jh163888/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

TLS: switch ssl_protocols to a comma separated list

Browse Source
This commit is contained in:
Koichiro IWAO 2017-01-31 14:59:46 +09:00 committed by metalefty
parent c126f81d9a
commit 849c1a22a2
3 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/man/xrdp.ini.5.in
View File

@ -145,7 +145,7 @@ Negotiate these security methods with clients.
.TP
\fBssl_protocols\fP=\fI[SSLv3] [TLSv1] [TLSv1.1] [TLSv1.2]\fP
Enables the specified SSL/TLS protocols. Each value should be separated by space.
Enables the specified SSL/TLS protocols. Each value should be separated by comma.
SSLv2 is always disabled. At least one protocol should be given to accept TLS connections.
This parameter is effective only if \fBsecurity_layer\fP is set to \fBtls\fP or \fBnegotiate\fP.

18
libxrdp/xrdp_rdp.c
View File

@ -45,6 +45,7 @@ xrdp_rdp_read_config(struct xrdp_client_info *client_info)
char *item = (char *)NULL;
char *value = (char *)NULL;
char cfg_file[256];
char *p = (char *)NULL;
char *tmp = (char *)NULL;
int tmp_length = 0;
@ -165,31 +166,36 @@ xrdp_rdp_read_config(struct xrdp_client_info *client_info)
}
else if (g_strcasecmp(item, "ssl_protocols") == 0)
{
/* put leading/trailing space to properly detect "TLSv1" without regex */
/* put leading/trailing comma to properly detect "TLSv1" without regex */
tmp_length = g_strlen(value) + 3;
tmp = g_new(char, tmp_length);
g_snprintf(tmp, tmp_length, "%s%s%s", " ", value, " ");
g_snprintf(tmp, tmp_length, "%s%s%s", ",", value, ",");
/* to accept space after comma */
while ((p = (char *) g_strchr(tmp, ' ')) != NULL)
{
*p = ',';
}
/* disable all protocols first, enable later */
client_info->ssl_protocols =
SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
if (g_pos(tmp, " TLSv1.2 ") >= 0)
if (g_pos(tmp, ",TLSv1.2,") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1.2 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1_2;
}
if (g_pos(tmp, " TLSv1.1 ") >= 0)
if (g_pos(tmp, ",TLSv1.1,") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1.1 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1_1;
}
if (g_pos(tmp, " TLSv1 ") >= 0)
if (g_pos(tmp, ",TLSv1,") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "TLSv1 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_TLSv1;
}
if (g_pos(tmp, " SSLv3 ") >= 0)
if (g_pos(tmp, ",SSLv3,") >= 0)
{
log_message(LOG_LEVEL_DEBUG, "SSLv3 enabled");
client_info->ssl_protocols &= ~SSL_OP_NO_SSLv3;

4
xrdp/xrdp.ini
View File

@ -26,8 +26,8 @@ crypt_level=high
certificate=
key_file=
; set SSL protocols
; can be space separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2'
ssl_protocols=TLSv1 TLSv1.1 TLSv1.2
; can be comma separated list of 'SSLv3', 'TLSv1', 'TLSv1.1', 'TLSv1.2'
ssl_protocols=TLSv1, TLSv1.1, TLSv1.2
; set TLS cipher suites (up to 63 characters)
#tls_ciphers=HIGH