Messaging changes:-
- Implement sys_login request message with username, password and
IP address
- Implement UDS login message for current user connected to sesman
- Implement common login response message for login requests
- Implement logout message so gateway authentications can be handled
- with login/logout messages
- Remove login info from the create session request
- Existing gateway request/response messages removed
- Add close connection message so that sesman can close terminated
connections without displaying ERROR messages in the log.
- Add a set_peername message so clients can send a name to sesman
for improved logging.
Other changes:-
- Add status types for logging in and session creation, so that the
front-end can supply the user with more informative errors in the
event of an error occurring.
- Users identities are now carried by UID rather than username, as
xrdp and sesman are guaranteed to be on the same machine.
The connected client is currently described in two places in
the xrdp_client_info structure:-
1) In the connection_description field. This was introduced as
field client_ip by commit d797b2cf49
for xrdp v0.6.0
2) In the client_addr and client_port fields introduced by commit
25369460a1 for xrdp v0.8.0
This commit unifies these two sets of fields into a single
set of fields describing the connection IP and port (for
AF_INET/AF_INET6 connections only) and a connection description
for all connection types.
The code in os_calls to provide client logging has been simplified
somewhat which should make it easier to add new connection types (e.g.
AF_VSOCK).
The old connection_description field used to be passed to sesman to
inform sesman of the IP address of the client, and also to provide
a string for 'C' field session policy matching. 'C' field session policy
matching does not actually need this string (see #2239), and so now only
the IP field is passed to sesman.
The TCP socket implementation of sesman has a number of limitations,
namely that it is affected by firewalls, and also that determining the
user on the other end requires a full authentication process.
The advantage of the TCP socket is that sesman and xrdp can be run on
separate machines. This is however not supported by the xorgxrdp
backend (shared memory), and is insecure, in that passwords are sent
in-the-clear, and the connection is susceptible to MitM attacks. This
architecture has been deprecated in release notes since xrdp v0.9.17,
and although it will continue to be supported in any further releases
in the x0.9.x series, it will not be supported in the next major
version.
matt335672