blob: a268a512a485d178db31a63f190d16e22c60748f [file] [log] [blame]
Adam Tkacdfe19cf2010-04-23 14:14:11 +00001/*
2 * Copyright (C) 2004 Red Hat Inc.
3 * Copyright (C) 2005 Martin Koegler
4 * Copyright (C) 2010 TigerVNC Team
5 *
6 * This is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This software is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this software; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
19 * USA.
20 */
21
22#ifdef HAVE_CONFIG_H
23#include <config.h>
24#endif
25
Adam Tkacdf799702010-04-28 15:45:53 +000026#ifndef HAVE_GNUTLS
27#error "This source should not be compiled without HAVE_GNUTLS defined"
28#endif
Adam Tkacdfe19cf2010-04-23 14:14:11 +000029
Adam Tkac21b61a52010-07-21 09:19:00 +000030#include <rfb/SSecurityTLS.h>
Adam Tkacdfe19cf2010-04-23 14:14:11 +000031#include <rfb/SConnection.h>
32#include <rfb/LogWriter.h>
33#include <rfb/Exception.h>
34#include <rdr/TLSInStream.h>
35#include <rdr/TLSOutStream.h>
36
Adam Tkacf39671d2010-07-21 09:10:54 +000037#define DH_BITS 1024 /* XXX This should be configurable! */
Adam Tkacdfe19cf2010-04-23 14:14:11 +000038#define TLS_DEBUG
39
40using namespace rfb;
41
Adam Tkac21b61a52010-07-21 09:19:00 +000042StringParameter SSecurityTLS::X509_CertFile
Adam Tkacf39671d2010-07-21 09:10:54 +000043("x509cert", "specifies path to the x509 certificate in PEM format", "", ConfServer);
44
Adam Tkac21b61a52010-07-21 09:19:00 +000045StringParameter SSecurityTLS::X509_KeyFile
Adam Tkacf39671d2010-07-21 09:10:54 +000046("x509key", "specifies path to the key of the x509 certificate in PEM format", "", ConfServer);
47
Adam Tkacdfe19cf2010-04-23 14:14:11 +000048static LogWriter vlog("TLS");
49
50#ifdef TLS_DEBUG
51static void debug_log(int level, const char* str)
52{
53 vlog.debug(str);
54}
55#endif
56
Adam Tkac21b61a52010-07-21 09:19:00 +000057void SSecurityTLS::initGlobal()
Adam Tkacdfe19cf2010-04-23 14:14:11 +000058{
59 static bool globalInitDone = false;
60
61 if (!globalInitDone) {
62 if (gnutls_global_init() != GNUTLS_E_SUCCESS)
63 throw AuthFailureException("gnutls_global_init failed");
64
65#ifdef TLS_DEBUG
66 gnutls_global_set_log_level(10);
67 gnutls_global_set_log_function(debug_log);
68#endif
69
70 globalInitDone = true;
71 }
72}
73
Adam Tkac21b61a52010-07-21 09:19:00 +000074SSecurityTLS::SSecurityTLS(bool _anon) : session(0), dh_params(0),
Adam Tkacf39671d2010-07-21 09:10:54 +000075 anon_cred(0), cert_cred(0),
76 anon(_anon), fis(0), fos(0)
Adam Tkacdfe19cf2010-04-23 14:14:11 +000077{
Adam Tkacf39671d2010-07-21 09:10:54 +000078 certfile = X509_CertFile.getData();
79 keyfile = X509_KeyFile.getData();
Adam Tkacdfe19cf2010-04-23 14:14:11 +000080}
81
Adam Tkac21b61a52010-07-21 09:19:00 +000082void SSecurityTLS::shutdown()
Adam Tkacdfe19cf2010-04-23 14:14:11 +000083{
Adam Tkacf39671d2010-07-21 09:10:54 +000084 if (session) {
85 if (gnutls_bye(session, GNUTLS_SHUT_RDWR) != GNUTLS_E_SUCCESS) {
86 /* FIXME: Treat as non-fatal error */
87 vlog.error("TLS session wasn't terminated gracefully");
88 }
89 }
90
91 if (dh_params) {
92 gnutls_dh_params_deinit(dh_params);
93 dh_params = 0;
94 }
95
96 if (anon_cred) {
97 gnutls_anon_free_server_credentials(anon_cred);
98 anon_cred = 0;
99 }
100
101 if (cert_cred) {
102 gnutls_certificate_free_credentials(cert_cred);
103 cert_cred = 0;
104 }
105
106 if (session) {
107 gnutls_deinit(session);
108 session = 0;
109
110 gnutls_global_deinit();
111 }
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000112}
113
114
Adam Tkac21b61a52010-07-21 09:19:00 +0000115SSecurityTLS::~SSecurityTLS()
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000116{
Adam Tkacf39671d2010-07-21 09:10:54 +0000117 shutdown();
118
119 if (fis)
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000120 delete fis;
Adam Tkacf39671d2010-07-21 09:10:54 +0000121 if (fos)
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000122 delete fos;
Adam Tkacf39671d2010-07-21 09:10:54 +0000123
124 delete[] keyfile;
125 delete[] certfile;
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000126}
127
Adam Tkac21b61a52010-07-21 09:19:00 +0000128bool SSecurityTLS::processMsg(SConnection *sc)
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000129{
130 rdr::InStream* is = sc->getInStream();
131 rdr::OutStream* os = sc->getOutStream();
132
133 vlog.debug("Process security message (session %p)", session);
134
135 if (!session) {
136 initGlobal();
137
138 if (gnutls_init(&session, GNUTLS_SERVER) != GNUTLS_E_SUCCESS)
139 throw AuthFailureException("gnutls_init failed");
140
141 if (gnutls_set_default_priority(session) != GNUTLS_E_SUCCESS)
142 throw AuthFailureException("gnutls_set_default_priority failed");
143
144 try {
145 setParams(session);
146 }
147 catch(...) {
148 os->writeU8(0);
149 throw;
150 }
151
152 gnutls_transport_set_pull_function(session,rdr::gnutls_InStream_pull);
153 gnutls_transport_set_push_function(session,rdr::gnutls_OutStream_push);
154 gnutls_transport_set_ptr2(session,
155 (gnutls_transport_ptr)is,
156 (gnutls_transport_ptr)os);
157 os->writeU8(1);
158 os->flush();
159 }
160
161 int err;
162 if ((err = gnutls_handshake(session)) != GNUTLS_E_SUCCESS) {
163 if (!gnutls_error_is_fatal(err)) {
164 vlog.debug("Deferring completion of TLS handshake: %s", gnutls_strerror(err));
165 return false;
166 }
167 vlog.error("TLS Handshake failed: %s", gnutls_strerror (err));
Adam Tkacf39671d2010-07-21 09:10:54 +0000168 shutdown();
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000169 throw AuthFailureException("TLS Handshake failed");
170 }
171
172 vlog.debug("Handshake completed");
173
174 sc->setStreams(fis=new rdr::TLSInStream(is,session),
175 fos=new rdr::TLSOutStream(os,session));
176
177 return true;
178}
179
Adam Tkac21b61a52010-07-21 09:19:00 +0000180void SSecurityTLS::setParams(gnutls_session session)
Adam Tkacf39671d2010-07-21 09:10:54 +0000181{
182 static const int kx_anon_priority[] = { GNUTLS_KX_ANON_DH, 0 };
183 static const int kx_priority[] = { GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
184 GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0 };
185
186 gnutls_kx_set_priority(session, anon ? kx_anon_priority : kx_priority);
187
188 if (gnutls_dh_params_init(&dh_params) != GNUTLS_E_SUCCESS)
189 throw AuthFailureException("gnutls_dh_params_init failed");
190
191 if (gnutls_dh_params_generate2(dh_params, DH_BITS) != GNUTLS_E_SUCCESS)
192 throw AuthFailureException("gnutls_dh_params_generate2 failed");
193
194 if (anon) {
195 if (gnutls_anon_allocate_server_credentials(&anon_cred) != GNUTLS_E_SUCCESS)
196 throw AuthFailureException("gnutls_anon_allocate_server_credentials failed");
197
198 gnutls_anon_set_server_dh_params(anon_cred, dh_params);
199
200 if (gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred)
201 != GNUTLS_E_SUCCESS)
202 throw AuthFailureException("gnutls_credentials_set failed");
203
204 vlog.debug("Anonymous session has been set");
205
206 } else {
207 if (gnutls_certificate_allocate_credentials(&cert_cred) != GNUTLS_E_SUCCESS)
208 throw AuthFailureException("gnutls_certificate_allocate_credentials failed");
209
210 gnutls_certificate_set_dh_params(cert_cred, dh_params);
211
212 if (gnutls_certificate_set_x509_key_file(cert_cred, certfile, keyfile,
213 GNUTLS_X509_FMT_PEM) != GNUTLS_E_SUCCESS)
214 throw AuthFailureException("load of key failed");
215
216 if (gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred)
217 != GNUTLS_E_SUCCESS)
218 throw AuthFailureException("gnutls_credentials_set failed");
219
220 vlog.debug("X509 session has been set");
221
222 }
223
224}