← Back to branch summary

~ubuntu-branches/debian/jessie/italc/jessie

« back to all changes in this revision

Viewing changes to ica/x11/x11vnc/sslcmds.c

  • Committer: Bazaar Package Importer
  • Author(s): Patrick Winnertz
  • Date: 2011-02-11 14:50:22 UTC
  • mto: This revision was merged to the branch mainline in revision 8.
  • Revision ID: james.westby@ubuntu.com-20110211145022-sn173siax6lywjus
Tags: upstream-1.0.13
Import upstream version 1.0.13

Show diffs side-by-side

added added

removed removed

Lines of Context:
ica/x11/x11vnc/sslcmds.c
 
1
/*
 
2
   Copyright (C) 2002-2010 Karl J. Runge <runge@karlrunge.com> 
 
3
   All rights reserved.
 
4
 
 
5
This file is part of x11vnc.
 
6
 
 
7
x11vnc is free software; you can redistribute it and/or modify
 
8
it under the terms of the GNU General Public License as published by
 
9
the Free Software Foundation; either version 2 of the License, or (at
 
10
your option) any later version.
 
11
 
 
12
x11vnc is distributed in the hope that it will be useful,
 
13
but WITHOUT ANY WARRANTY; without even the implied warranty of
 
14
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
15
GNU General Public License for more details.
 
16
 
 
17
You should have received a copy of the GNU General Public License
 
18
along with x11vnc; if not, write to the Free Software
 
19
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
 
20
or see <http://www.gnu.org/licenses/>.
 
21
 
 
22
In addition, as a special exception, Karl J. Runge
 
23
gives permission to link the code of its release of x11vnc with the
 
24
OpenSSL project's "OpenSSL" library (or with modified versions of it
 
25
that use the same license as the "OpenSSL" library), and distribute
 
26
the linked executables.  You must obey the GNU General Public License
 
27
in all respects for all of the code used other than "OpenSSL".  If you
 
28
modify this file, you may extend this exception to your version of the
 
29
file, but you are not obligated to do so.  If you do not wish to do
 
30
so, delete this exception statement from your version.
 
31
*/
 
32
 
1
33
/* -- sslcmds.c -- */
2
34
 
3
35
#include "x11vnc.h"
15
47
#endif
16
48
#endif
17
49
 
18
 
#ifdef NO_SSL_OR_UNIXPW
19
 
#undef SSLCMDS
20
 
#endif
21
 
 
22
50
 
23
51
void check_stunnel(void);
24
 
int start_stunnel(int stunnel_port, int x11vnc_port);
 
52
int start_stunnel(int stunnel_port, int x11vnc_port, int hport, int x11vnc_hport);
25
53
void stop_stunnel(void);
26
54
void setup_stunnel(int rport, int *argc, char **argv);
27
55
char *get_Cert_dir(char *cdir_in, char **tmp_in);
 
56
void sslScripts(void);
28
57
void sslGenCA(char *cdir);
29
58
void sslGenCert(char *ty, char *nm);
30
59
void sslEncKey(char *path, int info_only);
58
87
        }
59
88
}
60
89
 
61
 
int start_stunnel(int stunnel_port, int x11vnc_port) {
 
90
int start_stunnel(int stunnel_port, int x11vnc_port, int hport, int x11vnc_hport) {
62
91
#ifdef SSLCMDS
63
92
        char extra[] = ":/usr/sbin:/usr/local/sbin:/dist/sbin";
64
93
        char *path, *p, *exe;
65
94
        char *stunnel_path = NULL;
66
95
        struct stat verify_buf;
67
 
        int status;
 
96
        struct stat crl_buf;
 
97
        int status, tmp_pem = 0;
68
98
 
69
99
        if (stunnel_pid) {
70
100
                stop_stunnel();
84
114
                strcat(path, extra);
85
115
        }
86
116
 
87
 
        exe = (char *) malloc(strlen(path) + 1 + strlen("stunnel") + 1);
 
117
        exe = (char *) malloc(strlen(path) + 1 + strlen("stunnel4") + 1);
88
118
 
89
119
        p = strtok(path, ":");
90
120
 
93
123
        while (p) {
94
124
                struct stat sbuf;
95
125
 
 
126
                sprintf(exe, "%s/%s", p, "stunnel4");
 
127
                if (! stunnel_path && stat(exe, &sbuf) == 0) {
 
128
                        if (! S_ISDIR(sbuf.st_mode)) {
 
129
                                stunnel_path = exe;
 
130
                                break;
 
131
                        }
 
132
                }
 
133
 
96
134
                sprintf(exe, "%s/%s", p, "stunnel");
97
135
                if (! stunnel_path && stat(exe, &sbuf) == 0) {
98
136
                        if (! S_ISDIR(sbuf.st_mode)) {
107
145
                free(path);
108
146
        }
109
147
 
 
148
        if (getenv("STUNNEL_PROG")) {
 
149
                free(exe);
 
150
                exe = strdup(getenv("STUNNEL_PROG"));
 
151
                stunnel_path = exe;
 
152
        }
 
153
 
110
154
        if (! stunnel_path) {
111
155
                free(exe);
112
156
                return 0;
138
182
                            " saved PEM.\n");   
139
183
                        clean_up_exit(1);
140
184
                }
 
185
        } else if (!stunnel_pem) {
 
186
                stunnel_pem = create_tmp_pem(NULL, 0);
 
187
                if (! stunnel_pem) {
 
188
                        rfbLog("start_stunnel: could not create temporary,"
 
189
                            " self-signed PEM.\n");     
 
190
                        clean_up_exit(1);
 
191
                }
 
192
                tmp_pem = 1;
 
193
                if (getenv("X11VNC_SHOW_TMP_PEM")) {
 
194
                        FILE *in = fopen(stunnel_pem, "r");
 
195
                        if (in != NULL) {
 
196
                                char line[128];
 
197
                                fprintf(stderr, "\n");
 
198
                                while (fgets(line, 128, in) != NULL) {
 
199
                                        fprintf(stderr, "%s", line);
 
200
                                }
 
201
                                fprintf(stderr, "\n");
 
202
                                fclose(in);
 
203
                        }
 
204
                }
141
205
        }
142
206
 
143
207
        if (ssl_verify) {
 
208
                char *file = get_ssl_verify_file(ssl_verify);
 
209
                if (file) {
 
210
                        ssl_verify = file;
 
211
                }
144
212
                if (stat(ssl_verify, &verify_buf) != 0) {
145
213
                        rfbLog("stunnel: %s does not exist.\n", ssl_verify);
146
214
                        clean_up_exit(1);
147
215
                }
148
216
        }
 
217
        if (ssl_crl) {
 
218
                if (stat(ssl_crl, &crl_buf) != 0) {
 
219
                        rfbLog("stunnel: %s does not exist.\n", ssl_crl);
 
220
                        clean_up_exit(1);
 
221
                }
 
222
        }
149
223
 
150
224
        stunnel_pid = fork();
151
225
 
159
233
                FILE *in;
160
234
                char fd[20];
161
235
                int i;
 
236
                char *st_if = getenv("STUNNEL_LISTEN");
 
237
 
 
238
                if (st_if == NULL) {
 
239
                        st_if = "";
 
240
                } else {
 
241
                        st_if = (char *) malloc(strlen(st_if) + 2);
 
242
                        sprintf(st_if, "%s:", getenv("STUNNEL_LISTEN"));
 
243
                }
 
244
 
162
245
 
163
246
                for (i=3; i<256; i++) {
164
247
                        close(i);
180
263
                                        a = "-A";
181
264
                                }
182
265
                        }
 
266
 
 
267
                        if (ssl_crl) {
 
268
                                rfbLog("stunnel: stunnel3 does not support CRL. %s\n", ssl_crl);
 
269
                                clean_up_exit(1);
 
270
                        }
183
271
                        
184
272
                        if (stunnel_pem && ssl_verify) {
185
273
                                /* XXX double check -v 2 */
205
293
                if (! in) {
206
294
                        exit(1);
207
295
                }
 
296
 
208
297
                fprintf(in, "foreground = yes\n");
209
298
                fprintf(in, "pid =\n");
210
299
                if (stunnel_pem) {
211
300
                        fprintf(in, "cert = %s\n", stunnel_pem);
212
301
                }
 
302
                if (ssl_crl) {
 
303
                        if(S_ISDIR(crl_buf.st_mode)) {
 
304
                                fprintf(in, "CRLpath = %s\n", ssl_crl);
 
305
                        } else {
 
306
                                fprintf(in, "CRLfile = %s\n", ssl_crl);
 
307
                        }
 
308
                }
213
309
                if (ssl_verify) {
214
310
                        if(S_ISDIR(verify_buf.st_mode)) {
215
311
                                fprintf(in, "CApath = %s\n", ssl_verify);
216
312
                        } else {
217
313
                                fprintf(in, "CAfile = %s\n", ssl_verify);
218
314
                        }
219
 
                        /* XXX double check -v 2 */
220
315
                        fprintf(in, "verify = 2\n");
221
316
                }
222
317
                fprintf(in, ";debug = 7\n\n");
223
318
                fprintf(in, "[x11vnc_stunnel]\n");
224
 
                fprintf(in, "accept = %d\n", stunnel_port);
 
319
                fprintf(in, "accept = %s%d\n", st_if, stunnel_port);
225
320
                fprintf(in, "connect = %d\n", x11vnc_port);
226
321
 
 
322
                if (hport > 0 && x11vnc_hport > 0) {
 
323
                        fprintf(in, "\n[x11vnc_http]\n");
 
324
                        fprintf(in, "accept = %s%d\n", st_if, hport);
 
325
                        fprintf(in, "connect = %d\n", x11vnc_hport);
 
326
                }
 
327
 
227
328
                fflush(in);
228
329
                rewind(in);
 
330
 
 
331
                if (getenv("STUNNEL_DEBUG")) {
 
332
                        char line[1000];
 
333
                        fprintf(stderr, "\nstunnel config contents:\n\n");
 
334
                        while (fgets(line, sizeof(line), in) != NULL) {
 
335
                                fprintf(stderr, "%s", line);
 
336
                        }
 
337
                        fprintf(stderr, "\n");
 
338
                        rewind(in);
 
339
                }
229
340
                
230
341
                sprintf(fd, "%d", fileno(in));
231
342
                execlp(stunnel_path, stunnel_path, "-fd", fd, (char *) NULL);
233
344
        }
234
345
 
235
346
        free(exe);
236
 
        usleep(500 * 1000);
 
347
        usleep(750 * 1000);
237
348
 
238
349
        waitpid(stunnel_pid, &status, WNOHANG); 
 
350
 
 
351
        if (ssl_verify && strstr(ssl_verify, "/sslverify-tmp-load-")) {
 
352
                /* temporary file */
 
353
                usleep(1000 * 1000);
 
354
                unlink(ssl_verify);
 
355
        }
 
356
        if (tmp_pem) {
 
357
                /* temporary cert */
 
358
                usleep(1500 * 1000);
 
359
                unlink(stunnel_pem);
 
360
        }
 
361
 
239
362
        if (kill(stunnel_pid, 0) != 0) {
240
363
                waitpid(stunnel_pid, &status, WNOHANG); 
241
364
                stunnel_pid = 0;
268
391
}
269
392
 
270
393
void setup_stunnel(int rport, int *argc, char **argv) {
271
 
        int i, xport = 0;
 
394
        int i, xport = 0, hport = 0, xhport = 0;
 
395
 
272
396
        if (! rport && argc && argv) {
273
397
                for (i=0; i< *argc; i++) {
274
398
                        if (argv[i] && !strcmp(argv[i], "-rfbport")) {
275
399
                                if (i < *argc - 1) {
276
400
                                        rport = atoi(argv[i+1]);
277
 
                                        break;
278
401
                                }
279
402
                        }
280
403
                }
293
416
                goto stunnel_fail; 
294
417
        }
295
418
 
296
 
        if (start_stunnel(rport, xport)) {
 
419
        if (https_port_num > 0) {
 
420
                hport = https_port_num;
 
421
        }
 
422
 
 
423
        if (! hport && argc && argv) {
 
424
                for (i=0; i< *argc; i++) {
 
425
                        if (argv[i] && !strcmp(argv[i], "-httpport")) {
 
426
                                if (i < *argc - 1) {
 
427
                                        hport = atoi(argv[i+1]);
 
428
                                }
 
429
                        }
 
430
                }
 
431
        }
 
432
 
 
433
        if (! hport && http_try_it) {
 
434
                hport = find_free_port(rport-100, rport-1);
 
435
                if (! hport) {
 
436
                        goto stunnel_fail;
 
437
                }
 
438
        }
 
439
        if (hport) {
 
440
                xhport = find_free_port(5850, 5899);
 
441
                if (! xhport) {
 
442
                        goto stunnel_fail; 
 
443
                }
 
444
                stunnel_http_port = hport;
 
445
        }
 
446
        
 
447
 
 
448
        if (start_stunnel(rport, xport, hport, xhport)) {
297
449
                int tweaked = 0;
298
450
                char tmp[30];
299
451
                sprintf(tmp, "%d", xport);
430
582
        return scr;
431
583
}
432
584
 
 
585
void sslScripts(void) {
 
586
        fprintf(stdout, "======================================================\n");
 
587
        fprintf(stdout, "genCA script for '-sslGenCA':\n\n");
 
588
        fprintf(stdout, "%s\n", genCA);
 
589
        fprintf(stdout, "======================================================\n");
 
590
        fprintf(stdout, "genCert script for '-sslGenCert', etc.:\n\n");
 
591
        fprintf(stdout, "%s\n", genCert);
 
592
}
 
593
 
433
594
void sslGenCA(char *cdir) {
434
595
        char *cmd, *scr = getsslscript(cdir, "genca", genCA);
435
596