From 38b55a056b7c3d74f0cd14d5303268d137ec77a9 Mon Sep 17 00:00:00 2001 From: runge Date: Tue, 21 Nov 2006 21:57:22 +0000 Subject: [PATCH] rename --- .../misc/enhanced_tightvnc_viewer/bin/ssvnc | 78 + .../enhanced_tightvnc_viewer/bin/ssvnc_cmd | 158 + .../bin/util/ss_vncviewer | 638 ++ .../bin/util/ssvnc.tcl | 6675 +++++++++++++++++ 4 files changed, 7549 insertions(+) create mode 100755 x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc create mode 100755 x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc_cmd create mode 100755 x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ss_vncviewer create mode 100755 x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ssvnc.tcl diff --git a/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc b/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc new file mode 100755 index 0000000..a077054 --- /dev/null +++ b/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc @@ -0,0 +1,78 @@ +#!/bin/sh +# +# Copyright (c) 2006 by Karl J. Runge +# +# ssl_vnc_gui: +# +# A wrapper for ssl_tightvncviewer using a tcl/tk gui. +# +# See ssl_tightvncviewer for details. +# +if [ "X$XTERM_PRINT" != "X" ]; then + XTERM_PRINT="" + cat > /dev/null +fi +if [ "X$1" = "X-bg" ]; then + shift + $0 "$@" & + exit 0 +fi + +PATH=$PATH:/usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/openwin/bin +export PATH + + +SSL_VNC_GUI_CMD="$0 $*" +export SSL_VNC_GUI_CMD +SSL_VNC_LAUNCH=$SSL_VNC_GUI_CMD +export SSL_VNC_LAUNCH + +# work out os.arch platform string and check for binaries: +# +name=$UNAME +if [ "X$name" = "X" ]; then + name=`uname -sm | sed -e 's/ /./g'` +fi + +f="$0" +for t in 1 2 3 4 5 +do + if [ -L "$f" ]; then + f0="$f" + f=`ls -l "$f" | sed -e 's/^.* -> //'` + if echo "$f" | grep '^/' > /dev/null; then + : + else + f="`dirname "$f0"`/$f" + fi + else + break + fi +done +dir=`dirname "$f"` + +if [ ! -d "$dir/$name" ]; then + echo "cannot find platform dir: $dir/$name for your OS:" + uname -sm + echo "you can set the \$UNAME env. var. to override the setting." + exit 1 +fi + +# Put our os.arch and other utils dirs at head of PATH to be sure to +# pick them up: +# +PATH="$dir:$dir/$name:$dir/util:$PATH" +if echo "$dir" | grep '^/' > /dev/null; then + : +else + dir=`pwd`/$dir + PATH="$dir:$dir/$name:$dir/util:$PATH" +fi + +SSL_VNC_BASEDIR="$dir" +export SSL_VNC_BASEDIR + +STUNNEL_EXTRA_OPTS=${STUNNEL_EXTRA_OPTS:-"maxconn = 1"} +export STUNNEL_EXTRA_OPTS + +exec ssl_tightvncviewer.tcl "$@" diff --git a/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc_cmd b/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc_cmd new file mode 100755 index 0000000..3f0de56 --- /dev/null +++ b/x11vnc/misc/enhanced_tightvnc_viewer/bin/ssvnc_cmd @@ -0,0 +1,158 @@ +#!/bin/sh +# +# Copyright (c) 2006 by Karl J. Runge +# +# ssl_tightvncviewer: +# +# A wrapper that calls ssl_vncviewer to use the enhanced TightVNC viewer. +# +# The enhanced TightVNC viewer features are: +# +# - SSL support for connections using the co-bundled stunnel program. +# - rfbNewFBSize VNC support (screen resizing) +# - cursor alphablending with x11vnc at 32bpp +# - xgrabserver support for fullscreen mode (for old window mgrs) +# +# +# Your platform (e.g. Linux.i686) is autodetected and enhanced +# vncviewer and stunnel binaries for it are used (see the ./bin directory). +# +# See the build.unix script if your platform is not in this package. +# You can also set the env. var. UNAME=os.arch to any "os.arch" you want +# to override the autodetetion. +# +# Usage: +# +# ssl_tightvncviewer [ssl_vncviewer-args] hostname:N [tightvncviewer-args] +# +# "hostname:N" is the host and VNC display to connect to, e.g. snoopy:0 +# +# See the script util/ssl_vncviewer for details about its arguments: +# +# -verify pemfile +# -mycert pemfile +# -proxy phost:pport +# -alpha +# -grab +# +# +# If the *very first* argument is "-cotvnc" then it is assumed you are on +# Darwin and want to run the Chicken of the VNC viewer via our wrapper. +# +# +# See the TightVNC viewer documentation for on its cmdline arguments. +# +# For convenience, here is the current (7/2006) TightVNC viewer -help output: +# +# TightVNC viewer version 1.3dev5 +# +# Usage: vncviewer [] [][:] +# vncviewer [] [][::] +# vncviewer [] -listen [] +# vncviewer -help +# +# are standard Xt options, or: +# -via +# -shared (set by default) +# -noshared +# -viewonly +# -fullscreen +# -noraiseonbeep +# -passwd (standard VNC authentication) +# -user (Unix login authentication) +# -encodings (e.g. "tight copyrect") +# -bgr233 +# -owncmap +# -truecolour +# -depth +# -compresslevel (0..9: 0-fast, 9-best) +# -quality (0..9: 0-low, 9-high) +# -nojpeg +# -nocursorshape +# -x11cursor +# -autopass +# +# Option names may be abbreviated, e.g. -bgr instead of -bgr233. +# See the manual page for more information. +# + +if [ "X$1" = "X-h" -o "X$1" = "X-help" -o "X$1" = "X--help" ]; then + head -76 "$0" | grep -v bin/sh + exit +fi + +# Include /usr/bin... to be sure to get regular utilities: +# +PATH=$PATH:/usr/bin:/bin +export PATH + +# Set this for ssl_vncviewer to pick up: +# +use_ours=0 +if [ "X$1" = "X-cotvnc" ]; then + shift + DARWIN_COTVNC=1 + export DARWIN_COTVNC +fi +if [ "X$VNCVIEWERCMD" = "X" ]; then + VNCVIEWERCMD="vncviewer" + export VNCVIEWERCMD + if [ "X$DARWIN_COTVNC" = "X" ]; then + use_ours=1 + fi +fi + +# work out os.arch platform string and check for binaries: +# +name=$UNAME +if [ "X$name" = "X" ]; then + name=`uname -sm | sed -e 's/ /./g'` +fi + +f="$0" +for t in 1 2 3 4 5 +do + if [ -L "$f" ]; then + f0="$f" + f=`ls -l "$f" | sed -e 's/^.* -> //'` + if echo "$f" | grep '^/' > /dev/null; then + : + else + f="`dirname "$f0"`/$f" + fi + else + break + fi +done +dir=`dirname "$f"` + +if [ ! -d "$dir/$name" ]; then + echo "cannot find platform dir: $dir/$name for your OS:" + uname -sm + echo "you can set the \$UNAME env. var. to override the setting." + exit 1 +fi + +# Put our os.arch and other utils dirs at head of PATH to be sure to +# pick them up: +# +PATH="$dir:$dir/$name:$dir/util:$PATH" +if echo "$dir" | grep '^/' > /dev/null; then + : +else + dir=`pwd`/$dir + PATH="$dir:$dir/$name:$dir/util:$PATH" +fi + +STUNNEL_EXTRA_OPTS=${STUNNEL_EXTRA_OPTS:-"maxconn = 1"} +export STUNNEL_EXTRA_OPTS + +# If ours (and not cotvnc), force the use of tight encoding for localhost +# redir connection: +# +# +if [ $use_ours = 1 ]; then + ssl_vncviewer "$@" -encodings 'copyrect tight zrle zlib hextile' +else + ssl_vncviewer "$@" +fi diff --git a/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ss_vncviewer b/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ss_vncviewer new file mode 100755 index 0000000..0477eee --- /dev/null +++ b/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ss_vncviewer @@ -0,0 +1,638 @@ +#!/bin/sh +# +# ssl_vncviewer: wrapper for vncviewer to use an stunnel SSL tunnel +# or an SSH tunnel. +# +# Copyright (c) 2006 by Karl J. Runge +# +# You must have stunnel(8) installed on the system and in your PATH +# (however, see the -ssh option below, in which case you will need ssh(1) +# installed) Note: stunnel is usually installed in an "sbin" subdirectory. +# +# You should have "x11vnc -ssl ..." or "x11vnc -stunnel ..." +# already running as the VNC server on the remote machine. +# (or use stunnel on the server side for any other VNC server) +# +# +# Usage: ssl_vncviewer [cert-args] host:display +# +# e.g.: ssl_vncviewer snoopy:0 +# ssl_vncviewer snoopy:0 -encodings "copyrect tight zrle hextile" +# +# [cert-args] can be: +# +# -verify /path/to/cacert.pem +# -mycert /path/to/mycert.pem +# -proxy host:port +# +# -verify specifies a CA cert PEM file (or a self-signed one) for +# authenticating the VNC server. +# +# -mycert specifies this client's cert+key PEM file for the VNC server to +# authenticate this client. +# +# -proxy try host:port as a Web proxy to use the CONNECT method +# to reach the VNC server (e.g. your firewall requires a proxy). +# +# For the "double proxy" case use -proxy host1:port1,host2:port2 +# (the first CONNECT is done through host1:port1 to host2:port2 +# and then a 2nd CONNECT to the destination VNC server.) +# +# See http://www.karlrunge.com/x11vnc/#faq-ssl-ca for details on SSL +# certificates with VNC. +# +# A few other args (not related to SSL and certs): +# +# -ssh Use ssh instead of stunnel SSL. ssh(1) must be installed and you +# must be able to log into the remote machine via ssh. +# +# In this case "host:display" may be of the form "user@host:display" +# where "user@host" is used for the ssh login (see ssh(1) manpage). +# +# If -proxy is supplied it can be of the forms: "gwhost" "gwhost:port" +# "user@gwhost" or "user@gwhost:port". "gwhost" is an incoming ssh +# gateway machine (the VNC server is not running there), an ssh -L +# redir is used to "host" in "host:display" from "gwhost". Any "user@" +# part must be in the -proxy string (not in "host:display"). +# +# Under -proxy use "gwhost:port" if connecting to any ssh port +# other than the default (22). (even for the non-gateway case, +# -proxy must be used to specify a non-standard ssh port) +# +# A "double ssh" can be specified via a -proxy string with the two +# hosts separated by a comma: +# +# [user1@]host1[:port1],[user2@]host2[:port2] +# +# in which case a ssh to host1 and thru it via a -L redir a 2nd +# ssh is established to host2. +# +# Examples: +# +# ssl_vncviewer -ssh bob@bobs-home.net:0 +# ssl_vncviewer -ssh -sshcmd 'x11vnc -localhost' bob@bobs-home.net:0 +# +# ssl_vncviewer -ssh -proxy fred@mygate.com:2022 mymachine:0 +# ssl_vncviewer -ssh -proxy bob@bobs-home.net:2222 localhost:0 +# +# ssl_vncviewer -ssh -proxy fred@gw-host,fred@peecee localhost:0 +# +# -sshcmd cmd Run "cmd" via ssh instead of the default "sleep 15" +# e.g. -sshcmd 'x11vnc -display :0 -localhost -rfbport 5900' +# +# -sshargs "args" pass "args" to the ssh process, e.g. -L/-R port redirs. +# +# -sshssl Tunnel the SSL connection thru a SSH connection. The tunnel as +# under -ssh is set up and the SSL connection goes thru it. Use +# this if you want to have and end-to-end SSL connection but must +# go thru a SSH gateway host (e.g. not the vnc server). Or use +# this if you need to tunnel additional services via -R and -L +# (see -sshargs above). +# +# ssl_vncviewer -sshssl -proxy fred@mygate.com mymachine:0 +# +# +# -alpha turn on cursor alphablending hack if you are using the +# enhanced tightvnc vncviewer. +# +# -grab turn on XGrabServer hack if you are using the enhanced tightvnc +# vncviewer (e.g. for fullscreen mode in some windowmanagers like +# fvwm that do not otherwise work in fullscreen mode) +# +# +# set VNCVIEWERCMD to whatever vncviewer command you want to use. +# +VNCIPCMD=${VNCVIEWERCMD:-vncip} +VNCVIEWERCMD=${VNCVIEWERCMD:-vncviewer} +# +# Same for STUNNEL, e.g. set it to /path/to/stunnel or stunnel4, etc. +# + +PATH=$PATH:/usr/sbin:/usr/local/sbin:/dist/sbin; export PATH + +if [ "X$STUNNEL" = "X" ]; then + type stunnel4 > /dev/null 2>&1 + if [ $? = 0 ]; then + STUNNEL=stunnel4 + else + STUNNEL=stunnel + fi +fi + +help() { + tail +2 "$0" | sed -e '/^$/ q' +} + +gotalpha="" +use_ssh="" +use_sshssl="" +direct_connect="" +ssh_sleep=15 +ssh_cmd="sleep $ssh_sleep" +if [ "X$SSL_VNCVIEWER_SSH_CMD" != "X" ]; then + ssh_cmd="$SSL_VNCVIEWER_SSH_CMD" +fi +ssh_args="" + +# grab our cmdline options: +while [ "X$1" != "X" ] +do + case $1 in + "-verify") shift; verify="$1" + ;; + "-mycert") shift; mycert="$1" + ;; + "-proxy") shift; proxy="$1" + ;; + "-ssh") use_ssh=1 + ;; + "-sshssl") use_ssh=1 + use_sshssl=1 + ;; + "-sshcmd") shift; ssh_cmd="$1" + ;; + "-sshargs") shift; ssh_args="$1" + ;; + "-alpha") gotalpha=1 + ;; + "-grab") VNCVIEWER_GRAB_SERVER=1; export VNCVIEWER_GRAB_SERVER + ;; + "-h"*) help; exit 0 + ;; + "--h"*) help; exit 0 + ;; + *) break + ;; + esac + shift +done + +if [ "X$gotalpha" != "X1" ]; then + NO_ALPHABLEND=1 + export NO_ALPHABLEND +fi + +orig="$1" +shift + +if [ "X$use_ssh" = "X1" -a "X$use_sshssl" = "X" ]; then + if [ "X$mycert" != "X" -o "X$verify" != "X" ]; then + echo "-mycert and -verify cannot be used in -ssh mode" + exit 1 + fi +fi + +if echo "$orig" | grep '^vnc://' > /dev/null; then + orig=`echo "$orig" | sed -e 's,vnc://,,'` + verify="" + mycert="" + use_ssh="" + use_sshssl="" + direct_connect=1 +fi + +# play around with host:display port: +if echo "$orig" | grep ':' > /dev/null; then + : +else + orig="$orig:0" +fi + +host=`echo "$orig" | awk -F: '{print $1}'` +disp=`echo "$orig" | awk -F: '{print $2}'` +if [ "X$host" = "X" ]; then + host=localhost +fi +if [ $disp -lt 200 ]; then + port=`expr $disp + 5900` +else + port=$disp +fi + +# try to find an open listening port via netstat(1): +inuse="" +if uname | grep Linux > /dev/null; then + inuse=`netstat -ant | egrep 'LISTEN|WAIT|ESTABLISH|CLOSE' | awk '{print $4}' | sed 's/^.*://'` +elif uname | grep SunOS > /dev/null; then + inuse=`netstat -an -f inet -P tcp | grep LISTEN | awk '{print $1}' | sed 's/^.*\.//'` +# add others... +fi + +date_sec=`date +%S` + +findfree() { + try0=$1 + try=$try0 + use0="" + + while [ $try -lt 6000 ] + do + if [ "X$inuse" = "X" ]; then + break + fi + if echo "$inuse" | grep -w $try > /dev/null; then + : + else + use0=$try + break + fi + try=`expr $try + 1` + done + if [ "X$use0" = "X" ]; then + use0=`expr $date_sec + $try0` + fi + + echo $use0 +} + +use=`findfree 5930` + +if [ $use -ge 5900 ]; then + N=`expr $use - 5900` +else + N=$use +fi + +if echo "$0" | grep vncip > /dev/null; then + VNCVIEWERCMD="$VNCIPCMD" +fi + +if [ "X$use_ssh" = "X1" ]; then + ssh_port="22" + ssh_host="$host" + vnc_host="localhost" + ssh=${SSH:-"ssh -x"} + if echo "$proxy" | grep "," > /dev/null; then + proxy1=`echo "$proxy" | awk -F, '{print $1}'` + proxy2=`echo "$proxy" | awk -F, '{print $2}'` + # user1@gw1.com:port1,user2@ws2:port2 + ssh_host1=`echo "$proxy1" | awk -F: '{print $1}'` + ssh_port1=`echo "$proxy1" | awk -F: '{print $2}'` + if [ "X$ssh_port1" = "X" ]; then + ssh_port1="22" + fi + ssh_host2=`echo "$proxy2" | awk -F: '{print $1}'` + ssh_user2=`echo "$ssh_host2" | awk -F@ '{print $1}'` + ssh_host2=`echo "$ssh_host2" | awk -F@ '{print $2}'` + if [ "X$ssh_host2" = "X" ]; then + ssh_host2=$ssh_user2 + ssh_user2="" + else + ssh_user2="${ssh_user2}@" + fi + ssh_port2=`echo "$proxy2" | awk -F: '{print $2}'` + if [ "X$ssh_port2" = "X" ]; then + ssh_port2="22" + fi + proxport=`findfree 3500` + echo + echo "Running 1st ssh proxy:" + echo "$ssh -f -x -p $ssh_port1 -t -e none -L $proxport:$ssh_host2:$ssh_port2 $ssh_host1 \"sleep 30\"" + $ssh -f -x -p $ssh_port1 -t -e none -L $proxport:$ssh_host2:$ssh_port2 $ssh_host1 "sleep 30" + ssh_args="$ssh_args -o NoHostAuthenticationForLocalhost=yes" + sleep 1 + stty sane + proxy="${ssh_user2}localhost:$proxport" + fi + if [ "X$proxy" != "X" ]; then + ssh_port=`echo "$proxy" | awk -F: '{print $2}'` + if [ "X$ssh_port" = "X" ]; then + ssh_port="22" + fi + ssh_host=`echo "$proxy" | awk -F: '{print $1}'` + vnc_host="$host" + fi + echo "" + echo "Running ssh:" + sz=`echo "$ssh_cmd" | wc -c` + if [ "$sz" -gt 200 ]; then + info="..." + else + info="$ssh_cmd" + fi + + C="" + if [ "X$SSL_VNCVIEWER_USE_C" != "X" ]; then + C="-C" + fi + # the -t option actually speeds up typing response via VNC!! + if [ "X$SSL_VNCVIEWER_SSH_ONLY" != "X" ]; then + echo "$ssh -x -p $ssh_port -t $C $ssh_args $ssh_host \"$info\"" + echo "" + $ssh -x -p $ssh_port -t $C $ssh_args $ssh_host "$ssh_cmd" + exit $? + elif [ "X$SSL_VNCVIEWER_NO_F" != "X" ]; then + echo "$ssh -x -p $ssh_port -t $C -L ${use}:${vnc_host}:${port} $ssh_args $ssh_host \"$info\"" + echo "" + $ssh -x -p $ssh_port -t $C -L ${use}:${vnc_host}:${port} $ssh_args $ssh_host "$ssh_cmd" + else + echo "$ssh -x -f -p $ssh_port -t $C -L ${use}:${vnc_host}:${port} $ssh_args $ssh_host \"$info\"" + echo "" + $ssh -x -f -p $ssh_port -t $C -L ${use}:${vnc_host}:${port} $ssh_args $ssh_host "$ssh_cmd" + fi + if [ "$?" != "0" ]; then + echo "" + echo "ssh to $ssh_host failed." + exit 1 + fi + echo "" + if [ "X$ssh_cmd" = "Xsleep $ssh_sleep" ] ; then + sleep 1 + else + # let any command get started a bit. + sleep 5 + fi + echo "" + #reset + stty sane + if [ "X$use_sshssl" = "X" ]; then + echo "Running viewer:" + echo "$VNCVIEWERCMD" "$@" localhost:$N + echo "" + "$VNCVIEWERCMD" "$@" localhost:$N + + exit $? + else + use2=`findfree 5960` + host0=$host + port0=$port + host=localhost + port=$use + use=$use2 + N=`expr $use - 5900` + proxy="" + fi +fi + +# create the stunnel config file: +if [ "X$verify" != "X" ]; then + if [ -d $verify ]; then + verify="CApath = $verify" + else + verify="CAfile = $verify" + fi + verify="$verify +verify = 2" +fi +if [ "X$mycert" != "X" ]; then + cert="cert = $mycert" +fi + +mytmp() { + tf=$1 + rm -rf "$tf" || exit 1 + if [ -d "$tf" ]; then + echo "tmp file $tf still exists as a directory." + exit 1 + elif [ -L "$tf" ]; then + echo "tmp file $tf still exists as a symlink." + exit 1 + elif [ -f "$tf" ]; then + echo "tmp file $tf still exists." + exit 1 + fi + touch "$tf" || exit 1 + chmod 600 "$tf" || exit 1 +} + +if echo "$RANDOM" | grep '[^0-9]' > /dev/null; then + RANDOM=`date +%S` +fi + +pcode() { + tf=$1 + SSL_VNC_PROXY=$proxy; export SSL_VNC_PROXY + SSL_VNC_DEST="$host:$port"; export SSL_VNC_DEST + cod='#!/usr/bin/perl + +# A hack to glue stunnel to a Web proxy for client connections. + +use IO::Socket::INET; + +my ($first, $second) = split(/,/, $ENV{SSL_VNC_PROXY}); +my ($proxy_host, $proxy_port) = split(/:/, $first); +my $connect = $ENV{SSL_VNC_DEST}; + +print STDERR "\nperl script for web proxing:\n"; +print STDERR "proxy_host: $proxy_host\n"; +print STDERR "proxy_port: $proxy_port\n"; +print STDERR "proxy_connect: $connect\n"; + +my $listen_handle = ""; +if ($ENV{SSL_VNC_LISTEN} != "") { + my $listen_sock = IO::Socket::INET->new( + Listen => 2, + LocalAddr => "localhost", + LocalPort => $ENV{SSL_VNC_LISTEN}, + Proto => "tcp"); + if (! $listen_sock) { + die "perl proxy: $!\n"; + } + my $ip; + ($listen_handle, $ip) = $listen_sock->accept(); + if (! $listen_handle) { + die "perl proxy: $!\n"; + } +} + +my $sock = IO::Socket::INET->new( + PeerAddr => $proxy_host, + PeerPort => $proxy_port, + Proto => "tcp"); + +if (! $sock) { + unlink($0); + die "perl proxy: $!\n"; +} + +my $con = ""; +if ($second ne "") { + $con = "CONNECT $second HTTP/1.1\r\n"; + $con .= "Host: $second\r\n\r\n"; +} else { + $con = "CONNECT $connect HTTP/1.1\r\n"; + $con .= "Host: $connect\r\n\r\n"; +} + +print STDERR "proxy_request1:\n$con"; +print $sock $con; + +unlink($0); + +my $rep = ""; +while ($rep !~ /\r\n\r\n/) { + my $c = getc($sock); + print STDERR $c; + $rep .= $c; +} +if ($rep !~ m,HTTP/.* 200,) { + die "proxy error: $rep\n"; +} + +if ($second ne "") { + $con = "CONNECT $connect HTTP/1.1\r\n"; + $con .= "Host: $connect\r\n\r\n"; + print STDERR "proxy_request2:\n$con"; + + print $sock $con; + + $rep = ""; + while ($rep !~ /\r\n\r\n/) { + my $c = getc($sock); + print STDERR $c; + $rep .= $c; + } + if ($rep !~ m,HTTP/.* 200,) { + die "proxy error: $rep\n"; + } +} + +if (fork) { + print STDERR "parent\[$$] STDIN -> socket\n\n"; + if ($listen_handle) { + xfer($listen_handle, $sock); + } else { + xfer(STDIN, $sock); + } +} else { + print STDERR "child \[$$] socket -> STDOUT\n\n"; + if ($listen_handle) { + xfer($sock, $listen_handle); + } else { + xfer($sock, STDOUT); + } +} +exit; + +sub xfer { + my($in, $out) = @_; + $RIN = $WIN = $EIN = ""; + $ROUT = ""; + vec($RIN, fileno($in), 1) = 1; + vec($WIN, fileno($in), 1) = 1; + $EIN = $RIN | $WIN; + + while (1) { + my $nf = 0; + while (! $nf) { + $nf = select($ROUT=$RIN, undef, undef, undef); + } + my $len = sysread($in, $buf, 8192); + if (! defined($len)) { + next if $! =~ /^Interrupted/; + print STDERR "perl proxy\[$$]: $!\n"; + last; + } elsif ($len == 0) { + print STDERR "perl proxy\[$$]: Input is EOF.\n"; + last; + } + my $offset = 0; + my $quit = 0; + while ($len) { + my $written = syswrite($out, $buf, $len, $offset); + if (! defined $written) { + print STDERR "perl proxy\[$$]: Output is EOF. $!\n"; + $quit = 1; + last; + } + $len -= $written; + $offset += $written; + } + last if $quit; + } + close($in); + close($out); +} +' + echo "$cod" > $tf + chmod 700 $tf +} + +ptmp="" +if [ "X$proxy" != "X" ]; then + ptmp="/tmp/ssl_vncviewer${RANDOM}.$$.pl" + mytmp "$ptmp" + pcode "$ptmp" + connect="exec = $ptmp" +else + connect="connect = $host:$port" +fi + +if [ "X$direct_connect" != "X" ]; then + echo "" + echo "Running viewer for direct connection:" + echo "" + echo "** NOTE: THERE WILL BE NO SSL OR SSH ENCRYPTION **" + echo "" + if type printf > /dev/null 2>&1; then + printf "Are you sure you want to continue? [y]/n " + else + echo -n "Are you sure you want to continue? [y]/n " + fi + read x + if [ "X$x" = "Xn" ]; then + exit 1 + fi + echo "" + if [ "X$ptmp" != "X" ]; then + SSL_VNC_LISTEN=$use + export SSL_VNC_LISTEN + $ptmp & + sleep 2 + host="localhost" + disp="$N" + fi + echo "$VNCVIEWERCMD" "$@" $host:$disp + echo "" + "$VNCVIEWERCMD" "$@" $host:$disp + exit $? +fi + +##debug = 7 +tmp=/tmp/ssl_vncviewer${RANDOM}.$$ +mytmp "$tmp" + +cat > "$tmp" < /dev/tty & +pid=$! +echo "" + +# pause here to let the user supply a possible passphrase for the +# mycert key: +if [ "X$mycert" != "X" ]; then + sleep 4 +fi +sleep 2 +rm -f "$tmp" + +echo "" +echo "Running viewer:" +echo "$VNCVIEWERCMD" "$@" localhost:$N +echo "" +"$VNCVIEWERCMD" "$@" localhost:$N + +kill $pid +sleep 1 diff --git a/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ssvnc.tcl b/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ssvnc.tcl new file mode 100755 index 0000000..b7a083a --- /dev/null +++ b/x11vnc/misc/enhanced_tightvnc_viewer/bin/util/ssvnc.tcl @@ -0,0 +1,6675 @@ +#!/bin/sh +# the next line restarts using wish \ +exec wish "$0" "$@" + +# +# Copyright (c) 2006 by Karl J. Runge +# +# ssl_tightvncviewer.tcl: gui wrapper to the , etc. programs in this +# ssl_tightvncviewerpackage. Also sets up service port forwarding. +# + +set buck_zero $argv0 + +proc center_win {w} { + set W [winfo screenwidth $w] + set W [expr $W + 1] + wm geometry $w +$W+0 + update + set x [expr [winfo screenwidth $w]/2 - [winfo width $w]/2] + set y [expr [winfo screenheight $w]/2 - [winfo height $w]/2] + wm geometry $w +$x+$y + update +} + +proc apply_bg {w} { + global is_windows system_button_face + if {$is_windows && $system_button_face != ""} { + catch {$w configure -bg "$system_button_face"} + } +} + +proc scroll_text {fr {w 80} {h 35}} { + global help_font is_windows scroll_text_focus + + catch {destroy $fr} + + frame $fr -bd 0 + + eval text $fr.t -width $w -height $h $help_font \ + -setgrid 1 -bd 2 -yscrollcommand {"$fr.y set"} -relief ridge + + apply_bg $fr.t + + scrollbar $fr.y -orient v -relief sunken -command "$fr.t yview" + pack $fr.y -side right -fill y + pack $fr.t -side top -fill both -expand 1 + + if {$scroll_text_focus} { + focus $fr.t + } +} + +proc scroll_text_dismiss {fr {w 80} {h 35}} { + global help_font + + scroll_text $fr $w $h + + set up $fr + regsub {\.[^.]*$} $up "" up + + button $up.d -text "Dismiss" -command "destroy $up" + bind $up "destroy $up" + pack $up.d -side bottom -fill x + pack $fr -side top -fill both -expand 1 +} + +proc help {} { + catch {destroy .h} + toplevel .h + + scroll_text_dismiss .h.f + + center_win .h + wm title .h "SSL TightVNC Viewer Help" + + set msg { + Enter the VNC host and display in the 'VNC Host:Display' entry box. + + It is of the form "host:number", where "host" is the hostname of the + machine running the VNC Server and "number" is the VNC display number; + it is often "0". Examples: + + snoopy:0 + far-away.east:0 + sunray-srv1.west:17 + 24.67.132.27:0 + + Then click on "Connect". When you do so the STUNNEL program will be + started locally to provide you with an outgoing SSL tunnel. + + Once the STUNNEL is running, the TightVNC Viewer will be automatically + started directed to the local SSL tunnel which, in turn, encrypts and + redirects the connection to the remote VNC server. + + The remote VNC server must support an initial SSL handshake before + using the VNC protocol (i.e. VNC is tunnelled through the SSL channel + after it is established). "x11vnc -ssl ..." does this, and any VNC + server can be made to do this by using, e.g., STUNNEL on the remote side. + + Click on "Options ..." if you want to use an *SSH* tunnel instead of + SSL (then the VNC Server does not need to speak SSL or use STUNNEL). + + + Note that on Windows when the Viewer connection is finished you may + need to terminate STUNNEL manually from the System Tray (right click + on dark green icon) and selecting "Exit". + + + Proxies: If an intermediate proxy is needed to make the SSL connection + (e.g. web gateway out of a firewall), supply both hosts separated + by spaces (with the proxy second): + + host:number gwhost:port + + E.g.: far-away.east:0 mygateway.com:8080 + + If the "double proxy" case is required (e.g. coming out of a web + proxied firewall environment), separate them via a comma, e.g.: + + far-away:0 local-proxy:8080,mygateway.com:443 + + See the ssl_vncviewer description and x11vnc FAQ for info on proxies: + + http://www.karlrunge.com/x11vnc/#ssl_vncviewer + http://www.karlrunge.com/x11vnc/#faq-ssl-java-viewer-proxy + + + If you want to use a SSL Certificate (PEM) file to authenticate yourself + to the VNC server ("MyCert") or to verify the identity of the VNC Server + ("ServerCert" or "CertsDir") select the certificate file by clicking + the "Certs ..." button before connecting. + + Certificate verification is needed to prevent Man In the Middle attacks. + See the x11vnc documentation: + + http://www.karlrunge.com/x11vnc/ssl.html + + for how to create and use PEM SSL certificate files. An easy way is: + + x11vnc -ssl SAVE ... + + where it will print out its automatically generated certificate to + the screen and that can be safely copied to the viewer side. + + You can also use the "Create Certificate" feature of this program + under "Certs ...". Just click on it and follow the instructions in + the dialog. Then copy the cert file to the VNC Server and specify the + other one in the "Certs ..." dialog. Alternatively you can use the + "Import Certificate" action to paste in a certificate or read one in + from a file. + + + To set other Options, e.g. to use SSH instead of STUNNEL SSL, + click on the "Options ..." button and read the Help there. + + To load in a saved Options profile, click on the "Load" button. + + See these links for more information: + + http://www.karlrunge.com/x11vnc/#faq-ssl-tunnel-ext + http://www.stunnel.org + http://www.tightvnc.com + + + Tips and Tricks: + + 1) On Unix to get a 2nd GUI (e.g. for a 2nd connection) press Ctrl-N + on the GUI. If only the xterm window is visible you can press + Ctrl-N or try Ctrl-LeftButton -> New SSL_VNC_GUI. On Windows you + will have to manually Start a new one: Start -> Run ..., etc. + + 2) If you use "user@hostname cmd=SHELL" then you get an SSH shell only: + no VNC viewer will be launched. On Windows "user@hostname cmd=PUTTY" + will try to use putty.exe (better terminal emulation than + plink.exe). A shortcut for this is Ctrl-S as long as user@hostname + is present in the entry box. + + 3) If you use "user@hostname cmd=KNOCK" then only the port-knocking + is performed. A shortcut for this is Ctrl-P as long as hostname + is present in the entry box. If it matches cmd=KNOCKF, i.e. an + extra "F", then the port-knocking "FINISH" sequence is sent, if any. + A shortcut for this Shift-Ctrl-P as long as hostname is present. + + 4) Pressing the "Load" button or pressing Ctrl-L or Clicking the Right + mouse button on the main GUI will invoke the Load Profile dialog. + + 5) If you want to do a Direct VNC connection, with *NO* SSL or SSH + encryption, use the "vnc://" prefix, e.g. vnc://far-away.east:0 + +} + + .h.f.t insert end $msg +} + +proc help_certs {} { + catch {destroy .ch} + toplevel .ch + + scroll_text_dismiss .ch.f 90 33 + + center_win .ch + wm resizable .ch 1 0 + + wm title .ch "SSL Certificates Help" + + set msg { + Only with SSL Certificate verification can Man In the Middle attacks be + prevented. Otherwise, only passive snooping attacks are prevented with SSL. + + The SSL Certificate files described below can have been created externally + (e.g. by x11vnc), you can import it via "Import Certificate" if you like. + OR you can click on "Create Certificate ..." to use this program to generate a + Certificate + Private Key pair. In that case you will need to distribute one + of the generated files to the VNC Server. + + + Your Certificate + Key: + + You can specify your own SSL certificate (PEM) file in "MyCert" in which case it + is used to authenticate you (the viewer) to the remote VNC Server. If this fails + the remote VNC Server will drop the connection. + + + Server Certificates: + + Server certs can be specified in one of two ways: + + - A single certificate (PEM) file for a single server + or a single Certificate Authority (CA) + + - A directory of certificate (PEM) files stored in + the special OpenSSL hash fashion. + + The former is set via "ServerCert" in this gui. + The latter is set via "CertsDir" in this gui. + + The former corresponds to the "CAfile" STUNNEL parameter. + The latter corresponds to the "CApath" STUNNEL parameter. + See stunnel(8) or www.stunnel.org for more information. + + If the remote VNC Server fails to authenticate itself with respect to the specified + certificate(s), then the VNC Viewer (your side) will drop the connection. + + + Select which file or directory by clicking on the appropriate "Browse..." button. + Once selected, if you click the Right Mouse button on the "Browse..." button then + information about the certificate will be displayed. + + If "Use SSH instead" has been selected then SSL certs are disabled. + + See the x11vnc and STUNNEL documentation for how to create and use PEM + certificate files: + + http://www.karlrunge.com/x11vnc/#faq-ssl-tunnel-ext + http://www.karlrunge.com/x11vnc/ssl.html + http://www.stunnel.org + + A common way to create and use a VNC Server certificate is: + + x11vnc -ssl SAVE ... + + and then copy the Server certificate to the local (viewer-side) machine. + x11vnc prints out to the screen the Server certificate it generates. + You can set "ServerCert" to it directly or use the "Import Certificate" + action to save it to a file. + + x11vnc also has command line utilities to create server, client, and CA + (Certificate Authority) certificates. See the above URLs. +} + + .ch.f.t insert end $msg +} + +proc help_opts {} { + catch {destroy .oh} + toplevel .oh + + scroll_text_dismiss .oh.f + + center_win .oh + + wm title .oh "SSL Viewer Options Help" + +set msg { + Use SSH: Instead of using STUNNEL SSL, use ssh(1) for the encrypted + tunnel. You must be able to log in via ssh to the remote host. + + On Unix the cmdline ssh(1) program will be run in an xterm + for passphrase authentication, etc. On Windows the cmdline + plink.exe program will be launched in a Windows Console window. + + You can set the "VNC Host:Display" to "user@host:disp" to indicate + ssh should log in as "user" on "host". NOTE: On Windows you MUST + always supply the "user@" part (due to a plink deficiency). E.g.: + + fred@far-away.east:0 + + If an intermediate gateway machine must be used (e.g. to enter + a firewall; the VNC Server is not running on it), put something + like this in the "VNC Host:Display" entry box: + + workstation:0 user@gateway-host:port + + ssh is used to login to user@gateway-host and then a -L port + redirection is set up to go to workstation:0 from gateway-host. + ":port" is optional, use it if the gateway-host SSH port is + not the default value 22. + + One can also do a "double ssh", i.e. a first SSH to the + gateway login machine then a 2nd ssh to the destination machine + (presumably it is running the vnc server). Unlike the above + example, the "last leg" (gateway-host -> workstation) is also + encrypted by SSH this way. Do this by splitting the gateway + in two with a comma, the part before it is the first SSH: + + :0 user@gateway-host:port,user@workstation:port + + + At the very end of the entry box, you can also append a + cmd=... string to indicate that command should be run via ssh + on the remote machine instead of the default "sleep 15". E.g.: + + user@host:0 cmd=x11vnc -nopw -display :0 + + (if a gateway is also needed, put it just before the cmd=...) + + + Trick: If you use "cmd=SHELL" then you get an SSH shell only: + no VNC viewer will be launched. On Windows "cmd=PUTTY" will + try to use putty.exe (better terminal emulation than plink.exe) + A shortcut for this is Ctrl-S as long as user@hostname is present. + + Use SSH and SSL: Tunnel the SSL connection through a SSH tunnel. Use this + if you want end-to-end SSL and must use a SSH gateway (e.g. to + enter a firewall) or if additional SSH port redirs are required + (CUPS, Sound, SMB tunnelling: See Advanced options). + + + Putty PW: On Windows only: use the supplied password for plink SSH logins. + Unlike the other options the value is not saved when 'Save + Profile' is performed. This feature useful when options under + "Advanced" are set that require TWO SSH's: you just have + to type the password once in this entry box. The bundled + pagent.exe and puttygen.exe programs can also be used to avoid + repeatedly entering passwords (note this requires setting up + and distributing SSH keys). Start up pagent.exe or puttygen.exe + and read the instructions there. + + ssh-agent: On Unix only: restart the GUI in the presence of ssh-agent(1) + (e.g. in case you forgot to start your agent before starting + this GUI). An xterm will be used to enter passphrases, etc. + This can avoid repeatedly entering passphrases for the + SSH logins (note this requires setting up and distributing + SSH keys). + + + View Only: Have VNC Viewer ignore mouse and keyboard input. + + Fullscreen: Start the VNC Viewer in fullscreen mode. + + Raise On Beep: Deiconify viewer when bell rings. + + Use 8bit color: Request a very low-color pixel format. + + Cursor Alphablending: Use the x11vnc alpha hack for translucent cursors + (requires Unix, 32bpp and same endianness) + + Use XGrabServer: On Unix only, use the XGrabServer workaround for + old window managers. + + Do not use JPEG: Do not use the jpeg aspect of the tight encoding. + + Compress Level/Quality: Set TightVNC encoding parameters. + + Save and Load: You can Save the current settings by clicking on Save + Profile (.vnc file) and you can also read in a saved one + with Load Profile. Use the Browse... button to select + the filename via the GUI. + + Pressing Ctrl-L or Clicking the Right mouse button on + the main GUI will invoke the Load Profile dialog. + + Note: On Windows since the TightVNC Viewer will save + its own settings in the registry, some unexpected + behavior is possible because the viewer is nearly + always directed to the VNC host "localhost:30". E.g. if + you specify "View Only" in this gui once but not next + time the Windows VNC Viewer may remember the setting. + Unfortunately there is not a /noreg option for the Viewer. + + + Clear Options: Set all options to their defaults (i.e. unset). + + Advanced: Bring up the Advanced options dialog. +} + .oh.f.t insert end $msg +} + +proc win_nokill_msg {} { + global help_font is_windows system_button_face + catch {destroy .w} + toplevel .w + + eval text .w.t -width 60 -height 11 $help_font + button .w.d -text "Dismiss" -command {destroy .w} + pack .w.t .w.d -side top -fill x + + apply_bg .w.t + + center_win .w + wm resizable .w 1 0 + + wm title .w "SSL Viewer: Warning" + + set msg { + The TightVNC Viewer has exited. + + You will need to terminate STUNNEL manually. + + To do this go to the System Tray and right-click on the STUNNEL + icon (dark green). Then click "Exit". + + You can also double click on the STUNNEL icon to view the log + for error messages and other information. +} + .w.t insert end $msg +} + +proc win_kill_msg {pids} { + global terminate_pids + global help_font + catch {destroy .w} + toplevel .w + + eval text .w.t -width 72 -height 19 $help_font + button .w.d -text "Dismiss" -command {destroy .w; set terminate_pids no} + button .w.k -text "Terminate STUNNEL" -command {destroy .w; set terminate_pids yes} + pack .w.t .w.k .w.d -side top -fill x + + apply_bg .w.t + + center_win .w + wm resizable .w 1 0 + + wm title .w "SSL Viewer: Warning" + + set msg { + The TightVNC Viewer has exited. + + We can terminate the following still running STUNNEL process(es): + +} + append msg " $pids\n" + + append msg { + Click on the "Terminate STUNNEL" button below to do so. + + Before terminating STUNNEL you can double click on the STUNNEL + Tray icon to view its log for error messages and other information. + + Note: You may STILL need to terminate STUNNEL manually if we are + unable to kill it. To do this go to the System Tray and right-click + on the STUNNEL icon (dark green). Then click "Exit". You will + probably also need to hover the mouse over the STUNNEL Tray Icon to + make the Tray notice STUNNEL is gone... +} + .w.t insert end $msg +} + +proc win9x_plink_msg {file} { + catch {destroy .pl} + global help_font win9x_plink_msg_done + toplevel .pl + + eval text .pl.t -width 90 -height 26 $help_font + button .pl.d -text "OK" -command {destroy .pl; set win9x_plink_msg_done 1} + wm protocol .pl WM_DELETE_WINDOW {catch {destroy .pl}; set win9x_plink_msg_done 1} + pack .pl.t .pl.d -side top -fill x + + apply_bg .pl.t + + center_win .pl + wm resizable .pl 1 0 + + wm title .pl "SSL Viewer: Win9x Warning" + + set msg { + Due to limitations on Window 9x you will have to manually start up + a COMMAND.COM terminal and paste in the following command: + +} + set pwd [pwd] + regsub -all {/} $pwd "\\" pwd + append msg " $pwd\\$file\n" + + append msg { + The reason for this is a poor Console application implementation that + affects many text based applications. + + To start up a COMMAND.COM terminal, click on the Start -> Run, and then + type COMMAND in the entry box and hit Return or click OK. + + To select the above command, highlight it with the mouse and then press + Ctrl-C. Then go over to the COMMAND.COM window and click on the + Clipboard paste button. Once pasted in, press Return to run the script. + + This will start up a PLINK.EXE ssh login to the remote computer, + and after you log in successfully and indicate (QUICKLY!!) that the + connection is OK by clicking OK in this dialog. If the SSH connection + cannot be autodetected you will ALSO need to click "Success" in the + "plink ssh status?" dialog, the VNC Viewer will be started going + through the SSH tunnel. +} + .pl.t insert end $msg + wm deiconify .pl +} + +proc mesg {str} { + set maxx 53 + if {[string length $str] > $maxx} { + set str [string range $str 0 $maxx] + append str " ..." + } + .l configure -text $str + update +} + +proc get_ssh_hp {str} { + set str [string trim $str] + regsub {[ ].*$} $str "" str + return $str +} + +proc get_ssh_cmd {str} { + set str [string trim $str] + if [regexp {cmd=(.*$)} $str m cmd] { + set cmd [string trim $cmd] + regsub -nocase {^%x11vncr$} $cmd "x11vnc -nopw -display none -rawfb rand" cmd + regsub -nocase {^%x11vnc$} $cmd "x11vnc -nopw -display none -rawfb null" cmd + return $cmd + } else { + return "" + } +} + +proc get_ssh_proxy {str} { + set str [string trim $str] + regsub {cmd=(.*$)} $str "" str + set str [string trim $str] + if { ![regexp {[ ]} $str]} { + return "" + } + regsub {^.*[ ][ ]*} $str "" str + return $str +} + +proc set_defaults {} { + global defs + + global mycert svcert crtdir + global use_alpha use_grab use_ssh use_sshssl use_viewonly use_fullscreen use_bgr233 + global use_nojpeg use_raise_on_beep use_compresslevel use_quality + global compresslevel_text quality_text + global use_cups use_sound use_smbmnt + global cups_local_server cups_remote_port cups_manage_rcfile + global cups_local_smb_server cups_remote_smb_port + global change_vncviewer change_vncviewer_path vncviewer_realvnc4 + global additional_port_redirs additional_port_redirs_list + global sound_daemon_remote_cmd sound_daemon_remote_port sound_daemon_kill sound_daemon_restart + global sound_daemon_local_cmd sound_daemon_local_port sound_daemon_local_kill sound_daemon_local_start + global smb_su_mode smb_mount_list + global use_port_knocking port_knocking_list + global include_list + + set defs(use_ssh) 0 + set defs(use_sshssl) 0 + + set defs(use_viewonly) 0 + set defs(use_fullscreen) 0 + set defs(use_raise_on_beep) 0 + set defs(use_bgr233) 0 + set defs(use_alpha) 0 + set defs(use_grab) 0 + set defs(use_nojpeg) 0 + set defs(use_compresslevel) "default" + set defs(use_quality) "default" + set defs(compresslevel_text) "Compress Level: default" + set defs(quality_text) "Quality: default" + + set defs(mycert) "" + set defs(svcert) "" + set defs(crtdir) "" + + set defs(use_cups) 0 + set defs(use_sound) 0 + set defs(use_smbmnt) 0 + + set defs(change_vncviewer) 0 + set defs(change_vncviewer_path) "" + set defs(cups_manage_rcfile) 0 + set defs(vncviewer_realvnc4) 0 + + set defs(additional_port_redirs) 0 + set defs(additional_port_redirs_list) "" + + set defs(cups_local_server) "" + set defs(cups_remote_port) "" + set defs(cups_local_smb_server) "" + set defs(cups_remote_smb_port) "" + + set defs(smb_su_mode) "su" + set defs(smb_mount_list) "" + + set defs(sound_daemon_remote_cmd) "" + set defs(sound_daemon_remote_port) "" + set defs(sound_daemon_kill) 0 + set defs(sound_daemon_restart) 0 + + set defs(sound_daemon_local_cmd) "" + set defs(sound_daemon_local_port) "" + set defs(sound_daemon_local_start) 0 + set defs(sound_daemon_local_kill) 0 + + set defs(use_port_knocking) 0 + set defs(port_knocking_list) "" + + set defs(include_list) "" + + foreach var [array names defs] { + set $var $defs($var) + } + + putty_pw_entry check +} + +proc do_viewer_windows {n} { + global use_alpha use_grab use_ssh use_sshssl use_viewonly use_fullscreen use_bgr233 + global use_nojpeg use_raise_on_beep use_compresslevel use_quality + global change_vncviewer change_vncviewer_path vncviewer_realvnc4 + + set cmd "vncviewer" + if {$change_vncviewer && $change_vncviewer_path != ""} { + set cmd [string trim $change_vncviewer_path] + regsub -all {\\} $cmd {/} cmd + if {[regexp {[ \t]} $cmd]} { + if {[regexp -nocase {\.exe$} $cmd]} { + if {! [regexp {["']} $cmd]} { #" + # hmmm, not following instructions, are they? + set cmd "\"$cmd\"" + } + } + } + } + if {$use_viewonly} { + if {$vncviewer_realvnc4} { + append cmd " viewonly=1" + } else { + append cmd " /viewonly" + } + } + if {$use_fullscreen} { + if {$vncviewer_realvnc4} { + append cmd " fullscreen=1" + } else { + append cmd " /fullscreen" + } + } + if {$use_bgr233} { + if {$vncviewer_realvnc4} { + append cmd " lowcolourlevel=1" + } else { + append cmd " /8bit" + } + } + if {$use_nojpeg} { + if {! $vncviewer_realvnc4} { + append cmd " /nojpeg" + } + } + if {$use_raise_on_beep} { + if {! $vncviewer_realvnc4} { + append cmd " /belldeiconify" + } + } + if {$use_compresslevel != "" && $use_compresslevel != "default"} { + if {$vncviewer_realvnc4} { + append cmd " zliblevel=$use_compresslevel" + } else { + append cmd " /compresslevel $use_compresslevel" + } + } + if {$use_quality != "" && $use_quality != "default"} { + if {! $vncviewer_realvnc4} { + append cmd " /quality $use_quality" + } + } + append cmd " localhost:$n" + + mesg $cmd + set emess "" + set rc [catch {eval exec $cmd} emess] + if {$rc != 0} { + tk_messageBox -type ok -icon error -message $emess -title "Error: $cmd" + } +} + +proc get_netstat {} { + set ns "" + catch {set ns [exec netstat -an]} + return $ns +} + +proc get_ipconfig {} { + global is_win9x + set ip "" + if {! $is_win9x} { + catch {set ip [exec ipconfig]} + return $ip + } + + set file "ip" + append file [pid] + append file ".txt" + + catch {[exec winipcfg /Batch $file]} + + if [file exists $file] { + set fh [open $file "r"] + while {[gets $fh line] > -1} { + append ip "$line\n" + } + close $fh + catch {file delete $file} + } + return $ip +} + +proc guess_nat_ip {} { + global save_nat last_save_nat + set s "" + + if {! [info exists save_nat]} { + set save_nat "" + set last_save_nat 0 + } + if {$save_nat != ""} { + set now [clock seconds] + if {$now < $last_save_nat + 45} { + return $save_nat + } + } + set s "" + catch {set s [socket "www.whatismyip.com" 80]} + set ip "unknown" + if {$s != ""} { + fconfigure $s -buffering none + puts $s "GET / HTTP/1.1" + puts $s "Host: www.whatismyip.com" + puts $s "Connection: close" + puts $s "" + flush $s + set on 0 + while { [gets $s line] > -1 } { + if {! $on && [regexp {} $line]} {set on 1} + if {! $on && [regexp {} $line]} {set on 1} + if {! $on && [regexp {} $line]} {set on 1} + if {! $on} { + continue; + } + if [regexp {([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*)} $line ip] { + break + } + } + close $s + } + if {$ip != "unknown"} { + set save_nat $ip + set last_save_nat [clock seconds] + } + return $ip +} + +proc guess_ip {} { + global is_windows + if {! $is_windows} { + set out "" + set out [get_hostname] + if {$out != ""} { + set hout "" + catch {set hout [exec host $out]} + if {$hout != ""} { + if [regexp {has address ([.0-9][.0-9]*)} $hout mvar ip] { + set ip [string trim $ip] + return $ip + } + } + } + return "" + } else { + set out [get_ipconfig] + set out [string trim $out] + if {$out == ""} { + return "" + } + foreach line [split $out "\n\r"] { + if {[regexp -nocase {IP Address.*:[ \t]*([.0-9][.0-9]*)} $line mvar ip]} { + set ip [string trim $ip] + if [regexp {^[.0]*$} $ip] { + continue + } + if [regexp {127\.0\.0\.1} $ip] { + continue + } + if {$ip != ""} { + return $ip + } + } + } + } +} + +proc windows_start_sound_daemon {file} { + global env + global use_sound sound_daemon_local_cmd sound_daemon_local_start + + regsub {\.bat} $file "snd.bat" file2 + set fh2 [open $file2 "w"] + + puts $fh2 $sound_daemon_local_cmd + puts $fh2 "del $file2" + close $fh2 + + mesg "Starting SOUND daemon..." + if [info exists env(COMSPEC)] { + exec $env(COMSPEC) /c $file2 & + } else { + exec cmd.exe /c $file2 & + } + after 1500 +} + +proc windows_stop_sound_daemon {} { + global is_win9x + global use_sound sound_daemon_local_cmd sound_daemon_local_start + + set cmd [string trim $sound_daemon_local_cmd] + + regsub {[ \t].*$} $cmd "" cmd + regsub {^.*\\} $cmd "" cmd + regsub {^.*/} $cmd "" cmd + + if {$cmd == ""} { + return + } + + set output [get_task_list] + + foreach line [split $output "\n\r"] { + if [regexp "$cmd" $line] { + if [regexp {(-?[0-9][0-9]*)} $line m p] { + set pids($p) $line + } + } + } + + set count 0 + foreach pid [array names pids] { + mesg "Stopping SOUND pid: $pid" + if {$is_win9x} { + catch {exec w98/kill.exe /f $pid} + } else { + catch {exec tskill.exe $pid} + } + if {$count == 0} { + after 1200 + } else { + after 500 + } + incr count + } +} + +proc contag {} { + global concount + if {! [info exists concount]} { + set concount 0 + } + incr concount + set str [pid] + set str "-$str-$concount" +} + +proc make_plink {} { + catch {destroy .plink} + toplevel .plink + #wm geometry .plink +700+500 + wm geometry .plink -40-40 + wm title .plink "plink SSH status?" + set wd 37 + label .plink.l1 -anchor w -text "Login via plink/ssh to the remote server" -width $wd + label .plink.l2 -anchor w -text "(supply username and password as needed)." -width $wd + label .plink.l3 -anchor w -text "" -width $wd + label .plink.l4 -anchor w -text "After ssh is set up, AND if the connection" -width $wd + label .plink.l5 -anchor w -text "success is not autodetected, please click" -width $wd + label .plink.l6 -anchor w -text "one of these buttons:" -width $wd + global plink_status + button .plink.fail -text "Failed" -command {destroy .plink; set plink_status no} + button .plink.ok -text "Success" -command {destroy .plink; set plink_status yes} + pack .plink.l1 .plink.l2 .plink.l3 .plink.l4 .plink.l5 .plink.l6 .plink.fail .plink.ok -side top -fill x + + update +} + +proc ssh_split {str} { + if {! [regexp {:} $str]} { + append str ":22" + } + regsub {:.*$} $str "" ssh_host + regsub {^.*:} $str "" ssh_port + if {$ssh_port == ""} { + set ssh_port 22 + } + if [regexp {@} $ssh_host] { + regsub {@.*$} $ssh_host "" ssh_user + regsub {^.*@} $ssh_host "" ssh_host + } else { + set ssh_user "" + } + return [list $ssh_user $ssh_host $ssh_port] +} + +proc launch_windows_ssh {hp file n} { + global is_win9x env + global use_sshssl use_ssh putty_pw + global port_knocking_list + + set hpnew [get_ssh_hp $hp] + set proxy [get_ssh_proxy $hp] + set sshcmd [get_ssh_cmd $hp] + + set vnc_host "localhost" + set vnc_disp $hpnew + regsub {^.*:} $vnc_disp "" vnc_disp + + if {![regexp {^[0-9][0-9]*$} $vnc_disp]} { + if {[regexp {cmd=SHELL} $hp]} { + ; + } elseif {[regexp {cmd=PUTTY} $hp]} { + ; + } else { + mesg "Bad vncdisp, missing :0 ?, $vnc_disp" + bell + return 0 + } + } + + set vnc_port 5900 + if {![regexp {^[0-9][0-9]*$} $vnc_disp]} { + ; + } elseif {$vnc_disp < 200} { + set vnc_port [expr $vnc_disp + 5900] + } else { + set vnc_port $vnc_disp + } + + set ssh_port 22 + set ssh_host $hpnew + regsub {:.*$} $ssh_host "" ssh_host + + set double_ssh "" + set p_port "" + if {$proxy != ""} { + if [regexp {,} $proxy] { + if {$is_win9x} { + mesg "Double proxy does not work on Win9x" + bell + return 0 + } + # user1@gateway:port1,user2@workstation:port2 + set proxy1 "" + set proxy2 "" + set s [split $proxy ","] + set proxy1 [lindex $s 0] + set proxy2 [lindex $s 1] + + set p_port [expr 3000 + 1000 * rand()] + set p_port [expr round($p_port)] + + set s [ssh_split $proxy1] + set ssh_user1 [lindex $s 0] + set ssh_host1 [lindex $s 1] + set ssh_port1 [lindex $s 2] + + set s [ssh_split $proxy2] + set ssh_user2 [lindex $s 0] + set ssh_host2 [lindex $s 1] + set ssh_port2 [lindex $s 2] + + set u1 "" + if {$ssh_user1 != ""} { + set u1 "${ssh_user1}@" + } + set u2 "" + if {$ssh_user2 != ""} { + set u2 "${ssh_user2}@" + } + + set double_ssh "-L $p_port:$ssh_host2:$ssh_port2 -P $ssh_port1 $u1$ssh_host1" + set proxy_use "${u2}localhost:$p_port" + + } else { + # user1@gateway:port1 + set proxy_use $proxy + } + + set ssh_host $proxy_use + regsub {:.*$} $ssh_host "" ssh_host + set ssh_port $proxy_use + regsub {^.*:} $ssh_port "" ssh_port + if {$ssh_port == ""} { + set ssh_port 22 + } + + set vnc_host $hpnew + regsub {:.*$} $vnc_host "" vnc_host + if {$vnc_host == ""} { + set vnc_host "localhost" + } + } + + if {![regexp {^[^ ][^ ]*@} $ssh_host]} { + mesg "You must supply a username: user@host..." + bell + return 0 + } + + set verb "-v" + + set pwd "" + if {$is_win9x} { + set pwd [pwd] + regsub -all {/} $pwd "\\" pwd + } + if {! [regexp {^[0-9][0-9]*$} $n]} { + set n 0 + } + + set use [expr $n + 5900] + + set_smb_mounts + + global use_smbmnt use_sound sound_daemon_kill + set do_pre 0 + if {$use_smbmnt} { + set do_pre 1 + } elseif {$use_sound && $sound_daemon_kill} { + set do_pre 1 + } + + global skip_pre + if {$skip_pre} { + set do_pre 0 + set skip_pre 0 + } + + set pw "" + if {$putty_pw != ""} { + if {! [regexp {"} $putty_pw]} { #" + set pw " -pw \"$putty_pw\"" + } + } + + set tag [contag] + + set file_double "" + + set file_pre "" + set file_pre_cmd "" + if {$do_pre} { + set setup_cmds [ugly_setup_scripts pre $tag] + + if {$setup_cmds != ""} { + regsub {\.bat} $file "pre.cmd" file_pre_cmd + set fh [open $file_pre_cmd "w"] + puts $fh "$setup_cmds sleep 10; " + close $fh + + regsub {\.bat} $file "pre.bat" file_pre + set fh [open $file_pre "w"] + set plink_str "plink.exe -ssh -C -P $ssh_port -m $file_pre_cmd $verb -t" + + global smb_redir_0 + if {$smb_redir_0 != ""} { + append plink_str " $smb_redir_0" + } + + append plink_str "$pw $ssh_host" + + if {$pw != ""} { + puts $fh "echo off" + } + puts $fh $plink_str + + if {$file_pre_cmd != ""} { + puts $fh "del $file_pre_cmd" + } + puts $fh "del $file_pre" + + close $fh + } + } + + if {$is_win9x} { + set sleep 35 + } else { + set sleep 20 + } + + set setup_cmds [ugly_setup_scripts post $tag] + + set do_shell 0 + if {$sshcmd == "SHELL"} { + set setup_cmds "" + set sshcmd {$SHELL} + set do_shell 1 + } elseif {$sshcmd == "PUTTY"} { + set setup_cmds "" + set do_shell 1 + } + + set file_cmd "" + if {$setup_cmds != ""} { + regsub {\.bat} $file ".cmd" file_cmd + set fh_cmd [open $file_cmd "w"] + + set str $setup_cmds + if {$sshcmd != ""} { + append str " $sshcmd; " + } else { + append str " sleep $sleep; " + } + puts $fh_cmd $str + close $fh_cmd + + set sshcmd $setup_cmds + } + + if {$sshcmd == ""} { + set pcmd "echo; echo SSH connected OK.; echo If this state is not autodetected,; echo Go Click the Success button." + set sshcmd "$pcmd; sleep $sleep" + } + + global use_sound sound_daemon_local_cmd sound_daemon_local_start + if {! $do_shell && ! $is_win9x && $use_sound && $sound_daemon_local_start && $sound_daemon_local_cmd != ""} { + windows_start_sound_daemon $file + } + + set fh [open $file "w"] + if {$is_win9x} { + puts $fh "cd $pwd" + if {$file_pre != ""} { + puts $fh "echo Press Ctrl-C --HERE-- when done with the Pre-Command shell work." + puts $fh "start /w command.com /c $file_pre" + } + } + + global use_cups use_smbmnt + set extra_redirs "" + if {$use_cups} { + append extra_redirs [get_cups_redir] + } + if {$use_sound} { + append extra_redirs [get_sound_redir] + } + global additional_port_redirs + if {$additional_port_redirs} { + append extra_redirs [get_additional_redir] + } + + if {$vnc_host == ""} { + set vnc_host "localhost" + } + + set plink_str "plink.exe -ssh -P $ssh_port $verb -L $use:$vnc_host:$vnc_port $extra_redirs -t" + if {$extra_redirs != ""} { + regsub {exe} $plink_str "exe -C" plink_str + } + if {$do_shell} { + if {$sshcmd == "PUTTY"} { + if {$is_win9x} { + set plink_str "putty.exe -ssh -C -P $ssh_port $extra_redirs -t $pw $ssh_host" + } else { + set plink_str "start \"putty $ssh_host\" putty.exe -ssh -C -P $ssh_port $extra_redirs -t $pw $ssh_host" + if [regexp {FINISH} $port_knocking_list] { + regsub {start} $plink_str "start /wait" plink_str + } + } + } else { + set plink_str "plink.exe -ssh -C -P $ssh_port $extra_redirs -t $pw $ssh_host" + append plink_str { "$SHELL"} + } + } elseif {$file_cmd != ""} { + append plink_str " -m $file_cmd$pw $ssh_host" + } else { + append plink_str "$pw $ssh_host \"$sshcmd\"" + } + + if {$pw != ""} { + puts $fh "echo off" + } + puts $fh $plink_str + if {$file_cmd != ""} { + puts $fh "del $file_cmd" + } + puts $fh "del $file" + close $fh + + catch {destroy .o} + catch {destroy .oa} + + if { ![do_port_knock $ssh_host start]} { + catch {file delete $file} + if {$file_cmd != ""} { + catch {file delete $file_cmd} + } + if {$file_pre != ""} { + catch {file delete $file_pre} + } + return 0 + } + + if {$double_ssh != ""} { + set plink_str_double_ssh "plink.exe -ssh -t $pw $double_ssh \"echo sleep 60 ...; sleep 60; echo done.\"" + + regsub {\.bat} $file "dob.bat" file_double + set fhdouble [open $file_double "w"] + puts $fhdouble $plink_str_double_ssh + puts $fhdouble "del $file_double" + close $fhdouble + + set com "cmd.exe" + if [info exists env(COMSPEC)] { + set com $env(COMSPEC) + } + + exec $com /c $file_double & + + set waited 0 + set gotit 0 + while {$waited < 30000} { + after 500 + update + set ns [get_netstat] + set re ":$p_port" + append re {[ ][ ]*[0:.][0:.]*[ ][ ]*LISTEN} + if [regexp $re $ns] { + set gotit 1 + break + } + set waited [expr "$waited + 500"] + } + if {! $gotit} { + after 5000 + } + } + + if {$is_win9x} { + wm withdraw . + update + win9x_plink_msg $file + global win9x_plink_msg_done + set win9x_plink_msg_done 0 + vwait win9x_plink_msg_done + } else { + set com "cmd.exe" + if [info exists env(COMSPEC)] { + set com $env(COMSPEC) + } + + if {$file_pre != ""} { + set sl 0 + if {$use_smbmnt} { + global smb_su_mode + if {$smb_su_mode == "su"} { + set sl [expr $sl + 15] + } elseif {$smb_su_mode == "sudo"} { + set sl [expr $sl + 15] + } else { + set sl [expr $sl + 3] + } + } + if {$pw == ""} { + set sl [expr $sl + 5] + } + + set sl [expr $sl + 5] + set st [clock seconds] + set dt 0 + global entered_gui_top button_gui_top + set entered_gui_top 0 + set button_gui_top 0 + + catch {wm geometry . "-40-40"} + catch {wm withdraw .; update; wm deiconify .; raise .; update} + mesg "Click on *This* Label when done with 1st SSH 0/$sl" + after 600 + + exec $com /c $file_pre & + + catch {lower .; update; raise .; update} + + while {$dt < $sl} { + after 100 + set dt [clock seconds] + set dt [expr $dt - $st] + mesg "Click on *This* Label when done with 1st SSH $dt/$sl" + update + update idletasks + if {$dt <= 1} { + set button_gui_top 0 + } + if {$button_gui_top != 0 && $dt >= 3} { + mesg "Running 2nd SSH now ..." + after 1000 + break + } + } + mesg "Running 2nd SSH ..." + } + + if {! $do_shell} { + make_plink + } + wm withdraw . + update + if {$do_shell && [regexp {FINISH} $port_knocking_list]} { + catch {exec $com /c $file} + } else { + exec $com /c $file & + } + after 1000 + } + + if {$do_shell} { + wm deiconify . + update + if {[regexp {FINISH} $port_knocking_list]} { + do_port_knock $ssh_host finish + } + return 1 + } + if {$is_win9x} { + make_plink + } + global plink_status + set plink_status "" + set waited 0 + set cnt 0 + while {$waited < 30000} { + after 500 + update + set ns [get_netstat] + set re ":$use" + append re {[ ][ ]*[0:.][0:.]*[ ][ ]*LISTEN} + if [regexp $re $ns] { + set plink_status yes + } + if {$plink_status != ""} { + catch {destroy .plink} + break + } + + if {$waited == 0} { + #wm deiconify .plink + } + set waited [expr "$waited + 500"] + + incr cnt + if {$cnt >= 12} { + set cnt 0 + } + } + if {$plink_status == ""} { + vwait plink_status + } + + if {$use_sshssl} { + global launch_windows_ssh_files + if {$file != ""} { + append launch_windows_ssh_files "$file " + } + if {$file_pre != ""} { + append launch_windows_ssh_files "$file_pre " + } + if {$file_pre_cmd != ""} { + append launch_windows_ssh_files "$file_pre_cmd " + } + regsub { *$} $launch_windows_ssh_files "" launch_windows_ssh_files + return 1 + } + + if {$plink_status != "yes"} { + wm deiconify . + } else { + after 1000 + do_viewer_windows $n + wm deiconify . + mesg "Disconnected from $hp" + } + update + if [regexp {FINISH} $port_knocking_list] { + do_port_knock $ssh_host finish + } + + if {$file != ""} { + catch {file delete $file} + } + if {$file_pre != ""} { + catch {file delete $file_pre} + } + if {$file_pre_cmd != ""} { + catch {file delete $file_pre_cmd} + } + if {$file_double != ""} { + catch {file delete $file_double} + } + + global sound_daemon_local_kill + if {! $is_win9x && $use_sound && $sound_daemon_local_kill && $sound_daemon_local_cmd != ""} { + windows_stop_sound_daemon + } + return 1 +} + +proc check_ssh_needed {} { + globalize + + if {$use_ssh || $use_sshssl} { + return + } + set must 0 + if {$use_cups} { + if {$cups_local_server != ""} {set must 1} + if {$cups_remote_port != ""} {set must 1} + if {$cups_local_smb_server != ""} {set must 1} + if {$cups_remote_smb_port != ""} {set must 1} + if {$cups_manage_rcfile != ""} {set must 1} + } + if {$use_sound} { + if {$sound_daemon_remote_cmd != ""} {set must 1} + if {$sound_daemon_remote_port != ""} {set must 1} + if {$sound_daemon_kill} {set must 1} + if {$sound_daemon_restart} {set must 1} + if {$sound_daemon_local_cmd != ""} {set must 1} + if {$sound_daemon_local_port != ""} {set must 1} + if {$sound_daemon_local_kill} {set must 1} + if {$sound_daemon_local_start} {set must 1} + } + if {$use_smbmnt} { + if {[regexp {//} $smb_mount_list]} {set must 1} + } + if {$must} { + set use_sshssl 1 + putty_pw_entry check + mesg "Enabling \"Use SSH and SSL\" mode for port redir" + update + bell + after 4000 + } +} + +proc set_smb_mounts {} { + global smb_redir_0 smb_mounts use_smbmnt + + set smb_redir_0 "" + set smb_mounts "" + if {$use_smbmnt} { + set l2 [get_smb_redir] + set smb_redir_0 [lindex $l2 0] + set smb_redir_0 [string trim $smb_redir_0] + set smb_mounts [lindex $l2 1] + } +} + +proc darwin_terminal_cmd {{title ""} {cmd ""} {bg 0}} { + global darwin_terminal + + set tries "" + lappend tries "/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal" + + if {! [info exists darwin_terminal]} { + foreach try $tries { + if [file exists $try] { + if [file executable $try] { + set darwin_terminal $try + break + } + } + } + if {! [info exists darwin_terminal]} { + set fh "" + catch {set fh [open "| find /Applications -type f -name Terminal" "r"]} + if {$fh != ""} { + while {[gets $fh line] > -1} { + if {! [file exists $line]} { + continue + } + if {[file isdirectory $line]} { + continue + } + if {! [regexp {/Terminal$} $line]} { + continue + } + if {! [file executable $line]} { + continue + } + set darwin_terminal $line + break + } + close $fh + } + } + } + if {! [info exists darwin_terminal]} { + tk_messageBox -type ok -icon error -message "Cannot find Darwin Terminal program." -title "Cannot find Terminal program" + return + } + + global darwin_terminal_cnt + set tmp /tmp/darwin_terminal_cmd.[pid] + if {! [info exists darwin_terminal_cnt]} { + set darwin_terminal_cnt 0 + } + incr darwin_terminal_cnt + append tmp ".$darwin_terminal_cnt" + + set fh "" + catch {set fh [open $tmp w 0755]} + if {$fh == ""} { + tk_messageBox -type ok -icon error -message "Cannot open temporary file: $tmp" -title "Cannot open file" + return + } + global env + puts $fh "#!/bin/sh" + puts $fh "PATH=$env(PATH)" + puts $fh "export PATH" + puts $fh "tmp=$tmp" + puts $fh "sleep 1" + puts $fh {if [ "X$DDDBG" != "X" ]; then ps www; fi} + puts $fh {termpid=`ps www | grep -w Terminal | grep $tmp | grep -v grep | awk '{print $1}' | sort -n | tail -1`} + puts $fh {echo try-1: termpid=$termpid mypid=$$} + puts $fh {if [ "X$termpid" = "X" ]; then} + puts $fh { termpid=`ps www | grep -w Terminal | grep -v grep | awk '{print $1}' | sort -n | tail -1`} + puts $fh { echo try-2: termpid=$termpid mypid=$$} + puts $fh {fi} + puts $fh {if [ "X$termpid" = "X" ]; then} + puts $fh { termpid=$$} + puts $fh { echo termpid-find-fail: termpid=$termpid mypid=$$} + puts $fh {fi} + puts $fh {trap "rm -f $tmp; kill -TERM $termpid; kill -TERM $mypid; kill -KILL $mypid; exit 0" 0 2 15} + puts $fh "$cmd" + puts $fh "sleep 1" + puts $fh {rm -f $tmp} + puts $fh {kill -TERM $termpid} + puts $fh {kill -TERM $mypid} + puts $fh {kill -KILL $mypid} + puts $fh "exit 0" + close $fh + if {$bg} { + catch {exec $darwin_terminal $tmp &} + } else { + catch {exec $darwin_terminal $tmp} + } +} + +proc unix_terminal_cmd {{geometry "+100+100"} {title "xterm-command"} {cmd "echo test"} {bg 0} {xrm1 ""} {xrm2 ""} {xrm3 ""}} { + global uname + if {$uname == "Darwin"} { + global env + set doX 0; + if [info exists env(DISPLAY)] { + if {[in_path "xterm"] != ""} { + set doX 1 + } + } + if {! $doX} { + darwin_terminal_cmd $title $cmd $bg + return + } + } + if {$bg} { + if {$xrm1 == ""} { + exec xterm -geometry "$geometry" -title "$title" -e sh -c "$cmd" & + } else { + exec xterm -geometry "$geometry" -title "$title" -xrm "$xrm1" -xrm "$xrm2" -xrm "$xrm3" -e sh -c "$cmd" & + } + } else { + if {$xrm1 == ""} { + exec xterm -geometry "$geometry" -title "$title" -e sh -c "$cmd" + } else { + exec xterm -geometry "$geometry" -title "$title" -xrm "$xrm1" -xrm "$xrm2" -xrm "$xrm3" -e sh -c "$cmd" + } + } +} + +proc xterm_center_geometry {} { + set sh [winfo screenheight .] + set sw [winfo screenwidth .] + set gw 500 + set gh 300 + set x [expr $sw/2 - $gw/2] + set y [expr $sh/2 - $gh/2] + if {$x < 0} { + set x 10 + } + if {$y < 0} { + set y 10 + } + + return "+$x+$y" +} + +proc smbmnt_wait {tee} { + if {$tee != ""} { + set start [clock seconds] + set cut 30 + while {1} { + set now [clock seconds] + if {$now > $start + $cut} { + break; + } + if [file exists $tee] { + set sz 0 + catch {set sz [file size $tee]} + if {$sz > 50} { + set cut 50 + } + } + set g "" + catch {set g [exec grep vnc-helper-exiting $tee]} + if [regexp {vnc-helper-exiting} $g] { + break + } + after 1000 + } + catch {file delete $tee} + } else { + global smb_su_mode + if {$smb_su_mode == "su"} { + after 15000 + } elseif {$smb_su_mode == "sudo"} { + after 10000 + } + } +} + +proc do_unix_pre {tag proxy hp pk_hp} { + global env smb_redir_0 use_smbmnt + global did_port_knock + + set setup_cmds [ugly_setup_scripts pre $tag] + set c "ssl_vncviewer -ssh" + + if {$proxy == ""} { + set pxy $hp + regsub {:.*$} $pxy "" pxy + set c "$c -proxy '$pxy'" + } else { + set c "$c -proxy '$proxy'" + } + + if {$setup_cmds != ""} { + set env(SSL_VNCVIEWER_SSH_CMD) "$setup_cmds sleep 10" + set env(SSL_VNCVIEWER_SSH_ONLY) 1 + if {$smb_redir_0 != ""} { + set c "$c -sshargs '$smb_redir_0'" + } + + if {! [do_port_knock $pk_hp start]} { + return + } + set did_port_knock 1 + + if {$use_smbmnt} { + set title "SSL VNC Viewer $hp -- SMB MOUNTS" + } else { + set title "SSL VNC Viewer $hp -- Pre Commands" + } + + set tee "" + if {$use_smbmnt} { + set tee $env(HOME) + append tee "/.tee-etv$tag" + set fh "" + catch {set fh [open $tee "w"]} + if {$fh == ""} { + set tee "" + } else { + close $fh + set c "$c | tee $tee" + } + } + +# exec xterm -geometry "80x25+100+100" \ +# -title "$title" \ +# -e sh -c "set -xv; $c" & + + unix_terminal_cmd "80x25+100+100" "$title" "set -xv; $c" 1 + + set env(SSL_VNCVIEWER_SSH_CMD) "" + set env(SSL_VNCVIEWER_SSH_ONLY) "" + + if {$use_smbmnt} { + smbmnt_wait $tee + } else { + after 2000 + } + } +} + +proc port_knock_only {hp {mode KNOCK}} { + if {$hp == ""} { + global vncdisplay + set hp $vncdisplay + if {$hp == ""} { + mesg "No host port found" + bell + return + } + } + set hpnew [get_ssh_hp $hp] + set proxy [get_ssh_proxy $hp] + set sshcmd [get_ssh_cmd $hp] + set hp $hpnew + + set pk_hp "" + if {$proxy != ""} { + set pk_hp $proxy + } + if {$pk_hp == ""} { + set pk_hp $hp + } + if {$mode == "KNOCK"} { + do_port_knock $pk_hp start + } elseif {$mode == "FINISH"} { + do_port_knock $pk_hp finish + } +} + +proc direct_connect_msg {} { + set msg "" + globalize + if {$use_sshssl} { + append msg " - SSH + SSL tunnelling\n" + } elseif {$use_ssh} { + append msg " - SSH tunnelling\n" + } else { + append msg " - SSL tunnelling\n" + } + if {$use_smbmnt} { + append msg " - SMB Mount Port Redirection\n" + } + if {$use_sound} { + append msg " - ESD Sound Port Redirection\n" + } + if {$use_cups} { + append msg " - CUPS Port Redirection\n" + } + if {$additional_port_redirs} { + append msg " - Additional Port Redirections\n" + } + if {$mycert != "" || $svcert != "" || $crtdir != ""} { + append msg " - SSL certificate authentication\n" + } + if {$msg != ""} { + set msg "Direct connect via vnc://hostname\nThe following options will be disabled:\n\n$msg" + tk_messageBox -type ok -icon info -message $msg + } +} + +proc launch_unix {hp} { + global smb_redir_0 smb_mounts env + + globalize + + set cmd "" + + if [regexp {cmd=} $hp] { + if {! $use_ssh && ! $use_sshssl} { + set use_ssh 1 + } + } + check_ssh_needed + + set_smb_mounts + + global did_port_knock + set did_port_knock 0 + set pk_hp "" + + set skip_ssh 0 + if [regexp {vnc://} $hp] { + set skip_ssh 1 + direct_connect_msg + } + + if {$use_ssh || $use_sshssl} { + if {$skip_ssh} { + set cmd "ssl_vncviewer" + } elseif {$use_ssh} { + set cmd "ssl_vncviewer -ssh" + } else { + set cmd "ssl_vncviewer -sshssl" + if {$mycert != ""} { + set cmd "$cmd -mycert '$mycert'" + } + if {$svcert != ""} { + set cmd "$cmd -verify '$svcert'" + } elseif {$crtdir != ""} { + set cmd "$cmd -verify '$crtdir'" + } + } + set hpnew [get_ssh_hp $hp] + set proxy [get_ssh_proxy $hp] + set sshcmd [get_ssh_cmd $hp] + set hp $hpnew + + if {$proxy != ""} { + set cmd "$cmd -proxy '$proxy'" + set pk_hp $proxy + } + if {$pk_hp == ""} { + set pk_hp $hp + } + + set do_pre 0 + if {$use_smbmnt} { + set do_pre 1 + } elseif {$use_sound && $sound_daemon_kill} { + set do_pre 1 + } + global skip_pre + if {$skip_pre || $skip_ssh} { + set do_pre 0 + set skip_pre 0 + } + + set tag [contag] + + if {$do_pre} { + do_unix_pre $tag $proxy $hp $pk_hp + } + + + set setup_cmds [ugly_setup_scripts post $tag] + if {$skip_ssh} { + set setup_cmds "" + } + + if {$sshcmd == "SHELL"} { + set env(SSL_VNCVIEWER_SSH_CMD) {$SHELL} + set env(SSL_VNCVIEWER_SSH_ONLY) 1 + } elseif {$setup_cmds != ""} { + set env(SSL_VNCVIEWER_SSH_CMD) "$setup_cmds$sshcmd" + } else { + if {$sshcmd != ""} { + set cmd "$cmd -sshcmd '$sshcmd'" + } + } + + set sshargs "" + if {$use_cups} { + append sshargs [get_cups_redir] + } + if {$use_sound} { + append sshargs [get_sound_redir] + } + if {$additional_port_redirs} { + append sshargs [get_additional_redir] + } + + set sshargs [string trim $sshargs] + if {$skip_ssh} { + set sshargs "" + } + if {$sshargs != ""} { + set cmd "$cmd -sshargs '$sshargs'" + set env(SSL_VNCVIEWER_USE_C) 1 + } + if {$sshcmd == "SHELL"} { + set env(SSL_VNCVIEWER_SSH_ONLY) 1 + if {$proxy == ""} { + set hpt $hpnew + regsub {:[0-9]*$} $hpt "" hpt + set cmd "$cmd -proxy '$hpt'" + } + set geometry [xterm_center_geometry] + if {$pk_hp == ""} { + set pk_hp $hp + } + if {! $did_port_knock} { + if {! [do_port_knock $pk_hp start]} { + return + } + set did_port_knock 1 + } + + if {[regexp {FINISH} $port_knocking_list]} { + wm withdraw . + update +# exec xterm -geometry $geometry \ +# -title "SHELL to $hp" -e sh -c "$cmd" + unix_terminal_cmd $geometry "SHELL to $hp" "$cmd" + wm deiconify . + update + do_port_knock $pk_hp finish + } else { +# exec xterm -geometry $geometry \ +# -title "SHELL to $hp" -e sh -c "$cmd" & + unix_terminal_cmd $geometry "SHELL to $hp" "$cmd" 1 + } + set env(SSL_VNCVIEWER_SSH_CMD) "" + set env(SSL_VNCVIEWER_SSH_ONLY) "" + set env(SSL_VNCVIEWER_USE_C) "" + return + } + } else { + set cmd "ssl_tightvncviewer" + set hpnew [get_ssh_hp $hp] + set proxy [get_ssh_proxy $hp] + if {$mycert != ""} { + set cmd "$cmd -mycert '$mycert'" + } + if {$svcert != ""} { + set cmd "$cmd -verify '$svcert'" + } elseif {$crtdir != ""} { + set cmd "$cmd -verify '$crtdir'" + } + if {$proxy != ""} { + set cmd "$cmd -proxy '$proxy'" + } + set hp $hpnew + } + + if {$use_alpha} { + set cmd "$cmd -alpha" + } + if {$use_grab} { + set cmd "$cmd -grab" + } + + global darwin_cotvnc + if {$darwin_cotvnc} { + set env(DARWIN_COTVNC) 1 + } + + set cmd "$cmd $hp" + + if {$use_viewonly} { + if {$darwin_cotvnc} { + set cmd "$cmd --ViewOnly" + } else { + set cmd "$cmd -viewonly" + } + } + if {$use_fullscreen} { + if {$darwin_cotvnc} { + set cmd "$cmd --FullScreen" + } else { + set cmd "$cmd -fullscreen" + } + } + if {$use_bgr233} { + if {$vncviewer_realvnc4} { + set cmd "$cmd -lowcolourlevel 1" + } else { + set cmd "$cmd -bgr233" + } + } + if {$use_nojpeg} { + if {$darwin_cotvnc} { + ; + } elseif {! $vncviewer_realvnc4} { + set cmd "$cmd -nojpeg" + } + } + if {! $use_raise_on_beep} { + if {$darwin_cotvnc} { + ; + } elseif {! $vncviewer_realvnc4} { + set cmd "$cmd -noraiseonbeep" + } + } + if {$use_compresslevel != "" && $use_compresslevel != "default"} { + if {$vncviewer_realvnc4} { + set cmd "$cmd -zliblevel '$use_compresslevel'" + } else { + set cmd "$cmd -compresslevel '$use_compresslevel'" + } + } + if {$use_quality != "" && $use_quality != "default"} { + if {$darwin_cotvnc} { + ; + } elseif {! $vncviewer_realvnc4} { + set cmd "$cmd -quality '$use_quality'" + } + } + if {$use_ssh || $use_sshssl} { + # realvnc4 -preferredencoding zrle + if {$darwin_cotvnc} { + ; + } elseif {$vncviewer_realvnc4} { + set cmd "$cmd -preferredencoding zrle" + } else { + set cmd "$cmd -encodings 'copyrect tight zrle zlib hextile'" + } + } + + if {$change_vncviewer && $change_vncviewer_path != ""} { + set env(VNCVIEWERCMD) $change_vncviewer_path + } else { + set env(VNCVIEWERCMD) "" + } + + catch {destroy .o} + catch {destroy .oa} + update + + if {$sound_daemon_local_start && $sound_daemon_local_cmd != ""} { + mesg "running: $sound_daemon_local_cmd" + exec sh -c "$sound_daemon_local_cmd" >& /dev/null </dev/null & + update + after 500 + } + + if {$pk_hp == ""} { + set pk_hp $hp + } + if {! $did_port_knock} { + if {! [do_port_knock $pk_hp start]} { + wm deiconify . + update + return + } + set did_port_knock 1 + } + wm withdraw . + update + + set geometry [xterm_center_geometry] + set xrm1 "*.srinterCommand:true" + set xrm2 $xrm1 + set xrm3 $xrm1 + if {[info exists env(SSL_VNC_GUI_CMD)]} { + set xrm1 "*.printerCommand:env XTERM_PRINT=1 $env(SSL_VNC_GUI_CMD)" + set xrm2 "XTerm*VT100*translations:#override Shift<Btn3Down>:print()\\nCtrl<Key>N:print()" + set xrm3 "*mainMenu*print*Label: New SSL_VNC_GUI" + } +# exec xterm -geometry $geometry -xrm "$xrm1" -xrm "$xrm2" -xrm "$xrm3" \ +# -title "SSL VNC Viewer $hp" \ +# -e sh -c "set -xv; $cmd; set +xv; echo; echo Done. You Can X-out or Ctrl-C this Terminal if you like.; echo; echo sleep 15; echo; sleep 15" + set m "Done. You Can X-out or Ctrl-C this Terminal if you like." + global uname + if {$uname == "Darwin"} { + regsub {X-out or } $m "" m + } + unix_terminal_cmd $geometry "SSL VNC Viewer $hp" \ + "set -xv; $cmd; set +xv; echo; echo $m; echo; echo sleep 15; echo; sleep 15" 0 $xrm1 $xrm2 $xrm3 + + set env(SSL_VNCVIEWER_SSH_CMD) "" + set env(SSL_VNCVIEWER_USE_C) "" + + if {$sound_daemon_local_kill && $sound_daemon_local_cmd != ""} { + set daemon [string trim $sound_daemon_local_cmd] + regsub {^gw[ \t]*} $daemon "" daemon + regsub {[ \t].*$} $daemon "" daemon + regsub {^.*/} $daemon "" daemon + mesg "killing sound daemon: $daemon" + if {$daemon != ""} { + catch {exec sh -c "killall $daemon" >/dev/null 2>/dev/null </dev/null &} + catch {exec sh -c "pkill -x $daemon" >/dev/null 2>/dev/null </dev/null &} + } + } + wm deiconify . + mesg "Disconnected from $hp" + if {[regexp {FINISH} $port_knocking_list]} { + do_port_knock $pk_hp finish + } +} + +proc kill_stunnel {pids} { + global is_win9x + + set count 0 + foreach pid $pids { + mesg "killing STUNNEL pid: $pid" + if {$is_win9x} { + catch {exec w98/kill.exe /f $pid} + } else { + catch {exec tskill.exe $pid} + } + if {$count == 0} { + after 1200 + } else { + after 500 + } + incr count + } +} + +proc get_task_list {} { + global is_win9x + + set output1 "" + set output2 "" + if {! $is_win9x} { + # try for tasklist on XP pro + catch {set output1 [exec tasklist.exe]} + } + catch {set output2 [exec w98/tlist.exe]} + + set output $output1 + append output "\n" + append output $output2 + + return $output +} + +proc note_stunnel_pids {when} { + global is_win9x pids_before pids_after pids_new + + if {$when == "before"} { + array unset pids_before + array unset pids_after + set pids_new {} + set pids_before(none) "none" + set pids_after(none) "none" + } + + set output [get_task_list] + + foreach line [split $output "\n\r"] { + if [regexp -nocase {stunnel} $line] { + if [regexp {(-?[0-9][0-9]*)} $line m p] { + if {$when == "before"} { + set pids_before($p) $line + } else { + set pids_after($p) $line + } + } + } + } + if {$when == "after"} { + foreach new [array names pids_after] { + if {! [info exists pids_before($new)]} { + lappend pids_new $new + } + } + } +} + +proc del_launch_windows_ssh_files {} { + global launch_windows_ssh_files + + if {$launch_windows_ssh_files != ""} { + foreach tf [split $launch_windows_ssh_files] { + if {$tf == ""} { + continue + } + catch {file delete $tf} + } + } +} + +proc launch_shell_only {} { + global vncdisplay is_windows + global skip_pre + + set hp $vncdisplay + regsub {cmd=.*$} $vncdisplay "" hp + set hp [string trim $hp] + if {$is_windows} { + append hp " cmd=PUTTY" + } else { + append hp " cmd=SHELL" + } + set skip_pre 1 + launch $hp +} + +proc launch {{hp ""}} { + global vncdisplay tcl_platform is_windows + global mycert svcert crtdir + global pids_before pids_after pids_new + global env + global use_ssh use_sshssl + + set debug 0 + if {$hp == ""} { + set hp [string trim $vncdisplay] + } + + if {[regexp {^[ ]*$} $hp]} { + mesg "No host:disp supplied." + bell + catch {raise .} + return + } + if {! [regexp ":" $hp]} { + if {! [regexp {cmd=} $hp]} { + append hp ":0" + } + } + + mesg "Using: $hp" + after 600 + + set sc [get_ssh_cmd $hp] + if {[regexp {^KNOCK} $sc]} { + if [regexp {^KNOCKF} $sc] { + port_knock_only $hp "FINISH" + } else { + port_knock_only $hp "KNOCK" + } + return + } + + if {$debug} { + mesg "\"$tcl_platform(os)\" | \"$tcl_platform(osVersion)\"" + after 1000 + } + if {! $is_windows} { + launch_unix $hp + return + } + + if [regexp {cmd=} $hp] { + if {! $use_ssh && ! $use_sshssl} { + set use_ssh 1 + } + } + check_ssh_needed + + if {! $use_ssh} { + if {$mycert != ""} { + if {! [file exists $mycert]} { + mesg "MyCert does not exist: $mycert" + bell + return + } + } + if {$svcert != ""} { + if {! [file exists $svcert]} { + mesg "ServerCert does not exist: $svcert" + bell + return + } + } elseif {$crtdir != ""} { + if {! [file exists $crtdir]} { + mesg "CertsDir does not exist: $crtdir" + bell + return + } + } + } + + set prefix "stunnel-vnc" + set suffix "conf" + if {$use_ssh || $use_sshssl} { + set prefix "plink-vnc" + set suffix "bat" + } + + set file "" + set n "" + set file2 "" + set n2 "" + set now [clock seconds] + + set proxy [get_ssh_proxy $hp] + if {$use_sshssl} { + set proxy "" + } + + for {set i 30} {$i < 90} {incr i} { + set try "$prefix-$i.$suffix" + if {[file exists $try]} { + set mt [file mtime $try] + set age [expr "$now - $mt"] + set week [expr "7 * 3600 * 24"] + if {$age > $week} { + catch {file delete $file} + } + } + if {! [file exists $try]} { + if {$use_sshssl || $proxy != ""} { + if {$file != ""} { + set file2 $try + set n2 $i + break + } + } + set file $try + set n $i + if {! $use_sshssl && $proxy == ""} { + break + } + } + } + + if {$file == ""} { + mesg "could not find free stunnel file" + bell + return + } + + global launch_windows_ssh_files + set launch_windows_ssh_files "" + + set did_port_knock 0 + + if {$use_sshssl} { + set rc [launch_windows_ssh $hp $file2 $n2] + if {$rc == 0} { + catch {file delete $file} + catch {file delete $file2} + del_launch_windows_ssh_files + return + } + set did_port_knock 1 + } elseif {$use_ssh} { + launch_windows_ssh $hp $file $n + return + } + + set list [split $hp ":"] + + set host [lindex $list 0] + if {$host == ""} { + set host "localhost" + } + + set disp [lindex $list 1] + set disp [string trim $disp] + regsub { .*$} $disp "" disp + if {$disp == "" || ! [regexp {^[0-9][0-9]*$} $disp]} { + set disp 0 + } + set port [expr "$disp + 5900"] + + if {$proxy != ""} { + set env(SSL_VNC_PROXY) $proxy + set env(SSL_VNC_LISTEN) [expr "$n2 + 5900"] + set env(SSL_VNC_DEST) "$host:$port" + } + + if {$debug} { + mesg "file: $file" + after 1000 + } + + set fail 0 + + set fh [open $file "w"] + + puts $fh "client = yes" + puts $fh "options = ALL" + puts $fh "taskbar = yes" + puts $fh "RNDbytes = 2048" + puts $fh "RNDfile = bananarand.bin" + puts $fh "RNDoverwrite = yes" + puts $fh "debug = 6" + if {$mycert != ""} { + if {! [file exists $mycert]} { + mesg "MyCert does not exist: $mycert" + bell + set fail 1 + } + puts $fh "cert = $mycert" + } + if {$svcert != ""} { + if {! [file exists $svcert]} { + mesg "ServerCert does not exist: $svcert" + bell + set fail 1 + } + puts $fh "CAfile = $svcert" + puts $fh "verify = 2" + } elseif {$crtdir != ""} { + if {! [file exists $crtdir]} { + mesg "CertsDir does not exist: $crtdir" + bell + set fail 1 + } + puts $fh "CApath = $crtdir" + puts $fh "verify = 2" + } + + if {$n == ""} { + set n 10 + } + if {$n2 == ""} { + set n2 11 + } + puts $fh "\[vnc$n\]" + set port2 [expr "$n + 5900"] + puts $fh "accept = localhost:$port2" + + if {$use_sshssl || $proxy != ""} { + set port [expr "$n2 + 5900"] + puts $fh "connect = localhost:$port" + } else { + puts $fh "connect = $host:$port" + } + + puts $fh "delay = no" + puts $fh "" + close $fh + + if {! $did_port_knock} { + if {! [do_port_knock $host start]} { + set fail 1 + } + set did_port_knock 1 + } + + if {$fail} { + catch {file delete $file} + return + } + + set proxy_pid "" + if {$proxy != ""} { + mesg "Starting TCP helper on port $port ..." + after 600 + set proxy_pid [exec "connect_br.exe" &] + unset -nocomplain env(SSL_VNC_PROXY) + unset -nocomplain env(SSL_VNC_LISTEN) + unset -nocomplain env(SSL_VNC_DEST) + } + + mesg "Starting STUNNEL on port $port2 ..." + after 600 + + note_stunnel_pids "before" + + set pids [exec stunnel $file &] + + after 1300 + + note_stunnel_pids "after" + + if {$debug} { + after 1000 + mesg "pids $pids" + after 1000 + } else { + catch {destroy .o} + catch {destroy .oa} + wm withdraw . + } + + do_viewer_windows $n + + del_launch_windows_ssh_files + + catch {file delete $file} + + if {$debug} { + ; + } else { + wm deiconify . + } + mesg "Disconnected from $hp." + + global port_knocking_list + if [regexp {FINISH} $port_knocking_list] { + do_port_knock $host finish + } + + if {[llength $pids_new] > 0} { + set plist [join $pids_new ", "] + global terminate_pids + set terminate_pids "" + win_kill_msg $plist + update + vwait terminate_pids + if {$terminate_pids == "yes"} { + kill_stunnel $pids_new + } + } else { + win_nokill_msg + } + mesg "Disconnected from $hp." + + global is_win9x use_sound sound_daemon_local_kill sound_daemon_local_cmd + if {! $is_win9x && $use_sound && $sound_daemon_local_kill && $sound_daemon_local_cmd != ""} { + windows_stop_sound_daemon + } +} + +proc get_idir_certs {str} { + global is_windows env + set idir "" + if {$str != ""} { + if [file isdirectory $str] { + set idir $str + } else { + set idir [file dirname $str] + } + } + if {$idir == ""} { + if {$is_windows} { + set t [file dirname [pwd]] + set t "$t/certs" + if [file isdirectory $t] { + set idir $t + } + } + if {$idir == ""} { + if [info exists env(HOME)] { + set t "$env(HOME)/.vnc/certs" + if [file isdirectory $t] { + set idir $t + } + } + } + } + if {$idir == ""} { + if {$is_windows} { + set idir [get_profiles_dir] + } + if {$idir == ""} { + set idir [pwd] + } + } + return $idir +} + +proc set_mycert {} { + global mycert + set idir [get_idir_certs $mycert] + set t "" + if {$idir != ""} { + set t [tk_getOpenFile -initialdir $idir] + } else { + set t [tk_getOpenFile] + } + if {$t != ""} { + set mycert $t + } + catch {wm deiconify .c} + v_mycert + update +} + + +proc show_cert {crt} { + if {$crt == ""} { + bell + return + } + if {! [file exists $crt]} { + bell + return + } + set info "" + catch {set info [get_x509_info $crt]} + if {$info == ""} { + bell + return + } + + set w .show_certificate + catch {destroy $w} + toplevel $w + scroll_text $w.f + button $w.b -text Dismiss -command "destroy $w" + bind $w <Escape> "destroy $w" + $w.f.t insert end $info + + pack $w.b -side bottom -fill x + pack $w.f -side top -fill both -expand 1 + center_win $w + catch {raise $w} +} + +proc v_svcert {} { + global svcert + if {$svcert == "" || ! [file exists $svcert]} { + catch {.c.svcert.i configure -state disabled} + } else { + catch {.c.svcert.i configure -state normal} + } + return 1 +} + +proc v_mycert {} { + global mycert + if {$mycert == "" || ! [file exists $mycert]} { + catch {.c.mycert.i configure -state disabled} + } else { + catch {.c.mycert.i configure -state normal} + } + return 1 +} + +proc show_mycert {} { + global mycert + show_cert $mycert +} + +proc show_svcert {} { + global svcert + show_cert $svcert +} + +proc set_svcert {} { + global svcert crtdir + set idir [get_idir_certs $svcert] + set t "" + if {$idir != ""} { + set t [tk_getOpenFile -initialdir $idir] + } else { + set t [tk_getOpenFile] + } + if {$t != ""} { + set crtdir "" + set svcert $t + } + catch {wm deiconify .c} + v_svcert + update +} + +proc set_crtdir {} { + global svcert crtdir + set idir [get_idir_certs $crtdir] + set t "" + if {$idir != ""} { + set t [tk_chooseDirectory -initialdir $idir] + } else { + set t [tk_chooseDirectory] + } + if {$t != ""} { + set svcert "" + set crtdir $t + } + catch {wm deiconify .c} + update +} + +proc set_createcert_file {} { + global ccert + if {[info exists ccert(FILE)]} { + set idir [get_idir_certs $ccert(FILE)] + } + if {$idir != ""} { + set t [tk_getSaveFile -defaultextension ".pem" -initialdir $idir] + } else { + set t [tk_getSaveFile -defaultextension ".pem"] + } + if {$t != ""} { + set ccert(FILE) $t + } + catch {raise .ccrt} + update +} + +proc check_pp {} { + global ccert + if {$ccert(ENC)} { + catch {.ccrt.pf.e configure -state normal} + catch {focus .ccrt.pf.e} + catch {.ccrt.pf.e icursor end} + } else { + catch {.ccrt.pf.e configure -state disabled} + } +} + +proc get_openssl {} { + global is_windows + if {$is_windows} { + set ossl "openssl.exe" + } else { + set ossl "openssl" + } +} + +proc get_x509_info {crt} { + set ossl [get_openssl] + set info "" + update + set ph [open "| $ossl x509 -text -in \"$crt\"" "r"] + while {[gets $ph line] > -1} { + append info "$line\n" + } + close $ph + return $info +} + +proc do_oss_create {} { + global is_windows is_win9x + + set cfg { +[ req ] +default_bits = 2048 +encrypt_key = yes +distinguished_name = req_distinguished_name + +[ req_distinguished_name ] +countryName = Country Name (2 letter code) +countryName_default = %CO +countryName_min = 2 +countryName_max = 2 + +stateOrProvinceName = State or Province Name (full name) +stateOrProvinceName_default = %ST + +localityName = Locality Name (eg, city) +localityName_default = %LOC + +0.organizationName = Organization Name (eg, company) +0.organizationName_default = %ON + +organizationalUnitName = Organizational Unit Name (eg, section) +organizationalUnitName_default = %OUN + +commonName = Common Name (eg, YOUR name) +commonName_default = %CN +commonName_max = 64 + +emailAddress = Email Address +emailAddress_default = %EM +emailAddress_max = 64 +} + + global ccert + + if {$ccert(FILE) == ""} { + catch {destroy .c} + mesg "No output cert file supplied" + bell + return + } + if {! [regexp {\.pem$} $ccert(FILE)]} { + append ccert(FILE) ".pem" + } + set pem $ccert(FILE) + regsub {\.pem$} $ccert(FILE) ".crt" crt + + if {$ccert(ENC)} { + if {[string length $ccert(PASS)] < 4} { + catch {destroy .c} + mesg "Passphrase must be at least 4 characters long." + bell + return + } + } + if {[string length $ccert(CO)] != 2} { + catch {destroy .c} + mesg "Country Name must be at exactly 2 characters long." + bell + return + } + if {[string length $ccert(CN)] > 64} { + catch {destroy .c} + mesg "Common Name must be less than 65 characters long." + bell + return + } + if {[string length $ccert(EM)] > 64} { + catch {destroy .c} + mesg "Email Address must be less than 65 characters long." + bell + return + } + + foreach t {EM CN OUN ON LOC ST CO} { + + set val $ccert($t) + if {$val == ""} { + set val "none" + } + regsub "%$t" $cfg "$val" cfg + } + + global is_windows + + if {$is_windows} { + set tmp "cert.cfg" + } else { + set tmp "/tmp/cert.cfg." + append tmp [clock clicks -milliseconds] + catch {file delete $tmp} + if {[file exists $tmp]} { + catch {destroy .c} + mesg "file still exists: $tmp" + bell + return + } + catch {set fh [open $tmp "w"]} + catch {exec chmod 600 $tmp} + if {! [file exists $tmp]} { + catch {destroy .c} + mesg "cannot create: $tmp" + bell + return + } + } + set fh "" + catch {set fh [open $tmp "w"]} + if {$fh == ""} { + catch {destroy .c} + mesg "cannot create: $tmp" + bell + catch {file delete $tmp} + return + } + + puts $fh $cfg + close $fh + + set ossl [get_openssl] + + set cmd "$ossl req -config $tmp -nodes -new -newkey rsa:2048 -x509 -batch" + if {$ccert(DAYS) != ""} { + set cmd "$cmd -days $ccert(DAYS)" + } + if {$is_windows} { + set cmd "$cmd -keyout {$pem} -out {$crt}" + } else { + set cmd "$cmd -keyout \"$pem\" -out \"$crt\"" + } + + if {$is_windows} { + set emess "" + if {$is_win9x} { + catch {file delete $pem} + catch {file delete $crt} + update + eval exec $cmd & + catch {raise .} + set sl 0 + set max 100 + #if {$ccert(ENC)} { + # set max 100 + #} + set maxms [expr $max * 1000] + while {$sl < $maxms} { + set s2 [expr $sl / 1000] + mesg "running openssl ... $s2/$max" + if {[file exists $pem] && [file exists $crt]} { + after 2000 + break + } + after 500 + set sl [expr $sl + 500] + } + mesg "" + } else { + update + set rc [catch {eval exec $cmd} emess] + if {$rc != 0 && [regexp -nocase {error:} $emess]} { + tk_messageBox -type ok -icon error -message $emess -title "OpenSSL req command failed" + return + } + } + } else { + set geometry [xterm_center_geometry] + update +# exec xterm -geometry $geometry -title "Running OpenSSL" -e sh -c "$cmd" + unix_terminal_cmd $geometry "Running OpenSSL" "$cmd" + catch {file attributes $pem -permissions go-rw} + catch {file attributes $crt -permissions go-w} + } + catch {file delete $tmp} + + set bad "" + if {! [file exists $pem]} { + set bad "$pem " + } + if {! [file exists $crt]} { + set bad "$crt" + } + if {$bad != ""} { + tk_messageBox -type ok -icon error -message "Not created: $bad" -title "OpenSSL could not create cert" + catch {raise .c} + return + } + + if {$ccert(ENC) && $ccert(PASS) != ""} { + set cmd "$ossl rsa -in \"$pem\" -des3 -out \"$pem\" -passout stdin" + set ph "" + set emess "" + update + set rc [catch {set ph [open "| $cmd" "w"]} emess] + if {$rc != 0 || $ph == ""} { + tk_messageBox -type ok -icon error -message $emess -title "Count not encrypt private key" + catch {file delete $pem} + catch {file delete $crt} + return + } + puts $ph $ccert(PASS) + set emess "" + set rc [catch {close $ph} emess] + #puts $emess + #puts $rc + } + + set in [open $crt "r"] + set out [open $pem "a"] + while {[gets $in line] > -1} { + puts $out $line + } + close $in + close $out + + catch {raise .c} + set p . + if [winfo exists .c] { + set p .c + } + set reply [tk_messageBox -parent $p -type yesno -title "View Cert" -message "View Certificate and Info?"] + catch {raise .c} + if {$reply == "yes"} { + set w .view_cert + catch {destroy $w} + toplevel $w + scroll_text $w.f + set cert "" + set fh "" + catch {set fh [open $crt "r"]} + if {$fh != ""} { + while {[gets $fh line] > -1} { + append cert "$line\n" + } + catch {close $fh} + } + + global yegg + set yegg "" + button $w.b -text Dismiss -command "destroy $w; set yegg 1" + pack $w.b -side bottom -fill x + bind $w <Escape> "destroy $w; set yegg 1" + + $w.f.t insert end "\n" + $w.f.t insert end "$crt:\n" + $w.f.t insert end "\n" + $w.f.t insert end $cert + $w.f.t insert end "\n" + + set info [get_x509_info $crt] + $w.f.t insert end $info + + pack $w.f -side top -fill both -expand 1 + center_win $w + catch {raise $w} + vwait yegg + catch {raise .c} + } + + set p . + if [winfo exists .c] { + set p .c + } + set reply [tk_messageBox -parent $p -type yesno -title "View Private Key" -message "View Private Key?"] + catch {raise .c} + if {$reply == "yes"} { + set w .view_key + catch {destroy $w} + toplevel $w + scroll_text $w.f + set key "" + set fh [open $pem "r"] + while {[gets $fh line] > -1} { + append key "$line\n" + } + close $fh + + global yegg + set yegg "" + button $w.b -text Dismiss -command "destroy $w; set yegg 1" + pack $w.b -side bottom -fill x + bind $w <Escape> "destroy $w; set yegg 1" + + $w.f.t insert end "\n" + $w.f.t insert end "$pem:\n" + $w.f.t insert end "\n" + $w.f.t insert end $key + $w.f.t insert end "\n" + + pack $w.f -side top -fill both -expand 1 + center_win $w + catch {raise $w} + vwait yegg + catch {raise .c} + } +} + +proc create_cert {} { + + catch {destroy .ccrt} + toplevel .ccrt + wm title .ccrt "Create SSL Certificate" + + global uname + if {$uname == "Darwin"} { + scroll_text .ccrt.f 80 20 + } else { + scroll_text .ccrt.f 80 30 + } + + set msg { + This dialog helps you to create a simple self-signed SSL certificate. + + On Unix the openssl(1) program must be installed and in $PATH. + On Windows, a copy of the openssl program is provided for convenience. + + The resulting certificate files can be used for either: + + 1) authenticating yourself (VNC Viewer) to a VNC Server + or 2) your verifying the identity of a remote VNC Server. + + In either case you will need to safely copy one of the generated + certificate files to the remote VNC Server and have the VNC Server use + it. Or you could send it to the system administrator of the VNC Server. + + For the purpose of description, assume that the filename selected in the + "Save to file" entry is "vnccert.pem". That file will be generated + by this process and so will the "vnccert.crt" file. "vnccert.pem" + contains both the Private Key and the Public Certificate. "vnccert.crt" + only contains the Public Certificate. + + For case 1) you would copy "vnccert.crt" to the VNC Server side and + instruct the server to use it. For x11vnc it would be for example: + + x11vnc -sslverify /path/to/vnccert.crt -ssl SAVE ... + + (it is also possible to handle many client certs at once in a directory, + see the -sslverify documentation). Then you would use "vnccert.pem" + as the MyCert entry in the Set SSL Certificates dialog. + + For case 2) you would copy "vnccert.pem" to the VNC Server side and + instruct the server to use it. For x11vnc it would be for example: + + x11vnc -ssl /path/to/vnccert.pem + + Then you would use "vnccert.crt" as the as the ServerCert entry in the + "Set SSL Certificates" dialog. + + + Creating the Certificate: + + Choose a output filename (ending in .pem) in the "Save to file" entry. + + Then fill in the identification information (Country, State or Province, + etc). + + The click on "Create" to generate the certificate files. + + Encrypting the Private Key: It is a very good idea to encrypt the + Private Key that goes in the "vnccert.pem". The downside is that + whenever that key is used (e.g. starting up x11vnc using it) then + the passphrase will need to be created. If you do not encrypt it and + somebody steals a copy of the "vnccert.pem" file then they can pretend + to be you. + + After you have created the certificate files, you must copy and import + either "vnccert.pem" or "vnccert.pem" to the remote VNC Server and + also select the other file in the "Set SSL Certificates" dialog. + See the description above. + + For more information see: + + http://www.karlrunge.com/x11vnc/ssl.html + http://www.karlrunge.com/x11vnc/#faq-ssl-tunnel-int + + The first one describes how to use x11vnc to create Certificate + Authority (CA) certificates in addition to self-signed ones. + + + Tip: if you choose the "Common Name" to be the internet hostname + (e.g. gateway.mydomain.com) that connections will be made to or + from that will avoid many dialogs when connecting mentioning that + the hostname does not match the Common Name. +} + .ccrt.f.t insert end $msg + + global ccert ccert_init tcert + + + if {! [info exists ccert_init]} { + set ccert_init 1 + set ccert(CO) "US" + set ccert(ST) "Massachusetts" + set ccert(LOC) "Boston" + set ccert(ON) "My Company" + set ccert(OUN) "Product Development" + set ccert(CN) "www.nowhere.none" + set ccert(EM) "admin@nowhere.none" + set ccert(DAYS) "365" + set ccert(FILE) "" + } + + set ccert(ENC) 0 + set ccert(PASS) "" + + set tcert(CO) "Country Name (2 letter code):" + set tcert(ST) "State or Province Name (full name):" + set tcert(LOC) "Locality Name (eg, city):" + set tcert(ON) "Organization Name (eg, company):" + set tcert(OUN) "Organizational Unit Name (eg, section):" + set tcert(CN) "Common Name (eg, YOUR name):" + set tcert(EM) "Email Address:" + set tcert(DAYS) "Days until expiration:" + + if {$ccert(FILE) == ""} { + set idir [get_idir_certs ""] + set ccert(FILE) "$idir/vnccert.pem" + } + + button .ccrt.cancel -text "Cancel" -command {destroy .ccrt; catch {raise .c}} + bind .ccrt <Escape> {destroy .ccrt; catch {raise .c}} + + button .ccrt.create -text "Generate Cert" -command {destroy .ccrt; catch {raise .c}; do_oss_create} + + pack .ccrt.cancel .ccrt.create -side bottom -fill x + + set ew 40 + + set w .ccrt.pf + frame $w + checkbutton $w.check -anchor w -variable ccert(ENC) -text \ + "Encrypt Key with Passphrase" -command {check_pp} + + entry $w.e -width $ew -textvariable ccert(PASS) -state disabled \ + -show * + + pack $w.e -side right + pack $w.check -side left -expand 1 -fill x + pack $w -side bottom -fill x + + set w .ccrt.fl + frame $w + label $w.l -anchor w -text "Save to file:" + + entry $w.e -width $ew -textvariable ccert(FILE) + button $w.b -text "Browse..." -command {set_createcert_file; catch {raise .ccrt}} + + pack $w.e -side right + pack $w.b -side right + pack $w.l -side left -expand 1 -fill x + pack $w -side bottom -fill x + + set i 0 + foreach t {DAYS EM CN OUN ON LOC ST CO} { + set w .ccrt.f$i + frame $w + label $w.l -anchor w -text "$tcert($t)" + entry $w.e -width $ew -textvariable ccert($t) + pack $w.e -side right + pack $w.l -side left -expand 1 -fill x + pack $w -side bottom -fill x + incr i + } + + pack .ccrt.f -side top -fill both -expand 1 + + center_win .ccrt +} + +proc import_check_mode {w} { + global import_mode + if {$import_mode == "paste"} { + $w.mf.b configure -state disabled + $w.mf.e configure -state disabled + $w.plab configure -state normal + $w.paste.t configure -state normal + } else { + $w.mf.b configure -state normal + $w.mf.e configure -state normal + $w.plab configure -state disabled + $w.paste.t configure -state disabled + } +} + +proc import_browse {} { + global import_file + + set idir "" + if {$import_file != ""} { + set idir [get_idir_certs $import_file] + } + if {$idir != ""} { + set t [tk_getOpenFile -initialdir $idir] + } else { + set t [tk_getOpenFile] + } + if {$t != ""} { + set import_file $t + } + catch {raise .icrt} + update +} + +proc import_save_browse {} { + global import_save_file + + set idir "" + if {$import_save_file != ""} { + set idir [get_idir_certs $import_save_file] + } + if {$idir == ""} { + set idir [get_idir_certs ""] + } + if {$idir != ""} { + set t [tk_getSaveFile -defaultextension ".crt" -initialdir $idir] + } else { + set t [tk_getSaveFile -defaultextension ".crt"] + } + if {$t != ""} { + set import_save_file $t + } + catch {raise .icrt} + update +} + +proc do_save {} { + global import_mode import_file import_save_file + + if {$import_save_file == ""} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message "No Save File supplied" -title "Save File" + return + } + + set str "" + if {$import_mode == "paste"} { + set str [.icrt.paste.t get 1.0 end] + } else { + if {! [file exists $import_file]} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message "Input file \"$import_file\" does not exist." -title "Import File" + return + } + set fh "" + set emess "" + set rc [catch {set fh [open $import_file "r"]} emess] + if {$rc != 0 || $fh == ""} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message $emess -title "Import File: $import_file" + return + } + while {[gets $fh line] > -1} { + append str "$line\n" + } + close $fh + } + + if {! [regexp {BEGIN CERTIFICATE} $str]} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message "Import Text does not contain \"BEGIN CERTIFICATE\"" -title "Imported Text" + return + } + if {! [regexp {END CERTIFICATE} $str]} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message "Import Text does not contain \"END CERTIFICATE\"" -title "Imported Text" + return + } + + set fh "" + set emess "" + set rc [catch {set fh [open $import_save_file "w"]} emess] + if {$rc != 0 || $fh == ""} { + tk_messageBox -parent .icrt -type ok -icon error \ + -message $emess -title "Save File: $import_save_file" + return + } + global is_windows + if {! $is_windows} { + catch {file attributes $import_save_file -permissions go-w} + if {[regexp {PRIVATE} $str] || [regexp {\.pem$} $import_save_file]} { + catch {file attributes $import_save_file -permissions go-rw} + } + } + puts -nonewline $fh $str + close $fh + catch {destroy .icrt} + catch {raise .c} + tk_messageBox -parent .c -type ok -icon info \ + -message "Saved to file: $import_save_file" -title "Save File: $import_save_file" +} + +proc import_cert {} { + + catch {destroy .icrt} + toplevel .icrt + wm title .icrt "Import SSL Certificate" + + global scroll_text_focus + set scroll_text_focus 0 + global uname + if {$uname == "Darwin"} { + scroll_text .icrt.f 90 16 + } else { + scroll_text .icrt.f 90 20 + } + set scroll_text_focus 1 + + set msg { + This dialog lets you import a SSL Certificate by either pasting one in or by + loading from another file. Choose which input mode you want to use by the toggle + "Paste / Read from File". + + There are two types of files we use 1) Certificate only, and 2) Private Key + and Certificate. + + Type 1) would be used to verify the identity of a remote VNC Server, whereas + type 2) would be used to authenticate ourselves to the remote VNC Server. + + A type 1) by convention ends with file suffix ".crt" and looks like: + +-----BEGIN CERTIFICATE----- +MIID2jCCAsKgAwIBAgIJALKypfV8BItCMA0GCSqGSIb3DQEBBAUAMIGgMQswCQYD +(more lines) ... +TCQ+tbQ/DOiTXGKx1nlcKoPdkG+QVQVJthlQcpam +-----END CERTIFICATE----- + + A type 2) by convention ends with file suffix ".pem" and looks like: + +-----BEGIN RSA PRIVATE KEY----- +MIIEpAIBAAKCAQEA4sApd7WaPKQRWnFe9T04D4pglQB0Ti0/dCVHxg8WEVQ8OdcW +(more lines) ... +9kBmNotUiTpvRM+e7E/zRemhvY9qraFooqMWzi9JrgYfeLfSvvFfGw== +-----END RSA PRIVATE KEY----- +-----BEGIN CERTIFICATE----- +MIID2jCCAsKgAwIBAgIJALKypfV8BItCMA0GCSqGSIb3DQEBBAUAMIGgMQswCQYD +(more lines) ... +TCQ+tbQ/DOiTXGKx1nlcKoPdkG+QVQVJthlQcpam +-----END CERTIFICATE----- + + You do not need to use the ".crt" or ".pem" convention if you do not want to. + + First, either paste in the text or set the "Read from File" filename. + + Next, set the "Save to File" name to the file where the imported certificate + will be saved. + + Then, click on "Save" to save the imported Certificate. + + After you have imported the Certificate (or Key + Certificate), select it to + use for a connection via the "MyCert" or "ServerCert" dialog. +} + .icrt.f.t insert end $msg + + global icert import_mode + + set import_mode "paste" + + set w .icrt.mf + frame $w + + radiobutton $w.p -pady 1 -anchor w -variable import_mode -value paste \ + -text "Paste" -command "import_check_mode .icrt" + + radiobutton $w.f -pady 1 -anchor w -variable import_mode -value file \ + -text "Read from File:" -command "import_check_mode .icrt" + + global import_file + set import_file "" + entry $w.e -width 40 -textvariable import_file + + button $w.b -pady 1 -anchor w -text "Browse..." -command import_browse + pack $w.b -side right + pack $w.p $w.f -side left + pack $w.e -side left -expand 1 -fill x + + $w.b configure -state disabled + $w.e configure -state disabled + + label .icrt.plab -anchor w -text "Paste Certificate here:" + if {$uname == "Darwin"} { + scroll_text .icrt.paste 90 11 + } else { + scroll_text .icrt.paste 90 22 + } + + button .icrt.cancel -text "Cancel" -command {destroy .icrt; catch {raise .c}} + bind .icrt <Escape> {destroy .icrt; catch {raise .c}} + + button .icrt.save -text "Save" -command {do_save} + + set w .icrt.sf + frame $w + + label $w.l -text "Save to File:" -anchor w + global import_save_file + set import_save_file "" + entry $w.e -width 40 -textvariable import_save_file + button $w.b -pady 1 -anchor w -text "Browse..." -command import_save_browse + + pack $w.b -side right + pack $w.l -side left + pack $w.e -side left -expand 1 -fill x + + pack .icrt.cancel .icrt.save .icrt.sf .icrt.mf -side bottom -fill x + pack .icrt.paste .icrt.plab -side bottom -fill x + + pack .icrt.f -side top -fill both -expand 1 + + .icrt.paste.t insert end "" + + focus .icrt.paste.t + + center_win .icrt +} + + +proc getcerts {} { + global mycert svcert crtdir + global use_ssh use_sshssl + catch {destroy .c} + toplevel .c + wm title .c "Set SSL Certificates" + frame .c.mycert + frame .c.svcert + frame .c.crtdir + label .c.mycert.l -anchor w -width 12 -text "MyCert:" + label .c.svcert.l -anchor w -width 12 -text "ServerCert:" + label .c.crtdir.l -anchor w -width 12 -text "CertsDir:" + + entry .c.mycert.e -width 32 -textvariable mycert -vcmd v_mycert + entry .c.svcert.e -width 32 -textvariable svcert -vcmd v_svcert + bind .c.mycert.e <Enter> {.c.mycert.e validate} + bind .c.mycert.e <Leave> {.c.mycert.e validate} + bind .c.svcert.e <Enter> {.c.svcert.e validate} + bind .c.svcert.e <Leave> {.c.svcert.e validate} + entry .c.crtdir.e -width 32 -textvariable crtdir + button .c.mycert.b -text "Browse..." -command {set_mycert; catch {raise .c}} + button .c.svcert.b -text "Browse..." -command {set_svcert; catch {raise .c}} + button .c.crtdir.b -text "Browse..." -command {set_crtdir; catch {raise .c}} + button .c.mycert.i -text "Info" -command {show_mycert} + button .c.svcert.i -text "Info" -command {show_svcert} + button .c.crtdir.i -text "Info" -command {} + .c.mycert.i configure -state disabled + .c.svcert.i configure -state disabled + .c.crtdir.i configure -state disabled + bind .c.mycert.b <B3-ButtonRelease> "show_mycert" + bind .c.svcert.b <B3-ButtonRelease> "show_svcert" + + button .c.create -text "Create Certificate ..." -command {create_cert} + button .c.import -text "Import Certificate ..." -command {import_cert} + + frame .c.b + button .c.b.done -text "Done" -command {catch {destroy .c}} + bind .c <Escape> {destroy .c} + button .c.b.help -text "Help" -command help_certs + pack .c.b.help .c.b.done -fill x -expand 1 -side left + + foreach w [list mycert svcert crtdir] { + pack .c.$w.l -side left + pack .c.$w.e -side left -expand 1 -fill x + pack .c.$w.b -side left + pack .c.$w.i -side left + bind .c.$w.e <Return> ".c.$w.b invoke" + if {$use_ssh} { + .c.$w.l configure -state disabled + .c.$w.e configure -state disabled + .c.$w.b configure -state disabled + } + } + + pack .c.mycert .c.svcert .c.crtdir .c.create .c.import .c.b -side top -fill x + center_win .c + wm resizable .c 1 0 + + focus .c +} + +proc get_profiles_dir {} { + global env is_windows + + set dir "" + if {$is_windows} { + set t [file dirname [pwd]] + set t "$t/profiles" + if [file isdirectory $t] { + set dir $t + } + } elseif [info exists env(HOME)] { + set t "$env(HOME)/.vnc" + if [file isdirectory $t] { + set dir $t + set s "$t/profiles" + if {! [file exists $s]} { + catch {file mkdir $s} + } + } + } + + if {$dir != ""} { + + } elseif [info exists env(SSL_VNC_BASEDIR)] { + set dir $env(SSL_VNC_BASEDIR) + } else { + set dir [pwd] + } + if [file isdirectory "$dir/profiles"] { + set dir "$dir/profiles" + } + return $dir +} + +proc globalize {} { + global defs + foreach var [array names defs] { + uplevel global $var + } +} + +proc load_include {include dir} { + global include_vars defs + + if [info exists include_vars] { + unset include_vars + } + + foreach inc [split $include ", "] { + set f [string trim $inc] +#puts "f=$f"; + if {$f == ""} { + continue + } + set try "" + if {[regexp {/} $f] || [regexp {\\} $f]} { + set try $f; + } else { + set try "$dir/$f" + } + if {! [file exists $try]} { + set try "$dir/$f.vnc" + } +#puts "try: $try" + if [file exists $try] { + set fh "" + catch {set fh [open $try "r"]} + if {$fh == ""} { + continue + } + while {[gets $fh line] > -1} { + append inc_str "$line\n" + if [regexp {^([^=]*)=(.*)$} $line m var val] { + if {! [info exists defs($var)]} { + continue + } + if {$var == "include_list"} { + continue + } + set pct 0 + if {$var == "smb_mount_list"} { + set pct 1 + } + if {$var == "port_knocking_list"} { + set pct 1 + } + if {$pct} { + regsub -all {%%%} $val "\n" val + } + if {$val != $defs($var)} { +#puts "include_vars $var $val" + set include_vars($var) $val + } + } + } + catch {close $fh} + } + } +} + +proc load_profile {} { + global profdone + global vncdisplay + + globalize + + set dir [get_profiles_dir] + + set file [tk_getOpenFile -defaultextension ".vnc" \ + -initialdir $dir -title "Load VNC Profile"] + if {$file == ""} { + set profdone 1 + return + } + set fh [open $file "r"] + if {! [info exists fh]} { + set profdone 1 + return + } + set str "" + set include "" + while {[gets $fh line] > -1} { + append str "$line\n" + if [regexp {^include_list=(.*)$} $line m val] { + set include $val + } + } + close $fh + + if {$include != ""} { + load_include $include $dir + } + + set_defaults + + global include_vars + if [info exists include_vars] { + foreach var [array names include_vars] { + set $var $include_vars($var) + } + } + + global defs + foreach line [split $str "\n"] { + set line [string trim $line] + if [regexp {^#} $line] { + continue + } + if [regexp {^([^=]*)=(.*)$} $line m var val] { + if {$var == "disp"} { + set vncdisplay $val + continue + } + if [info exists defs($var)] { + set pct 0 + if {$var == "smb_mount_list"} { + set pct 1 + } + if {$var == "port_knocking_list"} { + set pct 1 + } + if {$pct} { + regsub -all {%%%} $val "\n" val + } + set $var $val + } + } + } + + set compresslevel_text "Compress Level: $use_compresslevel" + set quality_text "Quality: $use_quality" + + set profdone 1 + putty_pw_entry check +} + +proc save_profile {} { + global is_windows uname + global vncdisplay + global profdone + global include_vars defs + + globalize + + set dir [get_profiles_dir] + + set disp [string trim $vncdisplay] + if {$disp != ""} { + regsub {[ ].*$} $disp "" disp + regsub -all {/} $disp "" disp + } + if {$is_windows || $uname == "Darwin"} { + regsub -all {:} $disp "_" disp + } + + set file [tk_getSaveFile -defaultextension ".vnc" \ + -initialdir $dir -initialfile "$disp" -title "Save VNC Profile"] + if {$file == ""} { + set profdone 1 + return + } + set fh [open $file "w"] + if {! [info exists fh]} { + set profdone 1 + return + } + set h [string trim $vncdisplay] + set p $h + regsub {:.*$} $h "" h + set host $h + regsub {[ ].*$} $p "" p + regsub {^.*:} $p "" p + regsub { .*$} $p "" p + if {$p == ""} { + set p 0 + } + if {$p < 200} { + set port [expr $p + 5900] + } else { + set port $p + } + + set h [string trim $vncdisplay] + regsub {cmd=.*$} $h "" h + set h [string trim $h] + if {! [regexp {[ ]} $h]} { + set h "" + } else { + regsub {^.*[ ]} $h "" h + } + if {$h == ""} { + set proxy "" + set proxyport "" + } else { + set p $h + regsub {:.*$} $h "" h + set proxy $h + regsub {[ ].*$} $p "" p + regsub {^.*:} $p "" p + if {$p == ""} { + set proxyport 0 + } else { + set proxyport $p + } + } + + puts $fh "\[connection\]" + puts $fh "host=$host" + puts $fh "port=$port" + puts $fh "proxyhost=$proxy" + puts $fh "proxyport=$proxyport" + puts $fh "disp=$vncdisplay" + puts $fh "\n\[options\]" + + if {$include_list != ""} { + load_include $include_list [get_profiles_dir] + } + + foreach var [lsort [array names defs]] { + eval set val \$$var + set pre "" + if {$val == $defs($var)} { + set pre "#" + } + set pct 0 + if {$var == "smb_mount_list"} { + set pct 1 + } + if {$var == "port_knocking_list"} { + set pct 1 + } + if {$include_list != "" && [info exists include_vars($var)]} { + if {$val == $include_vars($var)} { + if {$pct} { + regsub -all "\n" $val "%%%" val + } + puts $fh "#from include: $var=$val" + continue + } + } + if {$pct} { + regsub -all "\n" $val "%%%" val + } + puts $fh "$pre$var=$val" + } + + close $fh + set profdone 1 +} + +proc set_ssh {} { + global use_ssh use_sshssl + if {! $use_ssh && ! $use_sshssl} { + set use_ssh 1 + } + putty_pw_entry check +} + +proc expand_IP {redir} { + if {! [regexp {:IP:} $redir]} { + return $redir + } + if {! [regexp {(-R).*:IP:} $redir]} { + return $redir + } + + set ip [guess_ip] + set ip [string trim $ip] + if {$ip == ""} { + return $redir + } + + regsub -all {:IP:} $redir ":$ip:" redir + return $redir +} + +proc get_cups_redir {} { + global cups_local_server cups_remote_port + global cups_local_smb_server cups_remote_smb_port + set redir "$cups_remote_port:$cups_local_server" + regsub -all {['" ]} $redir {} redir; #" + set redir " -R $redir" + if {$cups_local_smb_server != "" && $cups_remote_smb_port != ""} { + set redir2 "$cups_remote_smb_port:$cups_local_smb_server" + regsub -all {['" ]} $redir2 {} redir2; #" + set redir "$redir -R $redir2" + } + set redir [expand_IP $redir] + return $redir +} + +proc get_additional_redir {} { + global additional_port_redirs additional_port_redirs_list + if {! $additional_port_redirs || $additional_port_redirs_list == ""} { + return "" + } + set redir [string trim $additional_port_redirs_list] + regsub -all {['"]} $redir {} redir; #" + set redir " $redir" + set redir [expand_IP $redir] + return $redir +} + +proc get_sound_redir {} { + global sound_daemon_remote_port sound_daemon_local_port + set loc $sound_daemon_local_port + if {! [regexp {:} $loc]} { + set loc "localhost:$loc" + } + set redir "$sound_daemon_remote_port:$loc" + regsub -all {['" ]} $redir {} redir; #" + set redir " -R $redir" + set redir [expand_IP $redir] + return $redir +} + +proc get_smb_redir {} { + global smb_mount_list + + set s [string trim $smb_mount_list] + if {$s == ""} { + return "" + } + + set did(0) 1 + set redir "" + set mntlist "" + + foreach line [split $s "\r\n"] { + set str [string trim $line] + if {$str == ""} { + continue + } + if {[regexp {^#} $str]} { + continue + } + + set port "" + if [regexp {^([0-9][0-9]*)[ \t][ \t]*(.*)} $str mvar port rest] { + # leading port + set str [string trim $rest] + } + + # grab: //share /dest [host[:port]] + set share "" + set dest "" + set hostport "" + foreach item [split $str] { + if {$item == ""} { + continue + } + if {$share == ""} { + set share [string trim $item] + } elseif {$dest == ""} { + set dest [string trim $item] + } elseif {$hostport == ""} { + set hostport [string trim $item] + } + } + + regsub {^~/} $dest {$HOME/} dest + + # work out the local host:port + set lhost "" + set lport "" + if {$hostport != ""} { + if [regexp {(.*):(.*)} $hostport mvar lhost lport] { + ; + } else { + set lhost $hostport + set lport 139 + } + } else { + if [regexp {//([^/][^/]*)/} $share mvar h] { + if [regexp {(.*):(.*)} $h mvar lhost lport] { + ; + } else { + set lhost $h + set lport 139 + } + } else { + set lhost localhost + set lport 139 + } + } + + if {$port == ""} { + if [info exists did("$lhost:$lport")] { + # reuse previous one: + set port $did("$lhost:$lport") + } else { + # choose one at random: + for {set i 0} {$i < 3} {incr i} { + set port [expr 20100 + 9000 * rand()] + set port [expr round($port)] + if { ! [info exists did($port)] } { + break + } + } + } + set did($port) 1 + } + + if {$mntlist != ""} { + append mntlist " " + } + append mntlist "$share,$dest,$port" + + if { ! [info exists did("$lhost:$lport")] } { + append redir " -R $port:$lhost:$lport" + set did("$lhost:$lport") $port + } + } + + regsub -all {['"]} $redir {} redir; #" + set redir [expand_IP $redir] + + regsub -all {['"]} $mntlist {} mntlist; #" + + set l [list] + lappend l $redir + lappend l $mntlist + return $l +} + +proc ugly_setup_scripts {mode tag} { + +set cmd(1) { + SSHD_PID="" + FLAG=$HOME/.vnc-helper-flag__PID__ + + if [ "X$USER" = "X" ]; then + USER=$LOGNAME + fi + + DO_CUPS=0 + cups_dir=$HOME/.cups + cups_cfg=$cups_dir/client.conf + cups_host=localhost + cups_port=NNNN + + DO_SMB=0 + DO_SMB_SU=0 + DO_SMB_WAIT=0 + smb_mounts= + DONE_PORT=NNNN + smb_script=$HOME/.smb-mounts__PID__.sh + + DO_SOUND=0 + DO_SOUND_KILL=0 + DO_SOUND_RESTART=0 + sound_daemon_remote_prog= + sound_daemon_remote_args= + + findpid() { + i=1 + back=10 + touch $FLAG + + if [ "X$TOPPID" = "X" ]; then + TOPPID=$$ + back=50 + fi + + while [ $i -lt $back ] + do + try=`expr $TOPPID - $i` + if ps $try 2>/dev/null | grep sshd >/dev/null; then + SSHD_PID="$try" + echo SSHD_PID=$try + echo + break + fi + i=`expr $i + 1` + done + echo MY_PID=$$ + tty + echo + } + + wait_til_ssh_gone() { + try_perl="" + if type perl >/dev/null 2>&1; then + try_perl=1 + fi + uname=`uname` + if [ "X$uname" != "XLinux" -a "X$uname" != "XSunOS" ]; then + try_perl="" + fi + if [ "X$try_perl" = "X1" ]; then + # try to avoid wasting pids: + perl -e "while (1) {if(! -e \"/proc/$SSHD_PID\"){exit} if(! -f \"$FLAG\"){exit} sleep 1;}" + else + while [ 1 ] + do + ps $SSHD_PID > /dev/null 2>&1 + if [ $? != 0 ]; then + break + fi + if [ ! -f $FLAG ]; then + break + fi + sleep 1 + done + fi + rm -f $FLAG + if [ "X$DO_SMB_WAIT" = "X1" ]; then + rm -f $smb_script + fi + } +}; + +set cmd(2) { + update_client_conf() { + mkdir -p $cups_dir + if [ -f $cups_cfg ]; then + cp -p $cups_cfg $cups_cfg.back + else + touch $cups_cfg.back + fi + sed -e "s/^ServerName/#-etv-#ServerName/" $cups_cfg.back > $cups_cfg + echo "ServerName $cups_host:$cups_port" >> $cups_cfg + echo + echo "--------------------------------------------------------------" + echo "The CUPS $cups_cfg config file has been set to:" + echo + cat $cups_cfg + echo + echo "If there are problems automatically restoring it, edit or" + echo "remove the file to go back to local CUPS settings." + echo + echo "A backup has been placed in: $cups_cfg.back" + echo + echo "See the help description for more details on printing." + echo + echo "done." + echo "--------------------------------------------------------------" + echo + } + + reset_client_conf() { + cp -p $cups_cfg $cups_cfg.tmp + grep -v "^ServerName" $cups_cfg.tmp | sed -e "s/^#-etv-#ServerName/ServerName/" > $cups_cfg + rm -f $cups_cfg.tmp + } + + cupswait() { + trap "" INT QUIT HUP + wait_til_ssh_gone + reset_client_conf + } +}; + +# if [ "X$DONE_PORT" != "X" ]; then +# if type perl >/dev/null 2>&1; then +# perl -e "use IO::Socket::INET; \$SIG{INT} = \"IGNORE\"; \$SIG{QUIT} = \"IGNORE\"; \$SIG{HUP} = \"INGORE\"; my \$client = IO::Socket::INET->new(Listen => 5, LocalAddr => \"localhost\", LocalPort => $DONE_PORT, Proto => \"tcp\")->accept(); \$line = <\$client>; close \$client; unlink \"$smb_script\";" </dev/null >/dev/null 2>/dev/null & +# if [ $? = 0 ]; then +# have_perl_done="1" +# fi +# fi +# fi + +set cmd(3) { + smbwait() { + trap "" INT QUIT HUP + wait_til_ssh_gone + } + do_smb_mounts() { + if [ "X$smb_mounts" = "X" ]; then + return + fi + echo > $smb_script + have_perl_done="" + echo "echo" >> $smb_script + dests="" + for mnt in $smb_mounts + do + smfs=`echo "$mnt" | awk -F, "{print \\\$1}"` + dest=`echo "$mnt" | awk -F, "{print \\\$2}"` + port=`echo "$mnt" | awk -F, "{print \\\$3}"` + dest=`echo "$dest" | sed -e "s,__USER__,$USER,g" -e "s,__HOME__,$HOME,g"` + if [ ! -d $dest ]; then + mkdir -p $dest + fi + echo "echo SMBMOUNT:" >> $smb_script + echo "echo smbmount $smfs $dest -o uid=$USER,ip=127.0.0.1,ttl=20000,port=$port" >> $smb_script + echo "smbmount \"$smfs\" \"$dest\" -o uid=$USER,ip=127.0.0.1,ttl=20000,port=$port" >> $smb_script + echo "echo; df \"$dest\"; echo" >> $smb_script + dests="$dests $dest" + done + #} +}; + +set cmd(4) { + echo "(" >> $smb_script + echo "trap \"\" INT QUIT HUP" >> $smb_script + + try_perl="" + if type perl >/dev/null 2>&1; then + try_perl=1 + fi + uname=`uname` + if [ "X$uname" != "XLinux" -a "X$uname" != "XSunOS" ]; then + try_perl="" + fi + + if [ "X$try_perl" = "X" ]; then + echo "while [ -f $smb_script ]" >> $smb_script + echo "do" >> $smb_script + echo " sleep 1" >> $smb_script + echo "done" >> $smb_script + else + echo "perl -e \"while (-f \\\\\"$smb_script\\\\\") {sleep 1;} exit 0;\"" >> $smb_script + fi + for dest in $dests + do + echo "echo smbumount $dest" >> $smb_script + echo "smbumount \"$dest\"" >> $smb_script + done + echo ") &" >> $smb_script + echo "--------------------------------------------------------------" + if [ "$DO_SMB_SU" = "0" ]; then + echo "We now run the smbmount script as user $USER" + echo + echo sh $smb_script + sh $smb_script + rc=0 + elif [ "$DO_SMB_SU" = "1" ]; then + echo "We now run the smbmount script via su(1)" + echo + echo "The first \"Password:\" will be for that of root to run the smbmount script." + echo + echo "Subsequent \"Password:\" will be for the SMB share(s) (hit Return if no passwd)" + echo + echo SU: + echo "su root -c \"sh $smb_script\"" + su root -c "sh $smb_script" + rc=$? + elif [ "$DO_SMB_SU" = "2" ]; then + echo "We now run the smbmount script via sudo(8)" + echo + echo "The first \"Password:\" will be for that of the sudo(8) password." + echo + echo "Subsequent \"Password:\" will be for the SMB shares (hit enter if no passwd)" + echo + echo SUDO: + echo sudo sh $smb_script + sudo sh $smb_script + rc=$? + fi +}; + +set cmd(5) { + #{ + echo + if [ "$rc" = 0 ]; then + if [ "X$have_perl_done" = "X1" -o 1 = 1 ] ; then + echo + echo "Your SMB shares will be unmounted when the VNC connection closes," + echo "*As Long As* No Applications have any of the share files opened or are" + echo "cd-ed into any of the share directories." + echo + echo "Try to make sure nothing is accessing the SMB shares before disconnecting" + echo "the VNC session. If you fail to do that follow these instructions:" + fi + echo + echo "To unmount your SMB shares make sure no applications are still using any of" + echo "the files and no shells are still cd-ed into the share area, then type:" + echo + echo " rm -f $smb_script" + echo + echo "In the worst case run: smbumount /path/to/mount/point for each mount as root" + echo "Even with the remote redirection gone the kernel should umount after a timeout." + else + echo + if [ "$DO_SMB_SU" = "1" ]; then + echo "su(1) to run smbmount(8) failed." + elif [ "$DO_SMB_SU" = "2" ]; then + echo "sudo(8) to run smbmount(8) failed." + fi + rm -f $smb_script + fi + echo + echo "done." + echo "--------------------------------------------------------------" + echo + } +}; + +set cmd(6) { + + setup_sound() { + dpid="" + d=$sound_daemon_remote_prog + if type pgrep >/dev/null 2>/dev/null; then + dpid=`pgrep -U $USER -x $d | head -1` + else + dpid=`env PATH=/usr/ucb:$PATH ps wwwwaux | grep -w $USER | grep -w $d | grep -v grep | head -1` + fi + echo "--------------------------------------------------------------" + echo "Setting up Sound: pid=$dpid" + if [ "X$dpid" != "X" ]; then + dcmd=`env PATH=/usr/ucb:$PATH ps wwwwaux | grep -w $USER | grep -w $d | grep -w $dpid | grep -v grep | head -1 | sed -e "s/^.*$d/$d/"` + if [ "X$DO_SOUND_KILL" = "X1" ]; then + echo "Stopping sound daemon: $sound_daemon_remote_prog $dpid" + echo "sound cmd: $dcmd" + kill -TERM $dpid + fi + fi + echo + echo "done." + echo "--------------------------------------------------------------" + echo + } + + reset_sound() { + if [ "X$DO_SOUND_RESTART" = "X1" ]; then + d=$sound_daemon_remote_prog + a=$sound_daemon_remote_args + echo "Restaring sound daemon: $d $a" + $d $a </dev/null >/dev/null 2>&1 & + fi + } + + soundwait() { + trap "" INT QUIT HUP + wait_til_ssh_gone + reset_sound + } + + findpid + + if [ $DO_SMB = 1 ]; then + do_smb_mounts + fi + + waiter=0 + + if [ $DO_CUPS = 1 ]; then + update_client_conf + cupswait </dev/null >/dev/null 2>/dev/null & + waiter=1 + fi + + if [ $DO_SOUND = 1 ]; then + setup_sound + soundwait </dev/null >/dev/null 2>/dev/null & + waiter=1 + fi + if [ $DO_SMB_WAIT = 1 ]; then + if [ $waiter != 1 ]; then + smbwait </dev/null >/dev/null 2>/dev/null & + waiter=1 + fi + fi + + + #FINMSG + echo + echo "--vnc-helper-exiting--" + echo + #cat $0 + rm -f $0 + exit 0 +}; + + set cmdall "" + + for {set i 1} {$i <= 6} {incr i} { + set v $cmd($i); + regsub -all "\n" $v "%" v + set cmd($i) $v + append cmdall "echo " + if {$i == 1} { + append cmdall {TOPPID=$$%} + } + append cmdall {'} + append cmdall $cmd($i) + append cmdall {' | tr '%' '\n'} + if {$i == 1} { + append cmdall {>} + } else { + append cmdall {>>} + } + append cmdall {$HOME/.vnc-helper-cmd__PID__; } + } + append cmdall {sh $HOME/.vnc-helper-cmd__PID__; } + + regsub -all {vnc-helper-cmd} $cmdall "vnc-helper-cmd-$mode" cmdall + if {$tag == ""} { + set tag [pid] + } + regsub -all {__PID__} $cmdall "$tag" cmdall + + set orig $cmdall + + global use_cups cups_local_server cups_remote_port cups_manage_rcfile + if {$use_cups && $cups_manage_rcfile} { + if {$mode == "post"} { + regsub {DO_CUPS=0} $cmdall {DO_CUPS=1} cmdall + regsub {cups_port=NNNN} $cmdall "cups_port=$cups_remote_port" cmdall + } + } + + global use_smbmnt smb_su_mode smb_mounts + if {$use_smbmnt} { + if {$smb_mounts != ""} { + set smbm $smb_mounts + regsub -all {%USER} $smbm "__USER__" smbm + regsub -all {%HOME} $smbm "__HOME__" smbm + if {$mode == "pre"} { + regsub {DO_SMB=0} $cmdall {DO_SMB=1} cmdall + if {$smb_su_mode == "su"} { + regsub {DO_SMB_SU=0} $cmdall {DO_SMB_SU=1} cmdall + } elseif {$smb_su_mode == "sudo"} { + regsub {DO_SMB_SU=0} $cmdall {DO_SMB_SU=2} cmdall + } elseif {$smb_su_mode == "none"} { + regsub {DO_SMB_SU=0} $cmdall {DO_SMB_SU=0} cmdall + } else { + regsub {DO_SMB_SU=0} $cmdall {DO_SMB_SU=1} cmdall + } + regsub {smb_mounts=} $cmdall "smb_mounts=\"$smbm\"" cmdall + } elseif {$mode == "post"} { + regsub {DO_SMB_WAIT=0} $cmdall {DO_SMB_WAIT=1} cmdall + } + } + } + + global use_sound + if {$use_sound} { + if {$mode == "pre"} { + global sound_daemon_remote_cmd sound_daemon_kill sound_daemon_restart + if {$sound_daemon_kill} { + regsub {DO_SOUND_KILL=0} $cmdall {DO_SOUND_KILL=1} cmdall + regsub {DO_SOUND=0} $cmdall {DO_SOUND=1} cmdall + } + if {$sound_daemon_restart} { + regsub {DO_SOUND_RESTART=0} $cmdall {DO_SOUND_RESTART=1} cmdall + regsub {DO_SOUND=0} $cmdall {DO_SOUND=1} cmdall + } + set sp [string trim $sound_daemon_remote_cmd] + regsub {[ \t].*$} $sp "" sp + set sa [string trim $sound_daemon_remote_cmd] + regsub {^[^ \t][^ \t]*[ \t][ \t]*} $sa "" sa + regsub {sound_daemon_remote_prog=} $cmdall "sound_daemon_remote_prog=\"$sp\"" cmdall + regsub {sound_daemon_remote_args=} $cmdall "sound_daemon_remote_args=\"$sa\"" cmdall + } + } + + if {$mode == "pre"} { + set dopre 0 + if {$use_smbmnt && $smb_mounts != ""} { + set dopre 1 + } + if {$use_sound && $sound_daemon_kill} { + set dopre 1 + } + if {$dopre} { + global is_windows + if {$is_windows} { + regsub {#FINMSG} $cmdall {echo "Now Go Click on the Label to Start the 2nd SSH"} cmdall + } else { + regsub {#FINMSG} $cmdall {echo "Finished with the 1st SSH tasks, the 2nd SSH should start shortly..."} cmdall + } + } + } + + if {"$orig" == "$cmdall"} { + return "" + } else { + return $cmdall + } +} + +proc cups_dialog {} { + + catch {destroy .cups} + toplevel .cups + wm title .cups "CUPS Tunnelling" + global cups_local_server cups_remote_port cups_manage_rcfile + global cups_local_smb_server cups_remote_smb_port + + global uname + if {$uname == "Darwin"} { + scroll_text .cups.f 80 25 + } else { + scroll_text .cups.f + } + + + set msg { + CUPS Printing requires SSH be used to set up the Print service port + redirection. This will be either of the "Use SSH instead" or "Use + SSH and SSL" modes under "Options". Pure SSL tunnelling will not work. + + This method requires working CUPS software setups on both the remote + and local sides of the connection. + + (See Method #1 below for perhaps the easiest way to get applications to + print through the tunnel; it requires printing admin privileges however). + + You choose an actual remote CUPS port below under "Use Remote CUPS + Port:" (6631 is just our default and used in the examples below). + Note that the normal default CUPS server port is 631. + + The port you choose must be unused on the VNC server machine (n.b. no + checking is done). Print requests connecting to it are redirected to + your local machine through the SSH tunnel. Note: root permission is + needed for ports less than 1024 (this is not recommended). + + Then enter the VNC Viewer side (i.e. where you are sitting) CUPS server + under "Local CUPS Server". E.g. use "localhost:631" if there is one + on the viewer machine, or, say, "my-print-srv:631" for a nearby CUPS + print server. + + Several methods are now described for how to get applications to + print through the port redirected tunnel. + + Method #0: Create or edit the file $HOME/.cups/client.conf on the VNC + server side by putting in something like this in it: + + ServerName localhost:6631 + + based on the port you selected above. + + NOTE: For this client.conf ServerName setting to work with lp(1) + and lpr(1) CUPS 1.2 or greater is required. The cmdline option + "-h localhost:6631" can be used for older versions. For client.conf to + work in general (e.g. Openoffice, Firefox), a bugfix found in CUPS 1.2.3 + is required. Two Workarounds (Methods #1 and #2) are described below. + + After the remote VNC Connection is finished, to go back to the non-SSH + tunnelled CUPS server and either remove the client.conf file or comment + out the ServerName line. This restores the normal CUPS server for + you on the remote machine. + + Select "Manage ServerName in the $HOME/.cups/client.conf file for me" to + attempt to do this editing of the CUPS config file for you automatically. + + Method #1: If you have admin permission on the VNC Server machine you + can likely "Add a Printer" via a GUI dialog, wizard, lpadmin(8), etc. + This makes the client.conf ServerName parameter unnecessary. You will + need to tell the GUI dialog that the printer is at, e.g., localhost:6631, + and anything else needed to identify the printer (type, model, etc). + + Method #2: Restarting individual applications with the IPP_PORT + set will enable redirected printing for them, e.g.: + + env IPP_PORT=6631 firefox + + If you can only get Method #2 to work, an extreme application would + be to run the whole desktop, e.g. env IPP_PORT=6631 gnome-session, but + then you would need some sort of TCP redirector (ssh -L comes to mind), + to direct it to 631 when not connected remotely. + + Windows/SMB Printers: Under "Local SMB Print Server" you can set + a port redirection for a Windows (non-CUPS) SMB printer. E.g. port + 6632 -> localhost:139. If localhost:139 does not work, try IP:139, + etc. or put in the IP address manually. Then at the least you can + print using the smbspool(8) program like this: + + smbspool smb://localhost:6632/lp job user title 1 "" myfile.ps + + You could put this in a script, "myprinter". It appears for the URI, + only the number of copies ("1" above) and the file itself are important. + (XXX this might only work for Samba printers...) + + If you have root or print admin permission you can configure CUPS to + know about this printer via lpadmin(8), etc. You basically give it + the smb://... URI. + + For more info see: http://www.karlrunge.com/x11vnc/#faq-cups +} + .cups.f.t insert end $msg + + if {$cups_local_server == ""} { + set cups_local_server "localhost:631" + } + if {$cups_remote_port == ""} { + set cups_remote_port "6631" + } + if {$cups_local_smb_server == ""} { + global is_windows + if {$is_windows} { + set cups_local_smb_server "IP:139" + } else { + set cups_local_smb_server "localhost:139" + } + } + if {$cups_remote_smb_port == ""} { + set cups_remote_smb_port "6632" + } + + frame .cups.serv + label .cups.serv.l -anchor w -text "Local CUPS Server: " + entry .cups.serv.e -width 40 -textvariable cups_local_server + pack .cups.serv.e -side right + pack .cups.serv.l -side left -expand 1 -fill x + + frame .cups.port + label .cups.port.l -anchor w -text "Use Remote CUPS Port:" + entry .cups.port.e -width 40 -textvariable cups_remote_port + pack .cups.port.e -side right + pack .cups.port.l -side left -expand 1 -fill x + + frame .cups.smbs + label .cups.smbs.l -anchor w -text "Local SMB Print Server: " + entry .cups.smbs.e -width 40 -textvariable cups_local_smb_server + pack .cups.smbs.e -side right + pack .cups.smbs.l -side left -expand 1 -fill x + + frame .cups.smbp + label .cups.smbp.l -anchor w -text "Use Remote SMB Print Port:" + entry .cups.smbp.e -width 40 -textvariable cups_remote_smb_port + pack .cups.smbp.e -side right + pack .cups.smbp.l -side left -expand 1 -fill x + + checkbutton .cups.cupsrc -anchor w -variable cups_manage_rcfile -text \ + "Manage ServerName in the remote \$HOME/.cups/client.conf file for me" + + button .cups.cancel -text "Cancel" -command {destroy .cups; set use_cups 0} + bind .cups <Escape> {destroy .cups; set use_cups 0} + button .cups.done -text "Done" -command {destroy .cups; if {$use_cups} {set_ssh}} + + button .cups.guess -text "Help me decide ..." -command {} + .cups.guess configure -state disabled + + pack .cups.done .cups.cancel .cups.guess .cups.cupsrc .cups.smbp .cups.smbs .cups.port .cups.serv -side bottom -fill x + pack .cups.f -side top -fill both -expand 1 + + center_win .cups +} + +proc sound_dialog {} { + + global is_windows + + catch {destroy .snd} + toplevel .snd + wm title .snd "ESD/ARTSD Sound Tunnelling" + + global uname + if {$uname == "Darwin"} { + scroll_text .snd.f 80 20 + } else { + scroll_text .snd.f 80 30 + } + + set msg { + Sound tunnelling to a sound daemon requires SSH be used to set up the + service port redirection. This will be either of the "Use SSH instead" + or "Use SSH and SSL" modes under "Options". Pure SSL tunnelling will + not work. + + This method requires working Sound daemon (e.g. ESD or ARTSD) software + setups on both the remote and local sides of the connection. + + Often this means you want to run your ENTIRE remote desktop with ALL + applications instructed to use the sound daemon's network port. E.g. + + esddsp -s localhost:16001 startkde + esddsp -s localhost:16001 gnome-session + + and similarly for artsdsp, etc. You put this in your ~/.xession, + or other startup file. This is non standard. If you do not want to + do this you still can direct *individual* sound applications through + the tunnel, for example "esddsp -s localhost:16001 soundapp", where + "soundapp" is some application that makes noise (say xmms or mpg123). + + Also, usually the remote Sound daemon must be killed BEFORE the SSH port + redir is established (because it is listening on the port we want to use + for the SSH redir), and, presumably, restarted when the VNC connection + finished. + + One may also want to start and kill a local sound daemon that will + play the sound received over the network on the local machine. + + You can indicate the remote and local Sound daemon commands below and + how they should be killed and/or restart. Some examples: + + esd -promiscuous -as 5 -port 16001 -tcp -bind 127.0.0.1 + artsd -n -p 7265 -F 10 -S 4096 -n -s 5 -m artsmessage -l 3 -f + + or you can leave some or all blank and kill/start them manually. + + For convenience, a Windows port of ESD is provided in the util/esound + directory, and so this might work for a Local command: + + esound\esd -promiscuous -as 5 -port 16001 -tcp -bind 127.0.0.1 + + NOTE: If you indicate "Remote Sound daemon: Kill at start." below, + then THERE WILL BE TWO SSH'S: THE FIRST ONE TO KILL THE DAEMON. + So you may need to supply TWO SSH PASSWORDS, unless you are using + something like ssh-agent(1), the Putty PW setting, etc. + + You will also need to supply the remote and local sound ports for + the SSH redirs. For esd the default port is 16001, but you can choose + another one if you prefer. + + For "Local Sound Port" you can also supply "host:port" instead of just + a numerical port to specify non-localhost connections, e.g. to another + nearby machine. + + For more info see: http://www.karlrunge.com/x11vnc/#faq-sound +} + .snd.f.t insert end $msg + + global sound_daemon_remote_port sound_daemon_local_port sound_daemon_local_cmd + if {$sound_daemon_remote_port == ""} { + set sound_daemon_remote_port 16001 + } + if {$sound_daemon_local_port == ""} { + set sound_daemon_local_port 16001 + } + + if {$sound_daemon_local_cmd == ""} { + global is_windows + if {$is_windows} { + set sound_daemon_local_cmd {esound\esd -promiscuous -as 5 -port %PORT -tcp -bind 127.0.0.1} + } else { + set sound_daemon_local_cmd {esd -promiscuous -as 5 -port %PORT -tcp -bind 127.0.0.1} + } + regsub {%PORT} $sound_daemon_local_cmd $sound_daemon_local_port sound_daemon_local_cmd + } + + + frame .snd.remote + label .snd.remote.l -anchor w -text "Remote Sound daemon cmd: " + entry .snd.remote.e -width 45 -textvariable sound_daemon_remote_cmd + pack .snd.remote.e -side right + pack .snd.remote.l -side left -expand 1 -fill x + + frame .snd.local + label .snd.local.l -anchor w -text "Local Sound daemon cmd: " + entry .snd.local.e -width 45 -textvariable sound_daemon_local_cmd + pack .snd.local.e -side right + pack .snd.local.l -side left -expand 1 -fill x + + frame .snd.rport + label .snd.rport.l -anchor w -text "Remote Sound Port: " + entry .snd.rport.e -width 45 -textvariable sound_daemon_remote_port + pack .snd.rport.e -side right + pack .snd.rport.l -side left -expand 1 -fill x + + frame .snd.lport + label .snd.lport.l -anchor w -text "Local Sound Port: " + entry .snd.lport.e -width 45 -textvariable sound_daemon_local_port + pack .snd.lport.e -side right + pack .snd.lport.l -side left -expand 1 -fill x + + + checkbutton .snd.sdk -anchor w -variable sound_daemon_kill -text \ + "Remote Sound daemon: Kill at start." + + checkbutton .snd.sdr -anchor w -variable sound_daemon_restart -text \ + "Remote Sound daemon: Restart at end." + + checkbutton .snd.sdsl -anchor w -variable sound_daemon_local_start -text \ + "Local Sound daemon: Run at start." + + checkbutton .snd.sdkl -anchor w -variable sound_daemon_local_kill -text \ + "Local Sound daemon: Kill at end." + + button .snd.guess -text "Help me decide ..." -command {} + .snd.guess configure -state disabled + + global is_win9x + if {$is_win9x} { + .snd.local.e configure -state disabled + .snd.local.l configure -state disabled + .snd.sdsl configure -state disabled + .snd.sdkl configure -state disabled + } + + button .snd.cancel -text "Cancel" -command {destroy .snd; set use_sound 0} + bind .snd <Escape> {destroy .snd; set use_sound 0} + button .snd.done -text "Done" -command {destroy .snd; if {$use_sound} {set_ssh}} + + pack .snd.done .snd.cancel .snd.guess .snd.sdkl .snd.sdsl .snd.sdr .snd.sdk .snd.lport .snd.rport \ + .snd.local .snd.remote -side bottom -fill x + pack .snd.f -side bottom -fill both -expand 1 + + center_win .snd +} + +# Share ideas. +# +# Unix: +# +# if type smbclient +# first parse smbclient -L localhost -N +# and/or smbclient -L `hostname` -N +# Get Sharenames and Servers and Domain. +# +# loop over servers, doing smbclient -L server -N +# pile this into a huge list, sep by disk and printers. +# +# WinXP: +# +# parse "NET VIEW" output similarly. +# +# Have checkbox for each disk. Set default root to /var/tmp/${USER}-mnts +# Let them change that at once and have it populate. +# +# use //hostname/share /var/tmp/runge-mnts/hostname/share +# +# +# Printers, hmmm. Can't add to remote cups list... I guess have the list +# ready for CUPS dialog to suggest which SMB servers they want to redirect +# to... + +proc get_hostname {} { + global is_windows is_win9x + set str "" + if {$is_windows} { + if {1} { + catch {set str [exec hostname]} + regsub -all {[\r]} $str "" str + } else { + catch {set str [exec net config]} + if [regexp -nocase {Computer name[ \t]+\\\\([^ \t]+)} $str mv str] { + ; + } else { + set str "" + } + } + } else { + catch {set str [exec hostname]} + } + set str [string trim $str] + return $str +} + +proc smb_list_windows {smbhost} { + global smb_local smb_local_hosts smb_this_host + global is_win9x + set dbg 0 + + set domain "" + + if {$is_win9x} { + # exec net view ... doesn't work. + set smb_this_host "unknown" + return + } + + set this_host [get_hostname] + set This_host [string toupper $this_host] + set smb_this_host $This_host + + if {$smbhost == $smb_this_host} { + catch {set out0 [exec net view]} + regsub -all {[\r]} $out0 "" out0 + foreach line [split $out0 "\n"] { + if [regexp -nocase {in workgroup ([^ \t]+)} $line mv wg] { + regsub -all {[.]} $wg "" wg + set domain $wg + } elseif [regexp {^\\\\([^ \t]+)[ \t]*(.*)} $line mv host comment] { + set smb_local($smbhost:server:$host) $comment + } + } + } + + set out1 "" + set h "\\\\$smbhost" + catch {set out1 [exec net view $h]} + regsub -all {[\r]} $out1 "" out1 + + if {$dbg} {puts "SMBHOST: $smbhost"} + + set mode "" + foreach line [split $out1 "\n"] { + if [regexp {^[ \t]*---} $line] { + continue + } + if [regexp -nocase {The command} $line] { + continue + } + if [regexp -nocase {Shared resources} $line] { + continue + } + if [regexp -nocase {^[ \t]*Share[ \t]*name} $line] { + set mode "shares" + continue + } + set line [string trim $line] + if {$line == ""} { + continue + } + if {$mode == "shares"} { + if [regexp {^([^ \t]+)[ \t]+([^ \t]+)[ \t]*(.*)$} $line mv name type comment] { + if {$dbg} { + puts "SHR: $name" + puts "---: $type" + puts "---: $comment" + } + if [regexp -nocase {^Disk$} $type] { + set smb_local($smbhost:disk:$name) $comment + } elseif [regexp -nocase {^Print} $type] { + set smb_local($smbhost:printer:$name) $comment + } + } + } + } + + set smb_local($smbhost:domain) $domain +} + +proc smb_list_unix {smbhost} { + global smb_local smb_local_hosts smb_this_host + set smbclient [in_path smbclient] + if {[in_path smbclient] == ""} { + return "" + } + set dbg 0 + + set this_host [get_hostname] + set This_host [string toupper $this_host] + set smb_this_host $This_host + + set out1 "" + catch {set out1 [exec smbclient -N -L $smbhost 2>@ stdout]} + + if {$dbg} {puts "SMBHOST: $smbhost"} + if {$smbhost == $this_host || $smbhost == $This_host} { + if {$out1 == ""} { + catch {set out1 [exec smbclient -N -L localhost 2>@ stdout]} + } + } + + set domain "" + set mode "" + foreach line [split $out1 "\n"] { + if [regexp {^[ \t]*---} $line] { + continue + } + if [regexp {Anonymous login} $line] { + continue + } + if {$domain == "" && [regexp {Domain=\[([^\]]+)\]} $line mv domain]} { + if {$dbg} {puts "DOM: $domain"} + continue + } + if [regexp {^[ \t]*Sharename} $line] { + set mode "shares" + continue + } + if [regexp {^[ \t]*Server} $line] { + set mode "server" + continue + } + if [regexp {^[ \t]*Workgroup} $line] { + set mode "workgroup" + continue + } + set line [string trim $line] + if {$mode == "shares"} { + if [regexp {^([^ \t]+)[ \t]+([^ \t]+)[ \t]*(.*)$} $line mv name type comment] { + if {$dbg} { + puts "SHR: $name" + puts "---: $type" + puts "---: $comment" + } + if [regexp -nocase {^Disk$} $type] { + set smb_local($smbhost:disk:$name) $comment + } elseif [regexp -nocase {^Printer$} $type] { + set smb_local($smbhost:printer:$name) $comment + } + } + } elseif {$mode == "server"} { + if [regexp {^([^ \t]+)[ \t]*(.*)$} $line mv host comment] { + if {$dbg} { + puts "SVR: $host" + puts "---: $comment" + } + set smb_local($smbhost:server:$host) $comment + } + } elseif {$mode == "workgroup"} { + if [regexp {^([^ \t]+)[ \t]+(.*)$} $line mv work host] { + if {$dbg} { + puts "WRK: $work" + puts "---: $host" + } + if {$host != ""} { + set smb_local($smbhost:master:$work) $host + } + } + } + } + + set smb_local($smbhost:domain) $domain +} + +proc smb_list {} { + global is_windows smb_local smb_local_hosts + global smb_host_list + + set smb_local(null) "" + + if {! [info exists smb_host_list]} { + set smb_host_list "" + } + if [info exists smb_local] { + unset smb_local + } + if [info exists smb_local_hosts] { + unset smb_local_hosts + } + + set this_host [get_hostname] + set this_host [string toupper $this_host] + if {$is_windows} { + smb_list_windows $this_host + } else { + smb_list_unix $this_host + } + set did($this_host) 1 + set keys [array names smb_local] + foreach item [split $smb_host_list] { + if {$item != ""} { + set item [string toupper $item] + lappend keys "$this_host:server:$item" + } + } + foreach key $keys { + if [regexp "^$this_host:server:(.*)\$" $key mv host] { + if {$host == ""} { + continue + } + set smb_local_hosts($host) 1 + if {! [info exists did($host)]} { + if {$is_windows} { + smb_list_windows $host + } else { + smb_list_unix $host + } + set did($host) 1 + } + } + } +} + +proc smb_check_selected {} { + global smbmount_exists smbmount_sumode + global smb_selected smb_selected_mnt smb_selected_cb smb_selected_en + + set ok 0 + if {$smbmount_exists && $smbmount_sumode != "dontknow"} { + set ok 1 + } + set state disabled + if {$ok} { + set state normal + } + + foreach cb [array names smb_selected_cb] { + catch {$cb configure -state $state} + } + foreach en [array names smb_selected_en] { + catch {$en configure -state $state} + } +} + +proc make_share_widgets {w} { + + set share_label $w.f.hl + catch {$share_label configure -text "Share Name: PROBING ..."} + update + + smb_list + + set saw_f 0 + foreach child [winfo children $w] { + if {$child == "$w.f"} { + set saw_f 1 + continue + } + catch {destroy $child} + } + + set w1 47 + set w2 44 + + if {! $saw_f} { + set wf $w.f + frame $wf + label $wf.hl -width $w1 -text "Share Name:" -anchor w + label $wf.hr -width $w2 -text " Mount Point:" -anchor w + + pack $wf.hl $wf.hr -side left -expand 1 + pack $wf -side top -fill x + + .smbwiz.f.t window create end -window $w + } + + global smb_local smb_local_hosts smb_this_host smb_selected smb_selected_mnt + global smb_selected_host smb_selected_name + global smb_selected_cb smb_selected_en + global smb_host_list + if [info exists smb_selected] {array unset smb_selected } + if [info exists smb_selected_mnt] {array unset smb_selected_mnt} + if [info exists smb_selected_cb] {array unset smb_selected_cb} + if [info exists smb_selected_en] {array unset smb_selected_en} + if [info exists smb_selected_host] {array unset smb_selected_host} + if [info exists smb_selected_name] {array unset smb_selected_name} + + set hosts [list $smb_this_host] + lappend hosts [lsort [array names smb_local_hosts]] + + set smb_host_list "" + set i 0 + + global smb_mount_prefix + set smb_mount_prefix "/var/tmp/%USER-mnts" + + foreach host [lsort [array names smb_local_hosts]] { + + if [info exists did($host)] { + continue + } + set did($host) 1 + + append smb_host_list "$host " + + foreach key [lsort [array names smb_local]] { + if [regexp {^([^:]+):([^:]+):(.*)$} $key mv host2 type name] { + if {$host2 != $host} { + continue + } + if {$type != "disk"} { + continue + } + set wf $w.f$i + frame $wf + checkbutton $wf.c -anchor w -width $w1 -variable smb_selected($i) \ + -text "//$host/$name" -relief ridge + if {! [info exists smb_selected($i)]} { + set smb_selected($i) 0 + } + + entry $wf.e -width $w2 -textvariable smb_selected_mnt($i) + set smb_selected_mnt($i) "$smb_mount_prefix/$host/$name" + + set smb_selected_host($i) $host + set smb_selected_name($i) $name + + set smb_selected_cb($wf.c) $i + set smb_selected_en($wf.e) $i + set comment $smb_local($key) + + bind $wf.c <Enter> "$share_label configure -text {Share Name: $comment}" + bind $wf.c <Leave> "$share_label configure -text {Share Name:}" + + $wf.c configure -state disabled + $wf.e configure -state disabled + + pack $wf.c $wf.e -side left -expand 1 + pack $wf -side top -fill x + incr i + } + } + } + if {$i == 0} { + global is_win9x + $share_label configure -text {Share Name: No SMB Share Hosts were found!} + if {$is_win9x} { + .smbwiz.f.t insert end "\n(this feature does not work on Win9x you have have to enter them manually: //HOST/share /var/tmp/mymnt)\n" + } + } else { + $share_label configure -text "Share Name: Found $i SMB Shares" + } + smb_check_selected +} + +proc smb_help_me_decide {} { + global is_windows + global smb_local smb_local_hosts smb_this_host smb_selected smb_selected_mnt + global smb_selected_host smb_selected_name + global smb_selected_cb smb_selected_en + global smb_host_list + + catch {destroy .smbwiz} + toplevel .smbwiz + set title "SMB Filesystem Tunnelling -- Help Me Decide" + wm title .smbwiz $title + set id " " + + scroll_text .smbwiz.f 100 40 + + set msg { +For now you will have to verify the following information manually. + +You can do this by either logging into the remote machine to find the info or asking the sysadmin for it. + +} + + if {! $is_windows} { + .smbwiz.f.t configure -font {Helvetica -12 bold} + } + .smbwiz.f.t insert end $msg + + set w .smbwiz.f.t.f1 + frame $w -bd 1 -relief ridge -cursor {top_left_arrow} + + .smbwiz.f.t insert end "\n" + + .smbwiz.f.t insert end "1) Indicate the existence of the 'smbmount' command on the remote system:\n" + .smbwiz.f.t insert end "\n$id" + global smbmount_exists + set smbmount_exists 0 + + checkbutton $w.smbmount_exists -pady 1 -anchor w -variable smbmount_exists \ + -text "Yes, the 'smbmount' command exists on the remote system." \ + -command smb_check_selected + + pack $w.smbmount_exists + .smbwiz.f.t window create end -window $w + + .smbwiz.f.t insert end "\n\n\n" + + set w .smbwiz.f.t.f2 + frame $w -bd 1 -relief ridge -cursor {top_left_arrow} + + .smbwiz.f.t insert end "2) Indicate your authorization to run 'smbmount' on the remote system:\n" + .smbwiz.f.t insert end "\n$id" + global smbmount_sumode + set smbmount_sumode "dontknow" + + radiobutton $w.dk -pady 1 -anchor w -variable smbmount_sumode -value dontknow \ + -text "I do not know if I can mount SMB shares on the remote system via 'smbmount'" \ + -command smb_check_selected + pack $w.dk -side top -fill x + + radiobutton $w.su -pady 1 -anchor w -variable smbmount_sumode -value su \ + -text "I know the Password to run commands as root on the remote system via 'su'" \ + -command smb_check_selected + pack $w.su -side top -fill x + + radiobutton $w.sudo -pady 1 -anchor w -variable smbmount_sumode -value sudo \ + -text "I know the Password to run commands as root on the remote system via 'sudo'" \ + -command smb_check_selected + pack $w.sudo -side top -fill x + + radiobutton $w.ru -pady 1 -anchor w -variable smbmount_sumode -value none \ + -text "I do not need to be root on the remote system to mount SMB shares via 'smbmount'" \ + -command smb_check_selected + pack $w.ru -side top -fill x + + .smbwiz.f.t window create end -window $w + + global smb_wiz_done + set smb_wiz_done 0 + + button .smbwiz.cancel -text "Cancel" -command {set smb_wiz_done 1} + button .smbwiz.done -text "Done" -command {set smb_wiz_done 1} + pack .smbwiz.done -side bottom -fill x + pack .smbwiz.f -side top -fill both -expand 1 + + wm protocol .smbwiz WM_DELETE_WINDOW {set smb_wiz_done 1} + center_win .smbwiz + + wm title .smbwiz "Searching for Local SMB shares..." + update + wm title .smbwiz $title + + global smb_local smb_this_host + .smbwiz.f.t insert end "\n\n\n" + + set w .smbwiz.f.t.f3 + catch {destroy $w} + frame $w -bd 1 -relief ridge -cursor {top_left_arrow} + + .smbwiz.f.t insert end "3) Select SMB shares to mount and their mount point on the remote system:\n" + .smbwiz.f.t insert end "\n${id}" + + make_share_widgets $w + + .smbwiz.f.t insert end "\n(%USER will be expanded to the username on the remote system and %HOME the home directory)\n" + + .smbwiz.f.t insert end "\n\n\n" + + .smbwiz.f.t insert end "You can change the list of Local SMB hosts to probe and the mount point prefix here:\n" + .smbwiz.f.t insert end "\n$id" + set w .smbwiz.f.t.f4 + frame $w -bd 1 -relief ridge -cursor {top_left_arrow} + set wf .smbwiz.f.t.f4.f + frame $wf + label $wf.l -text "SMB Hosts: " -anchor w + entry $wf.e -textvariable smb_host_list -width 60 + button $wf.b -text "Apply" -command {make_share_widgets .smbwiz.f.t.f3} + bind $wf.e <Return> "$wf.b invoke" + pack $wf.l $wf.e $wf.b -side left + pack $wf + pack $w + + .smbwiz.f.t window create end -window $w + + .smbwiz.f.t insert end "\n$id" + + set w .smbwiz.f.t.f5 + frame $w -bd 1 -relief ridge -cursor {top_left_arrow} + set wf .smbwiz.f.t.f5.f + frame $wf + label $wf.l -text "Mount Prefix:" -anchor w + entry $wf.e -textvariable smb_mount_prefix -width 60 + button $wf.b -text "Apply" -command {apply_mount_point_prefix .smbwiz.f.t.f5.f.e} + bind $wf.e <Return> "$wf.b invoke" + pack $wf.l $wf.e $wf.b -side left + pack $wf + pack $w + + .smbwiz.f.t window create end -window $w + + .smbwiz.f.t insert end "\n\n\n" + + .smbwiz.f.t see 1.0 + .smbwiz.f.t configure -state disabled + update + + vwait smb_wiz_done + catch {destroy .smbwiz} + + if {! $smbmount_exists || $smbmount_sumode == "dontknow"} { + tk_messageBox -type ok -icon warning -message "Sorry we couldn't help out!\n'smbmount' info on the remote system is required for SMB mounting" -title "SMB mounting -- aborting" + global use_smbmnt + set use_smbmnt 0 + catch {raise .oa} + return + } + global smb_su_mode + set smb_su_mode $smbmount_sumode + + set max 0 + foreach en [array names smb_selected_en] { + set i $smb_selected_en($en) + set host $smb_selected_host($i) + set name $smb_selected_name($i) + + set len [string length "//$host/$name"] + if {$len > $max} { + set max $len + } + } + + set max [expr $max + 8] + + set strs "" + foreach en [array names smb_selected_en] { + set i $smb_selected_en($en) + if {! $smb_selected($i)} { + continue + } + set host $smb_selected_host($i) + set name $smb_selected_name($i) + set mnt $smb_selected_mnt($i) + + set share "//$host/$name" + set share [format "%-${max}s" $share] + + lappend strs "$share $mnt" + } + set text "" + foreach str [lsort $strs] { + append text "$str\n" + } + + global smb_mount_list + set smb_mount_list $text + + smb_dialog +} + +proc apply_mount_point_prefix {w} { + global smb_selected_host smb_selected_name + global smb_selected_en smb_selected_mnt + + set prefix "" + catch {set prefix [$w get]} + if {$prefix == ""} { + mesg "No mount prefix." + bell + return + } + + foreach en [array names smb_selected_en] { + set i $smb_selected_en($en) + set host $smb_selected_host($i) + set name $smb_selected_name($i) + set smb_selected_mnt($i) "$prefix/$host/$name" + } +} + +proc smb_dialog {} { + catch {destroy .smb} + toplevel .smb + wm title .smb "SMB Filesystem Tunnelling" + global smb_su_mode smb_mount_list + global use_smbmnt + + global help_font + + global uname + if {$uname == "Darwin"} { + scroll_text .smb.f 80 25 + } else { + scroll_text .smb.f + } + + set msg { + Windows/Samba Filesystem mounting requires SSH be used to set up the SMB + service port redirection. This will be either of the "Use SSH instead" + or "Use SSH and SSL" modes under "Options". Pure SSL tunnelling will + not work. + + This method requires a working Samba software setup on the remote + side of the connection (VNC server) and existing Samba or Windows file + server(s) on the local side (VNC viewer). + + The smbmount(8) program MUST be installed on the remote side. This + evidently limits the mounting to Linux systems. Let us know of similar + utilities on other Unixes. Mounting onto remote Windows machines is + currently not supported (our SSH mode with services setup only works + to Unix). + + Depending on how smbmount is configured you may be able to run it + as a regular user, or it may require running under su(1) or sudo(8) + (root password or user password required, respectively). You select + which one you want via the checkbuttons below. + + In addition to a possible su(1) or sudo(8) password, you may ALSO + need to supply passwords to mount each SMB share. This is an SMB passwd. + If it has no password just hit enter after the "Password:" prompt. + + The passwords are supplied when the 1st SSH connection starts up; + be prepared to respond to them. + + NOTE: USE OF SMB TUNNELLING MODE WILL REQUIRE TWO SSH'S, AND SO YOU + MAY NEED TO SUPPLY TWO LOGIN PASSWORDS UNLESS YOU ARE USING SOMETHING + LIKE ssh-agent(1) or the Putty PW setting. + %WIN + + To indicate the Windows/Samba shares to mount enter them one per line + in one of the forms: + + //machine1/share ~/Desktop/my-mount1 + //machine2/fubar /var/tmp/my-foobar2 192.168.100.53:3456 + 1139 //machine3/baz /var/tmp/baz [...] + + The first part is the standard SMB host and share name //hostname/dir + (note this share is on the local viewer-side not on the remote end). + A leading '#' will cause the entire line to be skipped. + + The second part, e.g. /var/tmp/my-foobar2, is the directory to mount + the share on the remote (VNC Server) side. You must be able to + write to this directory. It will be created if it does not exist. + A leading character ~ will be expanded to $HOME. So will the string + %HOME. The string %USER will get expanded to the remote username. + + An optional part like 192.168.100.53:3456 is used to specify the real + hostname or IP address, and possible non-standard port, on the local + side if for some reason the //hostname is not sufficient. + + An optional leading numerical value, 1139 in the above example, indicates + which port to use on the Remote side to SSH redirect to the local side. + Otherwise a random one is tried (a unique one is needed for each SMB + server:port combination). A fixed one is preferred: choose a free + remote port. + + The standard SMB service ports (local side) are 445 and 139. 139 is + used by this application. + + Sometimes "localhost" will not work on Windows machines for a share + hostname, and you will have to specify a different network interface + (e.g. the machine's IP address). If you use the literal string "IP" + it will be attempted to replace it with the numerical IP address, e.g.: + + //machine1/share ~/Desktop/my-mount1 IP + + VERY IMPORTANT: Before terminating the VNC Connection, make sure no + applications are using any of the SMB shares (or shells are cd-ed + into the share). This way the shares will be automatically unmounted. + Otherwise you will need to log in again, stop processes from using + the share, become root and umount the shares manually ("smbumount + /path/to/share", etc.) + + For more info see: http://www.karlrunge.com/x11vnc/#faq-smb-shares +} + + set msg2 { + To speed up moving to the next step, iconify the first SSH console + when you are done entering passwords, etc. and then click on the + main panel 'VNC Host:Display' label. +} + + global is_windows + if {! $is_windows} { + regsub { *%WIN} $msg "" msg + } else { + set msg2 [string trim $msg2] + regsub { *%WIN} $msg " $msg2" msg + } + .smb.f.t insert end $msg + + frame .smb.r + label .smb.r.l -text "smbmount(8) auth mode:" -relief ridge + radiobutton .smb.r.none -text "None" -variable smb_su_mode -value "none" + radiobutton .smb.r.su -text "su(1)" -variable smb_su_mode -value "su" + radiobutton .smb.r.sudo -text "sudo(8)" -variable smb_su_mode -value "sudo" + + pack .smb.r.l .smb.r.none .smb.r.sudo .smb.r.su -side left -fill x + + label .smb.info -text "Supply the mounts (one per line) below:" -anchor w -relief ridge + + eval text .smb.mnts -width 80 -height 5 $help_font + .smb.mnts insert end $smb_mount_list + + button .smb.guess -text "Help me decide ..." -command {destroy .smb; smb_help_me_decide} + + button .smb.cancel -text "Cancel" -command {set use_smbmnt 0; destroy .smb} + bind .smb <Escape> {set use_smbmnt 0; destroy .smb} + button .smb.done -text "Done" -command {if {$use_smbmnt} {set_ssh; set smb_mount_list [.smb.mnts get 1.0 end]}; destroy .smb} + + pack .smb.done .smb.cancel .smb.guess .smb.mnts .smb.info .smb.r -side bottom -fill x + pack .smb.f -side top -fill both -expand 1 + + center_win .smb +} + +proc help_advanced_opts {} { + catch {destroy .ah} + toplevel .ah + + scroll_text_dismiss .ah.f + + center_win .ah + + wm title .ah "Advanced Opts Help" + + set msg { + These Advanced options that may require extra software installed on + the VNC server-side (the remote server machine) and/or on the VNC + client-side (where this gui is running). + + The Service redirection options, CUPS, ESD/ARTSD, and SMB will require + that you use SSH for tunneling so that they can use the -R port + redirection will be enabled for each service. I.e. "Use SSH instead" + or "Use SSH and SSL" mode. + + These options may also require additional configuration to get them + to work properly. Please submit bug reports if it appears it should + be working for your setup but is not. + + Brief descriptions: + + CUPS Print tunnelling: redirect localhost:6631 (say) on the VNC + server to your local CUPS server. + + ESD/ARTSD Audio tunnelling: redirect localhost:16001 (say) on + the VNC server to your local ESD, etc. sound server. + + SMB mount tunnelling: redirect localhost:1139 (say) on the VNC + server and through that mount SMB file shares from your local + server. The remote machine must be Linux with smbmount installed. + + Change vncviewer: specify a non-bundled VNC Viewer (e.g. + UltraVNC or RealVNC) to run instead of the bundled TightVNC Viewer. + + Extra Redirs: specify additional -L port:host:port and + -R port:host:port cmdline options for SSH to enable additional + services. + + Port Knocking: for "closed port" services, first "knock" on the + firewall ports in a certain way to open the door for SSH or SSL. + The port can also be closed when the encrypted VNC connection + finishes. + + Include: Profile template(s) to load before loading a profile + (see Load Profile under "Options"). For example if you Save a + profile called "globals" that has some settings you use often, + then just supply "Include: globals" to have them applied. + You may supply a comma or space separated list of templates + to include. They can be full path names or basenames relative + to the profiles directory. You do not need to supply the .vnc + suffix. The non-default settings in them will be applied first, + and then any values in the loaded Profile will override them. + + + About the CheckButtons: + + Ahem, Well...., yes quite a klunky UI: you have to toggle the + CheckButton to pull up the Dialog box a 2nd, etc. time... don't + worry your settings will still be there! +} + + .ah.f.t insert end $msg +} + +proc set_viewer_path {} { + global change_vncviewer_path + set change_vncviewer_path [tk_getOpenFile] + catch {raise .chviewer} + update +} + +proc change_vncviewer_dialog {} { + global change_vncviewer change_vncviewer_path vncviewer_realvnc4 + + catch {destroy .chviewer} + toplevel .chviewer + wm title .chviewer "Change VNC Viewer" + + global help_font + eval text .chviewer.t -width 90 -height 16 $help_font + apply_bg .chviewer.t + + set msg { + To use your own VNC Viewer (i.e. one installed by you, not included in this + package), e.g. UltraVNC or RealVNC, type in the program name, or browse for + the full path to it. You can put command line arguments after the program. + + Note that due to incompatibilities with respect to command line options + there may be issues, especially if many command line options are supplied. + You can specify your own command line options below if you like (and try to + avoid setting any others in this GUI under "Options"). + + If the path to the program name has any spaces it in, please surround it with + double quotes, e.g. "C:\Program Files\My Vnc Viewer\VNCVIEWER.EXE" + + Since the command line options differ between them greatly, if you know it + is of the RealVNC 4.x flavor, indicate so on the check box. +} + .chviewer.t insert end $msg + + frame .chviewer.path + label .chviewer.path.l -text "VNC Viewer:" + entry .chviewer.path.e -width 40 -textvariable change_vncviewer_path + button .chviewer.path.b -text "Browse..." -command set_viewer_path + checkbutton .chviewer.path.r -anchor w -variable vncviewer_realvnc4 -text \ + "RealVNC 4.x" + + pack .chviewer.path.l -side left + pack .chviewer.path.e -side left -expand 1 -fill x + pack .chviewer.path.b -side left + pack .chviewer.path.r -side left + + button .chviewer.cancel -text "Cancel" -command {destroy .chviewer; set change_vncviewer 0} + bind .chviewer <Escape> {destroy .chviewer; set change_vncviewer 0} + button .chviewer.done -text "Done" -command {destroy .chviewer; catch {raise .oa}} + + pack .chviewer.t .chviewer.path .chviewer.cancel .chviewer.done -side top -fill x + + center_win .chviewer + wm resizable .chviewer 1 0 + + focus .chviewer.path.e +} + +proc port_redir_dialog {} { + global additional_port_redirs additional_port_redirs_list + + catch {destroy .redirs} + toplevel .redirs + wm title .redirs "Additional Port Redirections" + + global help_font uname + if {$uname == "Darwin"} { + eval text .redirs.t -width 80 -height 35 $help_font + } else { + eval text .redirs.t -width 80 -height 35 $help_font + } + apply_bg .redirs.t + + set msg { + Specify any additional SSH port redirections you desire for the + connection. Put as many as you want separated by spaces. These only + apply to SSH and SSH+SSL connections, they do not apply to Pure SSL + connections. + + -L port1:host:port2 will listen on port1 on the local machine (where + you are sitting) and redirect them to port2 on + "host". "host" is relative to the remote side + (VNC Server). Use "localhost" for the remote + machine itself. + + -R port1:host:port2 will listen on port1 on the remote machine + (where the VNC server is running) and redirect + them to port2 on "host". "host" is relative + to the local side (where you are sitting). + Use "localhost" for this machine. + + Perhaps you want a redir to a web server inside an intranet: + + -L 8001:web-int:80 + + Or to redir a remote port to your local SSH daemon: + + -R 5022:localhost:22 + + etc. There are many interesting possibilities. + + Sometimes, especially for Windows Shares, you cannot do a -R redir to + localhost, but need to supply the IP address of the network interface + (e.g. by default the Shares do not listen on localhost:139). As a + convenience you can do something like -R 1139:IP:139 (for any port + numbers) and the IP will be attempted to be expanded. If this fails + for some reason you will have to use the actual numerical IP address. +} + .redirs.t insert end $msg + + frame .redirs.path + label .redirs.path.l -text "Port Redirs:" + entry .redirs.path.e -width 40 -textvariable additional_port_redirs_list + + pack .redirs.path.l -side left + pack .redirs.path.e -side left -expand 1 -fill x + + button .redirs.cancel -text "Cancel" -command {set additional_port_redirs 0; destroy .redirs} + bind .redirs <Escape> {set additional_port_redirs 0; destroy .redirs} + button .redirs.done -text "Done" -command {destroy .redirs} + + pack .redirs.t .redirs.path .redirs.cancel .redirs.done -side top -fill x + + center_win .redirs + wm resizable .redirs 1 0 + + focus .redirs.path.e +} + +proc find_netcat {} { + global is_windows + + set nc "" + + if {! $is_windows} { + set nc [in_path "netcat"] + if {$nc == ""} { + set nc [in_path "nc"] + } + } else { + set try "netcat.exe" + if [file exists $try] { + set nc $try + } + } + return $nc +} + +proc pk_expand {cmd host} { + global tcl_platform + set secs [clock seconds] + set msecs [clock clicks -milliseconds] + set user $tcl_platform(user) + if [regexp {%IP} $cmd] { + set ip [guess_ip] + if {$ip == ""} { + set ip "unknown" + } + regsub -all {%IP} $cmd $ip cmd + } + if [regexp {%NAT} $cmd] { + set ip [guess_nat_ip] + regsub -all {%NAT} $cmd $ip cmd + } + regsub -all {%HOST} $cmd $host cmd + regsub -all {%USER} $cmd $user cmd + regsub -all {%SECS} $cmd $secs cmd + regsub -all {%MSECS} $cmd $msecs cmd + + return $cmd +} + +proc backtick_expand {str} { + set str0 $str + set collect "" + set count 0 + while {[regexp {^(.*)`([^`]+)`(.*)$} $str mv p1 cmd p2]} { + set out [eval exec $cmd] + set str "$p1$out$p2" + incr count + if {$count > 10} { + break + } + } + return $str +} + +proc read_from_pad {file} { + set fh "" + if {[catch {set fh [open $file "r"]}] != 0} { + return "FAIL" + } + + set accum "" + set match "" + while {[gets $fh line] > -1} { + if [regexp {^[ \t]*#} $line] { + append accum "$line\n" + } elseif [regexp {^[ \t]*$} $line] { + append accum "$line\n" + } elseif {$match == ""} { + set match $line + append accum "# $line\n" + } else { + append accum "$line\n" + } + } + + close $fh + + if {$match == ""} { + return "FAIL" + } + + if {[catch {set fh [open $file "w"]}] != 0} { + return "FAIL" + } + + puts -nonewline $fh $accum + + return $match +} + +proc do_port_knock {hp mode} { + global use_port_knocking port_knocking_list + global is_windows + + if {! $use_port_knocking} { + return 1 + } + if {$port_knocking_list == ""} { + return 1 + } + set list $port_knocking_list + + if {$mode == "finish"} { + if {! [regexp {FINISH} $list]} { + mesg "PortKnock(finish): done" + return 1 + } else { + regsub {^.*FINISH} $list "" list + } + } elseif {$mode == "start"} { + if {[regexp {FINISH} $list]} { + regsub {FINISH.*$} $list "" list + } + } + + set default_delay 150 + + set host [string trim $hp] + regsub {^vnc://} $host "" host + regsub {^.*@} $host "" host + regsub {:.*$} $host "" host + set host0 [string trim $host] + + if {$host0 == ""} { + bell + mesg "PortKnock: No host: $hp" + return 0 + } + + set m "" + + if [regexp {PAD=([^\n]+)} $list mv padfile] { + set tlist [read_from_pad $padfile] + set tlist [string trim $tlist] + if {$tlist == "" || $tlist == "FAIL"} { + tk_messageBox -type ok -icon error \ + -message "Failed to read entry from $padfile" \ + -title "Error: Padfile $padfile" + return 0 + } + regsub -all {PAD=([^\n]+)} $list $tlist list + } + + set spl ",\n\r" + if [regexp {CMD=} $list] {set spl "\n\r"} + if [regexp {CMDX=} $list] {set spl "\n\r"} + if [regexp {SEND=} $list] {set spl "\n\r"} + if [regexp {SENDX=} $list] {set spl "\n\r"} + + set i 0 + set pi 0 + + foreach line [split $list $spl] { + set line [string trim $line] + set line0 $line + + if {$line == ""} { + continue + } + if [regexp {^#} $line] { + continue + } + + if [regexp {^sleep[ \t][ \t]*([0-9][0-9]*)} $line mv sl] { + set m "PortKnock: sleep $sl" + mesg $m + after $sl + continue + } + if [regexp {^delay[ \t][ \t]*([0-9][0-9]*)} $line mv sl] { + set m "PortKnock: delay=$sl" + mesg $m + set default_delay $sl + continue + } + + if [regexp {^CMD=(.*)} $line mv cmd] { + set m "PortKnock: CMD: $cmd" + mesg $m + eval exec $cmd + continue + } + if [regexp {^CMDX=(.*)} $line mv cmd] { + set cmd [pk_expand $cmd $host0] + set m "PortKnock: CMDX: $cmd" + mesg $m + eval exec $cmd + continue + } + + if [regexp {`} $line] { + #set line [backtick_expand $line] + } + + set snd "" + if [regexp {^(.*)SEND=(.*)$} $line mv line snd] { + set line [string trim $line] + set snd [string trim $snd] + regsub -all {%NEWLINE} $snd "\n" snd + } elseif [regexp {^(.*)SENDX=(.*)$} $line mv line snd] { + set line [string trim $line] + set snd [string trim $snd] + set snd [pk_expand $snd $host0] + regsub -all {%NEWLINE} $snd "\n" snd + } + + set udp 0 + if [regexp -nocase {[/:]udp} $line] { + set udp 1 + regsub -all -nocase {[/:]udp} $line " " line + set line [string trim $line] + } + regsub -all -nocase {[/:]tcp} $line " " line + set line [string trim $line] + + set delay 0 + if [regexp {^(.*)[ \t][ \t]*([0-9][0-9]*)$} $line mv first delay] { + set line [string trim $first] + } + + if {[regexp {^(.*):(.*)$} $line mv host port]} { + ; + } else { + set host $host0 + set port $line + } + set host [string trim $host] + set port [string trim $port] + + if {$host == ""} { + set host $host0 + } + + if {$port == ""} { + bell + set m "PortKnock: No port found: \"$line0\"" + mesg $m + return 0 + } + if {! [regexp {^[0-9][0-9]*$} $port]} { + bell + set m "PortKnock: Invalid port: \"$port\"" + mesg $m + return 0 + } + regsub {,.*$} $host "" host + if {[regexp {[ \t]} $host]} { + bell + set m "PortKnock: Invalid host: \"$host\"" + mesg $m + return 0 + } + if {! [regexp {^[-A-z0-9_.][-A-z0-9_.]*$} $host]} { + bell + set m "PortKnock: Invalid host: \"$host\"" + mesg $m + return 0 + } + + set nc "" + if {$udp || $snd != ""} { + set nc [find_netcat] + if {$nc == ""} { + bell + set m "PortKnock: UDP: netcat(1) not found" + mesg $m + after 1000 + continue + } + } + + if {$snd != ""} { + global env + set pfile "payload$pi.txt" + if {! $is_windows} { + set pfile "$env(HOME)/.$pfile" + } + set pfiles($pi) $pfile + incr pi + set fh [open $pfile "w"] + puts -nonewline $fh "$snd" + close $fh + + set m "PortKnock: SEND: $host $port" + mesg $m + if {$is_windows} { + if {$udp} { + catch {exec $nc -d -u -w 1 "$host" "$port" < $pfile &} + } else { + catch {exec $nc -d -w 1 "$host" "$port" < $pfile &} + } + } else { + if {$udp} { + catch {exec $nc -u -w 1 "$host" "$port" < $pfile &} + } else { + catch {exec $nc -w 1 "$host" "$port" < $pfile &} + } + } + catch {after 50; file delete $pfile} + + } elseif {$udp} { + set m "PortKnock: UDP: $host $port" + mesg $m + if {! $is_windows} { + catch {exec echo a | $nc -u -w 1 "$host" "$port" &} + } else { + set fh [open "nc_in.txt" "w"] + puts $fh "a" + close $fh + catch {exec $nc -d -u -w 1 "$host" "$port" < "nc_in.txt" &} + } + } else { + set m "PortKnock: TCP: $host $port" + mesg $m + set s "" + set emess "" + set rc [catch {set s [socket -async $host $port]} emess] + if {$rc != 0} { + tk_messageBox -type ok -icon error -message $emess -title "Error: socket -async $host $port" + } + set socks($i) $s + # seems we have to close it immediately to avoid multiple SYN's. + # does not help on Win9x. + catch {after 30; close $s}; + incr i + } + + if {$delay == 0} { + if {$default_delay > 0} { + after $default_delay + } + } elseif {$delay > 0} { + after $delay + } + } + + if {0} { + for {set j 0} {$j < $i} {incr j} { + set $s $socks($j) + if {$s != ""} { + catch {close $s} + } + } + } + for {set j 0} {$j < $pi} {incr j} { + set f $pfiles($j) + if {$f != ""} { + if [file exists $f] { + after 100 + } + catch {file delete $f} + } + } + if {$is_windows} { + catch {file delete "nc_in.txt"} + } + if {$m != ""} { + set m "$m," + } + if {$mode == "finish"} { + mesg "PortKnock(finish): done" + } else { + mesg "PortKnock: done" + } + return 1 +} + +proc port_knocking_dialog {} { + catch {destroy .pk} + toplevel .pk + wm title .pk "Port Knocking" + global use_port_knocking port_knocking_list + + global help_font + + global uname + if {$uname == "Darwin"} { + scroll_text .pk.f 85 25 + } else { + scroll_text .pk.f 85 + } + + set msg { + Port Knocking is where a network connection to a service is not provided + to just any client, but rather only to those that immediately prior to + connecting send a more or less secret pattern of connections to other + ports on the firewall. + + Somewhat like "knocking" on the door with the correct sequence before it + being opened (but not necessarily letting you in yet). It is also possible + to have a single encrypted packet (e.g. UDP) payload communicate with the + firewall instead of knocking on a sequence of ports. + + Only after the correct sequence of ports is observed by the firewall does + it allow the IP address of the client to attempt to connect to the service. + + So, for example, instead of allowing any host on the internet to connect + to your SSH service and then try to login with a username and password, the + client first must "tickle" your firewall with the correct sequence of ports. + Only then will it be allowed to connect to your SSH service at all. + + This does not replace the authentication and security of SSH, it merely + puts another layer of protection around it. E.g., suppose an exploit for + SSH was discovered, you would most likely have more time to fix/patch + the problem than if any client could directly connect to your SSH server. + + For more information http://www.portknocking.org/ and + http://www.linuxjournal.com/article/6811 + + Tip: if you just want to use the Port Knocking for an SSH shell and not + for a VNC tunnel, then specify something like "user@hostname cmd=SHELL" + (or "user@hostname cmd=PUTTY" on Windows) in the VNC Host:Display entry box + on the main panel. This will do everything short of starting the viewer. + A shortcut for this is Ctrl-S as long as user@hostname is present. + + + Specifying the Knocks: + + In the text area below "Supply port knocking pattern" you put in the pattern + of "knocks" needed for this connection. You can separate the knocks by + commas or put them one per line. + + Each "knock" is of this form: + + [host:]port[/udp] [delay] + + In the simplest form just a numerical port, e.g. 5433, is supplied. + Items inside [...] are optional and described below. + + The packet is sent to the same host that the VNC (or SSH) connection will + be made to. If you want it to go to a different host or IP use the [host:] + prefix. It can be either a hostname or numerical IP. + + A TCP packet is sent by default. + + If you need to send a UDP packet, the netcat (aka "nc") program must be + installed on Unix (tcl/tk does not support udp connections). Indicate this + with "/udp" following the port number (you can also use "/tcp", but since + it is the default it is not necessary). (You can also use ":udp" to match + the knockd syntax). See the example below. For convenience a Windows netcat + binary is supplied. + + The last field, [delay], is an optional number of milliseconds to delay + before continuing on to the next knock. + + + Examples: + + 5433, 12321, 1661 + + fw.example.com:5433, 12321/udp 3000, 1661 2000 + + fw.example.com:5433 + 12321/udp 3000 + 1661 2000 + + Note how the first two examples separate their knocks via commas ",". + The 3rd example is equivalent to the 2nd and splits them up by new lines. + + Note for each knock any second number (e.g. the "2000" in "1661 2000") is + a DELAY in milliseconds, not a port number. If you had a comma separating + them: "1661, 2000" that would mean two separate knocks: one to port 1661 + followed by one to 2000 (with basically no delay between them). + + In examples 2 and 3, "fw.example.com" represents some machine other than + the VNC/SSH host. By default, the VNC/SSH host is the one the packet is + sent to. + + If one of the items is the string "FINISH", then the part before it is + used prior to connecting and the part after is used once the connection + is finished. This can be used, say, to close the firewall port. Example: + + 5433, 12321, FINISH, 7659, 2314 + + (or one can split them up via lines as above.) + + + Advanced port knock actions: + + If the string in the text field contains anywhere the strings "CMD=", "CMDX=", + or "SEND=", then splitting on commas is not done: it is only split on lines. + + Then, if a line begins CMD=... the string after the = is run as an + external command. The command could be anything you want, e.g. it could + be a port-knocking client that does the knocking, perhaps encrypting the + "knocks" pattern somehow or using a Single Packet Authorization method such + as http://www.cipherdyne.com/fwknop/ + + Extra quotes (sometimes "'foo bar'") may be needed to preserve spaces in + command line arguments because the tcl/tk eval(n) command is used. You + can also use {...} for quoting strings with spaces. + + If a line begins CMDX=... then before the command is run the following + tokens are expanded to strings: + + %IP Current machine's IP address (NAT may make this not useful). + %NAT Try to get effective IP by contacting http://www.whatismyip.com + %HOST The remote host of the connection. + %USER The current user. + %SECS The current time in seconds (platform dependent). + %MSECS Platform dependent time having at least millisecond granularity. + + Lines not matching CMD= or CMDX= are treated as normal port knocks but with + one exception. If a line ends in SEND=... (i.e. after the [host:]port, + etc., part) then the string after the = is sent as a payload for the tcp + or udp connection to [host:]port. netcat is used for these SEND cases + (and must be available on Unix). If newlines (\n) are needed in the + SEND string, use %NEWLINE. Sending binary data is not yet supported; + use CMD= with your own program. + + Examples: + + CMD=port_knock_client -password wombat33 + CMDX=port_knock_client -password wombat33 -host %HOST -src %NAT + + fw.example.com:5433/udp SEND=ASDLFKSJDF + + More tricks: + + To temporarily "comment out" a knock, insert a leading "#" character. + + Use "sleep N" to insert a raw sleep for N milliseconds (e.g. between + CMD=... items or at the very end of the knocks to wait). + + If a knock entry matches "delay N" the default delay is set to + N milliseconds (it is 150 initially). + + One Time Pads: + + If the text contains a (presumably single) line of the form: + + PAD=/path/to/a/one/time/pad/file + + then that file is opened and the first non-blank line not beginning + with "#" is used as the knock pattern. The pad file is rewritten + with that line starting with a "#" (so it will be skipped next time). + + The PAD=... string is replaced with the read-in knock pattern line. + So, if needed, one can preface the PAD=... with "delay N" to set the + default delay, and one can also put a "sleep N" after the PAD=... + line to indicate a final sleep. One can also surround the PAD= + line with other knock and CMD= CMDX= lines, but that usage sounds + a bit rare. Example: + + delay 1000 + PAD=C:\My Pads\work-pad1.txt + sleep 4000 + + + Port knock only: + + If, in the 'VNC Host:Display' entry, you use "user@hostname cmd=KNOCK" + then only the port-knocking is performed. A shortcut for this is + Ctrl-P as long as hostname is present in the entry box. If it + matches cmd=KNOCKF, i.e. an extra "F", then the port-knocking + "FINISH" sequence is sent, if any. A shortcut for this Shift-Ctrl-P + as long as hostname is present. +} + .pk.f.t insert end $msg + + label .pk.info -text "Supply port knocking pattern:" -anchor w -relief ridge + + eval text .pk.rule -width 80 -height 5 $help_font + .pk.rule insert end $port_knocking_list + + button .pk.cancel -text "Cancel" -command {set use_port_knocking 0; destroy .pk} + bind .pk <Escape> {set use_port_knocking 0; destroy .pk} + button .pk.done -text "Done" -command {if {$use_port_knocking} {set port_knocking_list [.pk.rule get 1.0 end]}; destroy .pk} + + pack .pk.done .pk.cancel .pk.rule .pk.info -side bottom -fill x + pack .pk.f -side top -fill both -expand 1 + + center_win .pk +} + + +proc set_advanced_options {} { + global use_cups use_sound use_smbmnt + global change_vncviewer + global use_port_knocking port_knocking_list + + catch {destroy .o} + catch {destroy .oa} + toplevel .oa + wm title .oa "Advanced options" + + set i 1 + + checkbutton .oa.b$i -anchor w -variable use_cups -text \ + "Enable CUPS Print tunnelling" \ + -command {if {$use_cups} {cups_dialog}} + incr i + + checkbutton .oa.b$i -anchor w -variable use_sound -text \ + "Enable ESD/ARTSD Audio tunnelling" \ + -command {if {$use_sound} {sound_dialog}} + incr i + + checkbutton .oa.b$i -anchor w -variable use_smbmnt -text \ + "Enable SMB mount tunnelling" \ + -command {if {$use_smbmnt} {smb_dialog}} + incr i + + + checkbutton .oa.b$i -anchor w -variable change_vncviewer -text \ + "Change VNC Viewer" \ + -command {if {$change_vncviewer} {change_vncviewer_dialog}} + incr i + + checkbutton .oa.b$i -anchor w -variable additional_port_redirs -text \ + "Additional Port Redirs" \ + -command {if {$additional_port_redirs} {port_redir_dialog}} + incr i + + checkbutton .oa.b$i -anchor w -variable use_port_knocking -text \ + "Port Knocking" \ + -command {if {$use_port_knocking} {port_knocking_dialog}} + incr i + + global include_list + frame .oa.b$i + label .oa.b$i.l -text "Include:" + entry .oa.b$i.e -width 10 -textvariable include_list + pack .oa.b$i.l -side left + pack .oa.b$i.e -side right -expand 1 -fill x + + incr i + + for {set j 1} {$j < $i} {incr j} { + pack .oa.b$j -side top -fill x + } + + button .oa.connect -text "Connect" -command launch + pack .oa.connect -side top -fill x + + frame .oa.b + button .oa.b.done -text "Done" -command {destroy .oa} + bind .oa <Escape> {destroy .oa} + button .oa.b.help -text "Help" -command help_advanced_opts + + pack .oa.b.help .oa.b.done -fill x -expand 1 -side left + + pack .oa.b -side top -fill x + + center_win .oa + wm resizable .oa 1 0 + focus .oa +} + +proc in_path {cmd} { + global env + set p $env(PATH) + foreach dir [split $p ":"] { + set try "$dir/$cmd" + if [file exists $try] { + return "$try" + } + } + return "" +} + +proc ssh_agent_restart {} { + global env + + set got_ssh_agent 0 + set got_ssh_add 0 + set got_ssh_agent2 0 + set got_ssh_add2 0 + + if {[in_path "ssh-agent"] != ""} {set got_ssh_agent 1} + if {[in_path "ssh-agent2"] != ""} {set got_ssh_agent2 1} + if {[in_path "ssh-add"] != ""} {set got_ssh_add 1} + if {[in_path "ssh-add2"] != ""} {set got_ssh_add2 1} + + set ssh_agent "" + set ssh_add "" + if {[info exists env(USER)] && $env(USER) == "runge"} { + if {$got_ssh_agent2} { + set ssh_agent "ssh-agent2" + } + if {$got_ssh_add2} { + set ssh_add "ssh-add2" + } + } + if {$ssh_agent == "" && $got_ssh_agent} { + set ssh_agent "ssh-agent" + } + if {$ssh_add == "" && $got_ssh_add} { + set ssh_add "ssh-add" + } + if {$ssh_agent == ""} { + bell + mesg "could not find ssh-agent in PATH" + return + } + if {$ssh_add == ""} { + bell + mesg "could not find ssh-add in PATH" + return + } + set tmp $env(HOME)/.vnc-sa[pid] + set fh "" + catch {set fh [open $tmp "w"]} + if {$fh == ""} { + bell + mesg "could not open tmp file $tmp" + return + } + + puts $fh "#!/bin/sh" + puts $fh "eval `$ssh_agent -s`" + puts $fh "$ssh_add" + puts $fh "SSL_VNC_GUI_CHILD=\"\"" + puts $fh "export SSL_VNC_GUI_CHILD" + + global buck_zero + set cmd $buck_zero + + if [info exists env(SSL_VNC_GUI_CMD)] { + set cmd $env(SSL_VNC_GUI_CMD) + } + #puts $fh "$cmd </dev/null 1>/dev/null 2>/dev/null &" + puts $fh "nohup $cmd &" + puts $fh "sleep 1" + puts $fh "#rm -f $tmp" + close $fh + + wm withdraw . + catch {wm withdraw .o} + catch {wm withdraw .oa} + +# exec xterm -geometry +200+200 -title "Restarting with ssh-agent/ssh-add" -e sh $tmp & + unix_terminal_cmd "+200+200" "Restarting with ssh-agent/ssh-add" "sh $tmp" 1 + after 10000 + destroy . + exit +} + +proc putty_pw_entry {mode} { + if {$mode == "check"} { + global use_sshssl use_ssh + if {$use_sshssl || $use_ssh} { + putty_pw_entry enable + } else { + putty_pw_entry disable + } + return + } + if {$mode == "disable"} { + catch {.o.pw.l configure -state disabled} + catch {.o.pw.e configure -state disabled} + } else { + catch {.o.pw.l configure -state normal} + catch {.o.pw.e configure -state normal} + } +} + +proc set_options {} { + global use_alpha use_grab use_ssh use_sshssl use_viewonly use_fullscreen use_bgr233 + global use_nojpeg use_raise_on_beep use_compresslevel use_quality + global compresslevel_text quality_text + global env is_windows darwin_cotvnc + + catch {destroy .o} + toplevel .o + wm title .o "Set SSL VNC Viewer options" + + set i 1 + + checkbutton .o.b$i -anchor w -variable use_ssh -text \ + "Use SSH instead" \ + -command {if {$use_ssh} {set use_sshssl 0}; putty_pw_entry check} + incr i + + checkbutton .o.b$i -anchor w -variable use_sshssl -text \ + "Use SSH and SSL" \ + -command {if {$use_sshssl} {set use_ssh 0}; putty_pw_entry check} + set iss $i + incr i + + checkbutton .o.b$i -anchor w -variable use_viewonly -text \ + "View Only" + incr i + + checkbutton .o.b$i -anchor w -variable use_fullscreen -text \ + "Fullscreen" + incr i + + checkbutton .o.b$i -anchor w -variable use_raise_on_beep -text \ + "Raise On Beep" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + incr i + + checkbutton .o.b$i -anchor w -variable use_bgr233 -text \ + "Use 8bit color (-bgr233)" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + incr i + + checkbutton .o.b$i -anchor w -variable use_alpha -text \ + "Cursor alphablending (32bpp required)" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + set ia $i + incr i + + checkbutton .o.b$i -anchor w -variable use_grab -text \ + "Use XGrabServer" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + set ix $i + incr i + + checkbutton .o.b$i -anchor w -variable use_nojpeg -text \ + "Do not use JPEG (-nojpeg)" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + incr i + + menubutton .o.b$i -anchor w -menu .o.b$i.m -textvariable compresslevel_text + set compresslevel_text "Compress Level: $use_compresslevel" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + + menu .o.b$i.m -tearoff 0 + for {set j -1} {$j < 10} {incr j} { + set v $j + set l $j + if {$j == -1} { + set v "default" + set l "default" + } + .o.b$i.m add radiobutton -variable use_compresslevel \ + -value $v -label $l -command \ + {set compresslevel_text "Compress Level: $use_compresslevel"} + } + incr i + + menubutton .o.b$i -anchor w -menu .o.b$i.m -textvariable quality_text + set quality_text "Quality: $use_quality" + if {$darwin_cotvnc} {.o.b$i configure -state disabled} + + menu .o.b$i.m -tearoff 0 + for {set j -1} {$j < 10} {incr j} { + set v $j + set l $j + if {$j == -1} { + set v "default" + set l "default" + } + .o.b$i.m add radiobutton -variable use_quality \ + -value $v -label $l -command \ + {set quality_text "Quality: $use_quality"} + } + incr i + + for {set j 1} {$j < $i} {incr j} { + pack .o.b$j -side top -fill x + } + + if {$is_windows} { + .o.b$ia configure -state disabled + .o.b$ix configure -state disabled + } + + if {$is_windows} { + frame .o.pw + label .o.pw.l -text "Putty PW:" + entry .o.pw.e -width 10 -show * -textvariable putty_pw + pack .o.pw.l -side left + pack .o.pw.e -side left -expand 1 -fill x + pack .o.pw -side top -fill x + putty_pw_entry check + } else { + button .o.sa -text "Use ssh-agent" -command ssh_agent_restart + pack .o.sa -side top -fill x + } + + button .o.s_prof -text "Save Profile ..." -command {save_profile; raise .o} + button .o.l_prof -text " Load Profile ..." -command {load_profile; raise .o} + button .o.advanced -text "Advanced ..." -command set_advanced_options + button .o.connect -text "Connect" -command launch + button .o.clear -text "Clear Options" -command set_defaults + pack .o.s_prof -side top -fill x + pack .o.l_prof -side top -fill x + #pack .o.inc -side top -fill x + pack .o.clear -side top -fill x + pack .o.advanced -side top -fill x + pack .o.connect -side top -fill x + + frame .o.b + button .o.b.done -text "Done" -command {destroy .o} + bind .o <Escape> {destroy .o} + button .o.b.help -text "Help" -command help_opts + + pack .o.b.help .o.b.done -fill x -expand 1 -side left + + pack .o.b -side top -fill x + + center_win .o + wm resizable .o 1 0 + focus .o +} + +global env +set is_windows 0 +set help_font "-font fixed" +if { [regexp -nocase {Windows} $tcl_platform(os)]} { + cd util + set help_font "" + set is_windows 1 +} + +if {[regexp -nocase {Windows.9} $tcl_platform(os)]} { + set is_win9x 1 +} else { + set is_win9x 0 +} + +set uname "" +if {! $is_windows} { + catch {set uname [exec uname]} +} + +set darwin_cotvnc 0 +if {$uname == "Darwin"} { + if {! [info exists env(DISPLAY)]} { + set darwin_cotvnc 1 + } + if [info exists env(HOME)] { + set t "$env(HOME)/.vnc" + if {! [file exists $t]} { + catch {file mkdir $t} + } + } +} + +set putty_pw "" + +global scroll_text_focus +set scroll_text_focus 1 + +wm title . "SSL VNC Viewer" +wm resizable . 1 0 + +set_defaults +set skip_pre 0 + +set vncdisplay "" + +label .l -text "SSL TightVNC Viewer" -relief ridge + +set wl 21 +set we 40 +frame .f0 +#label .f0.l -width $wl -anchor w -text "VNC Host:Display" -relief ridge +label .f0.l -anchor w -text "VNC Host:Display" -relief ridge +entry .f0.e -width $we -textvariable vncdisplay +pack .f0.l -side left +pack .f0.e -side left -expand 1 -fill x +bind .f0.e <Return> launch + +frame .f1 +label .f1.l -width $wl -anchor w -text "Proxy/Gateway:" -relief ridge +entry .f1.e -width $we -textvariable vncdisplay +pack .f1.l -side left +pack .f1.e -side left -expand 1 -fill x + +frame .f2 +label .f2.l -width $wl -anchor w -text "Remote SSH Command:" -relief ridge +entry .f2.e -width $we -textvariable vncdisplay +pack .f2.l -side left +pack .f2.e -side left -expand 1 -fill x +.f2.l configure -state disabled +.f2.e configure -state disabled + +frame .f3 +# -command +checkbutton .f3.ssl -anchor w -variable use_ssl -text "Use SSL" +checkbutton .f3.ssh -anchor w -variable use_ssh -text "Use SSH" +checkbutton .f3.sshssl -anchor w -variable use_sshssl -text "Use SSH and SSL" +set use_ssl 1 +pack .f3.ssl .f3.ssh .f3.sshssl -side left -fill x + +frame .b +button .b.help -text "Help" -command help +button .b.certs -text "Certs ..." -command getcerts +button .b.opts -text "Options ..." -command set_options +button .b.load -text "Load" -command {load_profile} +button .b.conn -text "Connect" -command launch +button .b.exit -text "Exit" -command {destroy .; exit} + + +pack .b.certs .b.opts .b.load .b.conn .b.help .b.exit -side left -expand 1 -fill x + +#pack .l .f0 .f1 .f2 .f3 .b -side top -fill x +pack .l .f0 .b -side top -fill x +if {![info exists env(SSL_VNC_GUI_CHILD)] || $env(SSL_VNC_GUI_CHILD) == ""} { + center_win . +} +focus .f0.e + +global system_button_face +set system_button_face "" +foreach item [.b.help configure -bg] { + set system_button_face $item +} + +if {[info exists env(SSL_VNC_GUI_CMD)]} { + set env(SSL_VNC_GUI_CHILD) 1 + bind . <Control-n> "exec $env(SSL_VNC_GUI_CMD) &" +} +bind . <Control-q> "destroy .; exit" +bind . <Shift-Escape> "destroy .; exit" +bind . <Control-s> "launch_shell_only" +bind . <Control-p> {port_knock_only "" "KNOCK"} +bind . <Control-P> {port_knock_only "" "FINISH"} +bind . <Control-l> {load_profile} +bind . <B3-ButtonRelease> {load_profile} + +global entered_gui_top button_gui_top +set entered_gui_top 0 +set button_gui_top 0 +bind . <Enter> {set entered_gui_top 1} +bind .l <ButtonPress> {set button_gui_top 1} +bind .f0.l <ButtonPress> {set button_gui_top 1} + +update