feat(remote-connect): add bounded QR pairing

.github/workflows/main.yml

@@ -74,6 +74,11 @@ jobs:
           & .\src_assets\windows\misc\vdd\smoke-test-vdd-device-helper.ps1
           & .\src_assets\windows\misc\vdd\smoke-test-install-vdd-selection.ps1
 
+      - name: Run process cleanup smoke tests
+        shell: pwsh
+        run: |
+          & .\src_assets\windows\misc\service\smoke-test-stop-process-tree.ps1
+
   build_win:
     name: Windows
     needs: setup_release

cmake/compile_definitions/common.cmake

@@ -174,6 +174,17 @@ set(SUNSHINE_TARGET_FILES
         "${CMAKE_SOURCE_DIR}/src/nvhttp/sessions.h"
         "${CMAKE_SOURCE_DIR}/src/nvhttp/url_utils.cpp"
         "${CMAKE_SOURCE_DIR}/src/nvhttp/url_utils.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/api.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/api.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/easytier.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/easytier.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/invite.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/invite.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/pairing.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/pairing.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/service.cpp"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/service.h"
+        "${CMAKE_SOURCE_DIR}/src/remote_connect/types.h"
         "${CMAKE_SOURCE_DIR}/src/nvhttp_stream_start.cpp"
         "${CMAKE_SOURCE_DIR}/src/nvhttp_stream_start.h"
         "${CMAKE_SOURCE_DIR}/src/abr.cpp"

cmake/packaging/sunshine.iss.in

@@ -183,6 +183,13 @@ Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{
 [InstallDelete]
 ; Remove old hashed Web UI bundles before installing the freshly built frontend.
 Type: filesandordirs; Name: "{app}\assets\web"
+; Versions prior to the external-runtime boundary bundled EasyTier and its
+; networking dependencies. Remove only those known files during upgrade.
+Type: files; Name: "{app}\tools\easytier\easytier-core.exe"
+Type: files; Name: "{app}\tools\easytier\Packet.dll"
+Type: files; Name: "{app}\tools\easytier\WinDivert64.sys"
+Type: files; Name: "{app}\tools\easytier\wintun.dll"
+Type: files; Name: "{app}\tools\easytier\LICENSE-EasyTier.txt"
 
 [Files]
 ; Main application
@@ -209,6 +216,8 @@ Source: "{#MySourceDir}\scripts\languages\*"; DestDir: "{app}\scripts\languages"
 Source: "{#MySourceDir}\scripts\install-service.bat"; DestDir: "{app}\scripts"; Flags: ignoreversion; Components: application
 Source: "{#MySourceDir}\scripts\uninstall-service.bat"; DestDir: "{app}\scripts"; Flags: ignoreversion; Components: application
 Source: "{#MySourceDir}\scripts\sleep.bat"; DestDir: "{app}\scripts"; Flags: ignoreversion; Components: application
+Source: "{#MySourceDir}\scripts\stop-process-tree.ps1"; DestDir: "{app}\scripts"; Flags: ignoreversion; Components: application
+Source: "{#MySourceDir}\scripts\stop-process-tree.ps1"; Flags: dontcopy
 
 ; Migration scripts
 Source: "{#MySourceDir}\scripts\migrate-config.bat"; DestDir: "{app}\scripts"; Flags: ignoreversion; Components: application
@@ -317,12 +326,12 @@ Filename: "{cmd}"; Parameters: "/c start """" ""{app}\assets\gui\{#MyAppGUIExeNa
 [UninstallRun]
 ; Remove the per-user GUI startup entry before terminating the agent.
 Filename: "{app}\assets\gui\{#MyAppGUIExeName}"; Parameters: "--remove-autostart"; Flags: runhidden waituntilterminated; RunOnceId: "RemoveGUIAutoStart"; Check: FileExists(ExpandConstant('{app}\assets\gui\{#MyAppGUIExeName}'))
-; Stop running processes first. We force-kill the service binary
-; (sunshinesvc.exe) here as well, otherwise `sc stop` later may block waiting
-; on its stop handler — which is the typical "uninstaller appears frozen" symptom.
-Filename: "taskkill"; Parameters: "/f /im sunshine-gui.exe"; Flags: runhidden; RunOnceId: "KillGUI"
-Filename: "taskkill"; Parameters: "/f /im sunshine.exe"; Flags: runhidden; RunOnceId: "KillSunshine"
-Filename: "taskkill"; Parameters: "/f /im sunshinesvc.exe"; Flags: runhidden; RunOnceId: "KillSunshineSvc"
+; Match the executable path before terminating processes. The GUI may be the
+; updater's parent, so stop only the GUI itself; recurse for the service/core
+; processes that can own EasyTier children.
+Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File ""{app}\scripts\stop-process-tree.ps1"" -ExecutablePath ""{app}\assets\gui\{#MyAppGUIExeName}"""; Flags: runhidden waituntilterminated; RunOnceId: "KillGUI"
+Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File ""{app}\scripts\stop-process-tree.ps1"" -ExecutablePath ""{app}\{#MyAppExeName}"" -IncludeDescendants"; Flags: runhidden waituntilterminated; RunOnceId: "KillSunshine"
+Filename: "{sys}\WindowsPowerShell\v1.0\powershell.exe"; Parameters: "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File ""{app}\scripts\stop-process-tree.ps1"" -ExecutablePath ""{app}\tools\sunshinesvc.exe"" -IncludeDescendants"; Flags: runhidden waituntilterminated; RunOnceId: "KillSunshineSvc"
 ; Remove system components
 Filename: "{app}\scripts\delete-firewall-rule.bat"; Flags: runhidden waituntilterminated; RunOnceId: "DelFirewall"
 Filename: "{app}\scripts\uninstall-service.bat"; Flags: runhidden waituntilterminated; RunOnceId: "UninstallService"
@@ -926,18 +935,37 @@ begin
   Result := False;
 end;
 
+procedure StopProcessAtPath(ProcessStopScript, ExecutablePath: String; IncludeDescendants: Boolean);
+var
+  ResultCode: Integer;
+  Params: String;
+begin
+  Params := '-NoProfile -NonInteractive -ExecutionPolicy Bypass -File ' +
+    AddQuotes(ProcessStopScript) + ' -ExecutablePath ' + AddQuotes(ExecutablePath);
+  if IncludeDescendants then
+    Params := Params + ' -IncludeDescendants';
+  Exec(ExpandConstant('{sys}\WindowsPowerShell\v1.0\powershell.exe'), Params,
+    '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+end;
+
 // Stop services and processes before installation to avoid locked files
 function PrepareToInstall(var NeedsRestart: Boolean): String;
 var
   ResultCode: Integer;
+  ProcessStopScript: String;
 begin
   Result := '';
   // Stop the Sunshine service
   Exec('net', 'stop SunshineService', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  // Kill any running processes
-  Exec('taskkill', '/f /im sunshine.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  Exec('taskkill', '/f /im sunshine-gui.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
-  Exec('taskkill', '/f /im sunshinesvc.exe', '', SW_HIDE, ewWaitUntilTerminated, ResultCode);
+  // The new helper is embedded in the installer, so it is available before
+  // files from an older installation are replaced.
+  ExtractTemporaryFile('stop-process-tree.ps1');
+  ProcessStopScript := ExpandConstant('{tmp}\stop-process-tree.ps1');
+
+  StopProcessAtPath(ProcessStopScript, ExpandConstant('{app}\{#MyAppExeName}'), True);
+  // The GUI can be the updater's parent. Killing its tree would terminate this installer.
+  StopProcessAtPath(ProcessStopScript, ExpandConstant('{app}\assets\gui\{#MyAppGUIExeName}'), False);
+  StopProcessAtPath(ProcessStopScript, ExpandConstant('{app}\tools\sunshinesvc.exe'), True);
   // Small delay to allow processes to release files
   Sleep(1000);
 end;

docs/legal.md

@@ -14,6 +14,17 @@ contained within Sunshine. If you plan to sell access to Sunshine as part of the
 for obtaining the necessary licenses to do so. This may include obtaining a license from the
 Motion Picture Experts Group (MPEG-LA) and/or any other necessary licensing requirements.
 
+## Optional Remote Connection Runtime
+
+The remote connection feature can launch a separately installed
+[EasyTier](https://github.com/EasyTier/EasyTier) runtime. EasyTier and its Windows networking dependencies are not part
+of Sunshine and must not be copied into a Sunshine package without independently verifying and satisfying every
+applicable redistribution license. The Windows integration only discovers a complete EasyTier installation in the
+official installer's default, administrator-protected location.
+
+When the default remote connection peer is used, encrypted traffic may be relayed by an EasyTier community public
+node. Users are informed before enabling the feature and can configure a self-hosted peer instead.
+
 In summary, while Sunshine is free to use, it is the user's responsibility to ensure compliance with all applicable
 licensing requirements when redistributing the software as part of a commercial offering. If you have any questions or
 concerns about using Sunshine in a commercial setting, we recommend consulting with a lawyer.

src/config.cpp

@@ -29,6 +29,7 @@
 
 #include "display_device/parsed_config.h"
 #include "platform/common.h"
+#include "remote_connect/types.h"
 
 #ifdef _WIN32
   #include <shellapi.h>
@@ -530,6 +531,13 @@ namespace config {
 
     10,  // pair_max_attempts: default 10 attempts per IP per 60s
 
+    false,  // remote_connect_enabled
+    {},  // remote_connect_profile
+    {},  // remote_connect_virtual_ip
+    {},  // remote_connect_network_name
+    {},  // remote_connect_network_secret
+    remote_connect::default_peer,  // remote_connect_peer
+
     true,  // client_fingerprint_remote_rules
     "https://raw.githubusercontent.com/AlkaidLab/sunshine-client-fingerprint-rules/main/stable.json",
     {},  // client_fingerprint_rules_certificate (empty uses the pinned built-in certificate)
@@ -1191,7 +1199,8 @@ namespace config {
 
   void apply_config(std::unordered_map<std::string, std::string> &&vars) {
     for (auto &[name, val] : vars) {
-      const auto log_value = name == "file_mappings" && !val.empty() ? "<redacted>"s : val;
+      const bool sensitive = name == "file_mappings" || name == "remote_connect_network_secret";
+      const auto log_value = sensitive && !val.empty() ? "<redacted>"s : val;
       BOOST_LOG(info) << "config: '"sv << name << "' = "sv << log_value;
       modified_config_settings[name] = val;
     }
@@ -1462,6 +1471,12 @@ namespace config {
     list_string_f(vars, "fps"s, nvhttp.fps);
     int_between_f(vars, "sleep_mode", nvhttp.sleep_mode, { SLEEP_MODE_SUSPEND, SLEEP_MODE_AWAY });
     int_between_f(vars, "pair_max_attempts", nvhttp.pair_max_attempts, { 0, 50 });
+    bool_f(vars, "remote_connect_enabled", nvhttp.remote_connect_enabled);
+    string_f(vars, "remote_connect_profile", nvhttp.remote_connect_profile);
+    string_f(vars, "remote_connect_virtual_ip", nvhttp.remote_connect_virtual_ip);
+    string_f(vars, "remote_connect_network_name", nvhttp.remote_connect_network_name);
+    string_f(vars, "remote_connect_network_secret", nvhttp.remote_connect_network_secret);
+    string_f(vars, "remote_connect_peer", nvhttp.remote_connect_peer);
     bool_f(vars, "client_fingerprint_remote_rules", nvhttp.client_fingerprint_remote_rules);
     string_f(vars, "client_fingerprint_rules_url", nvhttp.client_fingerprint_rules_url);
     string_f(vars, "client_fingerprint_rules_certificate", nvhttp.client_fingerprint_rules_certificate);

src/config.h

@@ -194,6 +194,15 @@ namespace config {
 
     int pair_max_attempts;  // Max PIN pairing attempts per IP within 60s window. 0 disables limiting.
 
+    // Remote connection. The secret is generated locally and only leaves
+    // the host through an authenticated, short-lived pairing QR code.
+    bool remote_connect_enabled;
+    std::string remote_connect_profile;
+    std::string remote_connect_virtual_ip;
+    std::string remote_connect_network_name;
+    std::string remote_connect_network_secret;
+    std::string remote_connect_peer;
+
     // Signed, warning-only client fingerprint rule feed.
     bool client_fingerprint_remote_rules;
     std::string client_fingerprint_rules_url;

src/confighttp.cpp

@@ -8,24 +8,28 @@
 
 #include "process.h"
 
-#include <cstdint>
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cctype>
+#include <chrono>
 #include <cmath>
+#include <cstdint>
+#include <cstdio>
 #include <cstdlib>
+#include <ctime>
 #include <filesystem>
 #include <fstream>
 #include <iomanip>
-#include <algorithm>
-#include <atomic>
+#include <map>
 #include <mutex>
-#include <stdexcept>
 #include <random>
-#include <map>
 #include <set>
 #include <sstream>
-#include <cstdio>
-#include <ctime>
+#include <stdexcept>
 #include <thread>
 #include <utility>
+#include <vector>
 #include <openssl/evp.h>
 #include <openssl/sha.h>
 
@@ -36,6 +40,7 @@
 #include <boost/algorithm/string.hpp>
 
 #include <boost/filesystem.hpp>
+#include <boost/regex.hpp>
 #include <nlohmann/json.hpp>
 #include <Simple-Web-Server/crypto.hpp>
 #include <Simple-Web-Server/server_https.hpp>
@@ -60,6 +65,9 @@
 #include "perf_recorder.h"
 #include "platform/common.h"
 #include "platform/run_command.h"
+#include "remote_connect/api.h"
+#include "remote_connect/pairing.h"
+#include "remote_connect/service.h"
 #include "rtsp.h"
 #include "src/display_device/to_string.h"
 #include "src/tray/tray_http.h"
@@ -1916,6 +1924,29 @@ namespace confighttp {
     response->write(SimpleWeb::StatusCode::success_ok, content, headers);
   }
 
+  void
+  getRemoteConnectStatus(resp_https_t response, req_https_t request) {
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::get_status(std::move(response));
+  }
+
+  void
+  setRemoteConnectEnabled(resp_https_t response, req_https_t request) {
+    if (!check_content_type(response, request, "application/json")) return;
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::set_enabled(std::move(response), std::move(request));
+  }
+
+  void
+  resetRemoteConnect(resp_https_t response, req_https_t request) {
+    if (!check_content_type(response, request, "application/json")) return;
+    if (!authenticate(response, request)) return;
+    print_req(request);
+    remote_connect::api::reset_enrollment(std::move(response));
+  }
+
   void
   generateQrPairInfo(resp_https_t response, req_https_t request) {
     if (!authenticate(response, request)) return;
@@ -2013,19 +2044,28 @@ namespace confighttp {
       }
     }
 
-    // Build the moonlight:// URL
-    std::string url = "moonlight://pair?host=" + host +
-                      "&port=" + std::to_string(port) +
-                      "&pin=" + pin +
-                      "&name=" + server_name;
+    const auto pairing = remote_connect::create_pairing_invite({
+      std::move(host),
+      static_cast<std::uint16_t>(port),
+      pin,
+      server_name,
+      std::time(nullptr) + 120,
+    });
+    if (!pairing.success) {
+      outputTree.put("status", false);
+      outputTree.put("error", pairing.error);
+      return;
+    }
+    host = pairing.host;
 
     outputTree.put("status", true);
     outputTree.put("pin", pin);
     outputTree.put("host", host);
     outputTree.put("port", port);
     outputTree.put("name", server_name);
-    outputTree.put("url", url);
+    outputTree.put("url", pairing.url);
     outputTree.put("expires_in", 120);
+    outputTree.put("remote_connect", pairing.remote);
   }
 
   void
@@ -3780,6 +3820,7 @@ namespace confighttp {
 
   void
   start() {
+    remote_connect::start_if_enabled();
     auto shutdown_event = mail::man->event<bool>(mail::shutdown);
 
     auto port_https = net::map_port(PORT_HTTPS);
@@ -3799,6 +3840,9 @@ namespace confighttp {
     server.resource["^/api/qr-pair$"]["POST"] = generateQrPairInfo;
     server.resource["^/api/qr-pair/cancel$"]["POST"] = cancelQrPair;
     server.resource["^/api/qr-pair$"]["GET"] = getQrPairStatus;
+    server.resource["^/api/remote-connect$"]["GET"] = getRemoteConnectStatus;
+    server.resource["^/api/remote-connect$"]["POST"] = setRemoteConnectEnabled;
+    server.resource["^/api/remote-connect/reset$"]["POST"] = resetRemoteConnect;
     server.resource["^/api/apps$"]["GET"] = getApps;
     server.resource["^/api/logs$"]["GET"] = getLogs;
     server.resource["^/api/apps$"]["POST"] = saveApp;
@@ -3914,6 +3958,7 @@ namespace confighttp {
     shutdown_event->view();
 
     server.stop();
+    remote_connect::stop();
 
     tcp.join();
   }

src/nvhttp/url_utils.cpp

@@ -1,9 +1,27 @@
 #include "url_utils.h"
 
 #include <cctype>
+#include <iomanip>
+#include <sstream>
 
 namespace nvhttp::url_utils {
 
+  std::string
+  encode(const std::string &value) {
+    std::ostringstream encoded;
+    encoded << std::hex << std::uppercase;
+    for (const auto ch : value) {
+      const auto c = static_cast<unsigned char>(ch);
+      if (std::isalnum(c) || c == '-' || c == '_' || c == '.' || c == '~') {
+        encoded << ch;
+      }
+      else {
+        encoded << '%' << std::setw(2) << std::setfill('0') << static_cast<int>(c);
+      }
+    }
+    return encoded.str();
+  }
+
   std::string
   decode(std::string value) {
     std::string decoded;

src/nvhttp/url_utils.h

@@ -4,6 +4,9 @@
 
 namespace nvhttp::url_utils {
 
+  std::string
+  encode(const std::string &value);
+
   std::string
   decode(std::string value);