FreeRDP
Loading...
Searching...
No Matches
connection.c
1/*
2 * FreeRDP: A Remote Desktop Protocol Implementation
3 * Connection Sequence
4 *
5 * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
6 * Copyright 2015 Thincast Technologies GmbH
7 * Copyright 2015 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
8 * Copyright 2023 Armin Novak <anovak@thincast.com>
9 * Copyright 2023 Thincast Technologies GmbH
10 *
11 * Licensed under the Apache License, Version 2.0 (the "License");
12 * you may not use this file except in compliance with the License.
13 * You may obtain a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing, software
18 * distributed under the License is distributed on an "AS IS" BASIS,
19 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 * See the License for the specific language governing permissions and
21 * limitations under the License.
22 */
23
24#include <freerdp/config.h>
25
26#include "settings.h"
27
28#include "info.h"
29#include "input.h"
30#include "rdp.h"
31#include "peer.h"
32
33#include "connection.h"
34#include "transport.h"
35
36#include <winpr/crt.h>
37#include <winpr/crypto.h>
38#include <winpr/ssl.h>
39
40#include <freerdp/log.h>
41#include <freerdp/error.h>
42#include <freerdp/listener.h>
43
44#include "../cache/pointer.h"
45#include "../crypto/crypto.h"
46#include "../crypto/privatekey.h"
47#include "../crypto/certificate.h"
48#include "gateway/arm.h"
49
50#include "utils.h"
51
52#define TAG FREERDP_TAG("core.connection")
53
197static BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state);
198
199static BOOL rdp_client_reset_codecs(rdpContext* context)
200{
201 rdpSettings* settings = nullptr;
202
203 if (!context || !context->settings)
204 return FALSE;
205
206 settings = context->settings;
207
208 if (!freerdp_settings_get_bool(settings, FreeRDP_DeactivateClientDecoding))
209 {
210 const UINT32 flags = freerdp_settings_get_uint32(settings, FreeRDP_ThreadingFlags);
211 freerdp_client_codecs_free(context->codecs);
212 context->codecs = freerdp_client_codecs_new(flags);
213
214 if (!context->codecs)
215 return FALSE;
216
217 if (!freerdp_client_codecs_prepare(context->codecs,
218 freerdp_settings_get_codecs_flags(settings),
219 settings->DesktopWidth, settings->DesktopHeight))
220 return FALSE;
221
222/* Runtime H264 detection. (only available if dynamic backend loading is defined)
223 * If no backend is available disable it before the channel is loaded.
224 */
225#if defined(WITH_GFX_H264) && defined(WITH_OPENH264_LOADING)
226 if (!context->codecs->h264)
227 {
228 settings->GfxH264 = FALSE;
229 settings->GfxAVC444 = FALSE;
230 settings->GfxAVC444v2 = FALSE;
231 }
232#endif
233 }
234
235 return TRUE;
236}
237
238static BOOL rdp_client_wait_for_activation(rdpRdp* rdp)
239{
240 BOOL timedout = FALSE;
241 WINPR_ASSERT(rdp);
242
243 const rdpSettings* settings = rdp->settings;
244 WINPR_ASSERT(settings);
245
246 UINT64 now = GetTickCount64();
247 UINT64 dueDate = now + freerdp_settings_get_uint32(settings, FreeRDP_TcpAckTimeout);
248
249 for (; (now < dueDate) && !timedout; now = GetTickCount64())
250 {
251 HANDLE events[MAXIMUM_WAIT_OBJECTS] = WINPR_C_ARRAY_INIT;
252 DWORD wstatus = 0;
253 DWORD nevents = freerdp_get_event_handles(rdp->context, events, ARRAYSIZE(events));
254 if (!nevents)
255 {
256 WLog_ERR(TAG, "error retrieving connection events");
257 return FALSE;
258 }
259
260 const UINT64 timeout = (dueDate - now);
261 WINPR_ASSERT(timeout <= UINT32_MAX);
262 wstatus = WaitForMultipleObjectsEx(nevents, events, FALSE, (UINT32)timeout, TRUE);
263 switch (wstatus)
264 {
265 case WAIT_TIMEOUT:
266 /* will make us quit with a timeout */
267 timedout = TRUE;
268 break;
269 case WAIT_ABANDONED:
270 case WAIT_FAILED:
271 return FALSE;
272 case WAIT_IO_COMPLETION:
273 break;
274 case WAIT_OBJECT_0:
275 default:
276 /* handles all WAIT_OBJECT_0 + [0 .. MAXIMUM_WAIT_OBJECTS-1] cases */
277 if (rdp_check_fds(rdp) < 0)
278 {
279 freerdp_set_last_error_if_not(rdp->context,
280 FREERDP_ERROR_CONNECT_TRANSPORT_FAILED);
281 return FALSE;
282 }
283 break;
284 }
285
286 if (rdp_is_active_state(rdp))
287 return TRUE;
288 }
289
290 WLog_ERR(TAG, "Timeout waiting for activation");
291 freerdp_set_last_error_if_not(rdp->context, FREERDP_ERROR_CONNECT_ACTIVATION_TIMEOUT);
292 return FALSE;
293}
301BOOL rdp_client_connect(rdpRdp* rdp)
302{
303 UINT32 SelectedProtocol = 0;
304 BOOL status = 0;
305 rdpSettings* settings = nullptr;
306 /* make sure SSL is initialize for earlier enough for crypto, by taking advantage of winpr SSL
307 * FIPS flag for openssl initialization */
308 DWORD flags = WINPR_SSL_INIT_DEFAULT;
309
310 WINPR_ASSERT(rdp);
311
312 settings = rdp->settings;
313 WINPR_ASSERT(settings);
314
315 if (!rdp_client_reset_codecs(rdp->context))
316 return FALSE;
317
318 if (settings->FIPSMode)
319 flags |= WINPR_SSL_INIT_ENABLE_FIPS;
320
321 winpr_InitializeSSL(flags);
322 rdp_log_build_warnings(rdp);
323
324 /* FIPS Mode forces the following and overrides the following(by happening later */
325 /* in the command line processing): */
326 /* 1. Disables NLA Security since NLA in freerdp uses NTLM(no Kerberos support yet) which uses
327 * algorithms */
328 /* not allowed in FIPS for sensitive data. So, we disallow NLA when FIPS is required. */
329 /* 2. Forces the only supported RDP encryption method to be FIPS. */
330 if (settings->FIPSMode || winpr_FIPSMode())
331 {
332 settings->NlaSecurity = FALSE;
333 settings->EncryptionMethods = ENCRYPTION_METHOD_FIPS;
334 }
335
336 UINT32 TcpConnectTimeout = freerdp_settings_get_uint32(settings, FreeRDP_TcpConnectTimeout);
337 if (settings->GatewayArmTransport)
338 {
339 if (!arm_resolve_endpoint(rdp->log, rdp->context, TcpConnectTimeout))
340 {
341 WLog_ERR(TAG, "error retrieving ARM configuration");
342 return FALSE;
343 }
344 }
345
346 const char* hostname = settings->ServerHostname;
347 if (!hostname)
348 {
349 WLog_ERR(TAG, "Missing hostname, can not connect to nullptr target");
350 return FALSE;
351 }
352
353 const UINT32 port = settings->ServerPort;
354 WINPR_ASSERT(port <= UINT32_MAX);
355
356 nego_init(rdp->nego);
357 nego_set_target(rdp->nego, hostname, (UINT16)port);
358
359 if (settings->GatewayEnabled)
360 {
361 char* user = nullptr;
362 char* domain = nullptr;
363 size_t user_length = 0;
364
365 if (settings->Username)
366 {
367 user = settings->Username;
368 user_length = strlen(settings->Username);
369 }
370
371 if (settings->Domain)
372 domain = settings->Domain;
373 else
374 domain = settings->ComputerName;
375
376 const size_t domain_length = strlen(domain);
377 const size_t cookie_length = domain_length + 1 + user_length;
378 char* cookie = malloc(cookie_length + 1);
379
380 if (!cookie)
381 return FALSE;
382
383 CopyMemory(cookie, domain, domain_length);
384 WINPR_ASSERT(domain_length <= UINT32_MAX);
385 CharUpperBuffA(cookie, (UINT32)domain_length);
386 cookie[domain_length] = '\\';
387
388 if (settings->Username)
389 CopyMemory(&cookie[domain_length + 1], user, user_length);
390
391 cookie[cookie_length] = '\0';
392 status = nego_set_cookie(rdp->nego, cookie);
393 free(cookie);
394 }
395 else
396 {
397 status = nego_set_cookie(rdp->nego, settings->Username);
398 }
399
400 if (!status)
401 return FALSE;
402
403 nego_set_childsession_enabled(rdp->nego, settings->ConnectChildSession);
404 nego_set_send_preconnection_pdu(rdp->nego, settings->SendPreconnectionPdu);
405 nego_set_preconnection_id(rdp->nego, settings->PreconnectionId);
406 nego_set_preconnection_blob(rdp->nego, settings->PreconnectionBlob);
407 nego_set_negotiation_enabled(rdp->nego, settings->NegotiateSecurityLayer);
408 nego_set_restricted_admin_mode_required(rdp->nego, settings->RestrictedAdminModeRequired);
409 nego_set_RCG_required(rdp->nego, settings->RemoteCredentialGuard);
410 nego_set_gateway_enabled(rdp->nego, settings->GatewayEnabled);
411 nego_set_gateway_bypass_local(rdp->nego, settings->GatewayBypassLocal);
412 nego_enable_rdp(rdp->nego, settings->RdpSecurity);
413 nego_enable_tls(rdp->nego, settings->TlsSecurity);
414 nego_enable_nla(rdp->nego, settings->NlaSecurity);
415 nego_enable_ext(rdp->nego, settings->ExtSecurity);
416 nego_enable_rdstls(rdp->nego, settings->RdstlsSecurity);
417 nego_enable_aad(rdp->nego, settings->AadSecurity);
418
419 if (settings->MstscCookieMode)
420 settings->CookieMaxLength = MSTSC_COOKIE_MAX_LENGTH;
421
422 nego_set_cookie_max_length(rdp->nego, settings->CookieMaxLength);
423
424 if (settings->LoadBalanceInfo && (settings->LoadBalanceInfoLength > 0))
425 {
426 if (!nego_set_routing_token(rdp->nego, settings->LoadBalanceInfo,
427 settings->LoadBalanceInfoLength))
428 return FALSE;
429 }
430
431 if (!freerdp_settings_get_bool(settings, FreeRDP_TransportDumpReplay))
432 {
433 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_NEGO))
434 return FALSE;
435
436 if (!nego_connect(rdp->nego))
437 {
438 if (!freerdp_get_last_error(rdp->context))
439 {
440 freerdp_set_last_error_log(rdp->context,
441 FREERDP_ERROR_SECURITY_NEGO_CONNECT_FAILED);
442 WLog_ERR(TAG, "Error: protocol security negotiation or connection failure");
443 }
444
445 return FALSE;
446 }
447
448 SelectedProtocol = nego_get_selected_protocol(rdp->nego);
449
450 if ((SelectedProtocol & PROTOCOL_SSL) || (SelectedProtocol == PROTOCOL_RDP) ||
451 (SelectedProtocol == PROTOCOL_RDSTLS))
452 {
453 wStream s = WINPR_C_ARRAY_INIT;
454
455 if ((settings->Username != nullptr) &&
456 ((freerdp_settings_get_string(settings, FreeRDP_Password) != nullptr) ||
457 (settings->RedirectionPassword != nullptr &&
458 settings->RedirectionPasswordLength > 0)))
459 settings->AutoLogonEnabled = TRUE;
460
461 if (rdp_recv_callback(rdp->transport, &s, rdp) < 0)
462 return FALSE;
463 }
464
465 if (!transport_set_blocking_mode(rdp->transport, FALSE))
466 return FALSE;
467 }
468 else
469 {
470 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_REQUEST))
471 return FALSE;
472 }
473
474 /* everything beyond this point is event-driven and non blocking */
475 if (!transport_set_recv_callbacks(rdp->transport, rdp_recv_callback, rdp))
476 return FALSE;
477
478 return rdp_client_wait_for_activation(rdp);
479}
480
481BOOL rdp_client_disconnect(rdpRdp* rdp)
482{
483 rdpContext* context = nullptr;
484
485 if (!rdp || !rdp->settings || !rdp->context)
486 return FALSE;
487
488 context = rdp->context;
489
490 if (rdp->nego)
491 {
492 if (!nego_disconnect(rdp->nego))
493 return FALSE;
494 }
495
496 if (!transport_disconnect(rdp->transport))
497 return FALSE;
498
499 if (!rdp_reset(rdp))
500 return FALSE;
501
502 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_INITIAL))
503 return FALSE;
504
505 if (freerdp_channels_disconnect(context->channels, context->instance) != CHANNEL_RC_OK)
506 return FALSE;
507
508 freerdp_client_codecs_free(context->codecs);
509 context->codecs = nullptr;
510 return TRUE;
511}
512
513BOOL rdp_client_disconnect_and_clear(rdpRdp* rdp)
514{
515 rdpContext* context = nullptr;
516
517 if (!rdp_client_disconnect(rdp))
518 return FALSE;
519
520 WINPR_ASSERT(rdp);
521
522 context = rdp->context;
523 WINPR_ASSERT(context);
524
525 if (freerdp_get_last_error(context) == FREERDP_ERROR_CONNECT_CANCELLED)
526 return FALSE;
527
528 context->LastError = FREERDP_ERROR_SUCCESS;
529 clearChannelError(context);
530 return utils_reset_abort(rdp);
531}
532
533static BOOL rdp_client_reconnect_channels(rdpRdp* rdp, BOOL redirect)
534{
535 BOOL status = FALSE;
536 rdpContext* context = nullptr;
537
538 if (!rdp || !rdp->context || !rdp->context->channels)
539 return FALSE;
540
541 context = rdp->context;
542
543 if (context->instance->ConnectionCallbackState == CLIENT_STATE_INITIAL)
544 return FALSE;
545
546 if (context->instance->ConnectionCallbackState == CLIENT_STATE_PRECONNECT_PASSED)
547 {
548 if (redirect)
549 return TRUE;
550
551 pointer_cache_register_callbacks(context->update);
552
553 if (!IFCALLRESULT(FALSE, context->instance->PostConnect, context->instance))
554 return FALSE;
555
556 context->instance->ConnectionCallbackState = CLIENT_STATE_POSTCONNECT_PASSED;
557 }
558
559 if (context->instance->ConnectionCallbackState == CLIENT_STATE_POSTCONNECT_PASSED)
560 status =
561 (freerdp_channels_post_connect(context->channels, context->instance) == CHANNEL_RC_OK);
562
563 return status;
564}
565
566static BOOL rdp_client_redirect_resolvable(const char* host)
567{
568 struct addrinfo* result = freerdp_tcp_resolve_host(host, -1, 0);
569
570 if (!result)
571 return FALSE;
572
573 freeaddrinfo(result);
574 return TRUE;
575}
576
577static BOOL rdp_client_redirect_try_fqdn(rdpSettings* settings)
578{
579 if (settings->RedirectionFlags & LB_TARGET_FQDN)
580 {
581 if (settings->GatewayEnabled ||
582 rdp_client_redirect_resolvable(settings->RedirectionTargetFQDN))
583 {
584 return (freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
585 settings->RedirectionTargetFQDN));
586 }
587 }
588
589 return FALSE;
590}
591
592static BOOL rdp_client_redirect_try_ip(rdpSettings* settings)
593{
594 if (settings->RedirectionFlags & LB_TARGET_NET_ADDRESS)
595 {
596 return (freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
597 settings->TargetNetAddress));
598 }
599
600 return FALSE;
601}
602
603static BOOL rdp_client_redirect_try_netbios(rdpSettings* settings)
604{
605 if (settings->RedirectionFlags & LB_TARGET_NETBIOS_NAME)
606 {
607 if (settings->GatewayEnabled ||
608 rdp_client_redirect_resolvable(settings->RedirectionTargetNetBiosName))
609 {
610 return (freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
611 settings->RedirectionTargetNetBiosName));
612 }
613 }
614
615 return FALSE;
616}
617
618BOOL rdp_client_redirect(rdpRdp* rdp)
619{
620 BOOL status = 0;
621 rdpSettings* settings = nullptr;
622
623 if (!rdp_client_disconnect_and_clear(rdp))
624 return FALSE;
625
626 /* Only disconnect & close the channels here.
627 * they will be discarded and recreated after the new settings have been applied. */
628 freerdp_channels_disconnect(rdp->context->channels, rdp->context->instance);
629 freerdp_channels_close(rdp->context->channels, rdp->context->instance);
630
631 if (rdp_redirection_apply_settings(rdp) != 0)
632 return FALSE;
633
634 WINPR_ASSERT(rdp);
635
636 settings = rdp->settings;
637 WINPR_ASSERT(settings);
638
639 if ((settings->RedirectionFlags & LB_LOAD_BALANCE_INFO) == 0)
640 {
641 BOOL haveRedirectAddress = FALSE;
642 UINT32 redirectionMask = settings->RedirectionPreferType;
643
644 do
645 {
646 const BOOL tryFQDN = (redirectionMask & 0x01) == 0;
647 const BOOL tryNetAddress = (redirectionMask & 0x02) == 0;
648 const BOOL tryNetbios = (redirectionMask & 0x04) == 0;
649
650 if (tryFQDN && !haveRedirectAddress)
651 haveRedirectAddress = rdp_client_redirect_try_fqdn(settings);
652
653 if (tryNetAddress && !haveRedirectAddress)
654 haveRedirectAddress = rdp_client_redirect_try_ip(settings);
655
656 if (tryNetbios && !haveRedirectAddress)
657 haveRedirectAddress = rdp_client_redirect_try_netbios(settings);
658
659 redirectionMask >>= 3;
660 } while (!haveRedirectAddress && (redirectionMask != 0));
661 }
662
663 if (settings->RedirectionFlags & LB_USERNAME)
664 {
665 if (!freerdp_settings_set_string(
666 settings, FreeRDP_Username,
667 freerdp_settings_get_string(settings, FreeRDP_RedirectionUsername)))
668 return FALSE;
669 }
670
671 if (settings->RedirectionFlags & LB_DOMAIN)
672 {
673 if (!freerdp_settings_set_string(
674 settings, FreeRDP_Domain,
675 freerdp_settings_get_string(settings, FreeRDP_RedirectionDomain)))
676 return FALSE;
677 }
678
679 settings->RdstlsSecurity = ((settings->RedirectionFlags & LB_PASSWORD_IS_PK_ENCRYPTED) != 0);
680
681 WINPR_ASSERT(rdp->context);
682 WINPR_ASSERT(rdp->context->instance);
683 if (!IFCALLRESULT(TRUE, rdp->context->instance->Redirect, rdp->context->instance))
684 return FALSE;
685
686 BOOL ok = utils_reload_channels(rdp->context);
687 if (!ok)
688 return FALSE;
689
690 status = rdp_client_connect(rdp);
691
692 if (status)
693 status = rdp_client_reconnect_channels(rdp, TRUE);
694
695 return status;
696}
697
698BOOL rdp_client_reconnect(rdpRdp* rdp)
699{
700 BOOL status = 0;
701
702 if (!rdp_client_disconnect_and_clear(rdp))
703 return FALSE;
704
705 status = rdp_client_connect(rdp);
706
707 if (status)
708 status = rdp_client_reconnect_channels(rdp, FALSE);
709
710 return status;
711}
712
713static const BYTE fips_ivec[8] = { 0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF };
714
715static BOOL rdp_client_establish_keys(rdpRdp* rdp)
716{
717 wStream* s = nullptr;
718 BOOL ret = FALSE;
719
720 WINPR_ASSERT(rdp);
721 rdpSettings* settings = rdp->settings;
722 BYTE* crypt_client_random = nullptr;
723
724 WINPR_ASSERT(settings);
725 if (!settings->UseRdpSecurityLayer)
726 {
727 /* no RDP encryption */
728 return TRUE;
729 }
730
731 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT))
732 return FALSE;
733
734 /* encrypt client random */
735 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, nullptr,
736 CLIENT_RANDOM_LENGTH))
737 return FALSE;
738 if (winpr_RAND(settings->ClientRandom, settings->ClientRandomLength) < 0)
739 return FALSE;
740
741 const rdpCertInfo* info = freerdp_certificate_get_info(settings->RdpServerCertificate);
742 if (!info)
743 {
744 WLog_ERR(TAG, "Failed to get rdpCertInfo from RdpServerCertificate");
745 return FALSE;
746 }
747
748 /*
749 * client random must be (bitlen / 8) + 8 - see [MS-RDPBCGR] 5.3.4.1
750 * for details
751 */
752 crypt_client_random = calloc(info->ModulusLength, 1);
753
754 if (!crypt_client_random)
755 return FALSE;
756
757 if (crypto_rsa_public_encrypt(settings->ClientRandom, settings->ClientRandomLength, info,
758 crypt_client_random, info->ModulusLength) < 0)
759 return FALSE;
760 /* send crypt client random to server */
761 const size_t length = RDP_PACKET_HEADER_MAX_LENGTH + RDP_SECURITY_HEADER_LENGTH + 4ULL +
762 info->ModulusLength + 8ULL;
763 if (length > UINT16_MAX)
764 return FALSE;
765
766 s = Stream_New(nullptr, length);
767
768 if (!s)
769 {
770 WLog_ERR(TAG, "Stream_New failed!");
771 goto end;
772 }
773
774 {
775 const UINT16 sec_flags = SEC_EXCHANGE_PKT | SEC_LICENSE_ENCRYPT_SC;
776 if (!rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID, sec_flags))
777 goto end;
778 if (!rdp_write_security_header(rdp, s, sec_flags))
779 goto end;
780 }
781
782 Stream_Write_UINT32(s, info->ModulusLength + 8);
783 Stream_Write(s, crypt_client_random, info->ModulusLength);
784 Stream_Zero(s, 8);
785 Stream_SealLength(s);
786
787 {
788 rdpTransport* transport = freerdp_get_transport(rdp->context);
789 const int status = transport_write(transport, s);
790
791 if (status < 0)
792 goto end;
793 }
794
795 rdp->do_crypt_license = TRUE;
796
797 /* now calculate encrypt / decrypt and update keys */
798 if (!security_establish_keys(rdp))
799 goto end;
800
801 rdp->do_crypt = TRUE;
802
803 if (settings->SaltedChecksum)
804 rdp->do_secure_checksum = TRUE;
805
806 if (settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
807 {
808 rdp->fips_encrypt =
809 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
810 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
811
812 if (!rdp->fips_encrypt)
813 {
814 WLog_ERR(TAG, "unable to allocate des3 encrypt key");
815 goto end;
816 }
817
818 rdp->fips_decrypt =
819 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
820 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
821
822 if (!rdp->fips_decrypt)
823 {
824 WLog_ERR(TAG, "unable to allocate des3 decrypt key");
825 goto end;
826 }
827
828 ret = TRUE;
829 goto end;
830 }
831
832 if (!rdp_reset_rc4_encrypt_keys(rdp))
833 goto end;
834 if (!rdp_reset_rc4_decrypt_keys(rdp))
835 goto end;
836
837 ret = TRUE;
838end:
839 Stream_Free(s, TRUE);
840 free(crypt_client_random);
841
842 if (!ret)
843 {
844 winpr_Cipher_Free(rdp->fips_decrypt);
845 winpr_Cipher_Free(rdp->fips_encrypt);
846 rdp->fips_decrypt = nullptr;
847 rdp->fips_encrypt = nullptr;
848
849 rdp_free_rc4_decrypt_keys(rdp);
850 rdp_free_rc4_encrypt_keys(rdp);
851 }
852
853 return ret;
854}
855
856static BOOL rdp_update_client_random(rdpSettings* settings, const BYTE* crypt_random,
857 size_t crypt_random_len)
858{
859 const size_t length = 32;
860 WINPR_ASSERT(settings);
861
862 const rdpPrivateKey* rsa = freerdp_settings_get_pointer(settings, FreeRDP_RdpServerRsaKey);
863 WINPR_ASSERT(rsa);
864
865 const rdpCertInfo* cinfo = freerdp_key_get_info(rsa);
866 WINPR_ASSERT(cinfo);
867
868 if (crypt_random_len != cinfo->ModulusLength + 8)
869 {
870 WLog_ERR(TAG, "invalid encrypted client random length");
871 return FALSE;
872 }
873 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, nullptr, length))
874 return FALSE;
875
876 BYTE* client_random = freerdp_settings_get_pointer_writable(settings, FreeRDP_ClientRandom);
877 WINPR_ASSERT(client_random);
878 return crypto_rsa_private_decrypt(crypt_random, crypt_random_len - 8, rsa, client_random,
879 length) > 0;
880}
881
882BOOL rdp_server_establish_keys(rdpRdp* rdp, wStream* s)
883{
884 UINT32 rand_len = 0;
885 UINT16 channel_id = 0;
886 UINT16 length = 0;
887 UINT16 sec_flags = 0;
888 BOOL ret = FALSE;
889
890 WINPR_ASSERT(rdp);
891
892 if (!rdp->settings->UseRdpSecurityLayer)
893 {
894 /* No RDP Security. */
895 return TRUE;
896 }
897
898 if (!rdp_read_header(rdp, s, &length, &channel_id))
899 return FALSE;
900
901 if (!rdp_read_security_header(rdp, s, &sec_flags, nullptr))
902 {
903 WLog_Print(rdp->log, WLOG_ERROR, "invalid security header");
904 return FALSE;
905 }
906
907 if ((sec_flags & SEC_EXCHANGE_PKT) == 0)
908 {
909 WLog_Print(rdp->log, WLOG_ERROR, "missing SEC_EXCHANGE_PKT in security header");
910 return FALSE;
911 }
912
913 rdp->do_crypt_license = ((sec_flags & SEC_LICENSE_ENCRYPT_SC) != 0);
914
915 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, 4))
916 return FALSE;
917
918 Stream_Read_UINT32(s, rand_len);
919
920 /* rand_len already includes 8 bytes of padding */
921 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, rand_len))
922 return FALSE;
923
924 const BYTE* crypt_random = Stream_ConstPointer(s);
925 if (!Stream_SafeSeek(s, rand_len))
926 goto end;
927 if (!rdp_update_client_random(rdp->settings, crypt_random, rand_len))
928 goto end;
929
930 /* now calculate encrypt / decrypt and update keys */
931 if (!security_establish_keys(rdp))
932 goto end;
933
934 rdp->do_crypt = TRUE;
935
936 if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
937 {
938 rdp->fips_encrypt =
939 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
940 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
941
942 if (!rdp->fips_encrypt)
943 {
944 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 encrypt key");
945 goto end;
946 }
947
948 rdp->fips_decrypt =
949 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
950 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
951
952 if (!rdp->fips_decrypt)
953 {
954 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 decrypt key");
955 goto end;
956 }
957
958 ret = TRUE;
959 goto end;
960 }
961
962 if (!rdp_reset_rc4_encrypt_keys(rdp))
963 goto end;
964
965 if (!rdp_reset_rc4_decrypt_keys(rdp))
966 goto end;
967
968 ret = tpkt_ensure_stream_consumed(rdp->log, s, length);
969end:
970
971 if (!ret)
972 {
973 winpr_Cipher_Free(rdp->fips_encrypt);
974 winpr_Cipher_Free(rdp->fips_decrypt);
975 rdp->fips_encrypt = nullptr;
976 rdp->fips_decrypt = nullptr;
977
978 rdp_free_rc4_encrypt_keys(rdp);
979 rdp_free_rc4_decrypt_keys(rdp);
980 }
981
982 return ret;
983}
984
985static BOOL rdp_client_send_client_info_and_change_state(rdpRdp* rdp)
986{
987 WINPR_ASSERT(rdp);
988 if (!rdp_client_establish_keys(rdp))
989 return FALSE;
990 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE))
991 return FALSE;
992 if (!rdp_send_client_info(rdp))
993 return FALSE;
994 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST))
995 return FALSE;
996 return TRUE;
997}
998
999BOOL rdp_client_skip_mcs_channel_join(rdpRdp* rdp)
1000{
1001 WINPR_ASSERT(rdp);
1002
1003 rdpMcs* mcs = rdp->mcs;
1004 WINPR_ASSERT(mcs);
1005
1006 mcs->userChannelJoined = TRUE;
1007 mcs->globalChannelJoined = TRUE;
1008 mcs->messageChannelJoined = TRUE;
1009
1010 for (UINT32 i = 0; i < mcs->channelCount; i++)
1011 {
1012 rdpMcsChannel* cur = &mcs->channels[i];
1013 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1014 cur->joined = TRUE;
1015 }
1016
1017 return rdp_client_send_client_info_and_change_state(rdp);
1018}
1019
1020static BOOL rdp_client_join_channel(rdpRdp* rdp, UINT16 ChannelId)
1021{
1022 WINPR_ASSERT(rdp);
1023
1024 rdpMcs* mcs = rdp->mcs;
1025 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST))
1026 return FALSE;
1027 if (!mcs_send_channel_join_request(mcs, ChannelId))
1028 return FALSE;
1029 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1030 return FALSE;
1031 return TRUE;
1032}
1033
1034BOOL rdp_client_connect_mcs_channel_join_confirm(rdpRdp* rdp, wStream* s)
1035{
1036 UINT16 channelId = 0;
1037 BOOL allJoined = TRUE;
1038
1039 WINPR_ASSERT(rdp);
1040 rdpMcs* mcs = rdp->mcs;
1041
1042 if (!mcs_recv_channel_join_confirm(mcs, s, &channelId))
1043 return FALSE;
1044
1045 if (!mcs->userChannelJoined)
1046 {
1047 if (channelId != mcs->userId)
1048 {
1049 WLog_ERR(TAG, "expected user channel id %" PRIu16 ", but received %" PRIu16,
1050 mcs->userId, channelId);
1051 return FALSE;
1052 }
1053
1054 mcs->userChannelJoined = TRUE;
1055 if (!rdp_client_join_channel(rdp, MCS_GLOBAL_CHANNEL_ID))
1056 return FALSE;
1057 }
1058 else if (!mcs->globalChannelJoined)
1059 {
1060 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1061 {
1062 WLog_ERR(TAG, "expected uglobalser channel id %d, but received %" PRIu16,
1063 MCS_GLOBAL_CHANNEL_ID, channelId);
1064 return FALSE;
1065 }
1066 mcs->globalChannelJoined = TRUE;
1067
1068 if (mcs->messageChannelId != 0)
1069 {
1070 if (!rdp_client_join_channel(rdp, mcs->messageChannelId))
1071 return FALSE;
1072 allJoined = FALSE;
1073 }
1074 else
1075 {
1076 if (mcs->channelCount > 0)
1077 {
1078 const rdpMcsChannel* cur = &mcs->channels[0];
1079 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1080 return FALSE;
1081 allJoined = FALSE;
1082 }
1083 }
1084 }
1085 else if ((mcs->messageChannelId != 0) && !mcs->messageChannelJoined)
1086 {
1087 if (channelId != mcs->messageChannelId)
1088 {
1089 WLog_ERR(TAG, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1090 mcs->messageChannelId, channelId);
1091 return FALSE;
1092 }
1093
1094 mcs->messageChannelJoined = TRUE;
1095
1096 if (mcs->channelCount > 0)
1097 {
1098 const rdpMcsChannel* cur = &mcs->channels[0];
1099 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1100 return FALSE;
1101 allJoined = FALSE;
1102 }
1103 }
1104 else
1105 {
1106 UINT32 i = 0;
1107 for (; i < mcs->channelCount; i++)
1108 {
1109 rdpMcsChannel* cur = &mcs->channels[i];
1110 if (cur->joined)
1111 continue;
1112
1113 if (cur->ChannelId != channelId)
1114 {
1115 WLog_ERR(TAG, "expected channel id %d, but received %" PRIu16,
1116 MCS_GLOBAL_CHANNEL_ID, channelId);
1117 return FALSE;
1118 }
1119 cur->joined = TRUE;
1120 break;
1121 }
1122
1123 if (i + 1 < mcs->channelCount)
1124 {
1125 const rdpMcsChannel* cur = &mcs->channels[i + 1];
1126 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1127 return FALSE;
1128 allJoined = FALSE;
1129 }
1130 }
1131
1132 if (mcs->userChannelJoined && mcs->globalChannelJoined && allJoined)
1133 {
1134 if (!rdp_client_send_client_info_and_change_state(rdp))
1135 return FALSE;
1136 }
1137
1138 return TRUE;
1139}
1140
1141state_run_t rdp_handle_message_channel(rdpRdp* rdp, wStream* s, UINT16 channelId, UINT16 length)
1142{
1143 WINPR_ASSERT(rdp);
1144 WINPR_ASSERT(rdp->mcs);
1145
1146 if (!rdp->mcs->messageChannelJoined)
1147 {
1148 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel not joined!");
1149 return STATE_RUN_FAILED;
1150 }
1151 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1152 if (messageChannelId == 0)
1153 {
1154 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel id == 0");
1155 return STATE_RUN_FAILED;
1156 }
1157
1158 if ((channelId != messageChannelId) && (channelId != MCS_GLOBAL_CHANNEL_ID))
1159 {
1160 WLog_Print(rdp->log, WLOG_WARN,
1161 "MCS message channel expected id=[%" PRIu16 "|%d], got %" PRIu16,
1162 messageChannelId, MCS_GLOBAL_CHANNEL_ID, channelId);
1163 return STATE_RUN_FAILED;
1164 }
1165
1166 UINT16 securityFlags = 0;
1167 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1168 return STATE_RUN_FAILED;
1169
1170 if (securityFlags & SEC_ENCRYPT)
1171 {
1172 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1173 return STATE_RUN_FAILED;
1174 }
1175
1176 const state_run_t rc = rdp_recv_message_channel_pdu(rdp, s, securityFlags);
1177 if (state_run_success(rc))
1178 {
1179 if (!tpkt_ensure_stream_consumed(rdp->log, s, length))
1180 return STATE_RUN_FAILED;
1181 }
1182 return rc;
1183}
1184
1185BOOL rdp_client_connect_auto_detect(rdpRdp* rdp, wStream* s, DWORD logLevel)
1186{
1187 WINPR_ASSERT(rdp);
1188 WINPR_ASSERT(rdp->mcs);
1189
1190 const size_t pos = Stream_GetPosition(s);
1191 UINT16 length = 0;
1192 UINT16 channelId = 0;
1193
1194 if (rdp_read_header(rdp, s, &length, &channelId))
1195 {
1196 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1197 /* If the MCS message channel has been joined... */
1198
1199 /* Process any MCS message channel PDUs. */
1200 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1201 {
1202 const state_run_t rc = rdp_handle_message_channel(rdp, s, channelId, length);
1203 return state_run_success(rc);
1204 }
1205 else
1206 {
1207 wLog* log = WLog_Get(TAG);
1208 WLog_Print(log, logLevel, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1209 messageChannelId, channelId);
1210 }
1211 }
1212
1213 Stream_SetPosition(s, pos);
1214 return FALSE;
1215}
1216
1217state_run_t rdp_client_connect_license(rdpRdp* rdp, wStream* s)
1218{
1219 state_run_t status = STATE_RUN_FAILED;
1220 LICENSE_STATE state = LICENSE_STATE_ABORTED;
1221 UINT16 length = 0;
1222 UINT16 channelId = 0;
1223 UINT16 securityFlags = 0;
1224
1225 WINPR_ASSERT(rdp);
1226 if (!rdp_read_header(rdp, s, &length, &channelId))
1227 return STATE_RUN_FAILED;
1228
1229 /* there might be autodetect messages mixed in between licensing messages.
1230 * that has been observed with 2k12 R2 and 2k19
1231 */
1232 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1233 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1234 {
1235 return rdp_handle_message_channel(rdp, s, channelId, length);
1236 }
1237
1238 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1239 return STATE_RUN_FAILED;
1240
1241 if (securityFlags & SEC_ENCRYPT)
1242 {
1243 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1244 return STATE_RUN_FAILED;
1245 }
1246
1247 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1248 WLog_WARN(TAG, "unexpected message for channel %u, expected %d", channelId,
1249 MCS_GLOBAL_CHANNEL_ID);
1250
1251 if ((securityFlags & SEC_LICENSE_PKT) == 0)
1252 {
1253 char buffer[512] = WINPR_C_ARRAY_INIT;
1254 char lbuffer[32] = WINPR_C_ARRAY_INIT;
1255 WLog_ERR(TAG, "securityFlags=%s, missing required flag %s",
1256 rdp_security_flag_string(securityFlags, buffer, sizeof(buffer)),
1257 rdp_security_flag_string(SEC_LICENSE_PKT, lbuffer, sizeof(lbuffer)));
1258 return STATE_RUN_FAILED;
1259 }
1260
1261 status = license_recv(rdp->license, s);
1262
1263 if (state_run_failed(status))
1264 return status;
1265
1266 state = license_get_state(rdp->license);
1267 switch (state)
1268 {
1269 case LICENSE_STATE_ABORTED:
1270 WLog_ERR(TAG, "license connection sequence aborted.");
1271 return STATE_RUN_FAILED;
1272 case LICENSE_STATE_COMPLETED:
1273 if (rdp->settings->MultitransportFlags)
1274 {
1275 if (!rdp_client_transition_to_state(
1276 rdp, CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST))
1277 return STATE_RUN_FAILED;
1278 }
1279 else
1280 {
1281 if (!rdp_client_transition_to_state(
1282 rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1283 return STATE_RUN_FAILED;
1284 }
1285 return STATE_RUN_SUCCESS;
1286 default:
1287 return STATE_RUN_SUCCESS;
1288 }
1289}
1290
1291state_run_t rdp_client_connect_demand_active(rdpRdp* rdp, wStream* s)
1292{
1293 UINT16 length = 0;
1294 UINT16 channelId = 0;
1295 UINT16 pduType = 0;
1296 UINT16 pduSource = 0;
1297
1298 WINPR_ASSERT(rdp);
1299 WINPR_ASSERT(s);
1300 WINPR_ASSERT(rdp->settings);
1301
1302 if (!rdp_recv_get_active_header(rdp, s, &channelId, &length))
1303 return STATE_RUN_FAILED;
1304
1305 if (freerdp_shall_disconnect_context(rdp->context))
1306 return STATE_RUN_QUIT_SESSION;
1307
1308 if (rdp->mcs->messageChannelId && (channelId == rdp->mcs->messageChannelId))
1309 {
1310 rdp->inPackets++;
1311 return rdp_handle_message_channel(rdp, s, channelId, length);
1312 }
1313
1314 if (!rdp_handle_optional_rdp_decryption(rdp, s, &length, nullptr))
1315 return STATE_RUN_FAILED;
1316
1317 if (!rdp_read_share_control_header(rdp, s, nullptr, nullptr, &pduType, &pduSource))
1318 return STATE_RUN_FAILED;
1319
1320 switch (pduType)
1321 {
1322 case PDU_TYPE_DEMAND_ACTIVE:
1323 if (!rdp_recv_demand_active(rdp, s, pduSource, length))
1324 return STATE_RUN_FAILED;
1325 return STATE_RUN_ACTIVE;
1326 default:
1327 return rdp_recv_out_of_sequence_pdu(rdp, s, pduType, length);
1328 }
1329}
1330
1331state_run_t rdp_client_connect_finalize(rdpRdp* rdp)
1332{
1333 WINPR_ASSERT(rdp);
1340 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC))
1341 return STATE_RUN_FAILED;
1342
1343 if (!rdp_send_client_synchronize_pdu(rdp))
1344 return STATE_RUN_FAILED;
1345
1346 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_COOPERATE))
1347 return STATE_RUN_FAILED;
1348 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_COOPERATE))
1349 return STATE_RUN_FAILED;
1350
1351 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL))
1352 return STATE_RUN_FAILED;
1353 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_REQUEST_CONTROL))
1354 return STATE_RUN_FAILED;
1355
1363 if (!rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE) &&
1364 freerdp_settings_get_bool(rdp->settings, FreeRDP_BitmapCachePersistEnabled))
1365 {
1366 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST))
1367 return STATE_RUN_FAILED;
1368 if (!rdp_send_client_persistent_key_list_pdu(rdp))
1369 return STATE_RUN_FAILED;
1370 }
1371
1372 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_FONT_LIST))
1373 return STATE_RUN_FAILED;
1374 if (!rdp_send_client_font_list_pdu(rdp, FONTLIST_FIRST | FONTLIST_LAST))
1375 return STATE_RUN_FAILED;
1376
1377 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1378 return STATE_RUN_FAILED;
1379 return STATE_RUN_SUCCESS;
1380}
1381
1382BOOL rdp_client_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1383{
1384 const char* name = rdp_state_string(state);
1385
1386 WINPR_ASSERT(rdp);
1387 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp), name);
1388
1389 if (!rdp_set_state(rdp, state))
1390 return FALSE;
1391
1392 switch (state)
1393 {
1394 case CONNECTION_STATE_FINALIZATION_SYNC:
1395 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1396 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1397 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1398 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1399 update_reset_state(rdp->update);
1400 break;
1401
1402 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
1403 {
1404 ActivatedEventArgs activatedEvent = WINPR_C_ARRAY_INIT;
1405 rdpContext* context = rdp->context;
1406 EventArgsInit(&activatedEvent, "libfreerdp");
1407 activatedEvent.firstActivation =
1408 !rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1409 PubSub_OnActivated(rdp->pubSub, context, &activatedEvent);
1410 }
1411
1412 break;
1413
1414 default:
1415 break;
1416 }
1417
1418 {
1419 ConnectionStateChangeEventArgs stateEvent = WINPR_C_ARRAY_INIT;
1420 rdpContext* context = rdp->context;
1421 EventArgsInit(&stateEvent, "libfreerdp");
1422 stateEvent.state = WINPR_ASSERTING_INT_CAST(int32_t, rdp_get_state(rdp));
1423 stateEvent.active = rdp_is_active_state(rdp);
1424 PubSub_OnConnectionStateChange(rdp->pubSub, context, &stateEvent);
1425 }
1426
1427 return TRUE;
1428}
1429
1430BOOL rdp_server_accept_nego(rdpRdp* rdp, wStream* s)
1431{
1432 UINT32 SelectedProtocol = 0;
1433 UINT32 RequestedProtocols = 0;
1434 BOOL status = 0;
1435 rdpSettings* settings = nullptr;
1436 rdpNego* nego = nullptr;
1437
1438 WINPR_ASSERT(rdp);
1439 WINPR_ASSERT(s);
1440
1441 settings = rdp->settings;
1442 WINPR_ASSERT(settings);
1443
1444 nego = rdp->nego;
1445 WINPR_ASSERT(nego);
1446
1447 if (!transport_set_blocking_mode(rdp->transport, TRUE))
1448 return FALSE;
1449
1450 if (!nego_read_request(nego, s))
1451 return FALSE;
1452
1453 RequestedProtocols = nego_get_requested_protocols(nego);
1454 WLog_DBG(TAG, "Client Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1455 (RequestedProtocols & PROTOCOL_RDSTLS) ? 1 : 0,
1456 (RequestedProtocols & PROTOCOL_HYBRID) ? 1 : 0,
1457 (RequestedProtocols & PROTOCOL_SSL) ? 1 : 0,
1458 (RequestedProtocols == PROTOCOL_RDP) ? 1 : 0);
1459 WLog_DBG(TAG,
1460 "Server Security: RDSTLS:%" PRId32 " NLA:%" PRId32 " TLS:%" PRId32 " RDP:%" PRId32 "",
1461 settings->RdstlsSecurity, settings->NlaSecurity, settings->TlsSecurity,
1462 settings->RdpSecurity);
1463
1464 if ((settings->RdstlsSecurity) && (RequestedProtocols & PROTOCOL_RDSTLS))
1465 {
1466 SelectedProtocol = PROTOCOL_RDSTLS;
1467 }
1468 else if ((settings->NlaSecurity) && (RequestedProtocols & PROTOCOL_HYBRID))
1469 {
1470 SelectedProtocol = PROTOCOL_HYBRID;
1471 }
1472 else if ((settings->TlsSecurity) && (RequestedProtocols & PROTOCOL_SSL))
1473 {
1474 SelectedProtocol = PROTOCOL_SSL;
1475 }
1476 else if ((settings->RdpSecurity) && (RequestedProtocols == PROTOCOL_RDP))
1477 {
1478 SelectedProtocol = PROTOCOL_RDP;
1479 }
1480 else
1481 {
1482 /*
1483 * when here client and server aren't compatible, we select the right
1484 * error message to return to the client in the nego failure packet
1485 */
1486 SelectedProtocol = PROTOCOL_FAILED_NEGO;
1487
1488 if (settings->RdpSecurity)
1489 {
1490 WLog_ERR(TAG, "server supports only Standard RDP Security");
1491 SelectedProtocol |= SSL_NOT_ALLOWED_BY_SERVER;
1492 }
1493 else
1494 {
1495 if (settings->NlaSecurity && !settings->TlsSecurity)
1496 {
1497 WLog_WARN(TAG, "server supports only NLA Security");
1498 SelectedProtocol |= HYBRID_REQUIRED_BY_SERVER;
1499 }
1500 else
1501 {
1502 WLog_WARN(TAG, "server supports only a SSL based Security (TLS or NLA)");
1503 SelectedProtocol |= SSL_REQUIRED_BY_SERVER;
1504 }
1505 }
1506
1507 WLog_ERR(TAG, "Protocol security negotiation failure");
1508 }
1509
1510 if (!(SelectedProtocol & PROTOCOL_FAILED_NEGO))
1511 {
1512 WLog_DBG(TAG, "Negotiated Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1513 (SelectedProtocol & PROTOCOL_RDSTLS) ? 1 : 0,
1514 (SelectedProtocol & PROTOCOL_HYBRID) ? 1 : 0,
1515 (SelectedProtocol & PROTOCOL_SSL) ? 1 : 0,
1516 (SelectedProtocol == PROTOCOL_RDP) ? 1 : 0);
1517 }
1518
1519 if (!nego_set_selected_protocol(nego, SelectedProtocol))
1520 return FALSE;
1521
1522 if (!nego_send_negotiation_response(nego))
1523 return FALSE;
1524
1525 SelectedProtocol = nego_get_selected_protocol(nego);
1526 status = FALSE;
1527
1528 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_VmConnectMode) &&
1529 SelectedProtocol != PROTOCOL_RDP)
1530 /* When behind a Hyper-V proxy, security != RDP is handled by the host. */
1531 status = TRUE;
1532 else if (SelectedProtocol & PROTOCOL_RDSTLS)
1533 status = transport_accept_rdstls(rdp->transport);
1534 else if (SelectedProtocol & PROTOCOL_HYBRID)
1535 status = transport_accept_nla(rdp->transport);
1536 else if (SelectedProtocol & PROTOCOL_SSL)
1537 status = transport_accept_tls(rdp->transport);
1538 else if (SelectedProtocol == PROTOCOL_RDP) /* 0 */
1539 status = transport_accept_rdp(rdp->transport);
1540
1541 if (!status)
1542 return FALSE;
1543
1544 return transport_set_blocking_mode(rdp->transport, FALSE);
1545}
1546
1547static BOOL rdp_update_encryption_level(rdpSettings* settings)
1548{
1549 WINPR_ASSERT(settings);
1550
1551 UINT32 EncryptionLevel = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionLevel);
1552 UINT32 EncryptionMethods = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionMethods);
1553
1564 if (!settings->UseRdpSecurityLayer)
1565 {
1566 /* TLS/NLA is used: disable rdp style encryption */
1567 EncryptionLevel = ENCRYPTION_LEVEL_NONE;
1568 }
1569 else
1570 {
1571 /* verify server encryption level value */
1572 switch (EncryptionLevel)
1573 {
1574 case ENCRYPTION_LEVEL_NONE:
1575 WLog_INFO(TAG, "Active rdp encryption level: NONE");
1576 break;
1577
1578 case ENCRYPTION_LEVEL_FIPS:
1579 WLog_INFO(TAG, "Active rdp encryption level: FIPS Compliant");
1580 break;
1581
1582 case ENCRYPTION_LEVEL_HIGH:
1583 WLog_INFO(TAG, "Active rdp encryption level: HIGH");
1584 break;
1585
1586 case ENCRYPTION_LEVEL_LOW:
1587 WLog_INFO(TAG, "Active rdp encryption level: LOW");
1588 break;
1589
1590 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1591 WLog_INFO(TAG, "Active rdp encryption level: CLIENT-COMPATIBLE");
1592 break;
1593
1594 default:
1595 WLog_ERR(TAG, "Invalid server encryption level 0x%08" PRIX32 "", EncryptionLevel);
1596 WLog_ERR(TAG, "Switching to encryption level CLIENT-COMPATIBLE");
1597 EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
1598 }
1599 }
1600
1601 /* choose rdp encryption method based on server level and client methods */
1602 switch (EncryptionLevel)
1603 {
1604 case ENCRYPTION_LEVEL_NONE:
1605 /* The only valid method is NONE in this case */
1606 EncryptionMethods = ENCRYPTION_METHOD_NONE;
1607 break;
1608
1609 case ENCRYPTION_LEVEL_FIPS:
1610
1611 /* The only valid method is FIPS in this case */
1612 if (!(EncryptionMethods & ENCRYPTION_METHOD_FIPS))
1613 {
1614 WLog_WARN(TAG, "client does not support FIPS as required by server configuration");
1615 }
1616
1617 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1618 break;
1619
1620 case ENCRYPTION_LEVEL_HIGH:
1621
1622 /* Maximum key strength supported by the server must be used (128 bit)*/
1623 if (!(EncryptionMethods & ENCRYPTION_METHOD_128BIT))
1624 {
1625 WLog_WARN(TAG, "client does not support 128 bit encryption method as required by "
1626 "server configuration");
1627 }
1628
1629 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1630 break;
1631
1632 case ENCRYPTION_LEVEL_LOW:
1633 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1634
1635 /* Maximum key strength supported by the client must be used */
1636 if (EncryptionMethods & ENCRYPTION_METHOD_128BIT)
1637 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1638 else if (EncryptionMethods & ENCRYPTION_METHOD_56BIT)
1639 EncryptionMethods = ENCRYPTION_METHOD_56BIT;
1640 else if (EncryptionMethods & ENCRYPTION_METHOD_40BIT)
1641 EncryptionMethods = ENCRYPTION_METHOD_40BIT;
1642 else if (EncryptionMethods & ENCRYPTION_METHOD_FIPS)
1643 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1644 else
1645 {
1646 WLog_WARN(TAG, "client has not announced any supported encryption methods");
1647 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1648 }
1649
1650 break;
1651
1652 default:
1653 WLog_ERR(TAG, "internal error: unknown encryption level");
1654 return FALSE;
1655 }
1656
1657 /* log selected encryption method */
1658 if (settings->UseRdpSecurityLayer)
1659 {
1660 switch (EncryptionMethods)
1661 {
1662 case ENCRYPTION_METHOD_NONE:
1663 WLog_INFO(TAG, "Selected rdp encryption method: NONE");
1664 break;
1665
1666 case ENCRYPTION_METHOD_40BIT:
1667 WLog_INFO(TAG, "Selected rdp encryption method: 40BIT");
1668 break;
1669
1670 case ENCRYPTION_METHOD_56BIT:
1671 WLog_INFO(TAG, "Selected rdp encryption method: 56BIT");
1672 break;
1673
1674 case ENCRYPTION_METHOD_128BIT:
1675 WLog_INFO(TAG, "Selected rdp encryption method: 128BIT");
1676 break;
1677
1678 case ENCRYPTION_METHOD_FIPS:
1679 WLog_INFO(TAG, "Selected rdp encryption method: FIPS");
1680 break;
1681
1682 default:
1683 WLog_ERR(TAG, "internal error: unknown encryption method");
1684 return FALSE;
1685 }
1686 }
1687
1688 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionLevel, EncryptionLevel))
1689 return FALSE;
1690 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionMethods, EncryptionMethods))
1691 return FALSE;
1692 return TRUE;
1693}
1694
1695BOOL rdp_server_accept_mcs_connect_initial(rdpRdp* rdp, wStream* s)
1696{
1697 WINPR_ASSERT(rdp);
1698 WINPR_ASSERT(s);
1699
1700 rdpMcs* mcs = rdp->mcs;
1701 WINPR_ASSERT(mcs);
1702
1703 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CREATE_REQUEST);
1704 if (!mcs_recv_connect_initial(mcs, s))
1705 return FALSE;
1706 WINPR_ASSERT(rdp->settings);
1707
1708 if (!mcs_server_apply_to_settings(mcs, rdp->settings))
1709 return FALSE;
1710
1711 WLog_DBG(TAG, "Accepted client: %s", rdp->settings->ClientHostname);
1712 WLog_DBG(TAG, "Accepted channels:");
1713
1714 WINPR_ASSERT(mcs->channels || (mcs->channelCount == 0));
1715 for (UINT32 i = 0; i < mcs->channelCount; i++)
1716 {
1717 ADDIN_ARGV* arg = nullptr;
1718 rdpMcsChannel* cur = &mcs->channels[i];
1719 const char* params[1] = { cur->Name };
1720 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1721 arg = freerdp_addin_argv_new(ARRAYSIZE(params), params);
1722 if (!arg)
1723 return FALSE;
1724
1725 if (!freerdp_static_channel_collection_add(rdp->settings, arg))
1726 {
1727 freerdp_addin_argv_free(arg);
1728 return FALSE;
1729 }
1730 }
1731
1732 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_RESPONSE))
1733 return FALSE;
1734 if (!rdp_update_encryption_level(rdp->settings))
1735 return FALSE;
1736 if (!mcs_send_connect_response(mcs))
1737 return FALSE;
1738 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ERECT_DOMAIN))
1739 return FALSE;
1740
1741 return TRUE;
1742}
1743
1744BOOL rdp_server_accept_mcs_erect_domain_request(rdpRdp* rdp, wStream* s)
1745{
1746 WINPR_ASSERT(rdp);
1747 WINPR_ASSERT(s);
1748 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_ERECT_DOMAIN);
1749
1750 if (!mcs_recv_erect_domain_request(rdp->mcs, s))
1751 return FALSE;
1752
1753 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER);
1754}
1755
1756static BOOL rdp_server_skip_mcs_channel_join(rdpRdp* rdp)
1757{
1758 WINPR_ASSERT(rdp);
1759
1760 rdpMcs* mcs = rdp->mcs;
1761 WINPR_ASSERT(mcs);
1762
1763 mcs->userChannelJoined = TRUE;
1764 mcs->globalChannelJoined = TRUE;
1765 mcs->messageChannelJoined = TRUE;
1766
1767 for (UINT32 i = 0; i < mcs->channelCount; i++)
1768 {
1769 rdpMcsChannel* cur = &mcs->channels[i];
1770 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1771 cur->joined = TRUE;
1772 }
1773 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT);
1774}
1775
1776BOOL rdp_server_accept_mcs_attach_user_request(rdpRdp* rdp, wStream* s)
1777{
1778 if (!mcs_recv_attach_user_request(rdp->mcs, s))
1779 return FALSE;
1780
1781 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM))
1782 return FALSE;
1783
1784 if (!mcs_send_attach_user_confirm(rdp->mcs))
1785 return FALSE;
1786
1787 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_SupportSkipChannelJoin))
1788 return rdp_server_skip_mcs_channel_join(rdp);
1789 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1790}
1791
1792BOOL rdp_server_accept_mcs_channel_join_request(rdpRdp* rdp, wStream* s)
1793{
1794 UINT16 channelId = 0;
1795 BOOL allJoined = TRUE;
1796 rdpMcs* mcs = nullptr;
1797
1798 WINPR_ASSERT(rdp);
1799 WINPR_ASSERT(rdp->context);
1800
1801 mcs = rdp->mcs;
1802 WINPR_ASSERT(mcs);
1803
1804 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1805
1806 if (!mcs_recv_channel_join_request(mcs, rdp->settings, s, &channelId))
1807 return FALSE;
1808
1809 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1810 return FALSE;
1811
1812 if (!mcs_send_channel_join_confirm(mcs, channelId))
1813 return FALSE;
1814
1815 if (channelId == mcs->userId)
1816 mcs->userChannelJoined = TRUE;
1817 if (channelId == MCS_GLOBAL_CHANNEL_ID)
1818 mcs->globalChannelJoined = TRUE;
1819 if (channelId == mcs->messageChannelId)
1820 mcs->messageChannelJoined = TRUE;
1821
1822 for (UINT32 i = 0; i < mcs->channelCount; i++)
1823 {
1824 rdpMcsChannel* cur = &mcs->channels[i];
1825 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1826 if (cur->ChannelId == channelId)
1827 cur->joined = TRUE;
1828
1829 if (!cur->joined)
1830 allJoined = FALSE;
1831 }
1832
1833 CONNECTION_STATE rc = CONNECTION_STATE_INITIAL;
1834 if ((mcs->userChannelJoined) && (mcs->globalChannelJoined) &&
1835 (mcs->messageChannelId == 0 || mcs->messageChannelJoined) && allJoined)
1836 rc = CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT;
1837 else
1838 rc = CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST;
1839
1840 return rdp_server_transition_to_state(rdp, rc);
1841}
1842
1843static BOOL rdp_server_send_sync(rdpRdp* rdp)
1844{
1845 WINPR_ASSERT(rdp);
1846
1847 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1848 return FALSE;
1849 if (!rdp_send_server_synchronize_pdu(rdp))
1850 return FALSE;
1851 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE))
1852 return FALSE;
1853 if (!rdp_send_server_control_cooperate_pdu(rdp))
1854 return FALSE;
1855 if (!rdp_finalize_reset_flags(rdp, FALSE))
1856 return FALSE;
1857 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC);
1858}
1859
1860BOOL rdp_server_accept_confirm_active(rdpRdp* rdp, wStream* s, UINT16 pduLength)
1861{
1862 WINPR_ASSERT(rdp);
1863 WINPR_ASSERT(rdp->context);
1864 WINPR_ASSERT(rdp->settings);
1865 WINPR_ASSERT(s);
1866
1867 freerdp_peer* peer = rdp->context->peer;
1868 WINPR_ASSERT(peer);
1869
1870 if (rdp_get_state(rdp) != CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE)
1871 {
1872 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_TransportDumpReplay))
1873 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1874 else
1875 {
1876 WLog_WARN(TAG, "Invalid state, got %s, expected %s", rdp_get_state_string(rdp),
1877 rdp_state_string(CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE));
1878 return FALSE;
1879 }
1880 }
1881
1882 if (!rdp_recv_confirm_active(rdp, s, pduLength))
1883 return FALSE;
1884
1885 if (peer->ClientCapabilities && !peer->ClientCapabilities(peer))
1886 {
1887 WLog_WARN(TAG, "peer->ClientCapabilities failed");
1888 return FALSE;
1889 }
1890
1891 if (rdp->settings->SaltedChecksum)
1892 rdp->do_secure_checksum = TRUE;
1893
1894 return rdp_server_send_sync(rdp);
1895}
1896
1897BOOL rdp_server_reactivate(rdpRdp* rdp)
1898{
1899 freerdp_peer* client = nullptr;
1900
1901 if (rdp->context && rdp->context->peer)
1902 client = rdp->context->peer;
1903
1904 if (client)
1905 client->activated = FALSE;
1906
1907 if (!rdp_send_deactivate_all(rdp))
1908 return FALSE;
1909
1910 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1911 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1912 return FALSE;
1913
1914 state_run_t rc = rdp_peer_handle_state_demand_active(client);
1915 return state_run_success(rc);
1916}
1917
1918static BOOL rdp_is_active_peer_state(CONNECTION_STATE state)
1919{
1920 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1921 * 'upon receipt of the Font List PDU the server can start sending graphics
1922 * output to the client'
1923 */
1924 switch (state)
1925 {
1926 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1927 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1928 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1929 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1930 case CONNECTION_STATE_ACTIVE:
1931 return TRUE;
1932 default:
1933 return FALSE;
1934 }
1935}
1936
1937static BOOL rdp_is_active_client_state(CONNECTION_STATE state)
1938{
1939 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1940 * 'Once the client has sent the Confirm Active PDU, it can start sending
1941 * mouse and keyboard input to the server'
1942 */
1943 switch (state)
1944 {
1945 case CONNECTION_STATE_FINALIZATION_SYNC:
1946 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1947 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1948 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1949 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1950 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1951 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1952 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1953 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1954 case CONNECTION_STATE_ACTIVE:
1955 return TRUE;
1956 default:
1957 return FALSE;
1958 }
1959}
1960
1961BOOL rdp_is_active_state(const rdpRdp* rdp)
1962{
1963 WINPR_ASSERT(rdp);
1964 WINPR_ASSERT(rdp->context);
1965
1966 const CONNECTION_STATE state = rdp_get_state(rdp);
1967 if (freerdp_settings_get_bool(rdp->context->settings, FreeRDP_ServerMode))
1968 return rdp_is_active_peer_state(state);
1969 else
1970 return rdp_is_active_client_state(state);
1971}
1972
1973BOOL rdp_server_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1974{
1975 BOOL status = FALSE;
1976 freerdp_peer* client = nullptr;
1977 const CONNECTION_STATE cstate = rdp_get_state(rdp);
1978
1979 if (cstate >= CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT)
1980 {
1981 WINPR_ASSERT(rdp->context);
1982 client = rdp->context->peer;
1983 }
1984
1985 if (!rdp_is_active_peer_state(cstate))
1986 {
1987 if (client)
1988 client->activated = FALSE;
1989 }
1990
1991 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp),
1992 rdp_state_string(state));
1993 if (!rdp_set_state(rdp, state))
1994 goto fail;
1995
1996 status = TRUE;
1997fail:
1998 return status;
1999}
2000
2001const char* rdp_client_connection_state_string(UINT state)
2002{
2003 switch (state)
2004 {
2005 case CLIENT_STATE_INITIAL:
2006 return "CLIENT_STATE_INITIAL";
2007 case CLIENT_STATE_PRECONNECT_PASSED:
2008 return "CLIENT_STATE_PRECONNECT_PASSED";
2009 case CLIENT_STATE_POSTCONNECT_PASSED:
2010 return "CLIENT_STATE_POSTCONNECT_PASSED";
2011 default:
2012 return "UNKNOWN";
2013 }
2014}
2015
2016const char* rdp_state_string(CONNECTION_STATE state)
2017{
2018 switch (state)
2019 {
2020 case CONNECTION_STATE_INITIAL:
2021 return "CONNECTION_STATE_INITIAL";
2022 case CONNECTION_STATE_NEGO:
2023 return "CONNECTION_STATE_NEGO";
2024 case CONNECTION_STATE_NLA:
2025 return "CONNECTION_STATE_NLA";
2026 case CONNECTION_STATE_AAD:
2027 return "CONNECTION_STATE_AAD";
2028 case CONNECTION_STATE_MCS_CREATE_REQUEST:
2029 return "CONNECTION_STATE_MCS_CREATE_REQUEST";
2030 case CONNECTION_STATE_MCS_CREATE_RESPONSE:
2031 return "CONNECTION_STATE_MCS_CREATE_RESPONSE";
2032 case CONNECTION_STATE_MCS_ERECT_DOMAIN:
2033 return "CONNECTION_STATE_MCS_ERECT_DOMAIN";
2034 case CONNECTION_STATE_MCS_ATTACH_USER:
2035 return "CONNECTION_STATE_MCS_ATTACH_USER";
2036 case CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM:
2037 return "CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM";
2038 case CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST:
2039 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST";
2040 case CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE:
2041 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE";
2042 case CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT:
2043 return "CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT";
2044 case CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE:
2045 return "CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE";
2046 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST:
2047 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST";
2048 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE:
2049 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE";
2050 case CONNECTION_STATE_LICENSING:
2051 return "CONNECTION_STATE_LICENSING";
2052 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST:
2053 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST";
2054 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE:
2055 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE";
2056 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE:
2057 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE";
2058 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT:
2059 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT";
2060 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
2061 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE";
2062 case CONNECTION_STATE_FINALIZATION_SYNC:
2063 return "CONNECTION_STATE_FINALIZATION_SYNC";
2064 case CONNECTION_STATE_FINALIZATION_COOPERATE:
2065 return "CONNECTION_STATE_FINALIZATION_COOPERATE";
2066 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
2067 return "CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL";
2068 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
2069 return "CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST";
2070 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
2071 return "CONNECTION_STATE_FINALIZATION_FONT_LIST";
2072 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
2073 return "CONNECTION_STATE_FINALIZATION_CLIENT_SYNC";
2074 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
2075 return "CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE";
2076 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
2077 return "CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL";
2078 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
2079 return "CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP";
2080 case CONNECTION_STATE_ACTIVE:
2081 return "CONNECTION_STATE_ACTIVE";
2082 default:
2083 return "UNKNOWN";
2084 }
2085}
2086
2087CONNECTION_STATE rdp_get_state(const rdpRdp* rdp)
2088{
2089 WINPR_ASSERT(rdp);
2090 return rdp->state;
2091}
2092
2093BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state)
2094{
2095 WINPR_ASSERT(rdp);
2096 rdp->state = state;
2097 return TRUE;
2098}
2099
2100const char* rdp_get_state_string(const rdpRdp* rdp)
2101{
2102 CONNECTION_STATE state = rdp_get_state(rdp);
2103 return rdp_state_string(state);
2104}
2105
2106BOOL rdp_channels_from_mcs(rdpSettings* settings, const rdpRdp* rdp)
2107{
2108 const rdpMcs* mcs = nullptr;
2109
2110 WINPR_ASSERT(rdp);
2111
2112 mcs = rdp->mcs;
2113 WINPR_ASSERT(mcs);
2114
2115 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ChannelDefArray, nullptr,
2116 CHANNEL_MAX_COUNT))
2117 return FALSE;
2118
2119 for (UINT32 x = 0; x < mcs->channelCount; x++)
2120 {
2121 const rdpMcsChannel* mchannel = &mcs->channels[x];
2122 CHANNEL_DEF cur = WINPR_C_ARRAY_INIT;
2123
2124 memcpy(cur.name, mchannel->Name, sizeof(cur.name));
2125 cur.options = mchannel->options;
2126 if (!freerdp_settings_set_pointer_array(settings, FreeRDP_ChannelDefArray, x, &cur))
2127 return FALSE;
2128 }
2129
2130 return freerdp_settings_set_uint32(settings, FreeRDP_ChannelCount, mcs->channelCount);
2131}
2132
2133/* Here we are in client state CONFIRM_ACTIVE.
2134 *
2135 * This means:
2136 * 1. send the CONFIRM_ACTIVE PDU to the server
2137 * 2. register callbacks, the server can now start sending stuff
2138 */
2139state_run_t rdp_client_connect_confirm_active(rdpRdp* rdp, WINPR_ATTR_UNUSED wStream* s)
2140{
2141 WINPR_ASSERT(rdp);
2142 WINPR_ASSERT(rdp->settings);
2143 WINPR_ASSERT(s);
2144
2145 const UINT32 width = rdp->settings->DesktopWidth;
2146 const UINT32 height = rdp->settings->DesktopHeight;
2147
2148 if (!rdp_send_confirm_active(rdp))
2149 return STATE_RUN_FAILED;
2150
2151 if (!input_register_client_callbacks(rdp->input))
2152 {
2153 WLog_ERR(TAG, "error registering client callbacks");
2154 return STATE_RUN_FAILED;
2155 }
2156
2161 const BOOL deactivate_reactivate =
2162 rdp->was_deactivated && ((rdp->deactivated_width != rdp->settings->DesktopWidth) ||
2163 (rdp->deactivated_height != rdp->settings->DesktopHeight));
2164 const BOOL resolution_change =
2165 ((width != rdp->settings->DesktopWidth) || (height != rdp->settings->DesktopHeight));
2166 if (deactivate_reactivate || resolution_change)
2167 {
2168 BOOL status = TRUE;
2169 IFCALLRET(rdp->update->DesktopResize, status, rdp->update->context);
2170
2171 if (!status)
2172 {
2173 WLog_ERR(TAG, "client desktop resize callback failed");
2174 return STATE_RUN_FAILED;
2175 }
2176 }
2177
2178 WINPR_ASSERT(rdp->context);
2179 if (freerdp_shall_disconnect_context(rdp->context))
2180 return STATE_RUN_SUCCESS;
2181
2182 state_run_t status = STATE_RUN_SUCCESS;
2183 if (!rdp->settings->SupportMonitorLayoutPdu)
2184 status = rdp_client_connect_finalize(rdp);
2185 else
2186 {
2187 if (!rdp_client_transition_to_state(rdp,
2188 CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT))
2189 status = STATE_RUN_FAILED;
2190 }
2191 if (!rdp_finalize_reset_flags(rdp, FALSE))
2192 status = STATE_RUN_FAILED;
2193 return status;
2194}
2195
2196BOOL rdp_handle_optional_rdp_decryption(rdpRdp* rdp, wStream* s, UINT16* length,
2197 UINT16* pSecurityFlags)
2198{
2199 BOOL rc = FALSE;
2200 WINPR_ASSERT(rdp);
2201 WINPR_ASSERT(rdp->settings);
2202
2203 UINT16 securityFlags = 0;
2204 if (rdp->settings->UseRdpSecurityLayer)
2205 {
2206 if (!rdp_read_security_header(rdp, s, &securityFlags, length))
2207 goto fail;
2208
2209 if (securityFlags & SEC_ENCRYPT)
2210 {
2211 if (!rdp_decrypt(rdp, s, length, securityFlags))
2212 goto fail;
2213 }
2214 }
2215
2216 rc = TRUE;
2217
2218fail:
2219 if (pSecurityFlags)
2220 *pSecurityFlags = securityFlags;
2221 return rc;
2222}
freerdp_settings_get_pointer
WINPR_ATTR_NODISCARD FREERDP_API const void * freerdp_settings_get_pointer(const rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a immutable pointer settings value.
Definition common/settings.c:1414
freerdp_settings_set_uint32
FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 val)
Sets a UINT32 settings value.
freerdp_settings_get_string
WINPR_ATTR_NODISCARD FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
freerdp_settings_set_pointer_len
FREERDP_API BOOL freerdp_settings_set_pointer_len(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id, const void *data, size_t len)
Set a pointer to value data.
Definition common/settings.c:1426
freerdp_settings_get_pointer_writable
WINPR_ATTR_NODISCARD FREERDP_API void * freerdp_settings_get_pointer_writable(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a mutable pointer settings value.
Definition settings_getters.c:4088
freerdp_settings_get_codecs_flags
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_codecs_flags(const rdpSettings *settings)
helper function to get a mask of supported codec flags.
Definition common/settings.c:1994
freerdp_settings_get_uint32
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
freerdp_settings_get_bool
WINPR_ATTR_NODISCARD FREERDP_API BOOL freerdp_settings_get_bool(const rdpSettings *settings, FreeRDP_Settings_Keys_Bool id)
Returns a boolean settings value.
freerdp_settings_set_string
FREERDP_API BOOL freerdp_settings_set_string(rdpSettings *settings, FreeRDP_Settings_Keys_String id, const char *val)
Sets a string settings value. The param is copied.
Definition settings_getters.c:3729
ADDIN_ARGV
Definition settings_types.h:375
CHANNEL_DEF
Definition wtsapi.h:78