blob: 12273a6023983bb58ed44cafcbf890043ffd63fa [file] [log] [blame]
Adam Tkacb10489b2010-04-23 14:16:04 +00001/*
2 * Copyright (C) 2004 Red Hat Inc.
3 * Copyright (C) 2005 Martin Koegler
4 * Copyright (C) 2010 TigerVNC Team
Adam Tkac27b2f772010-11-18 13:33:57 +00005 * Copyright (C) 2010 m-privacy GmbH
Adam Tkacb10489b2010-04-23 14:16:04 +00006 *
7 * This is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
11 *
12 * This software is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this software; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
20 * USA.
21 */
22
23#ifdef HAVE_CONFIG_H
24#include <config.h>
25#endif
26
Adam Tkac43958232010-07-21 09:06:59 +000027#ifndef HAVE_GNUTLS
28#error "This header should not be compiled without HAVE_GNUTLS defined"
29#endif
Adam Tkacb10489b2010-04-23 14:16:04 +000030
Adam Tkac27b2f772010-11-18 13:33:57 +000031#include <stdlib.h>
32#include <unistd.h>
33
Adam Tkac3c5be392010-07-21 09:27:34 +000034#include <rfb/CSecurityTLS.h>
Adam Tkac0e61c342010-07-21 09:23:25 +000035#include <rfb/SSecurityVeNCrypt.h>
Adam Tkacb10489b2010-04-23 14:16:04 +000036#include <rfb/CConnection.h>
37#include <rfb/LogWriter.h>
38#include <rfb/Exception.h>
Adam Tkac27b2f772010-11-18 13:33:57 +000039#include <rfb/UserMsgBox.h>
Adam Tkacb10489b2010-04-23 14:16:04 +000040#include <rdr/TLSInStream.h>
41#include <rdr/TLSOutStream.h>
Adam Tkac27b2f772010-11-18 13:33:57 +000042#include <os/os.h>
Adam Tkacb10489b2010-04-23 14:16:04 +000043
Adam Tkac0e61c342010-07-21 09:23:25 +000044#include <gnutls/x509.h>
45
Adam Tkacb10489b2010-04-23 14:16:04 +000046#define TLS_DEBUG
47
48using namespace rfb;
49
Adam Tkac3c5be392010-07-21 09:27:34 +000050StringParameter CSecurityTLS::x509ca("x509ca", "X509 CA certificate", "", ConfViewer);
51StringParameter CSecurityTLS::x509crl("x509crl", "X509 CRL file", "", ConfViewer);
Adam Tkac0e61c342010-07-21 09:23:25 +000052
Adam Tkacb10489b2010-04-23 14:16:04 +000053static LogWriter vlog("TLS");
54
55#ifdef TLS_DEBUG
56static void debug_log(int level, const char* str)
57{
58 vlog.debug(str);
59}
60#endif
61
Adam Tkac3c5be392010-07-21 09:27:34 +000062void CSecurityTLS::initGlobal()
Adam Tkacb10489b2010-04-23 14:16:04 +000063{
64 static bool globalInitDone = false;
65
66 if (!globalInitDone) {
67 gnutls_global_init();
68
69#ifdef TLS_DEBUG
70 gnutls_global_set_log_level(10);
71 gnutls_global_set_log_function(debug_log);
72#endif
73
74 globalInitDone = true;
75 }
76}
77
Adam Tkac3c5be392010-07-21 09:27:34 +000078CSecurityTLS::CSecurityTLS(bool _anon) : session(0), anon_cred(0),
Adam Tkac0e61c342010-07-21 09:23:25 +000079 anon(_anon), fis(0), fos(0)
Adam Tkacb10489b2010-04-23 14:16:04 +000080{
Adam Tkac0e61c342010-07-21 09:23:25 +000081 cafile = x509ca.getData();
82 crlfile = x509crl.getData();
Adam Tkacb10489b2010-04-23 14:16:04 +000083}
84
Adam Tkac27b2f772010-11-18 13:33:57 +000085void CSecurityTLS::setDefaults()
86{
87 char* homeDir = NULL;
88
89 if (gethomedir(&homeDir) == -1) {
90 vlog.error("Could not obtain home directory path");
91 return;
92 }
93
94 CharArray caDefault(strlen(homeDir)+17);
95 sprintf(caDefault.buf, "%s/.vnc/x509_certs", homeDir);
96 delete [] homeDir;
97
98 /* XXX Do we need access() check here? */
99 if (!access(caDefault.buf, R_OK))
100 x509ca.setDefaultStr(strdup(caDefault.buf));
101 else
102 vlog.error("Failed to open ~/.vnc/x509_certs");
103}
104
Adam Tkac3c5be392010-07-21 09:27:34 +0000105void CSecurityTLS::shutdown()
Adam Tkacb10489b2010-04-23 14:16:04 +0000106{
Adam Tkac0e61c342010-07-21 09:23:25 +0000107 if (session)
Adam Tkac6948ead2010-08-11 15:58:59 +0000108 if (gnutls_bye(session, GNUTLS_SHUT_RDWR) != GNUTLS_E_SUCCESS)
109 throw Exception("gnutls_bye failed");
Adam Tkac0e61c342010-07-21 09:23:25 +0000110
111 if (anon_cred) {
112 gnutls_anon_free_client_credentials(anon_cred);
113 anon_cred = 0;
114 }
115
116 if (cert_cred) {
117 gnutls_certificate_free_credentials(cert_cred);
118 cert_cred = 0;
119 }
120
121 if (session) {
122 gnutls_deinit(session);
123 session = 0;
124
125 gnutls_global_deinit();
126 }
Adam Tkacb10489b2010-04-23 14:16:04 +0000127}
128
129
Adam Tkac3c5be392010-07-21 09:27:34 +0000130CSecurityTLS::~CSecurityTLS()
Adam Tkacb10489b2010-04-23 14:16:04 +0000131{
Adam Tkac0e61c342010-07-21 09:23:25 +0000132 shutdown();
133
Adam Tkacb10489b2010-04-23 14:16:04 +0000134 if (fis)
135 delete fis;
136 if (fos)
137 delete fos;
Adam Tkac0e61c342010-07-21 09:23:25 +0000138
139 delete[] cafile;
140 delete[] crlfile;
Adam Tkacb10489b2010-04-23 14:16:04 +0000141}
142
Adam Tkac3c5be392010-07-21 09:27:34 +0000143bool CSecurityTLS::processMsg(CConnection* cc)
Adam Tkacb10489b2010-04-23 14:16:04 +0000144{
145 rdr::InStream* is = cc->getInStream();
146 rdr::OutStream* os = cc->getOutStream();
147 client = cc;
148
149 initGlobal();
150
151 if (!session) {
152 if (!is->checkNoWait(1))
153 return false;
154
155 if (is->readU8() == 0)
156 return true;
157
Adam Tkac6948ead2010-08-11 15:58:59 +0000158 if (gnutls_init(&session, GNUTLS_CLIENT) != GNUTLS_E_SUCCESS)
159 throw AuthFailureException("gnutls_init failed");
160
161 if (gnutls_set_default_priority(session) != GNUTLS_E_SUCCESS)
162 throw AuthFailureException("gnutls_set_default_priority failed");
Adam Tkacb10489b2010-04-23 14:16:04 +0000163
Adam Tkac0e61c342010-07-21 09:23:25 +0000164 setParam();
Adam Tkacb10489b2010-04-23 14:16:04 +0000165
166 gnutls_transport_set_pull_function(session, rdr::gnutls_InStream_pull);
167 gnutls_transport_set_push_function(session, rdr::gnutls_OutStream_push);
168 gnutls_transport_set_ptr2(session,
169 (gnutls_transport_ptr) is,
170 (gnutls_transport_ptr) os);
171 }
172
173 int err;
174 err = gnutls_handshake(session);
175 if (err != GNUTLS_E_SUCCESS && !gnutls_error_is_fatal(err))
176 return false;
177
178 if (err != GNUTLS_E_SUCCESS) {
179 vlog.error("TLS Handshake failed: %s\n", gnutls_strerror (err));
Adam Tkac0e61c342010-07-21 09:23:25 +0000180 shutdown();
Adam Tkacb10489b2010-04-23 14:16:04 +0000181 throw AuthFailureException("TLS Handshake failed");
182 }
Adam Tkac0e61c342010-07-21 09:23:25 +0000183
184 checkSession();
Adam Tkacb10489b2010-04-23 14:16:04 +0000185
186 cc->setStreams(fis = new rdr::TLSInStream(is, session),
187 fos = new rdr::TLSOutStream(os, session));
188
189 return true;
190}
191
Adam Tkac3c5be392010-07-21 09:27:34 +0000192void CSecurityTLS::setParam()
Adam Tkac0e61c342010-07-21 09:23:25 +0000193{
194 static const int kx_anon_priority[] = { GNUTLS_KX_ANON_DH, 0 };
195 static const int kx_priority[] = { GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA,
196 GNUTLS_KX_DHE_RSA, GNUTLS_KX_SRP, 0 };
197
198 if (anon) {
Adam Tkac6948ead2010-08-11 15:58:59 +0000199 if (gnutls_kx_set_priority(session, kx_anon_priority) != GNUTLS_E_SUCCESS)
200 throw AuthFailureException("gnutls_kx_set_priority failed");
201
202 if (gnutls_anon_allocate_client_credentials(&anon_cred) != GNUTLS_E_SUCCESS)
203 throw AuthFailureException("gnutls_anon_allocate_client_credentials failed");
204
205 if (gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred) != GNUTLS_E_SUCCESS)
206 throw AuthFailureException("gnutls_credentials_set failed");
Adam Tkac0e61c342010-07-21 09:23:25 +0000207
208 vlog.debug("Anonymous session has been set");
209 } else {
Adam Tkac6948ead2010-08-11 15:58:59 +0000210 if (gnutls_kx_set_priority(session, kx_priority) != GNUTLS_E_SUCCESS)
211 throw AuthFailureException("gnutls_kx_set_priority failed");
212
213 if (gnutls_certificate_allocate_credentials(&cert_cred) != GNUTLS_E_SUCCESS)
214 throw AuthFailureException("gnutls_certificate_allocate_credentials failed");
Adam Tkac0e61c342010-07-21 09:23:25 +0000215
216 if (*cafile && gnutls_certificate_set_x509_trust_file(cert_cred,cafile,GNUTLS_X509_FMT_PEM) < 0)
217 throw AuthFailureException("load of CA cert failed");
218
219 if (*crlfile && gnutls_certificate_set_x509_crl_file(cert_cred,crlfile,GNUTLS_X509_FMT_PEM) < 0)
220 throw AuthFailureException("load of CRL failed");
221
Adam Tkac6948ead2010-08-11 15:58:59 +0000222 if (gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred) != GNUTLS_E_SUCCESS)
223 throw AuthFailureException("gnutls_credentials_set failed");
Adam Tkac0e61c342010-07-21 09:23:25 +0000224
225 vlog.debug("X509 session has been set");
226 }
227}
228
Adam Tkac3c5be392010-07-21 09:27:34 +0000229void CSecurityTLS::checkSession()
Adam Tkac0e61c342010-07-21 09:23:25 +0000230{
231 int status;
232 const gnutls_datum *cert_list;
233 unsigned int cert_list_size = 0;
234 unsigned int i;
Adam Tkac27b2f772010-11-18 13:33:57 +0000235 gnutls_datum_t info;
Adam Tkac0e61c342010-07-21 09:23:25 +0000236
237 if (anon)
238 return;
239
240 if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509)
241 throw AuthFailureException("unsupported certificate type");
242
243 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
244 if (!cert_list_size)
245 throw AuthFailureException("unsupported certificate type");
246
247 status = gnutls_certificate_verify_peers(session);
248 if (status == GNUTLS_E_NO_CERTIFICATE_FOUND)
249 throw AuthFailureException("no certificate sent");
250
251 if (status < 0) {
252 vlog.error("X509 verify failed: %s\n", gnutls_strerror (status));
253 throw AuthFailureException("certificate verification failed");
254 }
255
Adam Tkac27b2f772010-11-18 13:33:57 +0000256 if (status & GNUTLS_CERT_REVOKED) {
257 throw AuthFailureException("certificate has been revoked");
258 }
Adam Tkac0e61c342010-07-21 09:23:25 +0000259
Adam Tkac27b2f772010-11-18 13:33:57 +0000260 if (status & GNUTLS_CERT_NOT_ACTIVATED) {
261 throw AuthFailureException("certificate has not been activated");
262 }
Adam Tkac0e61c342010-07-21 09:23:25 +0000263
264 for (i = 0; i < cert_list_size; i++) {
265 gnutls_x509_crt crt;
266 gnutls_x509_crt_init(&crt);
267
268 if (gnutls_x509_crt_import(crt, &cert_list[i],GNUTLS_X509_FMT_DER) < 0)
Adam Tkac27b2f772010-11-18 13:33:57 +0000269 throw AuthFailureException("decoding of certificate failed");
270
271 if (gnutls_x509_crt_print(crt, GNUTLS_CRT_PRINT_ONELINE, &info)) {
272 gnutls_free(info.data);
273 throw AuthFailureException("Could not find certificate to display");
274 }
Adam Tkac0e61c342010-07-21 09:23:25 +0000275
276 if (gnutls_x509_crt_check_hostname(crt, client->getServerName()) == 0) {
Adam Tkac27b2f772010-11-18 13:33:57 +0000277 char buf[255];
278 sprintf(buf, "Hostname (%s) does not match any certificate, do you want to continue?", client->getServerName());
279 vlog.debug("hostname mismatch");
280 if(!msg->showMsgBox(UserMsgBox::M_YESNO, "hostname mismatch", buf))
281 throw AuthFailureException("hostname mismatch");
Adam Tkac0e61c342010-07-21 09:23:25 +0000282 }
Adam Tkac27b2f772010-11-18 13:33:57 +0000283
284 if (status & GNUTLS_CERT_EXPIRED) {
285 vlog.debug("certificate has expired");
286 if (!msg->showMsgBox(UserMsgBox::M_YESNO, "certficate has expired", "The certificate of the server has expired, do you want to continue?"))
287 throw AuthFailureException("certificate has expired");
288 }
289
290 if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
291 size_t out_size;
292 char *homeDir = NULL;
293 char *out_buf = NULL;
294 char *certinfo = NULL;
295 int len = 0;
296
297 vlog.debug("certificate issuer unknown");
298
299 len = snprintf(NULL, 0, "This certificate has been signed by an unknown authority:\n\n%s\n\nDo you want to save it and continue?\n ", info.data);
300 if (len < 0)
301 AuthFailureException("certificate decoding error");
302
303 vlog.debug("%s", info.data);
304
305 certinfo = new char[len];
306 if (certinfo == NULL)
307 throw AuthFailureException("Out of memory");
308
309 snprintf(certinfo, len, "This certificate has been signed by an unknown authority:\n\n%s\n\nDo you want to save it and continue? ", info.data);
310
311 for (int i = 0; i < len - 1; i++)
312 if (certinfo[i] == ',' && certinfo[i + 1] == ' ')
313 certinfo[i] = '\n';
314
315 if (!msg->showMsgBox(UserMsgBox::M_YESNO, "certificate issuer unknown",
316 certinfo)) {
317 delete [] certinfo;
318 throw AuthFailureException("certificate issuer unknown");
319 }
320 delete [] certinfo;
321
322 if (gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, NULL, &out_size)
323 == GNUTLS_E_SHORT_MEMORY_BUFFER)
324 AuthFailureException("Out of memory");
325
326 // Save cert
327 out_buf = new char[out_size];
328 if (out_buf == NULL)
329 AuthFailureException("Out of memory");
330
331 if (gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_PEM, out_buf, &out_size)
332 < 0)
333 AuthFailureException("certificate issuer unknown, and certificate "
334 "export failed");
335
336 if (gethomedir(&homeDir) == -1)
337 vlog.error("Could not obtain home directory path");
338 else {
339 FILE *f;
340 CharArray caSave(strlen(homeDir)+17);
341 sprintf(caSave.buf, "%s/.vnc/x509_certs", homeDir);
342 delete [] homeDir;
343 f = fopen(caSave.buf, "a+");
344 if (!f)
345 msg->showMsgBox(UserMsgBox::M_OK, "certificate save failed",
346 "Could not save the certificate");
347 else {
348 fprintf(f, "%s\n", out_buf);
349 fclose(f);
350 }
351 }
352 delete [] out_buf;
353 } else if (status & GNUTLS_CERT_INVALID)
354 throw AuthFailureException("certificate not trusted");
355
Adam Tkac0e61c342010-07-21 09:23:25 +0000356 gnutls_x509_crt_deinit(crt);
Adam Tkac27b2f772010-11-18 13:33:57 +0000357 gnutls_free(info.data);
Adam Tkac0e61c342010-07-21 09:23:25 +0000358 }
359}
360