blob: 600df14db67617752ed7dcfd3bf2b4ebaad1ef0b [file] [log] [blame]
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +00001/* Copyright (C) 2002-2005 RealVNC Ltd. All Rights Reserved.
Adam Tkacdf799702010-04-28 15:45:53 +00002 * Copyright (C) 2010 TigerVNC Team
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +00003 *
4 * This is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This software is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this software; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
17 * USA.
18 */
Adam Tkacdf799702010-04-28 15:45:53 +000019
20#ifdef HAVE_CONFIG_H
21#include <config.h>
22#endif
23
Adam Tkac1d15e2d2010-04-23 14:06:38 +000024#include <assert.h>
25#include <stdlib.h>
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +000026#include <string.h>
27#ifdef _WIN32
28#define strcasecmp _stricmp
29#endif
Adam Tkacc210e8a2010-04-23 14:09:16 +000030#include <rfb/CSecurityNone.h>
Adam Tkac707d3612010-07-20 15:16:10 +000031#include <rfb/CSecurityStack.h>
Adam Tkacb10489b2010-04-23 14:16:04 +000032#include <rfb/CSecurityVeNCrypt.h>
Adam Tkacc210e8a2010-04-23 14:09:16 +000033#include <rfb/CSecurityVncAuth.h>
Adam Tkac1d15e2d2010-04-23 14:06:38 +000034#include <rdr/Exception.h>
35#include <rfb/LogWriter.h>
Adam Tkacb6eb3992010-04-23 14:05:00 +000036#include <rfb/Security.h>
Adam Tkac1d15e2d2010-04-23 14:06:38 +000037#include <rfb/SSecurityNone.h>
Adam Tkac707d3612010-07-20 15:16:10 +000038#include <rfb/SSecurityStack.h>
Adam Tkac1d15e2d2010-04-23 14:06:38 +000039#include <rfb/SSecurityVncAuth.h>
Adam Tkacdfe19cf2010-04-23 14:14:11 +000040#include <rfb/SSecurityVeNCrypt.h>
Adam Tkac707d3612010-07-20 15:16:10 +000041#ifdef HAVE_GNUTLS
Adam Tkac3c5be392010-07-21 09:27:34 +000042#include <rfb/CSecurityTLS.h>
Adam Tkac21b61a52010-07-21 09:19:00 +000043#include <rfb/SSecurityTLS.h>
Adam Tkacdf799702010-04-28 15:45:53 +000044#endif
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +000045#include <rfb/util.h>
46
Adam Tkac1d15e2d2010-04-23 14:06:38 +000047using namespace rdr;
48using namespace rfb;
49using namespace std;
50
51static LogWriter vlog("Security");
52
Adam Tkacb10489b2010-04-23 14:16:04 +000053UserPasswdGetter *CSecurity::upg = NULL;
54
Adam Tkacfb993152010-08-12 14:17:28 +000055StringParameter Security::secTypesViewer
Adam Tkaca6578bf2010-04-23 14:07:41 +000056("SecurityTypes",
57 "Specify which security scheme to use (None, VncAuth)",
Adam Tkacfb993152010-08-12 14:17:28 +000058 "VncAuth", ConfViewer);
Adam Tkaca6578bf2010-04-23 14:07:41 +000059
Adam Tkacfb993152010-08-12 14:17:28 +000060StringParameter Security::secTypesServer
61("SecurityTypes",
62 "Specify which security scheme to use (None, VncAuth)",
63 "VncAuth", ConfServer);
64
65Security::Security(SecurityClassType secClassType)
Adam Tkac1d15e2d2010-04-23 14:06:38 +000066{
Adam Tkacfb993152010-08-12 14:17:28 +000067 char *secTypesStr;
68
69 switch (secClassType) {
70 case SecurityViewer:
71 secTypesStr = secTypesViewer.getData();
72 break;
73 case SecurityServer:
74 secTypesStr = secTypesServer.getData();
75 break;
76 };
Adam Tkac1d15e2d2010-04-23 14:06:38 +000077
78 enabledSecTypes = parseSecTypes(secTypesStr);
79
80 delete secTypesStr;
81}
82
Adam Tkac0c77e512010-07-20 15:10:16 +000083const std::list<rdr::U8> Security::GetEnabledSecTypes(void)
Adam Tkac1d15e2d2010-04-23 14:06:38 +000084{
Adam Tkac0c77e512010-07-20 15:10:16 +000085 list<rdr::U8> result;
86 list<U32>::iterator i;
87
88 for (i = enabledSecTypes.begin(); i != enabledSecTypes.end(); i++)
89 if (*i < 0x100)
90 result.push_back(*i);
91
92 return result;
93}
94
95const std::list<rdr::U32> Security::GetEnabledExtSecTypes(void)
96{
97 list<rdr::U32> result;
98 list<U32>::iterator i;
99
100 for (i = enabledSecTypes.begin(); i != enabledSecTypes.end(); i++)
Adam Tkac95e2fe82010-08-12 13:54:59 +0000101 if (*i != secTypeVeNCrypt) /* Do not include VeNCrypt type to avoid loops */
Adam Tkac0c77e512010-07-20 15:10:16 +0000102 result.push_back(*i);
103
104 return result;
105}
106
107void Security::EnableSecType(U32 secType)
108{
109 list<U32>::iterator i;
Adam Tkac1d15e2d2010-04-23 14:06:38 +0000110
111 for (i = enabledSecTypes.begin(); i != enabledSecTypes.end(); i++)
112 if (*i == secType)
113 return;
114
115 enabledSecTypes.push_back(secType);
116}
117
Adam Tkac0c77e512010-07-20 15:10:16 +0000118bool Security::IsSupported(U32 secType)
Adam Tkac1d15e2d2010-04-23 14:06:38 +0000119{
Adam Tkac0c77e512010-07-20 15:10:16 +0000120 list<U32>::iterator i;
Adam Tkac1d15e2d2010-04-23 14:06:38 +0000121
122 for (i = enabledSecTypes.begin(); i != enabledSecTypes.end(); i++)
123 if (*i == secType)
124 return true;
125
126 return false;
127}
128
Adam Tkac0c77e512010-07-20 15:10:16 +0000129SSecurity* Security::GetSSecurity(U32 secType)
Adam Tkac1d15e2d2010-04-23 14:06:38 +0000130{
131 if (!IsSupported(secType))
132 goto bail;
133
134 switch (secType) {
135 case secTypeNone: return new SSecurityNone();
136 case secTypeVncAuth: return new SSecurityVncAuth();
Adam Tkaca0325932010-07-20 15:14:08 +0000137 case secTypeVeNCrypt: return new SSecurityVeNCrypt(this);
Adam Tkac707d3612010-07-20 15:16:10 +0000138#ifdef HAVE_GNUTLS
139 case secTypeTLSNone:
Adam Tkac21b61a52010-07-21 09:19:00 +0000140 return new SSecurityStack(secTypeTLSNone, new SSecurityTLS(true));
Adam Tkac707d3612010-07-20 15:16:10 +0000141 case secTypeTLSVnc:
Adam Tkac21b61a52010-07-21 09:19:00 +0000142 return new SSecurityStack(secTypeTLSVnc, new SSecurityTLS(true), new SSecurityVncAuth());
Adam Tkac5bf73fb2010-07-21 09:08:24 +0000143 case secTypeX509None:
Adam Tkac21b61a52010-07-21 09:19:00 +0000144 return new SSecurityStack(secTypeX509None, new SSecurityTLS(false));
Adam Tkac5bf73fb2010-07-21 09:08:24 +0000145 case secTypeX509Vnc:
Adam Tkac21b61a52010-07-21 09:19:00 +0000146 return new SSecurityStack(secTypeX509None, new SSecurityTLS(false), new SSecurityVncAuth());
Adam Tkacdf799702010-04-28 15:45:53 +0000147#endif
Adam Tkacc210e8a2010-04-23 14:09:16 +0000148 }
149
150bail:
151 throw Exception("Security type not supported");
152}
153
Adam Tkac0c77e512010-07-20 15:10:16 +0000154CSecurity* Security::GetCSecurity(U32 secType)
Adam Tkacc210e8a2010-04-23 14:09:16 +0000155{
Adam Tkacb10489b2010-04-23 14:16:04 +0000156 assert (CSecurity::upg != NULL); /* (upg == NULL) means bug in the viewer */
Adam Tkacc210e8a2010-04-23 14:09:16 +0000157
158 if (!IsSupported(secType))
159 goto bail;
160
161 switch (secType) {
162 case secTypeNone: return new CSecurityNone();
Adam Tkacb10489b2010-04-23 14:16:04 +0000163 case secTypeVncAuth: return new CSecurityVncAuth();
Adam Tkaca0325932010-07-20 15:14:08 +0000164 case secTypeVeNCrypt: return new CSecurityVeNCrypt(this);
Adam Tkac707d3612010-07-20 15:16:10 +0000165#ifdef HAVE_GNUTLS
166 case secTypeTLSNone:
167 return new CSecurityStack(secTypeTLSNone, "TLS with no password",
Adam Tkac3c5be392010-07-21 09:27:34 +0000168 new CSecurityTLS(true));
Adam Tkac707d3612010-07-20 15:16:10 +0000169 case secTypeTLSVnc:
170 return new CSecurityStack(secTypeTLSVnc, "TLS with VNCAuth",
Adam Tkac3c5be392010-07-21 09:27:34 +0000171 new CSecurityTLS(true), new CSecurityVncAuth());
Adam Tkacf5f6a002010-07-21 09:09:19 +0000172 case secTypeX509None:
173 return new CSecurityStack(secTypeX509None, "X509 with no password",
Adam Tkac3c5be392010-07-21 09:27:34 +0000174 new CSecurityTLS(false));
Adam Tkacf5f6a002010-07-21 09:09:19 +0000175 case secTypeX509Vnc:
176 return new CSecurityStack(secTypeX509None, "X509 with VNCAuth",
Adam Tkac3c5be392010-07-21 09:27:34 +0000177 new CSecurityTLS(false), new CSecurityVncAuth());
Adam Tkacdf799702010-04-28 15:45:53 +0000178#endif
Adam Tkac1d15e2d2010-04-23 14:06:38 +0000179 }
180
181bail:
182 throw Exception("Security type not supported");
183}
184
Adam Tkac0c77e512010-07-20 15:10:16 +0000185rdr::U32 rfb::secTypeNum(const char* name)
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000186{
187 if (strcasecmp(name, "None") == 0) return secTypeNone;
188 if (strcasecmp(name, "VncAuth") == 0) return secTypeVncAuth;
189 if (strcasecmp(name, "Tight") == 0) return secTypeTight;
190 if (strcasecmp(name, "RA2") == 0) return secTypeRA2;
191 if (strcasecmp(name, "RA2ne") == 0) return secTypeRA2ne;
192 if (strcasecmp(name, "SSPI") == 0) return secTypeSSPI;
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000193 if (strcasecmp(name, "SSPIne") == 0) return secTypeSSPIne;
194 if (strcasecmp(name, "VeNCrypt") == 0) return secTypeVeNCrypt;
Adam Tkacb3e60c62010-07-20 15:10:59 +0000195
196 /* VeNCrypt subtypes */
Adam Tkac957a5ae2010-07-20 15:12:41 +0000197 if (strcasecmp(name, "Plain") == 0) return secTypePlain;
Adam Tkacb3e60c62010-07-20 15:10:59 +0000198 if (strcasecmp(name, "TLSNone") == 0) return secTypeTLSNone;
199 if (strcasecmp(name, "TLSVnc") == 0) return secTypeTLSVnc;
Adam Tkac957a5ae2010-07-20 15:12:41 +0000200 if (strcasecmp(name, "TLSPlain") == 0) return secTypeTLSPlain;
Adam Tkacb3e60c62010-07-20 15:10:59 +0000201 if (strcasecmp(name, "X509None") == 0) return secTypeX509None;
202 if (strcasecmp(name, "X509Vnc") == 0) return secTypeX509Vnc;
Adam Tkacb3e60c62010-07-20 15:10:59 +0000203 if (strcasecmp(name, "X509Plain") == 0) return secTypeX509Plain;
Adam Tkacb3e60c62010-07-20 15:10:59 +0000204
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000205 return secTypeInvalid;
206}
207
Adam Tkac0c77e512010-07-20 15:10:16 +0000208const char* rfb::secTypeName(rdr::U32 num)
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000209{
210 switch (num) {
211 case secTypeNone: return "None";
212 case secTypeVncAuth: return "VncAuth";
213 case secTypeTight: return "Tight";
214 case secTypeRA2: return "RA2";
215 case secTypeRA2ne: return "RA2ne";
216 case secTypeSSPI: return "SSPI";
217 case secTypeSSPIne: return "SSPIne";
Adam Tkacdfe19cf2010-04-23 14:14:11 +0000218 case secTypeVeNCrypt: return "VeNCrypt";
Adam Tkacb3e60c62010-07-20 15:10:59 +0000219
220 /* VeNCrypt subtypes */
Adam Tkac957a5ae2010-07-20 15:12:41 +0000221 case secTypePlain: return "Plain";
Adam Tkacb3e60c62010-07-20 15:10:59 +0000222 case secTypeTLSNone: return "TLSNone";
223 case secTypeTLSVnc: return "TLSVnc";
Adam Tkacb3e60c62010-07-20 15:10:59 +0000224 case secTypeTLSPlain: return "TLSPlain";
225 case secTypeX509None: return "X509None";
226 case secTypeX509Vnc: return "X509Vnc";
227 case secTypeX509Plain: return "X509Plain";
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000228 default: return "[unknown secType]";
229 }
230}
231
Adam Tkac0c77e512010-07-20 15:10:16 +0000232std::list<rdr::U32> rfb::parseSecTypes(const char* types_)
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000233{
Adam Tkac0c77e512010-07-20 15:10:16 +0000234 std::list<rdr::U32> result;
Adam Tkacd36b6262009-09-04 10:57:20 +0000235 CharArray types(strDup(types_)), type;
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000236 while (types.buf) {
237 strSplit(types.buf, ',', &type.buf, &types.buf);
Adam Tkac0c77e512010-07-20 15:10:16 +0000238 rdr::U32 typeNum = secTypeNum(type.buf);
Constantin Kaplinskya2adc8d2006-05-25 05:01:55 +0000239 if (typeNum != secTypeInvalid)
240 result.push_back(typeNum);
241 }
242 return result;
243}