From c18be254b23dee05fd31527c6c5708b75e1082b9 Mon Sep 17 00:00:00 2001
From: Nick Haghiri <ElCruncharino@users.noreply.gitlab.gnome.org>
Date: Fri, 23 Oct 2026 12:30:15 -0400
Subject: [PATCH 1/4] freerdp: optional microphone input

---
 app/src/main/AndroidManifest.xml              |  1 +
 .../remotedesktop/SessionActivity.java        | 75 ++++++++++++++++++-
 backends/freerdp/src/main/cpp/freerdp_jni.c   |  9 ++-
 .../backend/freerdp/FreeRdpBackend.java       |  2 +-
 .../backend/freerdp/FreeRdpNative.java        |  5 +-
 .../backend/freerdp/FreeRdpProvider.java      |  8 ++
 6 files changed, 95 insertions(+), 5 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 7f3f94c1..75323f37 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -25,6 +25,7 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
 
     <!--
         The lock screen in front of an export that carries the saved passwords
diff --git a/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java b/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
index ac6ade45..e7dcb70c 100644
--- a/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
+++ b/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
@@ -31,6 +31,7 @@
 import net.pgaskin.remotedesktop.control.input.TapRegions;
 import net.pgaskin.remotedesktop.session.SessionView;
 
+import java.util.HashMap;
 import java.util.Map;
 
 /**
@@ -161,6 +162,9 @@ protected void onCreate(Bundle savedInstanceState) {
      * are here as well.
      */
     private void start(String address, String backendId) {
+        if (awaitingMicrophone(connectionOptions(), () -> start(address, backendId))) {
+            return;
+        }
         try {
             session = openOrAttach(address);
         } catch (Throwable t) {
@@ -359,6 +363,26 @@ private String sessionKey(String address) {
                 : Sessions.keyForAddress(address);
     }
 
+    /** What the connection asks for, as saved or as given on the command line. */
+    private Map<String, String> connectionOptions() {
+        return connection != null ? Options.forConnection(this, connection) : optionsFromIntent();
+    }
+
+    /**
+     * What the backend is built with: the requested options, except that a
+     * microphone the phone has not been allowed to use is off rather than
+     * requested. A refused microphone is a session without one, not no session.
+     */
+    private Map<String, String> sessionOptions() {
+        final Map<String, String> options = connectionOptions();
+        if (!microphoneWanted(options) || microphoneGranted()) {
+            return options;
+        }
+        final Map<String, String> without = new HashMap<>(options);
+        without.put(MICROPHONE_OPTION, "false");
+        return without;
+    }
+
     private Session openOrAttach(String address) {
         final Session live = Sessions.byKey(sessionKey(address));
         if (live != null && !live.isClosed()) {
@@ -367,8 +391,7 @@ private Session openOrAttach(String address) {
         // A saved connection carries its own options, layered over its backend's;
         // an address from the command line gets the defaults. The application
         // context, because the backend outlives this activity by design.
-        final Map<String, String> options = connection != null
-                ? Options.forConnection(this, connection) : optionsFromIntent();
+        final Map<String, String> options = sessionOptions();
         final Backend backend = Backends.create(getApplicationContext(), backendId(), address,
                 connection != null ? connection.userName() : getIntent().getStringExtra("user"),
                 connection != null ? connection.password()
@@ -408,6 +431,54 @@ private void askAboutNotifications() {
         }
     }
 
+    /** The backend option that sends the microphone; read by name, as FreeRDP's provider names it. */
+    private static final String MICROPHONE_OPTION = "Microphone";
+    private static final int REQUEST_MICROPHONE = 2;
+
+    /** Asked once per window, so a refusal does not come back on every connect. */
+    private boolean askedForMicrophone;
+    /** What to do once the microphone question has been answered. */
+    private Runnable afterMicrophone;
+
+    private boolean microphoneWanted(Map<String, String> options) {
+        return "true".equals(options.get(MICROPHONE_OPTION));
+    }
+
+    private boolean microphoneGranted() {
+        return checkSelfPermission(android.Manifest.permission.RECORD_AUDIO)
+                == android.content.pm.PackageManager.PERMISSION_GRANTED;
+    }
+
+    /**
+     * The connection is opened as soon as the session starts, and the capture
+     * device with it, so a connection that wants the microphone waits for the
+     * answer. Returns true when it is waiting, and then {@code then} runs once
+     * the answer is in, whichever it was.
+     */
+    private boolean awaitingMicrophone(Map<String, String> options, Runnable then) {
+        if (!microphoneWanted(options) || microphoneGranted() || askedForMicrophone) {
+            return false;
+        }
+        askedForMicrophone = true;
+        afterMicrophone = then;
+        requestPermissions(new String[]{android.Manifest.permission.RECORD_AUDIO},
+                REQUEST_MICROPHONE);
+        return true;
+    }
+
+    @Override
+    public void onRequestPermissionsResult(int requestCode, String[] permissions,
+                                           int[] grantResults) {
+        super.onRequestPermissionsResult(requestCode, permissions, grantResults);
+        if (requestCode == REQUEST_MICROPHONE && afterMicrophone != null) {
+            // A refusal is not an error here: the session starts without the
+            // microphone, which openOrAttach arranges.
+            final Runnable then = afterMicrophone;
+            afterMicrophone = null;
+            then.run();
+        }
+    }
+
     /**
      * Focus is told to the backend on the way <em>up</em> only, and from here
      * rather than from {@link #onStart}, because of the clipboard: the core
diff --git a/backends/freerdp/src/main/cpp/freerdp_jni.c b/backends/freerdp/src/main/cpp/freerdp_jni.c
index 2b839362..4b7c5264 100644
--- a/backends/freerdp/src/main/cpp/freerdp_jni.c
+++ b/backends/freerdp/src/main/cpp/freerdp_jni.c
@@ -190,6 +190,7 @@ struct Session {
     char *experience;
     char *graphics;
     char *sound;
+    int microphone;
     char *clientName;
     char *configPath;
     int width, height, monitors, keyboardLayout;
@@ -1600,6 +1601,10 @@ static void applySettings(Session *s, rdpSettings *settings) {
     const int soundThere = s->sound && strcmp(s->sound, "remote") == 0;
     freerdp_settings_set_bool(settings, FreeRDP_AudioPlayback, soundHere);
     freerdp_settings_set_bool(settings, FreeRDP_RemoteConsoleAudio, soundThere);
+    /* The microphone is the audin channel's capture side, which the library
+       opens through OpenSL ES. The app checks RECORD_AUDIO before it gets here,
+       since the capture device cannot be opened without it. */
+    freerdp_settings_set_bool(settings, FreeRDP_AudioCapture, s->microphone);
 
     /* How big the far end draws its own interface. The protocol allows 100–500
        for the desktop factor and exactly 100, 140 or 180 for the device one,
@@ -1785,7 +1790,8 @@ JNIEXPORT jlong JNICALL
 Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
         JNIEnv *env, jclass cls, jobject listener, jstring address, jstring userName,
         jstring domain, jstring password, jstring nla, jboolean legacyTls, jboolean compression,
-        jstring graphics, jstring experience, jstring sound, jint scale, jint width, jint height,
+        jstring graphics, jstring experience, jstring sound, jboolean microphone, jint scale,
+        jint width, jint height,
         jint monitors, jint keyboardLayout, jstring clientName, jstring configPath,
         jint connectTimeoutMs) {
     (void) cls;
@@ -1836,6 +1842,7 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
     s->graphics = dup_jstring(env, graphics);
     s->experience = dup_jstring(env, experience);
     s->sound = dup_jstring(env, sound);
+    s->microphone = microphone != JNI_FALSE;
     s->clientName = dup_jstring(env, clientName);
     s->configPath = dup_jstring(env, configPath);
     s->compression = compression != JNI_FALSE;
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
index e6e3cba1..ce47030e 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
@@ -184,7 +184,7 @@ public void connect() {
                 options.get(FreeRdpProvider.NLA), bool(FreeRdpProvider.LEGACY_TLS),
                 bool(FreeRdpProvider.COMPRESSION),
                 options.get(FreeRdpProvider.GRAPHICS), options.get(FreeRdpProvider.EXPERIENCE),
-                options.get(FreeRdpProvider.SOUND), scale(),
+                options.get(FreeRdpProvider.SOUND), bool(FreeRdpProvider.MICROPHONE), scale(),
                 size[0], size[1], monitorCount(), KEYBOARD_LAYOUT,
                 android.os.Build.MODEL, store.getAbsolutePath(), CONNECT_TIMEOUT_MS);
         if (h == 0) {
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
index 0b0c648e..703540e5 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
@@ -104,6 +104,8 @@ interface Callbacks {
      *                   {@code bitmap}
      * @param experience {@code full}, {@code balanced} or {@code plain}
      * @param sound      {@code off}, {@code local} or {@code remote}
+     * @param microphone send this phone's microphone; the caller only passes
+     *                   true once RECORD_AUDIO is granted
      * @param scale      the percentage the far end is asked to draw its own
      *                   interface at; 100, 140 and 180 are the only values the
      *                   protocol allows, and anything else is taken as 100
@@ -114,7 +116,8 @@ interface Callbacks {
     static native long nativeCreate(Callbacks listener, String address, String userName,
                                     String domain, String password, String nla,
                                     boolean legacyTls, boolean compression, String graphics,
-                                    String experience, String sound, int scale, int width,
+                                    String experience, String sound, boolean microphone,
+                                    int scale, int width,
                                     int height, int monitors, int keyboardLayout,
                                     String clientName, String configPath, int connectTimeoutMs);
 
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
index 0633fcf9..6620b2bd 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
@@ -68,6 +68,11 @@ public final class FreeRdpProvider implements BackendProvider {
     public static final String GRAPHICS = "Graphics";
     public static final String EXPERIENCE = "Experience";
     public static final String SOUND = "Sound";
+    /**
+     * The app asks for RECORD_AUDIO before connecting when this is on, and
+     * reads the key by name, so it has to stay "Microphone".
+     */
+    public static final String MICROPHONE = "Microphone";
     public static final String COMPRESSION = "Compression";
     public static final String VIEW_ONLY = "ViewOnly";
 
@@ -133,6 +138,9 @@ public final class FreeRdpProvider implements BackendProvider {
                     new Choice("off", "Off"),
                     new Choice("local", "This phone"),
                     new Choice("remote", "The remote machine")),
+            BackendOption.bool(MICROPHONE, "Microphone",
+                    "Send this phone's microphone to the remote machine. Android asks for permission before connecting.",
+                    false, Scope.CONNECTION, false),
             BackendOption.bool(COMPRESSION, "Compression",
                     "Enable connection-level compression. Uses less bandwidth, but more CPU.",
                     true, Scope.LAYERED, false),

From 3a8602d1dbbbd4b8b2776d7ec863069755c63876 Mon Sep 17 00:00:00 2001
From: Nick Haghiri <ElCruncharino@users.noreply.gitlab.gnome.org>
Date: Fri, 23 Oct 2026 12:45:49 -0400
Subject: [PATCH 2/4] freerdp: rd gateway over https

---
 backends/freerdp/src/main/cpp/freerdp_jni.c   | 82 +++++++++++++++++--
 .../backend/freerdp/FreeRdpBackend.java       | 14 ++--
 .../backend/freerdp/FreeRdpNative.java        |  7 +-
 .../backend/freerdp/FreeRdpProvider.java      |  5 ++
 4 files changed, 93 insertions(+), 15 deletions(-)

diff --git a/backends/freerdp/src/main/cpp/freerdp_jni.c b/backends/freerdp/src/main/cpp/freerdp_jni.c
index 4b7c5264..58456712 100644
--- a/backends/freerdp/src/main/cpp/freerdp_jni.c
+++ b/backends/freerdp/src/main/cpp/freerdp_jni.c
@@ -191,6 +191,8 @@ struct Session {
     char *graphics;
     char *sound;
     int microphone;
+    char *gatewayHost; /* NULL for a direct connection */
+    int gatewayPort;
     char *clientName;
     char *configPath;
     int width, height, monitors, keyboardLayout;
@@ -954,19 +956,29 @@ static BOOL onAuthenticate(freerdp *instance, char **username, char **password,
 
    1 rather than 2 deliberately: 2 is "remember this", which would put the
    decision in a file of FreeRDP's beside the one this app already keeps. */
-static DWORD askTrust(Session *s, const char *fingerprint) {
+static DWORD askTrust(Session *s, const char *fingerprint, const char *host, UINT16 port) {
     pthread_mutex_lock(&s->lock);
     s->trustAnswered = 0;
     s->trustAccepted = 0;
     pthread_mutex_unlock(&s->lock);
 
+    /* The library asks for the gateway's certificate with the gateway's name, so
+       a host that is the gateway is the gateway's question. Java keeps its pin
+       under a different key, and the target's pins stay where they were. */
+    const int viaGateway = s->gatewayHost && host && strcmp(host, s->gatewayHost) == 0;
+    char hostPort[300];
+    snprintf(hostPort, sizeof(hostPort), "%s:%u", host ? host : "", (unsigned) port);
+
     int attached;
     JNIEnv *env = attach(s, &attached);
     if (env) {
         jstring js = (*env)->NewStringUTF(env, fingerprint ? fingerprint : "");
-        (*env)->CallVoidMethod(env, s->callbacks, mTrustNeeded, js);
+        jstring jhp = (*env)->NewStringUTF(env, hostPort);
+        (*env)->CallVoidMethod(env, s->callbacks, mTrustNeeded, js,
+                               viaGateway ? JNI_TRUE : JNI_FALSE, jhp);
         cleared(env);
         (*env)->DeleteLocalRef(env, js);
+        (*env)->DeleteLocalRef(env, jhp);
         detach(s, attached);
     }
 
@@ -982,8 +994,8 @@ static DWORD askTrust(Session *s, const char *fingerprint) {
 static DWORD onVerifyCertificate(freerdp *instance, const char *host, UINT16 port,
                                  const char *common_name, const char *subject, const char *issuer,
                                  const char *fingerprint, DWORD flags) {
-    (void) host; (void) port; (void) common_name; (void) subject; (void) issuer; (void) flags;
-    return askTrust(sessionOf(instance->context), fingerprint);
+    (void) common_name; (void) subject; (void) issuer; (void) flags;
+    return askTrust(sessionOf(instance->context), fingerprint, host, port);
 }
 
 /* Not the same question, and leaving it unset is a refusal: this is the one
@@ -994,9 +1006,9 @@ static DWORD onVerifyChangedCertificate(freerdp *instance, const char *host, UIN
                                         const char *issuer, const char *fingerprint,
                                         const char *old_subject, const char *old_issuer,
                                         const char *old_fingerprint, DWORD flags) {
-    (void) host; (void) port; (void) common_name; (void) subject; (void) issuer;
+    (void) common_name; (void) subject; (void) issuer;
     (void) old_subject; (void) old_issuer; (void) old_fingerprint; (void) flags;
-    return askTrust(sessionOf(instance->context), fingerprint);
+    return askTrust(sessionOf(instance->context), fingerprint, host, port);
 }
 
 /* ---- keysyms to scancodes ----------------------------------------------- */
@@ -1491,6 +1503,39 @@ static void onPostDisconnect(freerdp *instance) {
     gdi_free(instance);
 }
 
+/* "host" or "host:port", with 443 when there is no port. Empty is a direct
+   connection. IPv6 literals are not taken: a colon in the host is the port. */
+static void parseGateway(Session *s, const char *text) {
+    s->gatewayHost = NULL;
+    s->gatewayPort = 443;
+    if (!text || !*text) {
+        return;
+    }
+    size_t hostLen = strlen(text);
+    const char *colon = strrchr(text, ':');
+    if (colon && colon[1] != '\0') {
+        int digits = 1;
+        for (const char *p = colon + 1; *p; p++) {
+            if (*p < '0' || *p > '9') {
+                digits = 0;
+            }
+        }
+        const long port = digits ? strtol(colon + 1, NULL, 10) : 0;
+        if (digits && port > 0 && port <= 65535) {
+            hostLen = (size_t) (colon - text);
+            s->gatewayPort = (int) port;
+        }
+    }
+    if (hostLen == 0) {
+        return;
+    }
+    s->gatewayHost = malloc(hostLen + 1);
+    if (s->gatewayHost) {
+        memcpy(s->gatewayHost, text, hostLen);
+        s->gatewayHost[hostLen] = '\0';
+    }
+}
+
 static void applySettings(Session *s, rdpSettings *settings) {
     freerdp_settings_set_string(settings, FreeRDP_ServerHostname, s->host);
     freerdp_settings_set_uint32(settings, FreeRDP_ServerPort, (UINT32) s->port);
@@ -1606,6 +1651,20 @@ static void applySettings(Session *s, rdpSettings *settings) {
        since the capture device cannot be opened without it. */
     freerdp_settings_set_bool(settings, FreeRDP_AudioCapture, s->microphone);
 
+    /* RD Gateway, over HTTPS only (the RPC transport is the old one). The gateway
+       takes the connection's own credentials, so there is nothing separate to
+       store. TSC_PROXY_MODE_DIRECT means always use it, where the detect mode
+       would only use it when the direct route fails. */
+    freerdp_settings_set_bool(settings, FreeRDP_GatewayEnabled, s->gatewayHost != NULL);
+    if (s->gatewayHost) {
+        freerdp_settings_set_string(settings, FreeRDP_GatewayHostname, s->gatewayHost);
+        freerdp_settings_set_uint32(settings, FreeRDP_GatewayPort, (UINT32) s->gatewayPort);
+        freerdp_settings_set_uint32(settings, FreeRDP_GatewayUsageMethod, TSC_PROXY_MODE_DIRECT);
+        freerdp_settings_set_bool(settings, FreeRDP_GatewayUseSameCredentials, TRUE);
+        freerdp_settings_set_bool(settings, FreeRDP_GatewayHttpTransport, TRUE);
+        freerdp_settings_set_bool(settings, FreeRDP_GatewayRpcTransport, FALSE);
+    }
+
     /* How big the far end draws its own interface. The protocol allows 100–500
        for the desktop factor and exactly 100, 140 or 180 for the device one,
        and a value outside either range makes a server ignore both — which is
@@ -1790,7 +1849,8 @@ JNIEXPORT jlong JNICALL
 Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
         JNIEnv *env, jclass cls, jobject listener, jstring address, jstring userName,
         jstring domain, jstring password, jstring nla, jboolean legacyTls, jboolean compression,
-        jstring graphics, jstring experience, jstring sound, jboolean microphone, jint scale,
+        jstring graphics, jstring experience, jstring sound, jboolean microphone,
+        jstring gateway, jint scale,
         jint width, jint height,
         jint monitors, jint keyboardLayout, jstring clientName, jstring configPath,
         jint connectTimeoutMs) {
@@ -1805,7 +1865,8 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
         mBell = (*env)->GetMethodID(env, k, "onBell", "()V");
         mClipboard = (*env)->GetMethodID(env, k, "onClipboard", "(Ljava/lang/String;)V");
         mCredentialsNeeded = (*env)->GetMethodID(env, k, "onCredentialsNeeded", "(Z)V");
-        mTrustNeeded = (*env)->GetMethodID(env, k, "onTrustNeeded", "(Ljava/lang/String;)V");
+        mTrustNeeded = (*env)->GetMethodID(env, k, "onTrustNeeded",
+                                           "(Ljava/lang/String;ZLjava/lang/String;)V");
         mClosed = (*env)->GetMethodID(env, k, "onClosed", "(Ljava/lang/String;)V");
         /* Last, and that is the point: it is what every other caller tests, so
            publishing it first would let a second one past while the method ids
@@ -1843,6 +1904,9 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
     s->experience = dup_jstring(env, experience);
     s->sound = dup_jstring(env, sound);
     s->microphone = microphone != JNI_FALSE;
+    char *gatewayText = dup_jstring(env, gateway);
+    parseGateway(s, gatewayText);
+    free(gatewayText);
     s->clientName = dup_jstring(env, clientName);
     s->configPath = dup_jstring(env, configPath);
     s->compression = compression != JNI_FALSE;
@@ -1903,6 +1967,7 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
     free(s->graphics);
     free(s->experience);
     free(s->sound);
+    free(s->gatewayHost);
     free(s->clientName);
     free(s->configPath);
     free(s);
@@ -2015,6 +2080,7 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeDestroy(
     free(s->graphics);
     free(s->experience);
     free(s->sound);
+    free(s->gatewayHost);
     free(s->clientName);
     free(s->configPath);
     free(s->credUser);
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
index ce47030e..00a059f3 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
@@ -184,7 +184,8 @@ public void connect() {
                 options.get(FreeRdpProvider.NLA), bool(FreeRdpProvider.LEGACY_TLS),
                 bool(FreeRdpProvider.COMPRESSION),
                 options.get(FreeRdpProvider.GRAPHICS), options.get(FreeRdpProvider.EXPERIENCE),
-                options.get(FreeRdpProvider.SOUND), bool(FreeRdpProvider.MICROPHONE), scale(),
+                options.get(FreeRdpProvider.SOUND), bool(FreeRdpProvider.MICROPHONE),
+                options.getOrDefault(FreeRdpProvider.GATEWAY, ""), scale(),
                 size[0], size[1], monitorCount(), KEYBOARD_LAYOUT,
                 android.os.Build.MODEL, store.getAbsolutePath(), CONNECT_TIMEOUT_MS);
         if (h == 0) {
@@ -540,13 +541,16 @@ protected void deliver(boolean ok, String user, String secret) {
      * what is identified is the machine, not what reaches it.
      */
     @Override
-    public void onTrustNeeded(String fingerprint) {
-        if (KnownHosts.matches(context, address, fingerprint)) {
-            Log.i(TAG, "certificate matches the pin for " + address);
+    public void onTrustNeeded(String fingerprint, boolean gateway, String hostPort) {
+        // The gateway is a different machine with its own certificate, so it is
+        // pinned under its own name; the target keeps the address it was saved under.
+        final String key = gateway ? "RD Gateway " + hostPort : address;
+        if (KnownHosts.matches(context, key, fingerprint)) {
+            Log.i(TAG, "certificate matches the pin for " + key);
             answerTrust(true);
             return;
         }
-        main.post(() -> KnownHosts.ask(context, address, fingerprint, prompts, this::answerTrust));
+        main.post(() -> KnownHosts.ask(context, key, fingerprint, prompts, this::answerTrust));
     }
 
     private void answerTrust(boolean accept) {
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
index 703540e5..fe04d9c6 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
@@ -82,8 +82,10 @@ interface Callbacks {
          * secret is sent.
          *
          * @param fingerprint SHA-256, as {@code openssl x509 -fingerprint} prints it
+         * @param gateway    the certificate is the RD Gateway's, not the machine's
+         * @param hostPort   the host and port the certificate was presented for
          */
-        void onTrustNeeded(String fingerprint);
+        void onTrustNeeded(String fingerprint, boolean gateway, String hostPort);
 
         /** Terminal. Empty {@code detail} for an ordinary disconnect. */
         void onClosed(String detail);
@@ -106,6 +108,7 @@ interface Callbacks {
      * @param sound      {@code off}, {@code local} or {@code remote}
      * @param microphone send this phone's microphone; the caller only passes
      *                   true once RECORD_AUDIO is granted
+     * @param gateway    an RD Gateway as host or host:port; empty for none
      * @param scale      the percentage the far end is asked to draw its own
      *                   interface at; 100, 140 and 180 are the only values the
      *                   protocol allows, and anything else is taken as 100
@@ -117,7 +120,7 @@ static native long nativeCreate(Callbacks listener, String address, String userN
                                     String domain, String password, String nla,
                                     boolean legacyTls, boolean compression, String graphics,
                                     String experience, String sound, boolean microphone,
-                                    int scale, int width,
+                                    String gateway, int scale, int width,
                                     int height, int monitors, int keyboardLayout,
                                     String clientName, String configPath, int connectTimeoutMs);
 
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
index 6620b2bd..afbb0159 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
@@ -73,6 +73,8 @@ public final class FreeRdpProvider implements BackendProvider {
      * reads the key by name, so it has to stay "Microphone".
      */
     public static final String MICROPHONE = "Microphone";
+    /** An RD Gateway as host or host:port; empty connects directly. */
+    public static final String GATEWAY = "Gateway";
     public static final String COMPRESSION = "Compression";
     public static final String VIEW_ONLY = "ViewOnly";
 
@@ -141,6 +143,9 @@ public final class FreeRdpProvider implements BackendProvider {
             BackendOption.bool(MICROPHONE, "Microphone",
                     "Send this phone's microphone to the remote machine. Android asks for permission before connecting.",
                     false, Scope.CONNECTION, false),
+            BackendOption.text(GATEWAY, "RD Gateway",
+                    "Reach this machine through an RD Gateway, as host or host:port (443 if no port). The connection's own username and password are used for it. Leave empty to connect directly.",
+                    "", Scope.CONNECTION, false),
             BackendOption.bool(COMPRESSION, "Compression",
                     "Enable connection-level compression. Uses less bandwidth, but more CPU.",
                     true, Scope.LAYERED, false),

From 2ccbb1e2f7867d0b26ba6fde1db9c541b2ba0693 Mon Sep 17 00:00:00 2001
From: Nick Haghiri <ElCruncharino@users.noreply.gitlab.gnome.org>
Date: Fri, 23 Oct 2026 15:14:51 -0400
Subject: [PATCH 3/4] simplified the gateway port parsing

strtol's end pointer says whether the whole thing was a number, so the digit loop isn't needed.
---
 backends/freerdp/src/main/cpp/freerdp_jni.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/backends/freerdp/src/main/cpp/freerdp_jni.c b/backends/freerdp/src/main/cpp/freerdp_jni.c
index 58456712..e0c21ddb 100644
--- a/backends/freerdp/src/main/cpp/freerdp_jni.c
+++ b/backends/freerdp/src/main/cpp/freerdp_jni.c
@@ -1513,18 +1513,11 @@ static void parseGateway(Session *s, const char *text) {
     }
     size_t hostLen = strlen(text);
     const char *colon = strrchr(text, ':');
-    if (colon && colon[1] != '\0') {
-        int digits = 1;
-        for (const char *p = colon + 1; *p; p++) {
-            if (*p < '0' || *p > '9') {
-                digits = 0;
-            }
-        }
-        const long port = digits ? strtol(colon + 1, NULL, 10) : 0;
-        if (digits && port > 0 && port <= 65535) {
-            hostLen = (size_t) (colon - text);
-            s->gatewayPort = (int) port;
-        }
+    char *end = NULL;
+    const long port = colon ? strtol(colon + 1, &end, 10) : 0;
+    if (colon && end && end != colon + 1 && *end == '\0' && port > 0 && port <= 65535) {
+        hostLen = (size_t) (colon - text);
+        s->gatewayPort = (int) port;
     }
     if (hostLen == 0) {
         return;

From 4bfd2ae36e8f261f95de9535576a9e21df467316 Mon Sep 17 00:00:00 2001
From: Nick Haghiri <ElCruncharino@users.noreply.gitlab.gnome.org>
Date: Fri, 23 Oct 2026 12:48:43 -0400
Subject: [PATCH 4/4] freerdp: optional camera redirection

---
 app/src/main/AndroidManifest.xml              |  1 +
 .../remotedesktop/SessionActivity.java        | 73 +++++++++++--------
 backends/freerdp/src/main/cpp/freerdp_jni.c   | 14 +++-
 .../backend/freerdp/FreeRdpBackend.java       |  1 +
 .../backend/freerdp/FreeRdpNative.java        |  4 +-
 .../backend/freerdp/FreeRdpProvider.java      |  8 ++
 6 files changed, 69 insertions(+), 32 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 75323f37..36c771a3 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -26,6 +26,7 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <uses-permission android:name="android.permission.CAMERA" />
 
     <!--
         The lock screen in front of an export that carries the saved passwords
diff --git a/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java b/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
index e7dcb70c..62593652 100644
--- a/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
+++ b/app/src/main/java/net/pgaskin/remotedesktop/SessionActivity.java
@@ -162,7 +162,12 @@ protected void onCreate(Bundle savedInstanceState) {
      * are here as well.
      */
     private void start(String address, String backendId) {
-        if (awaitingMicrophone(connectionOptions(), () -> start(address, backendId))) {
+        final Map<String, String> wanted = connectionOptions();
+        final Runnable again = () -> start(address, backendId);
+        if (awaitingPermission(wanted, MICROPHONE_OPTION,
+                android.Manifest.permission.RECORD_AUDIO, REQUEST_MICROPHONE, again)
+                || awaitingPermission(wanted, CAMERA_OPTION,
+                android.Manifest.permission.CAMERA, REQUEST_CAMERA, again)) {
             return;
         }
         try {
@@ -370,16 +375,19 @@ private Map<String, String> connectionOptions() {
 
     /**
      * What the backend is built with: the requested options, except that a
-     * microphone the phone has not been allowed to use is off rather than
-     * requested. A refused microphone is a session without one, not no session.
+     * microphone or camera the phone has not been allowed to use is off rather
+     * than requested. A refused device is a session without it, not no session.
      */
     private Map<String, String> sessionOptions() {
         final Map<String, String> options = connectionOptions();
-        if (!microphoneWanted(options) || microphoneGranted()) {
-            return options;
-        }
         final Map<String, String> without = new HashMap<>(options);
-        without.put(MICROPHONE_OPTION, "false");
+        if (wanted(options, MICROPHONE_OPTION)
+                && !granted(android.Manifest.permission.RECORD_AUDIO)) {
+            without.put(MICROPHONE_OPTION, "false");
+        }
+        if (wanted(options, CAMERA_OPTION) && !granted(android.Manifest.permission.CAMERA)) {
+            without.put(CAMERA_OPTION, "false");
+        }
         return without;
     }
 
@@ -431,38 +439,44 @@ private void askAboutNotifications() {
         }
     }
 
-    /** The backend option that sends the microphone; read by name, as FreeRDP's provider names it. */
+    /*
+     * The backend options that send the microphone and the camera, read by name
+     * as FreeRDP's provider names them. Each needs a permission from Android, and
+     * the connection is opened as soon as the session starts, with the device, so
+     * a connection that wants one waits for the answer.
+     */
     private static final String MICROPHONE_OPTION = "Microphone";
+    private static final String CAMERA_OPTION = "Camera";
     private static final int REQUEST_MICROPHONE = 2;
+    private static final int REQUEST_CAMERA = 3;
 
     /** Asked once per window, so a refusal does not come back on every connect. */
-    private boolean askedForMicrophone;
-    /** What to do once the microphone question has been answered. */
-    private Runnable afterMicrophone;
+    private final java.util.Set<Integer> askedForPermission = new java.util.HashSet<>();
+    /** What to do once the permission question has been answered. */
+    private Runnable afterPermission;
 
-    private boolean microphoneWanted(Map<String, String> options) {
-        return "true".equals(options.get(MICROPHONE_OPTION));
+    private boolean wanted(Map<String, String> options, String option) {
+        return "true".equals(options.get(option));
     }
 
-    private boolean microphoneGranted() {
-        return checkSelfPermission(android.Manifest.permission.RECORD_AUDIO)
+    private boolean granted(String permission) {
+        return checkSelfPermission(permission)
                 == android.content.pm.PackageManager.PERMISSION_GRANTED;
     }
 
     /**
-     * The connection is opened as soon as the session starts, and the capture
-     * device with it, so a connection that wants the microphone waits for the
-     * answer. Returns true when it is waiting, and then {@code then} runs once
-     * the answer is in, whichever it was.
+     * Returns true when the window is waiting for an answer to a permission
+     * this connection needs, and then {@code then} runs once it is in, whichever
+     * it was. A refusal is not an error: the session starts without the device.
      */
-    private boolean awaitingMicrophone(Map<String, String> options, Runnable then) {
-        if (!microphoneWanted(options) || microphoneGranted() || askedForMicrophone) {
+    private boolean awaitingPermission(Map<String, String> options, String option,
+                                       String permission, int request, Runnable then) {
+        if (!wanted(options, option) || granted(permission)
+                || !askedForPermission.add(request)) {
             return false;
         }
-        askedForMicrophone = true;
-        afterMicrophone = then;
-        requestPermissions(new String[]{android.Manifest.permission.RECORD_AUDIO},
-                REQUEST_MICROPHONE);
+        afterPermission = then;
+        requestPermissions(new String[]{permission}, request);
         return true;
     }
 
@@ -470,11 +484,10 @@ private boolean awaitingMicrophone(Map<String, String> options, Runnable then) {
     public void onRequestPermissionsResult(int requestCode, String[] permissions,
                                            int[] grantResults) {
         super.onRequestPermissionsResult(requestCode, permissions, grantResults);
-        if (requestCode == REQUEST_MICROPHONE && afterMicrophone != null) {
-            // A refusal is not an error here: the session starts without the
-            // microphone, which openOrAttach arranges.
-            final Runnable then = afterMicrophone;
-            afterMicrophone = null;
+        if ((requestCode == REQUEST_MICROPHONE || requestCode == REQUEST_CAMERA)
+                && afterPermission != null) {
+            final Runnable then = afterPermission;
+            afterPermission = null;
             then.run();
         }
     }
diff --git a/backends/freerdp/src/main/cpp/freerdp_jni.c b/backends/freerdp/src/main/cpp/freerdp_jni.c
index e0c21ddb..0a4f7357 100644
--- a/backends/freerdp/src/main/cpp/freerdp_jni.c
+++ b/backends/freerdp/src/main/cpp/freerdp_jni.c
@@ -191,6 +191,7 @@ struct Session {
     char *graphics;
     char *sound;
     int microphone;
+    int camera;
     char *gatewayHost; /* NULL for a direct connection */
     int gatewayPort;
     char *clientName;
@@ -1644,6 +1645,16 @@ static void applySettings(Session *s, rdpSettings *settings) {
        since the capture device cannot be opened without it. */
     freerdp_settings_set_bool(settings, FreeRDP_AudioCapture, s->microphone);
 
+    /* The camera is the rdpecam dynamic channel, which the library adds by name
+       the same way its own client does with /dvc:rdpecam. Its Android backend
+       is the Camera2 NDK, and the app has checked CAMERA before it gets here. */
+    if (s->camera) {
+        static const char *const cameraChannel[] = {"rdpecam"};
+        if (!freerdp_client_add_dynamic_channel(settings, 1, cameraChannel)) {
+            LOGW("could not add the camera channel");
+        }
+    }
+
     /* RD Gateway, over HTTPS only (the RPC transport is the old one). The gateway
        takes the connection's own credentials, so there is nothing separate to
        store. TSC_PROXY_MODE_DIRECT means always use it, where the detect mode
@@ -1843,7 +1854,7 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
         JNIEnv *env, jclass cls, jobject listener, jstring address, jstring userName,
         jstring domain, jstring password, jstring nla, jboolean legacyTls, jboolean compression,
         jstring graphics, jstring experience, jstring sound, jboolean microphone,
-        jstring gateway, jint scale,
+        jboolean camera, jstring gateway, jint scale,
         jint width, jint height,
         jint monitors, jint keyboardLayout, jstring clientName, jstring configPath,
         jint connectTimeoutMs) {
@@ -1897,6 +1908,7 @@ Java_net_pgaskin_remotedesktop_backend_freerdp_FreeRdpNative_nativeCreate(
     s->experience = dup_jstring(env, experience);
     s->sound = dup_jstring(env, sound);
     s->microphone = microphone != JNI_FALSE;
+    s->camera = camera != JNI_FALSE;
     char *gatewayText = dup_jstring(env, gateway);
     parseGateway(s, gatewayText);
     free(gatewayText);
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
index 00a059f3..0de66678 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpBackend.java
@@ -185,6 +185,7 @@ public void connect() {
                 bool(FreeRdpProvider.COMPRESSION),
                 options.get(FreeRdpProvider.GRAPHICS), options.get(FreeRdpProvider.EXPERIENCE),
                 options.get(FreeRdpProvider.SOUND), bool(FreeRdpProvider.MICROPHONE),
+                bool(FreeRdpProvider.CAMERA),
                 options.getOrDefault(FreeRdpProvider.GATEWAY, ""), scale(),
                 size[0], size[1], monitorCount(), KEYBOARD_LAYOUT,
                 android.os.Build.MODEL, store.getAbsolutePath(), CONNECT_TIMEOUT_MS);
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
index fe04d9c6..760d8871 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpNative.java
@@ -108,6 +108,8 @@ interface Callbacks {
      * @param sound      {@code off}, {@code local} or {@code remote}
      * @param microphone send this phone's microphone; the caller only passes
      *                   true once RECORD_AUDIO is granted
+     * @param camera     send this phone's camera; the caller only passes true
+     *                   once CAMERA is granted
      * @param gateway    an RD Gateway as host or host:port; empty for none
      * @param scale      the percentage the far end is asked to draw its own
      *                   interface at; 100, 140 and 180 are the only values the
@@ -120,7 +122,7 @@ static native long nativeCreate(Callbacks listener, String address, String userN
                                     String domain, String password, String nla,
                                     boolean legacyTls, boolean compression, String graphics,
                                     String experience, String sound, boolean microphone,
-                                    String gateway, int scale, int width,
+                                    boolean camera, String gateway, int scale, int width,
                                     int height, int monitors, int keyboardLayout,
                                     String clientName, String configPath, int connectTimeoutMs);
 
diff --git a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
index afbb0159..a8f0f4b8 100644
--- a/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
+++ b/backends/freerdp/src/main/java/net/pgaskin/remotedesktop/backend/freerdp/FreeRdpProvider.java
@@ -73,6 +73,11 @@ public final class FreeRdpProvider implements BackendProvider {
      * reads the key by name, so it has to stay "Microphone".
      */
     public static final String MICROPHONE = "Microphone";
+    /**
+     * The app asks for CAMERA before connecting when this is on, and reads the
+     * key by name, so it has to stay "Camera".
+     */
+    public static final String CAMERA = "Camera";
     /** An RD Gateway as host or host:port; empty connects directly. */
     public static final String GATEWAY = "Gateway";
     public static final String COMPRESSION = "Compression";
@@ -143,6 +148,9 @@ public final class FreeRdpProvider implements BackendProvider {
             BackendOption.bool(MICROPHONE, "Microphone",
                     "Send this phone's microphone to the remote machine. Android asks for permission before connecting.",
                     false, Scope.CONNECTION, false),
+            BackendOption.bool(CAMERA, "Camera",
+                    "Send this phone's camera to the remote machine for the whole session. Android asks for permission before connecting.",
+                    false, Scope.CONNECTION, false),
             BackendOption.text(GATEWAY, "RD Gateway",
                     "Reach this machine through an RD Gateway, as host or host:port (443 if no port). The connection's own username and password are used for it. Leave empty to connect directly.",
                     "", Scope.CONNECTION, false),