VirtualBox

儲存庫 vbox 的更動 105136


忽略:
時間撮記:
2024-7-4 上午09:02:33 (5 月 以前)
作者:
vboxsync
訊息:

Main/VRDEServerImpl.cpp: Consider the autogenerated certificate 'invalid' if it expires within the next year. LogRel the auto certificate repair actions. Use RTPathFilename+RTStrICmp to match filenames, rather than strstr or RTCString::contains. Use #defines for the filenames to avoid accidental typos. bugref:10310

檔案:
修改 1 筆資料

圖例:

未更動
新增
刪除

  • trunk/src/VBox/Main/src-server/VRDEServerImpl.cpp

    r105130 r105136  
    5555#define VRDP_DEFAULT_PORT_STR "3389"
    5656
     57#define VRDE_AUTO_GENENERATED_CERT_FILENAME "VRDEAutoGeneratedCert.pem"
     58#define VRDE_AUTO_GENENERATED_PKEY_FILENAME "VRDEAutoGeneratedPrivateKey.pem"
     59
     60
    5761// constructor / destructor
    5862/////////////////////////////////////////////////////////////////////////////
    … …  
    238242 *
    239243 * @note Locks this object for writing.
    240 */
     244 */
    241245int VRDEServer::i_generateServerCertificate()
    242246{
    243     Utf8Str strServerCertificate("VRDEAutoGeneratedCert.pem");
     247    Utf8Str strServerCertificate(VRDE_AUTO_GENENERATED_CERT_FILENAME);
    244248    int vrc = mParent->i_calculateFullPath(strServerCertificate, strServerCertificate);
    245249    AssertRCReturn(vrc, vrc);
    246250
    247     Utf8Str strServerPrivateKey("VRDEAutoGeneratedPrivateKey.pem");
     251    Utf8Str strServerPrivateKey(VRDE_AUTO_GENENERATED_PKEY_FILENAME);
    248252    vrc = mParent->i_calculateFullPath(strServerPrivateKey, strServerPrivateKey);
    249253    AssertRCReturn(vrc, vrc);
    250254
    251255    AutoReadLock mlock(mParent COMMA_LOCKVAL_SRC_POS);
    252     Utf8Str strVMName = mParent->i_getName();
     256    Utf8Str const strVMName = mParent->i_getName();
    253257    mlock.release();
    254258
    … …  
    286290
    287291/**
    288  * Checks validity of auto-generated certificates, sets VRDE properties, and deletes files if necessary.
     292 * Checks validity of auto-generated certificates, sets VRDE properties, and
     293 * regenerates obsolete or missing files as necessary.
    289294 *
    290295 * @note Locks this object for writing.
    … …  
    292297HRESULT VRDEServer::i_certificateRepair(BOOL &certificateGenerated)
    293298{
    294     if ( (mData->mapProperties["Security/Method"] != "RDP" || mData->mapProperties["Security/Method"] != "None"))
    295     {
    296         Utf8Str strServerCertificate("VRDEAutoGeneratedCert.pem");
     299    if (mData->mapProperties["Security/Method"] != "RDP" || mData->mapProperties["Security/Method"] != "None")
     300    {
     301        Utf8Str strServerCertificate(VRDE_AUTO_GENENERATED_CERT_FILENAME);
    297302        int vrc = mParent->i_calculateFullPath(strServerCertificate, strServerCertificate);
    298303        AssertRCReturn(vrc, VBOX_E_IPRT_ERROR);
    299304
    300         Utf8Str strServerPrivateKey("VRDEAutoGeneratedPrivateKey.pem");
     305        Utf8Str strServerPrivateKey(VRDE_AUTO_GENENERATED_PKEY_FILENAME);
    301306        vrc = mParent->i_calculateFullPath(strServerPrivateKey, strServerPrivateKey);
    302307        AssertRCReturn(vrc, VBOX_E_IPRT_ERROR);
    303308
    304         if ( RTFileExists(strServerPrivateKey.c_str()) && RTFileExists(strServerCertificate.c_str()) )
    305         {
    306             /* Check validity of certificate */
     309        bool const fServerPrivateKeyExists = RTFileExists(strServerPrivateKey.c_str());
     310        bool const fServerCertificate      = RTFileExists(strServerCertificate.c_str());
     311        if (fServerPrivateKeyExists && fServerCertificate)
     312        {
     313            /*
     314             * Check that the certificate is valid right now and for the next 365 days.
     315             *
     316             * The ASSUMPTIONS here are that the automatically generated certificates
     317             * are valid for at least two years (currently ~10 years) and that VMs
     318             * doesn't typically stay up more than a year before being completely
     319             * restarted.  The latter assumption is of course a big one, as we've no
     320             * control what users do here, but a year seems reasonable while not being
     321             * too aggressive.
     322             */
     323            RTERRINFOSTATIC ErrInfo;
    307324            RTCRX509CERTIFICATE certificate;
    308325            vrc = RTCrX509Certificate_ReadFromFile(&certificate, strServerCertificate.c_str(), RTCRX509CERT_READ_F_PEM_ONLY,
    309                                                    &g_RTAsn1DefaultAllocator, NULL);
    310             if(RT_FAILURE(vrc))
     326                                                   &g_RTAsn1DefaultAllocator, RTErrInfoInitStatic(&ErrInfo));
     327            if (RT_FAILURE(vrc))
    311328            {
    312329                RTCrX509Certificate_Delete(&certificate);
    313                 return setError(VBOX_E_IPRT_ERROR, tr("Failed to read server certificate: (%Rrc)\n"), vrc);
     330                return setError(VBOX_E_IPRT_ERROR, tr("Failed to read server certificate '%s': %Rrc%#RTeim\n"),
     331                                strServerCertificate.c_str(), vrc, &ErrInfo.Core);
    314332            }
    315333
    316334            RTTIMESPEC Now;
    317             bool const validCert = RTCrX509Validity_IsValidAtTimeSpec(&certificate.TbsCertificate.Validity, RTTimeNow(&Now));
     335            bool const validCert = RTCrX509Validity_IsValidAtTimeSpec(&certificate.TbsCertificate.Validity, RTTimeNow(&Now))
     336                                && RTCrX509Validity_IsValidAtTimeSpec(&certificate.TbsCertificate.Validity,
     337                                                                      RTTimeSpecAddSeconds(&Now, 365 * RT_SEC_1DAY_64));
    318338
    319339            RTCrX509Certificate_Delete(&certificate);
    320340
    321             Utf8Str strPath = mData->mapProperties["Security/ServerCertificate"];
    322             if ( strPath.isEmpty() && validCert )
     341            Utf8Str const strPath = mData->mapProperties["Security/ServerCertificate"];
     342            if (validCert && strPath.isEmpty())
    323343            {
    324344                /*
    … …  
    333353                alock.release();
    334354                certificateGenerated = true;
     355                LogRel(("VRDE: Reconfigured using existing '%s' and '%s' files.\n",
     356                        strServerCertificate.c_str(), strServerPrivateKey.c_str()));
    335357            }
    336             else if ( (strPath.isEmpty() || strstr(strPath.c_str(),"VRDEAutoGeneratedCert.pem")) && !validCert)
     358            else if (   !validCert
     359                     && (strPath.isEmpty() || RTStrICmp(RTPathFilename(strPath.c_str()), VRDE_AUTO_GENENERATED_CERT_FILENAME)))
    337360            {
    338                 /* Certificate is not valid so delete the files and create new ones */
     361                /*
     362                 * Certificate is not valid so delete the files and create new ones
     363                 */
     364                LogRel(("VRDE: Regenerating expired or expiring certificate files '%s' and '%s'...\n",
     365                        strServerCertificate.c_str(), strServerPrivateKey.c_str()));
    339366                RTFileDelete(strServerPrivateKey.c_str());
    340367                RTFileDelete(strServerCertificate.c_str());
    … …  
    348375            }
    349376        }
    350         else if (RTFileExists(strServerPrivateKey.c_str())) /* If only one of cert/key pair exists */
    351         {
     377        /*
     378         * If only one of cert/key pair exists, delete the file and generate a new matching.
     379         */
     380        else if (fServerPrivateKeyExists)
     381        {
     382            LogRel(("VRDE: Orphaned private key file found. Regenerating certificate files '%s' and '%s'...\n",
     383                    strServerCertificate.c_str(), strServerPrivateKey.c_str()));
    352384            RTFileDelete(strServerPrivateKey.c_str());
    353385            vrc = i_generateServerCertificate();
    … …  
    359391            certificateGenerated = true;
    360392        }
    361         else if (RTFileExists(strServerCertificate.c_str()))
    362         {
     393        else if (fServerCertificate)
     394        {
     395            LogRel(("VRDE: Orphaned certificate file found. Regenerating certificate files '%s' and '%s'...\n",
     396                    strServerCertificate.c_str(), strServerPrivateKey.c_str()));
    363397            RTFileDelete(strServerCertificate.c_str());
    364398            vrc = i_generateServerCertificate();
    … …  
    370404            certificateGenerated = true;
    371405        }
     406        /*
     407         * Auto-generated certificate and key files do not exist
     408         * If the server certificate property is not set
     409         * or indicates an auto-generated certificate should exist, create one
     410         */
    372411        else
    373412        {
    374             /*
    375              * Auto-generated certificate and key files do not exist
    376              * If the server certificate property is not set
    377              * or indicates an auto-generated certificate should exist, create one
    378              */
    379             Utf8Str strPath = mData->mapProperties["Security/ServerCertificate"];
    380             if (strPath.isEmpty() || strstr(strPath.c_str(),"VRDEAutoGeneratedCert.pem"))
     413            Utf8Str const strPath = mData->mapProperties["Security/ServerCertificate"];
     414            if (strPath.isEmpty() || RTStrICmp(RTPathFilename(strPath.c_str()), VRDE_AUTO_GENENERATED_CERT_FILENAME) == 0)
    381415            {
     416                LogRel(("VRDE: Generating certificate files '%s' and '%s'...\n",
     417                        strServerCertificate.c_str(), strServerPrivateKey.c_str()));
    382418                vrc = i_generateServerCertificate();
    383419                if (RT_FAILURE(vrc))
注意: 瀏覽 TracChangeset 來幫助您使用更動檢視器

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette