Changeset 104537 in vbox for trunk/src/VBox/Main

Timestamp:

May 8, 2024 7:00:22 AM (7 months ago)

Author:

vboxsync

Message:

Made TLS default with auto-generation of self-signed certificate - #10310

Location:

trunk/src/VBox/Main

Files:

• include/VRDEServerImpl.h (modified) (1 diff)
• src-server/VRDEServerImpl.cpp (modified) (3 diffs)

trunk/src/VBox/Main/include/VRDEServerImpl.h

@@ -60 +60 @@
     HRESULT i_loadSettings(const settings::VRDESettings &data);
     HRESULT i_saveSettings(settings::VRDESettings &data);
+    HRESULT i_generateServerCertificate();
     void i_rollback();
     void i_commit();

trunk/src/VBox/Main/src-server/VRDEServerImpl.cpp

@@ -38 +38 @@
 #include <iprt/ldr.h>
 #include <iprt/path.h>
+#include <iprt/crypto/x509.h>
 
 #include <VBox/err.h>
@@ -233 +234 @@
 }
 
+/**
+ * Auto-generates a self-signed certificate for the VM.
+ *
+ * @note Locks this object for writing.
+*/
+HRESULT VRDEServer::i_generateServerCertificate()
+{
+    Utf8Str strServerCertificate = "server_cert.pem";
+    Utf8Str strServerPrivateKey = "server_key_private.pem";
+    mParent->i_calculateFullPath(strServerCertificate, strServerCertificate);
+    mParent->i_calculateFullPath(strServerPrivateKey, strServerPrivateKey);
+    const char *pszServerCertificate = strServerCertificate.c_str();
+    const char *pszServerPrivateKey = strServerPrivateKey.c_str();
+
+    HRESULT hrc = RTCrX509Certificate_Generate(pszServerCertificate, pszServerPrivateKey);
+
+    if (SUCCEEDED(hrc))
+    {
+        AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
+        mData.backup();
+
+        mData->mapProperties["Security/Method"] = Utf8Str("TLS");
+        mData->mapProperties["Security/ServerCertificate"] = strServerCertificate;
+        mData->mapProperties["Security/ServerPrivateKey"] = strServerPrivateKey;
+
+        /* Done with the properties access. */
+        alock.release();
+    }
+    return hrc;
+}
+
 // IVRDEServer properties
 /////////////////////////////////////////////////////////////////////////////
@@ -262 +294 @@
         /* leave the lock before informing callbacks */
         alock.release();
+
+        /*
+        * If TLS is not explicitely disabled then auto-generate
+        * a self-signed certificate for this VM.
+        */
+        if (mData->mapProperties["Security/Method"] != "RDP")
+        {
+            hrc = i_generateServerCertificate();
+            if (FAILED(hrc))
+            {
+                LogRel(("Failed to auto generate server key and certificate: (%Rrc)\n", hrc));
+            }
+        }
 
         AutoWriteLock mlock(mParent COMMA_LOCKVAL_SRC_POS);       // mParent is const, needs no locking