feat(remote-connect): add bounded QR pairing

cmake/compile_definitions/common.cmake

@@ -174,6 +174,17 @@ set(SUNSHINE_TARGET_FILES
         "${CMAKE_SOURCE_DIR}/src/nvhttp/sessions.h"
         "${CMAKE_SOURCE_DIR}/src/nvhttp/url_utils.cpp"
         "${CMAKE_SOURCE_DIR}/src/nvhttp/url_utils.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/api.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/api.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/easytier.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/easytier.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/invite.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/invite.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/pairing.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/pairing.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/service.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/service.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/types.h"
         "${CMAKE_SOURCE_DIR}/src/nvhttp_stream_start.cpp"
         "${CMAKE_SOURCE_DIR}/src/nvhttp_stream_start.h"
         "${CMAKE_SOURCE_DIR}/src/abr.cpp"

cmake/packaging/sunshine.iss.in

@@ -183,6 +183,13 @@ Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{
 [InstallDelete]
 ; Remove old hashed Web UI bundles before installing the freshly built frontend.
 Type: filesandordirs; Name: "{app}\assets\web"
+; Versions prior to the external-runtime boundary bundled EasyTier and its
+; networking dependencies. Remove only those known files during upgrade.
+Type: files; Name: "{app}\tools\easytier\easytier-core.exe"
+Type: files; Name: "{app}\tools\easytier\Packet.dll"
+Type: files; Name: "{app}\tools\easytier\WinDivert64.sys"
+Type: files; Name: "{app}\tools\easytier\wintun.dll"
+Type: files; Name: "{app}\tools\easytier\LICENSE-EasyTier.txt"
 
 [Files]
 ; Main application
@@ -317,12 +324,11 @@ Filename: "{cmd}"; Parameters: "/c start """" ""{app}\assets\gui\{#MyAppGUIExeNa
 [UninstallRun]
 ; Remove the per-user GUI startup entry before terminating the agent.
 Filename: "{app}\assets\gui\{#MyAppGUIExeName}"; Parameters: "--remove-autostart"; Flags: runhidden waituntilterminated; RunOnceId: "RemoveGUIAutoStart"; Check: FileExists(ExpandConstant('{app}\assets\gui\{#MyAppGUIExeName}'))
-; Stop running processes first. We force-kill the service binary
-; (sunshinesvc.exe) here as well, otherwise `sc stop` later may block waiting
-; on its stop handler — which is the typical "uninstaller appears frozen" symptom.
+; Stop only the process trees owned by Sunshine. /t includes a Sunshine-owned
+; EasyTier child without terminating a separately launched EasyTier instance.
 Filename: "taskkill"; Parameters: "/f /im sunshine-gui.exe"; Flags: runhidden; RunOnceId: "KillGUI"
-Filename: "taskkill"; Parameters: "/f /im sunshine.exe"; Flags: runhidden; RunOnceId: "KillSunshine"
-Filename: "taskkill"; Parameters: "/f /im sunshinesvc.exe"; Flags: runhidden; RunOnceId: "KillSunshineSvc"
+Filename: "taskkill"; Parameters: "/t /f /im sunshine.exe"; Flags: runhidden waituntilterminated; RunOnceId: "KillSunshine"
+Filename: "taskkill"; Parameters: "/t /f /im sunshinesvc.exe"; Flags: runhidden waituntilterminated; RunOnceId: "KillSunshineSvc"
 ; Remove system components
 Filename: "{app}\scripts\delete-firewall-rule.bat"; Flags: runhidden waituntilterminated; RunOnceId: "DelFirewall"
 Filename: "{app}\scripts\uninstall-service.bat"; Flags: runhidden waituntilterminated; RunOnceId: "UninstallService"
@@ -935,9 +941,11 @@ begin
   // Stop the Sunshine service
   Exec('net', 'stop SunshineService', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
   // Kill any running processes
-  Exec('taskkill', '/f /im sunshine.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  // Kill the Sunshine-owned process tree if graceful service stop did not
+  // terminate every child. This leaves independent EasyTier instances alone.
+  Exec('taskkill', '/t /f /im sunshine.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
   Exec('taskkill', '/f /im sunshine-gui.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  Exec('taskkill', '/f /im sunshinesvc.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  Exec('taskkill', '/t /f /im sunshinesvc.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
   // Small delay to allow processes to release files
   Sleep(1000);
 end;

docs/legal.md

@@ -14,6 +14,17 @@ contained within Sunshine. If you plan to sell access to Sunshine as part of the
 for obtaining the necessary licenses to do so. This may include obtaining a license from the
 Motion Picture Experts Group (MPEG-LA) and/or any other necessary licensing requirements.
 
+## Optional Remote Connection Runtime
+
+The remote connection feature can launch a separately installed
+[EasyTier](https://github.com/EasyTier/EasyTier) runtime. EasyTier and its Windows networking dependencies are not part
+of Sunshine and must not be copied into a Sunshine package without independently verifying and satisfying every
+applicable redistribution license. The Windows integration only discovers a complete EasyTier installation in the
+official installer's default, administrator-protected location.
+
+When the default remote connection peer is used, encrypted traffic may be relayed by an EasyTier community public
+node. Users are informed before enabling the feature and can configure a self-hosted peer instead.
+
 In summary, while Sunshine is free to use, it is the user's responsibility to ensure compliance with all applicable
 licensing requirements when redistributing the software as part of a commercial offering. If you have any questions or
 concerns about using Sunshine in a commercial setting, we recommend consulting with a lawyer.

src/config.cpp

@@ -530,6 +530,13 @@ namespace config {
 
     10,  // pair_max_attempts: default 10 attempts per IP per 60s
 
+    false,  // remote_connect_enabled
+    {},  // remote_connect_profile
+    {},  // remote_connect_virtual_ip
+    {},  // remote_connect_network_name
+    {},  // remote_connect_network_secret
+    "udp://public.easytier.top:11010",  // remote_connect_peer
+
     true,  // client_fingerprint_remote_rules
     "https://raw.githubusercontent.com/AlkaidLab/sunshine-client-fingerprint-rules/main/stable.json",
     {},  // client_fingerprint_rules_certificate (empty uses the pinned built-in certificate)
@@ -1191,7 +1198,8 @@ namespace config {
 
   void apply_config(std::unordered_map<std::string, std::string> &&vars) {
     for (auto &[name, val] : vars) {
-      const auto log_value = name == "file_mappings" && !val.empty() ? "<redacted>"s : val;
+      const bool sensitive = name == "file_mappings" || name == "remote_connect_network_secret";
+      const auto log_value = sensitive && !val.empty() ? "<redacted>"s : val;
       BOOST_LOG(info) << "config: '"sv << name << "' = "sv << log_value;
       modified_config_settings[name] = val;
     }
@@ -1462,6 +1470,12 @@ namespace config {
     list_string_f(vars, "fps"s, nvhttp.fps);
     int_between_f(vars, "sleep_mode", nvhttp.sleep_mode, { SLEEP_MODE_SUSPEND, SLEEP_MODE_AWAY });
     int_between_f(vars, "pair_max_attempts", nvhttp.pair_max_attempts, { 0, 50 });
+    bool_f(vars, "remote_connect_enabled", nvhttp.remote_connect_enabled);
+    string_f(vars, "remote_connect_profile", nvhttp.remote_connect_profile);
+    string_f(vars, "remote_connect_virtual_ip", nvhttp.remote_connect_virtual_ip);
+    string_f(vars, "remote_connect_network_name", nvhttp.remote_connect_network_name);
+    string_f(vars, "remote_connect_network_secret", nvhttp.remote_connect_network_secret);
+    string_f(vars, "remote_connect_peer", nvhttp.remote_connect_peer);
     bool_f(vars, "client_fingerprint_remote_rules", nvhttp.client_fingerprint_remote_rules);
     string_f(vars, "client_fingerprint_rules_url", nvhttp.client_fingerprint_rules_url);
     string_f(vars, "client_fingerprint_rules_certificate", nvhttp.client_fingerprint_rules_certificate);

src/config.h

@@ -194,6 +194,15 @@ namespace config {
 
     int pair_max_attempts;  // Max PIN pairing attempts per IP within 60s window. 0 disables limiting.
 
+    // Remote connection. The secret is generated locally and only leaves
+    // the host through an authenticated, short-lived pairing QR code.
+    bool remote_connect_enabled;
+    std::string remote_connect_profile;
+    std::string remote_connect_virtual_ip;
+    std::string remote_connect_network_name;
+    std::string remote_connect_network_secret;
+    std::string remote_connect_peer;
+
     // Signed, warning-only client fingerprint rule feed.
     bool client_fingerprint_remote_rules;
     std::string client_fingerprint_rules_url;

src/confighttp.cpp

@@ -8,24 +8,28 @@
 
 #include "process.h"
 
-#include <cstdint>
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cctype>
+#include <chrono>
 #include <cmath>
+#include <cstdint>
+#include <cstdio>
 #include <cstdlib>
+#include <ctime>
 #include <filesystem>
 #include <fstream>
 #include <iomanip>
-#include <algorithm>
-#include <atomic>
+#include <map>
 #include <mutex>
-#include <stdexcept>
 #include <random>
-#include <map>
 #include <set>
 #include <sstream>
-#include <cstdio>
-#include <ctime>
+#include <stdexcept>
 #include <thread>
 #include <utility>
+#include <vector>
 #include <openssl/evp.h>
 #include <openssl/sha.h>
 
@@ -36,6 +40,7 @@
 #include <boost/algorithm/string.hpp>
 
 #include <boost/filesystem.hpp>
+#include <boost/regex.hpp>
 #include <nlohmann/json.hpp>
 #include <Simple-Web-Server/crypto.hpp>
 #include <Simple-Web-Server/server_https.hpp>
@@ -60,6 +65,9 @@
 #include "perf_recorder.h"
 #include "platform/common.h"
 #include "platform/run_command.h"
+#include "remote_connect/api.h"
+#include "remote_connect/pairing.h"
+#include "remote_connect/service.h"
 #include "rtsp.h"
 #include "src/display_device/to_string.h"
 #include "src/tray/tray_http.h"
@@ -1916,6 +1924,29 @@ namespace confighttp {
     response->write(SimpleWeb::StatusCode::success_ok, content, headers);
   }
 
+  void
+  getRemoteConnectStatus(resp_https_t response, req_https_t request) {
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::get_status(std::move(response));
+  }
+
+  void
+  setRemoteConnectEnabled(resp_https_t response, req_https_t request) {
+    if (!check_content_type(response, request, "application/json")) return;
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::set_enabled(std::move(response), std::move(request));
+  }
+
+  void
+  resetRemoteConnect(resp_https_t response, req_https_t request) {
+    if (!check_content_type(response, request, "application/json")) return;
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::reset_enrollment(std::move(response));
+  }
+
   void
   generateQrPairInfo(resp_https_t response, req_https_t request) {
     if (!authenticate(response, request)) return;
@@ -2013,19 +2044,28 @@ namespace confighttp {
       }
     }
 
-    // Build the moonlight:// URL
-    std::string url = "moonlight://pair?host=" + host +
-                      "&port=" + std::to_string(port) +
-                      "&pin=" + pin +
-                      "&name=" + server_name;
+    const auto pairing = remote_connect::create_pairing_invite({
+      std::move(host),
+      static_cast<std::uint16_t>(port),
+      pin,
+      server_name,
+      std::time(nullptr) + 120,
+    });
+    if (!pairing.success) {
+      outputTree.put("status", false);
+      outputTree.put("error", pairing.error);
+      return;
+    }
+    host = pairing.host;
 
     outputTree.put("status", true);
     outputTree.put("pin", pin);
     outputTree.put("host", host);
     outputTree.put("port", port);
     outputTree.put("name", server_name);
-    outputTree.put("url", url);
+    outputTree.put("url", pairing.url);
     outputTree.put("expires_in", 120);
+    outputTree.put("remote_connect", pairing.remote);
   }
 
   void
@@ -3780,6 +3820,7 @@ namespace confighttp {
 
   void
   start() {
+    remote_connect::start_if_enabled();
     auto shutdown_event = mail::man->event<bool>(mail::shutdown);
 
     auto port_https = net::map_port(PORT_HTTPS);
@@ -3799,6 +3840,9 @@ namespace confighttp {
     server.resource["^/api/qr-pair$"]["POST"] = generateQrPairInfo;
     server.resource["^/api/qr-pair/cancel$"]["POST"] = cancelQrPair;
     server.resource["^/api/qr-pair$"]["GET"] = getQrPairStatus;
+    server.resource["^/api/remote-connect$"]["GET"] = getRemoteConnectStatus;
+    server.resource["^/api/remote-connect$"]["POST"] = setRemoteConnectEnabled;
+    server.resource["^/api/remote-connect/reset$"]["POST"] = resetRemoteConnect;
     server.resource["^/api/apps$"]["GET"] = getApps;
     server.resource["^/api/logs$"]["GET"] = getLogs;
     server.resource["^/api/apps$"]["POST"] = saveApp;
@@ -3914,6 +3958,7 @@ namespace confighttp {
     shutdown_event->view();
 
     server.stop();
+    remote_connect::stop();
 
     tcp.join();
   }

src/nvhttp/url_utils.cpp

@@ -1,9 +1,27 @@
 #include "url_utils.h"
 
 #include <cctype>
+#include <iomanip>
+#include <sstream>
 
 namespace nvhttp::url_utils {
 
+  std::string
+  encode(const std::string &value) {
+    std::ostringstream encoded;
+    encoded << std::hex << std::uppercase;
+    for (const auto ch : value) {
+      const auto c = static_cast<unsigned char>(ch);
+      if (std::isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') {
+        encoded << ch;
+      }
+      else {
+        encoded << '%' << std::setw(2) << std::setfill('0') << static_cast<int>(c);
+      }
+    }
+    return encoded.str();
+  }
+
   std::string
   decode(std::string value) {
     std::string decoded;

src/nvhttp/url_utils.h

@@ -4,6 +4,9 @@
 
 namespace nvhttp::url_utils {
 
+  std::string
+  encode(const std::string &value);
+
   std::string
   decode(std::string value);
 

src/remote_connect/api.cpp

@@ -0,0 +1,72 @@
+#include "api.h"
+
+#include <utility>
+
+#include <nlohmann/json.hpp>
+
+#include "service.h"
+
+namespace remote_connect::api {
+  namespace {
+    using json = nlohmann::json;
+
+    SimpleWeb::CaseInsensitiveMultimap
+    json_headers() {
+      return {
+        { "Content-Type", "application/json" },
+        { "X-Frame-Options", "DENY" },
+        { "Content-Security-Policy", "frame-ancestors 'none';" },
+      };
+    }
+
+    void
+    write_json(resp_https_t response, const json &body) {
+      response->write(body.dump(), json_headers());
+    }
+
+    json
+    status_response(bool success, const status_t &remote_status) {
+      return {
+        { "status", success },
+        { "enabled", remote_status.enabled },
+        { "running", remote_status.running },
+        { "available", remote_status.available },
+        { "virtual_ip", remote_status.virtual_ip },
+        { "error", remote_status.error },
+      };
+    }
+
+  }  // namespace
+
+  void
+  get_status(resp_https_t response) {
+    write_json(std::move(response), status_response(true, remote_connect::status()));
+  }
+
+  void
+  set_enabled(resp_https_t response, req_https_t request) {
+    json input;
+    try {
+      input = json::parse(request->content.string());
+    }
+    catch (const json::exception &e) {
+      write_json(std::move(response), { { "status", false }, { "error", e.what() } });
+      return;
+    }
+
+    if (!input.is_object() || !input.contains("enabled") || !input["enabled"].is_boolean()) {
+      write_json(std::move(response), { { "status", false }, { "error", "enabled must be a boolean" } });
+      return;
+    }
+
+    const auto result = remote_connect::set_enabled(input["enabled"].get<bool>());
+    write_json(std::move(response), status_response(result.success, result.status));
+  }
+
+  void
+  reset_enrollment(resp_https_t response) {
+    const auto result = remote_connect::reset_enrollment();
+    write_json(std::move(response), status_response(result.success, result.status));
+  }
+
+}  // namespace remote_connect::api