/**

 * FreeRDP: A Remote Desktop Protocol Implementation

 * FreeRDP Client Common

 *

 * Copyright 2012 Marc-Andre Moreau <marcandre.moreau@gmail.com>

 * Copyright 2025 Siemens

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#if !defined(_WIN32)

#include <fcntl.h>

#include <sys/types.h>

#include <sys/stat.h>

#endif

#include <winpr/cast.h>

#include <winpr/i18n.h>

#include <winpr/pipe.h>

#include <freerdp/config.h>

#include <freerdp/utils/signal.h>

#include <string.h>

#include <errno.h>

#include <math.h>

#include <limits.h>

#include <float.h>

#include <freerdp/client.h>

#include <freerdp/freerdp.h>

#include <freerdp/addin.h>

#include <freerdp/assistance.h>

#include <freerdp/client/file.h>

#include <freerdp/utils/passphrase.h>

#include <freerdp/client/cmdline.h>

#include <freerdp/client/channels.h>

#include <freerdp/event.h>

#include <freerdp/utils/smartcardlogon.h>

#include <freerdp/session.h>

#if defined(CHANNEL_AINPUT_CLIENT)

#include <freerdp/client/ainput.h>

#include <freerdp/channels/ainput.h>

#endif

#if defined(CHANNEL_VIDEO_CLIENT)

#include <freerdp/client/video.h>

#include <freerdp/channels/video.h>

#endif

#if defined(CHANNEL_RDPGFX_CLIENT)

#include <freerdp/client/rdpgfx.h>

#include <freerdp/channels/rdpgfx.h>

#include <freerdp/gdi/gfx.h>

#endif

#if defined(CHANNEL_GEOMETRY_CLIENT)

#include <freerdp/client/geometry.h>

#include <freerdp/channels/geometry.h>

#endif

#if defined(CHANNEL_GEOMETRY_CLIENT) || defined(CHANNEL_VIDEO_CLIENT)

#include <freerdp/gdi/video.h>

#endif

#include <freerdp/channels/rdpewa.h>

#ifdef WITH_AAD

#include <freerdp/utils/http.h>

#include <freerdp/utils/aad.h>

#include <freerdp/client/aad_helper.h>

#endif

#ifdef WITH_SSO_MIB

#include "sso_mib_tokens.h"

#endif

#include "oauth2.h"

#include <freerdp/log.h>

WINPR_ATTR_NODISCARD

static BOOL freerdp_client_common_pre_connect(rdpContext* context);

BOOL freerdp_client_enable_translation(const char* locale, const char* searchPath)

{

  return freerdp_enable_translation(locale, searchPath) &&

         winpr_i18n_bind_domain("freerdp-client", searchPath);

}

#define TAG CLIENT_TAG("common")

typedef struct

{

  freerdp* instance;

  window_events_fkt_t window_events;

  bool running;

} handle_window_events_t;

WINPR_ATTR_NODISCARD

static BOOL requireRdpClientContext(const rdpContext* context)

{

  if (!context)

  {

    WLog_ERR(TAG, "[APPLICATION BUG] Function must be called with a context != NULL!");

    return FALSE;

  }

  freerdp* instance = context->instance;

  if (!instance)

  {

    WLog_ERR(TAG,

             "[APPLICATION BUG] Function must be called with a context->instance != NULL!");

    return FALSE;

  }

  RDP_CLIENT_ENTRY_POINTS* pEntryPoints = instance->pClientEntryPoints;

  if (!pEntryPoints)

  {

    WLog_ERR(TAG, "[APPLICATION BUG] Function must be called with a "

                  "context->instance->pclientEntryPoints != NULL!");

    return FALSE;

  }

  /* This function must be called with a context containing rdpClientContext. So if the size is

   * not large enough that is a terminal failure. */

  if (sizeof(rdpClientContext) > instance->ContextSize)

  {

    WLog_ERR(

        TAG,

        "[APPLICATION BUG] Function must be called with a context based on rdpClientContext!");

    WLog_ERR(TAG,

             "[APPLICATION BUG] sizeof(rdpClientContext)[%" PRIuz

             "] > instance->ContextSize[%" PRIuz "])",

             sizeof(rdpClientContext), instance->ContextSize);

    return FALSE;

  }

  return TRUE;

}

static void set_default_callbacks(freerdp* instance)

{

  WINPR_ASSERT(instance);

  instance->AuthenticateEx = client_cli_authenticate_ex;

  instance->ChooseSmartcard = client_cli_choose_smartcard;

  instance->VerifyCertificateEx = client_cli_verify_certificate_ex;

  instance->VerifyChangedCertificateEx = client_cli_verify_changed_certificate_ex;

  instance->PresentGatewayMessage = client_cli_present_gateway_message;

  instance->LogonErrorInfo = client_cli_logon_error_info;

  instance->GetAccessToken = client_cli_get_access_token;

  instance->RetryDialog = client_common_retry_dialog;

  WINPR_ASSERT(instance->context);

  WINPR_ASSERT(instance->context->update);

  instance->context->update->SaveSessionInfo = client_common_save_session_info;

}

static void client_cli_user_notification(void* context, const UserNotificationEventArgs* e)

{

  WINPR_UNUSED(context);

  WINPR_ASSERT(e);

  if (strcmp(e->e.Sender, RDPEWA_CHANNEL_NAME) != 0)

    return;

  if (!e->message || e->message[0] == '\0')

    return;

  (void)fprintf(stderr, "[%s] Touch the security key\n", e->e.Sender);

  (void)fflush(stderr);

}

WINPR_ATTR_NODISCARD

static BOOL freerdp_client_common_new(freerdp* instance, rdpContext* context)

{

  WINPR_ASSERT(instance);

  WINPR_ASSERT(context);

  instance->LoadChannels = freerdp_client_load_channels;

  set_default_callbacks(instance);

  RDP_CLIENT_ENTRY_POINTS* pEntryPoints = instance->pClientEntryPoints;

  WINPR_ASSERT(pEntryPoints);

  if (requireRdpClientContext(context))

  {

    rdpClientContext* cctx = (rdpClientContext*)context;

    cctx->oauth2 = freerdp_oauth2_new();

    if (!cctx->oauth2)

      return FALSE;

  }

  const BOOL rc = IFCALLRESULT(TRUE, pEntryPoints->ClientNew, instance, context);

  if (!rc)

    return FALSE;

  return freerdp_client_common_pre_connect(context);

}

static void freerdp_client_common_free(freerdp* instance, rdpContext* context)

{

  WINPR_ASSERT(instance);

  WINPR_ASSERT(context);

  RDP_CLIENT_ENTRY_POINTS* pEntryPoints = instance->pClientEntryPoints;

  WINPR_ASSERT(pEntryPoints);

  IFCALL(pEntryPoints->ClientFree, instance, context);

  if (requireRdpClientContext(context))

  {

    rdpClientContext* cctx = (rdpClientContext*)context;

    freerdp_oauth2_free(cctx->oauth2);

    cctx->oauth2 = nullptr;

  }

}

/* Common API */

rdpContext* freerdp_client_context_new(const RDP_CLIENT_ENTRY_POINTS* pEntryPoints)

{

  freerdp* instance = nullptr;

  rdpContext* context = nullptr;

  if (!pEntryPoints)

    return nullptr;

  if (!IFCALLRESULT(TRUE, pEntryPoints->GlobalInit))

    return nullptr;

  instance = freerdp_new();

  if (!instance)

    return nullptr;

  instance->ContextSize = pEntryPoints->ContextSize;

  instance->ContextNew = freerdp_client_common_new;

  instance->ContextFree = freerdp_client_common_free;

  instance->pClientEntryPoints = (RDP_CLIENT_ENTRY_POINTS*)malloc(pEntryPoints->Size);

  if (!instance->pClientEntryPoints)

    goto out_fail;

  CopyMemory(instance->pClientEntryPoints, pEntryPoints, pEntryPoints->Size);

  if (!freerdp_context_new_ex(instance, pEntryPoints->settings))

    goto out_fail2;

  context = instance->context;

  context->instance = instance;

#if defined(WITH_CLIENT_CHANNELS)

  if (freerdp_register_addin_provider(freerdp_channels_load_static_addin_entry, 0) !=

      CHANNEL_RC_OK)

    goto out_fail2;

#endif

  return context;

out_fail2:

  free(instance->pClientEntryPoints);

out_fail:

  freerdp_free(instance);

  return nullptr;

}

void freerdp_client_context_free(rdpContext* context)

{

  freerdp* instance = nullptr;

  if (!context)

    return;

  instance = context->instance;

  if (instance)

  {

    RDP_CLIENT_ENTRY_POINTS* pEntryPoints = instance->pClientEntryPoints;

    freerdp_context_free(instance);

    if (pEntryPoints)

      IFCALL(pEntryPoints->GlobalUninit);

    free(instance->pClientEntryPoints);

    freerdp_free(instance);

  }

}

int freerdp_client_start(rdpContext* context)

{

  RDP_CLIENT_ENTRY_POINTS* pEntryPoints = nullptr;

  if (!context || !context->instance || !context->instance->pClientEntryPoints)

    return ERROR_BAD_ARGUMENTS;

  if (freerdp_settings_get_bool(context->settings, FreeRDP_UseCommonStdioCallbacks))

  {

    set_default_callbacks(context->instance);

    if (context->pubSub)

    {

      const int rc =

          PubSub_SubscribeUserNotification(context->pubSub, client_cli_user_notification);

      if (rc < 0)

        return FALSE;

    }

  }

#ifdef WITH_SSO_MIB

  if (requireRdpClientContext(context))

  {

    rdpClientContext* client_context = (rdpClientContext*)context;

    client_context->mibClientWrapper = sso_mib_new(context);

    if (!client_context->mibClientWrapper)

      return ERROR_INTERNAL_ERROR;

  }

#endif

  pEntryPoints = context->instance->pClientEntryPoints;

  return IFCALLRESULT(CHANNEL_RC_OK, pEntryPoints->ClientStart, context);

}

int freerdp_client_stop(rdpContext* context)

{

  RDP_CLIENT_ENTRY_POINTS* pEntryPoints = nullptr;

  if (!context || !context->instance || !context->instance->pClientEntryPoints)

    return ERROR_BAD_ARGUMENTS;

  pEntryPoints = context->instance->pClientEntryPoints;

  const int rc = IFCALLRESULT(CHANNEL_RC_OK, pEntryPoints->ClientStop, context);

  if (freerdp_settings_get_bool(context->settings, FreeRDP_UseCommonStdioCallbacks))

    PubSub_UnsubscribeUserNotification(context->pubSub, client_cli_user_notification);

#ifdef WITH_SSO_MIB

  if (requireRdpClientContext(context))

  {

    rdpClientContext* client_context = (rdpClientContext*)context;

    sso_mib_free(client_context->mibClientWrapper);

    client_context->mibClientWrapper = nullptr;

  }

#endif // WITH_SSO_MIB

  return rc;

}

freerdp* freerdp_client_get_instance(rdpContext* context)

{

  if (!context || !context->instance)

    return nullptr;

  return context->instance;

}

HANDLE freerdp_client_get_thread(rdpContext* context)

{

  if (!context)

    return nullptr;

  WINPR_ASSERT(requireRdpClientContext(context));

  if (!requireRdpClientContext(context))

    return nullptr;

  return ((rdpClientContext*)context)->thread;

}

WINPR_ATTR_NODISCARD

static BOOL freerdp_client_settings_post_process(rdpSettings* settings)

{

  /* Moved GatewayUseSameCredentials logic outside of cmdline.c, so

   * that the rdp file also triggers this functionality */

  if (freerdp_settings_get_bool(settings, FreeRDP_GatewayEnabled))

  {

    if (freerdp_settings_get_bool(settings, FreeRDP_GatewayUseSameCredentials))

    {

      const char* Username = freerdp_settings_get_string(settings, FreeRDP_Username);

      const char* Domain = freerdp_settings_get_string(settings, FreeRDP_Domain);

      if (Username)

      {

        if (!freerdp_settings_set_string(settings, FreeRDP_GatewayUsername, Username))

          goto out_error;

      }

      if (Domain)

      {

        if (!freerdp_settings_set_string(settings, FreeRDP_GatewayDomain, Domain))

          goto out_error;

      }

      if (freerdp_settings_get_string(settings, FreeRDP_Password))

      {

        if (!freerdp_settings_set_string(

                settings, FreeRDP_GatewayPassword,

                freerdp_settings_get_string(settings, FreeRDP_Password)))

          goto out_error;

      }

    }

  }

  /* Moved logic for Multimon and Span monitors to force fullscreen, so

   * that the rdp file also triggers this functionality */

  if (freerdp_settings_get_bool(settings, FreeRDP_SpanMonitors))

  {

    if (!freerdp_settings_set_bool(settings, FreeRDP_UseMultimon, TRUE))

      goto out_error;

    if (!freerdp_settings_set_bool(settings, FreeRDP_Fullscreen, TRUE))

      goto out_error;

  }

  else if (freerdp_settings_get_bool(settings, FreeRDP_UseMultimon))

  {

    if (!freerdp_settings_set_bool(settings, FreeRDP_Fullscreen, TRUE))

      goto out_error;

  }

  /* deal with the smartcard / smartcard logon stuff */

  if (freerdp_settings_get_bool(settings, FreeRDP_SmartcardLogon))

  {

    if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectSmartCards, TRUE))

      goto out_error;

    if (!freerdp_settings_set_bool(settings, FreeRDP_DeviceRedirection, TRUE))

      goto out_error;

    if (!freerdp_settings_set_bool(settings, FreeRDP_PasswordIsSmartcardPin, TRUE))

      goto out_error;

  }

  return TRUE;

out_error:

  return FALSE;

}

int freerdp_client_settings_parse_command_line(rdpSettings* settings, int argc, char** argv,

                                               BOOL allowUnknown)

{

  return freerdp_client_settings_parse_command_line_ex(settings, argc, argv, allowUnknown,

                                                       nullptr, 0, nullptr, nullptr);

}

int freerdp_client_settings_parse_command_line_ex(

    rdpSettings* settings, int argc, char** argv, BOOL allowUnknown, COMMAND_LINE_ARGUMENT_A* args,

    size_t count, freerdp_command_line_handle_option_t handle_option, void* handle_userdata)

{

  int status = 0;

  if (argc < 1)

    return 0;

  if (!argv)

    return -1;

  status = freerdp_client_settings_parse_command_line_arguments_ex(

      settings, argc, argv, allowUnknown, args, count, handle_option, handle_userdata);

  if (status < 0)

    return status;

  /* This function will call logic that is applicable to the settings

   * from command line parsing AND the rdp file parsing */

  if (!freerdp_client_settings_post_process(settings))

    status = -1;

  const char* name = argv[0];

  WLog_DBG(TAG, "This is [%s] %s %s", name, freerdp_get_version_string(),

           freerdp_get_build_config());

  return status;

}

int freerdp_client_settings_parse_connection_file(rdpSettings* settings, const char* filename)

{

  rdpFile* file = nullptr;

  int ret = -1;

  file = freerdp_client_rdp_file_new();

  if (!file)

    return -1;

  if (!freerdp_client_parse_rdp_file(file, filename))

    goto out;

  if (!freerdp_client_populate_settings_from_rdp_file(file, settings))

    goto out;

  ret = 0;

out:

  freerdp_client_rdp_file_free(file);

  return ret;

}

int freerdp_client_settings_parse_connection_file_buffer(rdpSettings* settings, const BYTE* buffer,

                                                         size_t size)

{

  rdpFile* file = nullptr;

  int status = -1;

  file = freerdp_client_rdp_file_new();

  if (!file)

    return -1;

  if (freerdp_client_parse_rdp_file_buffer(file, buffer, size) &&

      freerdp_client_populate_settings_from_rdp_file(file, settings))

  {

    status = 0;

  }

  freerdp_client_rdp_file_free(file);

  return status;

}

int freerdp_client_settings_write_connection_file(const rdpSettings* settings, const char* filename,

                                                  BOOL unicode)

{

  rdpFile* file = nullptr;

  int ret = -1;

  file = freerdp_client_rdp_file_new();

  if (!file)

    return -1;

  if (!freerdp_client_populate_rdp_file_from_settings(file, settings))

    goto out;

  if (!freerdp_client_write_rdp_file(file, filename, unicode))

    goto out;

  ret = 0;

out:

  freerdp_client_rdp_file_free(file);

  return ret;

}

int freerdp_client_settings_parse_assistance_file(rdpSettings* settings, int argc, char* argv[])

{

  int status = 0;

  int ret = -1;

  char* filename = nullptr;

  char* password = nullptr;

  rdpAssistanceFile* file = nullptr;

  if (!settings || !argv || (argc < 2))

    return -1;

  filename = argv[1];

  for (int x = 2; x < argc; x++)

  {

    const char* key = strstr(argv[x], "assistance:");

    if (key)

    {

      char* sep = strchr(key, ':');

      if (!sep)

        return -1;

      password = sep + 1;

    }

  }

  file = freerdp_assistance_file_new();

  if (!file)

    return -1;

  status = freerdp_assistance_parse_file(file, filename, password);

  if (status < 0)

    goto out;

  if (!freerdp_assistance_populate_settings_from_assistance_file(file, settings))

    goto out;

  ret = 0;

out:

  freerdp_assistance_file_free(file);

  return ret;

}

WINPR_ATTR_NODISCARD

static int client_cli_read_string(freerdp* instance, const char* what, const char* suggestion,

                                  char** result)

{

  WINPR_ASSERT(instance);

  WINPR_ASSERT(what);

  WINPR_ASSERT(result);

  size_t size = 0;

  printf("%s", what);

  (void)fflush(stdout);

  char* line = nullptr;

  if (suggestion && strlen(suggestion) > 0)

  {

    line = _strdup(suggestion);

    size = strlen(suggestion);

  }

  const SSIZE_T rc = freerdp_interruptible_get_line(instance->context, &line, &size, stdin);

  if (rc < 0)

  {

    char ebuffer[256] = WINPR_C_ARRAY_INIT;

    WLog_ERR(TAG, "freerdp_interruptible_get_line returned %s [%d]",

             winpr_strerror(errno, ebuffer, sizeof(ebuffer)), errno);

    free(line);

    return -1;

  }

  free(*result);

  *result = nullptr;

  if (line)

  {

    line = StrSep(&line, "\r");

    line = StrSep(&line, "\n");

    *result = line;

  }

  return 0;

}

/** @brief Callback set in the rdp_freerdp structure, and used to get the user's password,

 *  if required to establish the connection.

 *  This function is actually called in credssp_ntlmssp_client_init()

 *

 *  @see rdp_server_accept_nego() and rdp_check_fds()

 *  @param instance pointer to the rdp_freerdp structure that contains the connection settings

 *  @param username on input can contain a suggestion (must be allocated and is released by \b free

 * ). On output the allocated username entered by the user.

 *  @param password on input can contain a suggestion (must be allocated and is released by \b free

 * ). On output the allocated password entered by the user.

 *  @param domain on input can contain a suggestion (must be allocated and is released by \b free

 * ). On output the allocated domain entered by the user.

 *  @return TRUE if a password was successfully entered. See freerdp_passphrase_read() for more

 * details.

 */

WINPR_ATTR_NODISCARD

static BOOL client_cli_authenticate_raw(freerdp* instance, rdp_auth_reason reason, char** username,

                                        char** password, char** domain)

{

  static const size_t password_size = 512;

  const char* userAuth = "Username:        ";

  const char* domainAuth = "Domain:          ";

  const char* pwdAuth = "Password:        ";

  BOOL pinOnly = FALSE;

  BOOL queryAll = FALSE;

  WINPR_ASSERT(instance);

  WINPR_ASSERT(instance->context);

  WINPR_ASSERT(instance->context->settings);

  switch (reason)

  {

    case AUTH_SMARTCARD_PIN:

      pwdAuth = "Smartcard-Pin:   ";

      pinOnly = TRUE;

      break;

    case AUTH_FIDO_PIN:

      pwdAuth = "FIDO2 PIN:       ";

      pinOnly = TRUE;

      break;

    case AUTH_RDSTLS:

      queryAll = TRUE;

      break;

    case AUTH_TLS:

    case AUTH_RDP:

    case AUTH_NLA:

      break;

    case GW_AUTH_HTTP:

    case GW_AUTH_RDG:

    case GW_AUTH_RPC:

      userAuth = "GatewayUsername: ";

      domainAuth = "GatewayDomain:   ";

      pwdAuth = "GatewayPassword: ";

      break;

    default:

      return FALSE;

  }

  if (!username || !password || !domain)

    return FALSE;

  if (!pinOnly)

  {

    const char* suggest = *username;

    if (queryAll || !suggest)

    {

      const int rc = client_cli_read_string(instance, userAuth, suggest, username);

      if (rc < 0)

        goto fail;

    }

  }

  if (!pinOnly)

  {

    const char* suggest = *domain;

    if (queryAll || !suggest)

    {

      const int rc = client_cli_read_string(instance, domainAuth, suggest, domain);

      if (rc < 0)

        goto fail;

    }

  }

  {

    char* line = calloc(password_size, sizeof(char));

    if (!line)

      goto fail;

    const BOOL fromStdin =

        freerdp_settings_get_bool(instance->context->settings, FreeRDP_CredentialsFromStdin);

    const char* rc =

        freerdp_passphrase_read(instance->context, pwdAuth, line, password_size, fromStdin);

    if (rc == nullptr)

      goto fail;

    if (password_size > 0)

    {

      free(*password);

      *password = line;

    }

  }

  return TRUE;

fail:

  free(*username);

  free(*domain);

  free(*password);

  *username = nullptr;

  *domain = nullptr;

  *password = nullptr;

  return FALSE;

}

BOOL client_cli_authenticate_ex(freerdp* instance, char** username, char** password, char** domain,

                                rdp_auth_reason reason)

{

  WINPR_ASSERT(instance);

  WINPR_ASSERT(username);

  WINPR_ASSERT(password);

  WINPR_ASSERT(domain);

  switch (reason)

  {

    case AUTH_RDSTLS:

    case AUTH_NLA:

      break;

    case AUTH_TLS:

    case AUTH_RDP:

    case AUTH_SMARTCARD_PIN: /* in this case password is pin code */

    case AUTH_FIDO_PIN:

      if ((*username) && (*password))

        return TRUE;

      break;

    case GW_AUTH_HTTP:

    case GW_AUTH_RDG:

    case GW_AUTH_RPC:

      break;

    default:

      return FALSE;

  }

  return client_cli_authenticate_raw(instance, reason, username, password, domain);

}

BOOL client_cli_choose_smartcard(WINPR_ATTR_UNUSED freerdp* instance, SmartcardCertInfo** cert_list,

                                 DWORD count, DWORD* choice, BOOL gateway)

{

  unsigned long answer = 0;

  char* p = nullptr;

  printf("Multiple smartcards are available for use:\n");

  for (DWORD i = 0; i < count; i++)

  {

    const SmartcardCertInfo* cert = cert_list[i];

    char* reader = ConvertWCharToUtf8Alloc(cert->reader, nullptr);

    char* container_name = ConvertWCharToUtf8Alloc(cert->containerName, nullptr);

    printf("[%" PRIu32

           "] %s\n\tReader: %s\n\tUser: %s@%s\n\tSubject: %s\n\tIssuer: %s\n\tUPN: %s\n",

           i, container_name, reader, cert->userHint, cert->domainHint, cert->subject,

           cert->issuer, cert->upn);

    free(reader);

    free(container_name);

  }

  while (1)

  {

    char input[10] = WINPR_C_ARRAY_INIT;

    printf("\nChoose a smartcard to use for %s (0 - %" PRIu32 "): ",

           gateway ? "gateway authentication" : "logon", count - 1);

    (void)fflush(stdout);

    if (!fgets(input, 10, stdin))

    {

      WLog_ERR(TAG, "could not read from stdin");

      return FALSE;

    }

    answer = strtoul(input, &p, 10);

    if ((*p == '\n' && p != input) && answer < count)

    {

      *choice = (UINT32)answer;

      return TRUE;

    }

  }

}

#if defined(WITH_FREERDP_DEPRECATED)

BOOL client_cli_authenticate(freerdp* instance, char** username, char** password, char** domain)

{

  if (freerdp_settings_get_bool(instance->settings, FreeRDP_SmartcardLogon))

  {

    WLog_INFO(TAG, "Authentication via smartcard");

    return TRUE;

  }

  return client_cli_authenticate_raw(instance, FALSE, username, password, domain);

}

BOOL client_cli_gw_authenticate(freerdp* instance, char** username, char** password, char** domain)

{

  return client_cli_authenticate_raw(instance, TRUE, username, password, domain);

}

#endif

WINPR_ATTR_NODISCARD

static DWORD client_cli_accept_certificate(freerdp* instance)

{

  int answer = 0;

  WINPR_ASSERT(instance);

  WINPR_ASSERT(instance->context);

  const rdpSettings* settings = instance->context->settings;

  WINPR_ASSERT(settings);

  const BOOL fromStdin = freerdp_settings_get_bool(settings, FreeRDP_CredentialsFromStdin);

  if (fromStdin)

    return 0;

  while (1)

  {

    printf("Do you trust the above certificate? (Y/T/N) ");

    (void)fflush(stdout);

    answer = freerdp_interruptible_getc(instance->context, stdin);

    if ((answer == EOF) || feof(stdin))

    {

      printf("\nError: Could not read answer from stdin.\n");

      return 0;

    }

    switch (answer)

    {

      case 'y':

      case 'Y':

        answer = freerdp_interruptible_getc(instance->context, stdin);

        printf("\n");

        if (answer == EOF)

          return 0;

        return 1;

      case 't':

      case 'T':

        answer = freerdp_interruptible_getc(instance->context, stdin);

        printf("\n");

        if (answer == EOF)

          return 0;

        return 2;

      case 'n':

      case 'N':

        answer = freerdp_interruptible_getc(instance->context, stdin);

        printf("\n");

        if (answer == EOF)

          return 0;

        return 0;

      default:

        break;

    }

  }

}

/** Callback set in the rdp_freerdp structure, and used to make a certificate validation

 *  when the connection requires it.

 *  This function will actually be called by tls_verify_certificate().

 *  @see rdp_client_connect() and freerdp_tls_connect()

 *  @deprecated Use client_cli_verify_certificate_ex

 *  @param instance - pointer to the rdp_freerdp structure that contains the connection settings

 *  @param common_name

 *  @param subject

 *  @param issuer

 *  @param fingerprint

 *  @param host_mismatch Indicates the certificate host does not match.

 *  @return 1 if the certificate is trusted, 2 if temporary trusted, 0 otherwise.

 */

#if defined(WITH_FREERDP_DEPRECATED)

DWORD client_cli_verify_certificate(freerdp* instance, const char* common_name, const char* subject,

                                    const char* issuer, const char* fingerprint, BOOL host_mismatch)

{

  WINPR_UNUSED(common_name);

  WINPR_UNUSED(host_mismatch);

  printf("WARNING: This callback is deprecated, migrate to client_cli_verify_certificate_ex\n");

  printf("Certificate details:\n");

  printf("\tSubject: %s\n", subject);

  printf("\tIssuer: %s\n", issuer);

  printf("\tThumbprint: %s\n", fingerprint);

  printf("The above X.509 certificate could not be verified, possibly because you do not have\n"

         "the CA certificate in your certificate store, or the certificate has expired.\n"

         "Please look at the OpenSSL documentation on how to add a private CA to the store.\n");

  return client_cli_accept_certificate(instance);

}