|
|
|
@ -168,6 +168,136 @@ HandshakeTLS(rfbClient* client)
|
|
|
|
|
return TRUE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* VeNCrypt sub auth. 1 byte auth count, followed by count * 4 byte integers */
|
|
|
|
|
static rfbBool
|
|
|
|
|
ReadVeNCryptSecurityType(rfbClient* client, uint32_t *result)
|
|
|
|
|
{
|
|
|
|
|
uint8_t count=0;
|
|
|
|
|
uint8_t loop=0;
|
|
|
|
|
uint8_t flag=0;
|
|
|
|
|
uint32_t tAuth[256], t;
|
|
|
|
|
char buf1[500],buf2[10];
|
|
|
|
|
uint32_t authScheme;
|
|
|
|
|
|
|
|
|
|
if (!ReadFromRFBServer(client, (char *)&count, 1)) return FALSE;
|
|
|
|
|
|
|
|
|
|
if (count==0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("List of security types is ZERO. Giving up.\n");
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
if (count>sizeof(tAuth))
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("%d security types are too many; maximum is %d\n", count, sizeof(tAuth));
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
rfbClientLog("We have %d security types to read\n", count);
|
|
|
|
|
authScheme=0;
|
|
|
|
|
/* now, we have a list of available security types to read ( uint8_t[] ) */
|
|
|
|
|
for (loop=0;loop<count;loop++)
|
|
|
|
|
{
|
|
|
|
|
if (!ReadFromRFBServer(client, (char *)&tAuth[loop], 4)) return FALSE;
|
|
|
|
|
t=rfbClientSwap32IfLE(tAuth[loop]);
|
|
|
|
|
rfbClientLog("%d) Received security type %d\n", loop, t);
|
|
|
|
|
if (flag) continue;
|
|
|
|
|
if (t==rfbVeNCryptTLSNone ||
|
|
|
|
|
t==rfbVeNCryptTLSVNC ||
|
|
|
|
|
t==rfbVeNCryptTLSPlain ||
|
|
|
|
|
t==rfbVeNCryptX509None ||
|
|
|
|
|
t==rfbVeNCryptX509VNC ||
|
|
|
|
|
t==rfbVeNCryptX509Plain)
|
|
|
|
|
{
|
|
|
|
|
flag++;
|
|
|
|
|
authScheme=t;
|
|
|
|
|
rfbClientLog("Selecting security type %d (%d/%d in the list)\n", authScheme, loop, count);
|
|
|
|
|
/* send back 4 bytes (in original byte order!) indicating which security type to use */
|
|
|
|
|
if (!WriteToRFBServer(client, (char *)&tAuth[loop], 4)) return FALSE;
|
|
|
|
|
}
|
|
|
|
|
tAuth[loop]=t;
|
|
|
|
|
}
|
|
|
|
|
if (authScheme==0)
|
|
|
|
|
{
|
|
|
|
|
memset(buf1, 0, sizeof(buf1));
|
|
|
|
|
for (loop=0;loop<count;loop++)
|
|
|
|
|
{
|
|
|
|
|
if (strlen(buf1)>=sizeof(buf1)-1) break;
|
|
|
|
|
snprintf(buf2, sizeof(buf2), (loop>0 ? ", %d" : "%d"), (int)tAuth[loop]);
|
|
|
|
|
strncat(buf1, buf2, sizeof(buf1)-strlen(buf1)-1);
|
|
|
|
|
}
|
|
|
|
|
rfbClientLog("Unknown VeNCrypt authentication scheme from VNC server: %s\n",
|
|
|
|
|
buf1);
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
*result = authScheme;
|
|
|
|
|
return TRUE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
FreeX509Credential(rfbCredential *cred)
|
|
|
|
|
{
|
|
|
|
|
if (cred->x509Credential.x509CACertFile) free(cred->x509Credential.x509CACertFile);
|
|
|
|
|
if (cred->x509Credential.x509CACrlFile) free(cred->x509Credential.x509CACrlFile);
|
|
|
|
|
if (cred->x509Credential.x509ClientCertFile) free(cred->x509Credential.x509ClientCertFile);
|
|
|
|
|
if (cred->x509Credential.x509ClientKeyFile) free(cred->x509Credential.x509ClientKeyFile);
|
|
|
|
|
free(cred);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static gnutls_certificate_credentials_t
|
|
|
|
|
CreateX509CertCredential(rfbCredential *cred)
|
|
|
|
|
{
|
|
|
|
|
gnutls_certificate_credentials_t x509_cred;
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!cred->x509Credential.x509CACertFile)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("No CA certificate provided.\n");
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if ((ret = gnutls_certificate_allocate_credentials(&x509_cred)) < 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Cannot allocate credentials: %s.\n", gnutls_strerror(ret));
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
if ((ret = gnutls_certificate_set_x509_trust_file(x509_cred,
|
|
|
|
|
cred->x509Credential.x509CACertFile, GNUTLS_X509_FMT_PEM)) < 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Cannot load CA credentials: %s.\n", gnutls_strerror(ret));
|
|
|
|
|
gnutls_certificate_free_credentials (x509_cred);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
if (cred->x509Credential.x509ClientCertFile && cred->x509Credential.x509ClientKeyFile)
|
|
|
|
|
{
|
|
|
|
|
if ((ret = gnutls_certificate_set_x509_key_file(x509_cred,
|
|
|
|
|
cred->x509Credential.x509ClientCertFile, cred->x509Credential.x509ClientKeyFile,
|
|
|
|
|
GNUTLS_X509_FMT_PEM)) < 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Cannot load client certificate or key: %s.\n", gnutls_strerror(ret));
|
|
|
|
|
gnutls_certificate_free_credentials (x509_cred);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
} else
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("No client certificate or key provided.\n");
|
|
|
|
|
}
|
|
|
|
|
if (cred->x509Credential.x509CACrlFile)
|
|
|
|
|
{
|
|
|
|
|
if ((ret = gnutls_certificate_set_x509_crl_file(x509_cred,
|
|
|
|
|
cred->x509Credential.x509CACrlFile, GNUTLS_X509_FMT_PEM)) < 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Cannot load CRL: %s.\n", gnutls_strerror(ret));
|
|
|
|
|
gnutls_certificate_free_credentials (x509_cred);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
} else
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("No CRL provided.\n");
|
|
|
|
|
}
|
|
|
|
|
gnutls_certificate_set_dh_params (x509_cred, rfbDHParams);
|
|
|
|
|
return x509_cred;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
rfbBool
|
|
|
|
@ -193,17 +323,108 @@ rfbBool
|
|
|
|
|
HandleVeNCryptAuth(rfbClient* client)
|
|
|
|
|
{
|
|
|
|
|
#ifdef LIBVNCSERVER_WITH_CLIENT_TLS
|
|
|
|
|
uint8_t major, minor, status;
|
|
|
|
|
uint32_t authScheme;
|
|
|
|
|
rfbBool anonTLS;
|
|
|
|
|
gnutls_certificate_credentials_t x509_cred = NULL;
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!InitializeTLS() || !InitializeTLSSession(client, FALSE)) return FALSE;
|
|
|
|
|
if (!InitializeTLS()) return FALSE;
|
|
|
|
|
|
|
|
|
|
/* Read VeNCrypt version */
|
|
|
|
|
if (!ReadFromRFBServer(client, (char *)&major, 1) ||
|
|
|
|
|
!ReadFromRFBServer(client, (char *)&minor, 1))
|
|
|
|
|
{
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
rfbClientLog("Got VeNCrypt version %d.%d from server.\n", (int)major, (int)minor);
|
|
|
|
|
|
|
|
|
|
if (major != 0 && minor != 2)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Unsupported VeNCrypt version.\n");
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!WriteToRFBServer(client, (char *)&major, 1) ||
|
|
|
|
|
!WriteToRFBServer(client, (char *)&minor, 1) ||
|
|
|
|
|
!ReadFromRFBServer(client, (char *)&status, 1))
|
|
|
|
|
{
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (status != 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Server refused VeNCrypt version %d.%d.\n", (int)major, (int)minor);
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!ReadVeNCryptSecurityType(client, &authScheme)) return FALSE;
|
|
|
|
|
if (!ReadFromRFBServer(client, (char *)&status, 1) || status != 1)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Server refused VeNCrypt authentication %d (%d).\n", authScheme, (int)status);
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
client->subAuthScheme = authScheme;
|
|
|
|
|
|
|
|
|
|
/* TODO: read VeNCrypt version, etc */
|
|
|
|
|
/* TODO: call GetCredential and set to TLS session */
|
|
|
|
|
/* Some VeNCrypt security types are anonymous TLS, others are X509 */
|
|
|
|
|
switch (authScheme)
|
|
|
|
|
{
|
|
|
|
|
case rfbVeNCryptTLSNone:
|
|
|
|
|
case rfbVeNCryptTLSVNC:
|
|
|
|
|
case rfbVeNCryptTLSPlain:
|
|
|
|
|
anonTLS = TRUE;
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
anonTLS = FALSE;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Get X509 Credentials if it's not anonymous */
|
|
|
|
|
if (!anonTLS)
|
|
|
|
|
{
|
|
|
|
|
rfbCredential *cred;
|
|
|
|
|
|
|
|
|
|
if (!client->GetCredential)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("GetCredential callback is not set.\n");
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
cred = client->GetCredential(client, rfbCredentialTypeX509);
|
|
|
|
|
if (!cred)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Reading credential failed\n");
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
x509_cred = CreateX509CertCredential(cred);
|
|
|
|
|
FreeX509Credential(cred);
|
|
|
|
|
if (!x509_cred) return FALSE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Start up the TLS session */
|
|
|
|
|
if (!InitializeTLSSession(client, anonTLS)) return FALSE;
|
|
|
|
|
|
|
|
|
|
if (anonTLS)
|
|
|
|
|
{
|
|
|
|
|
if (!SetTLSAnonCredential(client)) return FALSE;
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
if ((ret = gnutls_credentials_set(client->tlsSession, GNUTLS_CRD_CERTIFICATE, x509_cred)) < 0)
|
|
|
|
|
{
|
|
|
|
|
rfbClientLog("Cannot set x509 credential: %s.\n", gnutls_strerror(ret));
|
|
|
|
|
FreeTLS(client);
|
|
|
|
|
return FALSE;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!HandshakeTLS(client)) return FALSE;
|
|
|
|
|
|
|
|
|
|
/* TODO: validate certificate */
|
|
|
|
|
|
|
|
|
|
/* We are done here. The caller should continue with client->subAuthScheme
|
|
|
|
|
* to do actual sub authentication.
|
|
|
|
|
*/
|
|
|
|
|
return TRUE;
|
|
|
|
|
|
|
|
|
|
#else
|
|
|
|
|