Does xrdp support ECC? #1776
Comments
|
Hi @dannytech I'm not familiar with this area of code at all I'm afraid. I've had a quick look however, and I don't think it's good news:-
You should be able to get the full output from the xrdp process with the command Are you in a position where you can build xrdp from scratch? If so, we might be able to get a patch together for you. |
|
Thanks for getting back to me, @matt335672. Here are the complete logs via For comparison, I'm also including the logs from a successful connection with an RSA keypair: It appears that the server sees (or at least logs) no issue with what's going on, the only issue is that the client closes the connection early with ECC. I would be happy to set up a build environment for xrdp, would you rather I use a packaged version or the latest version from git? |
|
That's interesting - from what I read yesterday I'd have expected you to see this:- the reason for this is that the keyfile you're trying to use isn't an RSA key, It's possible something is going wrong before this point I suppose. If you're happy to build the Also, could you generate a gash EC private key and cert and post them here? I'll see if I can reproduce what you're seeing with them. It'll be easier if we're working with the same pairing. |
|
Yeah I do find it interesting that there aren't any relevant logs. I've set up a build environment and successfully built from the latest I don't think I mentioned it previously but MSTSC sometimes just fails to connect silently, but other times fails with an error. Not sure why. Here's a quick self-signed certificate I came up with. Note that it's pretty barebones (i.e. doesn't include a SAN or anything), I can make it a little more complex if you need but my actual production certificates with SANs and everything don't work anyway so I'm not exactly sure if there are specific requirements. Private Key: Certificate (including metadata section): |
|
I don't think there are any specific requirements - the Windows client just moans if the name doesn't match for RSA, so I'm assuming that this is also the case for other certs. I'll pop those two on a test VM and step through the code and let you know how I get on. I see from your profile on github you've got some programming experience. Have you got any experience with |
|
Just run through - here's a patch for you to try:- diff --git a/common/ssl_calls.c b/common/ssl_calls.c
index aee18c28..6b5a2cf4 100644
--- a/common/ssl_calls.c
+++ b/common/ssl_calls.c
@@ -740,7 +740,7 @@ ssl_tls_accept(struct ssl_tls *self, long ssl_protocols,
SSL_CTX_set_read_ahead(self->ctx, 0);
- if (SSL_CTX_use_RSAPrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM)
+ if (SSL_CTX_use_PrivateKey_file(self->ctx, self->key, SSL_FILETYPE_PEM)
<= 0)
{
g_writeln("ssl_tls_accept: SSL_CTX_use_RSAPrivateKey_file failed");It's about as simple as it gets. I'm also getting:- Gotta dash - family duties. Let me know how you get on. |
|
Fixed! I see the same log, everything seems to be working correctly. Confirmed with both the cert I shared and with my CA-signed certificate, seems that it works just fine. You'll probably catch it, but Good catch on the expired cert... it was DNS + broken automatic certificate renewal. Thanks for that, and for the help figuring this issue out. |
|
I've taken the liberty of re-opening this so I've got something to pin a PR on. It'll get closed automatically when the PR gets pulled. Following needs to be done for a production fix:-
|
Fix missing SSL logging and reformat with astyle
I use an ECC-based PKI for whatever I can, and so I attempted to use it for
xrdp's TLS encryption. I have a certificate and corresponding EC key (using thesecp384r1curve, generated by OpenSSL). The key is in/etc/ssl/with the correct permissions (644 for the cert and 640 for the key, withssl-certas the group for the latter andxrdpadded to thessl-certgroup). This is then symlinked to/etc/xrdp/in the same way that the default snakeoil certificate is (I've also tried directly pointing to the cert and key). The below configuration is used to enable TLS:However, attempting to connect with both FreeRDP and MSTSC fails, and the latter produces the error
Because of a protocol error detected at the client (code 0x2104), this session will be disconnected. Capturing via Wireshark, the server behaves seemingly normally (a couple TLS data continuations) and sometimes sends a FIN, but then the client sends a RST. There are also no errors on thexrdpside:Changing to either the snakeoil keys or a self-signed RSA key solves this issue, it's only EC keys that won't work. I've tried both self-signed and CA-signed EC certificates, with a couple different curves. I wasn't able to find anything about whether ECC is supported by
xrdpso I assumed by the lack of server errors that it has some level of support, but it apparently has issues with that. ECC works just fine with Windows machines so clearly the protocol supports it correctly (of course TLS would support it though), so I'm not sure where the break is.Running Linux Mint 20 and
xrdp0.9.12.The text was updated successfully, but these errors were encountered: