Add new command-line option to force xfreerdp into a fips compliant mode.
authorBrent Collins <bcollins@forcepoint.com>
Fri, 7 Apr 2017 21:54:08 +0000 (16:54 -0500)
committerArmin Novak <armin.novak@thincast.com>
Fri, 17 Nov 2017 11:43:06 +0000 (12:43 +0100)
commitd98b88642ba73d58300baacdff0469778f9c37de
tree41f9cb810cae0e2286c1dc3436173219cd0a2960
parent80cb1dd23cd9dea575416fe91c984fe60a216203
Add new command-line option to force xfreerdp into a fips compliant mode.

This option will ensure that NLA is disabled(since NTLM uses weak crypto algorithms), FIPS
encryption is enabled, and ensure fips mode is enabled for openssl.

Selectively override specific uses of MD5/RC4 with new API calls specifically tailored to override FIPS.

Add comments on why overriding the use of these algorithms under FIPS is acceptable for the locations where overrides happen.

Remove check of server proprietary certificate which was already being ignore to avoid use of MD5.

Initialize winpr openssl earlier to ensure fips mode is set before starting using any crypto algorithms.
14 files changed:
client/common/cmdline.c
include/freerdp/settings.h
libfreerdp/common/settings.c
libfreerdp/core/certificate.c
libfreerdp/core/connection.c
libfreerdp/core/license.c
libfreerdp/core/security.c
libfreerdp/core/settings.c
libfreerdp/crypto/tls.c
winpr/include/winpr/crypto.h
winpr/include/winpr/ssl.h
winpr/libwinpr/crypto/cipher.c
winpr/libwinpr/crypto/hash.c
winpr/libwinpr/utils/ssl.c