It is possible to implement an rdp client that accepts certificates by
fingerprint by using VerifyCertificateEx. In case the server uses a
certificate without subject (which, apparently, is not mandated by X509)
freerdp_certificate_data_load_cache fails and the certificate is refused
even before calling VerifyCertificateEx. This commit changes
freerdp_certificate_data_load_cache to consider that missing subject is
the same as an empty string.
Also downgrade the log message complaining about missing subject and
issuer to a warning.
There were some fields sent without considering endianness, making the
clients fail when parsing those fields.
Use Data_Write_XXX functions so the endiannes won't affect the byte order
and the clients will read properly the fields.
In the function is_within_surface, the error message for out-of-bounds command rectangles has been enhanced for better clarity. The code has been modified to display the rectangle coordinates and surface dimensions in the error message. This change aims to make debugging easier and improve the overall code quality.
All clients can implement their own callbacks for
certificate/credential/smartcard/... but there is a common (default)
implementation for all clients.
with the new setting FreeRDP_UseCommonStdioCallbacks it is now possible
to force these over the client implementation provided ones
The AAD and AVD authentication mechanisms both need an OAuth2 token.
They only differ in the provided arguments, so unify the callbacks into
a single one with variable argument lists.
- Move responsibility for obtaining access tokens to clients
- Add function for getting access tokens for AVD
- Get correct server hostname during AVD setup
- Add utility function for doing http requests
This code fixes an issue where some settings were lost when copying
settings around. I.e. the device count was first set but then calling
`freerdp_settings_set_pointer_len` caused the device count to be reset
to 0 because we passed `NULL` for the data value.
This means the count got lost upon the first copy and further copies
also resulted in losing the array data (because the count was set to 0).
This PR fixes this issue by first resetting the array and afterwards
setting the correct count value.
According to the man page on macOS poll currently doesn't support
devices. This includes `/dev/tty`.
In this use case poll will returned immediately indicating that
something can be read but the following read returned `-1`
(with errno set to EAGAIN).
Using select on macOS for passphrase reading prevents this problem.
On some platforms (i.e. Mac) the BOOL type might be narrower than the
`RedirectionFlags` type leading to an overflow when just assigning the
logical AND result to the setting. This fix makes sure that the value is
correctly set to either `TRUE` or `FALSE`.
This PR creates a new /gateway:type:arm transport.
It depends on CJSON
The arm transport is not a transport by itself but is responsible
for getting the websocket endpoint from a configuration url derived from
the configured gateway host in the rdpw file or cmdline
If the reserved filed is not 0 the request PDU seems to contain
some extra data. Two bytes of 0 (probably a version field) followed by a
JSON payload (not null terminated, until the end of the packet. There
seems to be no dedicated length field)
* factor out most websocket specific code parts into websocket.c
* create wst.c (Websocket Transport) as gateway transport implementation
* introduce GatewayUrl setting that holds the websocket url
* introduce GatewayHttpExtAuthBearer that holds the HTTP Bearer
* GatewayHttpExtAuthBearer can be used by both rdg and wst
the new (optional) callback CheckPeerAcceptRestrictions is used to check
for server implementation specific connection requirements before
accepting a client.
The exported paths for
* FreeRDP_PLUGIN_DIR
* FreeRDP_PROXY_PLUGIN_DIR
* FreeRDP_EXTENSION_DIR
introduced in ddc9e5835f were relative to
the installation of the cmake module because of the use of CMakePackageConfigHelpers.
This could lead to different paths for configuration and runtime -
causing channels not to be found and loaded.
Instead of using paths relative to the cmake module set the paths
configured during configure/compile for plugins and extension.
This way the exported paths match the paths in build-config.h and are the
same used in the pkg-config variables.
Optionally build the SDL client with Qt WebEngine to create a popup
browser for authentication to AAD. Also change the URL output on the
command line to use the "nativeclient" redirect for easier copy/pasting
of the authorization code.
In Windows remote run vulnerabillities exe program, to create rdpgrfx channel, may case Remmina crash.
So, add bound check, check that the paste area is valid, and determine if the picture is in the paste area.
In Windows remote run vulnerabillities exe program, to create
Micorosoft::Windows::RDS::Graphics channel, case Remmina crash.
So, add bound check, limit the size of the requested rect, no larger than the surface data buffer.
When a PKCS11 module was provided, the CSP could not be set by command line
arguments, leading to an error when loading the ncrypt module, and an empty
smartcard list.
freerdp_bitmap_planar_context_new() expects flags as first argument not a BOOL,
even if giving FALSE ends with the same result, it makes it more clear.
* Use new enum constants with WINPR_KEYBOARD_* prefix
* Fix mapping of keycodes and scancodes, the offset of 8 is no longer
required if the proper keyboard type is used.
The number of updated tiles was not reset at the end of a progressive block
treatment leading to possibly overflow the updatedTiles array. This patch also
introduces a dirty bit on tiles, so that a tile updated multiple times is just
mark once as modified.
* remove unused function freerdp_detect_keymap_from_xkb
* instead of querying the x keyboard rule properties
(_XKB_RULES_NAMES_BACKUP and _XKB_RULES_NAMES) with xprop as external
program use xlib directly
contrary to '[MS-RDPBCGR] 1.3.9 Connect-Time and Continuous Network
Characteristics Detection' we have seen autodetection reqeusts mixed in
between licensing messages. This relaxes the state machine and allows
handling.
The VirtualChannelChunkSize can only be larger than 1600 Bytes, when
both client and server write that value in their capability set
regardless of the value itself.
Also, Microsoft clients and servers only advertise the capabilities that
are relevant for the other peer, e.g. mstsc only tells the server that
it supports decompressing compressed data from the server, but it does
not advertise, that it is able to compress data for the server.
Additionally, correctly apply the read capabilities after reading them.
The VirtualChannelChunkSize setting refers to the VCChunkSize for static
channels and not to the maximum size for DVC data PDUs.
DVC data PDUs are according to [MS-RDPEDYC] always limited to 1600
Bytes.
When enumerating smartcard certificates we check if we have duplicates
in our certificate list. In case we detect a duplicate we just return
`TRUE` (indicating that we consumed the certificate info) but do not
free the smartcard info instance.
Server side we often see "FreeRDP_ChannelDefArray::len expected to be >= 31,
but have XXX", where XXX is lower than 31.
This patche fixes that, the old code was setting the size of ChannelDefArray to the
number of ChannelCount, which is usually not what we want. We want to keep it to 31
and have ChannelCount indicate how many of these channels are used.
To simplify building external channels and other plugins related
paths are now exported in the pkg-config file and the cmake package.
The paths can be used to install channels/plugins/extensions in
the configured search paths.
For pkg-config the following variables are now available:
* datadir
* plugindir
* proxy_plugindir
* extensiondir
They can be queried like: `pkg-config freerdp3 --variable plugindir`
The cmake package has three new variables that can be used:
* FreeRDP_PLUGIN_DIR
* FreeRDP_PROXY_PLUGIN_DIR
* FreeRDP_EXTENSION_DIR
Note: Depending on the build the directories are not necessarily created.
* unify reading of domain and username strings with all the checks
* add handling of (undocumented) padding in [MS-RDPBCGR]
2.2.10.1.1.2 Logon Info Version 2 (TS_LOGON_INFO_VERSION_2)
occurring with windows 11
* move type definition to WinPR as used there too.
* supported keyboard types are defined in
[MS-RDPBCGR] 2.2.1.3.2 Client Core Data (TS_UD_CS_CORE)]
use a enum instead of magic numbers to make code more readable.
WinPR provides APIs to convert between keycodes between virtual
keycodes.
These keycodes can currently be evdev keycodes or Apple keycodes.
The evdev handling, however, handles XKB keycodes and not evdev ones.
The main difference between these is that XKB keycodes are shifted by
the value 8, compared to evdev keycodes.
In order to fix this situation, rename the evdev keycodes to XKB ones,
and introduce additionally a new keycode evdev, including its handling
for this keycode type.
Commit 2de7a4c249 introduced major changes
in the gateway authentication code. One of these changes was to decouple
NTLM specific authentication from the gateway code.
However with these changes, gateway authenciation with the old RPC code
stopped working and returned an authentication error. The problem is
that currently `credssp_auth_encrypt` encrypts the given message along
creating a signature.
The old code prevented encryption of the message by specifying
`SECBUFFER_READONLY` on the message buffer. The native Windows SSPI then
leaves this buffer as-is and gateway authentication works again.
This fix only applies to Windows platforms using the native SSPI API.
Interestingly this works on other platforms using the WinPR SSPI so
there seems to be a difference between the implementations (but that's a
topic for another PR).
The attributes xPos and yPos for a Color Pointer Update are confusing,
as they may be confused with the xPos and yPos of the pointer bitmap on
the actual screen.
Rename these attributes to what they actually represent, and that is the
hotspot position.
xPos and yPos are still members of the hotspot. However, hotSpotX and
hotSpotY are much more clearer.
In addition to that, the Large Pointer Update uses the same names for
the hotspot coordinates.
Currently, FreeRDP-based server implementations can do connect-time
autodetection.
However, without having any control over it.
In order to be able to override the default connect-time autodetection
handling, introduce three new states for the state machine of the
connection sequence and two new callbacks for the autodetect handling.
These are:
- CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_BEGIN
- CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_IN_PROGRESS
- CONNECTION_STATE_CONNECT_TIME_AUTO_DETECT_END
- OnConnectTimeAutoDetectBegin()
- OnConnectTimeAutoDetectProgress()
The END state is pretty simple: When the autodetection is finished and
the autodetect state is FREERDP_AUTODETECT_STATE_COMPLETE, transition
into the next state of the connection sequence.
The BEGIN state is entered, when capability-wise network autodetection
is available.
In this state, the OnConnectTimeAutoDetectBegin callback is called, the
server implementation may initialize any related handling here.
If the server implementation determines, that no further handling is
required, it can end the autodetection phase by returning
FREERDP_AUTODETECT_STATE_COMPLETE.
If not, and an autodetection request is sent, it returns
FREERDP_AUTODETECT_STATE_REQUEST.
The state machine of the connection sequence will then switch into the
IN_PROGRESS state.
In the IN_PROGRESS state, any incoming PDU is handled first, then the
OnConnectTimeAutoDetectProgress callback is called.
Like in the BEGIN state, the return value will determine, whether the
state machine of the connection sequence goes into the END state or goes
into (or rather stays) in the IN_PROGRESS state.
The current state of the autodetect API for the server side does not
include all allowed scenarios where the network autodetection can be
used.
This for example includes the connect-time autodetection, as the
related calls are hidden inside FreeRDP, and not exposed as public API.
In order to avoid duplicate send methods, check the state of the
connection sequence.
If the connection sequence is not yet done, use the connect-time request
types.
Otherwise, use the continuous request types.
The Bandwidth Measure Payload PDU is a little special case, as it is
only allowed to be sent during the connection sequence.
To ensure this, add an assertion in its sending method.
Also fix the handling for the Network Characteristics Sync PDU:
Previously, after parsing the PDU data, the read data was just sent
again to the client, which is wrong.
To fix this issue, introduce a callback for this client-to-server PDU,
so that the actual server implementation can hook up its own handling
for this PDU.
Depending on the situation, the server side may want to discard or use
the retrieved data here.
Moreover, decouple the send-handling for the Network Characteristics
Result PDU from the local autodetect variables.
Currently, these variables are shared between the send and receive
methods.
This leads to access problems, where the server side, wants to use a
different thread to send the autodetect PDU, as the receive handler may
receive an autodetect PDU and overwrite these values with possible
nonsense values.
This is especially the case with RTT response PDUs, as the written
netCharAverageRTT and netCharBaseRTT values are only correct, when only
one RTTRequest happens at a time and no stray RTTResponses are received.
rts_read_common_pdu_header is used to determine if the packet was read
successfully. In that case it might fail but there should be no logging
done to not spam it with unnecessary warnings.
TargetCertificate option is set in TARGET_CERTIFICATE_CONTAINER format.
Exposed ELEMENT_TYPE_CERTIFICATE and ENCODING_TYPE_ASN1_DER1 to allow
building it externally in the mentioned format.
On windows freerdp_interruptible_getc did not work at all. Fix this so
that reading characters works. This still does not hide input for
passwords or is actually interruptible, but at least it reads the data
correctly.
