tabby-rdp 0.5.0 → 0.5.2

package/dist/rdcleanpath.js

@@ -1,9 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.FLOW_WINDOW = void 0;
 exports.normalizeFingerprint = normalizeFingerprint;
 exports.preconnectionPdu = preconnectionPdu;
 exports.offersNla = offersNla;
+exports.earlyUserAuthorization = earlyUserAuthorization;
+exports.withoutUserCookie = withoutUserCookie;
 exports.serverFraming = serverFraming;
+exports.signsNothing = signsNothing;
+exports.withoutToken = withoutToken;
 exports.startRDCleanPathProxy = startRDCleanPathProxy;
 // RDCleanPath proxy for the IronRDP web client, running inside Tabby's renderer.
 // The WASM client talks WebSocket to this proxy; the proxy opens the upstream stream
@@ -11,6 +16,9 @@ exports.startRDCleanPathProxy = startRDCleanPathProxy;
 // terminates TLS, checks the server's certificate, hands the cert chain back to the client (for CredSSP), then relays.
 const tls = require("tls");
 const crypto_1 = require("crypto");
+const net_1 = require("net");
+const authorities_1 = require("./authorities");
+const byteQueue_1 = require("./byteQueue");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const { WebSocketServer } = require('ws');
 const VERSION_1 = 3390;
@@ -23,6 +31,16 @@ function normalizeFingerprint(value) {
 function fingerprintOf(der) {
     return normalizeFingerprint((0, crypto_1.createHash)('sha256').update(der).digest('hex'));
 }
+/**
+ * What answers to the remote's requests may have taken of the window's memory, read for it or handed to the connection,
+ * beyond what the proxy has read from the connection (see ServerFlow): four of the largest parts of files a request
+ * gets. A link stays busy with far less, as the proxy lets no more than HIGH_WATER wait for the server.
+ */
+exports.FLOW_WINDOW = 64 * 1024 * 1024;
+/** The answer to a server without Network Level Authentication where nobody decides otherwise: refused. */
+function refuseWithoutNla() {
+    throw new Error('the server doesn\'t use Network Level Authentication');
+}
 // ---- minimal DER -------------------------------------------------------------------------------
 function derLength(n) {
     if (n < 0x80) {
@@ -128,7 +146,7 @@ function encodeError() {
 // Reads exactly one TPKT-framed PDU (the X.224 Connection Confirm) without consuming TLS bytes.
 function readTpkt(stream) {
     return new Promise((resolve, reject) => {
-        let acc = Buffer.alloc(0);
+        const acc = new byteQueue_1.ByteQueue();
         const cleanup = () => {
             stream.off('data', onData);
             stream.off('error', onError);
@@ -138,20 +156,30 @@ function readTpkt(stream) {
         const onError = (e) => { cleanup(); reject(e); };
         const onClose = () => { cleanup(); reject(new Error('upstream closed during X.224')); };
         const onData = (chunk) => {
-            acc = Buffer.concat([acc, chunk]);
+            acc.push(chunk);
             if (acc.length < 4) {
                 return;
             }
-            const len = acc.readUInt16BE(2);
+            const header = acc.peek(4);
+            const len = header.readUInt16BE(2);
+            // TPKT is version 3, and an X.224 TPDU takes three bytes at least: anything else is not an RDP server
+            // answering (a web server on that port, say), and isn't waited on for the length it seems to give.
+            if (header[0] !== 3 || len < 7) {
+                cleanup();
+                reject(new Error('the server\'s answer isn\'t RDP (is that the desktop\'s port?)'));
+                return;
+            }
             if (acc.length < len) {
                 return;
             }
             stream.pause();
             cleanup();
-            if (acc.length > len) {
-                stream.unshift(acc.subarray(len));
+            // A copy: it is kept for the connection, and is a few bytes of the queue's storage.
+            const pdu = Buffer.from(acc.take(len));
+            if (acc.length) {
+                stream.unshift(acc.take(acc.length));
             }
-            resolve(acc.subarray(0, len));
+            resolve(pdu);
         };
         stream.on('data', onData);
         stream.on('error', onError);
@@ -171,11 +199,17 @@ function certChainOf(socket) {
     }
     return chain;
 }
+/** selectedProtocol's flags in the server's negotiation response (RDP_NEG_RSP). */
+const PROTOCOL_HYBRID = 0x02;
+const PROTOCOL_HYBRID_EX = 0x08;
 /**
- * The server's answer to the client's security negotiation, when it rules out TLS (which IronRDP and RDCleanPath
- * need): a server with RDP's standard security only (xrdp with security_layer=rdp, for example) answers without a
- * negotiation response, or with PROTOCOL_RDP, or refuses the negotiation. Null when TLS can go ahead.
+ * The security protocol the server chose (RDP_NEG_RSP's selectedProtocol), or 0 when its answer to the connection
+ * request has no negotiation response. Tested by its flags, as IronRDP does, so that the proxy and the client never
+ * read the same answer differently.
  */
+function selectedProtocol(x224) {
+    return x224.length >= 19 && x224[11] === 0x02 ? x224.readUInt32LE(15) : 0;
+}
 /**
  * Whether the server's answer to the connection request chose Network Level Authentication (CredSSP: HYBRID or
  * HYBRID_EX). With it, the sign-in is a proof both ways and the password only goes to a server that knows it already.
@@ -183,8 +217,49 @@ function certChainOf(socket) {
  * way, readable to whatever answered.
  */
 function offersNla(x224) {
-    return x224.length >= 19 && x224[11] === 0x02 && (x224.readUInt32LE(15) & (2 | 8)) !== 0;
+    return (selectedProtocol(x224) & (PROTOCOL_HYBRID | PROTOCOL_HYBRID_EX)) !== 0;
+}
+/**
+ * Whether an Early User Authorization Result follows CredSSP: the server chose HYBRID_EX (see serverFraming). IronRDP
+ * expects one whenever that flag is set, alone or not.
+ */
+function earlyUserAuthorization(x224) {
+    return (selectedProtocol(x224) & PROTOCOL_HYBRID_EX) !== 0;
 }
+/** The routing cookie that names the user (see withoutUserCookie). */
+const COOKIE = Buffer.from('Cookie: mstshash=');
+/**
+ * The client's X.224 connection request without its routing cookie, `Cookie: mstshash=<user name>`, which IronRDP fills
+ * in with the user name. It goes before TLS, in the clear, and before the certificate check and the stop at a server
+ * without Network Level Authentication: the account's name would reach whoever watches the way there, and servers the
+ * proxy then refuses. The cookie is optional, and what it is for, routing by user name in a load balancer in front of
+ * several servers, the plugin doesn't take part in (it sends no load-balancing info either). A request that isn't a
+ * connection request with such a cookie comes back as it is; so does a broker's routing token (`Cookie: msts=`), which
+ * names no user. The proxy sends none that still has the cookie (see handshake).
+ */
+function withoutUserCookie(request) {
+    // TPKT (4: version 3, 0, length), then X.224: length indicator (the rest of the header), the CR code, DST-REF,
+    // SRC-REF and class (6), then the cookie, the negotiation request and the rest.
+    const li = request[4];
+    if (request.length < 11 + COOKIE.length || request[0] !== 3 || request.readUInt16BE(2) !== request.length ||
+        (request[5] & 0xf0) !== 0xe0 || 5 + li !== request.length || !request.subarray(11, 11 + COOKIE.length).equals(COOKIE)) {
+        return request;
+    }
+    const end = request.indexOf('\r\n', 11 + COOKIE.length);
+    if (end < 0) {
+        return request;
+    }
+    const cut = end + 2 - 11;
+    const out = Buffer.concat([request.subarray(0, 11), request.subarray(end + 2)]);
+    out.writeUInt16BE(request.length - cut, 2);
+    out[4] = li - cut;
+    return out;
+}
+/**
+ * The server's answer to the client's security negotiation, when it rules out TLS (which IronRDP and RDCleanPath
+ * need): a server with RDP's standard security only (xrdp with security_layer=rdp, for example) answers without a
+ * negotiation response, or with PROTOCOL_RDP, or refuses the negotiation. Null when TLS can go ahead.
+ */
 function noTls(x224) {
     // TPKT (4), X.224 Connection Confirm (7), then RDP_NEG_RSP or RDP_NEG_FAILURE (8): type, flags, length, value.
     const standardOnly = 'the RDP server only offers standard RDP security, without TLS (for xrdp: set security_layer=negotiate in /etc/xrdp/xrdp.ini and restart xrdp)';
@@ -268,9 +343,11 @@ function autologon() {
  * function from server data to the PDUs it completes; it throws on data that is none of these.
  */
 function serverFraming(earlyAuth) {
-    const MAX_DER = 16 * 1024 * 1024;
+    // A server's CredSSP messages are small: its NTLM challenge or Kerberos reply, and its proof of the public key, a
+    // few kilobytes at most. A larger claim is no server's: it would only have Tabby keep whatever comes, and wait.
+    const MAX_DER = 256 * 1024;
     let rdp = false;
-    let pending = Buffer.alloc(0);
+    const pending = new byteQueue_1.ByteQueue();
     const invalid = () => new Error('invalid RDP server frame');
     /** The length of the PDU at the start of `b`, 0 while its header is incomplete. */
     const lengthOf = (b) => {
@@ -329,24 +406,23 @@ function serverFraming(earlyAuth) {
         throw invalid();
     };
     return data => {
-        pending = pending.length ? Buffer.concat([pending, data]) : data;
+        pending.push(data);
         const out = [];
         for (;;) {
-            const length = lengthOf(pending);
+            // Six bytes hold any of these headers: DER's tag and length with up to four length octets.
+            const head = pending.peek(6);
+            const length = lengthOf(head);
             if (!length || pending.length < length) {
                 break;
             }
-            if (!rdp && earlyAuth && pending[0] !== 0x30) {
+            if (!rdp && earlyAuth && head[0] !== 0x30) {
                 earlyAuth = false;
             }
-            else if (pending[0] === 0x03) {
+            else if (head[0] === 0x03) {
                 rdp = true;
             }
-            out.push(pending.subarray(0, length));
-            pending = pending.subarray(length);
+            out.push(pending.take(length));
         }
-        // A copy of the rest: it would otherwise keep the whole chunk it came in alive.
-        pending = Buffer.from(pending);
         return out;
     };
 }
@@ -361,6 +437,65 @@ const KEY_ENCIPHERMENT_ONLY_TLS = {
     maxVersion: 'TLSv1.2',
     ciphers: 'AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256',
 };
+/**
+ * The TLS library turned the server's certificate down for its key usage, the one failure KEY_ENCIPHERMENT_ONLY_TLS is
+ * for. Known by the library's own reason (Node's code is made from it), never by an error's text: that can carry what
+ * a gateway or an SSH host put in it, which would take forward secrecy away from a server that has no need to lose it.
+ * And only when the TLS socket raised it itself: an error the stream under it failed with reaches the TLS socket as it
+ * is, code and all (Electron's BoringSSL raises its own refusal with that stream untouched).
+ */
+class KeyUsageRefused extends Error {
+}
+const isKeyUsageRefusal = (e) => e?.code === 'ERR_SSL_KEY_USAGE_BIT_INCORRECT' || e?.reason === 'KEY_USAGE_BIT_INCORRECT';
+const KEY_USAGE = Buffer.from([0x55, 0x1d, 0x0f]); // the key usage extension's OID, 2.5.29.15
+/**
+ * Whether a certificate (DER) shows that it leaves digital signatures out of its key usage, as Windows' self-signed RDP
+ * certificate does (key and data encipherment only): the certificates KEY_ENCIPHERMENT_ONLY_TLS is for. False for one
+ * that allows them, has no key usage at all (anything goes), or can't be read here: the fallback, which gives up
+ * forward secrecy, is only for a certificate shown to need it.
+ */
+function signsNothing(der) {
+    const at = (offset, end) => {
+        const t = readTlv(der, offset);
+        if (!t || t.end > end) {
+            throw new Error('not DER');
+        }
+        return t;
+    };
+    const children = (parent) => {
+        const list = [];
+        for (let p = parent.start; p < parent.end; p = list[list.length - 1].end) {
+            list.push(at(p, parent.end));
+        }
+        return list;
+    };
+    try {
+        // Certificate: SEQUENCE { tbsCertificate: SEQUENCE { ..., extensions: [3] { SEQUENCE OF Extension } }, ... }
+        const certificate = at(0, der.length);
+        for (const field of children(at(certificate.start, certificate.end))) {
+            if (field.tag !== 0xa3) {
+                continue;
+            }
+            for (const extension of children(at(field.start, field.end))) {
+                // Extension: SEQUENCE { extnID OID, critical BOOLEAN (optional), extnValue OCTET STRING }
+                const [id, ...rest] = children(extension);
+                if (id.tag === 0x06 && der.subarray(id.start, id.end).equals(KEY_USAGE)) {
+                    const value = rest[rest.length - 1];
+                    const bits = at(value.start, value.end);
+                    if (bits.tag !== 0x03) {
+                        throw new Error('not a key usage');
+                    }
+                    // A BIT STRING: the count of unused bits, then the bits; digitalSignature is the first.
+                    return bits.end - bits.start < 2 || !(der[bits.start + 1] & 0x80);
+                }
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
 class NoTlsError extends Error {
 }
 /** The client's first message (the RDCleanPath request: a destination, a token, an X.224 request) is small. */
@@ -380,10 +515,17 @@ const HIGH_WATER = 8 * 1024 * 1024;
  * Sends the client's X.224 request upstream, reads the confirm, then does TLS there. With a pre-connection blob, that
  * goes first; without an X.224 request (a Hyper-V VM's console), TLS follows the blob at once and X.224 is the
  * client's to do later. `track` hears of each stream as soon as it exists, so the caller can end them if the client
- * goes away meanwhile; `gone` says it has.
+ * goes away meanwhile; `gone` says it has, and `signal` aborts then, for the factory that opens the first stream (which
+ * `track` only hears of once it is open).
  */
-async function handshake(openUpstream, destination, pcb, x224Request, legacyTls, track, gone, withoutNla) {
-    const raw = await openUpstream(destination);
+async function handshake(openUpstream, destination, pcb, x224Request, legacyTls, track, gone, withoutNla, options, signal) {
+    // Without the user name IronRDP puts in it. A request that still names one after that (its form not the one
+    // withoutUserCookie knows) goes nowhere: the name isn't to reach the server before it is checked.
+    const request = x224Request && withoutUserCookie(x224Request);
+    if (request?.includes(COOKIE)) {
+        throw new Error('the connection request carries the user name in a form the proxy can\'t take it out of');
+    }
+    const raw = await openUpstream(destination, signal);
     track(raw);
     try {
         if (gone()) {
@@ -393,8 +535,8 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
             raw.write(preconnectionPdu(pcb));
         }
         let x224 = null;
-        if (x224Request) {
-            raw.write(x224Request);
+        if (request) {
+            raw.write(request);
             x224 = await readTpkt(raw);
             const refused = noTls(x224);
             if (refused) {
@@ -402,14 +544,27 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
             }
             // Before TLS: a server that isn't to get the password gets nothing more at all.
             if (!offersNla(x224)) {
-                await withoutNla?.();
+                await withoutNla();
             }
         }
-        const upstream = tls.connect({ socket: raw, rejectUnauthorized: false, ...legacyTls ? KEY_ENCIPHERMENT_ONLY_TLS : {} });
+        // With a name, the certificate is checked against it (an address against the certificate's addresses; it goes
+        // without SNI, which only takes names), the authorities and its dates. Whatever the outcome, the handshake
+        // completes: the certificate check decides.
+        const name = options.serverName;
+        const upstream = tls.connect({
+            socket: raw, rejectUnauthorized: false,
+            ...name ? { host: name, ca: (0, authorities_1.certificateAuthorities)(), ...(0, net_1.isIP)(name) ? {} : { servername: name } } : {},
+            ...legacyTls ? KEY_ENCIPHERMENT_ONLY_TLS : {}, ...options.tls,
+        });
         track(upstream);
+        // An error after the one the handshake below waits for (the stream under it failing as the socket is destroyed,
+        // which a TLS socket over a stream passes on as its own) would have no listener until the relay is up, and an
+        // 'error' without one is an uncaught exception in Tabby's window. The relay listens for its own.
+        upstream.on('error', () => { });
         await new Promise((resolve, reject) => {
             upstream.once('secureConnect', resolve);
-            upstream.once('error', reject);
+            // TLS's own refusal only: not an error of the stream under it (raw.errored), whatever its code.
+            upstream.once('error', e => reject(isKeyUsageRefusal(e) && !raw.errored ? new KeyUsageRefused(e.message) : e));
             upstream.once('close', () => reject(new Error('upstream closed during TLS')));
             upstream.once('end', () => reject(new Error('upstream closed during TLS')));
         });
@@ -420,21 +575,72 @@ async function handshake(openUpstream, destination, pcb, x224Request, legacyTls,
         throw e;
     }
 }
-async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () => { }, options = {}) {
+/** Whether `given` is the secret, compared in a time that doesn't tell how much of it was right. */
+function sameSecret(given, secret) {
+    const bytes = Buffer.from(given);
+    return bytes.length === secret.length && (0, crypto_1.timingSafeEqual)(bytes, secret);
+}
+/**
+ * The Origin a client may say it comes from: none (not a browser's page), or a file's page, as Tabby's window is (its
+ * WebSockets carry `Origin: file://`). Not a web page (`http:`, `https:`), a sandboxed or otherwise opaque one (`null`),
+ * or a browser extension's.
+ */
+const ALLOWED_ORIGINS = [undefined, 'file://'];
+/**
+ * `text` without the proxy's token. IronRDP's error for an address it couldn't connect to names the address, whose path
+ * is the token, and such an error goes to the desktop's status line and its log, which "Copy log" hands out.
+ */
+function withoutToken(text, proxy) {
+    return proxy?.token ? text.split(proxy.token).join('…') : text;
+}
+async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () => { }, options = { withoutNla: refuseWithoutNla }) {
+    // Called from JavaScript without the decision, the proxy still refuses such servers rather than let them through.
+    if (typeof options.withoutNla !== 'function') {
+        options = { ...options, withoutNla: refuseWithoutNla };
+    }
     const token = (0, crypto_1.randomBytes)(24).toString('hex');
+    // The client shows it twice: as its address's path, before it is let in at all, and in its request.
+    const path = Buffer.from(`/${token}`);
+    const secret = Buffer.from(token);
     let failure = null;
-    // Set once the server turned out to need KEY_ENCIPHERMENT_ONLY_TLS; later connections start with it.
+    // Set once a connection showed that the server needs KEY_ENCIPHERMENT_ONLY_TLS (its handshake fell back, and the
+    // certificate leaves signatures out and was accepted). The next connection starts with it and clears it, to set it
+    // again once it has shown the same: one that doesn't get that far, whatever stops it (a failure, the server not
+    // answering in time, the client leaving), or that finds a certificate that doesn't need it, leaves it cleared.
     let legacyTls = false;
     const stats = { bytesIn: 0, bytesOut: 0 };
-    const wss = new WebSocketServer({ host: '127.0.0.1', port: 0, maxPayload: MAX_MESSAGE });
+    // The room (see ServerFlow): what was taken for answers and not read from the connection since, the client whose
+    // connection that is (the latest to reach the relay: a reconnect can overlap the connection it replaces), and what
+    // waits for room. Once the proxy is closed there is room for good: nothing more goes anywhere.
+    let owed = 0;
+    let flowClient = null;
+    let roomWaiters = [];
+    let shut = false;
+    const hasRoom = () => shut || owed < exports.FLOW_WINDOW;
+    const roomMade = () => {
+        if (roomWaiters.length && hasRoom()) {
+            const go = roomWaiters;
+            roomWaiters = [];
+            go.forEach(f => f());
+        }
+    };
+    const wss = new WebSocketServer({
+        host: '127.0.0.1',
+        port: 0,
+        maxPayload: MAX_MESSAGE,
+        // Anything on this computer can reach the port, and so can a web page in a browser. A connection without the
+        // token is turned away before it takes one of the few places, which the desktop's own client would then find
+        // taken; and one from a page other than a file's, as Tabby's window is, is turned away whatever it has.
+        verifyClient: ({ req }) => ALLOWED_ORIGINS.includes(req.headers.origin) && sameSecret(req.url ?? '', path),
+    });
     await new Promise((resolve, reject) => {
         wss.once('listening', resolve);
         wss.once('error', reject);
     });
     wss.on('error', (e) => log(`proxy: ${e.message}`));
     wss.on('connection', (ws) => {
-        // Anything on this computer can connect to the port; only the client that knows the token gets further than
-        // its first message, which has to be small and arrive soon.
+        // Only a client that knows the token gets here (see verifyClient), and then only as far as its first message
+        // (which has to be small and arrive soon) until that shows the token too.
         if (wss.clients.size > MAX_CLIENTS) {
             ws.terminate();
             return;
@@ -445,6 +651,8 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
         let earlySize = 0;
         let upstream = null;
         let closed = false;
+        // Aborts when the client has gone, for an upstream still being opened, which isn't among the streams yet.
+        const leaving = new AbortController();
         // Every stream opened for this client, from the moment it exists: ended with the client.
         const streams = new Set();
         const track = (stream) => {
@@ -456,16 +664,24 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
         };
         const end = () => {
             closed = true;
+            leaving.abort();
             clearTimeout(deadline);
             for (const stream of streams) {
                 stream.destroy();
             }
+            // What was handed to this connection went with it: the next starts with all the room.
+            if (flowClient === ws) {
+                flowClient = null;
+                owed = 0;
+                roomMade();
+            }
         };
         let deadline = setTimeout(() => stage === 'hello' && ws.terminate(), HELLO_TIMEOUT_MS);
         const toServer = options.autologon ? autologon() : (data) => data;
         const send = (data) => {
             const out = toServer(data);
-            // The server (or the SSH channel to it) not keeping up: stop reading from the client until it has.
+            // The server (or the SSH channel to it) not keeping up: stop reading from the client until it has (see
+            // ServerFlow).
             if (out.length && !upstream.write(out) && upstream.writableLength > HIGH_WATER) {
                 ws.pause();
                 upstream.once('drain', () => ws.resume());
@@ -490,6 +706,11 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
         ws.on('message', async (data) => {
             if (stage === 'relay') {
                 stats.bytesOut += data.length;
+                // Read from the connection: as much room again (see ServerFlow).
+                if (flowClient === ws) {
+                    owed = Math.max(0, owed - data.length);
+                    roomMade();
+                }
                 send(data);
                 return;
             }
@@ -519,22 +740,29 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
                 if (req.version !== VERSION_1 || !req.destination || !req.x224 && !req.pcb?.trim()) {
                     return fail('malformed request');
                 }
-                if (req.proxyAuth !== token) {
+                if (!sameSecret(req.proxyAuth ?? '', secret)) {
                     return fail('bad token');
                 }
-                deadline = setTimeout(() => stage === 'handshake' && fail('the server didn\'t answer in time'), HANDSHAKE_TIMEOUT_MS);
+                deadline = setTimeout(() => stage === 'handshake' && fail('the server didn\'t answer in time'), options.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+                // Whether this connection uses KEY_ENCIPHERMENT_ONLY_TLS, and whether it came to it by falling back
+                // (rather than starting with it, as remembered): kept here until the connection shows it was needed.
+                // Taken from legacyTls, which stays cleared until then: a server that hangs, or a client that leaves
+                // meanwhile, has the next connection try modern TLS first, as one whose handshake fails does.
+                let legacy = legacyTls;
+                legacyTls = false;
+                let fellBack = false;
                 let up;
                 try {
-                    up = await handshake(openUpstream, req.destination, req.pcb, req.x224, legacyTls, track, () => closed, options.withoutNla);
+                    up = await handshake(openUpstream, req.destination, req.pcb, req.x224, legacy, track, () => closed, options.withoutNla, options, leaving.signal);
                 }
                 catch (e) {
-                    if (closed || legacyTls || !/KEY_USAGE_BIT_INCORRECT/.test(e?.message ?? '')) {
+                    if (closed || legacy || !(e instanceof KeyUsageRefused)) {
                         throw e;
                     }
                     // The X.224 exchange is spent on that connection: start over on a fresh one.
                     log('TLS: the server certificate only allows key encipherment; using TLS 1.2 with RSA key exchange');
-                    legacyTls = true;
-                    up = await handshake(openUpstream, req.destination, req.pcb, req.x224, legacyTls, track, () => closed, options.withoutNla);
+                    legacy = fellBack = true;
+                    up = await handshake(openUpstream, req.destination, req.pcb, req.x224, legacy, track, () => closed, options.withoutNla, options, leaving.signal);
                 }
                 // Reached: from here on the time is the user's (a certificate to look at) and the session's.
                 clearTimeout(deadline);
@@ -550,15 +778,45 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
                 if (!chain.length) {
                     return fail('the server sent no certificate');
                 }
-                await checkCertificate(fingerprintOf(chain[0]));
+                // RSA key exchange, without forward secrecy, only for a certificate shown to leave no better choice. One
+                // that doesn't show it, after a handshake that failed as if it did, means something on the way made
+                // that failure up; after one that started with it as remembered, that the certificate changed. Either
+                // way the next connection starts without the fallback.
+                if (legacy && !signsNothing(chain[0])) {
+                    legacyTls = false;
+                    return fail(fellBack
+                        ? 'the server\'s certificate doesn\'t show a need for the fallback to TLS 1.2 with RSA key exchange (no forward secrecy) that this connection made: something on the way may be interfering with TLS'
+                        : 'the server\'s certificate changed, and no longer needs TLS 1.2 with RSA key exchange: the next connection uses modern TLS');
+                }
+                // Valid only as checked against a name: without one, Node checks against "localhost".
+                const valid = !!options.serverName && upstream.authorized;
+                const reason = valid ? '' : options.serverName ? String(upstream.authorizationError ?? '') : '';
+                // Where the chain stands and whether it is for the name, which Node's code for why it isn't valid can
+                // hide (see certificateDetails), by the authorities the handshake was checked against.
+                const peer = upstream.getPeerCertificate(true);
+                const checked = options.serverName && !valid ? { name: options.serverName, authorities: options.tls?.ca ?? (0, authorities_1.certificateAuthorities)(), reason } : undefined;
+                await checkCertificate(fingerprintOf(chain[0]), valid, reason, (0, authorities_1.certificateDetails)(peer, checked));
                 if (closed) {
                     return;
                 }
+                // Remembered only now: the handshake worked, with a certificate that needs it and that was accepted.
+                legacyTls = legacy;
+                // A server without NLA, let through before TLS: what let it through is held to its certificate.
+                if (x224 && !offersNla(x224) && options.withoutNlaCertificate) {
+                    await options.withoutNlaCertificate(fingerprintOf(chain[0]));
+                    if (closed) {
+                        return;
+                    }
+                }
                 ws.send(encodeResponse(x224, chain, req.destination));
                 stage = 'relay';
+                // The room is this connection's from now on, all of it (see ServerFlow).
+                flowClient = ws;
+                owed = 0;
+                roomMade();
                 // PROTOCOL_HYBRID_EX in the server's negotiation response: an Early User Authorization Result follows CredSSP.
                 // (A Hyper-V VM's console: CredSSP first, then the X.224 exchange, which never asks for HYBRID_EX.)
-                const frames = serverFraming(!!x224 && x224.length >= 19 && x224[11] === 0x02 && x224.readUInt32LE(15) === 8);
+                const frames = serverFraming(!!x224 && earlyUserAuthorization(x224));
                 upstream.on('data', (d) => {
                     stats.bytesIn += d.length;
                     let pdus;
@@ -610,7 +868,7 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
     });
     const { port } = wss.address();
     return {
-        url: `ws://127.0.0.1:${port}`,
+        url: `ws://127.0.0.1:${port}/${token}`,
         token,
         stats,
         get failure() { return failure; },
@@ -620,7 +878,24 @@ async function startRDCleanPathProxy(openUpstream, checkCertificate, log = () =>
             for (const client of wss.clients) {
                 client.terminate();
             }
+            // Nothing more goes to the server: what waited for room goes on, and finds the end.
+            shut = true;
+            owed = 0;
+            roomMade();
+        },
+        room: hasRoom,
+        // Counted only as a number of bytes: anything else would leave the room unknown, and every answer waiting.
+        spend: (bytes) => {
+            if (bytes > 0) {
+                owed += bytes;
+            }
+        },
+        refund: (bytes) => {
+            if (bytes > 0) {
+                owed = Math.max(0, owed - bytes);
+                roomMade();
+            }
         },
+        whenRoom: () => hasRoom() ? Promise.resolve() : new Promise(resolve => roomWaiters.push(resolve)),
     };
 }
-//# sourceMappingURL=rdcleanpath.js.map

package/dist/rdpFile.js

@@ -1,11 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROPHONE_NOTE = void 0;
 exports.parseRdpFile = parseRdpFile;
+/**
+ * The note for a file that asks for the microphone: not applied while the setting is off. With it on, every desktop
+ * gets the microphone, and the import says so instead (see RemoteDesktopService.importRdp).
+ */
+exports.MICROPHONE_NOTE = 'the microphone (Settings › Remote Desktop › Microphone)';
 /** What a setting in the file would mean here, when it isn't applied: by key, for the values that ask for something. */
 const NOTES = {
     'audiomode': v => v === '1' ? 'sound left on the remote (sound plays here; Settings › Remote Desktop › Sound)' : v === '2' ? 'sound off (Settings › Remote Desktop › Sound)' : null,
-    'audiocapturemode': v => v === '1' ? 'the microphone (Settings › Remote Desktop › Microphone)' : null,
-    'redirectclipboard': v => v === '0' ? 'the clipboard turned off (it is always on)' : null,
+    'audiocapturemode': v => v === '1' ? exports.MICROPHONE_NOTE : null,
     'redirectdrives': v => v === '1' ? 'its drives (share folders in Settings › Remote Desktop › Shared folders)' : null,
     'drivestoredirect': v => v ? 'its drives (share folders in Settings › Remote Desktop › Shared folders)' : null,
     'redirectprinters': v => v === '1' ? 'printer redirection (not supported)' : null,
@@ -51,15 +56,22 @@ function decode(data) {
 /** The connection a .rdp file describes, or null without a usable `full address`. */
 function parseRdpFile(data) {
     const settings = new Map();
+    // A limit is kept whichever way the file writes it (`0`, `00`, `+0`), and wherever it is: a file that says it
+    // twice, differently, gets the narrower of the two rather than whichever line comes last.
+    let clipboardOff = false;
     for (const line of decode(data).split(/\r?\n/)) {
         const m = /^\s*([^:]+?)\s*:\s*([sib])\s*:(.*)$/i.exec(line);
         if (m) {
-            settings.set(m[1].toLowerCase(), m[3].trim());
+            const key = m[1].toLowerCase();
+            const value = m[3].trim();
+            settings.set(key, value);
+            clipboardOff ||= key === 'redirectclipboard' && /^[+-]?\d+$/.test(value) && Number(value) === 0;
         }
     }
     const full = settings.get('full address') ?? '';
-    // host, host:port, [v6]:port, or a bare IPv6 address (colons, no brackets).
-    const m = /^\[([^\]]+)\](?::(\d+))?$|^([^:\s]+)(?::(\d+))?$/.exec(full);
+    // host, host:port, [v6]:port, or a bare IPv6 address (colons, no brackets). No '#': session and trust keys are
+    // split on it, so a host that carried one could be taken for another desktop's key (see keyParts).
+    const m = /^\[([^\]#]+)\](?::(\d+))?$|^([^:\s#]+)(?::(\d+))?$/.exec(full);
     const host = m?.[1] ?? m?.[3] ?? (/^[0-9a-f:.]+$/i.test(full) && (full.match(/:/g)?.length ?? 0) > 1 ? full : null);
     // A port in the address wins over `server port`, as in mstsc.
     const port = Number(m?.[2] ?? m?.[4] ?? (settings.get('server port') || 3389));
@@ -67,7 +79,10 @@ function parseRdpFile(data) {
         return null;
     }
     const scale = Number(settings.get('desktopscalefactor'));
-    const ignored = [...settings].map(([key, value]) => NOTES[key]?.(value, settings) ?? null).filter((n) => !!n);
+    // By own property only: a file whose key is `__proto__` or `constructor` names an inherited member of the NOTES
+    // object (Object.prototype, the Object constructor), not a note, and calling one would throw or inject its text.
+    const noteFor = (key) => Object.prototype.hasOwnProperty.call(NOTES, key) ? NOTES[key] : undefined;
+    const ignored = [...settings].map(([key, value]) => noteFor(key)?.(value, settings) ?? null).filter((n) => !!n);
     return {
         host,
         port,
@@ -75,7 +90,7 @@ function parseRdpFile(data) {
         ...settings.get('domain') ? { domain: settings.get('domain') } : {},
         ...Number.isFinite(scale) && scale >= 100 ? { sharpness: scale >= 150 ? 'retina' : 'standard' } : {},
         ...usesGateway(settings) ? { gateway: settings.get('gatewayhostname') } : {},
+        ...clipboardOff ? { clipboard: 'off' } : {},
         ignored: [...new Set(ignored)],
     };
 }
-//# sourceMappingURL=rdpFile.js.map