SSL Java viewer work thru proxy. -sslGenCA, etc key/cert management utils for x11vnc. FBPM "support".
runge
17 years ago
parent
1602b345f3
commit
d14cf0a84c
@ -1,2 +1,2 @@
|
||||
EXTRA_DIST=VncViewer.jar index.vnc
|
||||
EXTRA_DIST=VncViewer.jar index.vnc SignedVncViewer.jar proxy.vnc README ssl_vncviewer
|
||||
|
||||
|
||||
@ -0,0 +1,72 @@
|
||||
This directory contains a patched Java applet VNC viewer that is SSL
|
||||
enabled.
|
||||
|
||||
The patches in the *.patch files are relative to the source tarball:
|
||||
|
||||
tightvnc-1.3dev7_javasrc.tar.gz
|
||||
|
||||
currently (4/06) available here:
|
||||
|
||||
http://prdownloads.sourceforge.net/vnc-tight/tightvnc-1.3dev7_javasrc.tar.gz?download
|
||||
|
||||
It also includes some simple patches to:
|
||||
|
||||
- fix richcursor colors
|
||||
|
||||
- make the Java Applet cursor (not the cursor drawn to the canvas
|
||||
framebuffer) invisible when it is inside the canvas.
|
||||
|
||||
- allow Tab (and some other) keystrokes to be sent to the vnc
|
||||
server instead of doing widget traversal.
|
||||
|
||||
|
||||
This SSL applet should work with any VNC viewer that has an SSL tunnel in
|
||||
front of it. It has been tested on x11vnc and using the stunnel tunnel
|
||||
to other VNC servers.
|
||||
|
||||
By default this Vnc Viewer will only do SSL. To do unencrypted traffic
|
||||
see the "DisableSSL" applet parameter (e.g. set it to Yes in index.vnc).
|
||||
|
||||
Proxies: they are a general problem with java socket applets (a socket
|
||||
connection does not go through the proxy). See the info in the proxy.vnc
|
||||
file for a workaround. It uses SignedVncViewer.jar which is simply
|
||||
a signed version of VncViewer.jar. The basic idea is the user clicks
|
||||
"Yes" to trust the applet and then it can connect directly to the proxy
|
||||
and issue a CONNECT request.
|
||||
|
||||
This applet has been tested on versions 1.4.2 and 1.5.0 of the Sun
|
||||
Java plugin. It may not work on older releases or different vendor VM's.
|
||||
Send full Java Console output for failures.
|
||||
|
||||
---------------------------------------------------------------
|
||||
Tips:
|
||||
|
||||
When doing single-port proxy connections (e.g. both VNC and HTTPS
|
||||
thru port 5900) it helps to move through the 'do you trust this site'
|
||||
dialogs quickly. x11vnc has to wait to see if the traffic is VNC or
|
||||
HTTP and this can cause timeouts if you don't move thru them quickly.
|
||||
|
||||
You may have to restart your browser completely if it gets into a
|
||||
weird state. For one case we saw the JVM requesting VncViewer.class
|
||||
even when no such file exists.
|
||||
|
||||
|
||||
---------------------------------------------------------------
|
||||
Extras:
|
||||
|
||||
ssl_vncviewer (not Java):
|
||||
|
||||
Wrapper script for native VNC viewer to connect to x11vnc in
|
||||
SSL mode. Script launches stunnel(8) and then connects to it
|
||||
via localhost which in turn is then redirected to x11vnc via an
|
||||
SSL tunnel. stunnel(8) must be installed and available in PATH.
|
||||
|
||||
|
||||
Running Java SSL VncViewer from the command line:
|
||||
|
||||
From this directory:
|
||||
|
||||
java -cp ./VncViewer.jar VncViewer HOST <thehost> PORT <theport>
|
||||
|
||||
substitute <thehost> and <theport> with the actual values.
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@ -0,0 +1,70 @@
|
||||
<!--
|
||||
index.vnc - default HTML page for TightVNC Java viewer applet, to be
|
||||
used with Xvnc. On any file ending in .vnc, the HTTP server embedded in
|
||||
Xvnc will substitute the following variables when preceded by a dollar:
|
||||
USER, DESKTOP, DISPLAY, APPLETWIDTH, APPLETHEIGHT, WIDTH, HEIGHT, PORT,
|
||||
PARAMS. Use two dollar signs ($$) to get a dollar sign in the generated
|
||||
HTML page.
|
||||
|
||||
NOTE: the $PARAMS variable is not supported by the standard VNC, so
|
||||
make sure you have TightVNC on the server side, if you're using this
|
||||
variable.
|
||||
-->
|
||||
|
||||
<!--
|
||||
The idea behind using the signed applet in SignedVncViewer.jar for
|
||||
firewall proxies:
|
||||
|
||||
Java socket applets and http proxies do not get along well.
|
||||
|
||||
Java security allows the applet to connect back via a socket to the
|
||||
originating host, but the browser/plugin Proxy settings are not used for
|
||||
socket connections (only http and the like). So the socket connection
|
||||
fails in the proxy environment.
|
||||
|
||||
The applet is not allowed to open a socket connection to the proxy (since
|
||||
that would let it connect to just about any host, e.g. CONNECT method).
|
||||
|
||||
This is indpendent of SSL but of course fails for that socket connection
|
||||
as well. I.e. this is a problem for non-SSL VNC Viewers as well.
|
||||
|
||||
Solution? Sign the applet and have the user click on "Yes" that they
|
||||
fully trust the applet. Then the applet can connect to any host via
|
||||
sockets, in particular the proxy. It next issues the request
|
||||
|
||||
CONNECT host:port HTTP/1.1
|
||||
Host: host:port
|
||||
|
||||
and if the proxy supports the CONNECT method we are finally connected to
|
||||
the VNC server.
|
||||
|
||||
For SSL connections, SSL is layered on top of this socket. However note
|
||||
this scheme will work for non-SSL applet proxy tunnelling as well.
|
||||
|
||||
It should be able to get non-SSL VNC connections to work via GET
|
||||
command but that has not been done yet.
|
||||
|
||||
Note that some proxies only allow CONNECT to only these the ports 443
|
||||
(HTTPS) and 563 (SNEWS). So you would have to run the VNC server on
|
||||
those ports.
|
||||
|
||||
SignedVncViewer.jar is just a signed version of VncViewer.jar
|
||||
|
||||
The URL to use for this file: https://host:port/proxy.vnc
|
||||
|
||||
-->
|
||||
|
||||
|
||||
<HTML>
|
||||
<TITLE>
|
||||
$USER's $DESKTOP desktop ($DISPLAY)
|
||||
</TITLE>
|
||||
<APPLET CODE=VncViewer.class ARCHIVE=SignedVncViewer.jar
|
||||
WIDTH=$APPLETWIDTH HEIGHT=$APPLETHEIGHT>
|
||||
<param name=PORT value=$PORT>
|
||||
<param name="Open New Window" value=yes>
|
||||
$PARAMS
|
||||
</APPLET>
|
||||
<BR>
|
||||
<A href="http://www.tightvnc.com/">TightVNC site</A>
|
||||
</HTML>
|
||||
@ -0,0 +1,142 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# ssl_vncviewer: wrapper for vncviewer to use stunnel SSL tunnel.
|
||||
#
|
||||
# You must have stunnel(8) installed on the system and in your
|
||||
# PATH (n.b. stunnel is usually in an sbin subdir).
|
||||
#
|
||||
# You should have "x11vnc -ssl ..." or "x11vnc -stunnel ..."
|
||||
# running as the VNC server.
|
||||
#
|
||||
# usage: ssl_vncviewer [cert-args] host:display <vncviewer-args>
|
||||
#
|
||||
# e.g.: ssl_vncviewer snoopy:0
|
||||
# ssl_vncviewer snoopy:0 -encodings "copyrect tight zrle hextile"
|
||||
#
|
||||
# [cert-args] can be:
|
||||
# -verify /path/to/cacert.pem
|
||||
# -mycert /path/to/mycert.pem
|
||||
#
|
||||
# -verify specifies a CA cert PEM file (or a self-signed one) for
|
||||
# authenticating the VNC server.
|
||||
#
|
||||
# -mycert specifies this client's cert+key PEM file for the VNC server to
|
||||
# authenticate this client.
|
||||
#
|
||||
|
||||
VNCVIEWERCMD="vncviewer"
|
||||
PATH=$PATH:/usr/sbin:/usr/local/sbin:/dist/sbin; export PATH
|
||||
|
||||
help() {
|
||||
head -26 $0 | tail +2
|
||||
}
|
||||
|
||||
# grab our cmdline options:
|
||||
while [ "X$1" != "X" ]
|
||||
do
|
||||
case $1 in
|
||||
"-verify") shift; verify="$1"
|
||||
;;
|
||||
"-mycert") shift; mycert="$1"
|
||||
;;
|
||||
"-h"*) help; exit 0
|
||||
;;
|
||||
*) break
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
orig="$1"
|
||||
shift
|
||||
|
||||
# play around with host:display port:
|
||||
if ! echo "$orig" | grep ':' > /dev/null; then
|
||||
orig="$orig:0"
|
||||
fi
|
||||
|
||||
host=`echo "$orig" | awk -F: '{print $1}'`
|
||||
disp=`echo "$orig" | awk -F: '{print $2}'`
|
||||
if [ $disp -lt 200 ]; then
|
||||
port=`expr $disp + 5900`
|
||||
fi
|
||||
|
||||
# try to find an open listening port via netstat(1):
|
||||
use=""
|
||||
if uname | grep Linux > /dev/null; then
|
||||
inuse=`netstat -ant | grep LISTEN | awk '{print $4}' | sed 's/^.*://'`
|
||||
try=5920
|
||||
while [ $try -lt 6000 ]
|
||||
do
|
||||
if ! echo "$inuse" | grep -w $try > /dev/null; then
|
||||
use=$try
|
||||
break
|
||||
fi
|
||||
try=`expr $try + 1`
|
||||
done
|
||||
fi
|
||||
if [ "X$use" = "X" ]; then
|
||||
# otherwise choose a "random" one:
|
||||
use=`date +%S`
|
||||
use=`expr $use + 5920`
|
||||
fi
|
||||
|
||||
# create the stunnel config file:
|
||||
if [ "X$verify" != "X" ]; then
|
||||
if [ -d $verify ]; then
|
||||
verify="CApath = $verify"
|
||||
else
|
||||
verify="CAfile = $verify"
|
||||
fi
|
||||
verify="$verify
|
||||
verify = 2"
|
||||
fi
|
||||
if [ "X$mycert" != "X" ]; then
|
||||
cert="cert = $mycert"
|
||||
fi
|
||||
|
||||
##debug = 7
|
||||
tmp=/tmp/ssl_vncviewer.$$
|
||||
cat > $tmp <<END
|
||||
foreground = yes
|
||||
pid =
|
||||
client = yes
|
||||
$verify
|
||||
$cert
|
||||
|
||||
[vnc_stunnel]
|
||||
accept = $use
|
||||
connect= $host:$port
|
||||
END
|
||||
|
||||
echo ""
|
||||
echo "Using this stunnel configuration:"
|
||||
cat $tmp
|
||||
echo ""
|
||||
sleep 1
|
||||
|
||||
echo "running: stunnel $tmp"
|
||||
stunnel $tmp < /dev/tty > /dev/tty &
|
||||
pid=$!
|
||||
echo ""
|
||||
|
||||
# pause here to let the user supply a possible passphrase for the
|
||||
# mycert key:
|
||||
if [ "X$mycert" != "X" ]; then
|
||||
sleep 4
|
||||
fi
|
||||
sleep 2
|
||||
rm -f $tmp
|
||||
|
||||
if [ $use -ge 5900 ]; then
|
||||
n=`expr $use - 5900`
|
||||
fi
|
||||
|
||||
if echo "$0" | grep vncip > /dev/null; then
|
||||
# hack for runge's special wrapper script vncip.
|
||||
vncip "$@" localhost:$n
|
||||
else
|
||||
$VNCVIEWERCMD "$@" localhost:$n
|
||||
fi
|
||||
|
||||
kill $pid
|
||||
File diff suppressed because it is too large
Load Diff