FreeRDP
Loading...
Searching...
No Matches
connection.c
1/*
2 * FreeRDP: A Remote Desktop Protocol Implementation
3 * Connection Sequence
4 *
5 * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
6 * Copyright 2015 Thincast Technologies GmbH
7 * Copyright 2015 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
8 * Copyright 2023 Armin Novak <anovak@thincast.com>
9 * Copyright 2023 Thincast Technologies GmbH
10 *
11 * Licensed under the Apache License, Version 2.0 (the "License");
12 * you may not use this file except in compliance with the License.
13 * You may obtain a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing, software
18 * distributed under the License is distributed on an "AS IS" BASIS,
19 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 * See the License for the specific language governing permissions and
21 * limitations under the License.
22 */
23
24#include <freerdp/config.h>
25
26#include "settings.h"
27
28#include "info.h"
29#include "input.h"
30#include "rdp.h"
31#include "peer.h"
32
33#include "connection.h"
34#include "transport.h"
35
36#include <winpr/crt.h>
37#include <winpr/crypto.h>
38#include <winpr/ssl.h>
39
40#include <freerdp/log.h>
41#include <freerdp/error.h>
42#include <freerdp/listener.h>
43
44#include "../cache/pointer.h"
45#include "../crypto/crypto.h"
46#include "../crypto/privatekey.h"
47#include "../crypto/certificate.h"
48#include "gateway/arm.h"
49
50#include "utils.h"
51
52#define TAG FREERDP_TAG("core.connection")
53
197static BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state);
198
199static BOOL rdp_client_reset_codecs(rdpContext* context)
200{
201 rdpSettings* settings = NULL;
202
203 if (!context || !context->settings)
204 return FALSE;
205
206 settings = context->settings;
207
208 if (!freerdp_settings_get_bool(settings, FreeRDP_DeactivateClientDecoding))
209 {
210 const UINT32 flags = freerdp_settings_get_uint32(settings, FreeRDP_ThreadingFlags);
211 freerdp_client_codecs_free(context->codecs);
212 context->codecs = freerdp_client_codecs_new(flags);
213
214 if (!context->codecs)
215 return FALSE;
216
217 if (!freerdp_client_codecs_prepare(context->codecs,
218 freerdp_settings_get_codecs_flags(settings),
219 settings->DesktopWidth, settings->DesktopHeight))
220 return FALSE;
221
222/* Runtime H264 detection. (only available if dynamic backend loading is defined)
223 * If no backend is available disable it before the channel is loaded.
224 */
225#if defined(WITH_GFX_H264) && defined(WITH_OPENH264_LOADING)
226 if (!context->codecs->h264)
227 {
228 settings->GfxH264 = FALSE;
229 settings->GfxAVC444 = FALSE;
230 settings->GfxAVC444v2 = FALSE;
231 }
232#endif
233 }
234
235 return TRUE;
236}
237
238static BOOL rdp_client_wait_for_activation(rdpRdp* rdp)
239{
240 BOOL timedout = FALSE;
241 WINPR_ASSERT(rdp);
242
243 const rdpSettings* settings = rdp->settings;
244 WINPR_ASSERT(settings);
245
246 UINT64 now = GetTickCount64();
247 UINT64 dueDate = now + freerdp_settings_get_uint32(settings, FreeRDP_TcpAckTimeout);
248
249 for (; (now < dueDate) && !timedout; now = GetTickCount64())
250 {
251 HANDLE events[MAXIMUM_WAIT_OBJECTS] = { 0 };
252 DWORD wstatus = 0;
253 DWORD nevents = freerdp_get_event_handles(rdp->context, events, ARRAYSIZE(events));
254 if (!nevents)
255 {
256 WLog_ERR(TAG, "error retrieving connection events");
257 return FALSE;
258 }
259
260 const UINT64 timeout = (dueDate - now);
261 WINPR_ASSERT(timeout <= UINT32_MAX);
262 wstatus = WaitForMultipleObjectsEx(nevents, events, FALSE, (UINT32)timeout, TRUE);
263 switch (wstatus)
264 {
265 case WAIT_TIMEOUT:
266 /* will make us quit with a timeout */
267 timedout = TRUE;
268 break;
269 case WAIT_ABANDONED:
270 case WAIT_FAILED:
271 return FALSE;
272 case WAIT_IO_COMPLETION:
273 break;
274 case WAIT_OBJECT_0:
275 default:
276 /* handles all WAIT_OBJECT_0 + [0 .. MAXIMUM_WAIT_OBJECTS-1] cases */
277 if (rdp_check_fds(rdp) < 0)
278 {
279 freerdp_set_last_error_if_not(rdp->context,
280 FREERDP_ERROR_CONNECT_TRANSPORT_FAILED);
281 return FALSE;
282 }
283 break;
284 }
285
286 if (rdp_is_active_state(rdp))
287 return TRUE;
288 }
289
290 WLog_ERR(TAG, "Timeout waiting for activation");
291 freerdp_set_last_error_if_not(rdp->context, FREERDP_ERROR_CONNECT_ACTIVATION_TIMEOUT);
292 return FALSE;
293}
301BOOL rdp_client_connect(rdpRdp* rdp)
302{
303 UINT32 SelectedProtocol = 0;
304 BOOL status = 0;
305 rdpSettings* settings = NULL;
306 /* make sure SSL is initialize for earlier enough for crypto, by taking advantage of winpr SSL
307 * FIPS flag for openssl initialization */
308 DWORD flags = WINPR_SSL_INIT_DEFAULT;
309
310 WINPR_ASSERT(rdp);
311
312 settings = rdp->settings;
313 WINPR_ASSERT(settings);
314
315 if (!rdp_client_reset_codecs(rdp->context))
316 return FALSE;
317
318 if (settings->FIPSMode)
319 flags |= WINPR_SSL_INIT_ENABLE_FIPS;
320
321 winpr_InitializeSSL(flags);
322 rdp_log_build_warnings(rdp);
323
324 /* FIPS Mode forces the following and overrides the following(by happening later */
325 /* in the command line processing): */
326 /* 1. Disables NLA Security since NLA in freerdp uses NTLM(no Kerberos support yet) which uses
327 * algorithms */
328 /* not allowed in FIPS for sensitive data. So, we disallow NLA when FIPS is required. */
329 /* 2. Forces the only supported RDP encryption method to be FIPS. */
330 if (settings->FIPSMode || winpr_FIPSMode())
331 {
332 settings->NlaSecurity = FALSE;
333 settings->EncryptionMethods = ENCRYPTION_METHOD_FIPS;
334 }
335
336 UINT32 TcpConnectTimeout = freerdp_settings_get_uint32(settings, FreeRDP_TcpConnectTimeout);
337 if (settings->GatewayArmTransport)
338 {
339 if (!arm_resolve_endpoint(rdp->log, rdp->context, TcpConnectTimeout))
340 {
341 WLog_ERR(TAG, "error retrieving ARM configuration");
342 return FALSE;
343 }
344 }
345
346 const char* hostname = settings->ServerHostname;
347 if (!hostname)
348 {
349 WLog_ERR(TAG, "Missing hostname, can not connect to NULL target");
350 return FALSE;
351 }
352
353 const UINT32 port = settings->ServerPort;
354 WINPR_ASSERT(port <= UINT32_MAX);
355
356 nego_init(rdp->nego);
357 nego_set_target(rdp->nego, hostname, (UINT16)port);
358
359 if (settings->GatewayEnabled)
360 {
361 char* user = NULL;
362 char* domain = NULL;
363 size_t user_length = 0;
364
365 if (settings->Username)
366 {
367 user = settings->Username;
368 user_length = strlen(settings->Username);
369 }
370
371 if (settings->Domain)
372 domain = settings->Domain;
373 else
374 domain = settings->ComputerName;
375
376 const size_t domain_length = strlen(domain);
377 const size_t cookie_length = domain_length + 1 + user_length;
378 char* cookie = malloc(cookie_length + 1);
379
380 if (!cookie)
381 return FALSE;
382
383 CopyMemory(cookie, domain, domain_length);
384 WINPR_ASSERT(domain_length <= UINT32_MAX);
385 CharUpperBuffA(cookie, (UINT32)domain_length);
386 cookie[domain_length] = '\\';
387
388 if (settings->Username)
389 CopyMemory(&cookie[domain_length + 1], user, user_length);
390
391 cookie[cookie_length] = '\0';
392 status = nego_set_cookie(rdp->nego, cookie);
393 free(cookie);
394 }
395 else
396 {
397 status = nego_set_cookie(rdp->nego, settings->Username);
398 }
399
400 if (!status)
401 return FALSE;
402
403 nego_set_childsession_enabled(rdp->nego, settings->ConnectChildSession);
404 nego_set_send_preconnection_pdu(rdp->nego, settings->SendPreconnectionPdu);
405 nego_set_preconnection_id(rdp->nego, settings->PreconnectionId);
406 nego_set_preconnection_blob(rdp->nego, settings->PreconnectionBlob);
407 nego_set_negotiation_enabled(rdp->nego, settings->NegotiateSecurityLayer);
408 nego_set_restricted_admin_mode_required(rdp->nego, settings->RestrictedAdminModeRequired);
409 nego_set_RCG_required(rdp->nego, settings->RemoteCredentialGuard);
410 nego_set_gateway_enabled(rdp->nego, settings->GatewayEnabled);
411 nego_set_gateway_bypass_local(rdp->nego, settings->GatewayBypassLocal);
412 nego_enable_rdp(rdp->nego, settings->RdpSecurity);
413 nego_enable_tls(rdp->nego, settings->TlsSecurity);
414 nego_enable_nla(rdp->nego, settings->NlaSecurity);
415 nego_enable_ext(rdp->nego, settings->ExtSecurity);
416 nego_enable_rdstls(rdp->nego, settings->RdstlsSecurity);
417 nego_enable_aad(rdp->nego, settings->AadSecurity);
418
419 if (settings->MstscCookieMode)
420 settings->CookieMaxLength = MSTSC_COOKIE_MAX_LENGTH;
421
422 nego_set_cookie_max_length(rdp->nego, settings->CookieMaxLength);
423
424 if (settings->LoadBalanceInfo && (settings->LoadBalanceInfoLength > 0))
425 {
426 if (!nego_set_routing_token(rdp->nego, settings->LoadBalanceInfo,
427 settings->LoadBalanceInfoLength))
428 return FALSE;
429 }
430
431 if (!freerdp_settings_get_bool(settings, FreeRDP_TransportDumpReplay))
432 {
433 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_NEGO))
434 return FALSE;
435
436 if (!nego_connect(rdp->nego))
437 {
438 if (!freerdp_get_last_error(rdp->context))
439 {
440 freerdp_set_last_error_log(rdp->context,
441 FREERDP_ERROR_SECURITY_NEGO_CONNECT_FAILED);
442 WLog_ERR(TAG, "Error: protocol security negotiation or connection failure");
443 }
444
445 return FALSE;
446 }
447
448 SelectedProtocol = nego_get_selected_protocol(rdp->nego);
449
450 if ((SelectedProtocol & PROTOCOL_SSL) || (SelectedProtocol == PROTOCOL_RDP) ||
451 (SelectedProtocol == PROTOCOL_RDSTLS))
452 {
453 wStream s = { 0 };
454
455 if ((settings->Username != NULL) &&
456 ((freerdp_settings_get_string(settings, FreeRDP_Password) != NULL) ||
457 (settings->RedirectionPassword != NULL &&
458 settings->RedirectionPasswordLength > 0)))
459 settings->AutoLogonEnabled = TRUE;
460
461 if (rdp_recv_callback(rdp->transport, &s, rdp) < 0)
462 return FALSE;
463 }
464
465 transport_set_blocking_mode(rdp->transport, FALSE);
466 }
467 else
468 {
469 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_REQUEST))
470 return FALSE;
471 }
472
473 /* everything beyond this point is event-driven and non blocking */
474 if (!transport_set_recv_callbacks(rdp->transport, rdp_recv_callback, rdp))
475 return FALSE;
476
477 return rdp_client_wait_for_activation(rdp);
478}
479
480BOOL rdp_client_disconnect(rdpRdp* rdp)
481{
482 rdpContext* context = NULL;
483
484 if (!rdp || !rdp->settings || !rdp->context)
485 return FALSE;
486
487 context = rdp->context;
488
489 if (rdp->nego)
490 {
491 if (!nego_disconnect(rdp->nego))
492 return FALSE;
493 }
494
495 if (!transport_disconnect(rdp->transport))
496 return FALSE;
497
498 if (!rdp_reset(rdp))
499 return FALSE;
500
501 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_INITIAL))
502 return FALSE;
503
504 if (freerdp_channels_disconnect(context->channels, context->instance) != CHANNEL_RC_OK)
505 return FALSE;
506
507 freerdp_client_codecs_free(context->codecs);
508 context->codecs = NULL;
509 return TRUE;
510}
511
512BOOL rdp_client_disconnect_and_clear(rdpRdp* rdp)
513{
514 rdpContext* context = NULL;
515
516 if (!rdp_client_disconnect(rdp))
517 return FALSE;
518
519 WINPR_ASSERT(rdp);
520
521 context = rdp->context;
522 WINPR_ASSERT(context);
523
524 if (freerdp_get_last_error(context) == FREERDP_ERROR_CONNECT_CANCELLED)
525 return FALSE;
526
527 context->LastError = FREERDP_ERROR_SUCCESS;
528 clearChannelError(context);
529 return utils_reset_abort(rdp);
530}
531
532static BOOL rdp_client_reconnect_channels(rdpRdp* rdp, BOOL redirect)
533{
534 BOOL status = FALSE;
535 rdpContext* context = NULL;
536
537 if (!rdp || !rdp->context || !rdp->context->channels)
538 return FALSE;
539
540 context = rdp->context;
541
542 if (context->instance->ConnectionCallbackState == CLIENT_STATE_INITIAL)
543 return FALSE;
544
545 if (context->instance->ConnectionCallbackState == CLIENT_STATE_PRECONNECT_PASSED)
546 {
547 if (redirect)
548 return TRUE;
549
550 pointer_cache_register_callbacks(context->update);
551
552 if (!IFCALLRESULT(FALSE, context->instance->PostConnect, context->instance))
553 return FALSE;
554
555 context->instance->ConnectionCallbackState = CLIENT_STATE_POSTCONNECT_PASSED;
556 }
557
558 if (context->instance->ConnectionCallbackState == CLIENT_STATE_POSTCONNECT_PASSED)
559 status =
560 (freerdp_channels_post_connect(context->channels, context->instance) == CHANNEL_RC_OK);
561
562 return status;
563}
564
565static BOOL rdp_client_redirect_resolvable(const char* host)
566{
567 struct addrinfo* result = freerdp_tcp_resolve_host(host, -1, 0);
568
569 if (!result)
570 return FALSE;
571
572 freeaddrinfo(result);
573 return TRUE;
574}
575
576static BOOL rdp_client_redirect_try_fqdn(rdpSettings* settings)
577{
578 if (settings->RedirectionFlags & LB_TARGET_FQDN)
579 {
580 if (settings->GatewayEnabled ||
581 rdp_client_redirect_resolvable(settings->RedirectionTargetFQDN))
582 {
583 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
584 settings->RedirectionTargetFQDN))
585 return FALSE;
586
587 return TRUE;
588 }
589 }
590
591 return FALSE;
592}
593
594static BOOL rdp_client_redirect_try_ip(rdpSettings* settings)
595{
596 if (settings->RedirectionFlags & LB_TARGET_NET_ADDRESS)
597 {
598 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
599 settings->TargetNetAddress))
600 return FALSE;
601
602 return TRUE;
603 }
604
605 return FALSE;
606}
607
608static BOOL rdp_client_redirect_try_netbios(rdpSettings* settings)
609{
610 if (settings->RedirectionFlags & LB_TARGET_NETBIOS_NAME)
611 {
612 if (settings->GatewayEnabled ||
613 rdp_client_redirect_resolvable(settings->RedirectionTargetNetBiosName))
614 {
615 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
616 settings->RedirectionTargetNetBiosName))
617 return FALSE;
618
619 return TRUE;
620 }
621 }
622
623 return FALSE;
624}
625
626BOOL rdp_client_redirect(rdpRdp* rdp)
627{
628 BOOL status = 0;
629 rdpSettings* settings = NULL;
630
631 if (!rdp_client_disconnect_and_clear(rdp))
632 return FALSE;
633
634 /* Only disconnect & close the channels here.
635 * they will be discarded and recreated after the new settings have been applied. */
636 freerdp_channels_disconnect(rdp->context->channels, rdp->context->instance);
637 freerdp_channels_close(rdp->context->channels, rdp->context->instance);
638
639 if (rdp_redirection_apply_settings(rdp) != 0)
640 return FALSE;
641
642 WINPR_ASSERT(rdp);
643
644 settings = rdp->settings;
645 WINPR_ASSERT(settings);
646
647 if ((settings->RedirectionFlags & LB_LOAD_BALANCE_INFO) == 0)
648 {
649 BOOL haveRedirectAddress = FALSE;
650 UINT32 redirectionMask = settings->RedirectionPreferType;
651
652 do
653 {
654 const BOOL tryFQDN = (redirectionMask & 0x01) == 0;
655 const BOOL tryNetAddress = (redirectionMask & 0x02) == 0;
656 const BOOL tryNetbios = (redirectionMask & 0x04) == 0;
657
658 if (tryFQDN && !haveRedirectAddress)
659 haveRedirectAddress = rdp_client_redirect_try_fqdn(settings);
660
661 if (tryNetAddress && !haveRedirectAddress)
662 haveRedirectAddress = rdp_client_redirect_try_ip(settings);
663
664 if (tryNetbios && !haveRedirectAddress)
665 haveRedirectAddress = rdp_client_redirect_try_netbios(settings);
666
667 redirectionMask >>= 3;
668 } while (!haveRedirectAddress && (redirectionMask != 0));
669 }
670
671 if (settings->RedirectionFlags & LB_USERNAME)
672 {
673 if (!freerdp_settings_set_string(
674 settings, FreeRDP_Username,
675 freerdp_settings_get_string(settings, FreeRDP_RedirectionUsername)))
676 return FALSE;
677 }
678
679 if (settings->RedirectionFlags & LB_DOMAIN)
680 {
681 if (!freerdp_settings_set_string(
682 settings, FreeRDP_Domain,
683 freerdp_settings_get_string(settings, FreeRDP_RedirectionDomain)))
684 return FALSE;
685 }
686
687 settings->RdstlsSecurity =
688 (settings->RedirectionFlags & LB_PASSWORD_IS_PK_ENCRYPTED) != 0 ? TRUE : FALSE;
689
690 WINPR_ASSERT(rdp->context);
691 WINPR_ASSERT(rdp->context->instance);
692 if (!IFCALLRESULT(TRUE, rdp->context->instance->Redirect, rdp->context->instance))
693 return FALSE;
694
695 BOOL ok = utils_reload_channels(rdp->context);
696 if (!ok)
697 return FALSE;
698
699 status = rdp_client_connect(rdp);
700
701 if (status)
702 status = rdp_client_reconnect_channels(rdp, TRUE);
703
704 return status;
705}
706
707BOOL rdp_client_reconnect(rdpRdp* rdp)
708{
709 BOOL status = 0;
710
711 if (!rdp_client_disconnect_and_clear(rdp))
712 return FALSE;
713
714 status = rdp_client_connect(rdp);
715
716 if (status)
717 status = rdp_client_reconnect_channels(rdp, FALSE);
718
719 return status;
720}
721
722static const BYTE fips_ivec[8] = { 0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF };
723
724static BOOL rdp_client_establish_keys(rdpRdp* rdp)
725{
726 wStream* s = NULL;
727 int status = 0;
728 BOOL ret = FALSE;
729
730 WINPR_ASSERT(rdp);
731 rdpSettings* settings = rdp->settings;
732 BYTE* crypt_client_random = NULL;
733
734 WINPR_ASSERT(settings);
735 if (!settings->UseRdpSecurityLayer)
736 {
737 /* no RDP encryption */
738 return TRUE;
739 }
740
741 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT))
742 return FALSE;
743
744 /* encrypt client random */
745 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, NULL,
746 CLIENT_RANDOM_LENGTH))
747 return FALSE;
748 winpr_RAND(settings->ClientRandom, settings->ClientRandomLength);
749
750 const rdpCertInfo* info = freerdp_certificate_get_info(settings->RdpServerCertificate);
751 if (!info)
752 {
753 WLog_ERR(TAG, "Failed to get rdpCertInfo from RdpServerCertificate");
754 return FALSE;
755 }
756
757 /*
758 * client random must be (bitlen / 8) + 8 - see [MS-RDPBCGR] 5.3.4.1
759 * for details
760 */
761 crypt_client_random = calloc(info->ModulusLength, 1);
762
763 if (!crypt_client_random)
764 return FALSE;
765
766 crypto_rsa_public_encrypt(settings->ClientRandom, settings->ClientRandomLength, info,
767 crypt_client_random, info->ModulusLength);
768 /* send crypt client random to server */
769 const size_t length = RDP_PACKET_HEADER_MAX_LENGTH + RDP_SECURITY_HEADER_LENGTH + 4ULL +
770 info->ModulusLength + 8ULL;
771 if (length > UINT16_MAX)
772 return FALSE;
773
774 s = Stream_New(NULL, length);
775
776 if (!s)
777 {
778 WLog_ERR(TAG, "Stream_New failed!");
779 goto end;
780 }
781
782 UINT16 sec_flags = SEC_EXCHANGE_PKT | SEC_LICENSE_ENCRYPT_SC;
783 if (!rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID, sec_flags))
784 goto end;
785 if (!rdp_write_security_header(rdp, s, sec_flags))
786 goto end;
787
788 Stream_Write_UINT32(s, info->ModulusLength + 8);
789 Stream_Write(s, crypt_client_random, info->ModulusLength);
790 Stream_Zero(s, 8);
791 Stream_SealLength(s);
792 status = transport_write(rdp->mcs->transport, s);
793
794 if (status < 0)
795 goto end;
796
797 rdp->do_crypt_license = TRUE;
798
799 /* now calculate encrypt / decrypt and update keys */
800 if (!security_establish_keys(rdp))
801 goto end;
802
803 rdp->do_crypt = TRUE;
804
805 if (settings->SaltedChecksum)
806 rdp->do_secure_checksum = TRUE;
807
808 if (settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
809 {
810 rdp->fips_encrypt =
811 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
812 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
813
814 if (!rdp->fips_encrypt)
815 {
816 WLog_ERR(TAG, "unable to allocate des3 encrypt key");
817 goto end;
818 }
819
820 rdp->fips_decrypt =
821 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
822 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
823
824 if (!rdp->fips_decrypt)
825 {
826 WLog_ERR(TAG, "unable to allocate des3 decrypt key");
827 goto end;
828 }
829
830 ret = TRUE;
831 goto end;
832 }
833
834 if (!rdp_reset_rc4_encrypt_keys(rdp))
835 goto end;
836 if (!rdp_reset_rc4_decrypt_keys(rdp))
837 goto end;
838
839 ret = TRUE;
840end:
841 Stream_Free(s, TRUE);
842 free(crypt_client_random);
843
844 if (!ret)
845 {
846 winpr_Cipher_Free(rdp->fips_decrypt);
847 winpr_Cipher_Free(rdp->fips_encrypt);
848 rdp->fips_decrypt = NULL;
849 rdp->fips_encrypt = NULL;
850
851 rdp_free_rc4_decrypt_keys(rdp);
852 rdp_free_rc4_encrypt_keys(rdp);
853 }
854
855 return ret;
856}
857
858static BOOL rdp_update_client_random(rdpSettings* settings, const BYTE* crypt_random,
859 size_t crypt_random_len)
860{
861 const size_t length = 32;
862 WINPR_ASSERT(settings);
863
864 const rdpPrivateKey* rsa = freerdp_settings_get_pointer(settings, FreeRDP_RdpServerRsaKey);
865 WINPR_ASSERT(rsa);
866
867 const rdpCertInfo* cinfo = freerdp_key_get_info(rsa);
868 WINPR_ASSERT(cinfo);
869
870 if (crypt_random_len != cinfo->ModulusLength + 8)
871 {
872 WLog_ERR(TAG, "invalid encrypted client random length");
873 return FALSE;
874 }
875 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, NULL, length))
876 return FALSE;
877
878 BYTE* client_random = freerdp_settings_get_pointer_writable(settings, FreeRDP_ClientRandom);
879 WINPR_ASSERT(client_random);
880 return crypto_rsa_private_decrypt(crypt_random, crypt_random_len - 8, rsa, client_random,
881 length) > 0;
882}
883
884BOOL rdp_server_establish_keys(rdpRdp* rdp, wStream* s)
885{
886 UINT32 rand_len = 0;
887 UINT16 channel_id = 0;
888 UINT16 length = 0;
889 UINT16 sec_flags = 0;
890 BOOL ret = FALSE;
891
892 WINPR_ASSERT(rdp);
893
894 if (!rdp->settings->UseRdpSecurityLayer)
895 {
896 /* No RDP Security. */
897 return TRUE;
898 }
899
900 if (!rdp_read_header(rdp, s, &length, &channel_id))
901 return FALSE;
902
903 if (!rdp_read_security_header(rdp, s, &sec_flags, NULL))
904 {
905 WLog_Print(rdp->log, WLOG_ERROR, "invalid security header");
906 return FALSE;
907 }
908
909 if ((sec_flags & SEC_EXCHANGE_PKT) == 0)
910 {
911 WLog_Print(rdp->log, WLOG_ERROR, "missing SEC_EXCHANGE_PKT in security header");
912 return FALSE;
913 }
914
915 rdp->do_crypt_license = (sec_flags & SEC_LICENSE_ENCRYPT_SC) != 0 ? TRUE : FALSE;
916
917 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, 4))
918 return FALSE;
919
920 Stream_Read_UINT32(s, rand_len);
921
922 /* rand_len already includes 8 bytes of padding */
923 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, rand_len))
924 return FALSE;
925
926 const BYTE* crypt_random = Stream_ConstPointer(s);
927 if (!Stream_SafeSeek(s, rand_len))
928 goto end;
929 if (!rdp_update_client_random(rdp->settings, crypt_random, rand_len))
930 goto end;
931
932 /* now calculate encrypt / decrypt and update keys */
933 if (!security_establish_keys(rdp))
934 goto end;
935
936 rdp->do_crypt = TRUE;
937
938 if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
939 {
940 rdp->fips_encrypt =
941 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
942 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
943
944 if (!rdp->fips_encrypt)
945 {
946 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 encrypt key");
947 goto end;
948 }
949
950 rdp->fips_decrypt =
951 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
952 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
953
954 if (!rdp->fips_decrypt)
955 {
956 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 decrypt key");
957 goto end;
958 }
959
960 ret = TRUE;
961 goto end;
962 }
963
964 if (!rdp_reset_rc4_encrypt_keys(rdp))
965 goto end;
966
967 if (!rdp_reset_rc4_decrypt_keys(rdp))
968 goto end;
969
970 ret = tpkt_ensure_stream_consumed(rdp->log, s, length);
971end:
972
973 if (!ret)
974 {
975 winpr_Cipher_Free(rdp->fips_encrypt);
976 winpr_Cipher_Free(rdp->fips_decrypt);
977 rdp->fips_encrypt = NULL;
978 rdp->fips_decrypt = NULL;
979
980 rdp_free_rc4_encrypt_keys(rdp);
981 rdp_free_rc4_decrypt_keys(rdp);
982 }
983
984 return ret;
985}
986
987static BOOL rdp_client_send_client_info_and_change_state(rdpRdp* rdp)
988{
989 WINPR_ASSERT(rdp);
990 if (!rdp_client_establish_keys(rdp))
991 return FALSE;
992 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE))
993 return FALSE;
994 if (!rdp_send_client_info(rdp))
995 return FALSE;
996 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST))
997 return FALSE;
998 return TRUE;
999}
1000
1001BOOL rdp_client_skip_mcs_channel_join(rdpRdp* rdp)
1002{
1003 WINPR_ASSERT(rdp);
1004
1005 rdpMcs* mcs = rdp->mcs;
1006 WINPR_ASSERT(mcs);
1007
1008 mcs->userChannelJoined = TRUE;
1009 mcs->globalChannelJoined = TRUE;
1010 mcs->messageChannelJoined = TRUE;
1011
1012 for (UINT32 i = 0; i < mcs->channelCount; i++)
1013 {
1014 rdpMcsChannel* cur = &mcs->channels[i];
1015 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1016 cur->joined = TRUE;
1017 }
1018
1019 return rdp_client_send_client_info_and_change_state(rdp);
1020}
1021
1022static BOOL rdp_client_join_channel(rdpRdp* rdp, UINT16 ChannelId)
1023{
1024 WINPR_ASSERT(rdp);
1025
1026 rdpMcs* mcs = rdp->mcs;
1027 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST))
1028 return FALSE;
1029 if (!mcs_send_channel_join_request(mcs, ChannelId))
1030 return FALSE;
1031 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1032 return FALSE;
1033 return TRUE;
1034}
1035
1036BOOL rdp_client_connect_mcs_channel_join_confirm(rdpRdp* rdp, wStream* s)
1037{
1038 UINT16 channelId = 0;
1039 BOOL allJoined = TRUE;
1040
1041 WINPR_ASSERT(rdp);
1042 rdpMcs* mcs = rdp->mcs;
1043
1044 if (!mcs_recv_channel_join_confirm(mcs, s, &channelId))
1045 return FALSE;
1046
1047 if (!mcs->userChannelJoined)
1048 {
1049 if (channelId != mcs->userId)
1050 {
1051 WLog_ERR(TAG, "expected user channel id %" PRIu16 ", but received %" PRIu16,
1052 mcs->userId, channelId);
1053 return FALSE;
1054 }
1055
1056 mcs->userChannelJoined = TRUE;
1057 if (!rdp_client_join_channel(rdp, MCS_GLOBAL_CHANNEL_ID))
1058 return FALSE;
1059 }
1060 else if (!mcs->globalChannelJoined)
1061 {
1062 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1063 {
1064 WLog_ERR(TAG, "expected uglobalser channel id %" PRIu16 ", but received %" PRIu16,
1065 MCS_GLOBAL_CHANNEL_ID, channelId);
1066 return FALSE;
1067 }
1068 mcs->globalChannelJoined = TRUE;
1069
1070 if (mcs->messageChannelId != 0)
1071 {
1072 if (!rdp_client_join_channel(rdp, mcs->messageChannelId))
1073 return FALSE;
1074 allJoined = FALSE;
1075 }
1076 else
1077 {
1078 if (mcs->channelCount > 0)
1079 {
1080 const rdpMcsChannel* cur = &mcs->channels[0];
1081 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1082 return FALSE;
1083 allJoined = FALSE;
1084 }
1085 }
1086 }
1087 else if ((mcs->messageChannelId != 0) && !mcs->messageChannelJoined)
1088 {
1089 if (channelId != mcs->messageChannelId)
1090 {
1091 WLog_ERR(TAG, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1092 mcs->messageChannelId, channelId);
1093 return FALSE;
1094 }
1095
1096 mcs->messageChannelJoined = TRUE;
1097
1098 if (mcs->channelCount > 0)
1099 {
1100 const rdpMcsChannel* cur = &mcs->channels[0];
1101 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1102 return FALSE;
1103 allJoined = FALSE;
1104 }
1105 }
1106 else
1107 {
1108 UINT32 i = 0;
1109 for (; i < mcs->channelCount; i++)
1110 {
1111 rdpMcsChannel* cur = &mcs->channels[i];
1112 if (cur->joined)
1113 continue;
1114
1115 if (cur->ChannelId != channelId)
1116 {
1117 WLog_ERR(TAG, "expected channel id %" PRIu16 ", but received %" PRIu16,
1118 MCS_GLOBAL_CHANNEL_ID, channelId);
1119 return FALSE;
1120 }
1121 cur->joined = TRUE;
1122 break;
1123 }
1124
1125 if (i + 1 < mcs->channelCount)
1126 {
1127 const rdpMcsChannel* cur = &mcs->channels[i + 1];
1128 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1129 return FALSE;
1130 allJoined = FALSE;
1131 }
1132 }
1133
1134 if (mcs->userChannelJoined && mcs->globalChannelJoined && allJoined)
1135 {
1136 if (!rdp_client_send_client_info_and_change_state(rdp))
1137 return FALSE;
1138 }
1139
1140 return TRUE;
1141}
1142
1143state_run_t rdp_handle_message_channel(rdpRdp* rdp, wStream* s, UINT16 channelId, UINT16 length)
1144{
1145 WINPR_ASSERT(rdp);
1146 WINPR_ASSERT(rdp->mcs);
1147
1148 if (!rdp->mcs->messageChannelJoined)
1149 {
1150 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel not joined!");
1151 return STATE_RUN_FAILED;
1152 }
1153 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1154 if (messageChannelId == 0)
1155 {
1156 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel id == 0");
1157 return STATE_RUN_FAILED;
1158 }
1159
1160 if ((channelId != messageChannelId) && (channelId != MCS_GLOBAL_CHANNEL_ID))
1161 {
1162 WLog_Print(rdp->log, WLOG_WARN,
1163 "MCS message channel expected id=[%" PRIu16 "|%d], got %" PRIu16,
1164 messageChannelId, MCS_GLOBAL_CHANNEL_ID, channelId);
1165 return STATE_RUN_FAILED;
1166 }
1167
1168 UINT16 securityFlags = 0;
1169 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1170 return STATE_RUN_FAILED;
1171
1172 if (securityFlags & SEC_ENCRYPT)
1173 {
1174 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1175 return STATE_RUN_FAILED;
1176 }
1177
1178 const state_run_t rc = rdp_recv_message_channel_pdu(rdp, s, securityFlags);
1179 if (state_run_success(rc))
1180 {
1181 if (!tpkt_ensure_stream_consumed(rdp->log, s, length))
1182 return STATE_RUN_FAILED;
1183 }
1184 return rc;
1185}
1186
1187BOOL rdp_client_connect_auto_detect(rdpRdp* rdp, wStream* s, DWORD logLevel)
1188{
1189 WINPR_ASSERT(rdp);
1190 WINPR_ASSERT(rdp->mcs);
1191
1192 const size_t pos = Stream_GetPosition(s);
1193 UINT16 length = 0;
1194 UINT16 channelId = 0;
1195
1196 if (rdp_read_header(rdp, s, &length, &channelId))
1197 {
1198 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1199 /* If the MCS message channel has been joined... */
1200
1201 /* Process any MCS message channel PDUs. */
1202 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1203 {
1204 const state_run_t rc = rdp_handle_message_channel(rdp, s, channelId, length);
1205 return state_run_success(rc);
1206 }
1207 else
1208 {
1209 wLog* log = WLog_Get(TAG);
1210 WLog_Print(log, logLevel, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1211 messageChannelId, channelId);
1212 }
1213 }
1214
1215 Stream_SetPosition(s, pos);
1216 return FALSE;
1217}
1218
1219state_run_t rdp_client_connect_license(rdpRdp* rdp, wStream* s)
1220{
1221 state_run_t status = STATE_RUN_FAILED;
1222 LICENSE_STATE state = LICENSE_STATE_ABORTED;
1223 UINT16 length = 0;
1224 UINT16 channelId = 0;
1225 UINT16 securityFlags = 0;
1226
1227 WINPR_ASSERT(rdp);
1228 if (!rdp_read_header(rdp, s, &length, &channelId))
1229 return STATE_RUN_FAILED;
1230
1231 /* there might be autodetect messages mixed in between licensing messages.
1232 * that has been observed with 2k12 R2 and 2k19
1233 */
1234 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1235 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1236 {
1237 return rdp_handle_message_channel(rdp, s, channelId, length);
1238 }
1239
1240 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1241 return STATE_RUN_FAILED;
1242
1243 if (securityFlags & SEC_ENCRYPT)
1244 {
1245 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1246 return STATE_RUN_FAILED;
1247 }
1248
1249 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1250 WLog_WARN(TAG, "unexpected message for channel %u, expected %u", channelId,
1251 MCS_GLOBAL_CHANNEL_ID);
1252
1253 if ((securityFlags & SEC_LICENSE_PKT) == 0)
1254 {
1255 char buffer[512] = { 0 };
1256 char lbuffer[32] = { 0 };
1257 WLog_ERR(TAG, "securityFlags=%s, missing required flag %s",
1258 rdp_security_flag_string(securityFlags, buffer, sizeof(buffer)),
1259 rdp_security_flag_string(SEC_LICENSE_PKT, lbuffer, sizeof(lbuffer)));
1260 return STATE_RUN_FAILED;
1261 }
1262
1263 status = license_recv(rdp->license, s);
1264
1265 if (state_run_failed(status))
1266 return status;
1267
1268 state = license_get_state(rdp->license);
1269 switch (state)
1270 {
1271 case LICENSE_STATE_ABORTED:
1272 WLog_ERR(TAG, "license connection sequence aborted.");
1273 return STATE_RUN_FAILED;
1274 case LICENSE_STATE_COMPLETED:
1275 if (rdp->settings->MultitransportFlags)
1276 {
1277 if (!rdp_client_transition_to_state(
1278 rdp, CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST))
1279 return STATE_RUN_FAILED;
1280 }
1281 else
1282 {
1283 if (!rdp_client_transition_to_state(
1284 rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1285 return STATE_RUN_FAILED;
1286 }
1287 return STATE_RUN_SUCCESS;
1288 default:
1289 return STATE_RUN_SUCCESS;
1290 }
1291}
1292
1293state_run_t rdp_client_connect_demand_active(rdpRdp* rdp, wStream* s)
1294{
1295 UINT16 length = 0;
1296 UINT16 channelId = 0;
1297 UINT16 pduType = 0;
1298 UINT16 pduSource = 0;
1299
1300 WINPR_ASSERT(rdp);
1301 WINPR_ASSERT(s);
1302 WINPR_ASSERT(rdp->settings);
1303
1304 if (!rdp_recv_get_active_header(rdp, s, &channelId, &length))
1305 return STATE_RUN_FAILED;
1306
1307 if (freerdp_shall_disconnect_context(rdp->context))
1308 return STATE_RUN_QUIT_SESSION;
1309
1310 if (rdp->mcs->messageChannelId && (channelId == rdp->mcs->messageChannelId))
1311 {
1312 rdp->inPackets++;
1313 return rdp_handle_message_channel(rdp, s, channelId, length);
1314 }
1315
1316 if (!rdp_handle_optional_rdp_decryption(rdp, s, &length, NULL))
1317 return STATE_RUN_FAILED;
1318
1319 if (!rdp_read_share_control_header(rdp, s, NULL, NULL, &pduType, &pduSource))
1320 return STATE_RUN_FAILED;
1321
1322 switch (pduType)
1323 {
1324 case PDU_TYPE_DEMAND_ACTIVE:
1325 if (!rdp_recv_demand_active(rdp, s, pduSource, length))
1326 return STATE_RUN_FAILED;
1327 return STATE_RUN_ACTIVE;
1328 default:
1329 return rdp_recv_out_of_sequence_pdu(rdp, s, pduType, length);
1330 }
1331}
1332
1333state_run_t rdp_client_connect_finalize(rdpRdp* rdp)
1334{
1335 WINPR_ASSERT(rdp);
1342 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC))
1343 return STATE_RUN_FAILED;
1344
1345 if (!rdp_send_client_synchronize_pdu(rdp))
1346 return STATE_RUN_FAILED;
1347
1348 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_COOPERATE))
1349 return STATE_RUN_FAILED;
1350 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_COOPERATE))
1351 return STATE_RUN_FAILED;
1352
1353 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL))
1354 return STATE_RUN_FAILED;
1355 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_REQUEST_CONTROL))
1356 return STATE_RUN_FAILED;
1357
1365 if (!rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE) &&
1366 freerdp_settings_get_bool(rdp->settings, FreeRDP_BitmapCachePersistEnabled))
1367 {
1368 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST))
1369 return STATE_RUN_FAILED;
1370 if (!rdp_send_client_persistent_key_list_pdu(rdp))
1371 return STATE_RUN_FAILED;
1372 }
1373
1374 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_FONT_LIST))
1375 return STATE_RUN_FAILED;
1376 if (!rdp_send_client_font_list_pdu(rdp, FONTLIST_FIRST | FONTLIST_LAST))
1377 return STATE_RUN_FAILED;
1378
1379 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1380 return STATE_RUN_FAILED;
1381 return STATE_RUN_SUCCESS;
1382}
1383
1384BOOL rdp_client_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1385{
1386 const char* name = rdp_state_string(state);
1387
1388 WINPR_ASSERT(rdp);
1389 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp), name);
1390
1391 if (!rdp_set_state(rdp, state))
1392 return FALSE;
1393
1394 switch (state)
1395 {
1396 case CONNECTION_STATE_FINALIZATION_SYNC:
1397 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1398 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1399 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1400 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1401 update_reset_state(rdp->update);
1402 break;
1403
1404 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
1405 {
1406 ActivatedEventArgs activatedEvent = { 0 };
1407 rdpContext* context = rdp->context;
1408 EventArgsInit(&activatedEvent, "libfreerdp");
1409 activatedEvent.firstActivation =
1410 !rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1411 PubSub_OnActivated(rdp->pubSub, context, &activatedEvent);
1412 }
1413
1414 break;
1415
1416 default:
1417 break;
1418 }
1419
1420 {
1421 ConnectionStateChangeEventArgs stateEvent = { 0 };
1422 rdpContext* context = rdp->context;
1423 EventArgsInit(&stateEvent, "libfreerdp");
1424 stateEvent.state = WINPR_ASSERTING_INT_CAST(int32_t, rdp_get_state(rdp));
1425 stateEvent.active = rdp_is_active_state(rdp);
1426 PubSub_OnConnectionStateChange(rdp->pubSub, context, &stateEvent);
1427 }
1428
1429 return TRUE;
1430}
1431
1432BOOL rdp_server_accept_nego(rdpRdp* rdp, wStream* s)
1433{
1434 UINT32 SelectedProtocol = 0;
1435 UINT32 RequestedProtocols = 0;
1436 BOOL status = 0;
1437 rdpSettings* settings = NULL;
1438 rdpNego* nego = NULL;
1439
1440 WINPR_ASSERT(rdp);
1441 WINPR_ASSERT(s);
1442
1443 settings = rdp->settings;
1444 WINPR_ASSERT(settings);
1445
1446 nego = rdp->nego;
1447 WINPR_ASSERT(nego);
1448
1449 transport_set_blocking_mode(rdp->transport, TRUE);
1450
1451 if (!nego_read_request(nego, s))
1452 return FALSE;
1453
1454 RequestedProtocols = nego_get_requested_protocols(nego);
1455 WLog_DBG(TAG, "Client Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1456 (RequestedProtocols & PROTOCOL_RDSTLS) ? 1 : 0,
1457 (RequestedProtocols & PROTOCOL_HYBRID) ? 1 : 0,
1458 (RequestedProtocols & PROTOCOL_SSL) ? 1 : 0,
1459 (RequestedProtocols == PROTOCOL_RDP) ? 1 : 0);
1460 WLog_DBG(TAG,
1461 "Server Security: RDSTLS:%" PRId32 " NLA:%" PRId32 " TLS:%" PRId32 " RDP:%" PRId32 "",
1462 settings->RdstlsSecurity, settings->NlaSecurity, settings->TlsSecurity,
1463 settings->RdpSecurity);
1464
1465 if ((settings->RdstlsSecurity) && (RequestedProtocols & PROTOCOL_RDSTLS))
1466 {
1467 SelectedProtocol = PROTOCOL_RDSTLS;
1468 }
1469 else if ((settings->NlaSecurity) && (RequestedProtocols & PROTOCOL_HYBRID))
1470 {
1471 SelectedProtocol = PROTOCOL_HYBRID;
1472 }
1473 else if ((settings->TlsSecurity) && (RequestedProtocols & PROTOCOL_SSL))
1474 {
1475 SelectedProtocol = PROTOCOL_SSL;
1476 }
1477 else if ((settings->RdpSecurity) && (RequestedProtocols == PROTOCOL_RDP))
1478 {
1479 SelectedProtocol = PROTOCOL_RDP;
1480 }
1481 else
1482 {
1483 /*
1484 * when here client and server aren't compatible, we select the right
1485 * error message to return to the client in the nego failure packet
1486 */
1487 SelectedProtocol = PROTOCOL_FAILED_NEGO;
1488
1489 if (settings->RdpSecurity)
1490 {
1491 WLog_ERR(TAG, "server supports only Standard RDP Security");
1492 SelectedProtocol |= SSL_NOT_ALLOWED_BY_SERVER;
1493 }
1494 else
1495 {
1496 if (settings->NlaSecurity && !settings->TlsSecurity)
1497 {
1498 WLog_WARN(TAG, "server supports only NLA Security");
1499 SelectedProtocol |= HYBRID_REQUIRED_BY_SERVER;
1500 }
1501 else
1502 {
1503 WLog_WARN(TAG, "server supports only a SSL based Security (TLS or NLA)");
1504 SelectedProtocol |= SSL_REQUIRED_BY_SERVER;
1505 }
1506 }
1507
1508 WLog_ERR(TAG, "Protocol security negotiation failure");
1509 }
1510
1511 if (!(SelectedProtocol & PROTOCOL_FAILED_NEGO))
1512 {
1513 WLog_DBG(TAG, "Negotiated Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1514 (SelectedProtocol & PROTOCOL_RDSTLS) ? 1 : 0,
1515 (SelectedProtocol & PROTOCOL_HYBRID) ? 1 : 0,
1516 (SelectedProtocol & PROTOCOL_SSL) ? 1 : 0,
1517 (SelectedProtocol == PROTOCOL_RDP) ? 1 : 0);
1518 }
1519
1520 if (!nego_set_selected_protocol(nego, SelectedProtocol))
1521 return FALSE;
1522
1523 if (!nego_send_negotiation_response(nego))
1524 return FALSE;
1525
1526 SelectedProtocol = nego_get_selected_protocol(nego);
1527 status = FALSE;
1528
1529 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_VmConnectMode) &&
1530 SelectedProtocol != PROTOCOL_RDP)
1531 /* When behind a Hyper-V proxy, security != RDP is handled by the host. */
1532 status = TRUE;
1533 else if (SelectedProtocol & PROTOCOL_RDSTLS)
1534 status = transport_accept_rdstls(rdp->transport);
1535 else if (SelectedProtocol & PROTOCOL_HYBRID)
1536 status = transport_accept_nla(rdp->transport);
1537 else if (SelectedProtocol & PROTOCOL_SSL)
1538 status = transport_accept_tls(rdp->transport);
1539 else if (SelectedProtocol == PROTOCOL_RDP) /* 0 */
1540 status = transport_accept_rdp(rdp->transport);
1541
1542 if (!status)
1543 return FALSE;
1544
1545 transport_set_blocking_mode(rdp->transport, FALSE);
1546
1547 return TRUE;
1548}
1549
1550static BOOL rdp_update_encryption_level(rdpSettings* settings)
1551{
1552 WINPR_ASSERT(settings);
1553
1554 UINT32 EncryptionLevel = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionLevel);
1555 UINT32 EncryptionMethods = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionMethods);
1556
1567 if (!settings->UseRdpSecurityLayer)
1568 {
1569 /* TLS/NLA is used: disable rdp style encryption */
1570 EncryptionLevel = ENCRYPTION_LEVEL_NONE;
1571 }
1572 else
1573 {
1574 /* verify server encryption level value */
1575 switch (EncryptionLevel)
1576 {
1577 case ENCRYPTION_LEVEL_NONE:
1578 WLog_INFO(TAG, "Active rdp encryption level: NONE");
1579 break;
1580
1581 case ENCRYPTION_LEVEL_FIPS:
1582 WLog_INFO(TAG, "Active rdp encryption level: FIPS Compliant");
1583 break;
1584
1585 case ENCRYPTION_LEVEL_HIGH:
1586 WLog_INFO(TAG, "Active rdp encryption level: HIGH");
1587 break;
1588
1589 case ENCRYPTION_LEVEL_LOW:
1590 WLog_INFO(TAG, "Active rdp encryption level: LOW");
1591 break;
1592
1593 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1594 WLog_INFO(TAG, "Active rdp encryption level: CLIENT-COMPATIBLE");
1595 break;
1596
1597 default:
1598 WLog_ERR(TAG, "Invalid server encryption level 0x%08" PRIX32 "", EncryptionLevel);
1599 WLog_ERR(TAG, "Switching to encryption level CLIENT-COMPATIBLE");
1600 EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
1601 }
1602 }
1603
1604 /* choose rdp encryption method based on server level and client methods */
1605 switch (EncryptionLevel)
1606 {
1607 case ENCRYPTION_LEVEL_NONE:
1608 /* The only valid method is NONE in this case */
1609 EncryptionMethods = ENCRYPTION_METHOD_NONE;
1610 break;
1611
1612 case ENCRYPTION_LEVEL_FIPS:
1613
1614 /* The only valid method is FIPS in this case */
1615 if (!(EncryptionMethods & ENCRYPTION_METHOD_FIPS))
1616 {
1617 WLog_WARN(TAG, "client does not support FIPS as required by server configuration");
1618 }
1619
1620 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1621 break;
1622
1623 case ENCRYPTION_LEVEL_HIGH:
1624
1625 /* Maximum key strength supported by the server must be used (128 bit)*/
1626 if (!(EncryptionMethods & ENCRYPTION_METHOD_128BIT))
1627 {
1628 WLog_WARN(TAG, "client does not support 128 bit encryption method as required by "
1629 "server configuration");
1630 }
1631
1632 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1633 break;
1634
1635 case ENCRYPTION_LEVEL_LOW:
1636 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1637
1638 /* Maximum key strength supported by the client must be used */
1639 if (EncryptionMethods & ENCRYPTION_METHOD_128BIT)
1640 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1641 else if (EncryptionMethods & ENCRYPTION_METHOD_56BIT)
1642 EncryptionMethods = ENCRYPTION_METHOD_56BIT;
1643 else if (EncryptionMethods & ENCRYPTION_METHOD_40BIT)
1644 EncryptionMethods = ENCRYPTION_METHOD_40BIT;
1645 else if (EncryptionMethods & ENCRYPTION_METHOD_FIPS)
1646 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1647 else
1648 {
1649 WLog_WARN(TAG, "client has not announced any supported encryption methods");
1650 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1651 }
1652
1653 break;
1654
1655 default:
1656 WLog_ERR(TAG, "internal error: unknown encryption level");
1657 return FALSE;
1658 }
1659
1660 /* log selected encryption method */
1661 if (settings->UseRdpSecurityLayer)
1662 {
1663 switch (EncryptionMethods)
1664 {
1665 case ENCRYPTION_METHOD_NONE:
1666 WLog_INFO(TAG, "Selected rdp encryption method: NONE");
1667 break;
1668
1669 case ENCRYPTION_METHOD_40BIT:
1670 WLog_INFO(TAG, "Selected rdp encryption method: 40BIT");
1671 break;
1672
1673 case ENCRYPTION_METHOD_56BIT:
1674 WLog_INFO(TAG, "Selected rdp encryption method: 56BIT");
1675 break;
1676
1677 case ENCRYPTION_METHOD_128BIT:
1678 WLog_INFO(TAG, "Selected rdp encryption method: 128BIT");
1679 break;
1680
1681 case ENCRYPTION_METHOD_FIPS:
1682 WLog_INFO(TAG, "Selected rdp encryption method: FIPS");
1683 break;
1684
1685 default:
1686 WLog_ERR(TAG, "internal error: unknown encryption method");
1687 return FALSE;
1688 }
1689 }
1690
1691 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionLevel, EncryptionLevel))
1692 return FALSE;
1693 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionMethods, EncryptionMethods))
1694 return FALSE;
1695 return TRUE;
1696}
1697
1698BOOL rdp_server_accept_mcs_connect_initial(rdpRdp* rdp, wStream* s)
1699{
1700 WINPR_ASSERT(rdp);
1701 WINPR_ASSERT(s);
1702
1703 rdpMcs* mcs = rdp->mcs;
1704 WINPR_ASSERT(mcs);
1705
1706 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CREATE_REQUEST);
1707 if (!mcs_recv_connect_initial(mcs, s))
1708 return FALSE;
1709 WINPR_ASSERT(rdp->settings);
1710
1711 if (!mcs_server_apply_to_settings(mcs, rdp->settings))
1712 return FALSE;
1713
1714 WLog_DBG(TAG, "Accepted client: %s", rdp->settings->ClientHostname);
1715 WLog_DBG(TAG, "Accepted channels:");
1716
1717 WINPR_ASSERT(mcs->channels || (mcs->channelCount == 0));
1718 for (UINT32 i = 0; i < mcs->channelCount; i++)
1719 {
1720 ADDIN_ARGV* arg = NULL;
1721 rdpMcsChannel* cur = &mcs->channels[i];
1722 const char* params[1] = { cur->Name };
1723 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1724 arg = freerdp_addin_argv_new(ARRAYSIZE(params), params);
1725 if (!arg)
1726 return FALSE;
1727
1728 if (!freerdp_static_channel_collection_add(rdp->settings, arg))
1729 {
1730 freerdp_addin_argv_free(arg);
1731 return FALSE;
1732 }
1733 }
1734
1735 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_RESPONSE))
1736 return FALSE;
1737 if (!rdp_update_encryption_level(rdp->settings))
1738 return FALSE;
1739 if (!mcs_send_connect_response(mcs))
1740 return FALSE;
1741 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ERECT_DOMAIN))
1742 return FALSE;
1743
1744 return TRUE;
1745}
1746
1747BOOL rdp_server_accept_mcs_erect_domain_request(rdpRdp* rdp, wStream* s)
1748{
1749 WINPR_ASSERT(rdp);
1750 WINPR_ASSERT(s);
1751 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_ERECT_DOMAIN);
1752
1753 if (!mcs_recv_erect_domain_request(rdp->mcs, s))
1754 return FALSE;
1755
1756 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER);
1757}
1758
1759static BOOL rdp_server_skip_mcs_channel_join(rdpRdp* rdp)
1760{
1761 WINPR_ASSERT(rdp);
1762
1763 rdpMcs* mcs = rdp->mcs;
1764 WINPR_ASSERT(mcs);
1765
1766 mcs->userChannelJoined = TRUE;
1767 mcs->globalChannelJoined = TRUE;
1768 mcs->messageChannelJoined = TRUE;
1769
1770 for (UINT32 i = 0; i < mcs->channelCount; i++)
1771 {
1772 rdpMcsChannel* cur = &mcs->channels[i];
1773 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1774 cur->joined = TRUE;
1775 }
1776 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT);
1777}
1778
1779BOOL rdp_server_accept_mcs_attach_user_request(rdpRdp* rdp, wStream* s)
1780{
1781 if (!mcs_recv_attach_user_request(rdp->mcs, s))
1782 return FALSE;
1783
1784 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM))
1785 return FALSE;
1786
1787 if (!mcs_send_attach_user_confirm(rdp->mcs))
1788 return FALSE;
1789
1790 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_SupportSkipChannelJoin))
1791 return rdp_server_skip_mcs_channel_join(rdp);
1792 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1793}
1794
1795BOOL rdp_server_accept_mcs_channel_join_request(rdpRdp* rdp, wStream* s)
1796{
1797 UINT16 channelId = 0;
1798 BOOL allJoined = TRUE;
1799 rdpMcs* mcs = NULL;
1800
1801 WINPR_ASSERT(rdp);
1802 WINPR_ASSERT(rdp->context);
1803
1804 mcs = rdp->mcs;
1805 WINPR_ASSERT(mcs);
1806
1807 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1808
1809 if (!mcs_recv_channel_join_request(mcs, rdp->settings, s, &channelId))
1810 return FALSE;
1811
1812 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1813 return FALSE;
1814
1815 if (!mcs_send_channel_join_confirm(mcs, channelId))
1816 return FALSE;
1817
1818 if (channelId == mcs->userId)
1819 mcs->userChannelJoined = TRUE;
1820 if (channelId == MCS_GLOBAL_CHANNEL_ID)
1821 mcs->globalChannelJoined = TRUE;
1822 if (channelId == mcs->messageChannelId)
1823 mcs->messageChannelJoined = TRUE;
1824
1825 for (UINT32 i = 0; i < mcs->channelCount; i++)
1826 {
1827 rdpMcsChannel* cur = &mcs->channels[i];
1828 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1829 if (cur->ChannelId == channelId)
1830 cur->joined = TRUE;
1831
1832 if (!cur->joined)
1833 allJoined = FALSE;
1834 }
1835
1836 CONNECTION_STATE rc = CONNECTION_STATE_INITIAL;
1837 if ((mcs->userChannelJoined) && (mcs->globalChannelJoined) &&
1838 (mcs->messageChannelId == 0 || mcs->messageChannelJoined) && allJoined)
1839 rc = CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT;
1840 else
1841 rc = CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST;
1842
1843 return rdp_server_transition_to_state(rdp, rc);
1844}
1845
1846static BOOL rdp_server_send_sync(rdpRdp* rdp)
1847{
1848 WINPR_ASSERT(rdp);
1849
1850 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1851 return FALSE;
1852 if (!rdp_send_server_synchronize_pdu(rdp))
1853 return FALSE;
1854 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE))
1855 return FALSE;
1856 if (!rdp_send_server_control_cooperate_pdu(rdp))
1857 return FALSE;
1858 if (!rdp_finalize_reset_flags(rdp, FALSE))
1859 return FALSE;
1860 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC);
1861}
1862
1863BOOL rdp_server_accept_confirm_active(rdpRdp* rdp, wStream* s, UINT16 pduLength)
1864{
1865 WINPR_ASSERT(rdp);
1866 WINPR_ASSERT(rdp->context);
1867 WINPR_ASSERT(rdp->settings);
1868 WINPR_ASSERT(s);
1869
1870 freerdp_peer* peer = rdp->context->peer;
1871 WINPR_ASSERT(peer);
1872
1873 if (rdp_get_state(rdp) != CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE)
1874 {
1875 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_TransportDumpReplay))
1876 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1877 else
1878 {
1879 WLog_WARN(TAG, "Invalid state, got %s, expected %s", rdp_get_state_string(rdp),
1880 rdp_state_string(CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE));
1881 return FALSE;
1882 }
1883 }
1884
1885 if (!rdp_recv_confirm_active(rdp, s, pduLength))
1886 return FALSE;
1887
1888 if (peer->ClientCapabilities && !peer->ClientCapabilities(peer))
1889 {
1890 WLog_WARN(TAG, "peer->ClientCapabilities failed");
1891 return FALSE;
1892 }
1893
1894 if (rdp->settings->SaltedChecksum)
1895 rdp->do_secure_checksum = TRUE;
1896
1897 return rdp_server_send_sync(rdp);
1898}
1899
1900BOOL rdp_server_reactivate(rdpRdp* rdp)
1901{
1902 freerdp_peer* client = NULL;
1903
1904 if (rdp->context && rdp->context->peer)
1905 client = rdp->context->peer;
1906
1907 if (client)
1908 client->activated = FALSE;
1909
1910 if (!rdp_send_deactivate_all(rdp))
1911 return FALSE;
1912
1913 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1914 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1915 return FALSE;
1916
1917 state_run_t rc = rdp_peer_handle_state_demand_active(client);
1918 return state_run_success(rc);
1919}
1920
1921static BOOL rdp_is_active_peer_state(CONNECTION_STATE state)
1922{
1923 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1924 * 'upon receipt of the Font List PDU the server can start sending graphics
1925 * output to the client'
1926 */
1927 switch (state)
1928 {
1929 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1930 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1931 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1932 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1933 case CONNECTION_STATE_ACTIVE:
1934 return TRUE;
1935 default:
1936 return FALSE;
1937 }
1938}
1939
1940static BOOL rdp_is_active_client_state(CONNECTION_STATE state)
1941{
1942 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1943 * 'Once the client has sent the Confirm Active PDU, it can start sending
1944 * mouse and keyboard input to the server'
1945 */
1946 switch (state)
1947 {
1948 case CONNECTION_STATE_FINALIZATION_SYNC:
1949 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1950 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1951 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1952 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1953 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1954 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1955 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1956 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1957 case CONNECTION_STATE_ACTIVE:
1958 return TRUE;
1959 default:
1960 return FALSE;
1961 }
1962}
1963
1964BOOL rdp_is_active_state(const rdpRdp* rdp)
1965{
1966 WINPR_ASSERT(rdp);
1967 WINPR_ASSERT(rdp->context);
1968
1969 const CONNECTION_STATE state = rdp_get_state(rdp);
1970 if (freerdp_settings_get_bool(rdp->context->settings, FreeRDP_ServerMode))
1971 return rdp_is_active_peer_state(state);
1972 else
1973 return rdp_is_active_client_state(state);
1974}
1975
1976BOOL rdp_server_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1977{
1978 BOOL status = FALSE;
1979 freerdp_peer* client = NULL;
1980 const CONNECTION_STATE cstate = rdp_get_state(rdp);
1981
1982 if (cstate >= CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT)
1983 {
1984 WINPR_ASSERT(rdp->context);
1985 client = rdp->context->peer;
1986 }
1987
1988 if (!rdp_is_active_peer_state(cstate))
1989 {
1990 if (client)
1991 client->activated = FALSE;
1992 }
1993
1994 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp),
1995 rdp_state_string(state));
1996 if (!rdp_set_state(rdp, state))
1997 goto fail;
1998
1999 status = TRUE;
2000fail:
2001 return status;
2002}
2003
2004const char* rdp_client_connection_state_string(UINT state)
2005{
2006 switch (state)
2007 {
2008 case CLIENT_STATE_INITIAL:
2009 return "CLIENT_STATE_INITIAL";
2010 case CLIENT_STATE_PRECONNECT_PASSED:
2011 return "CLIENT_STATE_PRECONNECT_PASSED";
2012 case CLIENT_STATE_POSTCONNECT_PASSED:
2013 return "CLIENT_STATE_POSTCONNECT_PASSED";
2014 default:
2015 return "UNKNOWN";
2016 }
2017}
2018
2019const char* rdp_state_string(CONNECTION_STATE state)
2020{
2021 switch (state)
2022 {
2023 case CONNECTION_STATE_INITIAL:
2024 return "CONNECTION_STATE_INITIAL";
2025 case CONNECTION_STATE_NEGO:
2026 return "CONNECTION_STATE_NEGO";
2027 case CONNECTION_STATE_NLA:
2028 return "CONNECTION_STATE_NLA";
2029 case CONNECTION_STATE_AAD:
2030 return "CONNECTION_STATE_AAD";
2031 case CONNECTION_STATE_MCS_CREATE_REQUEST:
2032 return "CONNECTION_STATE_MCS_CREATE_REQUEST";
2033 case CONNECTION_STATE_MCS_CREATE_RESPONSE:
2034 return "CONNECTION_STATE_MCS_CREATE_RESPONSE";
2035 case CONNECTION_STATE_MCS_ERECT_DOMAIN:
2036 return "CONNECTION_STATE_MCS_ERECT_DOMAIN";
2037 case CONNECTION_STATE_MCS_ATTACH_USER:
2038 return "CONNECTION_STATE_MCS_ATTACH_USER";
2039 case CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM:
2040 return "CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM";
2041 case CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST:
2042 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST";
2043 case CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE:
2044 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE";
2045 case CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT:
2046 return "CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT";
2047 case CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE:
2048 return "CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE";
2049 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST:
2050 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST";
2051 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE:
2052 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE";
2053 case CONNECTION_STATE_LICENSING:
2054 return "CONNECTION_STATE_LICENSING";
2055 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST:
2056 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST";
2057 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE:
2058 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE";
2059 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE:
2060 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE";
2061 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT:
2062 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT";
2063 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
2064 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE";
2065 case CONNECTION_STATE_FINALIZATION_SYNC:
2066 return "CONNECTION_STATE_FINALIZATION_SYNC";
2067 case CONNECTION_STATE_FINALIZATION_COOPERATE:
2068 return "CONNECTION_STATE_FINALIZATION_COOPERATE";
2069 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
2070 return "CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL";
2071 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
2072 return "CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST";
2073 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
2074 return "CONNECTION_STATE_FINALIZATION_FONT_LIST";
2075 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
2076 return "CONNECTION_STATE_FINALIZATION_CLIENT_SYNC";
2077 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
2078 return "CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE";
2079 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
2080 return "CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL";
2081 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
2082 return "CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP";
2083 case CONNECTION_STATE_ACTIVE:
2084 return "CONNECTION_STATE_ACTIVE";
2085 default:
2086 return "UNKNOWN";
2087 }
2088}
2089
2090CONNECTION_STATE rdp_get_state(const rdpRdp* rdp)
2091{
2092 WINPR_ASSERT(rdp);
2093 return rdp->state;
2094}
2095
2096BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state)
2097{
2098 WINPR_ASSERT(rdp);
2099 rdp->state = state;
2100 return TRUE;
2101}
2102
2103const char* rdp_get_state_string(const rdpRdp* rdp)
2104{
2105 CONNECTION_STATE state = rdp_get_state(rdp);
2106 return rdp_state_string(state);
2107}
2108
2109BOOL rdp_channels_from_mcs(rdpSettings* settings, const rdpRdp* rdp)
2110{
2111 const rdpMcs* mcs = NULL;
2112
2113 WINPR_ASSERT(rdp);
2114
2115 mcs = rdp->mcs;
2116 WINPR_ASSERT(mcs);
2117
2118 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ChannelDefArray, NULL,
2119 CHANNEL_MAX_COUNT))
2120 return FALSE;
2121
2122 for (UINT32 x = 0; x < mcs->channelCount; x++)
2123 {
2124 const rdpMcsChannel* mchannel = &mcs->channels[x];
2125 CHANNEL_DEF cur = { 0 };
2126
2127 memcpy(cur.name, mchannel->Name, sizeof(cur.name));
2128 cur.options = mchannel->options;
2129 if (!freerdp_settings_set_pointer_array(settings, FreeRDP_ChannelDefArray, x, &cur))
2130 return FALSE;
2131 }
2132
2133 return freerdp_settings_set_uint32(settings, FreeRDP_ChannelCount, mcs->channelCount);
2134}
2135
2136/* Here we are in client state CONFIRM_ACTIVE.
2137 *
2138 * This means:
2139 * 1. send the CONFIRM_ACTIVE PDU to the server
2140 * 2. register callbacks, the server can now start sending stuff
2141 */
2142state_run_t rdp_client_connect_confirm_active(rdpRdp* rdp, WINPR_ATTR_UNUSED wStream* s)
2143{
2144 WINPR_ASSERT(rdp);
2145 WINPR_ASSERT(rdp->settings);
2146 WINPR_ASSERT(s);
2147
2148 const UINT32 width = rdp->settings->DesktopWidth;
2149 const UINT32 height = rdp->settings->DesktopHeight;
2150
2151 if (!rdp_send_confirm_active(rdp))
2152 return STATE_RUN_FAILED;
2153
2154 if (!input_register_client_callbacks(rdp->input))
2155 {
2156 WLog_ERR(TAG, "error registering client callbacks");
2157 return STATE_RUN_FAILED;
2158 }
2159
2164 const BOOL deactivate_reactivate =
2165 rdp->was_deactivated && ((rdp->deactivated_width != rdp->settings->DesktopWidth) ||
2166 (rdp->deactivated_height != rdp->settings->DesktopHeight));
2167 const BOOL resolution_change =
2168 ((width != rdp->settings->DesktopWidth) || (height != rdp->settings->DesktopHeight));
2169 if (deactivate_reactivate || resolution_change)
2170 {
2171 BOOL status = TRUE;
2172 IFCALLRET(rdp->update->DesktopResize, status, rdp->update->context);
2173
2174 if (!status)
2175 {
2176 WLog_ERR(TAG, "client desktop resize callback failed");
2177 return STATE_RUN_FAILED;
2178 }
2179 }
2180
2181 WINPR_ASSERT(rdp->context);
2182 if (freerdp_shall_disconnect_context(rdp->context))
2183 return STATE_RUN_SUCCESS;
2184
2185 state_run_t status = STATE_RUN_SUCCESS;
2186 if (!rdp->settings->SupportMonitorLayoutPdu)
2187 status = rdp_client_connect_finalize(rdp);
2188 else
2189 {
2190 if (!rdp_client_transition_to_state(rdp,
2191 CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT))
2192 status = STATE_RUN_FAILED;
2193 }
2194 if (!rdp_finalize_reset_flags(rdp, FALSE))
2195 status = STATE_RUN_FAILED;
2196 return status;
2197}
2198
2199BOOL rdp_handle_optional_rdp_decryption(rdpRdp* rdp, wStream* s, UINT16* length,
2200 UINT16* pSecurityFlags)
2201{
2202 BOOL rc = FALSE;
2203 WINPR_ASSERT(rdp);
2204 WINPR_ASSERT(rdp->settings);
2205
2206 UINT16 securityFlags = 0;
2207 if (rdp->settings->UseRdpSecurityLayer)
2208 {
2209 if (!rdp_read_security_header(rdp, s, &securityFlags, length))
2210 goto fail;
2211
2212 if (securityFlags & SEC_ENCRYPT)
2213 {
2214 if (!rdp_decrypt(rdp, s, length, securityFlags))
2215 goto fail;
2216 }
2217 }
2218
2219 rc = TRUE;
2220
2221fail:
2222 if (pSecurityFlags)
2223 *pSecurityFlags = securityFlags;
2224 return rc;
2225}
freerdp_settings_get_uint32
FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
freerdp_settings_set_string
FREERDP_API BOOL freerdp_settings_set_string(rdpSettings *settings, FreeRDP_Settings_Keys_String id, const char *param)
Sets a string settings value. The param is copied.
Definition settings_getters.c:3717
freerdp_settings_get_bool
FREERDP_API BOOL freerdp_settings_get_bool(const rdpSettings *settings, FreeRDP_Settings_Keys_Bool id)
Returns a boolean settings value.
freerdp_settings_set_pointer_len
FREERDP_API BOOL freerdp_settings_set_pointer_len(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id, const void *data, size_t len)
Set a pointer to value data.
Definition common/settings.c:1415
freerdp_settings_get_pointer_writable
FREERDP_API void * freerdp_settings_get_pointer_writable(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a mutable pointer settings value.
Definition settings_getters.c:4068
freerdp_settings_get_pointer
FREERDP_API const void * freerdp_settings_get_pointer(const rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a immutable pointer settings value.
Definition common/settings.c:1403
freerdp_settings_get_codecs_flags
FREERDP_API UINT32 freerdp_settings_get_codecs_flags(const rdpSettings *settings)
helper function to get a mask of supported codec flags.
Definition common/settings.c:1984
freerdp_settings_set_uint32
FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 param)
Sets a UINT32 settings value.
freerdp_settings_get_string
FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
ADDIN_ARGV
Definition settings_types.h:367
CHANNEL_DEF
Definition wtsapi.h:78