FreeRDP
Loading...
Searching...
No Matches
connection.c
1/*
2 * FreeRDP: A Remote Desktop Protocol Implementation
3 * Connection Sequence
4 *
5 * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
6 * Copyright 2015 Thincast Technologies GmbH
7 * Copyright 2015 DI (FH) Martin Haimberger <martin.haimberger@thincast.com>
8 * Copyright 2023 Armin Novak <anovak@thincast.com>
9 * Copyright 2023 Thincast Technologies GmbH
10 *
11 * Licensed under the Apache License, Version 2.0 (the "License");
12 * you may not use this file except in compliance with the License.
13 * You may obtain a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing, software
18 * distributed under the License is distributed on an "AS IS" BASIS,
19 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20 * See the License for the specific language governing permissions and
21 * limitations under the License.
22 */
23
24#include <freerdp/config.h>
25
26#include "settings.h"
27
28#include "info.h"
29#include "input.h"
30#include "rdp.h"
31#include "peer.h"
32
33#include "connection.h"
34#include "transport.h"
35
36#include <winpr/crt.h>
37#include <winpr/crypto.h>
38#include <winpr/ssl.h>
39
40#include <freerdp/log.h>
41#include <freerdp/error.h>
42#include <freerdp/listener.h>
43
44#include "../cache/pointer.h"
45#include "../crypto/crypto.h"
46#include "../crypto/privatekey.h"
47#include "../crypto/certificate.h"
48#include "gateway/arm.h"
49
50#include "utils.h"
51
52#define TAG FREERDP_TAG("core.connection")
53
197static BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state);
198
199static BOOL rdp_client_reset_codecs(rdpContext* context)
200{
201 rdpSettings* settings = NULL;
202
203 if (!context || !context->settings)
204 return FALSE;
205
206 settings = context->settings;
207
208 if (!freerdp_settings_get_bool(settings, FreeRDP_DeactivateClientDecoding))
209 {
210 const UINT32 flags = freerdp_settings_get_uint32(settings, FreeRDP_ThreadingFlags);
211 freerdp_client_codecs_free(context->codecs);
212 context->codecs = freerdp_client_codecs_new(flags);
213
214 if (!context->codecs)
215 return FALSE;
216
217 if (!freerdp_client_codecs_prepare(context->codecs,
218 freerdp_settings_get_codecs_flags(settings),
219 settings->DesktopWidth, settings->DesktopHeight))
220 return FALSE;
221
222/* Runtime H264 detection. (only available if dynamic backend loading is defined)
223 * If no backend is available disable it before the channel is loaded.
224 */
225#if defined(WITH_GFX_H264) && defined(WITH_OPENH264_LOADING)
226 if (!context->codecs->h264)
227 {
228 settings->GfxH264 = FALSE;
229 settings->GfxAVC444 = FALSE;
230 settings->GfxAVC444v2 = FALSE;
231 }
232#endif
233 }
234
235 return TRUE;
236}
237
238static BOOL rdp_client_wait_for_activation(rdpRdp* rdp)
239{
240 BOOL timedout = FALSE;
241 WINPR_ASSERT(rdp);
242
243 const rdpSettings* settings = rdp->settings;
244 WINPR_ASSERT(settings);
245
246 UINT64 now = GetTickCount64();
247 UINT64 dueDate = now + freerdp_settings_get_uint32(settings, FreeRDP_TcpAckTimeout);
248
249 for (; (now < dueDate) && !timedout; now = GetTickCount64())
250 {
251 HANDLE events[MAXIMUM_WAIT_OBJECTS] = { 0 };
252 DWORD wstatus = 0;
253 DWORD nevents = freerdp_get_event_handles(rdp->context, events, ARRAYSIZE(events));
254 if (!nevents)
255 {
256 WLog_ERR(TAG, "error retrieving connection events");
257 return FALSE;
258 }
259
260 const UINT64 timeout = (dueDate - now);
261 WINPR_ASSERT(timeout <= UINT32_MAX);
262 wstatus = WaitForMultipleObjectsEx(nevents, events, FALSE, (UINT32)timeout, TRUE);
263 switch (wstatus)
264 {
265 case WAIT_TIMEOUT:
266 /* will make us quit with a timeout */
267 timedout = TRUE;
268 break;
269 case WAIT_ABANDONED:
270 case WAIT_FAILED:
271 return FALSE;
272 case WAIT_IO_COMPLETION:
273 break;
274 case WAIT_OBJECT_0:
275 default:
276 /* handles all WAIT_OBJECT_0 + [0 .. MAXIMUM_WAIT_OBJECTS-1] cases */
277 if (rdp_check_fds(rdp) < 0)
278 {
279 freerdp_set_last_error_if_not(rdp->context,
280 FREERDP_ERROR_CONNECT_TRANSPORT_FAILED);
281 return FALSE;
282 }
283 break;
284 }
285
286 if (rdp_is_active_state(rdp))
287 return TRUE;
288 }
289
290 WLog_ERR(TAG, "Timeout waiting for activation");
291 freerdp_set_last_error_if_not(rdp->context, FREERDP_ERROR_CONNECT_ACTIVATION_TIMEOUT);
292 return FALSE;
293}
301BOOL rdp_client_connect(rdpRdp* rdp)
302{
303 UINT32 SelectedProtocol = 0;
304 BOOL status = 0;
305 rdpSettings* settings = NULL;
306 /* make sure SSL is initialize for earlier enough for crypto, by taking advantage of winpr SSL
307 * FIPS flag for openssl initialization */
308 DWORD flags = WINPR_SSL_INIT_DEFAULT;
309
310 WINPR_ASSERT(rdp);
311
312 settings = rdp->settings;
313 WINPR_ASSERT(settings);
314
315 if (!rdp_client_reset_codecs(rdp->context))
316 return FALSE;
317
318 if (settings->FIPSMode)
319 flags |= WINPR_SSL_INIT_ENABLE_FIPS;
320
321 winpr_InitializeSSL(flags);
322 rdp_log_build_warnings(rdp);
323
324 /* FIPS Mode forces the following and overrides the following(by happening later */
325 /* in the command line processing): */
326 /* 1. Disables NLA Security since NLA in freerdp uses NTLM(no Kerberos support yet) which uses
327 * algorithms */
328 /* not allowed in FIPS for sensitive data. So, we disallow NLA when FIPS is required. */
329 /* 2. Forces the only supported RDP encryption method to be FIPS. */
330 if (settings->FIPSMode || winpr_FIPSMode())
331 {
332 settings->NlaSecurity = FALSE;
333 settings->EncryptionMethods = ENCRYPTION_METHOD_FIPS;
334 }
335
336 UINT32 TcpConnectTimeout = freerdp_settings_get_uint32(settings, FreeRDP_TcpConnectTimeout);
337 if (settings->GatewayArmTransport)
338 {
339 if (!arm_resolve_endpoint(rdp->log, rdp->context, TcpConnectTimeout))
340 {
341 WLog_ERR(TAG, "error retrieving ARM configuration");
342 return FALSE;
343 }
344 }
345
346 const char* hostname = settings->ServerHostname;
347 if (!hostname)
348 {
349 WLog_ERR(TAG, "Missing hostname, can not connect to NULL target");
350 return FALSE;
351 }
352
353 const UINT32 port = settings->ServerPort;
354 WINPR_ASSERT(port <= UINT32_MAX);
355
356 nego_init(rdp->nego);
357 nego_set_target(rdp->nego, hostname, (UINT16)port);
358
359 if (settings->GatewayEnabled)
360 {
361 char* user = NULL;
362 char* domain = NULL;
363 size_t user_length = 0;
364
365 if (settings->Username)
366 {
367 user = settings->Username;
368 user_length = strlen(settings->Username);
369 }
370
371 if (settings->Domain)
372 domain = settings->Domain;
373 else
374 domain = settings->ComputerName;
375
376 const size_t domain_length = strlen(domain);
377 const size_t cookie_length = domain_length + 1 + user_length;
378 char* cookie = malloc(cookie_length + 1);
379
380 if (!cookie)
381 return FALSE;
382
383 CopyMemory(cookie, domain, domain_length);
384 WINPR_ASSERT(domain_length <= UINT32_MAX);
385 CharUpperBuffA(cookie, (UINT32)domain_length);
386 cookie[domain_length] = '\\';
387
388 if (settings->Username)
389 CopyMemory(&cookie[domain_length + 1], user, user_length);
390
391 cookie[cookie_length] = '\0';
392 status = nego_set_cookie(rdp->nego, cookie);
393 free(cookie);
394 }
395 else
396 {
397 status = nego_set_cookie(rdp->nego, settings->Username);
398 }
399
400 if (!status)
401 return FALSE;
402
403 nego_set_childsession_enabled(rdp->nego, settings->ConnectChildSession);
404 nego_set_send_preconnection_pdu(rdp->nego, settings->SendPreconnectionPdu);
405 nego_set_preconnection_id(rdp->nego, settings->PreconnectionId);
406 nego_set_preconnection_blob(rdp->nego, settings->PreconnectionBlob);
407 nego_set_negotiation_enabled(rdp->nego, settings->NegotiateSecurityLayer);
408 nego_set_restricted_admin_mode_required(rdp->nego, settings->RestrictedAdminModeRequired);
409 nego_set_RCG_required(rdp->nego, settings->RemoteCredentialGuard);
410 nego_set_gateway_enabled(rdp->nego, settings->GatewayEnabled);
411 nego_set_gateway_bypass_local(rdp->nego, settings->GatewayBypassLocal);
412 nego_enable_rdp(rdp->nego, settings->RdpSecurity);
413 nego_enable_tls(rdp->nego, settings->TlsSecurity);
414 nego_enable_nla(rdp->nego, settings->NlaSecurity);
415 nego_enable_ext(rdp->nego, settings->ExtSecurity);
416 nego_enable_rdstls(rdp->nego, settings->RdstlsSecurity);
417 nego_enable_aad(rdp->nego, settings->AadSecurity);
418
419 if (settings->MstscCookieMode)
420 settings->CookieMaxLength = MSTSC_COOKIE_MAX_LENGTH;
421
422 nego_set_cookie_max_length(rdp->nego, settings->CookieMaxLength);
423
424 if (settings->LoadBalanceInfo && (settings->LoadBalanceInfoLength > 0))
425 {
426 if (!nego_set_routing_token(rdp->nego, settings->LoadBalanceInfo,
427 settings->LoadBalanceInfoLength))
428 return FALSE;
429 }
430
431 if (!freerdp_settings_get_bool(settings, FreeRDP_TransportDumpReplay))
432 {
433 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_NEGO))
434 return FALSE;
435
436 if (!nego_connect(rdp->nego))
437 {
438 if (!freerdp_get_last_error(rdp->context))
439 {
440 freerdp_set_last_error_log(rdp->context,
441 FREERDP_ERROR_SECURITY_NEGO_CONNECT_FAILED);
442 WLog_ERR(TAG, "Error: protocol security negotiation or connection failure");
443 }
444
445 return FALSE;
446 }
447
448 SelectedProtocol = nego_get_selected_protocol(rdp->nego);
449
450 if ((SelectedProtocol & PROTOCOL_SSL) || (SelectedProtocol == PROTOCOL_RDP) ||
451 (SelectedProtocol == PROTOCOL_RDSTLS))
452 {
453 wStream s = { 0 };
454
455 if ((settings->Username != NULL) &&
456 ((freerdp_settings_get_string(settings, FreeRDP_Password) != NULL) ||
457 (settings->RedirectionPassword != NULL &&
458 settings->RedirectionPasswordLength > 0)))
459 settings->AutoLogonEnabled = TRUE;
460
461 if (rdp_recv_callback(rdp->transport, &s, rdp) < 0)
462 return FALSE;
463 }
464
465 transport_set_blocking_mode(rdp->transport, FALSE);
466 }
467 else
468 {
469 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_REQUEST))
470 return FALSE;
471 }
472
473 /* everything beyond this point is event-driven and non blocking */
474 if (!transport_set_recv_callbacks(rdp->transport, rdp_recv_callback, rdp))
475 return FALSE;
476
477 return rdp_client_wait_for_activation(rdp);
478}
479
480BOOL rdp_client_disconnect(rdpRdp* rdp)
481{
482 rdpContext* context = NULL;
483
484 if (!rdp || !rdp->settings || !rdp->context)
485 return FALSE;
486
487 context = rdp->context;
488
489 if (rdp->nego)
490 {
491 if (!nego_disconnect(rdp->nego))
492 return FALSE;
493 }
494
495 if (!transport_disconnect(rdp->transport))
496 return FALSE;
497
498 if (!rdp_reset(rdp))
499 return FALSE;
500
501 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_INITIAL))
502 return FALSE;
503
504 if (freerdp_channels_disconnect(context->channels, context->instance) != CHANNEL_RC_OK)
505 return FALSE;
506
507 freerdp_client_codecs_free(context->codecs);
508 context->codecs = NULL;
509 return TRUE;
510}
511
512BOOL rdp_client_disconnect_and_clear(rdpRdp* rdp)
513{
514 rdpContext* context = NULL;
515
516 if (!rdp_client_disconnect(rdp))
517 return FALSE;
518
519 WINPR_ASSERT(rdp);
520
521 context = rdp->context;
522 WINPR_ASSERT(context);
523
524 if (freerdp_get_last_error(context) == FREERDP_ERROR_CONNECT_CANCELLED)
525 return FALSE;
526
527 context->LastError = FREERDP_ERROR_SUCCESS;
528 clearChannelError(context);
529 return utils_reset_abort(rdp);
530}
531
532static BOOL rdp_client_reconnect_channels(rdpRdp* rdp, BOOL redirect)
533{
534 BOOL status = FALSE;
535 rdpContext* context = NULL;
536
537 if (!rdp || !rdp->context || !rdp->context->channels)
538 return FALSE;
539
540 context = rdp->context;
541
542 if (context->instance->ConnectionCallbackState == CLIENT_STATE_INITIAL)
543 return FALSE;
544
545 if (context->instance->ConnectionCallbackState == CLIENT_STATE_PRECONNECT_PASSED)
546 {
547 if (redirect)
548 return TRUE;
549
550 pointer_cache_register_callbacks(context->update);
551
552 if (!IFCALLRESULT(FALSE, context->instance->PostConnect, context->instance))
553 return FALSE;
554
555 context->instance->ConnectionCallbackState = CLIENT_STATE_POSTCONNECT_PASSED;
556 }
557
558 if (context->instance->ConnectionCallbackState == CLIENT_STATE_POSTCONNECT_PASSED)
559 status =
560 (freerdp_channels_post_connect(context->channels, context->instance) == CHANNEL_RC_OK);
561
562 return status;
563}
564
565static BOOL rdp_client_redirect_resolvable(const char* host)
566{
567 struct addrinfo* result = freerdp_tcp_resolve_host(host, -1, 0);
568
569 if (!result)
570 return FALSE;
571
572 freeaddrinfo(result);
573 return TRUE;
574}
575
576static BOOL rdp_client_redirect_try_fqdn(rdpSettings* settings)
577{
578 if (settings->RedirectionFlags & LB_TARGET_FQDN)
579 {
580 if (settings->GatewayEnabled ||
581 rdp_client_redirect_resolvable(settings->RedirectionTargetFQDN))
582 {
583 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
584 settings->RedirectionTargetFQDN))
585 return FALSE;
586
587 return TRUE;
588 }
589 }
590
591 return FALSE;
592}
593
594static BOOL rdp_client_redirect_try_ip(rdpSettings* settings)
595{
596 if (settings->RedirectionFlags & LB_TARGET_NET_ADDRESS)
597 {
598 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
599 settings->TargetNetAddress))
600 return FALSE;
601
602 return TRUE;
603 }
604
605 return FALSE;
606}
607
608static BOOL rdp_client_redirect_try_netbios(rdpSettings* settings)
609{
610 if (settings->RedirectionFlags & LB_TARGET_NETBIOS_NAME)
611 {
612 if (settings->GatewayEnabled ||
613 rdp_client_redirect_resolvable(settings->RedirectionTargetNetBiosName))
614 {
615 if (!freerdp_settings_set_string(settings, FreeRDP_ServerHostname,
616 settings->RedirectionTargetNetBiosName))
617 return FALSE;
618
619 return TRUE;
620 }
621 }
622
623 return FALSE;
624}
625
626BOOL rdp_client_redirect(rdpRdp* rdp)
627{
628 BOOL status = 0;
629 rdpSettings* settings = NULL;
630
631 if (!rdp_client_disconnect_and_clear(rdp))
632 return FALSE;
633
634 /* Only disconnect & close the channels here.
635 * they will be discarded and recreated after the new settings have been applied. */
636 freerdp_channels_disconnect(rdp->context->channels, rdp->context->instance);
637 freerdp_channels_close(rdp->context->channels, rdp->context->instance);
638
639 if (rdp_redirection_apply_settings(rdp) != 0)
640 return FALSE;
641
642 WINPR_ASSERT(rdp);
643
644 settings = rdp->settings;
645 WINPR_ASSERT(settings);
646
647 if ((settings->RedirectionFlags & LB_LOAD_BALANCE_INFO) == 0)
648 {
649 BOOL haveRedirectAddress = FALSE;
650 UINT32 redirectionMask = settings->RedirectionPreferType;
651
652 do
653 {
654 const BOOL tryFQDN = (redirectionMask & 0x01) == 0;
655 const BOOL tryNetAddress = (redirectionMask & 0x02) == 0;
656 const BOOL tryNetbios = (redirectionMask & 0x04) == 0;
657
658 if (tryFQDN && !haveRedirectAddress)
659 haveRedirectAddress = rdp_client_redirect_try_fqdn(settings);
660
661 if (tryNetAddress && !haveRedirectAddress)
662 haveRedirectAddress = rdp_client_redirect_try_ip(settings);
663
664 if (tryNetbios && !haveRedirectAddress)
665 haveRedirectAddress = rdp_client_redirect_try_netbios(settings);
666
667 redirectionMask >>= 3;
668 } while (!haveRedirectAddress && (redirectionMask != 0));
669 }
670
671 if (settings->RedirectionFlags & LB_USERNAME)
672 {
673 if (!freerdp_settings_set_string(
674 settings, FreeRDP_Username,
675 freerdp_settings_get_string(settings, FreeRDP_RedirectionUsername)))
676 return FALSE;
677 }
678
679 if (settings->RedirectionFlags & LB_DOMAIN)
680 {
681 if (!freerdp_settings_set_string(
682 settings, FreeRDP_Domain,
683 freerdp_settings_get_string(settings, FreeRDP_RedirectionDomain)))
684 return FALSE;
685 }
686
687 settings->RdstlsSecurity =
688 (settings->RedirectionFlags & LB_PASSWORD_IS_PK_ENCRYPTED) != 0 ? TRUE : FALSE;
689
690 WINPR_ASSERT(rdp->context);
691 WINPR_ASSERT(rdp->context->instance);
692 if (!IFCALLRESULT(TRUE, rdp->context->instance->Redirect, rdp->context->instance))
693 return FALSE;
694
695 BOOL ok = utils_reload_channels(rdp->context);
696 if (!ok)
697 return FALSE;
698
699 status = rdp_client_connect(rdp);
700
701 if (status)
702 status = rdp_client_reconnect_channels(rdp, TRUE);
703
704 return status;
705}
706
707BOOL rdp_client_reconnect(rdpRdp* rdp)
708{
709 BOOL status = 0;
710
711 if (!rdp_client_disconnect_and_clear(rdp))
712 return FALSE;
713
714 status = rdp_client_connect(rdp);
715
716 if (status)
717 status = rdp_client_reconnect_channels(rdp, FALSE);
718
719 return status;
720}
721
722static const BYTE fips_ivec[8] = { 0x12, 0x34, 0x56, 0x78, 0x90, 0xAB, 0xCD, 0xEF };
723
724static BOOL rdp_client_establish_keys(rdpRdp* rdp)
725{
726 wStream* s = NULL;
727 BOOL ret = FALSE;
728
729 WINPR_ASSERT(rdp);
730 rdpSettings* settings = rdp->settings;
731 BYTE* crypt_client_random = NULL;
732
733 WINPR_ASSERT(settings);
734 if (!settings->UseRdpSecurityLayer)
735 {
736 /* no RDP encryption */
737 return TRUE;
738 }
739
740 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT))
741 return FALSE;
742
743 /* encrypt client random */
744 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, NULL,
745 CLIENT_RANDOM_LENGTH))
746 return FALSE;
747 winpr_RAND(settings->ClientRandom, settings->ClientRandomLength);
748
749 const rdpCertInfo* info = freerdp_certificate_get_info(settings->RdpServerCertificate);
750 if (!info)
751 {
752 WLog_ERR(TAG, "Failed to get rdpCertInfo from RdpServerCertificate");
753 return FALSE;
754 }
755
756 /*
757 * client random must be (bitlen / 8) + 8 - see [MS-RDPBCGR] 5.3.4.1
758 * for details
759 */
760 crypt_client_random = calloc(info->ModulusLength, 1);
761
762 if (!crypt_client_random)
763 return FALSE;
764
765 crypto_rsa_public_encrypt(settings->ClientRandom, settings->ClientRandomLength, info,
766 crypt_client_random, info->ModulusLength);
767 /* send crypt client random to server */
768 const size_t length = RDP_PACKET_HEADER_MAX_LENGTH + RDP_SECURITY_HEADER_LENGTH + 4ULL +
769 info->ModulusLength + 8ULL;
770 if (length > UINT16_MAX)
771 return FALSE;
772
773 s = Stream_New(NULL, length);
774
775 if (!s)
776 {
777 WLog_ERR(TAG, "Stream_New failed!");
778 goto end;
779 }
780
781 {
782 const UINT16 sec_flags = SEC_EXCHANGE_PKT | SEC_LICENSE_ENCRYPT_SC;
783 if (!rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID, sec_flags))
784 goto end;
785 if (!rdp_write_security_header(rdp, s, sec_flags))
786 goto end;
787 }
788
789 Stream_Write_UINT32(s, info->ModulusLength + 8);
790 Stream_Write(s, crypt_client_random, info->ModulusLength);
791 Stream_Zero(s, 8);
792 Stream_SealLength(s);
793
794 {
795 rdpTransport* transport = freerdp_get_transport(rdp->context);
796 const int status = transport_write(transport, s);
797
798 if (status < 0)
799 goto end;
800 }
801
802 rdp->do_crypt_license = TRUE;
803
804 /* now calculate encrypt / decrypt and update keys */
805 if (!security_establish_keys(rdp))
806 goto end;
807
808 rdp->do_crypt = TRUE;
809
810 if (settings->SaltedChecksum)
811 rdp->do_secure_checksum = TRUE;
812
813 if (settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
814 {
815 rdp->fips_encrypt =
816 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
817 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
818
819 if (!rdp->fips_encrypt)
820 {
821 WLog_ERR(TAG, "unable to allocate des3 encrypt key");
822 goto end;
823 }
824
825 rdp->fips_decrypt =
826 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
827 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
828
829 if (!rdp->fips_decrypt)
830 {
831 WLog_ERR(TAG, "unable to allocate des3 decrypt key");
832 goto end;
833 }
834
835 ret = TRUE;
836 goto end;
837 }
838
839 if (!rdp_reset_rc4_encrypt_keys(rdp))
840 goto end;
841 if (!rdp_reset_rc4_decrypt_keys(rdp))
842 goto end;
843
844 ret = TRUE;
845end:
846 Stream_Free(s, TRUE);
847 free(crypt_client_random);
848
849 if (!ret)
850 {
851 winpr_Cipher_Free(rdp->fips_decrypt);
852 winpr_Cipher_Free(rdp->fips_encrypt);
853 rdp->fips_decrypt = NULL;
854 rdp->fips_encrypt = NULL;
855
856 rdp_free_rc4_decrypt_keys(rdp);
857 rdp_free_rc4_encrypt_keys(rdp);
858 }
859
860 return ret;
861}
862
863static BOOL rdp_update_client_random(rdpSettings* settings, const BYTE* crypt_random,
864 size_t crypt_random_len)
865{
866 const size_t length = 32;
867 WINPR_ASSERT(settings);
868
869 const rdpPrivateKey* rsa = freerdp_settings_get_pointer(settings, FreeRDP_RdpServerRsaKey);
870 WINPR_ASSERT(rsa);
871
872 const rdpCertInfo* cinfo = freerdp_key_get_info(rsa);
873 WINPR_ASSERT(cinfo);
874
875 if (crypt_random_len != cinfo->ModulusLength + 8)
876 {
877 WLog_ERR(TAG, "invalid encrypted client random length");
878 return FALSE;
879 }
880 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ClientRandom, NULL, length))
881 return FALSE;
882
883 BYTE* client_random = freerdp_settings_get_pointer_writable(settings, FreeRDP_ClientRandom);
884 WINPR_ASSERT(client_random);
885 return crypto_rsa_private_decrypt(crypt_random, crypt_random_len - 8, rsa, client_random,
886 length) > 0;
887}
888
889BOOL rdp_server_establish_keys(rdpRdp* rdp, wStream* s)
890{
891 UINT32 rand_len = 0;
892 UINT16 channel_id = 0;
893 UINT16 length = 0;
894 UINT16 sec_flags = 0;
895 BOOL ret = FALSE;
896
897 WINPR_ASSERT(rdp);
898
899 if (!rdp->settings->UseRdpSecurityLayer)
900 {
901 /* No RDP Security. */
902 return TRUE;
903 }
904
905 if (!rdp_read_header(rdp, s, &length, &channel_id))
906 return FALSE;
907
908 if (!rdp_read_security_header(rdp, s, &sec_flags, NULL))
909 {
910 WLog_Print(rdp->log, WLOG_ERROR, "invalid security header");
911 return FALSE;
912 }
913
914 if ((sec_flags & SEC_EXCHANGE_PKT) == 0)
915 {
916 WLog_Print(rdp->log, WLOG_ERROR, "missing SEC_EXCHANGE_PKT in security header");
917 return FALSE;
918 }
919
920 rdp->do_crypt_license = (sec_flags & SEC_LICENSE_ENCRYPT_SC) != 0 ? TRUE : FALSE;
921
922 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, 4))
923 return FALSE;
924
925 Stream_Read_UINT32(s, rand_len);
926
927 /* rand_len already includes 8 bytes of padding */
928 if (!Stream_CheckAndLogRequiredLengthWLog(rdp->log, s, rand_len))
929 return FALSE;
930
931 const BYTE* crypt_random = Stream_ConstPointer(s);
932 if (!Stream_SafeSeek(s, rand_len))
933 goto end;
934 if (!rdp_update_client_random(rdp->settings, crypt_random, rand_len))
935 goto end;
936
937 /* now calculate encrypt / decrypt and update keys */
938 if (!security_establish_keys(rdp))
939 goto end;
940
941 rdp->do_crypt = TRUE;
942
943 if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
944 {
945 rdp->fips_encrypt =
946 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_ENCRYPT, rdp->fips_encrypt_key,
947 sizeof(rdp->fips_encrypt_key), fips_ivec, sizeof(fips_ivec));
948
949 if (!rdp->fips_encrypt)
950 {
951 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 encrypt key");
952 goto end;
953 }
954
955 rdp->fips_decrypt =
956 winpr_Cipher_NewEx(WINPR_CIPHER_DES_EDE3_CBC, WINPR_DECRYPT, rdp->fips_decrypt_key,
957 sizeof(rdp->fips_decrypt_key), fips_ivec, sizeof(fips_ivec));
958
959 if (!rdp->fips_decrypt)
960 {
961 WLog_Print(rdp->log, WLOG_ERROR, "unable to allocate des3 decrypt key");
962 goto end;
963 }
964
965 ret = TRUE;
966 goto end;
967 }
968
969 if (!rdp_reset_rc4_encrypt_keys(rdp))
970 goto end;
971
972 if (!rdp_reset_rc4_decrypt_keys(rdp))
973 goto end;
974
975 ret = tpkt_ensure_stream_consumed(rdp->log, s, length);
976end:
977
978 if (!ret)
979 {
980 winpr_Cipher_Free(rdp->fips_encrypt);
981 winpr_Cipher_Free(rdp->fips_decrypt);
982 rdp->fips_encrypt = NULL;
983 rdp->fips_decrypt = NULL;
984
985 rdp_free_rc4_encrypt_keys(rdp);
986 rdp_free_rc4_decrypt_keys(rdp);
987 }
988
989 return ret;
990}
991
992static BOOL rdp_client_send_client_info_and_change_state(rdpRdp* rdp)
993{
994 WINPR_ASSERT(rdp);
995 if (!rdp_client_establish_keys(rdp))
996 return FALSE;
997 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE))
998 return FALSE;
999 if (!rdp_send_client_info(rdp))
1000 return FALSE;
1001 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST))
1002 return FALSE;
1003 return TRUE;
1004}
1005
1006BOOL rdp_client_skip_mcs_channel_join(rdpRdp* rdp)
1007{
1008 WINPR_ASSERT(rdp);
1009
1010 rdpMcs* mcs = rdp->mcs;
1011 WINPR_ASSERT(mcs);
1012
1013 mcs->userChannelJoined = TRUE;
1014 mcs->globalChannelJoined = TRUE;
1015 mcs->messageChannelJoined = TRUE;
1016
1017 for (UINT32 i = 0; i < mcs->channelCount; i++)
1018 {
1019 rdpMcsChannel* cur = &mcs->channels[i];
1020 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1021 cur->joined = TRUE;
1022 }
1023
1024 return rdp_client_send_client_info_and_change_state(rdp);
1025}
1026
1027static BOOL rdp_client_join_channel(rdpRdp* rdp, UINT16 ChannelId)
1028{
1029 WINPR_ASSERT(rdp);
1030
1031 rdpMcs* mcs = rdp->mcs;
1032 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST))
1033 return FALSE;
1034 if (!mcs_send_channel_join_request(mcs, ChannelId))
1035 return FALSE;
1036 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1037 return FALSE;
1038 return TRUE;
1039}
1040
1041BOOL rdp_client_connect_mcs_channel_join_confirm(rdpRdp* rdp, wStream* s)
1042{
1043 UINT16 channelId = 0;
1044 BOOL allJoined = TRUE;
1045
1046 WINPR_ASSERT(rdp);
1047 rdpMcs* mcs = rdp->mcs;
1048
1049 if (!mcs_recv_channel_join_confirm(mcs, s, &channelId))
1050 return FALSE;
1051
1052 if (!mcs->userChannelJoined)
1053 {
1054 if (channelId != mcs->userId)
1055 {
1056 WLog_ERR(TAG, "expected user channel id %" PRIu16 ", but received %" PRIu16,
1057 mcs->userId, channelId);
1058 return FALSE;
1059 }
1060
1061 mcs->userChannelJoined = TRUE;
1062 if (!rdp_client_join_channel(rdp, MCS_GLOBAL_CHANNEL_ID))
1063 return FALSE;
1064 }
1065 else if (!mcs->globalChannelJoined)
1066 {
1067 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1068 {
1069 WLog_ERR(TAG, "expected uglobalser channel id %" PRIu16 ", but received %" PRIu16,
1070 MCS_GLOBAL_CHANNEL_ID, channelId);
1071 return FALSE;
1072 }
1073 mcs->globalChannelJoined = TRUE;
1074
1075 if (mcs->messageChannelId != 0)
1076 {
1077 if (!rdp_client_join_channel(rdp, mcs->messageChannelId))
1078 return FALSE;
1079 allJoined = FALSE;
1080 }
1081 else
1082 {
1083 if (mcs->channelCount > 0)
1084 {
1085 const rdpMcsChannel* cur = &mcs->channels[0];
1086 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1087 return FALSE;
1088 allJoined = FALSE;
1089 }
1090 }
1091 }
1092 else if ((mcs->messageChannelId != 0) && !mcs->messageChannelJoined)
1093 {
1094 if (channelId != mcs->messageChannelId)
1095 {
1096 WLog_ERR(TAG, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1097 mcs->messageChannelId, channelId);
1098 return FALSE;
1099 }
1100
1101 mcs->messageChannelJoined = TRUE;
1102
1103 if (mcs->channelCount > 0)
1104 {
1105 const rdpMcsChannel* cur = &mcs->channels[0];
1106 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1107 return FALSE;
1108 allJoined = FALSE;
1109 }
1110 }
1111 else
1112 {
1113 UINT32 i = 0;
1114 for (; i < mcs->channelCount; i++)
1115 {
1116 rdpMcsChannel* cur = &mcs->channels[i];
1117 if (cur->joined)
1118 continue;
1119
1120 if (cur->ChannelId != channelId)
1121 {
1122 WLog_ERR(TAG, "expected channel id %" PRIu16 ", but received %" PRIu16,
1123 MCS_GLOBAL_CHANNEL_ID, channelId);
1124 return FALSE;
1125 }
1126 cur->joined = TRUE;
1127 break;
1128 }
1129
1130 if (i + 1 < mcs->channelCount)
1131 {
1132 const rdpMcsChannel* cur = &mcs->channels[i + 1];
1133 if (!rdp_client_join_channel(rdp, cur->ChannelId))
1134 return FALSE;
1135 allJoined = FALSE;
1136 }
1137 }
1138
1139 if (mcs->userChannelJoined && mcs->globalChannelJoined && allJoined)
1140 {
1141 if (!rdp_client_send_client_info_and_change_state(rdp))
1142 return FALSE;
1143 }
1144
1145 return TRUE;
1146}
1147
1148state_run_t rdp_handle_message_channel(rdpRdp* rdp, wStream* s, UINT16 channelId, UINT16 length)
1149{
1150 WINPR_ASSERT(rdp);
1151 WINPR_ASSERT(rdp->mcs);
1152
1153 if (!rdp->mcs->messageChannelJoined)
1154 {
1155 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel not joined!");
1156 return STATE_RUN_FAILED;
1157 }
1158 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1159 if (messageChannelId == 0)
1160 {
1161 WLog_Print(rdp->log, WLOG_WARN, "MCS message channel id == 0");
1162 return STATE_RUN_FAILED;
1163 }
1164
1165 if ((channelId != messageChannelId) && (channelId != MCS_GLOBAL_CHANNEL_ID))
1166 {
1167 WLog_Print(rdp->log, WLOG_WARN,
1168 "MCS message channel expected id=[%" PRIu16 "|%d], got %" PRIu16,
1169 messageChannelId, MCS_GLOBAL_CHANNEL_ID, channelId);
1170 return STATE_RUN_FAILED;
1171 }
1172
1173 UINT16 securityFlags = 0;
1174 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1175 return STATE_RUN_FAILED;
1176
1177 if (securityFlags & SEC_ENCRYPT)
1178 {
1179 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1180 return STATE_RUN_FAILED;
1181 }
1182
1183 const state_run_t rc = rdp_recv_message_channel_pdu(rdp, s, securityFlags);
1184 if (state_run_success(rc))
1185 {
1186 if (!tpkt_ensure_stream_consumed(rdp->log, s, length))
1187 return STATE_RUN_FAILED;
1188 }
1189 return rc;
1190}
1191
1192BOOL rdp_client_connect_auto_detect(rdpRdp* rdp, wStream* s, DWORD logLevel)
1193{
1194 WINPR_ASSERT(rdp);
1195 WINPR_ASSERT(rdp->mcs);
1196
1197 const size_t pos = Stream_GetPosition(s);
1198 UINT16 length = 0;
1199 UINT16 channelId = 0;
1200
1201 if (rdp_read_header(rdp, s, &length, &channelId))
1202 {
1203 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1204 /* If the MCS message channel has been joined... */
1205
1206 /* Process any MCS message channel PDUs. */
1207 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1208 {
1209 const state_run_t rc = rdp_handle_message_channel(rdp, s, channelId, length);
1210 return state_run_success(rc);
1211 }
1212 else
1213 {
1214 wLog* log = WLog_Get(TAG);
1215 WLog_Print(log, logLevel, "expected messageChannelId=%" PRIu16 ", got %" PRIu16,
1216 messageChannelId, channelId);
1217 }
1218 }
1219
1220 Stream_SetPosition(s, pos);
1221 return FALSE;
1222}
1223
1224state_run_t rdp_client_connect_license(rdpRdp* rdp, wStream* s)
1225{
1226 state_run_t status = STATE_RUN_FAILED;
1227 LICENSE_STATE state = LICENSE_STATE_ABORTED;
1228 UINT16 length = 0;
1229 UINT16 channelId = 0;
1230 UINT16 securityFlags = 0;
1231
1232 WINPR_ASSERT(rdp);
1233 if (!rdp_read_header(rdp, s, &length, &channelId))
1234 return STATE_RUN_FAILED;
1235
1236 /* there might be autodetect messages mixed in between licensing messages.
1237 * that has been observed with 2k12 R2 and 2k19
1238 */
1239 const UINT16 messageChannelId = rdp->mcs->messageChannelId;
1240 if (rdp->mcs->messageChannelJoined && (channelId == messageChannelId))
1241 {
1242 return rdp_handle_message_channel(rdp, s, channelId, length);
1243 }
1244
1245 if (!rdp_read_security_header(rdp, s, &securityFlags, &length))
1246 return STATE_RUN_FAILED;
1247
1248 if (securityFlags & SEC_ENCRYPT)
1249 {
1250 if (!rdp_decrypt(rdp, s, &length, securityFlags))
1251 return STATE_RUN_FAILED;
1252 }
1253
1254 if (channelId != MCS_GLOBAL_CHANNEL_ID)
1255 WLog_WARN(TAG, "unexpected message for channel %u, expected %u", channelId,
1256 MCS_GLOBAL_CHANNEL_ID);
1257
1258 if ((securityFlags & SEC_LICENSE_PKT) == 0)
1259 {
1260 char buffer[512] = { 0 };
1261 char lbuffer[32] = { 0 };
1262 WLog_ERR(TAG, "securityFlags=%s, missing required flag %s",
1263 rdp_security_flag_string(securityFlags, buffer, sizeof(buffer)),
1264 rdp_security_flag_string(SEC_LICENSE_PKT, lbuffer, sizeof(lbuffer)));
1265 return STATE_RUN_FAILED;
1266 }
1267
1268 status = license_recv(rdp->license, s);
1269
1270 if (state_run_failed(status))
1271 return status;
1272
1273 state = license_get_state(rdp->license);
1274 switch (state)
1275 {
1276 case LICENSE_STATE_ABORTED:
1277 WLog_ERR(TAG, "license connection sequence aborted.");
1278 return STATE_RUN_FAILED;
1279 case LICENSE_STATE_COMPLETED:
1280 if (rdp->settings->MultitransportFlags)
1281 {
1282 if (!rdp_client_transition_to_state(
1283 rdp, CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST))
1284 return STATE_RUN_FAILED;
1285 }
1286 else
1287 {
1288 if (!rdp_client_transition_to_state(
1289 rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1290 return STATE_RUN_FAILED;
1291 }
1292 return STATE_RUN_SUCCESS;
1293 default:
1294 return STATE_RUN_SUCCESS;
1295 }
1296}
1297
1298state_run_t rdp_client_connect_demand_active(rdpRdp* rdp, wStream* s)
1299{
1300 UINT16 length = 0;
1301 UINT16 channelId = 0;
1302 UINT16 pduType = 0;
1303 UINT16 pduSource = 0;
1304
1305 WINPR_ASSERT(rdp);
1306 WINPR_ASSERT(s);
1307 WINPR_ASSERT(rdp->settings);
1308
1309 if (!rdp_recv_get_active_header(rdp, s, &channelId, &length))
1310 return STATE_RUN_FAILED;
1311
1312 if (freerdp_shall_disconnect_context(rdp->context))
1313 return STATE_RUN_QUIT_SESSION;
1314
1315 if (rdp->mcs->messageChannelId && (channelId == rdp->mcs->messageChannelId))
1316 {
1317 rdp->inPackets++;
1318 return rdp_handle_message_channel(rdp, s, channelId, length);
1319 }
1320
1321 if (!rdp_handle_optional_rdp_decryption(rdp, s, &length, NULL))
1322 return STATE_RUN_FAILED;
1323
1324 if (!rdp_read_share_control_header(rdp, s, NULL, NULL, &pduType, &pduSource))
1325 return STATE_RUN_FAILED;
1326
1327 switch (pduType)
1328 {
1329 case PDU_TYPE_DEMAND_ACTIVE:
1330 if (!rdp_recv_demand_active(rdp, s, pduSource, length))
1331 return STATE_RUN_FAILED;
1332 return STATE_RUN_ACTIVE;
1333 default:
1334 return rdp_recv_out_of_sequence_pdu(rdp, s, pduType, length);
1335 }
1336}
1337
1338state_run_t rdp_client_connect_finalize(rdpRdp* rdp)
1339{
1340 WINPR_ASSERT(rdp);
1347 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC))
1348 return STATE_RUN_FAILED;
1349
1350 if (!rdp_send_client_synchronize_pdu(rdp))
1351 return STATE_RUN_FAILED;
1352
1353 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_COOPERATE))
1354 return STATE_RUN_FAILED;
1355 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_COOPERATE))
1356 return STATE_RUN_FAILED;
1357
1358 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL))
1359 return STATE_RUN_FAILED;
1360 if (!rdp_send_client_control_pdu(rdp, CTRLACTION_REQUEST_CONTROL))
1361 return STATE_RUN_FAILED;
1362
1370 if (!rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE) &&
1371 freerdp_settings_get_bool(rdp->settings, FreeRDP_BitmapCachePersistEnabled))
1372 {
1373 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST))
1374 return STATE_RUN_FAILED;
1375 if (!rdp_send_client_persistent_key_list_pdu(rdp))
1376 return STATE_RUN_FAILED;
1377 }
1378
1379 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_FONT_LIST))
1380 return STATE_RUN_FAILED;
1381 if (!rdp_send_client_font_list_pdu(rdp, FONTLIST_FIRST | FONTLIST_LAST))
1382 return STATE_RUN_FAILED;
1383
1384 if (!rdp_client_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1385 return STATE_RUN_FAILED;
1386 return STATE_RUN_SUCCESS;
1387}
1388
1389BOOL rdp_client_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1390{
1391 const char* name = rdp_state_string(state);
1392
1393 WINPR_ASSERT(rdp);
1394 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp), name);
1395
1396 if (!rdp_set_state(rdp, state))
1397 return FALSE;
1398
1399 switch (state)
1400 {
1401 case CONNECTION_STATE_FINALIZATION_SYNC:
1402 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1403 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1404 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1405 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1406 update_reset_state(rdp->update);
1407 break;
1408
1409 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
1410 {
1411 ActivatedEventArgs activatedEvent = { 0 };
1412 rdpContext* context = rdp->context;
1413 EventArgsInit(&activatedEvent, "libfreerdp");
1414 activatedEvent.firstActivation =
1415 !rdp_finalize_is_flag_set(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1416 PubSub_OnActivated(rdp->pubSub, context, &activatedEvent);
1417 }
1418
1419 break;
1420
1421 default:
1422 break;
1423 }
1424
1425 {
1426 ConnectionStateChangeEventArgs stateEvent = { 0 };
1427 rdpContext* context = rdp->context;
1428 EventArgsInit(&stateEvent, "libfreerdp");
1429 stateEvent.state = WINPR_ASSERTING_INT_CAST(int32_t, rdp_get_state(rdp));
1430 stateEvent.active = rdp_is_active_state(rdp);
1431 PubSub_OnConnectionStateChange(rdp->pubSub, context, &stateEvent);
1432 }
1433
1434 return TRUE;
1435}
1436
1437BOOL rdp_server_accept_nego(rdpRdp* rdp, wStream* s)
1438{
1439 UINT32 SelectedProtocol = 0;
1440 UINT32 RequestedProtocols = 0;
1441 BOOL status = 0;
1442 rdpSettings* settings = NULL;
1443 rdpNego* nego = NULL;
1444
1445 WINPR_ASSERT(rdp);
1446 WINPR_ASSERT(s);
1447
1448 settings = rdp->settings;
1449 WINPR_ASSERT(settings);
1450
1451 nego = rdp->nego;
1452 WINPR_ASSERT(nego);
1453
1454 transport_set_blocking_mode(rdp->transport, TRUE);
1455
1456 if (!nego_read_request(nego, s))
1457 return FALSE;
1458
1459 RequestedProtocols = nego_get_requested_protocols(nego);
1460 WLog_DBG(TAG, "Client Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1461 (RequestedProtocols & PROTOCOL_RDSTLS) ? 1 : 0,
1462 (RequestedProtocols & PROTOCOL_HYBRID) ? 1 : 0,
1463 (RequestedProtocols & PROTOCOL_SSL) ? 1 : 0,
1464 (RequestedProtocols == PROTOCOL_RDP) ? 1 : 0);
1465 WLog_DBG(TAG,
1466 "Server Security: RDSTLS:%" PRId32 " NLA:%" PRId32 " TLS:%" PRId32 " RDP:%" PRId32 "",
1467 settings->RdstlsSecurity, settings->NlaSecurity, settings->TlsSecurity,
1468 settings->RdpSecurity);
1469
1470 if ((settings->RdstlsSecurity) && (RequestedProtocols & PROTOCOL_RDSTLS))
1471 {
1472 SelectedProtocol = PROTOCOL_RDSTLS;
1473 }
1474 else if ((settings->NlaSecurity) && (RequestedProtocols & PROTOCOL_HYBRID))
1475 {
1476 SelectedProtocol = PROTOCOL_HYBRID;
1477 }
1478 else if ((settings->TlsSecurity) && (RequestedProtocols & PROTOCOL_SSL))
1479 {
1480 SelectedProtocol = PROTOCOL_SSL;
1481 }
1482 else if ((settings->RdpSecurity) && (RequestedProtocols == PROTOCOL_RDP))
1483 {
1484 SelectedProtocol = PROTOCOL_RDP;
1485 }
1486 else
1487 {
1488 /*
1489 * when here client and server aren't compatible, we select the right
1490 * error message to return to the client in the nego failure packet
1491 */
1492 SelectedProtocol = PROTOCOL_FAILED_NEGO;
1493
1494 if (settings->RdpSecurity)
1495 {
1496 WLog_ERR(TAG, "server supports only Standard RDP Security");
1497 SelectedProtocol |= SSL_NOT_ALLOWED_BY_SERVER;
1498 }
1499 else
1500 {
1501 if (settings->NlaSecurity && !settings->TlsSecurity)
1502 {
1503 WLog_WARN(TAG, "server supports only NLA Security");
1504 SelectedProtocol |= HYBRID_REQUIRED_BY_SERVER;
1505 }
1506 else
1507 {
1508 WLog_WARN(TAG, "server supports only a SSL based Security (TLS or NLA)");
1509 SelectedProtocol |= SSL_REQUIRED_BY_SERVER;
1510 }
1511 }
1512
1513 WLog_ERR(TAG, "Protocol security negotiation failure");
1514 }
1515
1516 if (!(SelectedProtocol & PROTOCOL_FAILED_NEGO))
1517 {
1518 WLog_DBG(TAG, "Negotiated Security: RDSTLS:%d NLA:%d TLS:%d RDP:%d",
1519 (SelectedProtocol & PROTOCOL_RDSTLS) ? 1 : 0,
1520 (SelectedProtocol & PROTOCOL_HYBRID) ? 1 : 0,
1521 (SelectedProtocol & PROTOCOL_SSL) ? 1 : 0,
1522 (SelectedProtocol == PROTOCOL_RDP) ? 1 : 0);
1523 }
1524
1525 if (!nego_set_selected_protocol(nego, SelectedProtocol))
1526 return FALSE;
1527
1528 if (!nego_send_negotiation_response(nego))
1529 return FALSE;
1530
1531 SelectedProtocol = nego_get_selected_protocol(nego);
1532 status = FALSE;
1533
1534 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_VmConnectMode) &&
1535 SelectedProtocol != PROTOCOL_RDP)
1536 /* When behind a Hyper-V proxy, security != RDP is handled by the host. */
1537 status = TRUE;
1538 else if (SelectedProtocol & PROTOCOL_RDSTLS)
1539 status = transport_accept_rdstls(rdp->transport);
1540 else if (SelectedProtocol & PROTOCOL_HYBRID)
1541 status = transport_accept_nla(rdp->transport);
1542 else if (SelectedProtocol & PROTOCOL_SSL)
1543 status = transport_accept_tls(rdp->transport);
1544 else if (SelectedProtocol == PROTOCOL_RDP) /* 0 */
1545 status = transport_accept_rdp(rdp->transport);
1546
1547 if (!status)
1548 return FALSE;
1549
1550 transport_set_blocking_mode(rdp->transport, FALSE);
1551
1552 return TRUE;
1553}
1554
1555static BOOL rdp_update_encryption_level(rdpSettings* settings)
1556{
1557 WINPR_ASSERT(settings);
1558
1559 UINT32 EncryptionLevel = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionLevel);
1560 UINT32 EncryptionMethods = freerdp_settings_get_uint32(settings, FreeRDP_EncryptionMethods);
1561
1572 if (!settings->UseRdpSecurityLayer)
1573 {
1574 /* TLS/NLA is used: disable rdp style encryption */
1575 EncryptionLevel = ENCRYPTION_LEVEL_NONE;
1576 }
1577 else
1578 {
1579 /* verify server encryption level value */
1580 switch (EncryptionLevel)
1581 {
1582 case ENCRYPTION_LEVEL_NONE:
1583 WLog_INFO(TAG, "Active rdp encryption level: NONE");
1584 break;
1585
1586 case ENCRYPTION_LEVEL_FIPS:
1587 WLog_INFO(TAG, "Active rdp encryption level: FIPS Compliant");
1588 break;
1589
1590 case ENCRYPTION_LEVEL_HIGH:
1591 WLog_INFO(TAG, "Active rdp encryption level: HIGH");
1592 break;
1593
1594 case ENCRYPTION_LEVEL_LOW:
1595 WLog_INFO(TAG, "Active rdp encryption level: LOW");
1596 break;
1597
1598 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1599 WLog_INFO(TAG, "Active rdp encryption level: CLIENT-COMPATIBLE");
1600 break;
1601
1602 default:
1603 WLog_ERR(TAG, "Invalid server encryption level 0x%08" PRIX32 "", EncryptionLevel);
1604 WLog_ERR(TAG, "Switching to encryption level CLIENT-COMPATIBLE");
1605 EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
1606 }
1607 }
1608
1609 /* choose rdp encryption method based on server level and client methods */
1610 switch (EncryptionLevel)
1611 {
1612 case ENCRYPTION_LEVEL_NONE:
1613 /* The only valid method is NONE in this case */
1614 EncryptionMethods = ENCRYPTION_METHOD_NONE;
1615 break;
1616
1617 case ENCRYPTION_LEVEL_FIPS:
1618
1619 /* The only valid method is FIPS in this case */
1620 if (!(EncryptionMethods & ENCRYPTION_METHOD_FIPS))
1621 {
1622 WLog_WARN(TAG, "client does not support FIPS as required by server configuration");
1623 }
1624
1625 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1626 break;
1627
1628 case ENCRYPTION_LEVEL_HIGH:
1629
1630 /* Maximum key strength supported by the server must be used (128 bit)*/
1631 if (!(EncryptionMethods & ENCRYPTION_METHOD_128BIT))
1632 {
1633 WLog_WARN(TAG, "client does not support 128 bit encryption method as required by "
1634 "server configuration");
1635 }
1636
1637 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1638 break;
1639
1640 case ENCRYPTION_LEVEL_LOW:
1641 case ENCRYPTION_LEVEL_CLIENT_COMPATIBLE:
1642
1643 /* Maximum key strength supported by the client must be used */
1644 if (EncryptionMethods & ENCRYPTION_METHOD_128BIT)
1645 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1646 else if (EncryptionMethods & ENCRYPTION_METHOD_56BIT)
1647 EncryptionMethods = ENCRYPTION_METHOD_56BIT;
1648 else if (EncryptionMethods & ENCRYPTION_METHOD_40BIT)
1649 EncryptionMethods = ENCRYPTION_METHOD_40BIT;
1650 else if (EncryptionMethods & ENCRYPTION_METHOD_FIPS)
1651 EncryptionMethods = ENCRYPTION_METHOD_FIPS;
1652 else
1653 {
1654 WLog_WARN(TAG, "client has not announced any supported encryption methods");
1655 EncryptionMethods = ENCRYPTION_METHOD_128BIT;
1656 }
1657
1658 break;
1659
1660 default:
1661 WLog_ERR(TAG, "internal error: unknown encryption level");
1662 return FALSE;
1663 }
1664
1665 /* log selected encryption method */
1666 if (settings->UseRdpSecurityLayer)
1667 {
1668 switch (EncryptionMethods)
1669 {
1670 case ENCRYPTION_METHOD_NONE:
1671 WLog_INFO(TAG, "Selected rdp encryption method: NONE");
1672 break;
1673
1674 case ENCRYPTION_METHOD_40BIT:
1675 WLog_INFO(TAG, "Selected rdp encryption method: 40BIT");
1676 break;
1677
1678 case ENCRYPTION_METHOD_56BIT:
1679 WLog_INFO(TAG, "Selected rdp encryption method: 56BIT");
1680 break;
1681
1682 case ENCRYPTION_METHOD_128BIT:
1683 WLog_INFO(TAG, "Selected rdp encryption method: 128BIT");
1684 break;
1685
1686 case ENCRYPTION_METHOD_FIPS:
1687 WLog_INFO(TAG, "Selected rdp encryption method: FIPS");
1688 break;
1689
1690 default:
1691 WLog_ERR(TAG, "internal error: unknown encryption method");
1692 return FALSE;
1693 }
1694 }
1695
1696 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionLevel, EncryptionLevel))
1697 return FALSE;
1698 if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionMethods, EncryptionMethods))
1699 return FALSE;
1700 return TRUE;
1701}
1702
1703BOOL rdp_server_accept_mcs_connect_initial(rdpRdp* rdp, wStream* s)
1704{
1705 WINPR_ASSERT(rdp);
1706 WINPR_ASSERT(s);
1707
1708 rdpMcs* mcs = rdp->mcs;
1709 WINPR_ASSERT(mcs);
1710
1711 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CREATE_REQUEST);
1712 if (!mcs_recv_connect_initial(mcs, s))
1713 return FALSE;
1714 WINPR_ASSERT(rdp->settings);
1715
1716 if (!mcs_server_apply_to_settings(mcs, rdp->settings))
1717 return FALSE;
1718
1719 WLog_DBG(TAG, "Accepted client: %s", rdp->settings->ClientHostname);
1720 WLog_DBG(TAG, "Accepted channels:");
1721
1722 WINPR_ASSERT(mcs->channels || (mcs->channelCount == 0));
1723 for (UINT32 i = 0; i < mcs->channelCount; i++)
1724 {
1725 ADDIN_ARGV* arg = NULL;
1726 rdpMcsChannel* cur = &mcs->channels[i];
1727 const char* params[1] = { cur->Name };
1728 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1729 arg = freerdp_addin_argv_new(ARRAYSIZE(params), params);
1730 if (!arg)
1731 return FALSE;
1732
1733 if (!freerdp_static_channel_collection_add(rdp->settings, arg))
1734 {
1735 freerdp_addin_argv_free(arg);
1736 return FALSE;
1737 }
1738 }
1739
1740 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CREATE_RESPONSE))
1741 return FALSE;
1742 if (!rdp_update_encryption_level(rdp->settings))
1743 return FALSE;
1744 if (!mcs_send_connect_response(mcs))
1745 return FALSE;
1746 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ERECT_DOMAIN))
1747 return FALSE;
1748
1749 return TRUE;
1750}
1751
1752BOOL rdp_server_accept_mcs_erect_domain_request(rdpRdp* rdp, wStream* s)
1753{
1754 WINPR_ASSERT(rdp);
1755 WINPR_ASSERT(s);
1756 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_ERECT_DOMAIN);
1757
1758 if (!mcs_recv_erect_domain_request(rdp->mcs, s))
1759 return FALSE;
1760
1761 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER);
1762}
1763
1764static BOOL rdp_server_skip_mcs_channel_join(rdpRdp* rdp)
1765{
1766 WINPR_ASSERT(rdp);
1767
1768 rdpMcs* mcs = rdp->mcs;
1769 WINPR_ASSERT(mcs);
1770
1771 mcs->userChannelJoined = TRUE;
1772 mcs->globalChannelJoined = TRUE;
1773 mcs->messageChannelJoined = TRUE;
1774
1775 for (UINT32 i = 0; i < mcs->channelCount; i++)
1776 {
1777 rdpMcsChannel* cur = &mcs->channels[i];
1778 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1779 cur->joined = TRUE;
1780 }
1781 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT);
1782}
1783
1784BOOL rdp_server_accept_mcs_attach_user_request(rdpRdp* rdp, wStream* s)
1785{
1786 if (!mcs_recv_attach_user_request(rdp->mcs, s))
1787 return FALSE;
1788
1789 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM))
1790 return FALSE;
1791
1792 if (!mcs_send_attach_user_confirm(rdp->mcs))
1793 return FALSE;
1794
1795 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_SupportSkipChannelJoin))
1796 return rdp_server_skip_mcs_channel_join(rdp);
1797 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1798}
1799
1800BOOL rdp_server_accept_mcs_channel_join_request(rdpRdp* rdp, wStream* s)
1801{
1802 UINT16 channelId = 0;
1803 BOOL allJoined = TRUE;
1804 rdpMcs* mcs = NULL;
1805
1806 WINPR_ASSERT(rdp);
1807 WINPR_ASSERT(rdp->context);
1808
1809 mcs = rdp->mcs;
1810 WINPR_ASSERT(mcs);
1811
1812 WINPR_ASSERT(rdp_get_state(rdp) == CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST);
1813
1814 if (!mcs_recv_channel_join_request(mcs, rdp->settings, s, &channelId))
1815 return FALSE;
1816
1817 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE))
1818 return FALSE;
1819
1820 if (!mcs_send_channel_join_confirm(mcs, channelId))
1821 return FALSE;
1822
1823 if (channelId == mcs->userId)
1824 mcs->userChannelJoined = TRUE;
1825 if (channelId == MCS_GLOBAL_CHANNEL_ID)
1826 mcs->globalChannelJoined = TRUE;
1827 if (channelId == mcs->messageChannelId)
1828 mcs->messageChannelJoined = TRUE;
1829
1830 for (UINT32 i = 0; i < mcs->channelCount; i++)
1831 {
1832 rdpMcsChannel* cur = &mcs->channels[i];
1833 WLog_DBG(TAG, " %s [%" PRIu16 "]", cur->Name, cur->ChannelId);
1834 if (cur->ChannelId == channelId)
1835 cur->joined = TRUE;
1836
1837 if (!cur->joined)
1838 allJoined = FALSE;
1839 }
1840
1841 CONNECTION_STATE rc = CONNECTION_STATE_INITIAL;
1842 if ((mcs->userChannelJoined) && (mcs->globalChannelJoined) &&
1843 (mcs->messageChannelId == 0 || mcs->messageChannelJoined) && allJoined)
1844 rc = CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT;
1845 else
1846 rc = CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST;
1847
1848 return rdp_server_transition_to_state(rdp, rc);
1849}
1850
1851static BOOL rdp_server_send_sync(rdpRdp* rdp)
1852{
1853 WINPR_ASSERT(rdp);
1854
1855 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_SYNC))
1856 return FALSE;
1857 if (!rdp_send_server_synchronize_pdu(rdp))
1858 return FALSE;
1859 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE))
1860 return FALSE;
1861 if (!rdp_send_server_control_cooperate_pdu(rdp))
1862 return FALSE;
1863 if (!rdp_finalize_reset_flags(rdp, FALSE))
1864 return FALSE;
1865 return rdp_server_transition_to_state(rdp, CONNECTION_STATE_FINALIZATION_SYNC);
1866}
1867
1868BOOL rdp_server_accept_confirm_active(rdpRdp* rdp, wStream* s, UINT16 pduLength)
1869{
1870 WINPR_ASSERT(rdp);
1871 WINPR_ASSERT(rdp->context);
1872 WINPR_ASSERT(rdp->settings);
1873 WINPR_ASSERT(s);
1874
1875 freerdp_peer* peer = rdp->context->peer;
1876 WINPR_ASSERT(peer);
1877
1878 if (rdp_get_state(rdp) != CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE)
1879 {
1880 if (freerdp_settings_get_bool(rdp->settings, FreeRDP_TransportDumpReplay))
1881 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1882 else
1883 {
1884 WLog_WARN(TAG, "Invalid state, got %s, expected %s", rdp_get_state_string(rdp),
1885 rdp_state_string(CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE));
1886 return FALSE;
1887 }
1888 }
1889
1890 if (!rdp_recv_confirm_active(rdp, s, pduLength))
1891 return FALSE;
1892
1893 if (peer->ClientCapabilities && !peer->ClientCapabilities(peer))
1894 {
1895 WLog_WARN(TAG, "peer->ClientCapabilities failed");
1896 return FALSE;
1897 }
1898
1899 if (rdp->settings->SaltedChecksum)
1900 rdp->do_secure_checksum = TRUE;
1901
1902 return rdp_server_send_sync(rdp);
1903}
1904
1905BOOL rdp_server_reactivate(rdpRdp* rdp)
1906{
1907 freerdp_peer* client = NULL;
1908
1909 if (rdp->context && rdp->context->peer)
1910 client = rdp->context->peer;
1911
1912 if (client)
1913 client->activated = FALSE;
1914
1915 if (!rdp_send_deactivate_all(rdp))
1916 return FALSE;
1917
1918 rdp_finalize_set_flag(rdp, FINALIZE_DEACTIVATE_REACTIVATE);
1919 if (!rdp_server_transition_to_state(rdp, CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE))
1920 return FALSE;
1921
1922 state_run_t rc = rdp_peer_handle_state_demand_active(client);
1923 return state_run_success(rc);
1924}
1925
1926static BOOL rdp_is_active_peer_state(CONNECTION_STATE state)
1927{
1928 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1929 * 'upon receipt of the Font List PDU the server can start sending graphics
1930 * output to the client'
1931 */
1932 switch (state)
1933 {
1934 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1935 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1936 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1937 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1938 case CONNECTION_STATE_ACTIVE:
1939 return TRUE;
1940 default:
1941 return FALSE;
1942 }
1943}
1944
1945static BOOL rdp_is_active_client_state(CONNECTION_STATE state)
1946{
1947 /* [MS-RDPBCGR] 1.3.1.1 Connection Sequence states:
1948 * 'Once the client has sent the Confirm Active PDU, it can start sending
1949 * mouse and keyboard input to the server'
1950 */
1951 switch (state)
1952 {
1953 case CONNECTION_STATE_FINALIZATION_SYNC:
1954 case CONNECTION_STATE_FINALIZATION_COOPERATE:
1955 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
1956 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
1957 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
1958 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
1959 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
1960 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
1961 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
1962 case CONNECTION_STATE_ACTIVE:
1963 return TRUE;
1964 default:
1965 return FALSE;
1966 }
1967}
1968
1969BOOL rdp_is_active_state(const rdpRdp* rdp)
1970{
1971 WINPR_ASSERT(rdp);
1972 WINPR_ASSERT(rdp->context);
1973
1974 const CONNECTION_STATE state = rdp_get_state(rdp);
1975 if (freerdp_settings_get_bool(rdp->context->settings, FreeRDP_ServerMode))
1976 return rdp_is_active_peer_state(state);
1977 else
1978 return rdp_is_active_client_state(state);
1979}
1980
1981BOOL rdp_server_transition_to_state(rdpRdp* rdp, CONNECTION_STATE state)
1982{
1983 BOOL status = FALSE;
1984 freerdp_peer* client = NULL;
1985 const CONNECTION_STATE cstate = rdp_get_state(rdp);
1986
1987 if (cstate >= CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT)
1988 {
1989 WINPR_ASSERT(rdp->context);
1990 client = rdp->context->peer;
1991 }
1992
1993 if (!rdp_is_active_peer_state(cstate))
1994 {
1995 if (client)
1996 client->activated = FALSE;
1997 }
1998
1999 WLog_Print(rdp->log, WLOG_DEBUG, "%s --> %s", rdp_get_state_string(rdp),
2000 rdp_state_string(state));
2001 if (!rdp_set_state(rdp, state))
2002 goto fail;
2003
2004 status = TRUE;
2005fail:
2006 return status;
2007}
2008
2009const char* rdp_client_connection_state_string(UINT state)
2010{
2011 switch (state)
2012 {
2013 case CLIENT_STATE_INITIAL:
2014 return "CLIENT_STATE_INITIAL";
2015 case CLIENT_STATE_PRECONNECT_PASSED:
2016 return "CLIENT_STATE_PRECONNECT_PASSED";
2017 case CLIENT_STATE_POSTCONNECT_PASSED:
2018 return "CLIENT_STATE_POSTCONNECT_PASSED";
2019 default:
2020 return "UNKNOWN";
2021 }
2022}
2023
2024const char* rdp_state_string(CONNECTION_STATE state)
2025{
2026 switch (state)
2027 {
2028 case CONNECTION_STATE_INITIAL:
2029 return "CONNECTION_STATE_INITIAL";
2030 case CONNECTION_STATE_NEGO:
2031 return "CONNECTION_STATE_NEGO";
2032 case CONNECTION_STATE_NLA:
2033 return "CONNECTION_STATE_NLA";
2034 case CONNECTION_STATE_AAD:
2035 return "CONNECTION_STATE_AAD";
2036 case CONNECTION_STATE_MCS_CREATE_REQUEST:
2037 return "CONNECTION_STATE_MCS_CREATE_REQUEST";
2038 case CONNECTION_STATE_MCS_CREATE_RESPONSE:
2039 return "CONNECTION_STATE_MCS_CREATE_RESPONSE";
2040 case CONNECTION_STATE_MCS_ERECT_DOMAIN:
2041 return "CONNECTION_STATE_MCS_ERECT_DOMAIN";
2042 case CONNECTION_STATE_MCS_ATTACH_USER:
2043 return "CONNECTION_STATE_MCS_ATTACH_USER";
2044 case CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM:
2045 return "CONNECTION_STATE_MCS_ATTACH_USER_CONFIRM";
2046 case CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST:
2047 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_REQUEST";
2048 case CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE:
2049 return "CONNECTION_STATE_MCS_CHANNEL_JOIN_RESPONSE";
2050 case CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT:
2051 return "CONNECTION_STATE_RDP_SECURITY_COMMENCEMENT";
2052 case CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE:
2053 return "CONNECTION_STATE_SECURE_SETTINGS_EXCHANGE";
2054 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST:
2055 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_REQUEST";
2056 case CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE:
2057 return "CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_RESPONSE";
2058 case CONNECTION_STATE_LICENSING:
2059 return "CONNECTION_STATE_LICENSING";
2060 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST:
2061 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_REQUEST";
2062 case CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE:
2063 return "CONNECTION_STATE_MULTITRANSPORT_BOOTSTRAPPING_RESPONSE";
2064 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE:
2065 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_DEMAND_ACTIVE";
2066 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT:
2067 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT";
2068 case CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE:
2069 return "CONNECTION_STATE_CAPABILITIES_EXCHANGE_CONFIRM_ACTIVE";
2070 case CONNECTION_STATE_FINALIZATION_SYNC:
2071 return "CONNECTION_STATE_FINALIZATION_SYNC";
2072 case CONNECTION_STATE_FINALIZATION_COOPERATE:
2073 return "CONNECTION_STATE_FINALIZATION_COOPERATE";
2074 case CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL:
2075 return "CONNECTION_STATE_FINALIZATION_REQUEST_CONTROL";
2076 case CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST:
2077 return "CONNECTION_STATE_FINALIZATION_PERSISTENT_KEY_LIST";
2078 case CONNECTION_STATE_FINALIZATION_FONT_LIST:
2079 return "CONNECTION_STATE_FINALIZATION_FONT_LIST";
2080 case CONNECTION_STATE_FINALIZATION_CLIENT_SYNC:
2081 return "CONNECTION_STATE_FINALIZATION_CLIENT_SYNC";
2082 case CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE:
2083 return "CONNECTION_STATE_FINALIZATION_CLIENT_COOPERATE";
2084 case CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL:
2085 return "CONNECTION_STATE_FINALIZATION_CLIENT_GRANTED_CONTROL";
2086 case CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP:
2087 return "CONNECTION_STATE_FINALIZATION_CLIENT_FONT_MAP";
2088 case CONNECTION_STATE_ACTIVE:
2089 return "CONNECTION_STATE_ACTIVE";
2090 default:
2091 return "UNKNOWN";
2092 }
2093}
2094
2095CONNECTION_STATE rdp_get_state(const rdpRdp* rdp)
2096{
2097 WINPR_ASSERT(rdp);
2098 return rdp->state;
2099}
2100
2101BOOL rdp_set_state(rdpRdp* rdp, CONNECTION_STATE state)
2102{
2103 WINPR_ASSERT(rdp);
2104 rdp->state = state;
2105 return TRUE;
2106}
2107
2108const char* rdp_get_state_string(const rdpRdp* rdp)
2109{
2110 CONNECTION_STATE state = rdp_get_state(rdp);
2111 return rdp_state_string(state);
2112}
2113
2114BOOL rdp_channels_from_mcs(rdpSettings* settings, const rdpRdp* rdp)
2115{
2116 const rdpMcs* mcs = NULL;
2117
2118 WINPR_ASSERT(rdp);
2119
2120 mcs = rdp->mcs;
2121 WINPR_ASSERT(mcs);
2122
2123 if (!freerdp_settings_set_pointer_len(settings, FreeRDP_ChannelDefArray, NULL,
2124 CHANNEL_MAX_COUNT))
2125 return FALSE;
2126
2127 for (UINT32 x = 0; x < mcs->channelCount; x++)
2128 {
2129 const rdpMcsChannel* mchannel = &mcs->channels[x];
2130 CHANNEL_DEF cur = { 0 };
2131
2132 memcpy(cur.name, mchannel->Name, sizeof(cur.name));
2133 cur.options = mchannel->options;
2134 if (!freerdp_settings_set_pointer_array(settings, FreeRDP_ChannelDefArray, x, &cur))
2135 return FALSE;
2136 }
2137
2138 return freerdp_settings_set_uint32(settings, FreeRDP_ChannelCount, mcs->channelCount);
2139}
2140
2141/* Here we are in client state CONFIRM_ACTIVE.
2142 *
2143 * This means:
2144 * 1. send the CONFIRM_ACTIVE PDU to the server
2145 * 2. register callbacks, the server can now start sending stuff
2146 */
2147state_run_t rdp_client_connect_confirm_active(rdpRdp* rdp, WINPR_ATTR_UNUSED wStream* s)
2148{
2149 WINPR_ASSERT(rdp);
2150 WINPR_ASSERT(rdp->settings);
2151 WINPR_ASSERT(s);
2152
2153 const UINT32 width = rdp->settings->DesktopWidth;
2154 const UINT32 height = rdp->settings->DesktopHeight;
2155
2156 if (!rdp_send_confirm_active(rdp))
2157 return STATE_RUN_FAILED;
2158
2159 if (!input_register_client_callbacks(rdp->input))
2160 {
2161 WLog_ERR(TAG, "error registering client callbacks");
2162 return STATE_RUN_FAILED;
2163 }
2164
2169 const BOOL deactivate_reactivate =
2170 rdp->was_deactivated && ((rdp->deactivated_width != rdp->settings->DesktopWidth) ||
2171 (rdp->deactivated_height != rdp->settings->DesktopHeight));
2172 const BOOL resolution_change =
2173 ((width != rdp->settings->DesktopWidth) || (height != rdp->settings->DesktopHeight));
2174 if (deactivate_reactivate || resolution_change)
2175 {
2176 BOOL status = TRUE;
2177 IFCALLRET(rdp->update->DesktopResize, status, rdp->update->context);
2178
2179 if (!status)
2180 {
2181 WLog_ERR(TAG, "client desktop resize callback failed");
2182 return STATE_RUN_FAILED;
2183 }
2184 }
2185
2186 WINPR_ASSERT(rdp->context);
2187 if (freerdp_shall_disconnect_context(rdp->context))
2188 return STATE_RUN_SUCCESS;
2189
2190 state_run_t status = STATE_RUN_SUCCESS;
2191 if (!rdp->settings->SupportMonitorLayoutPdu)
2192 status = rdp_client_connect_finalize(rdp);
2193 else
2194 {
2195 if (!rdp_client_transition_to_state(rdp,
2196 CONNECTION_STATE_CAPABILITIES_EXCHANGE_MONITOR_LAYOUT))
2197 status = STATE_RUN_FAILED;
2198 }
2199 if (!rdp_finalize_reset_flags(rdp, FALSE))
2200 status = STATE_RUN_FAILED;
2201 return status;
2202}
2203
2204BOOL rdp_handle_optional_rdp_decryption(rdpRdp* rdp, wStream* s, UINT16* length,
2205 UINT16* pSecurityFlags)
2206{
2207 BOOL rc = FALSE;
2208 WINPR_ASSERT(rdp);
2209 WINPR_ASSERT(rdp->settings);
2210
2211 UINT16 securityFlags = 0;
2212 if (rdp->settings->UseRdpSecurityLayer)
2213 {
2214 if (!rdp_read_security_header(rdp, s, &securityFlags, length))
2215 goto fail;
2216
2217 if (securityFlags & SEC_ENCRYPT)
2218 {
2219 if (!rdp_decrypt(rdp, s, length, securityFlags))
2220 goto fail;
2221 }
2222 }
2223
2224 rc = TRUE;
2225
2226fail:
2227 if (pSecurityFlags)
2228 *pSecurityFlags = securityFlags;
2229 return rc;
2230}
freerdp_settings_get_uint32
FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
freerdp_settings_set_string
FREERDP_API BOOL freerdp_settings_set_string(rdpSettings *settings, FreeRDP_Settings_Keys_String id, const char *param)
Sets a string settings value. The param is copied.
Definition settings_getters.c:3746
freerdp_settings_get_bool
FREERDP_API BOOL freerdp_settings_get_bool(const rdpSettings *settings, FreeRDP_Settings_Keys_Bool id)
Returns a boolean settings value.
freerdp_settings_set_pointer_len
FREERDP_API BOOL freerdp_settings_set_pointer_len(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id, const void *data, size_t len)
Set a pointer to value data.
Definition common/settings.c:1442
freerdp_settings_get_pointer_writable
FREERDP_API void * freerdp_settings_get_pointer_writable(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a mutable pointer settings value.
Definition settings_getters.c:4106
freerdp_settings_get_pointer
FREERDP_API const void * freerdp_settings_get_pointer(const rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a immutable pointer settings value.
Definition common/settings.c:1430
freerdp_settings_get_codecs_flags
FREERDP_API UINT32 freerdp_settings_get_codecs_flags(const rdpSettings *settings)
helper function to get a mask of supported codec flags.
Definition common/settings.c:2011
freerdp_settings_set_uint32
FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 param)
Sets a UINT32 settings value.
freerdp_settings_get_string
FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
ADDIN_ARGV
Definition settings_types.h:367
CHANNEL_DEF
Definition wtsapi.h:78