Vncpassfile #497

jsorg71 · 2016-11-19T05:35:14Z

This fixes an old VNC security issue were the VNC password file is based on the user password.
Now it is derived from a random GUID that is generated for each session.
This GUID can be used in the future for session reconnect and other things.

jsorg71 · 2016-11-19T05:40:50Z

Let me manually merge this if it all looks good.

proski · 2016-11-19T08:07:58Z

sesman/libscp/libscp_session.c

@@ -416,6 +416,21 @@ scp_session_set_addr(struct SCP_SESSION *s, int type, const void *addr)
 }

 /*******************************************************************/
+int
+scp_session_set_guid(struct SCP_SESSION *s, const tui8 *guid)


If tui8 a useful type? uint8_t is a standard type that is also unsigned 8-bit integer.

Currently we are not using the _t types, only the t types in arch.h

OK, we can change it after the release.

proski · 2016-11-19T08:08:45Z

sesman/libscp/libscp_session.c

+int
+scp_session_set_guid(struct SCP_SESSION *s, const tui8 *guid)
+{
+    if (0 == guid)


Let's use NULL for pointers, it's more readable.

I know what you mean here, the NULL means it's a pointer. Currently, zeros are used all over the project. I've never liked that NULL is defined differently sometimes.

NULL is a special value for every variable that can be compared to it (i.e. every pointer). But 0 is not always a special value for a variable that can be compared to it. A variable can be 0 and be used, say, as an index. When I see comparison to 0, I need to examine it more closely. It can be a pointer check, or it can be something completely different.

proski · 2016-11-19T08:10:29Z

sesman/libscp/libscp_v0.h

@@ -61,7 +61,7 @@ scp_v0s_accept(struct SCP_CONNECTION* c, struct SCP_SESSION** s, int skipVchk);
 *
 */
 enum SCP_SERVER_STATES_E
-scp_v0s_allow_connection(struct SCP_CONNECTION* c, SCP_DISPLAY d);
+scp_v0s_allow_connection(struct SCP_CONNECTION* c, SCP_DISPLAY d, tui8 *guid);


I believe it should be a constant pointer.

proski · 2016-11-19T08:11:14Z

sesman/scp_v0.c

@@ -99,6 +99,11 @@ scp_v0_process(struct SCP_CONNECTION *c, struct SCP_SESSION *s)

            if (1 == access_login_allowed(s->username))
            {
+                tui8 guid[16];
+
+                g_random((char*)guid, 16);


Please use correct spacing.

proski · 2016-11-19T08:12:27Z

sesman/session.c

@@ -410,7 +410,8 @@ wait_for_xserver(int display)
 static int APP_CC
 session_start_fork(int width, int height, int bpp, char *username,
                   char *password, tbus data, tui8 type, char *domain,
-                   char *program, char *directory, char *client_ip)
+                   char *program, char *directory, char *client_ip,
+                   const tui8 *guid)


Would not it be easier to send the session pointer instead of so many fields?

I was thinking that too, I'll take a look at it.

proski · 2016-11-19T08:14:46Z

vnc/vnc.c

+}
+
+/******************************************************************************/
+/* taken from vncauth.c */


Function comments should primarily describe what the function does, not where the code came from.

proski · 2016-11-19T08:16:31Z

vnc/vnc.c

+/******************************************************************************/
+/* taken from vncauth.c */
+void DEFAULT_CC
+rfbHashEncryptBytes(char *bytes, char *passwd)


Do both arguments need to be non-constant?

Ouch! This function needs a real comment.

proski · 2016-11-19T08:20:09Z

xrdp/xrdp_mm.c

@@ -1195,11 +1199,18 @@ xrdp_mm_process_login_response(struct xrdp_mm *self, struct stream *s)
    int rv;
    char ip[256];
    char port[256];
+    tui8 guid[16];
+    tui8* pguid;


Formatting - * sticks to the variable, not to the type.

proski · 2016-11-19T08:24:50Z

vnc/vnc.c

@@ -1422,6 +1447,11 @@ lib_mod_set_param(struct vnc *v, const char *name, char *value)
    {
        v->delay_ms = g_atoi(value);
    }
+    else if (g_strcasecmp(name, "guid") == 0)


Why is a user configuration needed? Should it be documented?

This is the only API to give the modules general data. We don't give the modules access to the entire xrdp internals.
It was not meant to be only user data.

I don't understand. Should users configure it? If not, who should configure it? If nobody should configure it, why is it read from the config file?

lib_mod_set_param is not only for passing params from config file,
please look @ https://github.com/jsorg71/xrdp/blob/ed862ea361e1a364f153da2bd22c402f529b547e/xrdp/xrdp_mm.c#L568

This is the api for passing params to modules also for internal usages.

Oh, I see it now.

proski · 2016-11-20T17:41:54Z

vnc/vnc.c

@@ -1422,6 +1447,11 @@ lib_mod_set_param(struct vnc *v, const char *name, char *value)
    {
        v->delay_ms = g_atoi(value);
    }
+    else if (g_strcasecmp(name, "guid") == 0)


Oh, I see it now.

proski · 2016-12-09T02:58:00Z

#523 has been merged. I assume this PR can be closed.

carnil · 2016-12-11T16:22:08Z

Additional note for this pull request.

Originally reported to by Dag-Erling Smørgrav and Petter Reinholdtsen:

When successfully logging in using RDP into a xrdp session, the file
~/.vnc/sesman_${username}_passwd is created. Its content is the
equivalent of the users clear text password, DES encrypted with a known
key.

This issue got assigned back then CVE-2013-1430

jsorg71 added 5 commits November 13, 2016 23:37

sesman: change vnc password file to guid

e507086

sesman: work on guid / vnc password file

6d29add

xrdp,vnc: work on guid / vnc password file

2e19d20

xrdp,vnc: password fixes

34e9bfa

Merge branch 'devel' into vncpassfile

ed862ea

proski reviewed Nov 19, 2016

View reviewed changes

jsorg71 added 2 commits November 20, 2016 06:25

vnc: add const and comments to rfbEncryptBytes

42083d5

sesman, xrdp: const, spacing changes

28709d0

proski approved these changes Nov 20, 2016

View reviewed changes

metalefty added this to the v0.9.1 milestone Nov 21, 2016

metalefty closed this Dec 9, 2016

jsorg71 deleted the vncpassfile branch July 29, 2017 04:18

matt335672 mentioned this pull request Jan 13, 2020

VNC Password failed when picking existing session #1011

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vncpassfile #497

Vncpassfile #497

jsorg71 commented Nov 19, 2016

jsorg71 commented Nov 19, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 19, 2016 •

edited

jsorg71 Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 19, 2016

jsorg71 Nov 20, 2016

proski Nov 20, 2016

speidy Nov 20, 2016 •

edited

proski Nov 20, 2016

proski Nov 20, 2016

proski commented Dec 9, 2016

carnil commented Dec 11, 2016

Vncpassfile #497

Vncpassfile #497

Conversation

jsorg71 commented Nov 19, 2016

jsorg71 commented Nov 19, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

proski Nov 19, 2016 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

speidy Nov 20, 2016 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

proski commented Dec 9, 2016

carnil commented Dec 11, 2016

proski Nov 19, 2016 •

edited

speidy Nov 20, 2016 •

edited