FreeRDP
Loading...
Searching...
No Matches
pf_config.c
1
23#include <stdio.h>
24#include <string.h>
25#include <winpr/crt.h>
26#include <winpr/path.h>
27#include <winpr/collections.h>
28#include <winpr/cmdline.h>
29
30#include "pf_server.h"
31#include <freerdp/server/proxy/proxy_config.h>
32
33#include <freerdp/server/proxy/proxy_log.h>
34
35#include <freerdp/crypto/crypto.h>
36#include <freerdp/channels/cliprdr.h>
37#include <freerdp/channels/rdpsnd.h>
38#include <freerdp/channels/audin.h>
39#include <freerdp/channels/rdpdr.h>
40#include <freerdp/channels/disp.h>
41#include <freerdp/channels/rail.h>
42#include <freerdp/channels/rdpei.h>
43#include <freerdp/channels/tsmf.h>
44#include <freerdp/channels/video.h>
45#include <freerdp/channels/rdpecam.h>
46
47#include "pf_utils.h"
48
49#define TAG PROXY_TAG("config")
50
51#define CONFIG_PRINT_SECTION(section) WLog_INFO(TAG, "\t%s:", section)
52#define CONFIG_PRINT_SECTION_KEY(section, key) WLog_INFO(TAG, "\t%s/%s:", section, key)
53#define CONFIG_PRINT_STR(config, key) WLog_INFO(TAG, "\t\t%s: %s", #key, (config)->key)
54#define CONFIG_PRINT_SECRET_STR(config, key) \
55 WLog_INFO(TAG, "\t\t%s: %s", #key, (config)->key ? "********" : nullptr)
56#define CONFIG_PRINT_BOOL(config, key) WLog_INFO(TAG, "\t\t%s: %s", #key, boolstr((config)->key))
57#define CONFIG_PRINT_UINT16(config, key) WLog_INFO(TAG, "\t\t%s: %" PRIu16 "", #key, (config)->key)
58#define CONFIG_PRINT_UINT32(config, key) WLog_INFO(TAG, "\t\t%s: %" PRIu32 "", #key, (config)->key)
59
60static const char* bool_str_true = "true";
61static const char* bool_str_false = "false";
62
63WINPR_ATTR_NODISCARD
64static const char* boolstr(BOOL rc)
65{
66 return rc ? bool_str_true : bool_str_false;
67}
68
69static const char* section_server = "Server";
70static const char* key_host = "Host";
71static const char* key_port = "Port";
72static const char* key_sam_file = "SamFile";
73
74static const char* section_target = "Target";
75static const char* key_target_fixed = "FixedTarget";
76static const char* key_target_user = "User";
77static const char* key_target_pwd = "Password";
78static const char* key_target_domain = "Domain";
79static const char* key_target_tls_seclevel = "TlsSecLevel";
80static const char* key_target_scard_auth = "SmartcardAuth";
81static const char* key_target_scard_cert = "SmartcardCert";
82static const char* key_target_scard_key = "SmartcardKey";
83static const char* key_target_scard_pem_cert = "SmartcardCertPEMContent";
84static const char* key_target_scard_pem_key = "SmartcardKeyPEMContent";
85static const char* key_target_cert_policy = "CertificatePolicy";
86static const char* key_target_cert_pem = "CertificatePEM";
87static const char* key_target_cert_pem_content =
88 "CertificatePEMContent";
89static const char* key_target_cert_hash = "CertificateHash";
90static const char* key_target_cert_store_path = "CertificateStorePath";
92static const char* section_plugins = "Plugins";
93static const char* key_plugins_modules = "Modules";
94static const char* key_plugins_required = "Required";
95
96static const char* section_codecs = "Codecs";
97static const char* key_codecs_rfx = "RFX";
98static const char* key_codecs_nsc = "NSC";
99
100static const char* section_channels = "Channels";
101static const char* key_channels_gfx = "GFX";
102static const char* key_channels_disp = "DisplayControl";
103static const char* key_channels_clip = "Clipboard";
104static const char* key_channels_mic = "AudioInput";
105static const char* key_channels_sound = "AudioOutput";
106static const char* key_channels_rdpdr = "DeviceRedirection";
107static const char* key_channels_video = "VideoRedirection";
108static const char* key_channels_camera = "CameraRedirection";
109static const char* key_channels_rails = "RemoteApp";
110static const char* key_channels_blacklist = "PassthroughIsBlacklist";
111static const char* key_channels_pass = "Passthrough";
112static const char* key_channels_intercept = "Intercept";
113
114static const char* section_input = "Input";
115static const char* key_input_kbd = "Keyboard";
116static const char* key_input_mouse = "Mouse";
117static const char* key_input_multitouch = "Multitouch";
118
119static const char* section_security = "Security";
120static const char* key_security_server_nla = "ServerNlaSecurity";
121static const char* key_security_server_ext = "ServerExtSecurity";
122static const char* key_security_server_tls = "ServerTlsSecurity";
123static const char* key_security_server_rdp = "ServerRdpSecurity";
124static const char* key_security_client_nla = "ClientNlaSecurity";
125static const char* key_security_client_ext = "ClientExtSecurity";
126static const char* key_security_client_tls = "ClientTlsSecurity";
127static const char* key_security_client_rdp = "ClientRdpSecurity";
128static const char* key_security_client_fallback = "ClientAllowFallbackToTls";
129
130static const char* section_certificates = "Certificates";
131static const char* key_private_key_file = "PrivateKeyFile";
132static const char* key_private_key_content = "PrivateKeyContent";
133static const char* key_cert_file = "CertificateFile";
134static const char* key_cert_content = "CertificateContent";
135
136WINPR_ATTR_MALLOC(free, 1)
137static char* pf_config_decode_base64(const char* data, const char* name, size_t* pLength);
138
139WINPR_ATTR_MALLOC(CommandLineParserFree, 1)
140WINPR_ATTR_NODISCARD
141static char** pf_config_parse_comma_separated_list(const char* list, size_t* count)
142{
143 if (!list || !count)
144 return nullptr;
145
146 if (strlen(list) == 0)
147 {
148 *count = 0;
149 return nullptr;
150 }
151
152 return CommandLineParseCommaSeparatedValues(list, count);
153}
154
155WINPR_ATTR_NODISCARD
156static BOOL pf_config_get_uint16(wIniFile* ini, const char* section, const char* key,
157 UINT16* result, BOOL required)
158{
159 int val = 0;
160 const char* strval = nullptr;
161
162 WINPR_ASSERT(result);
163
164 strval = IniFile_GetKeyValueString(ini, section, key);
165 if (!strval && required)
166 {
167 WLog_ERR(TAG, "key '%s.%s' does not exist.", section, key);
168 return FALSE;
169 }
170 else if (!strval)
171 goto out;
172
173 val = IniFile_GetKeyValueInt(ini, section, key);
174 if ((val <= 0) || (val > UINT16_MAX))
175 {
176 WLog_ERR(TAG, "invalid value %d for key '%s.%s'.", val, section, key);
177 return FALSE;
178 }
179
180out:
181 *result = (UINT16)val;
182 return TRUE;
183}
184
185WINPR_ATTR_NODISCARD
186static BOOL pf_config_get_uint32(wIniFile* ini, const char* section, const char* key,
187 UINT32* result, BOOL required)
188{
189 WINPR_ASSERT(result);
190
191 const char* strval = IniFile_GetKeyValueString(ini, section, key);
192 if (!strval)
193 {
194 if (required)
195 WLog_ERR(TAG, "key '%s.%s' does not exist.", section, key);
196 return !required;
197 }
198
199 const int val = IniFile_GetKeyValueInt(ini, section, key);
200 if (val < 0)
201 {
202 WLog_ERR(TAG, "invalid value %d for key '%s.%s'.", val, section, key);
203 return FALSE;
204 }
205
206 *result = (UINT32)val;
207 return TRUE;
208}
209
210WINPR_ATTR_NODISCARD
211static BOOL pf_config_get_bool(wIniFile* ini, const char* section, const char* key, BOOL fallback)
212{
213 int num_value = 0;
214 const char* str_value = nullptr;
215
216 str_value = IniFile_GetKeyValueString(ini, section, key);
217 if (!str_value)
218 {
219 WLog_WARN(TAG, "key '%s.%s' not found, value defaults to %s.", section, key,
220 fallback ? bool_str_true : bool_str_false);
221 return fallback;
222 }
223
224 if (_stricmp(str_value, bool_str_true) == 0)
225 return TRUE;
226 if (_stricmp(str_value, bool_str_false) == 0)
227 return FALSE;
228
229 num_value = IniFile_GetKeyValueInt(ini, section, key);
230
231 return (num_value != 0);
232}
233
234WINPR_ATTR_NODISCARD
235static const char* pf_config_get_str(wIniFile* ini, const char* section, const char* key,
236 BOOL required)
237{
238 const char* value = IniFile_GetKeyValueString(ini, section, key);
239
240 if (!value)
241 {
242 if (required)
243 WLog_ERR(TAG, "key '%s.%s' not found.", section, key);
244 return nullptr;
245 }
246
247 return value;
248}
249
250WINPR_ATTR_NODISCARD
251static BOOL pf_config_copy_string(char** dst, const char* src)
252{
253 WINPR_ASSERT(dst);
254 *dst = nullptr;
255 if (src)
256 *dst = _strdup(src);
257 return TRUE;
258}
259
260WINPR_ATTR_NODISCARD
261static BOOL pf_config_free_and_copy_string(char** dst, const char* src)
262{
263 WINPR_ASSERT(dst);
264 winpr_zfree(*dst);
265 return pf_config_copy_string(dst, src);
266}
267
268WINPR_ATTR_NODISCARD
269static BOOL pf_config_load_server(wIniFile* ini, proxyConfig* config)
270{
271 WINPR_ASSERT(config);
272 const char* host = pf_config_get_str(ini, section_server, key_host, FALSE);
273
274 if (host)
275 {
276 if (!pf_config_free_and_copy_string(&config->Host, host))
277 return FALSE;
278 }
279
280 if (!pf_config_get_uint16(ini, section_server, key_port, &config->Port, FALSE))
281 return FALSE;
282
283 const char* sam = pf_config_get_str(ini, section_server, key_sam_file, FALSE);
284 if (sam)
285 {
286 if (!pf_config_free_and_copy_string(&config->SamFile, sam))
287 return FALSE;
288 }
289
290 return TRUE;
291}
292
293WINPR_ATTR_NODISCARD
294static BOOL pf_config_load_target(wIniFile* ini, proxyConfig* config)
295{
296 const char* target_value = nullptr;
297
298 WINPR_ASSERT(config);
299 config->FixedTarget = pf_config_get_bool(ini, section_target, key_target_fixed, FALSE);
300
301 if (!pf_config_get_uint32(ini, section_target, key_target_tls_seclevel,
302 &config->TargetTlsSecLevel, FALSE))
303 return FALSE;
304
305 if (config->FixedTarget)
306 {
307 if (!pf_config_get_uint16(ini, section_target, key_port, &config->TargetPort, FALSE))
308 return FALSE;
309
310 target_value = pf_config_get_str(ini, section_target, key_host, FALSE);
311 if (target_value)
312 {
313 if (!pf_config_free_and_copy_string(&config->TargetHost, target_value))
314 return FALSE;
315 }
316 }
317
318 target_value = pf_config_get_str(ini, section_target, key_target_user, FALSE);
319 if (target_value)
320 {
321 if (!pf_config_free_and_copy_string(&config->TargetUser, target_value))
322 return FALSE;
323 }
324
325 target_value = pf_config_get_str(ini, section_target, key_target_pwd, FALSE);
326 if (target_value)
327 {
328 if (!pf_config_free_and_copy_string(&config->TargetPassword, target_value))
329 return FALSE;
330 }
331
332 target_value = pf_config_get_str(ini, section_target, key_target_domain, FALSE);
333 if (target_value)
334 {
335 if (!pf_config_free_and_copy_string(&config->TargetDomain, target_value))
336 return FALSE;
337 }
338
339 config->TargetSmartcardAuth =
340 pf_config_get_bool(ini, section_target, key_target_scard_auth, FALSE);
341
342 target_value = pf_config_get_str(ini, section_target, key_target_scard_cert, FALSE);
343 if (target_value)
344 {
345 size_t len = 0;
346 char* pem = crypto_read_pem(target_value, &len);
347 if (!pem)
348 return FALSE;
349 winpr_znfree(config->TargetSmartcardCert, config->TargetSmartcardCertLength);
350 config->TargetSmartcardCert = pem;
351 config->TargetSmartcardCertLength = len;
352 }
353
354 {
355 const char* pem_value =
356 pf_config_get_str(ini, section_target, key_target_scard_pem_cert, FALSE);
357 if (pem_value)
358 {
359 if (target_value)
360 WLog_WARN(TAG, "In section [%s] both, '%s' and '%s' are provided. Ignoring %s",
361 section_target, key_target_scard_cert, key_target_scard_pem_cert,
362 key_target_scard_cert);
363 winpr_znfree(config->TargetSmartcardCert, config->TargetSmartcardCertLength);
364 size_t len = 0;
365 config->TargetSmartcardCert =
366 pf_config_decode_base64(pem_value, key_target_scard_pem_cert, &len);
367 if (!config->TargetSmartcardCert)
368 return FALSE;
369 config->TargetSmartcardCertLength = len;
370 }
371 }
372
373 target_value = pf_config_get_str(ini, section_target, key_target_scard_key, FALSE);
374 if (target_value)
375 {
376 size_t len = 0;
377 char* pem = crypto_read_pem(target_value, &len);
378 if (!pem)
379 return FALSE;
380 winpr_znfree(config->TargetSmartcardKey, config->TargetSmartcardKeyLength);
381 config->TargetSmartcardKey = pem;
382 config->TargetSmartcardKeyLength = len;
383 }
384
385 {
386 const char* pem_value =
387 pf_config_get_str(ini, section_target, key_target_scard_pem_key, FALSE);
388 if (pem_value)
389 {
390 if (target_value)
391 WLog_WARN(TAG, "In section [%s] both, '%s' and '%s' are provided. Ignoring %s",
392 section_target, key_target_scard_key, key_target_scard_pem_key,
393 key_target_scard_key);
394 winpr_znfree(config->TargetSmartcardKey, config->TargetSmartcardKeyLength);
395
396 size_t len = 0;
397 config->TargetSmartcardKey =
398 pf_config_decode_base64(pem_value, key_target_scard_pem_key, &len);
399 if (!config->TargetSmartcardKey)
400 return FALSE;
401 config->TargetSmartcardKeyLength = len;
402 }
403 }
404
405 target_value = pf_config_get_str(ini, section_target, key_target_cert_pem, FALSE);
406 if (target_value)
407 {
408 size_t len = 0;
409 char* pem = crypto_read_pem(target_value, &len);
410 if (!pem)
411 return FALSE;
412 winpr_znfree(config->TargetCertPEM, config->TargetCertPEMLength);
413 config->TargetCertPEM = pem;
414 config->TargetCertPEMLength = len;
415 }
416
417 target_value = pf_config_get_str(ini, section_target, key_target_cert_pem_content, FALSE);
418 if (target_value)
419 {
420 const char* pem_value = pf_config_get_str(ini, section_target, key_target_cert_pem, FALSE);
421 if (pem_value)
422 WLog_WARN(TAG, "In section [%s] both, '%s' and '%s' are provided. Ignoring %s",
423 section_target, key_target_cert_pem, key_target_cert_pem_content,
424 key_target_cert_pem);
425
426 winpr_znfree(config->TargetCertPEM, config->TargetCertPEMLength);
427 config->TargetCertPEM = pf_config_decode_base64(target_value, "TargetCertificateContent",
428 &config->TargetCertPEMLength);
429
430 if (!config->TargetCertPEM || (config->TargetCertPEMLength == 0))
431 return FALSE;
432 }
433
434 target_value = pf_config_get_str(ini, section_target, key_target_cert_hash, FALSE);
435 if (target_value)
436 {
437 const char* sep = strchr(target_value, ':');
438 char hash[32] = WINPR_C_ARRAY_INIT;
439 if (sep)
440 {
441 const size_t len = WINPR_ASSERTING_INT_CAST(size_t, sep - target_value);
442 if (len < sizeof(hash))
443 {
444 memcpy(hash, target_value, len);
445 }
446 }
447 if (!sep || (winpr_md_type_from_string(hash) == WINPR_MD_NONE))
448 {
449 WLog_WARN(TAG,
450 "In section [%s] key %s value %s is invalid. Format required is '<hash "
451 "type>:<hash value>'.",
452 section_target, key_target_cert_hash, target_value);
453 return FALSE;
454 }
455 winpr_zfree(config->TargetCertHash);
456 config->TargetCertHash = _strdup(target_value);
457 if (!config->TargetCertHash)
458 return FALSE;
459 }
460
461 target_value = pf_config_get_str(ini, section_target, key_target_cert_store_path, FALSE);
462 if (target_value)
463 {
464 winpr_zfree(config->CertStorePath);
465 config->CertStorePath = _strdup(target_value);
466 if (!config->CertStorePath)
467 return FALSE;
468 }
469
470 target_value = pf_config_get_str(ini, section_target, key_target_cert_policy, FALSE);
471 if (target_value)
472 {
473 config->TargetCertPolicy = pf_config_policy_from_str(target_value);
474 switch (config->TargetCertPolicy)
475 {
476 case FREERDP_PROXY_CERT_POLICY_PINNED:
477 {
478 if (!config->TargetCertHash && !config->TargetCertPEM)
479 {
480 WLog_WARN(
481 TAG, "In section [%s] key %s value %s requires one of %s, %s or %s set.",
482 section_target, key_target_cert_policy, target_value, key_target_cert_hash,
483 key_target_cert_pem, key_target_cert_pem_content);
484 return FALSE;
485 }
486 }
487 break;
488 default:
489 break;
490 }
491 }
492
493 return TRUE;
494}
495
496WINPR_ATTR_NODISCARD
497static BOOL pf_config_load_codecs(wIniFile* ini, proxyConfig* config)
498{
499 WINPR_ASSERT(config);
500 config->RFX = pf_config_get_bool(ini, section_codecs, key_codecs_rfx, TRUE);
501 config->NSC = pf_config_get_bool(ini, section_codecs, key_codecs_nsc, TRUE);
502 return TRUE;
503}
504
505WINPR_ATTR_NODISCARD
506static BOOL pf_config_load_channels(wIniFile* ini, proxyConfig* config)
507{
508 WINPR_ASSERT(config);
509 config->GFX = pf_config_get_bool(ini, section_channels, key_channels_gfx, TRUE);
510 config->DisplayControl = pf_config_get_bool(ini, section_channels, key_channels_disp, TRUE);
511 config->Clipboard = pf_config_get_bool(ini, section_channels, key_channels_clip, FALSE);
512 config->AudioOutput = pf_config_get_bool(ini, section_channels, key_channels_sound, TRUE);
513 config->AudioInput = pf_config_get_bool(ini, section_channels, key_channels_mic, TRUE);
514 config->DeviceRedirection = pf_config_get_bool(ini, section_channels, key_channels_rdpdr, TRUE);
515 config->VideoRedirection = pf_config_get_bool(ini, section_channels, key_channels_video, TRUE);
516 config->CameraRedirection =
517 pf_config_get_bool(ini, section_channels, key_channels_camera, TRUE);
518 config->RemoteApp = pf_config_get_bool(ini, section_channels, key_channels_rails, FALSE);
519 config->PassthroughIsBlacklist =
520 pf_config_get_bool(ini, section_channels, key_channels_blacklist, FALSE);
521 config->Passthrough = pf_config_parse_comma_separated_list(
522 pf_config_get_str(ini, section_channels, key_channels_pass, FALSE),
523 &config->PassthroughCount);
524 config->Intercept = pf_config_parse_comma_separated_list(
525 pf_config_get_str(ini, section_channels, key_channels_intercept, FALSE),
526 &config->InterceptCount);
527
528 return TRUE;
529}
530
531WINPR_ATTR_NODISCARD
532static BOOL pf_config_load_input(wIniFile* ini, proxyConfig* config)
533{
534 WINPR_ASSERT(config);
535 config->Keyboard = pf_config_get_bool(ini, section_input, key_input_kbd, TRUE);
536 config->Mouse = pf_config_get_bool(ini, section_input, key_input_mouse, TRUE);
537 config->Multitouch = pf_config_get_bool(ini, section_input, key_input_multitouch, TRUE);
538 return TRUE;
539}
540
541WINPR_ATTR_NODISCARD
542static BOOL pf_config_load_security(wIniFile* ini, proxyConfig* config)
543{
544 WINPR_ASSERT(config);
545 config->ServerTlsSecurity =
546 pf_config_get_bool(ini, section_security, key_security_server_tls, TRUE);
547 config->ServerNlaSecurity =
548 pf_config_get_bool(ini, section_security, key_security_server_nla, FALSE);
549 config->ServerExtSecurity =
550 pf_config_get_bool(ini, section_security, key_security_server_ext, FALSE);
551 config->ServerRdpSecurity =
552 pf_config_get_bool(ini, section_security, key_security_server_rdp, TRUE);
553
554 config->ClientTlsSecurity =
555 pf_config_get_bool(ini, section_security, key_security_client_tls, TRUE);
556 config->ClientNlaSecurity =
557 pf_config_get_bool(ini, section_security, key_security_client_nla, TRUE);
558 config->ClientExtSecurity =
559 pf_config_get_bool(ini, section_security, key_security_client_ext, TRUE);
560 config->ClientRdpSecurity =
561 pf_config_get_bool(ini, section_security, key_security_client_rdp, TRUE);
562 config->ClientAllowFallbackToTls =
563 pf_config_get_bool(ini, section_security, key_security_client_fallback, TRUE);
564 return TRUE;
565}
566
567WINPR_ATTR_NODISCARD
568static BOOL pf_config_load_modules(wIniFile* ini, proxyConfig* config)
569{
570 const char* modules_to_load = nullptr;
571 const char* required_modules = nullptr;
572
573 modules_to_load = pf_config_get_str(ini, section_plugins, key_plugins_modules, FALSE);
574 required_modules = pf_config_get_str(ini, section_plugins, key_plugins_required, FALSE);
575
576 WINPR_ASSERT(config);
577 config->Modules = pf_config_parse_comma_separated_list(modules_to_load, &config->ModulesCount);
578
579 config->RequiredPlugins =
580 pf_config_parse_comma_separated_list(required_modules, &config->RequiredPluginsCount);
581 return TRUE;
582}
583
584char* pf_config_decode_base64(const char* data, const char* name, size_t* pLength)
585{
586 const char* headers[] = { "-----BEGIN PUBLIC KEY-----", "-----BEGIN RSA PUBLIC KEY-----",
587 "-----BEGIN CERTIFICATE-----", "-----BEGIN PRIVATE KEY-----",
588 "-----BEGIN RSA PRIVATE KEY-----" };
589
590 size_t decoded_length = 0;
591 char* decoded = nullptr;
592 if (!data)
593 {
594 WLog_ERR(TAG, "Invalid base64 data [nullptr] for %s", name);
595 return nullptr;
596 }
597
598 WINPR_ASSERT(name);
599 WINPR_ASSERT(pLength);
600
601 const size_t length = strlen(data);
602
603 if (strncmp(data, "-----", 5) == 0)
604 {
605 BOOL expected = FALSE;
606 for (size_t x = 0; x < ARRAYSIZE(headers); x++)
607 {
608 const char* header = headers[x];
609
610 if (strncmp(data, header, strlen(header)) == 0)
611 expected = TRUE;
612 }
613
614 if (!expected)
615 {
616 /* Extract header for log message
617 * expected format is '----- SOMETEXT -----'
618 */
619 char hdr[128] = WINPR_C_ARRAY_INIT;
620 const char* end = strchr(&data[5], '-');
621 if (end)
622 {
623 while (*end == '-')
624 end++;
625
626 const size_t s = MIN(ARRAYSIZE(hdr) - 1ULL, (size_t)(end - data));
627 memcpy(hdr, data, s);
628 }
629
630 WLog_WARN(TAG, "PEM has unexpected header '%s'. Known supported headers are:", hdr);
631 for (size_t x = 0; x < ARRAYSIZE(headers); x++)
632 {
633 const char* header = headers[x];
634 WLog_WARN(TAG, "%s", header);
635 }
636 }
637
638 *pLength = length + 1;
639 return _strdup(data);
640 }
641
642 crypto_base64_decode(data, length, (BYTE**)&decoded, &decoded_length);
643 if (!decoded || decoded_length == 0)
644 {
645 WLog_ERR(TAG, "Failed to decode base64 data of length %" PRIuz " for %s", length, name);
646 winpr_zfree(decoded);
647 return nullptr;
648 }
649
650 *pLength = strnlen(decoded, decoded_length) + 1;
651 return decoded;
652}
653
654WINPR_ATTR_NODISCARD
655static BOOL pf_config_load_certificates(wIniFile* ini, proxyConfig* config)
656{
657 const char* tmp1 = nullptr;
658 const char* tmp2 = nullptr;
659
660 WINPR_ASSERT(ini);
661 WINPR_ASSERT(config);
662
663 tmp1 = pf_config_get_str(ini, section_certificates, key_cert_file, FALSE);
664 if (tmp1)
665 {
666 if (!winpr_PathFileExists(tmp1))
667 {
668 WLog_ERR(TAG, "%s/%s file %s does not exist", section_certificates, key_cert_file,
669 tmp1);
670 return FALSE;
671 }
672 config->CertificateFile = _strdup(tmp1);
673 config->CertificatePEM =
674 crypto_read_pem(config->CertificateFile, &config->CertificatePEMLength);
675 if (!config->CertificatePEM)
676 return FALSE;
677 config->CertificatePEMLength += 1;
678 }
679 tmp2 = pf_config_get_str(ini, section_certificates, key_cert_content, FALSE);
680 if (tmp2)
681 {
682 if (strlen(tmp2) < 1)
683 {
684 WLog_ERR(TAG, "%s/%s has invalid empty value", section_certificates, key_cert_content);
685 return FALSE;
686 }
687 config->CertificateContent = _strdup(tmp2);
688 config->CertificatePEM = pf_config_decode_base64(
689 config->CertificateContent, "CertificateContent", &config->CertificatePEMLength);
690 if (!config->CertificatePEM)
691 return FALSE;
692 }
693 if (tmp1 && tmp2)
694 {
695 WLog_ERR(TAG,
696 "%s/%s and %s/%s are "
697 "mutually exclusive options",
698 section_certificates, key_cert_file, section_certificates, key_cert_content);
699 return FALSE;
700 }
701 else if (!tmp1 && !tmp2)
702 {
703 WLog_ERR(TAG,
704 "%s/%s or %s/%s are "
705 "required settings",
706 section_certificates, key_cert_file, section_certificates, key_cert_content);
707 return FALSE;
708 }
709
710 tmp1 = pf_config_get_str(ini, section_certificates, key_private_key_file, FALSE);
711 if (tmp1)
712 {
713 if (!winpr_PathFileExists(tmp1))
714 {
715 WLog_ERR(TAG, "%s/%s file %s does not exist", section_certificates,
716 key_private_key_file, tmp1);
717 return FALSE;
718 }
719 config->PrivateKeyFile = _strdup(tmp1);
720 config->PrivateKeyPEM =
721 crypto_read_pem(config->PrivateKeyFile, &config->PrivateKeyPEMLength);
722 if (!config->PrivateKeyPEM)
723 return FALSE;
724 config->PrivateKeyPEMLength += 1;
725 }
726 tmp2 = pf_config_get_str(ini, section_certificates, key_private_key_content, FALSE);
727 if (tmp2)
728 {
729 if (strlen(tmp2) < 1)
730 {
731 WLog_ERR(TAG, "%s/%s has invalid empty value", section_certificates,
732 key_private_key_content);
733 return FALSE;
734 }
735 config->PrivateKeyContent = _strdup(tmp2);
736 config->PrivateKeyPEM = pf_config_decode_base64(
737 config->PrivateKeyContent, "PrivateKeyContent", &config->PrivateKeyPEMLength);
738 if (!config->PrivateKeyPEM)
739 return FALSE;
740 }
741
742 if (tmp1 && tmp2)
743 {
744 WLog_ERR(TAG,
745 "%s/%s and %s/%s are "
746 "mutually exclusive options",
747 section_certificates, key_private_key_file, section_certificates,
748 key_private_key_content);
749 return FALSE;
750 }
751 else if (!tmp1 && !tmp2)
752 {
753 WLog_ERR(TAG,
754 "%s/%s or %s/%s are "
755 "are required settings",
756 section_certificates, key_private_key_file, section_certificates,
757 key_private_key_content);
758 return FALSE;
759 }
760
761 return TRUE;
762}
763
764proxyConfig* server_config_load_ini(wIniFile* ini)
765{
766 proxyConfig* config = nullptr;
767
768 WINPR_ASSERT(ini);
769
770 config = calloc(1, sizeof(proxyConfig));
771 if (config)
772 {
773 /* Set default values != 0 */
774 config->TargetTlsSecLevel = 1;
775
776 /* Load from ini */
777 if (!pf_config_load_server(ini, config))
778 goto out;
779
780 if (!pf_config_load_target(ini, config))
781 goto out;
782
783 if (!pf_config_load_codecs(ini, config))
784 goto out;
785
786 if (!pf_config_load_channels(ini, config))
787 goto out;
788
789 if (!pf_config_load_input(ini, config))
790 goto out;
791
792 if (!pf_config_load_security(ini, config))
793 goto out;
794
795 if (!pf_config_load_modules(ini, config))
796 goto out;
797
798 if (!pf_config_load_certificates(ini, config))
799 goto out;
800 config->ini = IniFile_Clone(ini);
801 if (!config->ini)
802 goto out;
803 }
804 return config;
805out:
806 WINPR_PRAGMA_DIAG_PUSH
807 WINPR_PRAGMA_DIAG_IGNORED_MISMATCHED_DEALLOC
808 pf_server_config_free(config);
809 WINPR_PRAGMA_DIAG_POP
810
811 return nullptr;
812}
813
814BOOL pf_server_config_dump(const char* file)
815{
816 BOOL rc = FALSE;
817 wIniFile* ini = IniFile_New();
818 if (!ini)
819 return FALSE;
820
821 /* Proxy server configuration */
822 if (IniFile_SetKeyValueString(ini, section_server, key_host, "0.0.0.0") < 0)
823 goto fail;
824 if (IniFile_SetKeyValueInt(ini, section_server, key_port, 3389) < 0)
825 goto fail;
826 if (IniFile_SetKeyValueString(ini, section_server, key_sam_file,
827 "optional/path/some/file.sam") < 0)
828 goto fail;
829
830 /* Target configuration */
831 if (IniFile_SetKeyValueString(ini, section_target, key_host, "somehost.example.com") < 0)
832 goto fail;
833 if (IniFile_SetKeyValueInt(ini, section_target, key_port, 3389) < 0)
834 goto fail;
835 if (IniFile_SetKeyValueString(ini, section_target, key_target_fixed, bool_str_true) < 0)
836 goto fail;
837 if (IniFile_SetKeyValueInt(ini, section_target, key_target_tls_seclevel, 1) < 0)
838 goto fail;
839 if (IniFile_SetKeyValueString(ini, section_target, key_target_user, "optionaltargetuser") < 0)
840 goto fail;
841 if (IniFile_SetKeyValueString(ini, section_target, key_target_domain, "optionaltargetdomain") <
842 0)
843 goto fail;
844 if (IniFile_SetKeyValueString(ini, section_target, key_target_pwd, "optionaltargetpassword") <
845 0)
846 goto fail;
847 if (IniFile_SetKeyValueString(ini, section_target, key_target_scard_auth, bool_str_false) < 0)
848 goto fail;
849 if (IniFile_SetKeyValueString(ini, section_target, key_target_scard_cert,
850 "optional/path/some/file.pem.crt") < 0)
851 goto fail;
852 if (IniFile_SetKeyValueString(ini, section_target, key_target_scard_pem_cert,
853 "<base64 encoded PEM>") < 0)
854 goto fail;
855 if (IniFile_SetKeyValueString(ini, section_target, key_target_scard_key,
856 "optional/path/some/file.pem.key") < 0)
857 goto fail;
858
859 if (IniFile_SetKeyValueString(ini, section_target, key_target_scard_pem_key,
860 "<base64 encoded PEM>") < 0)
861 goto fail;
862 if (IniFile_SetKeyValueString(ini, section_target, key_target_cert_policy,
863 "[deny|allow|pinned]") < 0)
864 goto fail;
865 if (IniFile_SetKeyValueString(ini, section_target, key_target_cert_pem,
866 "optional/path/some/file.pem.crt") < 0)
867 goto fail;
868 if (IniFile_SetKeyValueString(ini, section_target, key_target_cert_pem_content,
869 "<base64 encoded PEM>") < 0)
870 goto fail;
871 if (IniFile_SetKeyValueString(ini, section_target, key_target_cert_hash,
872 "<hash type>:<hash hex string>") < 0)
873 goto fail;
874 if (IniFile_SetKeyValueString(ini, section_target, key_target_cert_store_path,
875 "optional/path/to/cert/store") < 0)
876 goto fail;
877 /* Codec configuration */
878 if (IniFile_SetKeyValueString(ini, section_codecs, key_codecs_rfx, bool_str_true) < 0)
879 goto fail;
880 if (IniFile_SetKeyValueString(ini, section_codecs, key_codecs_nsc, bool_str_true) < 0)
881 goto fail;
882
883 /* Channel configuration */
884 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_gfx, bool_str_true) < 0)
885 goto fail;
886 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_disp, bool_str_true) < 0)
887 goto fail;
888 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_clip, bool_str_true) < 0)
889 goto fail;
890 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_mic, bool_str_true) < 0)
891 goto fail;
892 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_sound, bool_str_true) < 0)
893 goto fail;
894 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_rdpdr, bool_str_true) < 0)
895 goto fail;
896 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_video, bool_str_true) < 0)
897 goto fail;
898 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_camera, bool_str_true) < 0)
899 goto fail;
900 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_rails, bool_str_false) < 0)
901 goto fail;
902
903 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_blacklist, bool_str_true) < 0)
904 goto fail;
905 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_pass, "") < 0)
906 goto fail;
907 if (IniFile_SetKeyValueString(ini, section_channels, key_channels_intercept, "") < 0)
908 goto fail;
909
910 /* Input configuration */
911 if (IniFile_SetKeyValueString(ini, section_input, key_input_kbd, bool_str_true) < 0)
912 goto fail;
913 if (IniFile_SetKeyValueString(ini, section_input, key_input_mouse, bool_str_true) < 0)
914 goto fail;
915 if (IniFile_SetKeyValueString(ini, section_input, key_input_multitouch, bool_str_true) < 0)
916 goto fail;
917
918 /* Security settings */
919 if (IniFile_SetKeyValueString(ini, section_security, key_security_server_tls, bool_str_true) <
920 0)
921 goto fail;
922 if (IniFile_SetKeyValueString(ini, section_security, key_security_server_nla, bool_str_false) <
923 0)
924 goto fail;
925 if (IniFile_SetKeyValueString(ini, section_security, key_security_server_ext, bool_str_false) <
926 0)
927 goto fail;
928 if (IniFile_SetKeyValueString(ini, section_security, key_security_server_rdp, bool_str_true) <
929 0)
930 goto fail;
931
932 if (IniFile_SetKeyValueString(ini, section_security, key_security_client_tls, bool_str_true) <
933 0)
934 goto fail;
935 if (IniFile_SetKeyValueString(ini, section_security, key_security_client_nla, bool_str_true) <
936 0)
937 goto fail;
938 if (IniFile_SetKeyValueString(ini, section_security, key_security_client_ext, bool_str_true) <
939 0)
940 goto fail;
941 if (IniFile_SetKeyValueString(ini, section_security, key_security_client_rdp, bool_str_true) <
942 0)
943 goto fail;
944 if (IniFile_SetKeyValueString(ini, section_security, key_security_client_fallback,
945 bool_str_true) < 0)
946 goto fail;
947
948 /* Module configuration */
949 if (IniFile_SetKeyValueString(ini, section_plugins, key_plugins_modules,
950 "module1,module2,...") < 0)
951 goto fail;
952 if (IniFile_SetKeyValueString(ini, section_plugins, key_plugins_required,
953 "module1,module2,...") < 0)
954 goto fail;
955
956 /* Certificate configuration */
957 if (IniFile_SetKeyValueString(ini, section_certificates, key_cert_file,
958 "<absolute path to some certificate file> OR") < 0)
959 goto fail;
960 if (IniFile_SetKeyValueString(ini, section_certificates, key_cert_content,
961 "<base64 encoded PEM>") < 0)
962 goto fail;
963
964 if (IniFile_SetKeyValueString(ini, section_certificates, key_private_key_file,
965 "<absolute path to some private key file> OR") < 0)
966 goto fail;
967 if (IniFile_SetKeyValueString(ini, section_certificates, key_private_key_content,
968 "<base64 encoded PEM>") < 0)
969 goto fail;
970
971 if ((strcmp("stdout", file) == 0) || (strcmp("stderr", file) == 0))
972 {
973 char* buffer = IniFile_WriteBuffer(ini);
974 if (!buffer)
975 goto fail;
976 FILE* fp = stderr;
977 if (strcmp("stdout", file) == 0)
978 fp = stdout;
979 (void)fprintf(fp, "%s", buffer);
980 winpr_zfree(buffer);
981 }
982 else
983 {
984 /* store configuration */
985 if (IniFile_WriteFile(ini, file) < 0)
986 goto fail;
987 }
988
989 rc = TRUE;
990
991fail:
992 IniFile_Free(ini);
993 return rc;
994}
995
996proxyConfig* pf_server_config_load_buffer(const char* buffer)
997{
998 proxyConfig* config = nullptr;
999 wIniFile* ini = nullptr;
1000
1001 ini = IniFile_New();
1002
1003 if (!ini)
1004 {
1005 WLog_ERR(TAG, "IniFile_New() failed!");
1006 return nullptr;
1007 }
1008
1009 if (IniFile_ReadBuffer(ini, buffer) < 0)
1010 {
1011 WLog_ERR(TAG, "failed to parse ini: '%s'", buffer);
1012 goto out;
1013 }
1014
1015 config = server_config_load_ini(ini);
1016out:
1017 IniFile_Free(ini);
1018 return config;
1019}
1020
1021proxyConfig* pf_server_config_load_file(const char* path)
1022{
1023 proxyConfig* config = nullptr;
1024 wIniFile* ini = IniFile_New();
1025
1026 if (!ini)
1027 {
1028 WLog_ERR(TAG, "IniFile_New() failed!");
1029 return nullptr;
1030 }
1031
1032 if (IniFile_ReadFile(ini, path) < 0)
1033 {
1034 WLog_ERR(TAG, "failed to parse ini file: '%s'", path);
1035 goto out;
1036 }
1037
1038 config = server_config_load_ini(ini);
1039out:
1040 IniFile_Free(ini);
1041 return config;
1042}
1043
1044static void pf_server_config_print_list(char** list, size_t count)
1045{
1046 WINPR_ASSERT(list);
1047 for (size_t i = 0; i < count; i++)
1048 WLog_INFO(TAG, "\t\t- %s", list[i]);
1049}
1050
1051void pf_server_config_print(const proxyConfig* config)
1052{
1053 WINPR_ASSERT(config);
1054 WLog_INFO(TAG, "Proxy configuration:");
1055
1056 CONFIG_PRINT_SECTION(section_server);
1057 CONFIG_PRINT_STR(config, Host);
1058 CONFIG_PRINT_STR(config, SamFile);
1059 CONFIG_PRINT_UINT16(config, Port);
1060
1061 if (config->FixedTarget)
1062 {
1063 CONFIG_PRINT_SECTION(section_target);
1064 CONFIG_PRINT_STR(config, TargetHost);
1065 CONFIG_PRINT_UINT16(config, TargetPort);
1066 CONFIG_PRINT_UINT32(config, TargetTlsSecLevel);
1067
1068 CONFIG_PRINT_STR(config, TargetUser);
1069 CONFIG_PRINT_STR(config, TargetDomain);
1070 CONFIG_PRINT_SECRET_STR(config, TargetPassword);
1071
1072 CONFIG_PRINT_BOOL(config, TargetSmartcardAuth);
1073 CONFIG_PRINT_SECRET_STR(config, TargetSmartcardCert);
1074 CONFIG_PRINT_SECRET_STR(config, TargetSmartcardKey);
1075
1076 WLog_INFO(TAG, "\t\t%s%s: %s", section_target, key_target_cert_policy,
1077 pf_config_policy_to_str(config->TargetCertPolicy));
1078 CONFIG_PRINT_SECRET_STR(config, TargetCertPEM);
1079 CONFIG_PRINT_SECRET_STR(config, TargetCertHash);
1080 }
1081
1082 CONFIG_PRINT_SECTION(section_input);
1083 CONFIG_PRINT_BOOL(config, Keyboard);
1084 CONFIG_PRINT_BOOL(config, Mouse);
1085 CONFIG_PRINT_BOOL(config, Multitouch);
1086
1087 CONFIG_PRINT_SECTION(section_security);
1088 CONFIG_PRINT_BOOL(config, ServerNlaSecurity);
1089 CONFIG_PRINT_BOOL(config, ServerExtSecurity);
1090 CONFIG_PRINT_BOOL(config, ServerTlsSecurity);
1091 CONFIG_PRINT_BOOL(config, ServerRdpSecurity);
1092 CONFIG_PRINT_BOOL(config, ClientNlaSecurity);
1093 CONFIG_PRINT_BOOL(config, ClientExtSecurity);
1094 CONFIG_PRINT_BOOL(config, ClientTlsSecurity);
1095 CONFIG_PRINT_BOOL(config, ClientRdpSecurity);
1096 CONFIG_PRINT_BOOL(config, ClientAllowFallbackToTls);
1097
1098 CONFIG_PRINT_SECTION(section_codecs);
1099 CONFIG_PRINT_BOOL(config, RFX);
1100 CONFIG_PRINT_BOOL(config, NSC);
1101
1102 CONFIG_PRINT_SECTION(section_channels);
1103 CONFIG_PRINT_BOOL(config, GFX);
1104 CONFIG_PRINT_BOOL(config, DisplayControl);
1105 CONFIG_PRINT_BOOL(config, Clipboard);
1106 CONFIG_PRINT_BOOL(config, AudioOutput);
1107 CONFIG_PRINT_BOOL(config, AudioInput);
1108 CONFIG_PRINT_BOOL(config, DeviceRedirection);
1109 CONFIG_PRINT_BOOL(config, VideoRedirection);
1110 CONFIG_PRINT_BOOL(config, CameraRedirection);
1111 CONFIG_PRINT_BOOL(config, RemoteApp);
1112 CONFIG_PRINT_BOOL(config, PassthroughIsBlacklist);
1113
1114 if (config->PassthroughCount)
1115 {
1116 WLog_INFO(TAG, "\tStatic Channels Proxy:");
1117 pf_server_config_print_list(config->Passthrough, config->PassthroughCount);
1118 }
1119
1120 if (config->InterceptCount)
1121 {
1122 WLog_INFO(TAG, "\tStatic Channels Proxy-Intercept:");
1123 pf_server_config_print_list(config->Intercept, config->InterceptCount);
1124 }
1125
1126 /* modules */
1127 CONFIG_PRINT_SECTION_KEY(section_plugins, key_plugins_modules);
1128 for (size_t x = 0; x < config->ModulesCount; x++)
1129 CONFIG_PRINT_STR(config, Modules[x]);
1130
1131 /* Required plugins */
1132 CONFIG_PRINT_SECTION_KEY(section_plugins, key_plugins_required);
1133 for (size_t x = 0; x < config->RequiredPluginsCount; x++)
1134 CONFIG_PRINT_STR(config, RequiredPlugins[x]);
1135
1136 CONFIG_PRINT_SECTION(section_certificates);
1137 CONFIG_PRINT_STR(config, CertificateFile);
1138 CONFIG_PRINT_SECRET_STR(config, CertificateContent);
1139 CONFIG_PRINT_STR(config, PrivateKeyFile);
1140 CONFIG_PRINT_SECRET_STR(config, PrivateKeyContent);
1141}
1142
1143void pf_server_config_free(proxyConfig* config)
1144{
1145 if (config == nullptr)
1146 return;
1147
1148 winpr_zfree(config->Host);
1149 winpr_zfree(config->SamFile);
1150 winpr_zfree(config->TargetHost);
1151 winpr_zfree(config->TargetUser);
1152 winpr_zfree(config->TargetDomain);
1153 winpr_zfree(config->TargetPassword);
1154 winpr_znfree(config->TargetSmartcardCert, config->TargetSmartcardCertLength);
1155 winpr_znfree(config->TargetSmartcardKey, config->TargetSmartcardKeyLength);
1156 winpr_zfree(config->TargetCertHash);
1157 winpr_znfree(config->TargetCertPEM, config->TargetCertPEMLength);
1158
1159 CommandLineParserFree(config->Passthrough);
1160 CommandLineParserFree(config->Intercept);
1161 CommandLineParserFree(config->Modules);
1162 CommandLineParserFree(config->RequiredPlugins);
1163
1164 winpr_zfree(config->CertificateFile);
1165 winpr_zfree(config->CertificateContent);
1166 winpr_znfree(config->CertificatePEM, config->CertificatePEMLength);
1167 winpr_zfree(config->PrivateKeyFile);
1168 winpr_zfree(config->PrivateKeyContent);
1169 winpr_znfree(config->PrivateKeyPEM, config->PrivateKeyPEMLength);
1170 IniFile_Free(config->ini);
1171 free(config);
1172}
1173
1174size_t pf_config_required_plugins_count(const proxyConfig* config)
1175{
1176 WINPR_ASSERT(config);
1177 return config->RequiredPluginsCount;
1178}
1179
1180const char* pf_config_required_plugin(const proxyConfig* config, size_t index)
1181{
1182 WINPR_ASSERT(config);
1183 if (index >= config->RequiredPluginsCount)
1184 return nullptr;
1185
1186 return config->RequiredPlugins[index];
1187}
1188
1189size_t pf_config_modules_count(const proxyConfig* config)
1190{
1191 WINPR_ASSERT(config);
1192 return config->ModulesCount;
1193}
1194
1195const char** pf_config_modules(const proxyConfig* config)
1196{
1197 union
1198 {
1199 char** ppc;
1200 const char** cppc;
1201 } cnv;
1202
1203 WINPR_ASSERT(config);
1204
1205 cnv.ppc = config->Modules;
1206 return cnv.cppc;
1207}
1208
1209WINPR_ATTR_NODISCARD
1210static BOOL pf_config_copy_string_n(char** dst, const char* src, size_t size)
1211{
1212 *dst = nullptr;
1213
1214 if (src && (size > 0))
1215 {
1216 WINPR_ASSERT(strnlen(src, size) == size - 1);
1217 *dst = calloc(size, sizeof(char));
1218 if (!*dst)
1219 return FALSE;
1220 memcpy(*dst, src, size);
1221 }
1222
1223 return TRUE;
1224}
1225
1226WINPR_ATTR_NODISCARD
1227static BOOL pf_config_copy_string_list(char*** dst, size_t* size, char** src, size_t srcSize)
1228{
1229 WINPR_ASSERT(dst);
1230 WINPR_ASSERT(size);
1231 WINPR_ASSERT(src || (srcSize == 0));
1232
1233 *dst = nullptr;
1234 *size = 0;
1235 if (srcSize > INT32_MAX)
1236 return FALSE;
1237
1238 if (srcSize != 0)
1239 {
1240 char* csv = CommandLineToCommaSeparatedValues((INT32)srcSize, src);
1241 *dst = CommandLineParseCommaSeparatedValues(csv, size);
1242 winpr_zfree(csv);
1243 }
1244
1245 return TRUE;
1246}
1247
1248BOOL pf_config_clone(proxyConfig** dst, const proxyConfig* config)
1249{
1250 proxyConfig* tmp = calloc(1, sizeof(proxyConfig));
1251
1252 WINPR_ASSERT(dst);
1253 WINPR_ASSERT(config);
1254
1255 if (!tmp)
1256 return FALSE;
1257
1258 *tmp = *config;
1259
1260 if (!pf_config_copy_string(&tmp->Host, config->Host))
1261 goto fail;
1262 if (!pf_config_copy_string(&tmp->SamFile, config->SamFile))
1263 goto fail;
1264 if (!pf_config_copy_string(&tmp->TargetHost, config->TargetHost))
1265 goto fail;
1266 if (!pf_config_copy_string(&tmp->TargetUser, config->TargetUser))
1267 goto fail;
1268 if (!pf_config_copy_string(&tmp->TargetDomain, config->TargetDomain))
1269 goto fail;
1270 if (!pf_config_copy_string(&tmp->TargetPassword, config->TargetPassword))
1271 goto fail;
1272 if (!pf_config_copy_string_n(&tmp->TargetSmartcardCert, config->TargetSmartcardCert,
1273 config->TargetSmartcardCertLength))
1274 goto fail;
1275 if (!pf_config_copy_string_n(&tmp->TargetSmartcardKey, config->TargetSmartcardKey,
1276 config->TargetSmartcardKeyLength))
1277 goto fail;
1278 if (!pf_config_copy_string_list(&tmp->Passthrough, &tmp->PassthroughCount, config->Passthrough,
1279 config->PassthroughCount))
1280 goto fail;
1281 if (!pf_config_copy_string_list(&tmp->Intercept, &tmp->InterceptCount, config->Intercept,
1282 config->InterceptCount))
1283 goto fail;
1284 if (!pf_config_copy_string_list(&tmp->Modules, &tmp->ModulesCount, config->Modules,
1285 config->ModulesCount))
1286 goto fail;
1287 if (!pf_config_copy_string_list(&tmp->RequiredPlugins, &tmp->RequiredPluginsCount,
1288 config->RequiredPlugins, config->RequiredPluginsCount))
1289 goto fail;
1290 if (!pf_config_copy_string(&tmp->CertificateFile, config->CertificateFile))
1291 goto fail;
1292 if (!pf_config_copy_string(&tmp->CertificateContent, config->CertificateContent))
1293 goto fail;
1294 if (!pf_config_copy_string_n(&tmp->CertificatePEM, config->CertificatePEM,
1295 config->CertificatePEMLength))
1296 goto fail;
1297 if (!pf_config_copy_string(&tmp->PrivateKeyFile, config->PrivateKeyFile))
1298 goto fail;
1299 if (!pf_config_copy_string(&tmp->PrivateKeyContent, config->PrivateKeyContent))
1300 goto fail;
1301 if (!pf_config_copy_string_n(&tmp->PrivateKeyPEM, config->PrivateKeyPEM,
1302 config->PrivateKeyPEMLength))
1303 goto fail;
1304 if (!pf_config_copy_string(&tmp->TargetCertPEM, config->TargetCertPEM))
1305 goto fail;
1306 if (!pf_config_copy_string(&tmp->TargetCertHash, config->TargetCertHash))
1307 goto fail;
1308 tmp->ini = IniFile_Clone(config->ini);
1309 if (!tmp->ini)
1310 goto fail;
1311
1312 *dst = tmp;
1313 return TRUE;
1314
1315fail:
1316 WINPR_PRAGMA_DIAG_PUSH
1317 WINPR_PRAGMA_DIAG_IGNORED_MISMATCHED_DEALLOC
1318 pf_server_config_free(tmp);
1319 WINPR_PRAGMA_DIAG_POP
1320 return FALSE;
1321}
1322
1323struct config_plugin_data
1324{
1325 proxyPluginsManager* mgr;
1326 const proxyConfig* config;
1327};
1328
1329static const char config_plugin_name[] = "config";
1330static const char config_plugin_desc[] =
1331 "A plugin filtering according to proxy configuration file rules";
1332
1333WINPR_ATTR_NODISCARD
1334static BOOL config_plugin_unload(proxyPlugin* plugin)
1335{
1336 WINPR_ASSERT(plugin);
1337
1338 /* Here we have to free up our custom data storage. */
1339 if (plugin)
1340 {
1341 free(plugin->custom);
1342 plugin->custom = nullptr;
1343 }
1344
1345 return TRUE;
1346}
1347
1348WINPR_ATTR_NODISCARD
1349static BOOL config_plugin_keyboard_event(proxyPlugin* plugin, WINPR_ATTR_UNUSED proxyData* pdata,
1350 void* param)
1351{
1352 BOOL rc = 0;
1353 const struct config_plugin_data* custom = nullptr;
1354 const proxyConfig* cfg = nullptr;
1355 const proxyKeyboardEventInfo* event_data = (const proxyKeyboardEventInfo*)(param);
1356
1357 WINPR_ASSERT(plugin);
1358 WINPR_ASSERT(pdata);
1359 WINPR_ASSERT(event_data);
1360
1361 WINPR_UNUSED(event_data);
1362
1363 custom = plugin->custom;
1364 WINPR_ASSERT(custom);
1365
1366 cfg = custom->config;
1367 WINPR_ASSERT(cfg);
1368
1369 rc = cfg->Keyboard;
1370 WLog_DBG(TAG, "%s", boolstr(rc));
1371 return rc;
1372}
1373
1374WINPR_ATTR_NODISCARD
1375static BOOL config_plugin_unicode_event(proxyPlugin* plugin, WINPR_ATTR_UNUSED proxyData* pdata,
1376 void* param)
1377{
1378 BOOL rc = 0;
1379 const struct config_plugin_data* custom = nullptr;
1380 const proxyConfig* cfg = nullptr;
1381 const proxyUnicodeEventInfo* event_data = (const proxyUnicodeEventInfo*)(param);
1382
1383 WINPR_ASSERT(plugin);
1384 WINPR_ASSERT(pdata);
1385 WINPR_ASSERT(event_data);
1386
1387 WINPR_UNUSED(event_data);
1388
1389 custom = plugin->custom;
1390 WINPR_ASSERT(custom);
1391
1392 cfg = custom->config;
1393 WINPR_ASSERT(cfg);
1394
1395 rc = cfg->Keyboard;
1396 WLog_DBG(TAG, "%s", boolstr(rc));
1397 return rc;
1398}
1399
1400WINPR_ATTR_NODISCARD
1401static BOOL config_plugin_mouse_event(proxyPlugin* plugin, WINPR_ATTR_UNUSED proxyData* pdata,
1402 void* param)
1403{
1404 BOOL rc = 0;
1405 const struct config_plugin_data* custom = nullptr;
1406 const proxyConfig* cfg = nullptr;
1407 const proxyMouseEventInfo* event_data = (const proxyMouseEventInfo*)(param);
1408
1409 WINPR_ASSERT(plugin);
1410 WINPR_ASSERT(pdata);
1411 WINPR_ASSERT(event_data);
1412
1413 WINPR_UNUSED(event_data);
1414
1415 custom = plugin->custom;
1416 WINPR_ASSERT(custom);
1417
1418 cfg = custom->config;
1419 WINPR_ASSERT(cfg);
1420
1421 rc = cfg->Mouse;
1422 return rc;
1423}
1424
1425WINPR_ATTR_NODISCARD
1426static BOOL config_plugin_mouse_ex_event(proxyPlugin* plugin, WINPR_ATTR_UNUSED proxyData* pdata,
1427 void* param)
1428{
1429 BOOL rc = 0;
1430 const struct config_plugin_data* custom = nullptr;
1431 const proxyConfig* cfg = nullptr;
1432 const proxyMouseExEventInfo* event_data = (const proxyMouseExEventInfo*)(param);
1433
1434 WINPR_ASSERT(plugin);
1435 WINPR_ASSERT(pdata);
1436 WINPR_ASSERT(event_data);
1437
1438 WINPR_UNUSED(event_data);
1439
1440 custom = plugin->custom;
1441 WINPR_ASSERT(custom);
1442
1443 cfg = custom->config;
1444 WINPR_ASSERT(cfg);
1445
1446 rc = cfg->Mouse;
1447 return rc;
1448}
1449
1450WINPR_ATTR_NODISCARD
1451static BOOL config_plugin_client_channel_data(WINPR_ATTR_UNUSED proxyPlugin* plugin,
1452 WINPR_ATTR_UNUSED proxyData* pdata, void* param)
1453{
1454 const proxyChannelDataEventInfo* channel = (const proxyChannelDataEventInfo*)(param);
1455
1456 WINPR_ASSERT(plugin);
1457 WINPR_ASSERT(pdata);
1458 WINPR_ASSERT(channel);
1459
1460 WLog_DBG(TAG, "%s [0x%04" PRIx16 "] got %" PRIuz, channel->channel_name, channel->channel_id,
1461 channel->data_len);
1462 return TRUE;
1463}
1464
1465WINPR_ATTR_NODISCARD
1466static BOOL config_plugin_server_channel_data(WINPR_ATTR_UNUSED proxyPlugin* plugin,
1467 WINPR_ATTR_UNUSED proxyData* pdata, void* param)
1468{
1469 const proxyChannelDataEventInfo* channel = (const proxyChannelDataEventInfo*)(param);
1470
1471 WINPR_ASSERT(plugin);
1472 WINPR_ASSERT(pdata);
1473 WINPR_ASSERT(channel);
1474
1475 WLog_DBG(TAG, "%s [0x%04" PRIx16 "] got %" PRIuz, channel->channel_name, channel->channel_id,
1476 channel->data_len);
1477 return TRUE;
1478}
1479
1480WINPR_ATTR_NODISCARD
1481static BOOL config_plugin_dynamic_channel_create(proxyPlugin* plugin,
1482 WINPR_ATTR_UNUSED proxyData* pdata, void* param)
1483{
1484 BOOL accept = 0;
1485 const proxyChannelDataEventInfo* channel = (const proxyChannelDataEventInfo*)(param);
1486
1487 WINPR_ASSERT(plugin);
1488 WINPR_ASSERT(pdata);
1489 WINPR_ASSERT(channel);
1490
1491 const struct config_plugin_data* custom = plugin->custom;
1492 WINPR_ASSERT(custom);
1493
1494 const proxyConfig* cfg = custom->config;
1495 WINPR_ASSERT(cfg);
1496
1497 pf_utils_channel_mode rc = pf_utils_get_channel_mode(cfg, channel->channel_name);
1498 switch (rc)
1499 {
1500
1501 case PF_UTILS_CHANNEL_INTERCEPT:
1502 case PF_UTILS_CHANNEL_PASSTHROUGH:
1503 accept = TRUE;
1504 break;
1505 case PF_UTILS_CHANNEL_BLOCK:
1506 default:
1507 accept = FALSE;
1508 break;
1509 }
1510
1511 if (accept)
1512 {
1513 if (strncmp(RDPGFX_DVC_CHANNEL_NAME, channel->channel_name,
1514 sizeof(RDPGFX_DVC_CHANNEL_NAME)) == 0)
1515 accept = cfg->GFX;
1516 else if (strncmp(RDPSND_DVC_CHANNEL_NAME, channel->channel_name,
1517 sizeof(RDPSND_DVC_CHANNEL_NAME)) == 0)
1518 accept = cfg->AudioOutput;
1519 else if (strncmp(RDPSND_LOSSY_DVC_CHANNEL_NAME, channel->channel_name,
1520 sizeof(RDPSND_LOSSY_DVC_CHANNEL_NAME)) == 0)
1521 accept = cfg->AudioOutput;
1522 else if (strncmp(AUDIN_DVC_CHANNEL_NAME, channel->channel_name,
1523 sizeof(AUDIN_DVC_CHANNEL_NAME)) == 0)
1524 accept = cfg->AudioInput;
1525 else if (strncmp(RDPEI_DVC_CHANNEL_NAME, channel->channel_name,
1526 sizeof(RDPEI_DVC_CHANNEL_NAME)) == 0)
1527 accept = cfg->Multitouch;
1528 else if (strncmp(TSMF_DVC_CHANNEL_NAME, channel->channel_name,
1529 sizeof(TSMF_DVC_CHANNEL_NAME)) == 0)
1530 accept = cfg->VideoRedirection;
1531 else if (strncmp(VIDEO_CONTROL_DVC_CHANNEL_NAME, channel->channel_name,
1532 sizeof(VIDEO_CONTROL_DVC_CHANNEL_NAME)) == 0)
1533 accept = cfg->VideoRedirection;
1534 else if (strncmp(VIDEO_DATA_DVC_CHANNEL_NAME, channel->channel_name,
1535 sizeof(VIDEO_DATA_DVC_CHANNEL_NAME)) == 0)
1536 accept = cfg->VideoRedirection;
1537 else if (strncmp(RDPECAM_DVC_CHANNEL_NAME, channel->channel_name,
1538 sizeof(RDPECAM_DVC_CHANNEL_NAME)) == 0)
1539 accept = cfg->CameraRedirection;
1540 }
1541
1542 WLog_DBG(TAG, "%s [0x%04" PRIx16 "]: %s", channel->channel_name, channel->channel_id,
1543 boolstr(accept));
1544 return accept;
1545}
1546
1547WINPR_ATTR_NODISCARD
1548static BOOL config_plugin_channel_create(proxyPlugin* plugin, WINPR_ATTR_UNUSED proxyData* pdata,
1549 void* param)
1550{
1551 BOOL accept = 0;
1552 const proxyChannelDataEventInfo* channel = (const proxyChannelDataEventInfo*)(param);
1553
1554 WINPR_ASSERT(plugin);
1555 WINPR_ASSERT(pdata);
1556 WINPR_ASSERT(channel);
1557
1558 const struct config_plugin_data* custom = plugin->custom;
1559 WINPR_ASSERT(custom);
1560
1561 const proxyConfig* cfg = custom->config;
1562 WINPR_ASSERT(cfg);
1563
1564 pf_utils_channel_mode rc = pf_utils_get_channel_mode(cfg, channel->channel_name);
1565 switch (rc)
1566 {
1567 case PF_UTILS_CHANNEL_INTERCEPT:
1568 case PF_UTILS_CHANNEL_PASSTHROUGH:
1569 accept = TRUE;
1570 break;
1571 case PF_UTILS_CHANNEL_BLOCK:
1572 default:
1573 accept = FALSE;
1574 break;
1575 }
1576 if (accept)
1577 {
1578 if (strncmp(CLIPRDR_SVC_CHANNEL_NAME, channel->channel_name,
1579 sizeof(CLIPRDR_SVC_CHANNEL_NAME)) == 0)
1580 accept = cfg->Clipboard;
1581 else if (strncmp(RDPSND_CHANNEL_NAME, channel->channel_name, sizeof(RDPSND_CHANNEL_NAME)) ==
1582 0)
1583 accept = cfg->AudioOutput;
1584 else if (strncmp(RDPDR_SVC_CHANNEL_NAME, channel->channel_name,
1585 sizeof(RDPDR_SVC_CHANNEL_NAME)) == 0)
1586 accept = cfg->DeviceRedirection;
1587 else if (strncmp(DISP_DVC_CHANNEL_NAME, channel->channel_name,
1588 sizeof(DISP_DVC_CHANNEL_NAME)) == 0)
1589 accept = cfg->DisplayControl;
1590 else if (strncmp(RAIL_SVC_CHANNEL_NAME, channel->channel_name,
1591 sizeof(RAIL_SVC_CHANNEL_NAME)) == 0)
1592 accept = cfg->RemoteApp;
1593 }
1594
1595 WLog_DBG(TAG, "%s [static]: %s", channel->channel_name, boolstr(accept));
1596 return accept;
1597}
1598
1599BOOL pf_config_plugin(proxyPluginsManager* plugins_manager, void* userdata)
1600{
1601 struct config_plugin_data* custom = nullptr;
1602 proxyPlugin plugin = WINPR_C_ARRAY_INIT;
1603
1604 plugin.name = config_plugin_name;
1605 plugin.description = config_plugin_desc;
1606 plugin.PluginUnload = config_plugin_unload;
1607
1608 plugin.KeyboardEvent = config_plugin_keyboard_event;
1609 plugin.UnicodeEvent = config_plugin_unicode_event;
1610 plugin.MouseEvent = config_plugin_mouse_event;
1611 plugin.MouseExEvent = config_plugin_mouse_ex_event;
1612 plugin.ClientChannelData = config_plugin_client_channel_data;
1613 plugin.ServerChannelData = config_plugin_server_channel_data;
1614 plugin.ChannelCreate = config_plugin_channel_create;
1615 plugin.DynamicChannelCreate = config_plugin_dynamic_channel_create;
1616 plugin.userdata = userdata;
1617
1618 custom = calloc(1, sizeof(struct config_plugin_data));
1619 if (!custom)
1620 return FALSE;
1621
1622 custom->mgr = plugins_manager;
1623 custom->config = userdata;
1624
1625 plugin.custom = custom;
1626 plugin.userdata = userdata;
1627
1628 return plugins_manager->RegisterPlugin(plugins_manager, &plugin);
1629}
1630
1631const char* pf_config_get(const proxyConfig* config, const char* section, const char* key)
1632{
1633 WINPR_ASSERT(config);
1634 WINPR_ASSERT(config->ini);
1635 WINPR_ASSERT(section);
1636 WINPR_ASSERT(key);
1637
1638 return IniFile_GetKeyValueString(config->ini, section, key);
1639}
1640
1641const char* pf_config_policy_to_str(FreeRDP_ProxyCertPolicy policy)
1642{
1643 switch (policy)
1644 {
1645 case FREERDP_PROXY_CERT_POLICY_ALLOW:
1646 return "allow";
1647 case FREERDP_PROXY_CERT_POLICY_PINNED:
1648 return "pinned";
1649 case FREERDP_PROXY_CERT_POLICY_VERIFIED:
1650 return "verified";
1651 case FREERDP_PROXY_CERT_POLICY_VERIFIED_HOST_MATCH:
1652 return "verified-with-host-match";
1653 case FREERDP_PROXY_CERT_POLICY_DENY:
1654 default:
1655 return "deny";
1656 }
1657}
1658
1659FreeRDP_ProxyCertPolicy pf_config_policy_from_str(const char* val)
1660{
1661 if (!val)
1662 return FREERDP_PROXY_CERT_POLICY_DENY;
1663 if (_stricmp(val, "allow") == 0)
1664 return FREERDP_PROXY_CERT_POLICY_ALLOW;
1665 if (_stricmp(val, "pinned") == 0)
1666 return FREERDP_PROXY_CERT_POLICY_PINNED;
1667 if (_stricmp(val, "verified-with-host-match") == 0)
1668 return FREERDP_PROXY_CERT_POLICY_VERIFIED_HOST_MATCH;
1669 if (_stricmp(val, "verified") == 0)
1670 return FREERDP_PROXY_CERT_POLICY_VERIFIED;
1671 return FREERDP_PROXY_CERT_POLICY_DENY;
1672}
pf_server_config_load_buffer
proxyConfig * pf_server_config_load_buffer(const char *buffer)
pf_server_config_load_buffer Create a proxyConfig from a memory string buffer in INI file format
Definition pf_config.c:996
pf_server_config_free
void pf_server_config_free(proxyConfig *config)
pf_server_config_free Releases all resources associated with proxyConfig
Definition pf_config.c:1143
pf_server_config_print
void pf_server_config_print(const proxyConfig *config)
pf_server_config_print Print the configuration to stdout
Definition pf_config.c:1051
pf_config_modules
const char ** pf_config_modules(const proxyConfig *config)
pf_config_modules
Definition pf_config.c:1195
pf_config_required_plugin
const char * pf_config_required_plugin(const proxyConfig *config, size_t index)
pf_config_required_plugin
Definition pf_config.c:1180
pf_config_policy_from_str
FreeRDP_ProxyCertPolicy pf_config_policy_from_str(const char *val)
Convert a string to a FreeRDP_ProxyCertPolicy value.
Definition pf_config.c:1659
pf_config_modules_count
size_t pf_config_modules_count(const proxyConfig *config)
pf_config_modules_count
Definition pf_config.c:1189
pf_config_policy_to_str
const char * pf_config_policy_to_str(FreeRDP_ProxyCertPolicy policy)
Convert a FreeRDP_ProxyCertPolicy value to a string.
Definition pf_config.c:1641
pf_config_clone
BOOL pf_config_clone(proxyConfig **dst, const proxyConfig *config)
pf_config_clone Create a copy of the configuration
Definition pf_config.c:1248
pf_config_required_plugins_count
size_t pf_config_required_plugins_count(const proxyConfig *config)
pf_config_required_plugins_count
Definition pf_config.c:1174
server_config_load_ini
proxyConfig * server_config_load_ini(wIniFile *ini)
server_config_load_ini Create a proxyConfig from a already loaded INI file.
Definition pf_config.c:764
pf_server_config_load_file
proxyConfig * pf_server_config_load_file(const char *path)
pf_server_config_load_file Create a proxyConfig from a INI file found at path.
Definition pf_config.c:1021
pf_server_config_dump
BOOL pf_server_config_dump(const char *file)
pf_server_config_dump Dumps a default INI configuration file
Definition pf_config.c:814
pf_config_plugin
BOOL pf_config_plugin(proxyPluginsManager *plugins_manager, void *userdata)
pf_config_plugin Register a proxy plugin handling event filtering defined in the configuration.
Definition pf_config.c:1599
pf_config_get
const char * pf_config_get(const proxyConfig *config, const char *section, const char *key)
pf_config_get get a value for a section/key
Definition pf_config.c:1631