mirrors
/
xrdp
mirror of https://github.com/neutrinolabs/xrdp
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
3,599 Commits 9 Branches 44 Tags 21 MiB
Commit Graph

596 Commits

Author SHA1 Message Date
speidy 8effc09ab7 common: ssl_calls: check if SSL object created right after its creation. 2018-03-21 08:16:12 +02:00
Koichiro IWAO e3d0fd6d46
common: temporarily disable DHE 
until make it possible to use generated DH parameters per installation.
 2018-03-18 21:14:06 +09:00
Koichiro IWAO 1690950cc8
common: regenerate dhparam 
Generated by: openssl dhparam -C 2236
 2018-03-01 13:48:22 +09:00
Koichiro IWAO 578d23477c
common: obey coding style, remove trailing space 2018-03-01 12:11:52 +09:00
Enrico Tagliavini 70b5adb396 add support for DHE ciphers via compiled in dhparam 
make it possible to use regular (non EC) EDH ciphers. To make this
possible a Diffie-Hellman parameter must be passed to the openssl
library. There are a few options possible as described in the manuals at
[1] and [2]. Simplest approach is to generate a DH parameter using
openssl dhparam -C <lenght> and include the code into the application.
The lenght used for this commit is 2236 bits long, which is the longest
possible without risking backward incompatibilities with old systems as
stated in [1]. Newer systems should use ECDH anyway, so it makes sense
to keep this method as compatible with older system as possible.
Paramters longer than 2048 should still be secure enough at the time of
writing.

[1] https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
[2] https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_tmp_dh_callback(3)
 2018-03-01 09:57:35 +09:00
Enrico Tagliavini 6cdc0f31b0 enable automatic ECDH when possible (openssl 1.0.2) 
Openssl 1.1.0 and later are enabling ECDH automatically, but for older
version it must be enabled explicitly or all Perfect Forward Secrecy
ciphers will be silently ignored. See also [1]. This commit applies the
same fix as found in CnetOS 7 httpd package to enable automatic ECDH as
found in [2].

[1] https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
[2] https://git.centos.org/blob/rpms!httpd.git/c7/SOURCES!httpd-2.4.6-ssl-ecdh-auto.patch
 2018-03-01 09:57:35 +09:00
Koichiro IWAO 793a418cfb
common: log what value is set to tls_ciphers 
Related to #1033.
 2018-02-20 13:13:37 +09:00
Koichiro IWAO 3da4d72323
common: quit using `!` as comment out symbol in config files 
It is not used anywhere in default config. Some config like
`tls_ciphers` might contain `!` like this:

    tls_ciphers=FIPS:!aNULL:!eNULL

Fixes #1033.
 2018-02-20 13:13:34 +09:00
daixj 31ef2552c4 log: revert permission 2018-02-13 16:44:37 +09:00
daixj ea6bb62410 log: fix fd checking 2018-02-13 16:44:37 +09:00
daixj 551bb185c5 log: remove unused code and fix potential memory leak 2018-02-13 16:44:37 +09:00
Koichiro IWAO 577bd8214f common: add more capset constants 
defined at MS-RDPBCGR 2.2.1.13.1.1.1 [1] and sort

[1] https://msdn.microsoft.com/en-us/library/cc240486.aspx
 2017-12-01 11:20:42 +09:00
Koichiro IWAO 77a34e0a7b common: express capability set constants in hex 
as same as done in  MS-RDPBCGR 2.2.1.13.1.1.1 [1].

[1] https://msdn.microsoft.com/en-us/library/cc240486.aspx
 2017-12-01 11:20:42 +09:00
Koichiro IWAO 788ae1467a xrdp_sec: constify color depth value 2017-12-01 11:20:42 +09:00
Koichiro IWAO d0c27a2904 common: suppress log when closing log files 
because if xrdp is running 'fork=yes' mode, the log message
'shutting down log subsystem...' is logged everytime when the child
process is exitting. In other words, everytime when clients are
disconnecting.  This is a little bit too vebose.
 2017-11-30 15:13:18 +09:00
Koichiro IWAO 3de3a4fab5 common: add more references to constants' origin 
classify constants into these 5 types

* constants for xrdp
* constants come from ITU-T Recommendations
* constants come from Remote Desktop Protocol
* constants come from other MS products
* unclassified yet
 2017-11-24 21:45:48 +09:00
Koichiro IWAO 799c230998 common: add references to constants' origin 2017-11-24 21:45:48 +09:00
Jay Sorg a9eb21e6d7 common: avoid 100% cpu on ssl accept, can be fake client 2017-11-22 16:17:34 -08:00
Justin Terry (VM) d7d14d7462 Implements the accept/close logic for vsock 2017-11-17 20:23:20 -08:00
Jay Sorg bc48578a90 remove crc16.h from common/Makefile.am 2017-11-09 21:13:53 -08:00
Jay Sorg 54285d26dd remove empty crc16.h file 2017-11-09 21:13:53 -08:00
Jay Sorg 285465a1f5 common, return -1 for bad socket 2017-11-07 18:20:45 -08:00
Jay Sorg c6c513b23c use g_memcpy, braces 2017-11-07 18:20:45 -08:00
Jay Sorg 26507644e3 vsock, move some defines 2017-11-07 18:20:45 -08:00
Justin Terry (VM) 50bd624cc4 Implements XRDP over vsock 
1. Implements the ability to use AV_VSOCK for the transport rather than TCP.
2. Updates the ini file to be able to conditionally turn this feature on.
 2017-11-07 18:20:45 -08:00
Koichiro IWAO a6fd518a48 fix typo s/Roration/Rotation/ 2017-11-06 16:18:42 +09:00
Koichiro IWAO 2475893402 Constify extended mouse events 2017-11-06 16:18:42 +09:00
Koichiro IWAO 27aef96e81 Constify mouse event flags, use the MS name for constants 2017-11-06 16:18:42 +09:00
Koichiro IWAO 4a2818e183 Add some more Input Capability Set constants 2017-11-06 16:18:42 +09:00
Koichiro IWAO 2411a0be14 log: add log level TRACE 
TRACE means more verbose than DEBUG. syslog doesn't have more verbose
level than DEBUG, map TRACE to DEBUG for syslog.
 2017-10-13 15:09:33 +09:00
Koichiro IWAO 00bf62bd42 common: prevent raw use of snprintf 2017-10-03 21:55:08 +09:00
Koichiro IWAO ced3a4817f xrdp: constify input event type 2017-10-02 09:39:48 +09:00
Koichiro IWAO f9ab4df7f2 common: fix g_write_ip_address() didn't return correct IP address 
Fixes: #878.
 2017-09-26 10:54:08 +09:00
Jay Sorg 021a78f4c6 chansrv: sound, use WAVE_FORMAT_AAC not WAVE_FORMAT_AAC_MS 2017-08-04 17:24:57 -07:00
Jay Sorg bf0d56c314 chansrv: sound, add aac 2017-08-04 17:24:57 -07:00
Koichiro IWAO 4d14f344fd fix indent, no logic change 2017-08-01 08:40:30 +09:00
Koichiro IWAO 04187945a8 move base64 functions to base64.c 2017-08-01 08:40:30 +09:00
Koichiro IWAO eae5cdf1fd pass through except for the first '=' 
if "foo=ba=r" is found in ini files, it should be parsed like this.
      key : foo
    value : ba=r
 2017-08-01 08:40:30 +09:00
Koichiro IWAO d57e02626d add base64_decode function 2017-08-01 08:40:30 +09:00
Koichiro IWAO dbaf23e93b chansrv: constify wFormatTag 2017-07-25 11:40:04 +09:00
Ian Geiser 324a334315 append a / to ensure the full path is created even when the config variable lacks a trailing / 2017-07-19 10:35:37 +09:00
Koichiro IWAO aa0721a90e common: fix more glitches in IPv4 initialization 2017-07-14 21:21:15 +09:00
Ian Geiser 4b87548b71 Use g_create_path instead of g_create_dir 
Rename g_mk_temp_dir to g_mk_socket_path
 2017-07-14 20:52:38 +09:00
Koichiro IWAO 8d5010a202 common: use log_message 2017-07-13 13:41:26 +09:00
Koichiro IWAO 8c74fcb80c common: fix a glitch with IPv4 struct initialization 
Pointed out by: andrecbarros
Closes: #803
 2017-07-10 11:58:10 +09:00
Koichiro IWAO aa4b90d250 Change log level DEBUG -> WARNING 
since unavailability of ssl protocols defined in config file
may weaken security and it is important for users.
 2017-07-06 13:14:27 +09:00
Koichiro IWAO 455c341efc Reword log messages in ssl_get_protocols_from_string() 2017-07-06 13:14:27 +09:00
Jay Sorg 8d63c32899 move openssl calls to common/libssl.c, check for defines 2017-06-22 11:47:48 +09:00
Koichiro IWAO 088bd2d811 common: implement g_file_readable for WIN32 2017-06-12 16:57:04 +09:00
Koichiro IWAO 65c1fe87d7 Log user-friendly message when certificate/privkey is inaccessible 
We shouldn't assume that xrdp daemon is running under root privilege.
In many cases, root privilege is not really needed for xrdp daemon.
xrdp may fail to load certificate/privkey due to lack of permissions
when running under user privilege. Checking existence of files is not
enough and xrdp should output user-friendly log in such case.

Reported by Debian user in bug 856436 [1].

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856436
 2017-06-12 16:57:04 +09:00
Koichiro IWAO 0e7844ab02 Constify MCS connectionType 2017-06-06 10:04:48 +09:00
Koichiro IWAO c7f8e360fd common: separate sockets macros into basename and fullpath 
since sometimes socket directory is obtained from environment variable.
 2017-05-16 10:41:06 +09:00
Jay Sorg 2c96908ea5 common: if SSL_shutdown fails, only call one more time 2017-05-10 14:56:20 -07:00
Jay Sorg 75fd3fcf89 common: ssl_tls_write / read return 0 on socket close 2017-05-10 14:56:20 -07:00
MichaelSweden 5c668dc420 Removed error message while falling back to IPv4 (issue #714) 2017-04-25 09:31:22 +09:00
MichaelSweden 106ae2cd43 Fix to handle OS disabled IPv6, issue #714. 
- Changes made only in the os_calls.c file.
- Exported functions changed: g_tcp_bind g_tcp_bind_address g_tcp_connect
- Support three network configurations:
  1) Normal network, with IPv6
  2) Partly disabled IPv6 via sysctl.conf
  3) Total disabled IPv6 via grub
 2017-04-25 09:31:22 +09:00
Pavel Roskin 148afd1170 Rename file_loc.h to xrdp_sockets.h, install it 
Include xrdp_sockets.h directly, not through headers.
 2017-03-28 00:59:16 -07:00
speidy 2f382d2a16 libxrdp: print connected client name to log 2017-03-21 22:02:29 -07:00
Pavel Roskin 95506a169f Log socket fd in g_sck_accept(), fix AF_UNIX logging 2017-03-21 21:59:50 -07:00
Pavel Roskin 43899b7e0c Allocate space for tls_ciphers dynamically 2017-03-21 10:39:40 -07:00
Pavel Roskin 58c9cb43e9 Make socket directory configurable, don't hardcode /tmp/.xrdp 
Use XRDP_SOCKET_PATH in file_loc.h

Don't define any non-socket paths in file_loc.h, they should come from
the makefiles.

Define all paths unconditionally, they should not be defined elsewhere.

Pass XRDP_SOCKET_PATH as environment variable to the backends.
 2017-03-17 22:25:05 -07:00
Pavel Roskin 6ed4c969f4 Eliminate APP_CC and DEFAULT_CC 2017-03-14 00:21:48 -07:00
Pavel Roskin 30a7a947b1 Don't include config_ac.h from any header files 2017-03-04 00:52:34 -08:00
Pavel Roskin b2d3dcf169 Include config_ac.h from all source files 2017-03-04 00:52:34 -08:00
Koichiro IWAO c126f81d9a add comment to keep xorgxrdp/x11rdp compatibility 2017-02-27 14:17:25 +09:00
Koichiro IWAO e94ab10e14 TLS: new method to specify SSL/TLS version 
SSL/TLS protocols only listed in ssl_protocols should be used.
The name "ssl_protocols" comes from nginx.

Resolves #428.
 2017-02-27 14:17:25 +09:00
Jay Sorg 657f6f3756 common: use select for SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE tls errors 2017-02-25 20:52:27 -08:00
Jay Sorg e0ac84aaa4 change some casts to long long 2017-02-22 20:39:56 -08:00
Jay Sorg c5e9bc7851 common: print list items as pointers 2017-02-22 20:39:56 -08:00
Jay Sorg 7825246d7a fix warning new since stdint.h change 2017-02-22 20:39:56 -08:00
Pavel Roskin f8d22ce673 aarch64 doesn't require pointers to be aligned 2017-02-13 21:00:22 -08:00
Pavel Roskin dc1e341f5a Constify input arguments of ssl_mod_exp() and ssl_gen_key_xrdp1() 2017-02-02 21:39:10 -08:00
Pavel Roskin 6a3f0a75bd Remove support for OpenSSL older than 0.9.8 
It's hard to find an older version of OpenSSL even on long term support
distros.
 2017-02-02 21:39:10 -08:00
Jay Sorg d7967ec897 minor arch.h change 2017-01-29 23:14:33 -08:00
Jay Sorg 3b84314a1a arch.h changes to include stdint.h 2017-01-29 23:14:33 -08:00
mirabilos 6257bae23f Add GNU/kFreeBSD support (#645) 
* GNU/kFreeBSD is a FreeBSD variant, for code purposes.

* GNU/kFreeBSD uses GNU/Linux-ish init scripts, however.
 2017-01-26 23:02:41 -02:00
Idan Freiberg 19375dda7a Merge pull request #426 from metalefty/log-tls-version-and-cipher 
TLS: log TLS version and cipher
 2017-01-16 07:26:51 +02:00
Idan Freiberg a64e1789c5 Merge pull request #615 from speidy/channels_fixes 
Channels improvements
 2017-01-15 08:55:00 +02:00
Pavel Roskin f1a521204a Remove redundant function declarations 2017-01-11 23:25:42 -08:00
Koichiro IWAO c89c1318f8 obey coding standard, no logic change 2017-01-12 09:28:22 +09:00
speidy 94cdbdcee6 libxrdp: change channel_code into a meaningful name 2017-01-06 07:59:49 +02:00
Pavel Roskin 6664aac00f Use "void" for empty argument list in declarations 
In C, an empty argument list in a declaration means that the function
can accept any arguments. Use "void" instead, it means "no arguments".

C++ treats void and empty list as "no arguments".
 2017-01-05 17:27:20 -08:00
volth 26a26ef906 fix build with --enable-xrdpdebug=yes 2017-01-04 19:20:44 +00:00
volth 37b4a14b54 fix build with --enable-xrdpdebug=yes 2017-01-04 13:00:01 +00:00
metalefty 25e5243ecf Merge pull request #553 from jsorg71/libpainter 
add libpainter for drawing when client does not have minimum orders
 2016-12-20 17:00:48 +09:00
Jay Sorg 1f51586769 add libpainter for drawing when client does not have minimum orders 2016-12-15 21:17:50 -08:00
speidy 4697354044 xrdp_constants: move CAPSET constants to their place 2016-12-13 19:35:56 -05:00
speidy 917aadd2d1 libxrdp: more constants 2016-12-13 18:18:34 -05:00
speidy 3dc0f2860c Merge branch 'surface_cmds' of git://github.com/speidy/xrdp into surface_cmds 2016-12-13 15:08:37 -05:00
speidy 5e39bb1f87 libxrdp: caps, group caps require fastpath output, use FASTPATH_OUTPUT_SUPPORTED constant 2016-12-13 15:05:39 -05:00
Speidy a0cf6030df Merge branch 'devel' of https://github.com/neutrinolabs/xrdp into surface_cmds 2016-12-12 15:51:39 -08:00
jsorg71 5966de4ee2 Merge pull request #536 from jsorg71/unicode 
add unicode support
 2016-12-11 17:15:34 -08:00
Jay Sorg c264862afe change some magics to defines 2016-12-10 01:06:45 -08:00
Jay Sorg 2f8d3ba9da add unicode support 2016-12-10 00:11:28 -08:00
Pavel Roskin d97155e2f6 Don't use colon to separate IPv6 address from the port 
IPv6 addresses can have colons in their names, so the final colon can be
confusing.
 2016-12-09 08:42:56 -08:00
speidy 8a0fec5e66 o send RFX tiles as stream (Stream Surface Bits Command) 
o silent frame ack logging
o support surface commands in capsets
o fix some wrong constants
 2016-12-08 20:12:00 -05:00
Jay Sorg 9a517b34f0 vnc: code cleanup 2016-12-04 15:39:10 -08:00
metalefty 943dec86ca Merge pull request #512 from speidy/devel 
xrdp_encoder: do not initialize for non-UNIX rdp clients
 2016-12-02 15:25:48 +09:00
Pavel Roskin c6307aa2b0 Use pkg-config to discover OpenSSL 
All supported versions of OpenSSL have pkg-config files.
 2016-11-29 17:00:09 -08:00
Pavel Roskin 06f4f72e28 Add -ldl to libcommon link flags if it's needed for dlopen() 2016-11-29 16:25:37 -08:00