Move SCP to a Unix Domain Socket

The TCP socket implementation of sesman has a number of limitations,
namely that it is affected by firewalls, and also that determining the
user on the other end requires a full authentication process.

The advantage of the TCP socket is that sesman and xrdp can be run on
separate machines. This is however not supported by the xorgxrdp
backend (shared memory), and is insecure, in that passwords are sent
in-the-clear, and the connection is susceptible to MitM attacks. This
architecture has been deprecated in release notes since xrdp v0.9.17,
and although it will continue to be supported in any further releases
in the x0.9.x series, it will not be supported in the next major
version.

libipm/Makefile.am

@@ -1,5 +1,6 @@
 
 AM_CPPFLAGS = \
+  -DSESMAN_RUNTIME_PATH=\"${sesmanruntimedir}\" \
   -I$(top_srcdir)/common
 
 module_LTLIBRARIES = \

libipm/scp.c

@@ -33,6 +33,7 @@
 #include "trans.h"
 #include "os_calls.h"
 #include "string_calls.h"
+#include "xrdp_sockets.h"
 
 /*****************************************************************************/
 static const char *
@@ -66,28 +67,97 @@ scp_msgno_to_str(enum scp_msg_code n, char *buff, unsigned int buff_size)
     return buff;
 }
 
+/*****************************************************************************/
+int
+scp_port_to_unix_domain_path(const char *port, char *buff,
+                             unsigned int bufflen)
+{
+    /* GOTCHA: Changes to this logic should be mirrored in
+     * scp_port_to_display_string() */
+
+    int result;
+
+    /* Make sure we can safely de-reference 'port' */
+    if (port == NULL)
+    {
+        port = "";
+    }
+
+    if (port[0] == '/')
+    {
+        result = g_snprintf(buff, bufflen, "%s", port);
+    }
+    else
+    {
+        const char *sep;
+        if ((sep = g_strrchr(port, '/')) != NULL && sep != port)
+        {
+            /* We allow the user to specify an absolute path, but not
+             * a relative one with embedded '/' characters */
+            LOG(LOG_LEVEL_WARNING, "Ignoring path elements of '%s'", port);
+            port = sep + 1;
+        }
+
+        if (port[0] == '\0')
+        {
+            port = SCP_LISTEN_PORT_BASE_STR;
+        }
+        else if (g_strcmp(port, "3350") == 0)
+        {
+            /* Version v0.9.x and earlier of xrdp used a TCP port
+             * number. If we come across this, we'll ignore it for
+             * compatibility with old config files */
+            LOG(LOG_LEVEL_WARNING,
+                "Ignoring obsolete SCP port value '%s'", port);
+            port = SCP_LISTEN_PORT_BASE_STR;
+        }
+
+        result = g_snprintf(buff, bufflen, SESMAN_RUNTIME_PATH "/%s", port);
+    }
+
+    return result;
+}
+
+/*****************************************************************************/
+int
+scp_port_to_display_string(const char *port, char *buff, unsigned int bufflen)
+{
+    /* Make sure we can safely de-reference 'port' */
+    if (port == NULL)
+    {
+        port = "";
+    }
+
+    /* Ignore any directories for the display */
+    const char *sep;
+    if ((sep = g_strrchr(port, '/')) != NULL)
+    {
+        port = sep + 1;
+    }
+
+    /* Check for a default */
+    if (port[0] == '\0' || g_strcmp(port, "3350") == 0)
+    {
+        port = SCP_LISTEN_PORT_BASE_STR;
+    }
+
+    return g_snprintf(buff, bufflen, "%s", port);
+}
+
 /*****************************************************************************/
 struct trans *
-scp_connect(const char *host, const  char *port,
+scp_connect(const  char *port,
             int (*term_func)(void))
 {
+    char sock_path[256];
     struct trans *t;
-    if ((t = trans_create(TRANS_MODE_TCP, 128, 128)) != NULL)
+
+    (void)scp_port_to_unix_domain_path(port, sock_path, sizeof(sock_path));
+    if ((t = trans_create(TRANS_MODE_UNIX, 128, 128)) != NULL)
     {
-        if (host == NULL)
-        {
-            host = "localhost";
-        }
-
-        if (port == NULL)
-        {
-            port = "3350";
-        }
-
         t->is_term = term_func;
 
-        trans_connect(t, host, port, 3000);
-        if (t->status != TRANS_STATUS_UP)
+        if (trans_connect(t, NULL, sock_path, 3000) != 0)
         {
             trans_delete(t);
             t = NULL;

libipm/scp.h

@@ -65,11 +65,38 @@ scp_msgno_to_str(enum scp_msg_code n, char *buff, unsigned int buff_size);
 
 /* Connection management facilities */
 
+/**
+ * Maps a port definition to a UNIX domain socket path
+ * @param port Port definition (e.g. from sesman.ini). Can be "" or NULL
+ * @param buff Buffer for result
+ * @param bufflen Length of buff
+ *
+ * @return Number of chars needed for result, excluding the '\0'
+ */
+int
+scp_port_to_unix_domain_path(const char *port, char *buff,
+                             unsigned int bufflen);
+
+/**
+ * Maps a port definition to a displayable string
+ * @param port Port definition (e.g. from sesman.ini). Can be "" or NULL
+ * @param buff Buffer for result
+ * @param bufflen Length of buff
+ *
+ * @return Number of chars needed for result, excluding the '\0'
+ *
+ * This differs from scp_port_to_unix_domain_path() in that the result is
+ * for displaying to the user (i.e. in a status message), rather than for
+ * connecting to. For log messages, use the result of
+ * scp_port_to_unix_domain_path()
+ */
+int
+scp_port_to_display_string(const char *port, char *buff, unsigned int bufflen);
+
 /**
  * Connect to an SCP server
  *
- * @param host Host providing SCP service
- * @param port TCP port for SCP service
+ * @param port Port definition (e.g. from sesman.ini)
  * @param term_func Function to poll during connection for program
  *         termination, or NULL for none.
  * @return Initialised SCP transport
@@ -77,7 +104,7 @@ scp_msgno_to_str(enum scp_msg_code n, char *buff, unsigned int buff_size);
  * The returned tranport has the is_term member set to term_func.
  */
 struct trans *
-scp_connect(const char *host, const  char *port,
+scp_connect(const  char *port,
             int (*term_func)(void));
 
 /**