jh163888/xrdp
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

libxrdp, common: work on TLS mode

Browse Source
This commit is contained in:
Idan Freiberg 2014-07-23 15:31:45 +03:00
parent 1acdc3085e
commit afdf638c7b
15 changed files with 542 additions and 430 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
common/Makefile.am
View File

@ -17,7 +17,7 @@ EXTRA_DIST = \
trans.h \ trans.h \
xrdp_client_info.h \ xrdp_client_info.h \
xrdp_constants.h \ xrdp_constants.h \
xrdp_rail.h xrdp_rail.h
AM_CFLAGS = \ AM_CFLAGS = \
-DXRDP_CFG_PATH=\"${sysconfdir}/xrdp\" \ -DXRDP_CFG_PATH=\"${sysconfdir}/xrdp\" \
@ -39,7 +39,8 @@ libcommon_la_SOURCES = \
os_calls.c \ os_calls.c \
ssl_calls.c \ ssl_calls.c \
thread_calls.c \ thread_calls.c \
trans.c trans.c \
xrdp_tls.c
libcommon_la_LIBADD = \ libcommon_la_LIBADD = \
-lcrypto \ -lcrypto \

65
common/trans.c
View File

@ -38,8 +38,10 @@ trans_create(int mode, int in_size, int out_size)
make_stream(self->out_s); make_stream(self->out_s);
init_stream(self->out_s, out_size); init_stream(self->out_s, out_size);
self->mode = mode; self->mode = mode;
self->do_tls = 0; /* default simple tcp layer */
self->tls = 0; self->tls = 0;
/* assign tcp functions */
self->trans_read_call = trans_tcp_force_read_s;
self->trans_write_call = trans_tcp_force_write_s;
} }
return self; return self;
@ -70,6 +72,11 @@ trans_delete(struct trans *self)
g_free(self->listen_filename); g_free(self->listen_filename);
} }
if (self->tls != 0)
{
xrdp_tls_delete(self->tls);
}
g_free(self); g_free(self);
} }
@ -301,10 +308,15 @@ trans_check_wait_objs(struct trans *self)
return rv; return rv;
} }
/*****************************************************************************/ /*****************************************************************************/
int APP_CC int APP_CC
trans_force_read_s(struct trans *self, struct stream *in_s, int size) trans_force_read_s(struct trans *self, struct stream *in_s, int size)
{
return self->trans_read_call(self, in_s, size);
}
/*****************************************************************************/
int APP_CC
trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size)
{ {
int rcvd; int rcvd;
@ -368,12 +380,22 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size)
int APP_CC int APP_CC
trans_force_read(struct trans *self, int size) trans_force_read(struct trans *self, int size)
{ {
if (self->tls != 0)
{
return xrdp_tls_force_read_s(self, self->in_s, size);
}
return trans_force_read_s(self, self->in_s, size); return trans_force_read_s(self, self->in_s, size);
} }
/*****************************************************************************/ /*****************************************************************************/
int APP_CC int APP_CC
trans_force_write_s(struct trans *self, struct stream *out_s) trans_force_write_s(struct trans *self, struct stream *out_s)
{
return self->trans_write_call(self, out_s);
}
/*****************************************************************************/
int APP_CC
trans_tcp_force_write_s(struct trans *self, struct stream *out_s)
{ {
int size; int size;
int total; int total;
@ -632,3 +654,42 @@ trans_get_out_s(struct trans *self, int size)
return rv; return rv;
} }
/*****************************************************************************/
/* returns error */
int APP_CC
trans_set_tls_mode(struct trans *self, const char *key, const char *cert)
{
self->tls = xrdp_tls_create(self, key, cert);
if (self->tls == NULL)
{
g_writeln("trans_set_tls_mode: xrdp_tls_create malloc error");
return 1;
}
if (xrdp_tls_accept(self->tls) != 0)
{
g_writeln("trans_set_tls_mode: xrdp_tls_accept failed");
return 1;
}
/* assign tls functions */
self->trans_read_call = xrdp_tls_force_read_s;
self->trans_write_call = xrdp_tls_force_write_s;
return 0;
}
/*****************************************************************************/
/* returns error */
int APP_CC
trans_shutdown_tls_mode(struct trans *self)
{
if (self->tls != NULL)
{
return xrdp_tls_disconnect(self->tls);
}
/* set callback to tls */
self->trans_read_call = trans_tcp_force_read_s;
self->trans_write_call = trans_tcp_force_write_s;
return 0;
}

38
common/trans.h
View File

@ -23,6 +23,7 @@
#include "arch.h" #include "arch.h"
#include "parse.h" #include "parse.h"
#include <openssl/ssl.h>
#define TRANS_MODE_TCP 1 #define TRANS_MODE_TCP 1
#define TRANS_MODE_UNIX 2 #define TRANS_MODE_UNIX 2
@ -35,11 +36,14 @@
#define TRANS_STATUS_UP 1 #define TRANS_STATUS_UP 1
struct trans; /* forward declaration */ struct trans; /* forward declaration */
struct xrdp_tls;
typedef int (DEFAULT_CC *ttrans_data_in)(struct trans* self); typedef int (DEFAULT_CC *ttrans_data_in)(struct trans* self);
typedef int (DEFAULT_CC *ttrans_conn_in)(struct trans* self, typedef int (DEFAULT_CC *ttrans_conn_in)(struct trans* self,
struct trans* new_self); struct trans* new_self);
typedef int (DEFAULT_CC *tis_term)(void); typedef int (DEFAULT_CC *tis_term)(void);
typedef int (APP_CC *trans_read_call) (struct trans *self, struct stream *in_s, int size);
typedef int (APP_CC *trans_write_call) (struct trans *self, struct stream *out_s);
struct trans struct trans
{ {
@ -60,10 +64,34 @@ struct trans
char port[256]; char port[256];
int no_stream_init_on_data_in; int no_stream_init_on_data_in;
int extra_flags; /* user defined */ int extra_flags; /* user defined */
int do_tls; /* 0 - tcp, 1 - tls */
struct xrdp_tls *tls; struct xrdp_tls *tls;
trans_read_call trans_read_call;
trans_write_call trans_write_call;
}; };
/* xrdp_tls */
struct xrdp_tls {
SSL *ssl;
SSL_CTX *ctx;
char *cert;
char *key;
struct trans *trans;
};
/* xrdp_tls.c */
struct xrdp_tls *APP_CC
xrdp_tls_create(struct trans *trans, const char *key, const char *cert);
int APP_CC
xrdp_tls_accept(struct xrdp_tls *self);
int APP_CC
xrdp_tls_disconnect(struct xrdp_tls *self);
void APP_CC
xrdp_tls_delete(struct xrdp_tls *self);
int APP_CC
xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size);
int APP_CC
xrdp_tls_force_write_s(struct trans *self, struct stream *out_s);
struct trans* APP_CC struct trans* APP_CC
trans_create(int mode, int in_size, int out_size); trans_create(int mode, int in_size, int out_size);
void APP_CC void APP_CC
@ -97,5 +125,13 @@ struct stream* APP_CC
trans_get_in_s(struct trans* self); trans_get_in_s(struct trans* self);
struct stream* APP_CC struct stream* APP_CC
trans_get_out_s(struct trans* self, int size); trans_get_out_s(struct trans* self, int size);
int APP_CC
trans_set_tls_mode(struct trans *self, const char *key, const char *cert);
int APP_CC
trans_shutdown_tls_mode(struct trans *self);
int APP_CC
trans_tcp_force_read_s(struct trans *self, struct stream *in_s, int size);
int APP_CC
trans_tcp_force_write_s(struct trans *self, struct stream *out_s);
#endif #endif

3
common/xrdp_client_info.h
View File

@ -123,6 +123,9 @@ struct xrdp_client_info
int max_fastpath_frag_bytes; int max_fastpath_frag_bytes;
char certificate[1024];
char key_file[1024];
}; };
#endif #endif

44
libxrdp/xrdp_tls.c → common/xrdp_tls.c
View File

@ -18,7 +18,8 @@
* transport layer security * transport layer security
*/ */
#include "libxrdp.h" #include "trans.h"
#include "ssl_calls.h"
/*****************************************************************************/ /*****************************************************************************/
struct xrdp_tls *APP_CC struct xrdp_tls *APP_CC
@ -30,10 +31,8 @@ xrdp_tls_create(struct trans *trans, const char *key, const char *cert)
if (self != NULL) if (self != NULL)
{ {
self->trans = trans; self->trans = trans;
self->cert = g_malloc(g_strlen(key) + 1, 1); self->cert = (char *) cert;
self->key = g_malloc(g_strlen(cert) + 1, 1); self->key = (char *) key;
strcpy(self->cert, cert);
strcpy(self->key, key);
} }
return self; return self;
@ -87,30 +86,30 @@ xrdp_tls_accept(struct xrdp_tls *self)
SSL_CTX_set_read_ahead(self->ctx, 1); SSL_CTX_set_read_ahead(self->ctx, 1);
if (self->ctx == NULL) { if (self->ctx == NULL) {
g_writeln("ssl_tls_accept: SSL_CTX_new failed"); g_writeln("xrdp_tls_accept: SSL_CTX_new failed");
return 1; return 1;
} }
if (SSL_CTX_use_RSAPrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM) if (SSL_CTX_use_RSAPrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM)
<= 0) { <= 0) {
g_writeln("ssl_tls_accept: SSL_CTX_use_RSAPrivateKey_file failed"); g_writeln("xrdp_tls_accept: SSL_CTX_use_RSAPrivateKey_file failed");
return 1; return 1;
} }
self->ssl = SSL_new(self->ctx); self->ssl = SSL_new(self->ctx);
if (self->ssl == NULL) { if (self->ssl == NULL) {
g_writeln("ssl_tls_accept: SSL_new failed"); g_writeln("xrdp_tls_accept: SSL_new failed");
return 1; return 1;
} }
if (SSL_use_certificate_file(self->ssl, self->cert, SSL_FILETYPE_PEM) <= 0) { if (SSL_use_certificate_file(self->ssl, self->cert, SSL_FILETYPE_PEM) <= 0) {
g_writeln("ssl_tls_accept: SSL_use_certificate_file failed"); g_writeln("xrdp_tls_accept: SSL_use_certificate_file failed");
return 1; return 1;
} }
if (SSL_set_fd(self->ssl, self->trans->sck) < 1) { if (SSL_set_fd(self->ssl, self->trans->sck) < 1) {
g_writeln("ssl_tls_accept: SSL_set_fd failed"); g_writeln("xrdp_tls_accept: SSL_set_fd failed");
return 1; return 1;
} }
@ -123,11 +122,7 @@ xrdp_tls_accept(struct xrdp_tls *self)
} }
} }
g_writeln("ssl_tls_accept: TLS connection accepted"); g_writeln("xrdp_tls_accept: TLS connection accepted");
/* set trans for TLS */
self->trans->do_tls = 1; /* TLS layer */
self->trans->tls = self; /* owner */
return 0; return 0;
} }
@ -166,7 +161,18 @@ xrdp_tls_print_error(char *func, SSL *connection, int value)
int APP_CC int APP_CC
xrdp_tls_disconnect(struct xrdp_tls *self) xrdp_tls_disconnect(struct xrdp_tls *self)
{ {
SSL_shutdown(self->ssl); int status = SSL_shutdown(self->ssl);
while (status != 1)
{
status = SSL_shutdown(self->ssl);
if (status <= 0) {
if (xrdp_tls_print_error("SSL_shutdown", self->ssl, status))
{
return 1;
}
}
}
return 0; return 0;
} }
/*****************************************************************************/ /*****************************************************************************/
@ -255,7 +261,6 @@ xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size)
return 1; return 1;
} }
g_writeln("xrdp_tls_force_read_s: Pending= %d", SSL_pending(self->tls->ssl));
rcvd = xrdp_tls_read(self->tls, in_s->end, size); rcvd = xrdp_tls_read(self->tls, in_s->end, size);
if (rcvd == -1) if (rcvd == -1)
@ -313,10 +318,9 @@ xrdp_tls_force_write_s(struct trans *self, struct stream *out_s)
} }
size = (int)(out_s->end - out_s->data); size = (int)(out_s->end - out_s->data);
g_writeln("packet size= %d", size);
total = 0; total = 0;
if (send_waiting(self, 1) != 0) if (xrdp_tls_send_waiting(self, 1) != 0)
{ {
self->status = TRANS_STATUS_DOWN; self->status = TRANS_STATUS_DOWN;
return 1; return 1;
@ -367,7 +371,7 @@ xrdp_tls_force_write_s(struct trans *self, struct stream *out_s)
} }
/*****************************************************************************/ /*****************************************************************************/
int APP_CC int APP_CC
send_waiting(struct trans *self, int block) xrdp_tls_send_waiting(struct trans *self, int block)
{ {
struct stream *temp_s; struct stream *temp_s;
int bytes; int bytes;

3
libxrdp/Makefile.am
View File

@ -61,8 +61,7 @@ libxrdp_la_SOURCES = \
xrdp_orders_rail.c \ xrdp_orders_rail.c \
xrdp_mppc_enc.c \ xrdp_mppc_enc.c \
xrdp_fastpath.c \ xrdp_fastpath.c \
xrdp_caps.c \ xrdp_caps.c
xrdp_tls.c
libxrdp_la_LDFLAGS = \ libxrdp_la_LDFLAGS = \
$(EXTRA_FLAGS) $(EXTRA_FLAGS)

27
libxrdp/libxrdp.c
View File

@ -141,16 +141,8 @@ libxrdp_force_read(struct trans* trans)
s = trans->in_s; s = trans->in_s;
init_stream(s, 32 * 1024); init_stream(s, 32 * 1024);
if (trans->do_tls)
{ if (trans_force_read(trans, 4) != 0)
g_writeln("libxrdp_force_read: tls data in");
if (xrdp_tls_force_read_s(trans, s, 4) != 0)
{
return 0;
}
g_hexdump(s->data, 4);
}
else if (trans_force_read(trans, 4) != 0) /*TCP*/
{ {
g_writeln("libxrdp_force_read: error"); g_writeln("libxrdp_force_read: error");
return 0; return 0;
@ -167,24 +159,11 @@ libxrdp_force_read(struct trans* trans)
return 0; return 0;
} }
if (trans->do_tls) if (trans_force_read(trans, bytes - 4) != 0)
{
g_writeln("libxrdp_force_read: tls data in");
xrdp_tls_force_read_s(trans, s, bytes - 4);
g_hexdump(s->data, bytes);
}
else if (trans_force_read(trans, bytes - 4) != 0) /*TCP*/
{ {
g_writeln("libxrdp_force_read: error"); g_writeln("libxrdp_force_read: error");
return 0; return 0;
} }
// if (trans_force_read(trans, bytes - 4) != 0)
// {
// g_writeln("libxrdp_force_read: error");
// return 0;
// }
return s; return s;
} }

36
libxrdp/libxrdp.h
View File

@ -36,7 +36,6 @@
#include "libxrdpinc.h" #include "libxrdpinc.h"
#include "file_loc.h" #include "file_loc.h"
#include "xrdp_client_info.h" #include "xrdp_client_info.h"
#include <openssl/ssl.h>
/* iso */ /* iso */
@ -123,16 +122,13 @@ struct xrdp_sec
char pub_mod[256]; char pub_mod[256];
char pub_sig[64]; char pub_sig[64];
char pri_exp[256]; char pri_exp[256];
int rsa_key_bytes; /* 64 or 256 */ int rsa_key_bytes; /* 64 or 256 , 0 = no rdp security */
int channel_code;
int multimon;
char fips_encrypt_key[24]; char fips_encrypt_key[24];
char fips_decrypt_key[24]; char fips_decrypt_key[24];
char fips_sign_key[20]; char fips_sign_key[20];
void *encrypt_fips_info; void *encrypt_fips_info;
void *decrypt_fips_info; void *decrypt_fips_info;
void *sign_fips_info; void *sign_fips_info;
struct xrdp_tls *tls;
}; };
/* channel */ /* channel */
@ -293,29 +289,6 @@ struct xrdp_mppc_enc
}; };
/* xrdp_tls */
struct xrdp_tls {
SSL *ssl;
SSL_CTX *ctx;
char *cert;
char *key;
struct trans *trans;
};
/* xrdp_tls.c */
struct xrdp_tls *APP_CC
xrdp_tls_create(struct trans *trans, const char *key, const char *cert);
int APP_CC
xrdp_tls_accept(struct xrdp_tls *self);
int APP_CC
xrdp_tls_disconnect(struct xrdp_tls *self);
void APP_CC
xrdp_tls_delete(struct xrdp_tls *self);
int APP_CC
xrdp_tls_force_read_s(struct trans *self, struct stream *in_s, int size);
int APP_CC
xrdp_tls_force_write_s(struct trans *self, struct stream *out_s);
int APP_CC int APP_CC
compress_rdp(struct xrdp_mppc_enc *enc, tui8 *srcData, int len); compress_rdp(struct xrdp_mppc_enc *enc, tui8 *srcData, int len);
struct xrdp_mppc_enc * APP_CC struct xrdp_mppc_enc * APP_CC
@ -370,9 +343,8 @@ int APP_CC
xrdp_mcs_disconnect(struct xrdp_mcs *self); xrdp_mcs_disconnect(struct xrdp_mcs *self);
/* xrdp_sec.c */ /* xrdp_sec.c */
struct xrdp_sec * APP_CC struct xrdp_sec *APP_CC
xrdp_sec_create(struct xrdp_rdp *owner, struct trans *trans, int crypt_level, xrdp_sec_create(struct xrdp_rdp *owner, struct trans *trans);
int channel_code, int multimon);
void APP_CC void APP_CC
xrdp_sec_delete(struct xrdp_sec *self); xrdp_sec_delete(struct xrdp_sec *self);
int APP_CC int APP_CC
@ -392,8 +364,6 @@ xrdp_sec_send(struct xrdp_sec *self, struct stream *s, int chan);
int APP_CC int APP_CC
xrdp_sec_process_mcs_data(struct xrdp_sec *self); xrdp_sec_process_mcs_data(struct xrdp_sec *self);
int APP_CC int APP_CC
xrdp_sec_out_mcs_data(struct xrdp_sec *self);
int APP_CC
xrdp_sec_incoming(struct xrdp_sec *self); xrdp_sec_incoming(struct xrdp_sec *self);
int APP_CC int APP_CC
xrdp_sec_disconnect(struct xrdp_sec *self); xrdp_sec_disconnect(struct xrdp_sec *self);

2
libxrdp/xrdp_fastpath.c
View File

@ -117,7 +117,7 @@ xrdp_fastpath_init(struct xrdp_fastpath *self, struct stream *s)
int APP_CC int APP_CC
xrdp_fastpath_send(struct xrdp_fastpath *self, struct stream *s) xrdp_fastpath_send(struct xrdp_fastpath *self, struct stream *s)
{ {
if (trans_force_write_s(self->trans, s) != 0) if (trans_force_write_s(self->trans, s) != 0)
{ {
return 1; return 1;
} }

15
libxrdp/xrdp_iso.c
View File

@ -56,8 +56,6 @@ xrdp_iso_process_rdpNegReq(struct xrdp_iso *self, struct stream *s)
int flags; int flags;
int len; int len;
DEBUG((" in xrdp_iso_process_neg_req"));
in_uint8(s, flags); in_uint8(s, flags);
if (flags != 0x0 && flags != 0x8 && flags != 0x1) if (flags != 0x0 && flags != 0x8 && flags != 0x1)
{ {
@ -80,7 +78,6 @@ xrdp_iso_process_rdpNegReq(struct xrdp_iso *self, struct stream *s)
return 1; return 1;
} }
DEBUG((" out xrdp_iso_process_rdpNegReq"));
return 0; return 0;
} }
/*****************************************************************************/ /*****************************************************************************/
@ -278,8 +275,7 @@ xrdp_iso_incoming(struct xrdp_iso *self)
self->rdpNegData = 1; self->rdpNegData = 1;
if (xrdp_iso_process_rdpNegReq(self, s) != 0) if (xrdp_iso_process_rdpNegReq(self, s) != 0)
{ {
g_writeln( g_writeln("xrdp_iso_incoming: xrdp_iso_process_rdpNegReq returned non zero");
"xrdp_iso_incoming: xrdp_iso_process_rdpNegReq returned non zero");
return 1; return 1;
} }
break; break;
@ -416,14 +412,7 @@ xrdp_iso_send(struct xrdp_iso *self, struct stream *s)
out_uint8(s, ISO_PDU_DT); out_uint8(s, ISO_PDU_DT);
out_uint8(s, 0x80); out_uint8(s, 0x80);
if (self->trans->do_tls) if (trans_force_write_s(self->trans, s) != 0)
{
if (xrdp_tls_force_write_s(self->trans, s) != 0)
{
return 1;
}
}
else if (trans_force_write_s(self->trans, s) != 0)
{ {
return 1; return 1;
} }

222
libxrdp/xrdp_mcs.c
View File

@ -706,7 +706,163 @@ xrdp_mcs_out_domain_params(struct xrdp_mcs *self, struct stream *s,
xrdp_mcs_ber_out_int8(self, s, 2); xrdp_mcs_ber_out_int8(self, s, 2);
return 0; return 0;
} }
/*****************************************************************************/
/* prepare server gcc data to send in mcs response msg */
int APP_CC
xrdp_mcs_out_gcc_data(struct xrdp_sec *self)
{
struct stream *s;
int num_channels_even;
int num_channels;
int index;
int channel;
int gcc_size;
char* gcc_size_ptr;
char* ud_ptr;
num_channels = self->mcs_layer->channel_list->count;
num_channels_even = num_channels + (num_channels & 1);
s = &(self->server_mcs_data);
init_stream(s, 8192);
out_uint16_be(s, 5); /* AsnBerObjectIdentifier */
out_uint16_be(s, 0x14);
out_uint8(s, 0x7c);
out_uint16_be(s, 1); /* -- */
out_uint8(s, 0x2a); /* ConnectPDULen */
out_uint8(s, 0x14);
out_uint8(s, 0x76);
out_uint8(s, 0x0a);
out_uint8(s, 1);
out_uint8(s, 1);
out_uint8(s, 0);
out_uint16_le(s, 0xc001);
out_uint8(s, 0);
out_uint8(s, 0x4d); /* M */
out_uint8(s, 0x63); /* c */
out_uint8(s, 0x44); /* D */
out_uint8(s, 0x6e); /* n */
/* GCC Response Total Length - 2 bytes , set later */
gcc_size_ptr = s->p; /* RDPGCCUserDataResponseLength */
out_uint8s(s, 2);
ud_ptr = s->p; /* User Data */
out_uint16_le(s, SEC_TAG_SRV_INFO);
if (self->mcs_layer->iso_layer->rdpNegData)
{
out_uint16_le(s, 12); /* len */
}
else
{
out_uint16_le(s, 8); /* len */
}
out_uint8(s, 4); /* 4 = rdp5 1 = rdp4 */
out_uint8(s, 0);
out_uint8(s, 8);
out_uint8(s, 0);
if (self->mcs_layer->iso_layer->rdpNegData)
{
/* ReqeustedProtocol */
out_uint32_le(s, self->mcs_layer->iso_layer->requestedProtocol);
}
out_uint16_le(s, SEC_TAG_SRV_CHANNELS);
out_uint16_le(s, 8 + (num_channels_even * 2)); /* len */
out_uint16_le(s, MCS_GLOBAL_CHANNEL); /* 1003, 0x03eb main channel */
out_uint16_le(s, num_channels); /* number of other channels */
for (index = 0; index < num_channels_even; index++)
{
if (index < num_channels)
{
channel = MCS_GLOBAL_CHANNEL + (index + 1);
out_uint16_le(s, channel);
}
else
{
out_uint16_le(s, 0);
}
}
if (self->rsa_key_bytes == 64)
{
g_writeln("xrdp_sec_out_mcs_data: using 512 bit RSA key");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 0x00ec); /* len is 236 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
out_uint32_le(s, 32); /* 32 bytes random len */
out_uint32_le(s, 0xb8); /* 184 bytes rsa info(certificate) len */
out_uint8a(s, self->server_random, 32);
/* here to end is certificate */
/* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ */
/* TermService\Parameters\Certificate */
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint16_le(s, SEC_TAG_PUBKEY); /* 0x0006 */
out_uint16_le(s, 0x005c); /* 92 bytes length of SEC_TAG_PUBKEY */
out_uint32_le(s, SEC_RSA_MAGIC); /* 0x31415352 'RSA1' */
out_uint32_le(s, 0x0048); /* 72 bytes modulus len */
out_uint32_be(s, 0x00020000); /* bit len */
out_uint32_be(s, 0x3f000000); /* data len */
out_uint8a(s, self->pub_exp, 4); /* pub exp */
out_uint8a(s, self->pub_mod, 64); /* pub mod */
out_uint8s(s, 8); /* pad */
out_uint16_le(s, SEC_TAG_KEYSIG); /* 0x0008 */
out_uint16_le(s, 72); /* len */
out_uint8a(s, self->pub_sig, 64); /* pub sig */
out_uint8s(s, 8); /* pad */
}
else if (self->rsa_key_bytes == 256)
{
g_writeln("xrdp_sec_out_mcs_data: using 2048 bit RSA key");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 0x01ac); /* len is 428 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
out_uint32_le(s, 32); /* 32 bytes random len */
out_uint32_le(s, 0x178); /* 376 bytes rsa info(certificate) len */
out_uint8a(s, self->server_random, 32);
/* here to end is certificate */
/* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ */
/* TermService\Parameters\Certificate */
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint16_le(s, SEC_TAG_PUBKEY); /* 0x0006 */
out_uint16_le(s, 0x011c); /* 284 bytes length of SEC_TAG_PUBKEY */
out_uint32_le(s, SEC_RSA_MAGIC); /* 0x31415352 'RSA1' */
out_uint32_le(s, 0x0108); /* 264 bytes modulus len */
out_uint32_be(s, 0x00080000); /* bit len */
out_uint32_be(s, 0xff000000); /* data len */
out_uint8a(s, self->pub_exp, 4); /* pub exp */
out_uint8a(s, self->pub_mod, 256); /* pub mod */
out_uint8s(s, 8); /* pad */
out_uint16_le(s, SEC_TAG_KEYSIG); /* 0x0008 */
out_uint16_le(s, 72); /* len */
out_uint8a(s, self->pub_sig, 64); /* pub sig */
out_uint8s(s, 8); /* pad */
}
else if (self->rsa_key_bytes == 0) /* no security */
{
g_writeln("xrdp_sec_out_mcs_data: using no security");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 12); /* len is 12 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
}
else
{
g_writeln("xrdp_sec_out_mcs_data: error");
}
/* end certificate */
s_mark_end(s);
gcc_size = (int)(s->end - ud_ptr) | 0x8000;
gcc_size_ptr[0] = gcc_size >> 8;
gcc_size_ptr[1] = gcc_size;
return 0;
}
/*****************************************************************************/ /*****************************************************************************/
/* returns error */ /* returns error */
static int APP_CC static int APP_CC
@ -719,10 +875,10 @@ xrdp_mcs_send_connect_response(struct xrdp_mcs *self)
make_stream(s); make_stream(s);
init_stream(s, 8192); init_stream(s, 8192);
data_len = (int) (self->server_mcs_data->end - self->server_mcs_data->data); data_len = (int) (self->server_mcs_data->end - self->server_mcs_data->data);
g_writeln("data len = %d , +36= %d", data_len, data_len+36);
xrdp_iso_init(self->iso_layer, s); xrdp_iso_init(self->iso_layer, s);
//TODO: 36 - tls , 38 - rdp - we should calculate that //TODO: we should calculate the whole length include MCS_CONNECT_RESPONSE
xrdp_mcs_ber_out_header(self, s, MCS_CONNECT_RESPONSE, data_len + 36); xrdp_mcs_ber_out_header(self, s, MCS_CONNECT_RESPONSE,
data_len > 0x80 ? data_len + 38 : data_len + 36);
xrdp_mcs_ber_out_header(self, s, BER_TAG_RESULT, 1); xrdp_mcs_ber_out_header(self, s, BER_TAG_RESULT, 1);
out_uint8(s, 0); out_uint8(s, 0);
xrdp_mcs_ber_out_header(self, s, BER_TAG_INTEGER, 1); xrdp_mcs_ber_out_header(self, s, BER_TAG_INTEGER, 1);
@ -751,31 +907,9 @@ xrdp_mcs_send_connect_response(struct xrdp_mcs *self)
int APP_CC int APP_CC
xrdp_mcs_incoming(struct xrdp_mcs *self) xrdp_mcs_incoming(struct xrdp_mcs *self)
{ {
int i;
DEBUG((" in xrdp_mcs_incoming")); DEBUG((" in xrdp_mcs_incoming"));
/* ISO */
if (xrdp_iso_incoming(self->iso_layer) != 0)
{
return 1;
}
/* TLS */
if (PROTOCOL_SSL & self->iso_layer->selectedProtocol)
{
g_writeln("xrdp_mcs_incoming: TLS mode!");
self->sec_layer->crypt_level = CRYPT_LEVEL_NONE;
self->sec_layer->crypt_method = CRYPT_METHOD_NONE;
self->sec_layer->rsa_key_bytes = 0;
if (xrdp_tls_accept(self->sec_layer->tls) != 0)
{
g_writeln("xrdp_mcs_incoming: ssl_tls_accept failed");
return 1;
}
g_writeln("xrdp_mcs_incoming: ssl_tls_accept done!!!!");
}
/* MCS */
if (xrdp_mcs_recv_connect_initial(self) != 0) if (xrdp_mcs_recv_connect_initial(self) != 0)
{ {
return 1; return 1;
@ -787,8 +921,7 @@ xrdp_mcs_incoming(struct xrdp_mcs *self)
return 1; return 1;
} }
/* in xrdp_sec.c */ if (xrdp_mcs_out_gcc_data(self->sec_layer) != 0)
if (xrdp_sec_out_mcs_data(self->sec_layer) != 0)
{ {
return 1; return 1;
} }
@ -813,25 +946,18 @@ xrdp_mcs_incoming(struct xrdp_mcs *self)
return 1; return 1;
} }
if (xrdp_mcs_recv_cjrq(self) != 0) for (i = 0 ; i < self->channel_list->count + 2 ; i++)
{ {
return 1; if (xrdp_mcs_recv_cjrq(self) != 0)
} {
return 1;
}
if (xrdp_mcs_send_cjcf(self, self->userid, if (xrdp_mcs_send_cjcf(self, self->userid,
self->userid + MCS_USERCHANNEL_BASE) != 0) self->userid + MCS_USERCHANNEL_BASE + i) != 0)
{ {
return 1; return 1;
} }
if (xrdp_mcs_recv_cjrq(self) != 0)
{
return 1;
}
if (xrdp_mcs_send_cjcf(self, self->userid, MCS_GLOBAL_CHANNEL) != 0)
{
return 1;
} }
DEBUG((" out xrdp_mcs_incoming")); DEBUG((" out xrdp_mcs_incoming"));
@ -960,6 +1086,7 @@ close_rdp_socket(struct xrdp_mcs *self)
{ {
if (self->iso_layer->trans != 0) if (self->iso_layer->trans != 0)
{ {
trans_shutdown_tls_mode(self->iso_layer->trans);
g_tcp_close(self->iso_layer->trans->sck); g_tcp_close(self->iso_layer->trans->sck);
self->iso_layer->trans->sck = 0 ; self->iso_layer->trans->sck = 0 ;
g_writeln("xrdp_mcs_disconnect - socket closed"); g_writeln("xrdp_mcs_disconnect - socket closed");
@ -982,8 +1109,7 @@ xrdp_mcs_disconnect(struct xrdp_mcs *self)
if (xrdp_iso_init(self->iso_layer, s) != 0) if (xrdp_iso_init(self->iso_layer, s) != 0)
{ {
xrdp_tls_disconnect(self->sec_layer->tls); free_stream(s);
free_stream(s);
close_rdp_socket(self); close_rdp_socket(self);
DEBUG((" out xrdp_mcs_disconnect error - 1")); DEBUG((" out xrdp_mcs_disconnect error - 1"));
return 1; return 1;
@ -995,14 +1121,12 @@ xrdp_mcs_disconnect(struct xrdp_mcs *self)
if (xrdp_iso_send(self->iso_layer, s) != 0) if (xrdp_iso_send(self->iso_layer, s) != 0)
{ {
xrdp_tls_disconnect(self->sec_layer->tls);
free_stream(s); free_stream(s);
close_rdp_socket(self); close_rdp_socket(self);
DEBUG((" out xrdp_mcs_disconnect error - 2")); DEBUG((" out xrdp_mcs_disconnect error - 2"));
return 1; return 1;
} }
xrdp_tls_disconnect(self->sec_layer->tls);
free_stream(s); free_stream(s);
close_rdp_socket(self); close_rdp_socket(self);
DEBUG(("xrdp_mcs_disconnect - close sent")); DEBUG(("xrdp_mcs_disconnect - close sent"));

46
libxrdp/xrdp_rdp.c
View File

@ -177,6 +177,38 @@ xrdp_rdp_read_config(struct xrdp_client_info *client_info)
client_info->security_layer = PROTOCOL_SSL | PROTOCOL_HYBRID | PROTOCOL_HYBRID_EX; client_info->security_layer = PROTOCOL_SSL | PROTOCOL_HYBRID | PROTOCOL_HYBRID_EX;
} }
} }
else if (g_strcasecmp(item, "certificate") == 0)
{
g_memset(client_info->certificate, 0, sizeof(char) * 1024);
if (value[0] != '/')
{
/* default certificate path */
g_snprintf(client_info->certificate, 1023, "%s/cert.pem", XRDP_CFG_PATH);
log_message(LOG_LEVEL_ALWAYS,"WARNING: Invalid x.509 certificate path defined, "
"default path will be used: %s", client_info->certificate);
}
else
{
/* use user defined certificate */
g_strncpy(client_info->certificate, value, 1023);
}
}
else if (g_strcasecmp(item, "key_file") == 0)
{
g_memset(client_info->key_file, 0, sizeof(char) * 1024);
if (value[0] != '/')
{
/* default key_file path */
g_snprintf(client_info->key_file, 1023, "%s/key.pem", XRDP_CFG_PATH);
log_message(LOG_LEVEL_ALWAYS,"WARNING: Invalid x.509 certificate path defined, "
"default path will be used: %s", client_info->key_file);
}
else
{
/* use user defined key_file */
g_strncpy(client_info->key_file, value, 1023);
}
}
} }
@ -253,10 +285,7 @@ xrdp_rdp_create(struct xrdp_session *session, struct trans *trans)
/* read ini settings */ /* read ini settings */
xrdp_rdp_read_config(&self->client_info); xrdp_rdp_read_config(&self->client_info);
/* create sec layer */ /* create sec layer */
self->sec_layer = xrdp_sec_create(self, trans, self->sec_layer = xrdp_sec_create(self, trans);
self->client_info.crypt_level,
self->client_info.channel_code,
self->client_info.multimon);
/* default 8 bit v1 color bitmap cache entries and size */ /* default 8 bit v1 color bitmap cache entries and size */
self->client_info.cache1_entries = 600; self->client_info.cache1_entries = 600;
self->client_info.cache1_size = 256; self->client_info.cache1_size = 256;
@ -352,6 +381,15 @@ xrdp_rdp_recv(struct xrdp_rdp *self, struct stream *s, int *code)
chan = 0; chan = 0;
error = xrdp_sec_recv(self->sec_layer, s, &chan); error = xrdp_sec_recv(self->sec_layer, s, &chan);
if (error == 3)
{
/* unencrypted confirm active msg arrived */
s->next_packet = 0;
*code = 3;
DEBUG(("out (0) xrdp_rdp_recv"));
return 0;
}
if (error == -1) /* special code for send demand active */ if (error == -1) /* special code for send demand active */
{ {
s->next_packet = 0; s->next_packet = 0;

455
libxrdp/xrdp_sec.c
View File

@ -222,91 +222,46 @@ hex_str_to_bin(char *in, char *out, int out_len)
/*****************************************************************************/ /*****************************************************************************/
struct xrdp_sec *APP_CC struct xrdp_sec *APP_CC
xrdp_sec_create(struct xrdp_rdp *owner, struct trans *trans, int crypt_level, xrdp_sec_create(struct xrdp_rdp *owner, struct trans *trans)
int channel_code, int multimon)
{ {
struct xrdp_sec *self; struct xrdp_sec *self;
DEBUG((" in xrdp_sec_create")); DEBUG((" in xrdp_sec_create"));
self = (struct xrdp_sec *)g_malloc(sizeof(struct xrdp_sec), 1); self = (struct xrdp_sec *) g_malloc(sizeof(struct xrdp_sec), 1);
self->rdp_layer = owner; self->rdp_layer = owner;
self->crypt_method = CRYPT_METHOD_NONE; self->crypt_method = CRYPT_METHOD_NONE; /* set later */
self->crypt_level = CRYPT_LEVEL_NONE; self->crypt_level = CRYPT_LEVEL_NONE;
switch (crypt_level) self->mcs_layer = xrdp_mcs_create(self, trans, &(self->client_mcs_data),
{ &(self->server_mcs_data));
case 1: /* low */ self->fastpath_layer = xrdp_fastpath_create(self, trans);
self->crypt_method = CRYPT_METHOD_40BIT; self->chan_layer = xrdp_channel_create(self, self->mcs_layer);
self->crypt_level = CRYPT_LEVEL_LOW; DEBUG((" out xrdp_sec_create"));
break;
case 2: /* medium */
self->crypt_method = CRYPT_METHOD_40BIT;
self->crypt_level = CRYPT_LEVEL_CLIENT_COMPATIBLE;
break;
case 3: /* high */
self->crypt_method = CRYPT_METHOD_128BIT;
self->crypt_level = CRYPT_LEVEL_HIGH;
break;
case 4: /* fips */
self->crypt_method = CRYPT_METHOD_FIPS;
self->crypt_level = CRYPT_LEVEL_FIPS;
break;
default:
g_writeln("Fatal : Illegal crypt_level");
break ;
}
self->channel_code = channel_code; return self;
self->multimon = multimon;
if (self->decrypt_rc4_info != NULL)
{
g_writeln("xrdp_sec_create - decrypt_rc4_info already created !!!");
}
self->decrypt_rc4_info = ssl_rc4_info_create();
if (self->encrypt_rc4_info != NULL)
{
g_writeln("xrdp_sec_create - encrypt_rc4_info already created !!!");
}
self->encrypt_rc4_info = ssl_rc4_info_create();
self->mcs_layer = xrdp_mcs_create(self, trans,
&(self->client_mcs_data),
&(self->server_mcs_data));
self->fastpath_layer = xrdp_fastpath_create(self, trans);
self->chan_layer = xrdp_channel_create(self, self->mcs_layer);
//TODO: add cert to config
self->tls = xrdp_tls_create(trans, "/opt/xrdpinstall/etc/xrdp/pkey.pem",
"/opt/xrdpinstall/etc/xrdp/cert.pem");
DEBUG((" out xrdp_sec_create"));
return self;
} }
/*****************************************************************************/ /*****************************************************************************/
void APP_CC void APP_CC
xrdp_sec_delete(struct xrdp_sec *self) xrdp_sec_delete(struct xrdp_sec *self) {
{
if (self == 0)
{
g_writeln("xrdp_sec_delete: indata is null");
return;
}
xrdp_channel_delete(self->chan_layer); if (self == 0) {
xrdp_mcs_delete(self->mcs_layer); g_writeln("xrdp_sec_delete: indata is null");
xrdp_fastpath_delete(self->fastpath_layer); return;
ssl_rc4_info_delete(self->decrypt_rc4_info); /* TODO clear all data */ }
ssl_rc4_info_delete(self->encrypt_rc4_info); /* TODO clear all data */
ssl_des3_info_delete(self->decrypt_fips_info); xrdp_channel_delete(self->chan_layer);
ssl_des3_info_delete(self->encrypt_fips_info); xrdp_mcs_delete(self->mcs_layer);
ssl_hmac_info_delete(self->sign_fips_info); xrdp_fastpath_delete(self->fastpath_layer);
xrdp_tls_delete(self->tls); ssl_rc4_info_delete(self->decrypt_rc4_info); /* TODO clear all data */
g_free(self->client_mcs_data.data); ssl_rc4_info_delete(self->encrypt_rc4_info); /* TODO clear all data */
g_free(self->server_mcs_data.data); ssl_des3_info_delete(self->decrypt_fips_info);
/* Crypto information must always be cleared */ ssl_des3_info_delete(self->encrypt_fips_info);
g_memset(self, 0, sizeof(struct xrdp_sec)); ssl_hmac_info_delete(self->sign_fips_info);
g_free(self); g_free(self->client_mcs_data.data);
g_free(self->server_mcs_data.data);
/* Crypto information must always be cleared */
g_memset(self, 0, sizeof(struct xrdp_sec));
g_free(self);
} }
/*****************************************************************************/ /*****************************************************************************/
@ -1046,9 +1001,23 @@ xrdp_sec_recv(struct xrdp_sec *self, struct stream *s, int *chan)
{ {
return 1; return 1;
} }
//TODO: HACK, we should recognize packets with sec header: client info, and license.
if (s->data[17] == 0x13) /* confirm active pdu */
{
g_writeln("CONFIRM ACTIVE ARRIVED");
in_uint8s(s, 6);
return 3;
}
if (s->data[17] == 0x17 || s->data[16] == 0x17) /* rdp data pdu */
{
g_writeln("RDP DATA ARRIVED");
return 0;
}
in_uint32_le(s, flags); in_uint32_le(s, flags);
DEBUG((" in xrdp_sec_recv flags $%x", flags)); DEBUG((" in xrdp_sec_recv flags $%x", flags));
g_writeln("userdata shareheaedr flags = %d", flags);
if (flags & SEC_ENCRYPT) /* 0x08 */ if (flags & SEC_ENCRYPT) /* 0x08 */
{ {
@ -1071,7 +1040,7 @@ xrdp_sec_recv(struct xrdp_sec *self, struct stream *s, int *chan)
xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p)); xrdp_sec_fips_decrypt(self, s->p, (int)(s->end - s->p));
s->end -= pad; s->end -= pad;
} }
else else if (self->crypt_level > CRYPT_LEVEL_NONE)
{ {
if (!s_check_rem(s, 8)) if (!s_check_rem(s, 8))
{ {
@ -1622,11 +1591,14 @@ xrdp_sec_process_mcs_data_channels(struct xrdp_sec *self, struct stream *s)
int num_channels; int num_channels;
int index; int index;
struct mcs_channel_item *channel_item; struct mcs_channel_item *channel_item;
struct xrdp_client_info *client_info = (struct xrdp_client_info *)NULL;
DEBUG(("processing channels, channel_code is %d", self->channel_code)); client_info = &(self->rdp_layer->client_info);
DEBUG(("processing channels, channel_code is %d", client_info->channel_code));
/* this is an option set in xrdp.ini */ /* this is an option set in xrdp.ini */
if (self->channel_code != 1) /* are channels on? */ if (client_info->channel_code != 1) /* are channels on? */
{ {
g_writeln("Processing channel data from client - The channel is off"); g_writeln("Processing channel data from client - The channel is off");
return 0; return 0;
@ -1675,9 +1647,9 @@ xrdp_sec_process_mcs_data_monitors(struct xrdp_sec *self, struct stream *s)
client_info = &(self->rdp_layer->client_info); client_info = &(self->rdp_layer->client_info);
DEBUG(("processing monitors data, allow_multimon is %d", self->multimon)); DEBUG(("processing monitors data, allow_multimon is %d", client_info->multimon));
/* this is an option set in xrdp.ini */ /* this is an option set in xrdp.ini */
if (self->multimon != 1) /* are multi-monitors allowed ? */ if (client_info->multimon != 1) /* are multi-monitors allowed ? */
{ {
DEBUG(("[INFO] xrdp_sec_process_mcs_data_monitors: multimon is not " DEBUG(("[INFO] xrdp_sec_process_mcs_data_monitors: multimon is not "
"allowed, skipping")); "allowed, skipping"));
@ -1818,164 +1790,6 @@ xrdp_sec_process_mcs_data(struct xrdp_sec *self)
return 0; return 0;
} }
/*****************************************************************************/
/* prepare server mcs data to send in mcs layer */
int APP_CC
xrdp_sec_out_mcs_data(struct xrdp_sec *self)
{
struct stream *s;
int num_channels_even;
int num_channels;
int index;
int channel;
int gcc_size;
char* gcc_size_ptr;
char* ud_ptr;
num_channels = self->mcs_layer->channel_list->count;
num_channels_even = num_channels + (num_channels & 1);
s = &(self->server_mcs_data);
init_stream(s, 8192);
out_uint16_be(s, 5); /* AsnBerObjectIdentifier */
out_uint16_be(s, 0x14);
out_uint8(s, 0x7c);
out_uint16_be(s, 1); /* -- */
out_uint8(s, 0x2a); /* ConnectPDULen */
out_uint8(s, 0x14);
out_uint8(s, 0x76);
out_uint8(s, 0x0a);
out_uint8(s, 1);
out_uint8(s, 1);
out_uint8(s, 0);
out_uint16_le(s, 0xc001);
out_uint8(s, 0);
out_uint8(s, 0x4d); /* M */
out_uint8(s, 0x63); /* c */
out_uint8(s, 0x44); /* D */
out_uint8(s, 0x6e); /* n */
/* GCC Response Total Length - 2 bytes , set later */
gcc_size_ptr = s->p; /* RDPGCCUserDataResponseLength */
out_uint8(s, 0);
ud_ptr = s->p; /* User Data */
out_uint16_le(s, SEC_TAG_SRV_INFO);
if (self->mcs_layer->iso_layer->rdpNegData)
{
out_uint16_le(s, 12); /* len */
}
else
{
out_uint16_le(s, 8); /* len */
}
out_uint8(s, 4); /* 4 = rdp5 1 = rdp4 */
out_uint8(s, 0);
out_uint8(s, 8);
out_uint8(s, 0);
if (self->mcs_layer->iso_layer->rdpNegData)
{
/* ReqeustedProtocol */
out_uint32_le(s, self->mcs_layer->iso_layer->requestedProtocol);
}
out_uint16_le(s, SEC_TAG_SRV_CHANNELS);
out_uint16_le(s, 8 + (num_channels_even * 2)); /* len */
out_uint16_le(s, MCS_GLOBAL_CHANNEL); /* 1003, 0x03eb main channel */
out_uint16_le(s, num_channels); /* number of other channels */
for (index = 0; index < num_channels_even; index++)
{
if (index < num_channels)
{
channel = MCS_GLOBAL_CHANNEL + (index + 1);
out_uint16_le(s, channel);
}
else
{
out_uint16_le(s, 0);
}
}
if (self->rsa_key_bytes == 64)
{
g_writeln("xrdp_sec_out_mcs_data: using 512 bit RSA key");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 0x00ec); /* len is 236 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
out_uint32_le(s, 32); /* 32 bytes random len */
out_uint32_le(s, 0xb8); /* 184 bytes rsa info(certificate) len */
out_uint8a(s, self->server_random, 32);
/* here to end is certificate */
/* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ */
/* TermService\Parameters\Certificate */
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint16_le(s, SEC_TAG_PUBKEY); /* 0x0006 */
out_uint16_le(s, 0x005c); /* 92 bytes length of SEC_TAG_PUBKEY */
out_uint32_le(s, SEC_RSA_MAGIC); /* 0x31415352 'RSA1' */
out_uint32_le(s, 0x0048); /* 72 bytes modulus len */
out_uint32_be(s, 0x00020000); /* bit len */
out_uint32_be(s, 0x3f000000); /* data len */
out_uint8a(s, self->pub_exp, 4); /* pub exp */
out_uint8a(s, self->pub_mod, 64); /* pub mod */
out_uint8s(s, 8); /* pad */
out_uint16_le(s, SEC_TAG_KEYSIG); /* 0x0008 */
out_uint16_le(s, 72); /* len */
out_uint8a(s, self->pub_sig, 64); /* pub sig */
out_uint8s(s, 8); /* pad */
}
else if (self->rsa_key_bytes == 256)
{
g_writeln("xrdp_sec_out_mcs_data: using 2048 bit RSA key");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 0x01ac); /* len is 428 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
out_uint32_le(s, 32); /* 32 bytes random len */
out_uint32_le(s, 0x178); /* 376 bytes rsa info(certificate) len */
out_uint8a(s, self->server_random, 32);
/* here to end is certificate */
/* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ */
/* TermService\Parameters\Certificate */
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint32_le(s, 1);
out_uint16_le(s, SEC_TAG_PUBKEY); /* 0x0006 */
out_uint16_le(s, 0x011c); /* 284 bytes length of SEC_TAG_PUBKEY */
out_uint32_le(s, SEC_RSA_MAGIC); /* 0x31415352 'RSA1' */
out_uint32_le(s, 0x0108); /* 264 bytes modulus len */
out_uint32_be(s, 0x00080000); /* bit len */
out_uint32_be(s, 0xff000000); /* data len */
out_uint8a(s, self->pub_exp, 4); /* pub exp */
out_uint8a(s, self->pub_mod, 256); /* pub mod */
out_uint8s(s, 8); /* pad */
out_uint16_le(s, SEC_TAG_KEYSIG); /* 0x0008 */
out_uint16_le(s, 72); /* len */
out_uint8a(s, self->pub_sig, 64); /* pub sig */
out_uint8s(s, 8); /* pad */
}
else if (self->rsa_key_bytes == 0) /* no security */
{
g_writeln("xrdp_sec_out_mcs_data: using no security");
out_uint16_le(s, SEC_TAG_SRV_CRYPT);
out_uint16_le(s, 12); /* len is 12 */
out_uint32_le(s, self->crypt_method);
out_uint32_le(s, self->crypt_level);
}
else
{
LLOGLN(0, ("xrdp_sec_out_mcs_data: error"));
}
/* end certificate */
s_mark_end(s);
gcc_size = (int)(s->end - ud_ptr);// | 0x8000;
gcc_size_ptr[0] = gcc_size;// >> 8;
//gcc_size_ptr[1] = gcc_size;
return 0;
}
/*****************************************************************************/ /*****************************************************************************/
/* process the mcs client data we received from the mcs layer */ /* process the mcs client data we received from the mcs layer */
static int APP_CC static int APP_CC
@ -2039,66 +1853,155 @@ xrdp_sec_in_mcs_data(struct xrdp_sec *self)
return 0; return 0;
} }
/*****************************************************************************/
/* returns error */
int APP_CC
xrdp_sec_init_rdp_security(struct xrdp_sec *self)
{
switch (self->rdp_layer->client_info.crypt_level)
{
case 1: /* low */
self->crypt_method = CRYPT_METHOD_40BIT;
self->crypt_level = CRYPT_LEVEL_LOW;
break;
case 2: /* medium */
self->crypt_method = CRYPT_METHOD_40BIT;
self->crypt_level = CRYPT_LEVEL_CLIENT_COMPATIBLE;
break;
case 3: /* high */
self->crypt_method = CRYPT_METHOD_128BIT;
self->crypt_level = CRYPT_LEVEL_HIGH;
break;
case 4: /* fips */
self->crypt_method = CRYPT_METHOD_FIPS;
self->crypt_level = CRYPT_LEVEL_FIPS;
break;
default:
g_writeln("Fatal : Illegal crypt_level");
break ;
}
if (self->decrypt_rc4_info != NULL)
{
g_writeln("xrdp_sec_init_rdp_security: decrypt_rc4_info already created !!!");
}
else
{
self->decrypt_rc4_info = ssl_rc4_info_create();
}
if (self->encrypt_rc4_info != NULL)
{
g_writeln("xrdp_sec_init_rdp_security: encrypt_rc4_info already created !!!");
}
else
{
self->encrypt_rc4_info = ssl_rc4_info_create();
}
return 0;
}
/*****************************************************************************/ /*****************************************************************************/
int APP_CC int APP_CC
xrdp_sec_incoming(struct xrdp_sec *self) xrdp_sec_incoming(struct xrdp_sec *self)
{ {
struct list *items = NULL; struct list *items = NULL;
struct list *values = NULL; struct list *values = NULL;
struct xrdp_iso *iso;
int index = 0; int index = 0;
char *item = NULL; char *item = NULL;
char *value = NULL; char *value = NULL;
char key_file[256]; char key_file[256];
g_memset(key_file, 0, sizeof(char) * 256); DEBUG((" in xrdp_sec_incoming:"));
DEBUG((" in xrdp_sec_incoming")); iso = self->mcs_layer->iso_layer;
g_random(self->server_random, 32);
items = list_create();
items->auto_free = 1;
values = list_create();
values->auto_free = 1;
g_snprintf(key_file, 255, "%s/rsakeys.ini", XRDP_CFG_PATH);
if (file_by_name_read_section(key_file, "keys", items, values) != 0) /* negotiate security layer */
if (xrdp_iso_incoming(iso) != 0)
{ {
/* this is a show stopper */ DEBUG(("xrdp_sec_incoming: xrdp_iso_incoming failed"));
log_message(LOG_LEVEL_ALWAYS, "XRDP cannot read file: %s "
"(check permissions)", key_file);
list_delete(items);
list_delete(values);
return 1; return 1;
} }
for (index = 0; index < items->count; index++) /* initialize selected security layer */
if (iso->requestedProtocol > PROTOCOL_RDP)
{ {
item = (char *)list_get_item(items, index); /* init tls security */
value = (char *)list_get_item(values, index); DEBUG((" in xrdp_sec_incoming: init tls security"));
if (g_strcasecmp(item, "pub_exp") == 0) if (trans_set_tls_mode(self->mcs_layer->iso_layer->trans,
self->rdp_layer->client_info.key_file,
self->rdp_layer->client_info.certificate) != 0)
{
g_writeln("xrdp_sec_incoming: trans_set_tls_mode failed");
return 1;
}
self->crypt_level = CRYPT_LEVEL_NONE;
self->crypt_method = CRYPT_METHOD_NONE;
self->rsa_key_bytes = 0;
}
else
{
/* init rdp security */
DEBUG((" in xrdp_sec_incoming: init rdp security"));
if (xrdp_sec_init_rdp_security(self) != 0)
{ {
hex_str_to_bin(value, self->pub_exp, 4); DEBUG(("xrdp_sec_incoming: xrdp_sec_init_rdp_security failed"));
return 1;
} }
else if (g_strcasecmp(item, "pub_mod") == 0)
g_memset(key_file, 0, sizeof(char) * 256);
g_random(self->server_random, 32);
items = list_create();
items->auto_free = 1;
values = list_create();
values->auto_free = 1;
g_snprintf(key_file, 255, "%s/rsakeys.ini", XRDP_CFG_PATH);
if (file_by_name_read_section(key_file, "keys", items, values) != 0)
{ {
self->rsa_key_bytes = (g_strlen(value) + 1) / 5; /* this is a show stopper */
g_writeln("pub_mod bytes %d", self->rsa_key_bytes); log_message(LOG_LEVEL_ALWAYS, "XRDP cannot read file: %s "
hex_str_to_bin(value, self->pub_mod, self->rsa_key_bytes); "(check permissions)", key_file);
list_delete(items);
list_delete(values);
return 1;
} }
else if (g_strcasecmp(item, "pub_sig") == 0)
for (index = 0; index < items->count; index++)
{ {
hex_str_to_bin(value, self->pub_sig, 64); item = (char *)list_get_item(items, index);
} value = (char *)list_get_item(values, index);
else if (g_strcasecmp(item, "pri_exp") == 0)
{ if (g_strcasecmp(item, "pub_exp") == 0)
self->rsa_key_bytes = (g_strlen(value) + 1) / 5; {
g_writeln("pri_exp %d", self->rsa_key_bytes); hex_str_to_bin(value, self->pub_exp, 4);
hex_str_to_bin(value, self->pri_exp, self->rsa_key_bytes); }
else if (g_strcasecmp(item, "pub_mod") == 0)
{
self->rsa_key_bytes = (g_strlen(value) + 1) / 5;
g_writeln("pub_mod bytes %d", self->rsa_key_bytes);
hex_str_to_bin(value, self->pub_mod, self->rsa_key_bytes);
}
else if (g_strcasecmp(item, "pub_sig") == 0)
{
hex_str_to_bin(value, self->pub_sig, 64);
}
else if (g_strcasecmp(item, "pri_exp") == 0)
{
self->rsa_key_bytes = (g_strlen(value) + 1) / 5;
g_writeln("pri_exp %d", self->rsa_key_bytes);
hex_str_to_bin(value, self->pri_exp, self->rsa_key_bytes);
}
} }
list_delete(items);
list_delete(values);
} }
list_delete(items); /* negotiate mcs layer */
list_delete(values);
if (xrdp_mcs_incoming(self->mcs_layer) != 0) if (xrdp_mcs_incoming(self->mcs_layer) != 0)
{ {
return 1; return 1;
@ -2117,6 +2020,7 @@ xrdp_sec_incoming(struct xrdp_sec *self)
{ {
return 1; return 1;
} }
LLOGLN(10, ("xrdp_sec_incoming: out")); LLOGLN(10, ("xrdp_sec_incoming: out"));
return 0; return 0;
} }
@ -2128,7 +2032,6 @@ xrdp_sec_disconnect(struct xrdp_sec *self)
int rv; int rv;
DEBUG((" in xrdp_sec_disconnect")); DEBUG((" in xrdp_sec_disconnect"));
rv = xrdp_mcs_disconnect(self->mcs_layer); rv = xrdp_mcs_disconnect(self->mcs_layer);
DEBUG((" out xrdp_sec_disconnect")); DEBUG((" out xrdp_sec_disconnect"));
return rv; return rv;

10
xrdp/xrdp.ini
View File

@ -5,11 +5,17 @@ ini_version=1
bitmap_cache=yes bitmap_cache=yes
bitmap_compression=yes bitmap_compression=yes
port=3389 port=3389
crypt_level=high
security_layer=rdp
allow_channels=true allow_channels=true
max_bpp=32 max_bpp=32
fork=yes fork=yes
crypt_level=high
# security layer can be 'tls', 'rdp' or 'negotiate'
# for client compatible layer
security_layer=rdp
# X.509 certificate and private key
# openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365
certificate=
key_file=
# regulate if the listening socket use socket option tcp_nodelay # regulate if the listening socket use socket option tcp_nodelay
# no buffering will be performed in the TCP stack # no buffering will be performed in the TCP stack

1
xrdp/xrdp_process.c
View File

@ -171,7 +171,6 @@ xrdp_process_data_in(struct trans *self)
pro->server_trans->extra_flags = 1; pro->server_trans->extra_flags = 1;
break; break;
} }
return 0; return 0;
} }