diff options
| -rw-r--r-- | common/rfb/Makefile.am | 4 | ||||
| -rw-r--r-- | common/rfb/SSecurityVeNCrypt.cxx | 10 | ||||
| -rw-r--r-- | common/rfb/SSecurityVeNCrypt.h | 2 | ||||
| -rw-r--r-- | common/rfb/SSecurityX509.cxx | 90 | ||||
| -rw-r--r-- | common/rfb/SSecurityX509.h | 61 | ||||
| -rw-r--r-- | common/rfb/Security.cxx | 5 |
6 files changed, 158 insertions, 14 deletions
diff --git a/common/rfb/Makefile.am b/common/rfb/Makefile.am index 7df6b6b9..4160a9d6 100644 --- a/common/rfb/Makefile.am +++ b/common/rfb/Makefile.am @@ -1,10 +1,10 @@ noinst_LTLIBRARIES = librfb.la VENCRYPT_HDRS = CSecurityTLS.h CSecurityTLSBase.h \ - SSecurityTLS.h SSecurityTLSBase.h + SSecurityTLS.h SSecurityTLSBase.h SSecurityX509.h VENCRYPT_SRCS = CSecurityTLS.cxx CSecurityTLSBase.cxx \ - SSecurityTLS.cxx SSecurityTLSBase.cxx + SSecurityTLS.cxx SSecurityTLSBase.cxx SSecurityX509.cxx HDRS = Blacklist.h CapsContainer.h CapsList.h CConnection.h \ CMsgHandler.h CMsgReader.h CMsgReaderV3.h CMsgWriter.h \ diff --git a/common/rfb/SSecurityVeNCrypt.cxx b/common/rfb/SSecurityVeNCrypt.cxx index c704d1e5..ac4f16f3 100644 --- a/common/rfb/SSecurityVeNCrypt.cxx +++ b/common/rfb/SSecurityVeNCrypt.cxx @@ -38,16 +38,6 @@ using namespace std; static LogWriter vlog("SVeNCrypt");
-StringParameter SSecurityVeNCrypt::X509_CertFile
-("x509cert",
- "specifies path to the x509 certificate in PEM format",
- "", ConfServer);
-
-StringParameter SSecurityVeNCrypt::X509_KeyFile
-("x509key",
- "specifies path to the key of the x509 certificate in PEM format",
- "", ConfServer);
-
SSecurityVeNCrypt::SSecurityVeNCrypt(Security *sec) : security(sec)
{
ssecurity = NULL;
diff --git a/common/rfb/SSecurityVeNCrypt.h b/common/rfb/SSecurityVeNCrypt.h index 6201a7b7..37ff9096 100644 --- a/common/rfb/SSecurityVeNCrypt.h +++ b/common/rfb/SSecurityVeNCrypt.h @@ -42,8 +42,6 @@ namespace rfb { virtual int getType() const { return secTypeVeNCrypt; }
virtual const char* getUserName() const { return NULL; }
- static StringParameter X509_CertFile, X509_KeyFile;
-
protected:
SSecurity *ssecurity;
Security *security;
diff --git a/common/rfb/SSecurityX509.cxx b/common/rfb/SSecurityX509.cxx new file mode 100644 index 00000000..82a2b02b --- /dev/null +++ b/common/rfb/SSecurityX509.cxx @@ -0,0 +1,90 @@ +/* + * Copyright (C) 2005 Martin Koegler + * Copyright (C) 2010 TigerVNC Team + * + * This is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This software is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this software; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, + * USA. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#ifndef HAVE_GNUTLS +#error "This source should not be compiled without HAVE_GNUTLS defined" +#endif + +#include <rfb/SSecurityX509.h> +#include <rfb/Exception.h> + +#define DH_BITS 1024 + +using namespace rfb; + +StringParameter SSecurityX509::X509_CertFile +("x509cert", "specifies path to the x509 certificate in PEM format", "", ConfServer); + +StringParameter SSecurityX509::X509_KeyFile +("x509key", "specifies path to the key of the x509 certificate in PEM format", "", ConfServer); + +SSecurityX509::SSecurityX509() : dh_params(0), cert_cred(0) +{ + certfile = X509_CertFile.getData(); + keyfile = X509_KeyFile.getData(); +} + +SSecurityX509::~SSecurityX509() +{ + shutdown(); + if (dh_params) + gnutls_dh_params_deinit(dh_params); + if (cert_cred) + gnutls_certificate_free_credentials(cert_cred); + delete[] keyfile; + delete[] certfile; +} + +void SSecurityX509::freeResources() +{ + if (dh_params) + gnutls_dh_params_deinit(dh_params); + dh_params=0; + if (cert_cred) + gnutls_certificate_free_credentials(cert_cred); + cert_cred=0; +} + +void SSecurityX509::setParams(gnutls_session session) +{ + static const int kx_priority[] = {GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0}; + gnutls_kx_set_priority(session, kx_priority); + + if (gnutls_certificate_allocate_credentials(&cert_cred) < 0) + goto error; + if (gnutls_dh_params_init(&dh_params) < 0) + goto error; + if (gnutls_dh_params_generate2(dh_params, DH_BITS) < 0) + goto error; + gnutls_certificate_set_dh_params(cert_cred, dh_params); + if (gnutls_certificate_set_x509_key_file(cert_cred, certfile, keyfile,GNUTLS_X509_FMT_PEM) < 0) + throw AuthFailureException("load of key failed"); + if (gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred) < 0) + goto error; + return; + + error: + throw AuthFailureException("setParams failed"); +} + diff --git a/common/rfb/SSecurityX509.h b/common/rfb/SSecurityX509.h new file mode 100644 index 00000000..64fa6ec3 --- /dev/null +++ b/common/rfb/SSecurityX509.h @@ -0,0 +1,61 @@ +/*
+ * Copyright (C) 2006 OCCAM Financial Technology
+ * Copyright (C) 2010 TigerVNC Team
+ *
+ * This is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this software; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+ * USA.
+ */
+
+#ifndef __S_SECURITY_X509_H__
+#define __S_SECURITY_X509_H__
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef HAVE_GNUTLS
+#error "This header should not be compiled without HAVE_GNUTLS defined"
+#endif
+
+#include <rfb/SSecurityTLSBase.h>
+#include <rfb/SSecurityVeNCrypt.h>
+
+namespace rfb {
+
+ class SSecurityX509 : public SSecurityTLSBase {
+ public:
+ SSecurityX509();
+ virtual ~SSecurityX509();
+ virtual int getType() const { return secTypeX509None; }
+
+ static StringParameter X509_CertFile;
+ static StringParameter X509_KeyFile;
+
+ protected:
+ virtual void freeResources();
+ virtual void setParams(gnutls_session session);
+
+ private:
+ static void initGlobal();
+
+ gnutls_dh_params dh_params;
+ gnutls_certificate_credentials cert_cred;
+ char* keyfile;
+ char* certfile;
+ };
+
+}
+
+#endif /* __S_SECURITY_TLS_H__ */
diff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx index e6a51bcc..c6ab4107 100644 --- a/common/rfb/Security.cxx +++ b/common/rfb/Security.cxx @@ -41,6 +41,7 @@ #ifdef HAVE_GNUTLS #include <rfb/CSecurityTLS.h> #include <rfb/SSecurityTLS.h> +#include <rfb/SSecurityX509.h> #endif #include <rfb/util.h> @@ -126,6 +127,10 @@ SSecurity* Security::GetSSecurity(U32 secType) return new SSecurityStack(secTypeTLSNone, new SSecurityTLS()); case secTypeTLSVnc: return new SSecurityStack(secTypeTLSVnc, new SSecurityTLS(), new SSecurityVncAuth()); + case secTypeX509None: + return new SSecurityStack(secTypeX509None, new SSecurityX509()); + case secTypeX509Vnc: + return new SSecurityStack(secTypeX509None, new SSecurityX509(), new SSecurityVncAuth()); #endif } |