Changeset 104570 in vbox for trunk/src/VBox/Main/src-server

Timestamp:

May 10, 2024 4:58:46 AM (8 months ago)

Author:

vboxsync

Message:

Make TLS default and auto-generate a certificate - bugref:10310

File:

• trunk/src/VBox/Main/src-server/VRDEServerImpl.cpp (modified) (3 diffs)

trunk/src/VBox/Main/src-server/VRDEServerImpl.cpp

@@ -38 +38 @@
 #include <iprt/ldr.h>
 #include <iprt/path.h>
+#include <iprt/crypto/x509.h>
 
 #include <VBox/err.h>
@@ -233 +234 @@
 }
 
+/**
+ * Auto-generates a self-signed certificate for the VM.
+ *
+ * @note Locks this object for writing.
+*/
+int VRDEServer::i_generateServerCertificate()
+{
+    Utf8Str strServerCertificate = "server_cert.pem";
+    Utf8Str strServerPrivateKey = "server_key_private.pem";
+    mParent->i_calculateFullPath(strServerCertificate, strServerCertificate);
+    mParent->i_calculateFullPath(strServerPrivateKey, strServerPrivateKey);
+    const char *pszServerCertificate = strServerCertificate.c_str();
+    const char *pszServerPrivateKey = strServerPrivateKey.c_str();
+
+    int vrc = RTCrX509Certificate_Generate(pszServerCertificate, pszServerPrivateKey);
+
+    if (RT_SUCCESS(vrc))
+    {
+        AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
+        mData.backup();
+
+        mData->mapProperties["Security/Method"] = Utf8Str("TLS");
+        mData->mapProperties["Security/ServerCertificate"] = strServerCertificate;
+        mData->mapProperties["Security/ServerPrivateKey"] = strServerPrivateKey;
+
+        /* Done with the properties access. */
+        alock.release();
+    }
+    return vrc;
+}
+
 // IVRDEServer properties
 /////////////////////////////////////////////////////////////////////////////
@@ -262 +294 @@
         /* leave the lock before informing callbacks */
         alock.release();
+
+        /*
+        * If TLS is not explicitely disabled then auto-generate
+        * a self-signed certificate for this VM.
+        */
+        if (mData->mapProperties["Security/Method"] != "RDP")
+        {
+            int vrc = i_generateServerCertificate();
+            if (RT_FAILURE(vrc))
+            {
+                LogRel(("Failed to auto generate server key and certificate: (%Rrc)\n", vrc));
+            }
+        }
 
         AutoWriteLock mlock(mParent COMMA_LOCKVAL_SRC_POS);       // mParent is const, needs no locking