Commit Graph

3422 Commits

Author SHA1 Message Date
Koichiro IWAO
ca24572fd5 chansrv: use switch-case to support more codecs 2017-07-25 11:40:04 +09:00
Koichiro IWAO
dbaf23e93b chansrv: constify wFormatTag 2017-07-25 11:40:04 +09:00
Koichiro IWAO
9f8a902476 Add a pam file for FreeBSD
as existing xrdp-sesman.unix doesn't suit FreeBSD.
2017-07-21 14:04:50 +09:00
Ben Cohen
8b4d057af2 Allow UDS connection from non-root users
If you run xrdp with a Unix Domain Socket (UDS) for the port specified in
/etc/xrdp/xrdp.ini then only root can connect to it.

Test case:

1. Edit /etc/xrdp/xrdp.ini to set "port=/var/run/xrdp-local.socket".

2. Restart xrdp.

3. Run the following, as a non-root user.

  socat TCP-LISTEN:12345 UNIX-CONNECT:/var/run/xrdp-local.socket &
  rdesktop localhost:12345

Expected behaviour: rdesktop starts up and displays the logon dialog.
Observed behaviour: rdesktop exits with "ERROR: Connection closed" and
socat exits with "Permission denied".  (But it suceeds if root runs
socat.)

UDS files are created by trans_listen_address() and given permissions
0660, so only root can connect to it.  In this case, for the RDP client
connection, it it fine for any user to connect so it should be given
permissions 0666.

Note that this is only relevant when the port in /etc/xrdp/xrdp.ini has
been set to create a UDS instead of a TCP socket.  When a TCP port is
created any user (including remote users, unless the loopback interface
is used) can connect so this is not less secure.
2017-07-20 09:13:06 +09:00
Ian Geiser
324a334315 append a / to ensure the full path is created even when the config variable lacks a trailing / 2017-07-19 10:35:37 +09:00
Koichiro IWAO
aaa40edefb NEWS: pulralize glitches 2017-07-14 21:22:02 +09:00
Koichiro IWAO
aa0721a90e common: fix more glitches in IPv4 initialization 2017-07-14 21:21:15 +09:00
Ian Geiser
4b87548b71 Use g_create_path instead of g_create_dir
Rename g_mk_temp_dir to g_mk_socket_path
2017-07-14 20:52:38 +09:00
Koichiro IWAO
59a7e8aedf fix typo (copy & paste mistake) 2017-07-13 14:34:19 +09:00
Koichiro IWAO
502998b8fe Update release date 2017-07-13 14:34:19 +09:00
Koichiro IWAO
7ee187f35b Update NEWS 2017-07-13 14:34:19 +09:00
Koichiro IWAO
858e6149f0 fix typo 2017-07-13 13:41:26 +09:00
Koichiro IWAO
6f8eacd72b sesman: make sure socket directory present
before try to create a domain socket.
Originally proposed by Ian Geiser (geiseri).
2017-07-13 13:41:26 +09:00
Koichiro IWAO
8d5010a202 common: use log_message 2017-07-13 13:41:26 +09:00
Jay Sorg
b6bd8acef1 sesman: move auth_start_session, auth_stop_session, and auth_end to child process 2017-07-12 17:58:36 +09:00
Jay Sorg
9d36983ae7 fix for protocol error when 32 bit and non rfx 2017-07-12 15:03:08 +09:00
Koichiro IWAO
8c74fcb80c common: fix a glitch with IPv4 struct initialization
Pointed out by: andrecbarros
Closes: #803
2017-07-10 11:58:10 +09:00
Koichiro IWAO
73a37a5441 Prepare release v0.9.3 2017-07-06 18:07:32 +09:00
Koichiro IWAO
e0b73bf700 update submodules to their release tag head commit 2017-07-06 14:02:04 +09:00
Koichiro IWAO
b83b5510f4 Fix Xvnc backend disconnects when some data copied to clipboard
Should fix #755.
2017-07-06 13:44:53 +09:00
Ben Cohen
c7d08bd9e7 xrdp-sesadmin: fix error when there are no sessions
Test case:  On a system running xrdp with no sessions running run:

  xrdp-sesadmin -u=<user> -p=<password> -c=list

Expected result: "No sessions." (ignoring debug output)
Observed result: "Error getting session list."

In the SCP_SERVER_STATE_MNG_LISTREQ case in scp_v1_mng_process() if
there are no sessions it ends the scp session, which causes an error in
the client.  In commit 0017081d the client was changed to report errors,
giving the result above.

Fix by calling scp_v1s_mng_list_sessions() from scp_v1_mng_process()
even when there are no sessions, and if so sending a packet with a count
of zero so that the client gets what it expects.
2017-07-06 13:40:25 +09:00
Koichiro IWAO
aa4b90d250 Change log level DEBUG -> WARNING
since unavailability of ssl protocols defined in config file
may weaken security and it is important for users.
2017-07-06 13:14:27 +09:00
Koichiro IWAO
455c341efc Reword log messages in ssl_get_protocols_from_string() 2017-07-06 13:14:27 +09:00
Koichiro IWAO
1b11c1888f docs: document change of xrdp-chansrv log path 2017-07-06 12:36:47 +09:00
Koichiro IWAO
9065964bd9 chansrv: include display number in chansrv log filename
since xrdp-chansrv may be run multiple instances per user. For example,
Xvnc backend creates one session per screen geometry.
2017-07-06 12:36:47 +09:00
Koichiro IWAO
3a27631826 travis: enable build test on v0.9 branch
it is the latest stable branch.
2017-07-06 12:27:56 +09:00
Jay Sorg
8d63c32899 move openssl calls to common/libssl.c, check for defines 2017-06-22 11:47:48 +09:00
Koichiro IWAO
5def0596e0 int function should return 2017-06-20 14:29:02 +09:00
Koichiro IWAO
5a7208a15b sesman: exit with failure status if listen failed 2017-06-20 14:29:02 +09:00
Koichiro IWAO
1d89000d90 xrdp: exit main process with failure status if listen failed (daemon mode) 2017-06-20 14:29:02 +09:00
Koichiro IWAO
7aad2c83c6 xrdp: exit with failure status if listen failed (foreground mode) 2017-06-20 14:29:02 +09:00
Koichiro IWAO
252cb20365 xrdp: xrdp_listen_main_loop pass through trans_listen_address return value 2017-06-20 14:29:02 +09:00
Koichiro IWAO
6a860d4b02 sesman: install empty reconnectwm.sh as a template
as it was undocumented and few people know reconnectwm.sh is executed on
client reconnect. The behaviour of startwm.sh / reconnectwm.sh  should
be documented. This is a first step of documenting them.
2017-06-20 13:40:05 +09:00
Koichiro IWAO
606984baad add Spanish keylayout 2017-06-17 16:31:17 +09:00
Koichiro IWAO
088bd2d811 common: implement g_file_readable for WIN32 2017-06-12 16:57:04 +09:00
Koichiro IWAO
a1b0344db5 Use the words "cannot read" rather than "cannot open"
as the code actually tests readability.
2017-06-12 16:57:04 +09:00
Koichiro IWAO
4f7969b562 Check certificate/privkey readability not existence
to fail RDP security negotiation if certificate/privkey is not readable
2017-06-12 16:57:04 +09:00
Koichiro IWAO
65c1fe87d7 Log user-friendly message when certificate/privkey is inaccessible
We shouldn't assume that xrdp daemon is running under root privilege.
In many cases, root privilege is not really needed for xrdp daemon.
xrdp may fail to load certificate/privkey due to lack of permissions
when running under user privilege. Checking existence of files is not
enough and xrdp should output user-friendly log in such case.

Reported by Debian user in bug 856436 [1].

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856436
2017-06-12 16:57:04 +09:00
Koichiro IWAO
0299d64fa8 sort xrdp_keyboard.ini 2017-06-09 15:55:22 +09:00
Ben Cohen
bb9756f6c5 Fix UK/GB keyboard layout
The UK/GB keyboard doesn't work properly connecting to xrdp with xorgxrdp.
It does work when connecting to xrdp with x11vnc, however.

This is because the layout is not declared in xrdp_keyboard.ini.  It needs
to be called "gb" not "uk".  (There are other layouts that have
km-nnnn.ini files that aren't declared in xrdp_keyboard.ini, so they might
have the same bug, but I haven't tested that.  This is analagous to the
commits for the "ch" and "pl" layouts.)

Test case:

1. Use a PC with the UK/GB keyboard layout.

2. Create /etc/xrdp/startwm.sh as follows:

     #!/bin/sh
     export LANG=en_GB.UTF-8
     export MDM_LANG=en_GB.UTF-8
     export XTERM_LOCALE=en_GB.UTF-8
     xterm
     exit 0

3. Connect using rdesktop to localhost (from a session where the same
   environment variables are defined).

4. Test layout-specific keys such as:
      \ (backslash)
      | (bar)
      # (numbersign)
      ~ (asciitilde)
      £ (sterling: Shift-3)
      € (EuroSign: AltGr-4)

These keys should produce the appropriate symbol but they don't.  With
the change in this commit the keys produce the correct symbol.
2017-06-08 13:31:30 +09:00
Koichiro IWAO
84596e7392 Pick up the first section if given section(domain) doesn't match anything
As some clinents (AFAIK Windows 10) always send domain name, the backend
module is not selected properly. This causes the default usage with
Windows 10 fails with 'xrdp_wm_log_msg: Section "XXX" not configured'.
2017-06-07 14:08:26 +09:00
Koichiro IWAO
0e7844ab02 Constify MCS connectionType 2017-06-06 10:04:48 +09:00
Koichiro IWAO
e879cf5fce add TODO comments 2017-05-31 16:27:23 +09:00
Koichiro IWAO
bedf04cd9f instfiles: substitute directories in systemd service files
Do not expect prefix is always /usr. /usr/local is often used when users
compile xrdp manually.
2017-05-31 16:27:23 +09:00
Koichiro IWAO
67aab0a706 configure: fix confusing help text about painter and librfxcodec
painter and librfxcodec are enabled by default. --disable-* options
disables them.

Before:
  --disable-painter       Use included painter library (default: yes)
  --disable-rfxcodec      Use included librfxcodec library (default: yes)

After:
  --disable-painter       Do not use included painter library (default: no)
  --disable-rfxcodec      Do not use included librfxcodec library (default:
                          no)
2017-05-23 11:26:51 +09:00
Koichiro IWAO
3c3c362946 ignore *.so (pulseaudio modules) 2017-05-16 10:41:06 +09:00
Koichiro IWAO
e1d11a74da pulse: respect XRDP_SOCKET_PATH environment variable 2017-05-16 10:41:06 +09:00
Koichiro IWAO
1acef2567c sesman: pass xrdp socket path to user session
via environment variable.
2017-05-16 10:41:06 +09:00
Koichiro IWAO
c7f8e360fd common: separate sockets macros into basename and fullpath
since sometimes socket directory is obtained from environment variable.
2017-05-16 10:41:06 +09:00
Jay Sorg
2c96908ea5 common: if SSL_shutdown fails, only call one more time 2017-05-10 14:56:20 -07:00