/src/FreeRDP/libfreerdp/core/utils.c

Source
/**
 * FreeRDP: A Remote Desktop Protocol Implementation
 * Terminal Server Gateway (utils)
 *
 * Copyright 2021 Armin Novak <armin.novak@thincast.com>
 * Copyright 2021 Thincast Technologies GmbH
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <freerdp/config.h>

#include "settings.h"

#include <winpr/assert.h>

#include <freerdp/freerdp.h>
#include <freerdp/channels/cliprdr.h>
#include <freerdp/channels/rdpdr.h>

#include <freerdp/log.h>
#define TAG FREERDP_TAG("core.gateway.utils")

#include "utils.h"

#include "../core/rdp.h"

BOOL utils_str_copy(const char* value, char** dst)
{
  WINPR_ASSERT(dst);

  free(*dst);
  *dst = nullptr;
  if (!value)
    return TRUE;

  (*dst) = _strdup(value);
  return (*dst) != nullptr;
}

static BOOL utils_copy_smartcard_settings(const rdpSettings* settings, rdpSettings* origSettings)
{
  /* update original settings with provided smart card settings */
  origSettings->SmartcardLogon = settings->SmartcardLogon;
  origSettings->PasswordIsSmartcardPin = settings->PasswordIsSmartcardPin;
  if (!utils_str_copy(settings->ReaderName, &origSettings->ReaderName))
    return FALSE;
  if (!utils_str_copy(settings->CspName, &origSettings->CspName))
    return FALSE;
  if (!utils_str_copy(settings->ContainerName, &origSettings->ContainerName))
    return FALSE;

  return TRUE;
}

auth_status utils_authenticate_gateway(freerdp* instance, rdp_auth_reason reason)
{
  rdpSettings* settings = nullptr;
  rdpSettings* origSettings = nullptr;
  BOOL prompt = FALSE;
  BOOL proceed = 0;

  WINPR_ASSERT(instance);
  WINPR_ASSERT(instance->context);
  WINPR_ASSERT(instance->context->settings);
  WINPR_ASSERT(instance->context->rdp);
  WINPR_ASSERT(instance->context->rdp->originalSettings);

  settings = instance->context->settings;
  origSettings = instance->context->rdp->originalSettings;

  if (freerdp_shall_disconnect_context(instance->context))
    return AUTH_FAILED;

  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayPassword)))
    prompt = TRUE;
  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayUsername)))
    prompt = TRUE;

  if (!prompt)
  {
    if (!utils_sync_credentials(settings, FALSE))
      return AUTH_FAILED;
    return AUTH_SKIP;
  }

#if !defined(WITH_FREERDP_DEPRECATED)
  if (!instance->AuthenticateEx)
    return AUTH_NO_CREDENTIALS;
#else
  if (!instance->GatewayAuthenticate && !instance->AuthenticateEx)
    return AUTH_NO_CREDENTIALS;

  if (!instance->GatewayAuthenticate)
#endif
  {
    proceed =
        instance->AuthenticateEx(instance, &settings->GatewayUsername,
                                 &settings->GatewayPassword, &settings->GatewayDomain, reason);
    if (!proceed)
      return AUTH_CANCELLED;
  }
#if defined(WITH_FREERDP_DEPRECATED)
  else
  {
    proceed =
        instance->GatewayAuthenticate(instance, &settings->GatewayUsername,
                                      &settings->GatewayPassword, &settings->GatewayDomain);
    if (!proceed)
      return AUTH_CANCELLED;
  }
#endif

  if (utils_str_is_empty(settings->GatewayUsername) ||
      utils_str_is_empty(settings->GatewayPassword))
    return AUTH_NO_CREDENTIALS;

  if (!utils_sync_credentials(settings, FALSE))
    return AUTH_FAILED;

  /* update original settings with provided user credentials */
  if (!utils_str_copy(settings->GatewayUsername, &origSettings->GatewayUsername))
    return AUTH_FAILED;
  if (!utils_str_copy(settings->GatewayDomain, &origSettings->GatewayDomain))
    return AUTH_FAILED;
  if (!utils_str_copy(settings->GatewayPassword, &origSettings->GatewayPassword))
    return AUTH_FAILED;
  if (!utils_sync_credentials(origSettings, FALSE))
    return AUTH_FAILED;

  if (!utils_copy_smartcard_settings(settings, origSettings))
    return AUTH_FAILED;

  return AUTH_SUCCESS;
}

auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL override)
{
  rdpSettings* settings = nullptr;
  rdpSettings* origSettings = nullptr;
  BOOL prompt = !override;
  BOOL proceed = 0;

  WINPR_ASSERT(instance);
  WINPR_ASSERT(instance->context);
  WINPR_ASSERT(instance->context->settings);
  WINPR_ASSERT(instance->context->rdp);
  WINPR_ASSERT(instance->context->rdp->originalSettings);

  settings = instance->context->settings;
  origSettings = instance->context->rdp->originalSettings;

  if (freerdp_shall_disconnect_context(instance->context))
    return AUTH_FAILED;

  if (settings->ConnectChildSession)
    return AUTH_NO_CREDENTIALS;

  /* Ask for auth data if no or an empty username was specified or no password was given */
  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_Username)) ||
      (settings->Password == nullptr && settings->RedirectionPassword == nullptr))
    prompt = TRUE;

  if (!prompt)
    return AUTH_SKIP;

  switch (reason)
  {
    case AUTH_RDP:
    case AUTH_TLS:
      if (settings->SmartcardLogon)
      {
        if (!utils_str_is_empty(settings->Password))
        {
          WLog_INFO(TAG, "Authentication via smartcard");
          return AUTH_SUCCESS;
        }
        reason = AUTH_SMARTCARD_PIN;
      }
      break;
    case AUTH_NLA:
      if (settings->SmartcardLogon)
        reason = AUTH_SMARTCARD_PIN;
      break;
    case AUTH_RDSTLS:
    default:
      break;
  }

  /* If no callback is specified still continue connection */
#if !defined(WITH_FREERDP_DEPRECATED)
  if (!instance->AuthenticateEx)
    return AUTH_NO_CREDENTIALS;
#else
  if (!instance->Authenticate && !instance->AuthenticateEx)
    return AUTH_NO_CREDENTIALS;
  if (!instance->Authenticate)
#endif
  {
    proceed = instance->AuthenticateEx(instance, &settings->Username, &settings->Password,
                                       &settings->Domain, reason);
    if (!proceed)
      return AUTH_CANCELLED;
  }
#if defined(WITH_FREERDP_DEPRECATED)
  else
  {
    proceed = instance->Authenticate(instance, &settings->Username, &settings->Password,
                                     &settings->Domain);
    if (!proceed)
      return AUTH_NO_CREDENTIALS;
  }
#endif

  if (utils_str_is_empty(settings->Username) || utils_str_is_empty(settings->Password))
    return AUTH_NO_CREDENTIALS;

  if (!utils_sync_credentials(settings, TRUE))
    return AUTH_FAILED;

  /* update original settings with provided user credentials */
  if (!utils_str_copy(settings->Username, &origSettings->Username))
    return AUTH_FAILED;
  if (!utils_str_copy(settings->Domain, &origSettings->Domain))
    return AUTH_FAILED;
  if (!utils_str_copy(settings->Password, &origSettings->Password))
    return AUTH_FAILED;
  if (!utils_sync_credentials(origSettings, TRUE))
    return AUTH_FAILED;

  if (!utils_copy_smartcard_settings(settings, origSettings))
    return AUTH_FAILED;

  return AUTH_SUCCESS;
}

BOOL utils_sync_credentials(rdpSettings* settings, BOOL toGateway)
{
  WINPR_ASSERT(settings);
  if (!settings->GatewayUseSameCredentials)
    return TRUE;

  if (toGateway)
  {
    if (!utils_str_copy(settings->Username, &settings->GatewayUsername))
      return FALSE;
    if (!utils_str_copy(settings->Domain, &settings->GatewayDomain))
      return FALSE;
    if (!utils_str_copy(settings->Password, &settings->GatewayPassword))
      return FALSE;
  }
  else
  {
    if (!utils_str_copy(settings->GatewayUsername, &settings->Username))
      return FALSE;
    if (!utils_str_copy(settings->GatewayDomain, &settings->Domain))
      return FALSE;
    if (!utils_str_copy(settings->GatewayPassword, &settings->Password))
      return FALSE;
  }
  return TRUE;
}

BOOL utils_persist_credentials(rdpSettings* settings, const rdpSettings* current)
{
  if (!settings || !current)
    return FALSE;

  const SSIZE_T keys[] = { FreeRDP_GatewayUsername, FreeRDP_GatewayDomain,
                         FreeRDP_GatewayPassword, FreeRDP_Username,
                         FreeRDP_Domain,          FreeRDP_Password };

  for (size_t x = 0; x < ARRAYSIZE(keys); x++)
  {
    const SSIZE_T key = keys[x];
    if (!freerdp_settings_copy_item(settings, current, key))
    {
      WLog_ERR(TAG, "Failed to copy %s from current to backup settings",
               freerdp_settings_get_name_for_key(key));
      return FALSE;
    }
  }

  return TRUE;
}

BOOL utils_str_is_empty(const char* str)
{
  if (!str)
    return TRUE;
  if (*str == '\0')
    return TRUE;
  return FALSE;
}

BOOL utils_abort_connect(rdpRdp* rdp)
{
  if (!rdp)
    return FALSE;

  return SetEvent(rdp->abortEvent);
}

BOOL utils_reset_abort(rdpRdp* rdp)
{
  WINPR_ASSERT(rdp);

  return ResetEvent(rdp->abortEvent);
}

HANDLE utils_get_abort_event(rdpRdp* rdp)
{
  WINPR_ASSERT(rdp);
  return rdp->abortEvent;
}

BOOL utils_abort_event_is_set(const rdpRdp* rdp)
{
  DWORD status = 0;
  WINPR_ASSERT(rdp);
  status = WaitForSingleObject(rdp->abortEvent, 0);
  return status == WAIT_OBJECT_0;
}

const char* utils_is_vsock(const char* hostname)
{
  if (!hostname)
    return nullptr;

  const char vsock[8] = { 'v', 's', 'o', 'c', 'k', ':', '/', '/' };
  if (strncmp(hostname, vsock, sizeof(vsock)) == 0)
    return &hostname[sizeof(vsock)];
  return nullptr;
}

static BOOL remove_rdpdr_type(rdpSettings* settings, UINT32 type)
{
  BOOL rc = TRUE;
  RDPDR_DEVICE* printer = nullptr;
  do
  {
    printer = freerdp_device_collection_find_type(settings, type);
    if (printer)
    {
      if (!freerdp_device_collection_del(settings, printer))
        rc = FALSE;
    }
    freerdp_device_free(printer);
  } while (printer);
  return rc;
}

static BOOL disable_clipboard(rdpSettings* settings)
{
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectClipboard, FALSE))
    return FALSE;
  freerdp_static_channel_collection_del(settings, CLIPRDR_SVC_CHANNEL_NAME);
  return TRUE;
}

static BOOL disable_drive(rdpSettings* settings)
{
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectDrives, FALSE))
    return FALSE;
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectHomeDrive, FALSE))
    return FALSE;

  return remove_rdpdr_type(settings, RDPDR_DTYP_FILESYSTEM);
}

static BOOL disable_printers(rdpSettings* settings)
{
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectPrinters, FALSE))
    return FALSE;

  return remove_rdpdr_type(settings, RDPDR_DTYP_PRINT);
}

static BOOL disable_port(rdpSettings* settings)
{
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectParallelPorts, FALSE))
    return FALSE;
  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectSerialPorts, FALSE))
    return FALSE;
  if (!remove_rdpdr_type(settings, RDPDR_DTYP_SERIAL))
    return FALSE;
  return remove_rdpdr_type(settings, RDPDR_DTYP_PARALLEL);
}

static BOOL disable_pnp(WINPR_ATTR_UNUSED rdpSettings* settings)
{
  // TODO(akallabeth): [MS-RDPEPNP] related stuff is disabled.
  return TRUE;
}

static BOOL apply_gw_policy(rdpContext* context)
{
  WINPR_ASSERT(context);
  return utils_reload_channels(context);
}

BOOL utils_apply_gateway_policy(wLog* log, rdpContext* context, UINT32 flags, const char* module)
{
  WINPR_ASSERT(log);
  WINPR_ASSERT(context);

  rdpSettings* settings = context->settings;
  WINPR_ASSERT(settings);

  if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)
  {
    WLog_Print(log, WLOG_DEBUG, "[%s] policy allows all redirections", module);
  }
  else if (freerdp_settings_get_bool(settings, FreeRDP_GatewayIgnoreRedirectionPolicy))
  {
    char buffer[128] = WINPR_C_ARRAY_INIT;
    WLog_Print(log, WLOG_INFO, "[%s] policy ignored on user request %s", module,
               utils_redir_flags_to_string(flags, buffer, sizeof(buffer)));
  }
  else if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)
  {
    WLog_Print(log, WLOG_INFO, "[%s] policy denies all redirections", module);
    if (!disable_drive(settings))
      return FALSE;
    if (!disable_printers(settings))
      return FALSE;
    if (!disable_clipboard(settings))
      return FALSE;
    if (!disable_port(settings))
      return FALSE;
    if (!disable_pnp(settings))
      return FALSE;
    if (!apply_gw_policy(context))
      return FALSE;
  }
  else
  {
    if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)
    {
      WLog_Print(log, WLOG_INFO, "[%s] policy denies drive redirections", module);
      if (!disable_drive(settings))
        return FALSE;
    }
    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)
    {
      WLog_Print(log, WLOG_INFO, "[%s] policy denies printer redirections", module);
      if (!disable_printers(settings))
        return FALSE;
    }
    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)
    {
      WLog_Print(log, WLOG_INFO, "[%s] policy denies port redirections", module);
      if (!disable_port(settings))
        return FALSE;
    }
    if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)
    {
      WLog_Print(log, WLOG_INFO, "[%s] policy denies clipboard redirections", module);
      if (!disable_clipboard(settings))
        return FALSE;
    }
    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)
    {
      WLog_Print(log, WLOG_INFO, "[%s] policy denies PNP redirections", module);
      if (!disable_pnp(settings))
        return FALSE;
    }
    if (flags != 0)
    {
      if (!apply_gw_policy(context))
        return FALSE;
    }
  }
  return TRUE;
}

char* utils_redir_flags_to_string(UINT32 flags, char* buffer, size_t size)
{
  winpr_str_append("{", buffer, size, "");
  if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)
    winpr_str_append("ENABLE_ALL", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)
    winpr_str_append("DISABLE_ALL", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)
    winpr_str_append("DISABLE_DRIVE", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)
    winpr_str_append("DISABLE_PRINTER", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)
    winpr_str_append("DISABLE_PORT", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)
    winpr_str_append("DISABLE_CLIPBOARD", buffer, size, "|");
  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)
    winpr_str_append("DISABLE_PNP", buffer, size, "|");

  char fbuffer[16] = WINPR_C_ARRAY_INIT;
  (void)_snprintf(fbuffer, sizeof(fbuffer), "[0x%08" PRIx32 "]", flags);

  winpr_str_append(fbuffer, buffer, size, " ");
  winpr_str_append("{", buffer, size, "}");
  return buffer;
}

BOOL utils_reload_channels(rdpContext* context)
{
  WINPR_ASSERT(context);

  if (context->channels)
  {
    freerdp_channels_disconnect(context->channels, context->instance);
    freerdp_channels_close(context->channels, context->instance);
    freerdp_channels_free(context->channels);
  }

  context->channels = freerdp_channels_new(context->instance);
  if (!context->channels)
    return FALSE;

  freerdp_channels_register_instance(context->channels, context->instance);

  BOOL rc = TRUE;
  IFCALLRET(context->instance->LoadChannels, rc, context->instance);
  if (rc)
    return freerdp_channels_pre_connect(context->channels, context->instance) == CHANNEL_RC_OK;
  return rc;
}

Coverage Report

Created: 2026-04-12 07:03

Line	Count	Source
1		/**
2		* FreeRDP: A Remote Desktop Protocol Implementation
3		* Terminal Server Gateway (utils)
4		*
5		* Copyright 2021 Armin Novak <armin.novak@thincast.com>
6		* Copyright 2021 Thincast Technologies GmbH
7		*
8		* Licensed under the Apache License, Version 2.0 (the "License");
9		* you may not use this file except in compliance with the License.
10		* You may obtain a copy of the License at
11		*
12		* http://www.apache.org/licenses/LICENSE-2.0
13		*
14		* Unless required by applicable law or agreed to in writing, software
15		* distributed under the License is distributed on an "AS IS" BASIS,
16		* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17		* See the License for the specific language governing permissions and
18		* limitations under the License.
19		*/
20
21		#include <freerdp/config.h>
22
23		#include "settings.h"
24
25		#include <winpr/assert.h>
26
27		#include <freerdp/freerdp.h>
28		#include <freerdp/channels/cliprdr.h>
29		#include <freerdp/channels/rdpdr.h>
30
31		#include <freerdp/log.h>
32		#define TAG FREERDP_TAG("core.gateway.utils")
33
34		#include "utils.h"
35
36		#include "../core/rdp.h"
37
38		BOOL utils_str_copy(const char* value, char** dst)
39	0	{
40	0	WINPR_ASSERT(dst);
41
42	0	free(*dst);
43	0	*dst = nullptr;
44	0	if (!value)
45	0	return TRUE;
46
47	0	(*dst) = _strdup(value);
48	0	return (*dst) != nullptr;
49	0	}
50
51		static BOOL utils_copy_smartcard_settings(const rdpSettings* settings, rdpSettings* origSettings)
52	0	{
53		/* update original settings with provided smart card settings */
54	0	origSettings->SmartcardLogon = settings->SmartcardLogon;
55	0	origSettings->PasswordIsSmartcardPin = settings->PasswordIsSmartcardPin;
56	0	if (!utils_str_copy(settings->ReaderName, &origSettings->ReaderName))
57	0	return FALSE;
58	0	if (!utils_str_copy(settings->CspName, &origSettings->CspName))
59	0	return FALSE;
60	0	if (!utils_str_copy(settings->ContainerName, &origSettings->ContainerName))
61	0	return FALSE;
62
63	0	return TRUE;
64	0	}
65
66		auth_status utils_authenticate_gateway(freerdp* instance, rdp_auth_reason reason)
67	0	{
68	0	rdpSettings* settings = nullptr;
69	0	rdpSettings* origSettings = nullptr;
70	0	BOOL prompt = FALSE;
71	0	BOOL proceed = 0;
72
73	0	WINPR_ASSERT(instance);
74	0	WINPR_ASSERT(instance->context);
75	0	WINPR_ASSERT(instance->context->settings);
76	0	WINPR_ASSERT(instance->context->rdp);
77	0	WINPR_ASSERT(instance->context->rdp->originalSettings);
78
79	0	settings = instance->context->settings;
80	0	origSettings = instance->context->rdp->originalSettings;
81
82	0	if (freerdp_shall_disconnect_context(instance->context))
83	0	return AUTH_FAILED;
84
85	0	if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayPassword)))
86	0	prompt = TRUE;
87	0	if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayUsername)))
88	0	prompt = TRUE;
89
90	0	if (!prompt)
91	0	{
92	0	if (!utils_sync_credentials(settings, FALSE))
93	0	return AUTH_FAILED;
94	0	return AUTH_SKIP;
95	0	}
96
97	0	#if !defined(WITH_FREERDP_DEPRECATED)
98	0	if (!instance->AuthenticateEx)
99	0	return AUTH_NO_CREDENTIALS;
100		#else
101		if (!instance->GatewayAuthenticate && !instance->AuthenticateEx)
102		return AUTH_NO_CREDENTIALS;
103
104		if (!instance->GatewayAuthenticate)
105		#endif
106	0	{
107	0	proceed =
108	0	instance->AuthenticateEx(instance, &settings->GatewayUsername,
109	0	&settings->GatewayPassword, &settings->GatewayDomain, reason);
110	0	if (!proceed)
111	0	return AUTH_CANCELLED;
112	0	}
113		#if defined(WITH_FREERDP_DEPRECATED)
114		else
115		{
116		proceed =
117		instance->GatewayAuthenticate(instance, &settings->GatewayUsername,
118		&settings->GatewayPassword, &settings->GatewayDomain);
119		if (!proceed)
120		return AUTH_CANCELLED;
121		}
122		#endif
123
124	0	if (utils_str_is_empty(settings->GatewayUsername) \|\|
125	0	utils_str_is_empty(settings->GatewayPassword))
126	0	return AUTH_NO_CREDENTIALS;
127
128	0	if (!utils_sync_credentials(settings, FALSE))
129	0	return AUTH_FAILED;
130
131		/* update original settings with provided user credentials */
132	0	if (!utils_str_copy(settings->GatewayUsername, &origSettings->GatewayUsername))
133	0	return AUTH_FAILED;
134	0	if (!utils_str_copy(settings->GatewayDomain, &origSettings->GatewayDomain))
135	0	return AUTH_FAILED;
136	0	if (!utils_str_copy(settings->GatewayPassword, &origSettings->GatewayPassword))
137	0	return AUTH_FAILED;
138	0	if (!utils_sync_credentials(origSettings, FALSE))
139	0	return AUTH_FAILED;
140
141	0	if (!utils_copy_smartcard_settings(settings, origSettings))
142	0	return AUTH_FAILED;
143
144	0	return AUTH_SUCCESS;
145	0	}
146
147		auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL override)
148	0	{
149	0	rdpSettings* settings = nullptr;
150	0	rdpSettings* origSettings = nullptr;
151	0	BOOL prompt = !override;
152	0	BOOL proceed = 0;
153
154	0	WINPR_ASSERT(instance);
155	0	WINPR_ASSERT(instance->context);
156	0	WINPR_ASSERT(instance->context->settings);
157	0	WINPR_ASSERT(instance->context->rdp);
158	0	WINPR_ASSERT(instance->context->rdp->originalSettings);
159
160	0	settings = instance->context->settings;
161	0	origSettings = instance->context->rdp->originalSettings;
162
163	0	if (freerdp_shall_disconnect_context(instance->context))
164	0	return AUTH_FAILED;
165
166	0	if (settings->ConnectChildSession)
167	0	return AUTH_NO_CREDENTIALS;
168
169		/* Ask for auth data if no or an empty username was specified or no password was given */
170	0	if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_Username)) \|\|
171	0	(settings->Password == nullptr && settings->RedirectionPassword == nullptr))
172	0	prompt = TRUE;
173
174	0	if (!prompt)
175	0	return AUTH_SKIP;
176
177	0	switch (reason)
178	0	{
179	0	case AUTH_RDP:
180	0	case AUTH_TLS:
181	0	if (settings->SmartcardLogon)
182	0	{
183	0	if (!utils_str_is_empty(settings->Password))
184	0	{
185	0	WLog_INFO(TAG, "Authentication via smartcard");
186	0	return AUTH_SUCCESS;
187	0	}
188	0	reason = AUTH_SMARTCARD_PIN;
189	0	}
190	0	break;
191	0	case AUTH_NLA:
192	0	if (settings->SmartcardLogon)
193	0	reason = AUTH_SMARTCARD_PIN;
194	0	break;
195	0	case AUTH_RDSTLS:
196	0	default:
197	0	break;
198	0	}
199
200		/* If no callback is specified still continue connection */
201	0	#if !defined(WITH_FREERDP_DEPRECATED)
202	0	if (!instance->AuthenticateEx)
203	0	return AUTH_NO_CREDENTIALS;
204		#else
205		if (!instance->Authenticate && !instance->AuthenticateEx)
206		return AUTH_NO_CREDENTIALS;
207		if (!instance->Authenticate)
208		#endif
209	0	{
210	0	proceed = instance->AuthenticateEx(instance, &settings->Username, &settings->Password,
211	0	&settings->Domain, reason);
212	0	if (!proceed)
213	0	return AUTH_CANCELLED;
214	0	}
215		#if defined(WITH_FREERDP_DEPRECATED)
216		else
217		{
218		proceed = instance->Authenticate(instance, &settings->Username, &settings->Password,
219		&settings->Domain);
220		if (!proceed)
221		return AUTH_NO_CREDENTIALS;
222		}
223		#endif
224
225	0	if (utils_str_is_empty(settings->Username) \|\| utils_str_is_empty(settings->Password))
226	0	return AUTH_NO_CREDENTIALS;
227
228	0	if (!utils_sync_credentials(settings, TRUE))
229	0	return AUTH_FAILED;
230
231		/* update original settings with provided user credentials */
232	0	if (!utils_str_copy(settings->Username, &origSettings->Username))
233	0	return AUTH_FAILED;
234	0	if (!utils_str_copy(settings->Domain, &origSettings->Domain))
235	0	return AUTH_FAILED;
236	0	if (!utils_str_copy(settings->Password, &origSettings->Password))
237	0	return AUTH_FAILED;
238	0	if (!utils_sync_credentials(origSettings, TRUE))
239	0	return AUTH_FAILED;
240
241	0	if (!utils_copy_smartcard_settings(settings, origSettings))
242	0	return AUTH_FAILED;
243
244	0	return AUTH_SUCCESS;
245	0	}
246
247		BOOL utils_sync_credentials(rdpSettings* settings, BOOL toGateway)
248	0	{
249	0	WINPR_ASSERT(settings);
250	0	if (!settings->GatewayUseSameCredentials)
251	0	return TRUE;
252
253	0	if (toGateway)
254	0	{
255	0	if (!utils_str_copy(settings->Username, &settings->GatewayUsername))
256	0	return FALSE;
257	0	if (!utils_str_copy(settings->Domain, &settings->GatewayDomain))
258	0	return FALSE;
259	0	if (!utils_str_copy(settings->Password, &settings->GatewayPassword))
260	0	return FALSE;
261	0	}
262	0	else
263	0	{
264	0	if (!utils_str_copy(settings->GatewayUsername, &settings->Username))
265	0	return FALSE;
266	0	if (!utils_str_copy(settings->GatewayDomain, &settings->Domain))
267	0	return FALSE;
268	0	if (!utils_str_copy(settings->GatewayPassword, &settings->Password))
269	0	return FALSE;
270	0	}
271	0	return TRUE;
272	0	}
273
274		BOOL utils_persist_credentials(rdpSettings* settings, const rdpSettings* current)
275	0	{
276	0	if (!settings \|\| !current)
277	0	return FALSE;
278
279	0	const SSIZE_T keys[] = { FreeRDP_GatewayUsername, FreeRDP_GatewayDomain,
280	0	FreeRDP_GatewayPassword, FreeRDP_Username,
281	0	FreeRDP_Domain, FreeRDP_Password };
282
283	0	for (size_t x = 0; x < ARRAYSIZE(keys); x++)
284	0	{
285	0	const SSIZE_T key = keys[x];
286	0	if (!freerdp_settings_copy_item(settings, current, key))
287	0	{
288	0	WLog_ERR(TAG, "Failed to copy %s from current to backup settings",
289	0	freerdp_settings_get_name_for_key(key));
290	0	return FALSE;
291	0	}
292	0	}
293
294	0	return TRUE;
295	0	}
296
297		BOOL utils_str_is_empty(const char* str)
298	0	{
299	0	if (!str)
300	0	return TRUE;
301	0	if (*str == '\0')
302	0	return TRUE;
303	0	return FALSE;
304	0	}
305
306		BOOL utils_abort_connect(rdpRdp* rdp)
307	1.07k	{
308	1.07k	if (!rdp)
309	0	return FALSE;
310
311	1.07k	return SetEvent(rdp->abortEvent);
312	1.07k	}
313
314		BOOL utils_reset_abort(rdpRdp* rdp)
315	0	{
316	0	WINPR_ASSERT(rdp);
317
318	0	return ResetEvent(rdp->abortEvent);
319	0	}
320
321		HANDLE utils_get_abort_event(rdpRdp* rdp)
322	17.7k	{
323	17.7k	WINPR_ASSERT(rdp);
324	17.7k	return rdp->abortEvent;
325	17.7k	}
326
327		BOOL utils_abort_event_is_set(const rdpRdp* rdp)
328	70	{
329	70	DWORD status = 0;
330	70	WINPR_ASSERT(rdp);
331	70	status = WaitForSingleObject(rdp->abortEvent, 0);
332	70	return status == WAIT_OBJECT_0;
333	70	}
334
335		const char* utils_is_vsock(const char* hostname)
336	0	{
337	0	if (!hostname)
338	0	return nullptr;
339
340	0	const char vsock[8] = { 'v', 's', 'o', 'c', 'k', ':', '/', '/' };
341	0	if (strncmp(hostname, vsock, sizeof(vsock)) == 0)
342	0	return &hostname[sizeof(vsock)];
343	0	return nullptr;
344	0	}
345
346		static BOOL remove_rdpdr_type(rdpSettings* settings, UINT32 type)
347	0	{
348	0	BOOL rc = TRUE;
349	0	RDPDR_DEVICE* printer = nullptr;
350	0	do
351	0	{
352	0	printer = freerdp_device_collection_find_type(settings, type);
353	0	if (printer)
354	0	{
355	0	if (!freerdp_device_collection_del(settings, printer))
356	0	rc = FALSE;
357	0	}
358	0	freerdp_device_free(printer);
359	0	} while (printer);
360	0	return rc;
361	0	}
362
363		static BOOL disable_clipboard(rdpSettings* settings)
364	0	{
365	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectClipboard, FALSE))
366	0	return FALSE;
367	0	freerdp_static_channel_collection_del(settings, CLIPRDR_SVC_CHANNEL_NAME);
368	0	return TRUE;
369	0	}
370
371		static BOOL disable_drive(rdpSettings* settings)
372	0	{
373	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectDrives, FALSE))
374	0	return FALSE;
375	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectHomeDrive, FALSE))
376	0	return FALSE;
377
378	0	return remove_rdpdr_type(settings, RDPDR_DTYP_FILESYSTEM);
379	0	}
380
381		static BOOL disable_printers(rdpSettings* settings)
382	0	{
383	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectPrinters, FALSE))
384	0	return FALSE;
385
386	0	return remove_rdpdr_type(settings, RDPDR_DTYP_PRINT);
387	0	}
388
389		static BOOL disable_port(rdpSettings* settings)
390	0	{
391	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectParallelPorts, FALSE))
392	0	return FALSE;
393	0	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectSerialPorts, FALSE))
394	0	return FALSE;
395	0	if (!remove_rdpdr_type(settings, RDPDR_DTYP_SERIAL))
396	0	return FALSE;
397	0	return remove_rdpdr_type(settings, RDPDR_DTYP_PARALLEL);
398	0	}
399
400		static BOOL disable_pnp(WINPR_ATTR_UNUSED rdpSettings* settings)
401	0	{
402		// TODO(akallabeth): [MS-RDPEPNP] related stuff is disabled.
403	0	return TRUE;
404	0	}
405
406		static BOOL apply_gw_policy(rdpContext* context)
407	0	{
408	0	WINPR_ASSERT(context);
409	0	return utils_reload_channels(context);
410	0	}
411
412		BOOL utils_apply_gateway_policy(wLog* log, rdpContext* context, UINT32 flags, const char* module)
413	0	{
414	0	WINPR_ASSERT(log);
415	0	WINPR_ASSERT(context);
416
417	0	rdpSettings* settings = context->settings;
418	0	WINPR_ASSERT(settings);
419
420	0	if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)
421	0	{
422	0	WLog_Print(log, WLOG_DEBUG, "[%s] policy allows all redirections", module);
423	0	}
424	0	else if (freerdp_settings_get_bool(settings, FreeRDP_GatewayIgnoreRedirectionPolicy))
425	0	{
426	0	char buffer[128] = WINPR_C_ARRAY_INIT;
427	0	WLog_Print(log, WLOG_INFO, "[%s] policy ignored on user request %s", module,
428	0	utils_redir_flags_to_string(flags, buffer, sizeof(buffer)));
429	0	}
430	0	else if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)
431	0	{
432	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies all redirections", module);
433	0	if (!disable_drive(settings))
434	0	return FALSE;
435	0	if (!disable_printers(settings))
436	0	return FALSE;
437	0	if (!disable_clipboard(settings))
438	0	return FALSE;
439	0	if (!disable_port(settings))
440	0	return FALSE;
441	0	if (!disable_pnp(settings))
442	0	return FALSE;
443	0	if (!apply_gw_policy(context))
444	0	return FALSE;
445	0	}
446	0	else
447	0	{
448	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)
449	0	{
450	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies drive redirections", module);
451	0	if (!disable_drive(settings))
452	0	return FALSE;
453	0	}
454	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)
455	0	{
456	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies printer redirections", module);
457	0	if (!disable_printers(settings))
458	0	return FALSE;
459	0	}
460	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)
461	0	{
462	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies port redirections", module);
463	0	if (!disable_port(settings))
464	0	return FALSE;
465	0	}
466	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)
467	0	{
468	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies clipboard redirections", module);
469	0	if (!disable_clipboard(settings))
470	0	return FALSE;
471	0	}
472	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)
473	0	{
474	0	WLog_Print(log, WLOG_INFO, "[%s] policy denies PNP redirections", module);
475	0	if (!disable_pnp(settings))
476	0	return FALSE;
477	0	}
478	0	if (flags != 0)
479	0	{
480	0	if (!apply_gw_policy(context))
481	0	return FALSE;
482	0	}
483	0	}
484	0	return TRUE;
485	0	}
486
487		char* utils_redir_flags_to_string(UINT32 flags, char* buffer, size_t size)
488	0	{
489	0	winpr_str_append("{", buffer, size, "");
490	0	if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)
491	0	winpr_str_append("ENABLE_ALL", buffer, size, "\|");
492	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)
493	0	winpr_str_append("DISABLE_ALL", buffer, size, "\|");
494	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)
495	0	winpr_str_append("DISABLE_DRIVE", buffer, size, "\|");
496	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)
497	0	winpr_str_append("DISABLE_PRINTER", buffer, size, "\|");
498	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)
499	0	winpr_str_append("DISABLE_PORT", buffer, size, "\|");
500	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)
501	0	winpr_str_append("DISABLE_CLIPBOARD", buffer, size, "\|");
502	0	if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)
503	0	winpr_str_append("DISABLE_PNP", buffer, size, "\|");
504
505	0	char fbuffer[16] = WINPR_C_ARRAY_INIT;
506	0	(void)_snprintf(fbuffer, sizeof(fbuffer), "[0x%08" PRIx32 "]", flags);
507
508	0	winpr_str_append(fbuffer, buffer, size, " ");
509	0	winpr_str_append("{", buffer, size, "}");
510	0	return buffer;
511	0	}
512
513		BOOL utils_reload_channels(rdpContext* context)
514	0	{
515	0	WINPR_ASSERT(context);
516
517	0	if (context->channels)
518	0	{
519	0	freerdp_channels_disconnect(context->channels, context->instance);
520	0	freerdp_channels_close(context->channels, context->instance);
521	0	freerdp_channels_free(context->channels);
522	0	}
523
524	0	context->channels = freerdp_channels_new(context->instance);
525	0	if (!context->channels)
526	0	return FALSE;
527
528	0	freerdp_channels_register_instance(context->channels, context->instance);
529
530	0	BOOL rc = TRUE;
531	0	IFCALLRET(context->instance->LoadChannels, rc, context->instance);
532	0	if (rc)
533	0	return freerdp_channels_pre_connect(context->channels, context->instance) == CHANNEL_RC_OK;
534	0	return rc;
535	0	}