From: Adam Tkac Date: Wed, 21 Jul 2010 09:08:24 +0000 (+0000) Subject: [Development] Implement X509 VeNCrypt subtypes on the server side. X-Git-Tag: v1.0.90~208 X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=5bf73fbb2a3d9ca8374d8ac587785dc76bb3fb63;p=tigervnc.git [Development] Implement X509 VeNCrypt subtypes on the server side. git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4105 3789f03b-4d11-0410-bbf8-ca57d06f2519 --- diff --git a/common/rfb/Makefile.am b/common/rfb/Makefile.am index 7df6b6b9..4160a9d6 100644 --- a/common/rfb/Makefile.am +++ b/common/rfb/Makefile.am @@ -1,10 +1,10 @@ noinst_LTLIBRARIES = librfb.la VENCRYPT_HDRS = CSecurityTLS.h CSecurityTLSBase.h \ - SSecurityTLS.h SSecurityTLSBase.h + SSecurityTLS.h SSecurityTLSBase.h SSecurityX509.h VENCRYPT_SRCS = CSecurityTLS.cxx CSecurityTLSBase.cxx \ - SSecurityTLS.cxx SSecurityTLSBase.cxx + SSecurityTLS.cxx SSecurityTLSBase.cxx SSecurityX509.cxx HDRS = Blacklist.h CapsContainer.h CapsList.h CConnection.h \ CMsgHandler.h CMsgReader.h CMsgReaderV3.h CMsgWriter.h \ diff --git a/common/rfb/SSecurityVeNCrypt.cxx b/common/rfb/SSecurityVeNCrypt.cxx index c704d1e5..ac4f16f3 100644 --- a/common/rfb/SSecurityVeNCrypt.cxx +++ b/common/rfb/SSecurityVeNCrypt.cxx @@ -38,16 +38,6 @@ using namespace std; static LogWriter vlog("SVeNCrypt"); -StringParameter SSecurityVeNCrypt::X509_CertFile -("x509cert", - "specifies path to the x509 certificate in PEM format", - "", ConfServer); - -StringParameter SSecurityVeNCrypt::X509_KeyFile -("x509key", - "specifies path to the key of the x509 certificate in PEM format", - "", ConfServer); - SSecurityVeNCrypt::SSecurityVeNCrypt(Security *sec) : security(sec) { ssecurity = NULL; diff --git a/common/rfb/SSecurityVeNCrypt.h b/common/rfb/SSecurityVeNCrypt.h index 6201a7b7..37ff9096 100644 --- a/common/rfb/SSecurityVeNCrypt.h +++ b/common/rfb/SSecurityVeNCrypt.h @@ -42,8 +42,6 @@ namespace rfb { virtual int getType() const { return secTypeVeNCrypt; } virtual const char* getUserName() const { return NULL; } - static StringParameter X509_CertFile, X509_KeyFile; - protected: SSecurity *ssecurity; Security *security; diff --git a/common/rfb/SSecurityX509.cxx b/common/rfb/SSecurityX509.cxx new file mode 100644 index 00000000..82a2b02b --- /dev/null +++ b/common/rfb/SSecurityX509.cxx @@ -0,0 +1,90 @@ +/* + * Copyright (C) 2005 Martin Koegler + * Copyright (C) 2010 TigerVNC Team + * + * This is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this software; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, + * USA. + */ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#ifndef HAVE_GNUTLS +#error "This source should not be compiled without HAVE_GNUTLS defined" +#endif + +#include +#include + +#define DH_BITS 1024 + +using namespace rfb; + +StringParameter SSecurityX509::X509_CertFile +("x509cert", "specifies path to the x509 certificate in PEM format", "", ConfServer); + +StringParameter SSecurityX509::X509_KeyFile +("x509key", "specifies path to the key of the x509 certificate in PEM format", "", ConfServer); + +SSecurityX509::SSecurityX509() : dh_params(0), cert_cred(0) +{ + certfile = X509_CertFile.getData(); + keyfile = X509_KeyFile.getData(); +} + +SSecurityX509::~SSecurityX509() +{ + shutdown(); + if (dh_params) + gnutls_dh_params_deinit(dh_params); + if (cert_cred) + gnutls_certificate_free_credentials(cert_cred); + delete[] keyfile; + delete[] certfile; +} + +void SSecurityX509::freeResources() +{ + if (dh_params) + gnutls_dh_params_deinit(dh_params); + dh_params=0; + if (cert_cred) + gnutls_certificate_free_credentials(cert_cred); + cert_cred=0; +} + +void SSecurityX509::setParams(gnutls_session session) +{ + static const int kx_priority[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0}; + gnutls_kx_set_priority(session, kx_priority); + + if (gnutls_certificate_allocate_credentials(&cert_cred) < 0) + goto error; + if (gnutls_dh_params_init(&dh_params) < 0) + goto error; + if (gnutls_dh_params_generate2(dh_params, DH_BITS) < 0) + goto error; + gnutls_certificate_set_dh_params(cert_cred, dh_params); + if (gnutls_certificate_set_x509_key_file(cert_cred, certfile, keyfile,GNUTLS_X509_FMT_PEM) < 0) + throw AuthFailureException("load of key failed"); + if (gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred) < 0) + goto error; + return; + + error: + throw AuthFailureException("setParams failed"); +} + diff --git a/common/rfb/SSecurityX509.h b/common/rfb/SSecurityX509.h new file mode 100644 index 00000000..64fa6ec3 --- /dev/null +++ b/common/rfb/SSecurityX509.h @@ -0,0 +1,61 @@ +/* + * Copyright (C) 2006 OCCAM Financial Technology + * Copyright (C) 2010 TigerVNC Team + * + * This is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this software; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, + * USA. + */ + +#ifndef __S_SECURITY_X509_H__ +#define __S_SECURITY_X509_H__ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#ifndef HAVE_GNUTLS +#error "This header should not be compiled without HAVE_GNUTLS defined" +#endif + +#include +#include + +namespace rfb { + + class SSecurityX509 : public SSecurityTLSBase { + public: + SSecurityX509(); + virtual ~SSecurityX509(); + virtual int getType() const { return secTypeX509None; } + + static StringParameter X509_CertFile; + static StringParameter X509_KeyFile; + + protected: + virtual void freeResources(); + virtual void setParams(gnutls_session session); + + private: + static void initGlobal(); + + gnutls_dh_params dh_params; + gnutls_certificate_credentials cert_cred; + char* keyfile; + char* certfile; + }; + +} + +#endif /* __S_SECURITY_TLS_H__ */ diff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx index e6a51bcc..c6ab4107 100644 --- a/common/rfb/Security.cxx +++ b/common/rfb/Security.cxx @@ -41,6 +41,7 @@ #ifdef HAVE_GNUTLS #include #include +#include #endif #include @@ -126,6 +127,10 @@ SSecurity* Security::GetSSecurity(U32 secType) return new SSecurityStack(secTypeTLSNone, new SSecurityTLS()); case secTypeTLSVnc: return new SSecurityStack(secTypeTLSVnc, new SSecurityTLS(), new SSecurityVncAuth()); + case secTypeX509None: + return new SSecurityStack(secTypeX509None, new SSecurityX509()); + case secTypeX509Vnc: + return new SSecurityStack(secTypeX509None, new SSecurityX509(), new SSecurityVncAuth()); #endif }