52a2e6520a
Remove unused include
We should not be including server headers from client code. It was
not even needed, so simply remove it.
5 years ago
83eee75c26
Log TLS handshake result
Makes it easier to debug TLS issues, and to see the effect of
altering the priority string.
5 years ago
8105be9f31
Do not duplicate default string twice
5 years ago
06c1199c0a
Restore original streams when terminating TLS
In theory we could return to communicate without TLS after a
shutdown. It also makes sure the connection object isn't left
completely without streams.
5 years ago
1b7463478e
Delete TLS streams before deleting the session
The streams depend on the session and can crash the program if they
are removed in the wrong order. Do a general cleanup of the life time
management of the streams.
5 years ago
ad2b3c4aa3
Strongly bind security objects to connection object
There is already an implicit connection between them, so let's make
it explicit. This allows easy lookup outside of the processMsg() function.
5 years ago
50aaed49b6
Initialise CSecurityTLS::cert_cred properly
If we leave it at something random we'll get an invalid delete
if the handshake fails.
5 years ago
c04f756bd2
Use system certificate trust store
Makes it possible to use certificates from all popular CAs with
TigerVNC.
5 years ago
19225507cc
Make exception classes have clearer messages
Include the type of exception in the string generated by each
subclass. Also simplify the constructs to what is needed.
6 years ago
894f2c5197
Include server name in TLS handshake for SNI
In case the server is a front-end to multiple systems and needs to
know which system we're after.
6 years ago
e43e5e3051
Add better error message for insecure certificate algorithms
6 years ago
8aa4bc5320
Proper global init/deinit of GnuTLS
These are reference counted so it is important to retain symmetry
between the calls. Failure to do so will result in bad memory access
and crashes.
7 years ago
27eb55e197
Add parameter to override GnuTLS priority
9 years ago
88c24edd8f
Raise GnuTLS requirements to 3.x
This allows us to simplify things by getting rid of some old
compatibility code. People should really be using current versions
of GnuTLS anyway to stay secure.
9 years ago
800a35ccdd
Remove verbose TLS logging
We don't even log this much for RFB protocol stuff, and it makes
it very annoying to run with full debugging on.
9 years ago
3d2a84b9ea
Correct naming convention for some parameters
9 years ago
5ad4d06006
Remove a lot of platform compatibilty stuff
It's either not used, or no longer relevant.
9 years ago
fe48cd4d24
Refactor the TLS code so that the push/pull functions are aware of their
containing stream object. This is in preparation for supporting GnuTLS 3.x.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4921 3789f03b-4d11-0410-bbf8-ca57d06f2519
12 years ago
ad8609a2ed
Fix unsafe usage of the logging functions.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4905 3789f03b-4d11-0410-bbf8-ca57d06f2519
12 years ago
ce6c8b097f
[Security] vncviewer can send password without proper validation of X.509 certs
(CVE-2011-1775).
Reference: http://www.mail-archive.com/tigervnc-devel@lists.sourceforge.net/msg01342.html
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4401 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
348269d30b
[Bugfix] Register GNUTLS debug routines only when we actually need them.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4295 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
b486423692
[Bugfix] Improve compatibility with ancient GNUTLS implementations even more.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4278 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
68481c19eb
[Development] os: add gnutls_x509_crt_print() implementation, older systems
don't have it and improve backward compatibility of TLS code.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4277 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
e32573a56b
[Bugfix] client: improve server certificate verification code.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4276 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
44cdb1352a
[Bugfix] Call gnutls_bye only when handshake is completed.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4275 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
32020bf720
Oops. Checked in some debugging code.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4272 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
b7ab54f0df
Oops. Need to wait until after gnutls.h is included before checking the value of GNUTLS_VERSION_NUMBER
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4266 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
ff1e1ff941
Attempt to restore compatibility with older GnuTLS versions
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4264 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
f16a421570
[Bugfix] Print empty string by default when paths for X.509 certs don't exist.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4256 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
437b0c2fc3
[Bugfix] Append ".pem" suffix to saved certificates.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4254 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
af0817220e
[Development] Rename function "gethomedir" to "getvnchomedir" and rewrite it in
platform-intependent manner.
Thanks to Guillaume Destuynder.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4252 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
179d2b14ec
[Bugfix] CSecurityTLS.cxx: include os/print.h to get correct snprintf definition.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4240 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
c4674db3bd
[Bugfix] Don't include unistd.h and don't call access() on Windows.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4239 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
5d4c6acf92
[Bugfix] Use free() instead of gnutls_free() on Windows.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4238 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
27b2f773be
[Development] client: Add dialog window to accept/save invalid X509
certificates. (Guillaume Destuynder)
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4198 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
6948ead152
[Bugfix] Check return codes from gnutls library every time.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4120 3789f03b-4d11-0410-bbf8-ca57d06f2519
13 years ago
3c5be39e92
[Development] Rename CSecurityTLSBase class to CSecurityTLS.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4110 3789f03b-4d11-0410-bbf8-ca57d06f2519
14 years ago
0e61c34932
[Development] Merge CSecurityTLS and CSecurityX509 classes into CSecurityTLSBase class.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4109 3789f03b-4d11-0410-bbf8-ca57d06f2519
14 years ago
4395823664
[Bugfix] Add "#error" directives to client-side TLS sources to avoid wrong usage.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4104 3789f03b-4d11-0410-bbf8-ca57d06f2519
14 years ago
b10489b039
[Development] Implement VeNCrypt type support on client side. Currently only
TLSNone and TLSVnc VeNCrypt subtypes are implemented.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4046 3789f03b-4d11-0410-bbf8-ca57d06f2519
14 years ago
dfe19cfff8
[Development] Implement VeNCrypt security type on server side. Currently only
TLSNone and TLSVnc VeNCrypt subtypes are implemented.
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4045 3789f03b-4d11-0410-bbf8-ca57d06f2519
14 years ago
Pierre Ossman
Jan Grulich
Adam Tkac
DRC