FreeRDP
Loading...
Searching...
No Matches
libfreerdp/crypto/tls.c
1
22#include <freerdp/config.h>
23
24#include "../core/settings.h"
25
26#include <winpr/assert.h>
27#include <string.h>
28#include <errno.h>
29
30#include <winpr/crt.h>
31#include <winpr/winpr.h>
32#include <winpr/string.h>
33#include <winpr/sspi.h>
34#include <winpr/ssl.h>
35#include <winpr/json.h>
36
37#include <winpr/stream.h>
38#include <freerdp/utils/ringbuffer.h>
39
40#include <freerdp/crypto/certificate.h>
41#include <freerdp/crypto/certificate_data.h>
42#include <freerdp/utils/helpers.h>
43
44#include <freerdp/log.h>
45#include "../crypto/tls.h"
46#include "../core/tcp.h"
47
48#include "opensslcompat.h"
49#include "certificate.h"
50#include "privatekey.h"
51
52#ifdef WINPR_HAVE_POLL_H
53#include <poll.h>
54#endif
55
56#ifdef FREERDP_HAVE_VALGRIND_MEMCHECK_H
57#include <valgrind/memcheck.h>
58#endif
59
60#define TAG FREERDP_TAG("crypto")
61
84typedef struct
85{
86 SSL* ssl;
88} BIO_RDP_TLS;
89
90static int tls_verify_certificate(rdpTls* tls, const rdpCertificate* cert, const char* hostname,
91 UINT16 port);
92static void tls_print_certificate_name_mismatch_error(const char* hostname, UINT16 port,
93 const char* common_name, char** alt_names,
94 size_t alt_names_count);
95static void tls_print_new_certificate_warn(rdpCertificateStore* store, const char* hostname,
96 UINT16 port, const char* fingerprint);
97static void tls_print_certificate_error(rdpCertificateStore* store, rdpCertificateData* stored_data,
98 const char* hostname, UINT16 port, const char* fingerprint);
99
100static void free_tls_public_key(rdpTls* tls)
101{
102 WINPR_ASSERT(tls);
103 free(tls->PublicKey);
104 tls->PublicKey = NULL;
105 tls->PublicKeyLength = 0;
106}
107
108static void free_tls_bindings(rdpTls* tls)
109{
110 WINPR_ASSERT(tls);
111
112 if (tls->Bindings)
113 free(tls->Bindings->Bindings);
114
115 free(tls->Bindings);
116 tls->Bindings = NULL;
117}
118
119static int bio_rdp_tls_write(BIO* bio, const char* buf, int size)
120{
121 int error = 0;
122 int status = 0;
123 BIO_RDP_TLS* tls = (BIO_RDP_TLS*)BIO_get_data(bio);
124
125 if (!buf || !tls)
126 return 0;
127
128 BIO_clear_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_READ | BIO_FLAGS_IO_SPECIAL);
129 EnterCriticalSection(&tls->lock);
130 status = SSL_write(tls->ssl, buf, size);
131 error = SSL_get_error(tls->ssl, status);
132 LeaveCriticalSection(&tls->lock);
133
134 if (status <= 0)
135 {
136 switch (error)
137 {
138 case SSL_ERROR_NONE:
139 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
140 break;
141
142 case SSL_ERROR_WANT_WRITE:
143 BIO_set_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
144 break;
145
146 case SSL_ERROR_WANT_READ:
147 BIO_set_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
148 break;
149
150 case SSL_ERROR_WANT_X509_LOOKUP:
151 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL);
152 BIO_set_retry_reason(bio, BIO_RR_SSL_X509_LOOKUP);
153 break;
154
155 case SSL_ERROR_WANT_CONNECT:
156 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL);
157 BIO_set_retry_reason(bio, BIO_RR_CONNECT);
158 break;
159
160 case SSL_ERROR_SYSCALL:
161 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
162 break;
163
164 case SSL_ERROR_SSL:
165 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
166 break;
167 default:
168 break;
169 }
170 }
171
172 return status;
173}
174
175static int bio_rdp_tls_read(BIO* bio, char* buf, int size)
176{
177 int error = 0;
178 int status = 0;
179 BIO_RDP_TLS* tls = (BIO_RDP_TLS*)BIO_get_data(bio);
180
181 if (!buf || !tls)
182 return 0;
183
184 BIO_clear_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_READ | BIO_FLAGS_IO_SPECIAL);
185 EnterCriticalSection(&tls->lock);
186 status = SSL_read(tls->ssl, buf, size);
187 error = SSL_get_error(tls->ssl, status);
188 LeaveCriticalSection(&tls->lock);
189
190 if (status <= 0)
191 {
192
193 switch (error)
194 {
195 case SSL_ERROR_NONE:
196 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
197 break;
198
199 case SSL_ERROR_WANT_READ:
200 BIO_set_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
201 break;
202
203 case SSL_ERROR_WANT_WRITE:
204 BIO_set_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
205 break;
206
207 case SSL_ERROR_WANT_X509_LOOKUP:
208 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL);
209 BIO_set_retry_reason(bio, BIO_RR_SSL_X509_LOOKUP);
210 break;
211
212 case SSL_ERROR_WANT_ACCEPT:
213 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL);
214 BIO_set_retry_reason(bio, BIO_RR_ACCEPT);
215 break;
216
217 case SSL_ERROR_WANT_CONNECT:
218 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL);
219 BIO_set_retry_reason(bio, BIO_RR_CONNECT);
220 break;
221
222 case SSL_ERROR_SSL:
223 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
224 break;
225
226 case SSL_ERROR_ZERO_RETURN:
227 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
228 break;
229
230 case SSL_ERROR_SYSCALL:
231 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
232 break;
233 default:
234 break;
235 }
236 }
237
238#ifdef FREERDP_HAVE_VALGRIND_MEMCHECK_H
239
240 if (status > 0)
241 {
242 VALGRIND_MAKE_MEM_DEFINED(buf, status);
243 }
244
245#endif
246 return status;
247}
248
249static int bio_rdp_tls_puts(BIO* bio, const char* str)
250{
251 if (!str)
252 return 0;
253
254 const int max = (INT_MAX > SIZE_MAX) ? SIZE_MAX : INT_MAX;
255 const size_t size = strnlen(str, max);
256 if (size >= max)
257 return -1;
258 ERR_clear_error();
259 return BIO_write(bio, str, (int)size);
260}
261
262static int bio_rdp_tls_gets(WINPR_ATTR_UNUSED BIO* bio, WINPR_ATTR_UNUSED char* str,
263 WINPR_ATTR_UNUSED int size)
264{
265 return 1;
266}
267
268static long bio_rdp_tls_ctrl(BIO* bio, int cmd, long num, void* ptr)
269{
270 BIO* ssl_rbio = NULL;
271 BIO* ssl_wbio = NULL;
272 BIO* next_bio = NULL;
273 long status = -1;
274 BIO_RDP_TLS* tls = (BIO_RDP_TLS*)BIO_get_data(bio);
275
276 if (!tls)
277 return 0;
278
279 if (!tls->ssl && (cmd != BIO_C_SET_SSL))
280 return 0;
281
282 next_bio = BIO_next(bio);
283 ssl_rbio = tls->ssl ? SSL_get_rbio(tls->ssl) : NULL;
284 ssl_wbio = tls->ssl ? SSL_get_wbio(tls->ssl) : NULL;
285
286 switch (cmd)
287 {
288 case BIO_CTRL_RESET:
289 SSL_shutdown(tls->ssl);
290
291 if (SSL_in_connect_init(tls->ssl))
292 SSL_set_connect_state(tls->ssl);
293 else if (SSL_in_accept_init(tls->ssl))
294 SSL_set_accept_state(tls->ssl);
295
296 SSL_clear(tls->ssl);
297
298 if (next_bio)
299 status = BIO_ctrl(next_bio, cmd, num, ptr);
300 else if (ssl_rbio)
301 status = BIO_ctrl(ssl_rbio, cmd, num, ptr);
302 else
303 status = 1;
304
305 break;
306
307 case BIO_C_GET_FD:
308 status = BIO_ctrl(ssl_rbio, cmd, num, ptr);
309 break;
310
311 case BIO_CTRL_INFO:
312 status = 0;
313 break;
314
315 case BIO_CTRL_SET_CALLBACK:
316 status = 0;
317 break;
318
319 case BIO_CTRL_GET_CALLBACK:
320 /* The OpenSSL API is horrible here:
321 * we get a function pointer returned and have to cast it to ULONG_PTR
322 * to return the value to the caller.
323 *
324 * This, of course, is something compilers warn about. So silence it by casting */
325 {
326 void* vptr = WINPR_FUNC_PTR_CAST(SSL_get_info_callback(tls->ssl), void*);
327 *((void**)ptr) = vptr;
328 status = 1;
329 }
330 break;
331
332 case BIO_C_SSL_MODE:
333 if (num)
334 SSL_set_connect_state(tls->ssl);
335 else
336 SSL_set_accept_state(tls->ssl);
337
338 status = 1;
339 break;
340
341 case BIO_CTRL_GET_CLOSE:
342 status = BIO_get_shutdown(bio);
343 break;
344
345 case BIO_CTRL_SET_CLOSE:
346 BIO_set_shutdown(bio, (int)num);
347 status = 1;
348 break;
349
350 case BIO_CTRL_WPENDING:
351 status = BIO_ctrl(ssl_wbio, cmd, num, ptr);
352 break;
353
354 case BIO_CTRL_PENDING:
355 status = SSL_pending(tls->ssl);
356
357 if (status == 0)
358 status = BIO_pending(ssl_rbio);
359
360 break;
361
362 case BIO_CTRL_FLUSH:
363 BIO_clear_retry_flags(bio);
364 status = BIO_ctrl(ssl_wbio, cmd, num, ptr);
365 if (status != 1)
366 WLog_DBG(TAG, "BIO_ctrl returned %d", status);
367 BIO_copy_next_retry(bio);
368 status = 1;
369 break;
370
371 case BIO_CTRL_PUSH:
372 if (next_bio && (next_bio != ssl_rbio))
373 {
374#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
375 (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL)
376 SSL_set_bio(tls->ssl, next_bio, next_bio);
377 CRYPTO_add(&(bio->next_bio->references), 1, CRYPTO_LOCK_BIO);
378#else
379 /*
380 * We are going to pass ownership of next to the SSL object...but
381 * we don't own a reference to pass yet - so up ref
382 */
383 BIO_up_ref(next_bio);
384 SSL_set_bio(tls->ssl, next_bio, next_bio);
385#endif
386 }
387
388 status = 1;
389 break;
390
391 case BIO_CTRL_POP:
392
393 /* Only detach if we are the BIO explicitly being popped */
394 if (bio == ptr)
395 {
396 if (ssl_rbio != ssl_wbio)
397 BIO_free_all(ssl_wbio);
398
399#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
400 (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL)
401
402 if (next_bio)
403 CRYPTO_add(&(bio->next_bio->references), -1, CRYPTO_LOCK_BIO);
404
405 tls->ssl->wbio = tls->ssl->rbio = NULL;
406#else
407 /* OpenSSL 1.1: This will also clear the reference we obtained during push */
408 SSL_set_bio(tls->ssl, NULL, NULL);
409#endif
410 }
411
412 status = 1;
413 break;
414
415 case BIO_C_GET_SSL:
416 if (ptr)
417 {
418 *((SSL**)ptr) = tls->ssl;
419 status = 1;
420 }
421
422 break;
423
424 case BIO_C_SET_SSL:
425 BIO_set_shutdown(bio, (int)num);
426
427 if (ptr)
428 {
429 tls->ssl = (SSL*)ptr;
430 ssl_rbio = SSL_get_rbio(tls->ssl);
431 }
432
433 if (ssl_rbio)
434 {
435 if (next_bio)
436 BIO_push(ssl_rbio, next_bio);
437
438 BIO_set_next(bio, ssl_rbio);
439#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
440 (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL)
441 CRYPTO_add(&(ssl_rbio->references), 1, CRYPTO_LOCK_BIO);
442#else
443 BIO_up_ref(ssl_rbio);
444#endif
445 }
446
447 BIO_set_init(bio, 1);
448 status = 1;
449 break;
450
451 case BIO_C_DO_STATE_MACHINE:
452 BIO_clear_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_WRITE | BIO_FLAGS_IO_SPECIAL);
453 BIO_set_retry_reason(bio, 0);
454 status = SSL_do_handshake(tls->ssl);
455
456 if (status <= 0)
457 {
458 const int err = (status < INT32_MIN) ? INT32_MIN : (int)status;
459 switch (SSL_get_error(tls->ssl, err))
460 {
461 case SSL_ERROR_WANT_READ:
462 BIO_set_flags(bio, BIO_FLAGS_READ | BIO_FLAGS_SHOULD_RETRY);
463 break;
464
465 case SSL_ERROR_WANT_WRITE:
466 BIO_set_flags(bio, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY);
467 break;
468
469 case SSL_ERROR_WANT_CONNECT:
470 BIO_set_flags(bio, BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY);
471 BIO_set_retry_reason(bio, BIO_get_retry_reason(next_bio));
472 break;
473
474 default:
475 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
476 break;
477 }
478 }
479
480 break;
481
482 default:
483 status = BIO_ctrl(ssl_rbio, cmd, num, ptr);
484 break;
485 }
486
487 return status;
488}
489
490static int bio_rdp_tls_new(BIO* bio)
491{
492 BIO_RDP_TLS* tls = NULL;
493 BIO_set_flags(bio, BIO_FLAGS_SHOULD_RETRY);
494
495 if (!(tls = calloc(1, sizeof(BIO_RDP_TLS))))
496 return 0;
497
498 InitializeCriticalSectionAndSpinCount(&tls->lock, 4000);
499 BIO_set_data(bio, (void*)tls);
500 return 1;
501}
502
503static int bio_rdp_tls_free(BIO* bio)
504{
505 BIO_RDP_TLS* tls = NULL;
506
507 if (!bio)
508 return 0;
509
510 tls = (BIO_RDP_TLS*)BIO_get_data(bio);
511
512 if (!tls)
513 return 0;
514
515 BIO_set_data(bio, NULL);
516 if (BIO_get_shutdown(bio))
517 {
518 if (BIO_get_init(bio) && tls->ssl)
519 {
520 SSL_shutdown(tls->ssl);
521 SSL_free(tls->ssl);
522 }
523
524 BIO_set_init(bio, 0);
525 BIO_set_flags(bio, 0);
526 }
527
528 DeleteCriticalSection(&tls->lock);
529 free(tls);
530
531 return 1;
532}
533
534static long bio_rdp_tls_callback_ctrl(BIO* bio, int cmd, bio_info_cb* fp)
535{
536 long status = 0;
537
538 if (!bio)
539 return 0;
540
541 BIO_RDP_TLS* tls = (BIO_RDP_TLS*)BIO_get_data(bio);
542
543 if (!tls)
544 return 0;
545
546 switch (cmd)
547 {
548 case BIO_CTRL_SET_CALLBACK:
549 {
550 typedef void (*fkt_t)(const SSL*, int, int);
551
552 /* Documented since https://www.openssl.org/docs/man1.1.1/man3/BIO_set_callback.html
553 * the argument is not really of type bio_info_cb* and must be cast
554 * to the required type */
555
556 fkt_t fkt = WINPR_FUNC_PTR_CAST(fp, fkt_t);
557 SSL_set_info_callback(tls->ssl, fkt);
558 status = 1;
559 }
560 break;
561
562 default:
563 status = BIO_callback_ctrl(SSL_get_rbio(tls->ssl), cmd, fp);
564 break;
565 }
566
567 return status;
568}
569
570#define BIO_TYPE_RDP_TLS 68
571
572static BIO_METHOD* BIO_s_rdp_tls(void)
573{
574 static BIO_METHOD* bio_methods = NULL;
575
576 if (bio_methods == NULL)
577 {
578 if (!(bio_methods = BIO_meth_new(BIO_TYPE_RDP_TLS, "RdpTls")))
579 return NULL;
580
581 BIO_meth_set_write(bio_methods, bio_rdp_tls_write);
582 BIO_meth_set_read(bio_methods, bio_rdp_tls_read);
583 BIO_meth_set_puts(bio_methods, bio_rdp_tls_puts);
584 BIO_meth_set_gets(bio_methods, bio_rdp_tls_gets);
585 BIO_meth_set_ctrl(bio_methods, bio_rdp_tls_ctrl);
586 BIO_meth_set_create(bio_methods, bio_rdp_tls_new);
587 BIO_meth_set_destroy(bio_methods, bio_rdp_tls_free);
588 BIO_meth_set_callback_ctrl(bio_methods, bio_rdp_tls_callback_ctrl);
589 }
590
591 return bio_methods;
592}
593
594static BIO* BIO_new_rdp_tls(SSL_CTX* ctx, int client)
595{
596 BIO* bio = NULL;
597 SSL* ssl = NULL;
598 bio = BIO_new(BIO_s_rdp_tls());
599
600 if (!bio)
601 return NULL;
602
603 ssl = SSL_new(ctx);
604
605 if (!ssl)
606 {
607 BIO_free_all(bio);
608 return NULL;
609 }
610
611 if (client)
612 SSL_set_connect_state(ssl);
613 else
614 SSL_set_accept_state(ssl);
615
616 BIO_set_ssl(bio, ssl, BIO_CLOSE);
617 return bio;
618}
619
620static rdpCertificate* tls_get_certificate(rdpTls* tls, BOOL peer)
621{
622 X509* remote_cert = NULL;
623
624 if (peer)
625 remote_cert = SSL_get_peer_certificate(tls->ssl);
626 else
627 remote_cert = X509_dup(SSL_get_certificate(tls->ssl));
628
629 if (!remote_cert)
630 {
631 WLog_ERR(TAG, "failed to get the server TLS certificate");
632 return NULL;
633 }
634
635 /* Get the peer's chain. If it does not exist, we're setting NULL (clean data either way) */
636 STACK_OF(X509)* chain = SSL_get_peer_cert_chain(tls->ssl);
637 rdpCertificate* cert = freerdp_certificate_new_from_x509(remote_cert, chain);
638 X509_free(remote_cert);
639
640 return cert;
641}
642
643static const char* tls_get_server_name(rdpTls* tls)
644{
645 return tls->serverName ? tls->serverName : tls->hostname;
646}
647
648#define TLS_SERVER_END_POINT "tls-server-end-point:"
649
650static SecPkgContext_Bindings* tls_get_channel_bindings(const rdpCertificate* cert)
651{
652 size_t CertificateHashLength = 0;
653 BYTE* ChannelBindingToken = NULL;
654 SEC_CHANNEL_BINDINGS* ChannelBindings = NULL;
655 const size_t PrefixLength = strnlen(TLS_SERVER_END_POINT, ARRAYSIZE(TLS_SERVER_END_POINT));
656
657 WINPR_ASSERT(cert);
658
659 /* See https://www.rfc-editor.org/rfc/rfc5929 for details about hashes */
660 WINPR_MD_TYPE alg = freerdp_certificate_get_signature_alg(cert);
661 const char* hash = NULL;
662 switch (alg)
663 {
664
665 case WINPR_MD_MD5:
666 case WINPR_MD_SHA1:
667 hash = winpr_md_type_to_string(WINPR_MD_SHA256);
668 break;
669 default:
670 hash = winpr_md_type_to_string(alg);
671 break;
672 }
673 if (!hash)
674 return NULL;
675
676 char* CertificateHash = freerdp_certificate_get_hash(cert, hash, &CertificateHashLength);
677 if (!CertificateHash)
678 return NULL;
679
680 const size_t ChannelBindingTokenLength = PrefixLength + CertificateHashLength;
681 SecPkgContext_Bindings* ContextBindings = calloc(1, sizeof(SecPkgContext_Bindings));
682
683 if (!ContextBindings)
684 goto out_free;
685
686 const size_t slen = sizeof(SEC_CHANNEL_BINDINGS) + ChannelBindingTokenLength;
687 if (slen > UINT32_MAX)
688 goto out_free;
689
690 ContextBindings->BindingsLength = (UINT32)slen;
691 ChannelBindings = (SEC_CHANNEL_BINDINGS*)calloc(1, ContextBindings->BindingsLength);
692
693 if (!ChannelBindings)
694 goto out_free;
695
696 ContextBindings->Bindings = ChannelBindings;
697 ChannelBindings->cbApplicationDataLength = (UINT32)ChannelBindingTokenLength;
698 ChannelBindings->dwApplicationDataOffset = sizeof(SEC_CHANNEL_BINDINGS);
699 ChannelBindingToken = &((BYTE*)ChannelBindings)[ChannelBindings->dwApplicationDataOffset];
700 memcpy(ChannelBindingToken, TLS_SERVER_END_POINT, PrefixLength);
701 memcpy(ChannelBindingToken + PrefixLength, CertificateHash, CertificateHashLength);
702 free(CertificateHash);
703 return ContextBindings;
704out_free:
705 free(CertificateHash);
706 free(ContextBindings);
707 return NULL;
708}
709
710static INIT_ONCE secrets_file_idx_once = INIT_ONCE_STATIC_INIT;
711static int secrets_file_idx = -1;
712
713static BOOL CALLBACK secrets_file_init_cb(WINPR_ATTR_UNUSED PINIT_ONCE once,
714 WINPR_ATTR_UNUSED PVOID param,
715 WINPR_ATTR_UNUSED PVOID* context)
716{
717 secrets_file_idx = SSL_get_ex_new_index(0, NULL, NULL, NULL, NULL);
718
719 return (secrets_file_idx != -1);
720}
721
722static void SSLCTX_keylog_cb(const SSL* ssl, const char* line)
723{
724 char* dfile = NULL;
725
726 if (secrets_file_idx == -1)
727 return;
728
729 dfile = SSL_get_ex_data(ssl, secrets_file_idx);
730 if (dfile)
731 {
732 FILE* f = winpr_fopen(dfile, "a+");
733 if (f)
734 {
735 (void)fwrite(line, strlen(line), 1, f);
736 (void)fwrite("\n", 1, 1, f);
737 (void)fclose(f);
738 }
739 }
740}
741
742static void tls_reset(rdpTls* tls)
743{
744 WINPR_ASSERT(tls);
745
746 if (tls->ctx)
747 {
748 SSL_CTX_free(tls->ctx);
749 tls->ctx = NULL;
750 }
751
752 /* tls->underlying is a stacked BIO under tls->bio.
753 * BIO_free_all will free recursively. */
754 if (tls->bio)
755 BIO_free_all(tls->bio);
756 else if (tls->underlying)
757 BIO_free_all(tls->underlying);
758 tls->bio = NULL;
759 tls->underlying = NULL;
760
761 free_tls_public_key(tls);
762 free_tls_bindings(tls);
763}
764
765#if OPENSSL_VERSION_NUMBER >= 0x010000000L
766static BOOL tls_prepare(rdpTls* tls, BIO* underlying, const SSL_METHOD* method, int options,
767 BOOL clientMode)
768#else
769static BOOL tls_prepare(rdpTls* tls, BIO* underlying, SSL_METHOD* method, int options,
770 BOOL clientMode)
771#endif
772{
773 WINPR_ASSERT(tls);
774
775 rdpSettings* settings = tls->context->settings;
776 WINPR_ASSERT(settings);
777
778 tls_reset(tls);
779 tls->ctx = SSL_CTX_new(method);
780
781 tls->underlying = underlying;
782
783 if (!tls->ctx)
784 {
785 WLog_ERR(TAG, "SSL_CTX_new failed");
786 return FALSE;
787 }
788
789 SSL_CTX_set_mode(tls->ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_ENABLE_PARTIAL_WRITE);
790 SSL_CTX_set_options(tls->ctx, WINPR_ASSERTING_INT_CAST(uint64_t, options));
791 SSL_CTX_set_read_ahead(tls->ctx, 1);
792#if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
793 UINT16 version = freerdp_settings_get_uint16(settings, FreeRDP_TLSMinVersion);
794 if (!SSL_CTX_set_min_proto_version(tls->ctx, version))
795 {
796 WLog_ERR(TAG, "SSL_CTX_set_min_proto_version %s failed", version);
797 return FALSE;
798 }
799 version = freerdp_settings_get_uint16(settings, FreeRDP_TLSMaxVersion);
800 if (!SSL_CTX_set_max_proto_version(tls->ctx, version))
801 {
802 WLog_ERR(TAG, "SSL_CTX_set_max_proto_version %s failed", version);
803 return FALSE;
804 }
805#endif
806#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
807 SSL_CTX_set_security_level(tls->ctx, WINPR_ASSERTING_INT_CAST(int, settings->TlsSecLevel));
808#endif
809
810 if (settings->AllowedTlsCiphers)
811 {
812 if (!SSL_CTX_set_cipher_list(tls->ctx, settings->AllowedTlsCiphers))
813 {
814 WLog_ERR(TAG, "SSL_CTX_set_cipher_list %s failed", settings->AllowedTlsCiphers);
815 return FALSE;
816 }
817 }
818
819 tls->bio = BIO_new_rdp_tls(tls->ctx, clientMode);
820
821 if (BIO_get_ssl(tls->bio, &tls->ssl) < 0)
822 {
823 WLog_ERR(TAG, "unable to retrieve the SSL of the connection");
824 return FALSE;
825 }
826
827 if (settings->TlsSecretsFile)
828 {
829#if OPENSSL_VERSION_NUMBER >= 0x10101000L
830 InitOnceExecuteOnce(&secrets_file_idx_once, secrets_file_init_cb, NULL, NULL);
831
832 if (secrets_file_idx != -1)
833 {
834 SSL_set_ex_data(tls->ssl, secrets_file_idx, settings->TlsSecretsFile);
835 SSL_CTX_set_keylog_callback(tls->ctx, SSLCTX_keylog_cb);
836 }
837#else
838 WLog_WARN(TAG, "Key-Logging not available - requires OpenSSL 1.1.1 or higher");
839#endif
840 }
841
842 BIO_push(tls->bio, underlying);
843 return TRUE;
844}
845
846static void
847adjustSslOptions(WINPR_ATTR_UNUSED int* options) // NOLINT(readability-non-const-parameter)
848{
849 WINPR_ASSERT(options);
850#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
851 *options |= SSL_OP_NO_SSLv2;
852 *options |= SSL_OP_NO_SSLv3;
853#endif
854}
855
856const SSL_METHOD* freerdp_tls_get_ssl_method(BOOL isDtls, BOOL isClient)
857{
858 if (isClient)
859 {
860 if (isDtls)
861 return DTLS_client_method();
862#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
863 return SSLv23_client_method();
864#else
865 return TLS_client_method();
866#endif
867 }
868
869 if (isDtls)
870 return DTLS_server_method();
871
872#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
873 return SSLv23_server_method();
874#else
875 return TLS_server_method();
876#endif
877}
878
879TlsHandshakeResult freerdp_tls_connect_ex(rdpTls* tls, BIO* underlying, const SSL_METHOD* methods)
880{
881 WINPR_ASSERT(tls);
882
883 int options = 0;
893#ifdef SSL_OP_NO_COMPRESSION
894 options |= SSL_OP_NO_COMPRESSION;
895#endif
902 options |= SSL_OP_TLS_BLOCK_PADDING_BUG;
909 options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
910
911 tls->isClientMode = TRUE;
912 adjustSslOptions(&options);
913
914 if (!tls_prepare(tls, underlying, methods, options, TRUE))
915 return 0;
916
917#if !defined(OPENSSL_NO_TLSEXT)
918 const char* str = tls_get_server_name(tls);
919 void* ptr = WINPR_CAST_CONST_PTR_AWAY(str, void*);
920 SSL_set_tlsext_host_name(tls->ssl, ptr);
921#endif
922
923 return freerdp_tls_handshake(tls);
924}
925
926static int bio_err_print(const char* str, size_t len, void* u)
927{
928 wLog* log = u;
929 WLog_Print(log, WLOG_ERROR, "[BIO_do_handshake] %s [%" PRIuz "]", str, len);
930 return 0;
931}
932
933TlsHandshakeResult freerdp_tls_handshake(rdpTls* tls)
934{
935 TlsHandshakeResult ret = TLS_HANDSHAKE_ERROR;
936
937 WINPR_ASSERT(tls);
938 const long status = BIO_do_handshake(tls->bio);
939 if (status != 1)
940 {
941 if (!BIO_should_retry(tls->bio))
942 {
943 wLog* log = WLog_Get(TAG);
944 WLog_Print(log, WLOG_ERROR, "BIO_do_handshake failed");
945 ERR_print_errors_cb(bio_err_print, log);
946 return TLS_HANDSHAKE_ERROR;
947 }
948
949 return TLS_HANDSHAKE_CONTINUE;
950 }
951
952 int verify_status = 0;
953 rdpCertificate* cert = tls_get_certificate(tls, tls->isClientMode);
954
955 if (!cert)
956 {
957 WLog_ERR(TAG, "tls_get_certificate failed to return the server certificate.");
958 return TLS_HANDSHAKE_ERROR;
959 }
960
961 do
962 {
963 free_tls_bindings(tls);
964 tls->Bindings = tls_get_channel_bindings(cert);
965 if (!tls->Bindings)
966 {
967 WLog_ERR(TAG, "unable to retrieve bindings");
968 break;
969 }
970
971 free_tls_public_key(tls);
972 if (!freerdp_certificate_get_public_key(cert, &tls->PublicKey, &tls->PublicKeyLength))
973 {
974 WLog_ERR(TAG,
975 "freerdp_certificate_get_public_key failed to return the server public key.");
976 break;
977 }
978
979 /* server-side NLA needs public keys (keys from us, the server) but no certificate verify */
980 ret = TLS_HANDSHAKE_SUCCESS;
981
982 if (tls->isClientMode)
983 {
984 WINPR_ASSERT(tls->port <= UINT16_MAX);
985 verify_status =
986 tls_verify_certificate(tls, cert, tls_get_server_name(tls), (UINT16)tls->port);
987
988 if (verify_status < 1)
989 {
990 WLog_ERR(TAG, "certificate not trusted, aborting.");
991 freerdp_tls_send_alert(tls);
992 ret = TLS_HANDSHAKE_VERIFY_ERROR;
993 }
994 }
995 } while (0);
996
997 freerdp_certificate_free(cert);
998 return ret;
999}
1000
1001static int pollAndHandshake(rdpTls* tls)
1002{
1003 WINPR_ASSERT(tls);
1004
1005 do
1006 {
1007 HANDLE events[] = { freerdp_abort_event(tls->context), NULL };
1008 DWORD status = 0;
1009 if (BIO_get_event(tls->bio, &events[1]) < 0)
1010 {
1011 WLog_ERR(TAG, "unable to retrieve BIO associated event");
1012 return -1;
1013 }
1014
1015 if (!events[1])
1016 {
1017 WLog_ERR(TAG, "unable to retrieve BIO event");
1018 return -1;
1019 }
1020
1021 status = WaitForMultipleObjectsEx(ARRAYSIZE(events), events, FALSE, INFINITE, TRUE);
1022 switch (status)
1023 {
1024 case WAIT_OBJECT_0 + 1:
1025 break;
1026 case WAIT_OBJECT_0:
1027 WLog_DBG(TAG, "Abort event set, cancel connect");
1028 return -1;
1029 case WAIT_TIMEOUT:
1030 case WAIT_IO_COMPLETION:
1031 continue;
1032 default:
1033 WLog_ERR(TAG, "error during WaitForSingleObject(): 0x%08" PRIX32 "", status);
1034 return -1;
1035 }
1036
1037 TlsHandshakeResult result = freerdp_tls_handshake(tls);
1038 switch (result)
1039 {
1040 case TLS_HANDSHAKE_CONTINUE:
1041 break;
1042 case TLS_HANDSHAKE_SUCCESS:
1043 return 1;
1044 case TLS_HANDSHAKE_ERROR:
1045 case TLS_HANDSHAKE_VERIFY_ERROR:
1046 default:
1047 return -1;
1048 }
1049 } while (TRUE);
1050}
1051
1052int freerdp_tls_connect(rdpTls* tls, BIO* underlying)
1053{
1054 const SSL_METHOD* method = freerdp_tls_get_ssl_method(FALSE, TRUE);
1055
1056 WINPR_ASSERT(tls);
1057 TlsHandshakeResult result = freerdp_tls_connect_ex(tls, underlying, method);
1058 switch (result)
1059 {
1060 case TLS_HANDSHAKE_SUCCESS:
1061 return 1;
1062 case TLS_HANDSHAKE_CONTINUE:
1063 break;
1064 case TLS_HANDSHAKE_ERROR:
1065 case TLS_HANDSHAKE_VERIFY_ERROR:
1066 return -1;
1067 default:
1068 return -1;
1069 }
1070
1071 return pollAndHandshake(tls);
1072}
1073
1074#if defined(MICROSOFT_IOS_SNI_BUG) && !defined(OPENSSL_NO_TLSEXT) && \
1075 !defined(LIBRESSL_VERSION_NUMBER)
1076static void tls_openssl_tlsext_debug_callback(SSL* s, int client_server, int type,
1077 unsigned char* data, int len, void* arg)
1078{
1079 if (type == TLSEXT_TYPE_server_name)
1080 {
1081 WLog_DBG(TAG, "Client uses SNI (extension disabled)");
1082 s->servername_done = 2;
1083 }
1084}
1085#endif
1086
1087BOOL freerdp_tls_accept(rdpTls* tls, BIO* underlying, rdpSettings* settings)
1088{
1089 WINPR_ASSERT(tls);
1090 TlsHandshakeResult res =
1091 freerdp_tls_accept_ex(tls, underlying, settings, freerdp_tls_get_ssl_method(FALSE, FALSE));
1092 switch (res)
1093 {
1094 case TLS_HANDSHAKE_SUCCESS:
1095 return TRUE;
1096 case TLS_HANDSHAKE_CONTINUE:
1097 break;
1098 case TLS_HANDSHAKE_ERROR:
1099 case TLS_HANDSHAKE_VERIFY_ERROR:
1100 default:
1101 return FALSE;
1102 }
1103
1104 return pollAndHandshake(tls) > 0;
1105}
1106
1107TlsHandshakeResult freerdp_tls_accept_ex(rdpTls* tls, BIO* underlying, rdpSettings* settings,
1108 const SSL_METHOD* methods)
1109{
1110 WINPR_ASSERT(tls);
1111
1112 int options = 0;
1113 int status = 0;
1114
1121 options |= SSL_OP_NO_SSLv2;
1131#ifdef SSL_OP_NO_COMPRESSION
1132 options |= SSL_OP_NO_COMPRESSION;
1133#endif
1140 options |= SSL_OP_TLS_BLOCK_PADDING_BUG;
1147 options |= SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
1148
1155#if (OPENSSL_VERSION_NUMBER >= 0x10101000L) && (OPENSSL_VERSION_NUMBER < 0x30000000L) && \
1156 !defined(LIBRESSL_VERSION_NUMBER)
1157 options |= SSL_OP_NO_RENEGOTIATION;
1158#endif
1159
1160 if (!tls_prepare(tls, underlying, methods, options, FALSE))
1161 return TLS_HANDSHAKE_ERROR;
1162
1163 const rdpPrivateKey* key = freerdp_settings_get_pointer(settings, FreeRDP_RdpServerRsaKey);
1164 if (!key)
1165 {
1166 WLog_ERR(TAG, "invalid private key");
1167 return TLS_HANDSHAKE_ERROR;
1168 }
1169
1170 EVP_PKEY* privkey = freerdp_key_get_evp_pkey(key);
1171 if (!privkey)
1172 {
1173 WLog_ERR(TAG, "invalid private key");
1174 return TLS_HANDSHAKE_ERROR;
1175 }
1176
1177 status = SSL_use_PrivateKey(tls->ssl, privkey);
1178 /* The local reference to the private key will anyway go out of
1179 * scope; so the reference count should be decremented weither
1180 * SSL_use_PrivateKey succeeds or fails.
1181 */
1182 EVP_PKEY_free(privkey);
1183
1184 if (status <= 0)
1185 {
1186 WLog_ERR(TAG, "SSL_CTX_use_PrivateKey_file failed");
1187 return TLS_HANDSHAKE_ERROR;
1188 }
1189
1190 rdpCertificate* cert =
1191 freerdp_settings_get_pointer_writable(settings, FreeRDP_RdpServerCertificate);
1192 if (!cert)
1193 {
1194 WLog_ERR(TAG, "invalid certificate");
1195 return TLS_HANDSHAKE_ERROR;
1196 }
1197
1198 status = SSL_use_certificate(tls->ssl, freerdp_certificate_get_x509(cert));
1199
1200 if (status <= 0)
1201 {
1202 WLog_ERR(TAG, "SSL_use_certificate_file failed");
1203 return TLS_HANDSHAKE_ERROR;
1204 }
1205
1206 const size_t cnt = freerdp_certificate_get_chain_len(cert);
1207 for (size_t x = 0; x < cnt; x++)
1208 {
1209 X509* xcert = freerdp_certificate_get_chain_at(cert, x);
1210 WINPR_ASSERT(xcert);
1211 const long rc = SSL_add1_chain_cert(tls->ssl, xcert);
1212 if (rc != 1)
1213 {
1214 WLog_ERR(TAG, "SSL_add1_chain_cert failed");
1215 return TLS_HANDSHAKE_ERROR;
1216 }
1217 }
1218
1219#if defined(MICROSOFT_IOS_SNI_BUG) && !defined(OPENSSL_NO_TLSEXT) && \
1220 !defined(LIBRESSL_VERSION_NUMBER)
1221 SSL_set_tlsext_debug_callback(tls->ssl, tls_openssl_tlsext_debug_callback);
1222#endif
1223
1224 return freerdp_tls_handshake(tls);
1225}
1226
1227BOOL freerdp_tls_send_alert(rdpTls* tls)
1228{
1229 WINPR_ASSERT(tls);
1230
1231 if (!tls)
1232 return FALSE;
1233
1234 if (!tls->ssl)
1235 return TRUE;
1236
1241#if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER < 0x10100000L)) || \
1242 (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER <= 0x2080300fL))
1243
1244 if (tls->alertDescription != TLS_ALERT_DESCRIPTION_CLOSE_NOTIFY)
1245 {
1255 SSL_SESSION* ssl_session = SSL_get_session(tls->ssl);
1256 SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(tls->ssl);
1257 SSL_set_quiet_shutdown(tls->ssl, 1);
1258
1259 if ((tls->alertLevel == TLS_ALERT_LEVEL_FATAL) && (ssl_session))
1260 SSL_CTX_remove_session(ssl_ctx, ssl_session);
1261
1262 tls->ssl->s3->alert_dispatch = 1;
1263 tls->ssl->s3->send_alert[0] = tls->alertLevel;
1264 tls->ssl->s3->send_alert[1] = tls->alertDescription;
1265
1266 if (tls->ssl->s3->wbuf.left == 0)
1267 tls->ssl->method->ssl_dispatch_alert(tls->ssl);
1268 }
1269
1270#endif
1271 return TRUE;
1272}
1273
1274int freerdp_tls_write_all(rdpTls* tls, const BYTE* data, size_t length)
1275{
1276 WINPR_ASSERT(tls);
1277 size_t offset = 0;
1278 BIO* bio = tls->bio;
1279
1280 if (length > INT32_MAX)
1281 return -1;
1282
1283 while (offset < length)
1284 {
1285 ERR_clear_error();
1286 const int status = BIO_write(bio, &data[offset], (int)(length - offset));
1287
1288 if (status > 0)
1289 offset += (size_t)status;
1290 else
1291 {
1292 if (!BIO_should_retry(bio))
1293 return -1;
1294
1295 if (BIO_write_blocked(bio))
1296 {
1297 const long rc = BIO_wait_write(bio, 100);
1298 if (rc < 0)
1299 return -1;
1300 }
1301 else if (BIO_read_blocked(bio))
1302 return -2; /* Abort write, there is data that must be read */
1303 else
1304 USleep(100);
1305 }
1306 }
1307
1308 return (int)length;
1309}
1310
1311int freerdp_tls_set_alert_code(rdpTls* tls, int level, int description)
1312{
1313 WINPR_ASSERT(tls);
1314 tls->alertLevel = level;
1315 tls->alertDescription = description;
1316 return 0;
1317}
1318
1319static BOOL tls_match_hostname(const char* pattern, const size_t pattern_length,
1320 const char* hostname)
1321{
1322 if (strlen(hostname) == pattern_length)
1323 {
1324 if (_strnicmp(hostname, pattern, pattern_length) == 0)
1325 return TRUE;
1326 }
1327
1328 if ((pattern_length > 2) && (pattern[0] == '*') && (pattern[1] == '.') &&
1329 ((strlen(hostname)) >= pattern_length))
1330 {
1331 const char* check_hostname = &hostname[strlen(hostname) - pattern_length + 1];
1332
1333 if (_strnicmp(check_hostname, &pattern[1], pattern_length - 1) == 0)
1334 {
1335 return TRUE;
1336 }
1337 }
1338
1339 return FALSE;
1340}
1341
1342static BOOL is_redirected(rdpTls* tls)
1343{
1344 rdpSettings* settings = tls->context->settings;
1345
1346 if (settings->GatewayArmTransport)
1347 return TRUE;
1348
1349 if (LB_NOREDIRECT & settings->RedirectionFlags)
1350 return FALSE;
1351
1352 return settings->RedirectionFlags != 0;
1353}
1354
1355static BOOL is_accepted(rdpTls* tls, const rdpCertificate* cert)
1356{
1357 WINPR_ASSERT(tls);
1358 WINPR_ASSERT(tls->context);
1359 WINPR_ASSERT(cert);
1360 rdpSettings* settings = tls->context->settings;
1361 WINPR_ASSERT(settings);
1362
1363 FreeRDP_Settings_Keys_String keyAccepted = FreeRDP_AcceptedCert;
1364 FreeRDP_Settings_Keys_UInt32 keyLength = FreeRDP_AcceptedCertLength;
1365
1366 if (tls->isGatewayTransport)
1367 {
1368 keyAccepted = FreeRDP_GatewayAcceptedCert;
1369 keyLength = FreeRDP_GatewayAcceptedCertLength;
1370 }
1371 else if (is_redirected(tls))
1372 {
1373 keyAccepted = FreeRDP_RedirectionAcceptedCert;
1374 keyLength = FreeRDP_RedirectionAcceptedCertLength;
1375 }
1376
1377 const char* AcceptedKey = freerdp_settings_get_string(settings, keyAccepted);
1378 const UINT32 AcceptedKeyLength = freerdp_settings_get_uint32(settings, keyLength);
1379
1380 if ((AcceptedKeyLength > 0) && AcceptedKey)
1381 {
1382 BOOL accepted = FALSE;
1383 size_t pemLength = 0;
1384 char* pem = freerdp_certificate_get_pem_ex(cert, &pemLength, FALSE);
1385 if (pem && (AcceptedKeyLength == pemLength))
1386 {
1387 if (memcmp(AcceptedKey, pem, AcceptedKeyLength) == 0)
1388 accepted = TRUE;
1389 }
1390 free(pem);
1391 if (accepted)
1392 return TRUE;
1393 }
1394
1395 (void)freerdp_settings_set_string(settings, keyAccepted, NULL);
1396 (void)freerdp_settings_set_uint32(settings, keyLength, 0);
1397
1398 return FALSE;
1399}
1400
1401static BOOL compare_fingerprint(const char* fp, const char* hash, const rdpCertificate* cert,
1402 BOOL separator)
1403{
1404 BOOL equal = 0;
1405 char* strhash = NULL;
1406
1407 WINPR_ASSERT(fp);
1408 WINPR_ASSERT(hash);
1409 WINPR_ASSERT(cert);
1410
1411 strhash = freerdp_certificate_get_fingerprint_by_hash_ex(cert, hash, separator);
1412 if (!strhash)
1413 return FALSE;
1414
1415 equal = (_stricmp(strhash, fp) == 0);
1416 free(strhash);
1417 return equal;
1418}
1419
1420static BOOL compare_fingerprint_all(const char* fp, const char* hash, const rdpCertificate* cert)
1421{
1422 WINPR_ASSERT(fp);
1423 WINPR_ASSERT(hash);
1424 WINPR_ASSERT(cert);
1425 if (compare_fingerprint(fp, hash, cert, FALSE))
1426 return TRUE;
1427 if (compare_fingerprint(fp, hash, cert, TRUE))
1428 return TRUE;
1429 return FALSE;
1430}
1431
1432static BOOL is_accepted_fingerprint(const rdpCertificate* cert,
1433 const char* CertificateAcceptedFingerprints)
1434{
1435 WINPR_ASSERT(cert);
1436
1437 BOOL rc = FALSE;
1438 if (CertificateAcceptedFingerprints)
1439 {
1440 char* context = NULL;
1441 char* copy = _strdup(CertificateAcceptedFingerprints);
1442 char* cur = strtok_s(copy, ",", &context);
1443 while (cur)
1444 {
1445 char* subcontext = NULL;
1446 const char* h = strtok_s(cur, ":", &subcontext);
1447
1448 if (!h)
1449 goto next;
1450
1451 const char* fp = h + strlen(h) + 1;
1452 if (compare_fingerprint_all(fp, h, cert))
1453 {
1454 rc = TRUE;
1455 break;
1456 }
1457 next:
1458 cur = strtok_s(NULL, ",", &context);
1459 }
1460 free(copy);
1461 }
1462
1463 return rc;
1464}
1465
1466static BOOL accept_cert(rdpTls* tls, const rdpCertificate* cert)
1467{
1468 WINPR_ASSERT(tls);
1469 WINPR_ASSERT(tls->context);
1470 WINPR_ASSERT(cert);
1471
1472 FreeRDP_Settings_Keys_String id = FreeRDP_AcceptedCert;
1473 FreeRDP_Settings_Keys_UInt32 lid = FreeRDP_AcceptedCertLength;
1474
1475 rdpSettings* settings = tls->context->settings;
1476 WINPR_ASSERT(settings);
1477
1478 if (tls->isGatewayTransport)
1479 {
1480 id = FreeRDP_GatewayAcceptedCert;
1481 lid = FreeRDP_GatewayAcceptedCertLength;
1482 }
1483 else if (is_redirected(tls))
1484 {
1485 id = FreeRDP_RedirectionAcceptedCert;
1486 lid = FreeRDP_RedirectionAcceptedCertLength;
1487 }
1488
1489 size_t pemLength = 0;
1490 char* pem = freerdp_certificate_get_pem_ex(cert, &pemLength, FALSE);
1491 BOOL rc = FALSE;
1492 if (pemLength <= UINT32_MAX)
1493 {
1494 if (freerdp_settings_set_string_len(settings, id, pem, pemLength))
1495 rc = freerdp_settings_set_uint32(settings, lid, (UINT32)pemLength);
1496 }
1497 free(pem);
1498 return rc;
1499}
1500
1501static BOOL tls_extract_full_pem(const rdpCertificate* cert, BYTE** PublicKey,
1502 size_t* PublicKeyLength)
1503{
1504 if (!cert || !PublicKey)
1505 return FALSE;
1506 *PublicKey = (BYTE*)freerdp_certificate_get_pem(cert, PublicKeyLength);
1507 return *PublicKey != NULL;
1508}
1509
1510static int tls_config_parse_bool(WINPR_JSON* json, const char* opt)
1511{
1512 WINPR_JSON* val = WINPR_JSON_GetObjectItem(json, opt);
1513 if (!val || !WINPR_JSON_IsBool(val))
1514 return -1;
1515
1516 if (WINPR_JSON_IsTrue(val))
1517 return 1;
1518 return 0;
1519}
1520
1521static int tls_config_check_allowed_hashed(const char* configfile, const rdpCertificate* cert,
1522 WINPR_JSON* json)
1523{
1524 WINPR_ASSERT(configfile);
1525 WINPR_ASSERT(cert);
1526 WINPR_ASSERT(json);
1527
1528 WINPR_JSON* db = WINPR_JSON_GetObjectItem(json, "certificate-db");
1529 if (!db || !WINPR_JSON_IsArray(db))
1530 return 0;
1531
1532 for (size_t x = 0; x < WINPR_JSON_GetArraySize(db); x++)
1533 {
1534 WINPR_JSON* cur = WINPR_JSON_GetArrayItem(db, x);
1535 if (!cur || !WINPR_JSON_IsObject(cur))
1536 {
1537 WLog_WARN(TAG,
1538 "[%s] invalid certificate-db entry at position %" PRIuz ": not a JSON object",
1539 configfile, x);
1540 continue;
1541 }
1542
1543 WINPR_JSON* key = WINPR_JSON_GetObjectItem(cur, "type");
1544 if (!key || !WINPR_JSON_IsString(key))
1545 {
1546 WLog_WARN(TAG,
1547 "[%s] invalid certificate-db entry at position %" PRIuz
1548 ": invalid 'type' element, expected type string",
1549 configfile, x);
1550 continue;
1551 }
1552 WINPR_JSON* val = WINPR_JSON_GetObjectItem(cur, "hash");
1553 if (!val || !WINPR_JSON_IsString(val))
1554 {
1555 WLog_WARN(TAG,
1556 "[%s] invalid certificate-db entry at position %" PRIuz
1557 ": invalid 'hash' element, expected type string",
1558 configfile, x);
1559 continue;
1560 }
1561
1562 const char* skey = WINPR_JSON_GetStringValue(key);
1563 const char* sval = WINPR_JSON_GetStringValue(val);
1564
1565 char* hash = freerdp_certificate_get_fingerprint_by_hash_ex(cert, skey, FALSE);
1566 if (!hash)
1567 {
1568 WLog_WARN(TAG,
1569 "[%s] invalid certificate-db entry at position %" PRIuz
1570 ": hash type '%s' not supported by certificate",
1571 configfile, x, skey);
1572 continue;
1573 }
1574
1575 const int cmp = _stricmp(hash, sval);
1576 free(hash);
1577
1578 if (cmp == 0)
1579 return 1;
1580 }
1581
1582 return 0;
1583}
1584
1585static int tls_config_check_certificate(const rdpCertificate* cert, BOOL* pAllowUserconfig)
1586{
1587 WINPR_ASSERT(cert);
1588 WINPR_ASSERT(pAllowUserconfig);
1589
1590 int rc = 0;
1591 const char configfile[] = "certificates.json";
1592 WINPR_JSON* json = freerdp_GetJSONConfigFile(TRUE, configfile);
1593
1594 if (!json)
1595 {
1596 WLog_DBG(TAG, "No or no valid configuration file for certificate handling, asking user");
1597 goto fail;
1598 }
1599
1600 if (tls_config_parse_bool(json, "deny") > 0)
1601 {
1602 WLog_WARN(TAG, "[%s] certificate denied by configuration", configfile);
1603 rc = -1;
1604 goto fail;
1605 }
1606
1607 if (tls_config_parse_bool(json, "ignore") > 0)
1608 {
1609 WLog_WARN(TAG, "[%s] certificate ignored by configuration", configfile);
1610 rc = 1;
1611 goto fail;
1612 }
1613
1614 if (tls_config_check_allowed_hashed(configfile, cert, json) > 0)
1615 {
1616 WLog_WARN(TAG, "[%s] certificate manually accepted by configuration", configfile);
1617 rc = 1;
1618 goto fail;
1619 }
1620
1621 if (tls_config_parse_bool(json, "deny-userconfig") > 0)
1622 {
1623 WLog_WARN(TAG, "[%s] configuration denies user to accept certificates", configfile);
1624 rc = -1;
1625 goto fail;
1626 }
1627
1628fail:
1629
1630 *pAllowUserconfig = (rc == 0);
1631 WINPR_JSON_Delete(json);
1632 return rc;
1633}
1634
1635int tls_verify_certificate(rdpTls* tls, const rdpCertificate* cert, const char* hostname,
1636 UINT16 port)
1637{
1638 int match = 0;
1639 size_t length = 0;
1640 BOOL certificate_status = 0;
1641 char* common_name = NULL;
1642 size_t common_name_length = 0;
1643 char** dns_names = 0;
1644 size_t dns_names_count = 0;
1645 size_t* dns_names_lengths = NULL;
1646 int verification_status = -1;
1647 BOOL hostname_match = FALSE;
1648 rdpCertificateData* certificate_data = NULL;
1649 BYTE* pemCert = NULL;
1650 DWORD flags = VERIFY_CERT_FLAG_NONE;
1651
1652 WINPR_ASSERT(tls);
1653 WINPR_ASSERT(tls->context);
1654
1655 freerdp* instance = tls->context->instance;
1656 WINPR_ASSERT(instance);
1657
1658 if (freerdp_shall_disconnect_context(instance->context))
1659 return -1;
1660
1661 if (!tls_extract_full_pem(cert, &pemCert, &length))
1662 goto end;
1663
1664 /* Check, if we already accepted this key. */
1665 if (is_accepted(tls, cert))
1666 {
1667 verification_status = 1;
1668 goto end;
1669 }
1670
1671 if (is_accepted_fingerprint(cert, tls->context->settings->CertificateAcceptedFingerprints))
1672 {
1673 verification_status = 1;
1674 goto end;
1675 }
1676
1677 if (tls->isGatewayTransport || is_redirected(tls))
1678 flags |= VERIFY_CERT_FLAG_LEGACY;
1679
1680 if (tls->isGatewayTransport)
1681 flags |= VERIFY_CERT_FLAG_GATEWAY;
1682
1683 if (is_redirected(tls))
1684 flags |= VERIFY_CERT_FLAG_REDIRECT;
1685
1686 /* Certificate management is done by the application */
1687 if (tls->context->settings->ExternalCertificateManagement)
1688 {
1689 if (instance->VerifyX509Certificate)
1690 verification_status =
1691 instance->VerifyX509Certificate(instance, pemCert, length, hostname, port, flags);
1692 else
1693 WLog_ERR(TAG, "No VerifyX509Certificate callback registered!");
1694
1695 if (verification_status > 0)
1696 accept_cert(tls, cert);
1697 else if (verification_status < 0)
1698 {
1699 WLog_ERR(TAG, "VerifyX509Certificate failed: (length = %" PRIuz ") status: [%d] %s",
1700 length, verification_status, pemCert);
1701 goto end;
1702 }
1703 }
1704 /* ignore certificate verification if user explicitly required it (discouraged) */
1705 else if (freerdp_settings_get_bool(tls->context->settings, FreeRDP_IgnoreCertificate))
1706 {
1707 WLog_WARN(TAG, "[DANGER] Certificate not checked, /cert:ignore in use.");
1708 WLog_WARN(TAG, "[DANGER] This prevents MITM attacks from being detected!");
1709 WLog_WARN(TAG,
1710 "[DANGER] Avoid using this unless in a secure LAN (=no internet) environment");
1711 verification_status = 1; /* success! */
1712 }
1713 else if (!tls->isGatewayTransport && (tls->context->settings->AuthenticationLevel == 0))
1714 verification_status = 1; /* success! */
1715 else
1716 {
1717 /* if user explicitly specified a certificate name, use it instead of the hostname */
1718 if (!tls->isGatewayTransport && tls->context->settings->CertificateName)
1719 hostname = tls->context->settings->CertificateName;
1720
1721 /* attempt verification using OpenSSL and the ~/.freerdp/certs certificate store */
1722 certificate_status = freerdp_certificate_verify(
1723 cert, freerdp_certificate_store_get_certs_path(tls->certificate_store));
1724 /* verify certificate name match */
1725 certificate_data = freerdp_certificate_data_new(hostname, port, cert);
1726 if (!certificate_data)
1727 goto end;
1728 /* extra common name and alternative names */
1729 common_name = freerdp_certificate_get_common_name(cert, &common_name_length);
1730 dns_names = freerdp_certificate_get_dns_names(cert, &dns_names_count, &dns_names_lengths);
1731
1732 /* compare against common name */
1733
1734 if (common_name)
1735 {
1736 if (tls_match_hostname(common_name, common_name_length, hostname))
1737 hostname_match = TRUE;
1738 }
1739
1740 /* compare against alternative names */
1741
1742 if (dns_names)
1743 {
1744 for (size_t index = 0; index < dns_names_count; index++)
1745 {
1746 if (tls_match_hostname(dns_names[index], dns_names_lengths[index], hostname))
1747 {
1748 hostname_match = TRUE;
1749 break;
1750 }
1751 }
1752 }
1753
1754 /* if the certificate is valid and the certificate name matches, verification succeeds
1755 */
1756 if (certificate_status && hostname_match)
1757 verification_status = 1; /* success! */
1758
1759 if (!hostname_match)
1760 flags |= VERIFY_CERT_FLAG_MISMATCH;
1761
1762 BOOL allowUserconfig = TRUE;
1763 if (!certificate_status || !hostname_match)
1764 verification_status = tls_config_check_certificate(cert, &allowUserconfig);
1765
1766 /* verification could not succeed with OpenSSL, use known_hosts file and prompt user for
1767 * manual verification */
1768 if (allowUserconfig && (!certificate_status || !hostname_match))
1769 {
1770 DWORD accept_certificate = 0;
1771 size_t pem_length = 0;
1772 char* issuer = freerdp_certificate_get_issuer(cert);
1773 char* subject = freerdp_certificate_get_subject(cert);
1774 char* pem = freerdp_certificate_get_pem(cert, &pem_length);
1775
1776 if (!pem)
1777 goto end;
1778
1779 /* search for matching entry in known_hosts file */
1780 match =
1781 freerdp_certificate_store_contains_data(tls->certificate_store, certificate_data);
1782
1783 if (match == 1)
1784 {
1785 /* no entry was found in known_hosts file, prompt user for manual verification
1786 */
1787 if (!hostname_match)
1788 tls_print_certificate_name_mismatch_error(hostname, port, common_name,
1789 dns_names, dns_names_count);
1790
1791 {
1792 char* efp = freerdp_certificate_get_fingerprint(cert);
1793 tls_print_new_certificate_warn(tls->certificate_store, hostname, port, efp);
1794 free(efp);
1795 }
1796
1797 /* Automatically accept certificate on first use */
1798 if (tls->context->settings->AutoAcceptCertificate)
1799 {
1800 WLog_INFO(TAG, "No certificate stored, automatically accepting.");
1801 accept_certificate = 1;
1802 }
1803 else if (tls->context->settings->AutoDenyCertificate)
1804 {
1805 WLog_INFO(TAG, "No certificate stored, automatically denying.");
1806 accept_certificate = 0;
1807 }
1808 else if (instance->VerifyX509Certificate)
1809 {
1810 int rc = instance->VerifyX509Certificate(instance, pemCert, pem_length,
1811 hostname, port, flags);
1812
1813 if (rc == 1)
1814 accept_certificate = 1;
1815 else if (rc > 1)
1816 accept_certificate = 2;
1817 else
1818 accept_certificate = 0;
1819 }
1820 else if (instance->VerifyCertificateEx)
1821 {
1822 const BOOL use_pem = freerdp_settings_get_bool(
1823 tls->context->settings, FreeRDP_CertificateCallbackPreferPEM);
1824 char* fp = NULL;
1825 DWORD cflags = flags;
1826 if (use_pem)
1827 {
1828 cflags |= VERIFY_CERT_FLAG_FP_IS_PEM;
1829 fp = pem;
1830 }
1831 else
1832 fp = freerdp_certificate_get_fingerprint(cert);
1833 accept_certificate = instance->VerifyCertificateEx(
1834 instance, hostname, port, common_name, subject, issuer, fp, cflags);
1835 if (!use_pem)
1836 free(fp);
1837 }
1838#if defined(WITH_FREERDP_DEPRECATED)
1839 else if (instance->VerifyCertificate)
1840 {
1841 char* fp = freerdp_certificate_get_fingerprint(cert);
1842
1843 WLog_WARN(TAG, "The VerifyCertificate callback is deprecated, migrate your "
1844 "application to VerifyCertificateEx");
1845 accept_certificate = instance->VerifyCertificate(instance, common_name, subject,
1846 issuer, fp, !hostname_match);
1847 free(fp);
1848 }
1849#endif
1850 }
1851 else if (match == -1)
1852 {
1853 rdpCertificateData* stored_data =
1854 freerdp_certificate_store_load_data(tls->certificate_store, hostname, port);
1855 /* entry was found in known_hosts file, but fingerprint does not match. ask user
1856 * to use it */
1857 {
1858 char* efp = freerdp_certificate_get_fingerprint(cert);
1859 tls_print_certificate_error(tls->certificate_store, stored_data, hostname, port,
1860 efp);
1861 free(efp);
1862 }
1863
1864 if (!stored_data)
1865 WLog_WARN(TAG, "Failed to get certificate entry for %s:%" PRIu16 "", hostname,
1866 port);
1867
1868 if (tls->context->settings->AutoDenyCertificate)
1869 {
1870 WLog_INFO(TAG, "No certificate stored, automatically denying.");
1871 accept_certificate = 0;
1872 }
1873 else if (instance->VerifyX509Certificate)
1874 {
1875 const int rc =
1876 instance->VerifyX509Certificate(instance, pemCert, pem_length, hostname,
1877 port, flags | VERIFY_CERT_FLAG_CHANGED);
1878
1879 if (rc == 1)
1880 accept_certificate = 1;
1881 else if (rc > 1)
1882 accept_certificate = 2;
1883 else
1884 accept_certificate = 0;
1885 }
1886 else if (instance->VerifyChangedCertificateEx)
1887 {
1888 DWORD cflags = flags | VERIFY_CERT_FLAG_CHANGED;
1889 const char* old_subject = freerdp_certificate_data_get_subject(stored_data);
1890 const char* old_issuer = freerdp_certificate_data_get_issuer(stored_data);
1891 const char* old_fp = freerdp_certificate_data_get_fingerprint(stored_data);
1892 const char* old_pem = freerdp_certificate_data_get_pem(stored_data);
1893 const BOOL fpIsAllocated =
1894 !old_pem ||
1895 !freerdp_settings_get_bool(tls->context->settings,
1896 FreeRDP_CertificateCallbackPreferPEM);
1897 char* fp = NULL;
1898 if (!fpIsAllocated)
1899 {
1900 cflags |= VERIFY_CERT_FLAG_FP_IS_PEM;
1901 fp = pem;
1902 old_fp = old_pem;
1903 }
1904 else
1905 {
1906 fp = freerdp_certificate_get_fingerprint(cert);
1907 }
1908 accept_certificate = instance->VerifyChangedCertificateEx(
1909 instance, hostname, port, common_name, subject, issuer, fp, old_subject,
1910 old_issuer, old_fp, cflags);
1911 if (fpIsAllocated)
1912 free(fp);
1913 }
1914#if defined(WITH_FREERDP_DEPRECATED)
1915 else if (instance->VerifyChangedCertificate)
1916 {
1917 char* fp = freerdp_certificate_get_fingerprint(cert);
1918 const char* old_subject = freerdp_certificate_data_get_subject(stored_data);
1919 const char* old_issuer = freerdp_certificate_data_get_issuer(stored_data);
1920 const char* old_fingerprint =
1921 freerdp_certificate_data_get_fingerprint(stored_data);
1922
1923 WLog_WARN(TAG, "The VerifyChangedCertificate callback is deprecated, migrate "
1924 "your application to VerifyChangedCertificateEx");
1925 accept_certificate = instance->VerifyChangedCertificate(
1926 instance, common_name, subject, issuer, fp, old_subject, old_issuer,
1927 old_fingerprint);
1928 free(fp);
1929 }
1930#endif
1931
1932 freerdp_certificate_data_free(stored_data);
1933 }
1934 else if (match == 0)
1935 accept_certificate = 2; /* success! */
1936
1937 /* Save certificate or do a simple accept / reject */
1938 switch (accept_certificate)
1939 {
1940 case 1:
1941
1942 /* user accepted certificate, add entry in known_hosts file */
1943 verification_status = freerdp_certificate_store_save_data(
1944 tls->certificate_store, certificate_data)
1945 ? 1
1946 : -1;
1947 break;
1948
1949 case 2:
1950 /* user did accept temporaty, do not add to known hosts file */
1951 verification_status = 1;
1952 break;
1953
1954 default:
1955 /* user did not accept, abort and do not add entry in known_hosts file */
1956 verification_status = -1; /* failure! */
1957 break;
1958 }
1959
1960 free(issuer);
1961 free(subject);
1962 free(pem);
1963 }
1964
1965 if (verification_status > 0)
1966 accept_cert(tls, cert);
1967 }
1968
1969end:
1970 freerdp_certificate_data_free(certificate_data);
1971 free(common_name);
1972 freerdp_certificate_free_dns_names(dns_names_count, dns_names_lengths, dns_names);
1973 free(pemCert);
1974 return verification_status;
1975}
1976
1977void tls_print_new_certificate_warn(rdpCertificateStore* store, const char* hostname, UINT16 port,
1978 const char* fingerprint)
1979{
1980 char* path = freerdp_certificate_store_get_cert_path(store, hostname, port);
1981
1982 WLog_ERR(TAG, "The host key for %s:%" PRIu16 " has changed", hostname, port);
1983 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1984 WLog_ERR(TAG, "@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
1985 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1986 WLog_ERR(TAG, "IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
1987 WLog_ERR(TAG, "Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
1988 WLog_ERR(TAG, "It is also possible that a host key has just been changed.");
1989 WLog_ERR(TAG, "The fingerprint for the host key sent by the remote host is %s", fingerprint);
1990 WLog_ERR(TAG, "Please contact your system administrator.");
1991 WLog_ERR(TAG, "Add correct host key in %s to get rid of this message.", path);
1992 WLog_ERR(TAG, "Host key for %s has changed and you have requested strict checking.", hostname);
1993 WLog_ERR(TAG, "Host key verification failed.");
1994
1995 free(path);
1996}
1997
1998void tls_print_certificate_error(rdpCertificateStore* store,
1999 WINPR_ATTR_UNUSED rdpCertificateData* stored_data,
2000 const char* hostname, UINT16 port, const char* fingerprint)
2001{
2002 char* path = freerdp_certificate_store_get_cert_path(store, hostname, port);
2003
2004 WLog_ERR(TAG, "New host key for %s:%" PRIu16, hostname, port);
2005 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
2006 WLog_ERR(TAG, "@ WARNING: NEW HOST IDENTIFICATION! @");
2007 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
2008
2009 WLog_ERR(TAG, "The fingerprint for the host key sent by the remote host is %s", fingerprint);
2010 WLog_ERR(TAG, "Please contact your system administrator.");
2011 WLog_ERR(TAG, "Add correct host key in %s to get rid of this message.", path);
2012
2013 free(path);
2014}
2015
2016void tls_print_certificate_name_mismatch_error(const char* hostname, UINT16 port,
2017 const char* common_name, char** alt_names,
2018 size_t alt_names_count)
2019{
2020 WINPR_ASSERT(NULL != hostname);
2021 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
2022 WLog_ERR(TAG, "@ WARNING: CERTIFICATE NAME MISMATCH! @");
2023 WLog_ERR(TAG, "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
2024 WLog_ERR(TAG, "The hostname used for this connection (%s:%" PRIu16 ") ", hostname, port);
2025 WLog_ERR(TAG, "does not match %s given in the certificate:",
2026 alt_names_count < 1 ? "the name" : "any of the names");
2027 WLog_ERR(TAG, "Common Name (CN):");
2028 WLog_ERR(TAG, "\t%s", common_name ? common_name : "no CN found in certificate");
2029
2030 if (alt_names_count > 0)
2031 {
2032 WINPR_ASSERT(NULL != alt_names);
2033 WLog_ERR(TAG, "Alternative names:");
2034
2035 for (size_t index = 0; index < alt_names_count; index++)
2036 {
2037 WINPR_ASSERT(alt_names[index]);
2038 WLog_ERR(TAG, "\t %s", alt_names[index]);
2039 }
2040 }
2041
2042 WLog_ERR(TAG, "A valid certificate for the wrong name should NOT be trusted!");
2043}
2044
2045rdpTls* freerdp_tls_new(rdpContext* context)
2046{
2047 rdpTls* tls = NULL;
2048 tls = (rdpTls*)calloc(1, sizeof(rdpTls));
2049
2050 if (!tls)
2051 return NULL;
2052
2053 tls->context = context;
2054
2055 if (!freerdp_settings_get_bool(tls->context->settings, FreeRDP_ServerMode))
2056 {
2057 tls->certificate_store = freerdp_certificate_store_new(tls->context->settings);
2058
2059 if (!tls->certificate_store)
2060 goto out_free;
2061 }
2062
2063 tls->alertLevel = TLS_ALERT_LEVEL_WARNING;
2064 tls->alertDescription = TLS_ALERT_DESCRIPTION_CLOSE_NOTIFY;
2065 return tls;
2066out_free:
2067 free(tls);
2068 return NULL;
2069}
2070
2071void freerdp_tls_free(rdpTls* tls)
2072{
2073 if (!tls)
2074 return;
2075
2076 tls_reset(tls);
2077
2078 if (tls->certificate_store)
2079 {
2080 freerdp_certificate_store_free(tls->certificate_store);
2081 tls->certificate_store = NULL;
2082 }
2083
2084 free(tls);
2085}
WINPR_API WINPR_JSON * WINPR_JSON_GetObjectItem(const WINPR_JSON *object, const char *string)
Return a pointer to an JSON object item.
Definition json.c:184
WINPR_API BOOL WINPR_JSON_IsString(const WINPR_JSON *item)
Check if JSON item is of type String.
Definition json.c:349
WINPR_API BOOL WINPR_JSON_IsBool(const WINPR_JSON *item)
Check if JSON item is of type BOOL.
Definition json.c:312
WINPR_API WINPR_JSON * WINPR_JSON_GetArrayItem(const WINPR_JSON *array, size_t index)
Return a pointer to an item in the array.
Definition json.c:155
WINPR_API BOOL WINPR_JSON_IsObject(const WINPR_JSON *item)
Check if JSON item is of type Object.
Definition json.c:373
WINPR_API const char * WINPR_JSON_GetStringValue(WINPR_JSON *item)
Return the String value of a JSON item.
Definition json.c:234
WINPR_API void WINPR_JSON_Delete(WINPR_JSON *item)
Delete a WinPR JSON wrapper object.
Definition json.c:144
WINPR_API size_t WINPR_JSON_GetArraySize(const WINPR_JSON *array)
Get the number of arrayitems from an array.
Definition json.c:169
WINPR_API BOOL WINPR_JSON_IsArray(const WINPR_JSON *item)
Check if JSON item is of type Array.
Definition json.c:361
WINPR_API BOOL WINPR_JSON_IsTrue(const WINPR_JSON *item)
Check if JSON item is BOOL value True.
Definition json.c:297
FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
FREERDP_API BOOL freerdp_settings_set_string(rdpSettings *settings, FreeRDP_Settings_Keys_String id, const char *param)
Sets a string settings value. The param is copied.
FREERDP_API BOOL freerdp_settings_get_bool(const rdpSettings *settings, FreeRDP_Settings_Keys_Bool id)
Returns a boolean settings value.
FREERDP_API UINT16 freerdp_settings_get_uint16(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt16 id)
Returns a UINT16 settings value.
FREERDP_API void * freerdp_settings_get_pointer_writable(rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a mutable pointer settings value.
FREERDP_API const void * freerdp_settings_get_pointer(const rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a immutable pointer settings value.
FREERDP_API BOOL freerdp_settings_set_string_len(rdpSettings *settings, FreeRDP_Settings_Keys_String id, const char *param, size_t len)
Sets a string settings value. The param is copied.
FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 param)
Sets a UINT32 settings value.
FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.