Commit Graph

25 Commits

Author SHA1 Message Date
Armin Novak
72ca88f49c Reformatted to new style 2019-11-07 10:53:54 +01:00
Armin Novak
f0864108f9 Updated iOS client. 2016-10-06 13:43:08 +02:00
Bernhard Miklautz
196695e011 client/ios: fix unchecked strdups 2015-06-22 19:09:59 +02:00
Norbert Federa
939f1c639a Standard RDP Security Layer Levels/Method Overhaul
[MS-RDPBCGR] Section 5.3 describes the encryption level and method values for
standard RDP security.

Looking at the current usage of these values in the FreeRDP code gives me
reason to believe that there is a certain lack of understanding of how these
values should be handled.

The encryption level is only configured on the server side in the "Encryption
Level" setting found in the Remote Desktop Session Host Configuration RDP-Tcp
properties dialog and this value is never transferred from the client to the
server over the wire.
The possible options are "None", "Low", "Client Compatible", "High" and
"FIPS Compliant". The client receices this value in the Server Security Data
block (TS_UD_SC_SEC1), probably only for informational purposes and maybe to
give the client the possibility to verify if the server's decision for the
encryption method confirms to the server's encryption level.
The possible encryption methods are "NONE", "40BIT", "56BIT", "128BIT" and
"FIPS" and the RDP client advertises the ones it supports to the server in the
Client Security Data block (TS_UD_CS_SEC).
The server's configured encryption level value restricts the possible final
encryption method.
Something that I was not able to find in the documentation is the priority
level of the individual encryption methods based on which the server makes its
final method decision if there are several options.
My analysis with Windows Servers reveiled that the order is 128, 56, 40, FIPS.
The server only chooses FIPS if the level is "FIPS Comliant" or if it is the
only method advertised by the client.

Bottom line:
* FreeRDP's client side does not need to set settings->EncryptionLevel
(which was done quite frequently).
* FreeRDP's server side does not have to set the supported encryption methods
list in settings->EncryptionMethods

Changes in this commit:

Removed unnecessary/confusing changes of EncryptionLevel/Methods settings

Refactor settings->DisableEncryption
* This value actually means "Advanced RDP Encryption (NLA/TLS) is NOT used"
* The old name caused lots of confusion among developers
* Renamed it to "UseRdpSecurityLayer" (the compare logic stays untouched)

Any client's setting of settings->EncryptionMethods were annihilated
* All clients "want" to set all supported methods
* Some clients forgot 56bit because 56bit was not supported at the time the
code was written
* settings->EncryptionMethods was overwritten anyways in nego_connect()
* Removed all client side settings of settings->EncryptionMethods
The default is "None" (0)
* Changed nego_connect() to advertise all supported methods if
settings->EncryptionMethods is 0 (None)
* Added a commandline option /encryption-methods:comma separated list of the
values "40", "56", "128", "FIPS". E.g. /encryption-methods:56,128
* Print warning if server chooses non-advertised method

Verify received level and method in client's gcc_read_server_security_data
* Only accept valid/known encryption methods
* Verify encryption level/method combinations according to MS-RDPBCGR 5.3.2

Server implementations can now set settings->EncryptionLevel
* The default for settings->EncryptionLevel is 0 (None)
* nego_send_negotiation_response() changes it to ClientCompatible in that case
* default to ClientCompatible if the server implementation set an invalid level

Fix server's gcc_write_server_security_data
* Verify server encryption level value set by server implementations
* Choose rdp encryption method based on level and supported client methods
* Moved FIPS to the lowest priority (only used if other methods are possible)

Updated sample server
* Support RDP Security (RdpKeyFile was not set)
* Added commented sample code for setting the security level
2014-12-12 02:17:12 +01:00
Martin Fleisz
4d71032656 iOS: Removed unused code 2013-12-04 12:30:33 +01:00
Bernhard Miklautz
2b6b4a6685 updated file headers 2013-12-04 11:44:22 +01:00
Marc-André Moreau
bc631c93a8 freerdp: separate GatewayUsageMethod from GatewayEnabled 2013-07-03 15:07:12 -04:00
Bernhard Miklautz
91380255c9 Merge pull request #1258 from mfleisz/rfxbmpv3fix
Android/iOS: Fixes for using RemoteFX with Bitmap Cache V3
2013-05-22 02:11:52 -07:00
Martin Fleisz
f2aea91ccf Android/iOS: Fixes for using RemoteFX with Bitmap Cache V3 2013-05-22 01:48:43 -07:00
Martin Fleisz
583938dcb8 iOS: Fixed password storage on higher iOS versions 2013-05-21 15:42:49 +02:00
Martin Fleisz
c55f3d6426 iOS: Encrypt TS Gateway passwords 2013-05-08 17:29:52 +02:00
Martin Fleisz
935aa5e2ea iOS: Added TS Gateway support 2013-05-08 14:50:29 +02:00
Martin Fleisz
1a336c30b8 iOS: Fix for shift key handling (by bslande) 2013-04-23 10:15:12 +02:00
Martin Fleisz
dd5cbef467 iOS: Fix resource leak 2013-04-18 10:51:39 +02:00
Martin Fleisz
ce4e02ae48 iOS: Fixed possible crash on disconnect 2013-04-17 13:09:53 +02:00
Martin Fleisz
0375189c8e iOS/Android: Fix for Win8 2013-04-05 12:36:23 +02:00
Martin Fleisz
db79cb34e2 iOS: Ensure each bookmark has a UUID 2013-04-05 10:46:28 +02:00
Thinstuff Developer
834ca7fc4a iOS: Fixed issue where boookmarks were saved even though cancel was pressed 2013-04-03 09:36:55 +02:00
Martin Fleisz
38446b5f2b iOS: got rid of xcode project file 2013-03-29 14:28:27 +01:00
Florian Holzapfel
65577d138e fix some memory leaks on iOS 2013-03-20 14:16:09 +01:00
Martin Fleisz
212673d7e9 iOS: Fixed keyboard issues 2013-03-18 12:29:47 +01:00
Martin Fleisz
96a2717b3c iOS: Compile fixes (Fixed #1069, #1086) 2013-03-13 15:08:45 +01:00
Martin Fleisz
14bd37e8b2 iOS: Enable NSCodec, fixed RFX to Win8, resize sanity check 2013-03-05 13:25:50 +01:00
Martin Fleisz
d9089f2730 iOS: Added test bookmark 2013-02-25 16:48:22 +01:00
Bernhard Miklautz
e5cf8ff7fb iOS: initial release of iFreeRDP
This is the initial release of iFreeRDP the FreeRDP iOS client.
Build instructions can be found in docs/README.ios.
2013-02-14 14:59:12 +01:00