ log_message(LOG_LEVEL_INFO, "++ created session (access granted): "
+ "username %s, ip %s", s->username, s->client_ip);
}
else
{
- log_message(LOG_LEVEL_INFO, "++ created session (access granted): username %s", s->username);
+ log_message(LOG_LEVEL_INFO, "++ created session (access granted): "
+ "username %s", s->username);
}
if (SCP_SESSION_TYPE_XVNC == s->type)
generated by cgit v1.2.1 (git 2.18.0) at 2024-12-18 07:32:09 +0000