FreeRDS and its X friends. David Hardening FORT XDC 2014

Transcription

1 FreeRDS and its X friends David Hardening FORT contact@hardening-consulting.com XDC 2014

2 About the author A linux and OSS addict since Doing security software most of my career. Now independent consultant - Active FreeRDP and FreeRDS developer. The author of the «famous» wayland RDP compositor. XDC David FORT contact@hardening-consulting.com 2

3 Sponsors Technologies GmbH XDC David FORT contact@hardening-consulting.com 3

4 Agenda FreeRDS architecture overview Xrds Wayland FreeRDS compositor XDC David FORT contact@hardening-consulting.com 4

5 FreeRDS XDC David FORT contact@hardening-consulting.com 5

6 FreeRDS > RDP protocol (1/2) Quite old and 90s tainted protocol slow/fast path weird ROP funny bits saving Almost all specs are «public» XDC David FORT contact@hardening-consulting.com 6

7 FreeRDS > RDP protocol (2/2) Security used to be an option Vector operations in the past, codecs now Channels : printing, bi-directionnal sound, serial port redirection, drive sharing, remote coffee? XDC David FORT contact@hardening-consulting.com 7

8 FreeRDS > the project An OSS RDP server (Apache2 licence) To be (fully) published soon Inspired by Xrdp but based on FreeRDP Young (2013) XDC David FORT contact@hardening-consulting.com 8

9 FreeRDS > features Security : RDP4, TLS, NLA Encoding : raw bitmap, planar codec, remotefx External channel handling Session reconnection Session shadowing XDC David FORT contact@hardening-consulting.com 9

10 FreeRDS > entities XDC David FORT contact@hardening-consulting.com 10

11 FreeRDS > in pratice Written in C (FreeRDS) and C++ (sessionmanager), CMake Based on FreeRDP Linux for now but targets multi-platform Protobuf, thrift and D-Bus A library to help building content providers XDC David FORT contact@hardening-consulting.com 11

12 FreeRDS > under the hood (1/3) Unix socket as a control channel Signaling messages Mouse moves Key presses Shared memory Framebuffer Damaged regions XDC David FORT contact@hardening-consulting.com 12

13 FreeRDS > under the hood (2/3) At connection, FreeRDS sends Version Screen depth / size Keyboard layout Content provider answers Byte / bits per pixel Scanline Size XDC David FORT contact@hardening-consulting.com 13

14 FreeRDS > under the hood (3/3) XDC David FORT contact@hardening-consulting.com 14

15 FreeRDS > key points FreeRDS does RDP Content provider creates the visible content XDC David FORT contact@hardening-consulting.com 15

16 Xrds XDC David FORT contact@hardening-consulting.com 16

17 Xrds > about X11 content provider A headless X server like x11vnc FreeRDS DDX, (currently) based on Xorg 1.15 Links against the content provider helper library XDC David FORT contact@hardening-consulting.com 17

18 Xrds > features One mouse (client side pointer) One keyboard : a xkb layout for the remote RDP keyboard layout Functional xrandr External program (channel) for clipboard Supports reconnection XDC David FORT contact@hardening-consulting.com 18

19 So... XDC David FORT contact@hardening-consulting.com 19

20 I love it when a plan comes together XDC David FORT contact@hardening-consulting.com 20

21 Xrds > xrandr m'a tuer... Fake modelines, timing, EDID block Use the right unit Race conditions Shut up the Desktop Environment XDC David FORT contact@hardening-consulting.com 21

22 Xrds > crazy pointer update Problem : application updating pointers at a mad rate Solution : check pointer changed (pointer cache) XDC David FORT contact@hardening-consulting.com 22

23 Xrds > damage is not damaged Problem : old flash player constantly updates the whole screen when the video is paused Solution : frame comparison Split damage in 32x32 tiles Compute the real damage Nice gains even with a fullscreen video XDC David FORT contact@hardening-consulting.com 23

24 Xrds > key points Full X11 environment under FreeRDS Gains for other content providers XDC David FORT contact@hardening-consulting.com 24

25 FreeRDS compositor XDC David FORT contact@hardening-consulting.com 25

26 FreeRDS compositor > about A FreeRDS backend for weston An advanced prototype Your remote desktop running weston XDC David FORT contact@hardening-consulting.com 26

27 FreeRDS compositor > features Uses the pixman renderer 1 seat (except with shadowing) Maps the RDP layout to a XKB layout XDC David FORT contact@hardening-consulting.com 27

28 FreeRDS compositor > key points Works Give it a try! XDC David FORT contact@hardening-consulting.com 28

29 Next... XDC David FORT contact@hardening-consulting.com 29

30 Future work Add support for extended RDP input to weston / Xrds (multitouch) RDP clipboard in weston Graphics with the egfx channel XDC David FORT contact@hardening-consulting.com 30

31 Questions? Me: Sponsors: FreeRDP: FreeRDS: Weston backend: XDC David FORT contact@hardening-consulting.com 31

32 Extra slides XDC David FORT contact@hardening-consulting.com 32

33 Steps for an RDP server should compile... $./rdp-server bash:./rdp-server: No such file or directory $ XDC David FORT contact@hardening-consulting.com 33

34 Steps for an RDP server listener not listening $ xfreerdp /v:<my host> freerdp_set_last_error 0x2000C Error: protocol security negotiation or connection failure $ XDC David FORT contact@hardening-consulting.com 34

35 Steps for an RDP server black screen XDC David FORT contact@hardening-consulting.com 35

36 Steps for an RDP server fireworks XDC David FORT contact@hardening-consulting.com 36

37 Steps for an RDP server artifacts XDC David FORT contact@hardening-consulting.com 37

38 Steps for an RDP server go for a beer XDC David FORT contact@hardening-consulting.com 38