blob: 6801210aa327ba3da6e2a1ab6f35967764c00591 [file] [log] [blame]
Adam Tkacdfe19cf2010-04-23 14:14:11 +00001/*
2 * Copyright (C) 2004 Red Hat Inc.
3 * Copyright (C) 2005 Martin Koegler
4 * Copyright (C) 2010 TigerVNC Team
5 *
6 * This is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This software is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this software; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
19 * USA.
20 */
21
22#ifdef HAVE_CONFIG_H
23#include <config.h>
24#endif
25
Adam Tkacdf799702010-04-28 15:45:53 +000026#ifndef HAVE_GNUTLS
27#error "This source should not be compiled without HAVE_GNUTLS defined"
28#endif
Adam Tkacdfe19cf2010-04-23 14:14:11 +000029
30#include <rfb/SSecurityTLSBase.h>
31#include <rfb/SConnection.h>
32#include <rfb/LogWriter.h>
33#include <rfb/Exception.h>
34#include <rdr/TLSInStream.h>
35#include <rdr/TLSOutStream.h>
36
37#define TLS_DEBUG
38
39using namespace rfb;
40
41static LogWriter vlog("TLS");
42
43#ifdef TLS_DEBUG
44static void debug_log(int level, const char* str)
45{
46 vlog.debug(str);
47}
48#endif
49
50void SSecurityTLSBase::initGlobal()
51{
52 static bool globalInitDone = false;
53
54 if (!globalInitDone) {
55 if (gnutls_global_init() != GNUTLS_E_SUCCESS)
56 throw AuthFailureException("gnutls_global_init failed");
57
58#ifdef TLS_DEBUG
59 gnutls_global_set_log_level(10);
60 gnutls_global_set_log_function(debug_log);
61#endif
62
63 globalInitDone = true;
64 }
65}
66
67SSecurityTLSBase::SSecurityTLSBase() : session(0)
68{
69 fis=0;
70 fos=0;
71}
72
73void SSecurityTLSBase::shutdown()
74{
75 if(session)
76 ;//gnutls_bye(session, GNUTLS_SHUT_RDWR);
77}
78
79
80SSecurityTLSBase::~SSecurityTLSBase()
81{
82 if (session) {
83 //gnutls_bye(session, GNUTLS_SHUT_RDWR);
84 gnutls_deinit(session);
85 }
86 if(fis)
87 delete fis;
88 if(fos)
89 delete fos;
90 /* FIXME: should be doing gnutls_global_deinit() at some point */
91}
92
93bool SSecurityTLSBase::processMsg(SConnection *sc)
94{
95 rdr::InStream* is = sc->getInStream();
96 rdr::OutStream* os = sc->getOutStream();
97
98 vlog.debug("Process security message (session %p)", session);
99
100 if (!session) {
101 initGlobal();
102
103 if (gnutls_init(&session, GNUTLS_SERVER) != GNUTLS_E_SUCCESS)
104 throw AuthFailureException("gnutls_init failed");
105
106 if (gnutls_set_default_priority(session) != GNUTLS_E_SUCCESS)
107 throw AuthFailureException("gnutls_set_default_priority failed");
108
109 try {
110 setParams(session);
111 }
112 catch(...) {
113 os->writeU8(0);
114 throw;
115 }
116
117 gnutls_transport_set_pull_function(session,rdr::gnutls_InStream_pull);
118 gnutls_transport_set_push_function(session,rdr::gnutls_OutStream_push);
119 gnutls_transport_set_ptr2(session,
120 (gnutls_transport_ptr)is,
121 (gnutls_transport_ptr)os);
122 os->writeU8(1);
123 os->flush();
124 }
125
126 int err;
127 if ((err = gnutls_handshake(session)) != GNUTLS_E_SUCCESS) {
128 if (!gnutls_error_is_fatal(err)) {
129 vlog.debug("Deferring completion of TLS handshake: %s", gnutls_strerror(err));
130 return false;
131 }
132 vlog.error("TLS Handshake failed: %s", gnutls_strerror (err));
133 gnutls_bye(session, GNUTLS_SHUT_RDWR);
134 freeResources();
135 gnutls_deinit(session);
136 session = 0;
137 throw AuthFailureException("TLS Handshake failed");
138 }
139
140 vlog.debug("Handshake completed");
141
142 sc->setStreams(fis=new rdr::TLSInStream(is,session),
143 fos=new rdr::TLSOutStream(os,session));
144
145 return true;
146}
147