feat(cliprdr): add clipboard data locking methods (#1064)

Per [MS-RDPECLIP sections 2.2.4.6 and 2.2.4.7][lock-spec], the Local
Clipboard
Owner may lock the Shared Clipboard Owner's clipboard data before
requesting
file contents to ensure data stability during multi-request transfers.

This enables server implementations to safely request file data from
clients
when handling clipboard paste operations.

---------

Co-authored-by: lamco-office <office@lamco.io>

Author: glamberson

crates/ironrdp-client/src/rdp.rs

@@ -565,6 +565,14 @@ async fn active_session(
                                     Some(cliprdr.initiate_paste(format)
                                         .map_err(|e| session::custom_err!("CLIPRDR", e))?)
                                 }
+                                ClipboardMessage::SendLockClipboard { clip_data_id } => {
+                                    Some(cliprdr.lock_clipboard(clip_data_id)
+                                        .map_err(|e| session::custom_err!("CLIPRDR", e))?)
+                                }
+                                ClipboardMessage::SendUnlockClipboard { clip_data_id } => {
+                                    Some(cliprdr.unlock_clipboard(clip_data_id)
+                                        .map_err(|e| session::custom_err!("CLIPRDR", e))?)
+                                }
                                 ClipboardMessage::Error(e) => {
                                     error!("Clipboard backend error: {}", e);
                                     None

crates/ironrdp-cliprdr/src/backend.rs

@@ -33,6 +33,16 @@ pub enum ClipboardMessage {
     /// received.
     SendInitiatePaste(ClipboardFormatId),
 
+    /// Sent by clipboard backend when clipboard data should be locked on the remote.
+    ///
+    /// Implementation should send lock clipboard data PDU on `CLIPRDR` SVC when received.
+    SendLockClipboard { clip_data_id: u32 },
+
+    /// Sent by clipboard backend when clipboard data should be unlocked on the remote.
+    ///
+    /// Implementation should send unlock clipboard data PDU on `CLIPRDR` SVC when received.
+    SendUnlockClipboard { clip_data_id: u32 },
+
     /// Failure received from the OS clipboard event loop.
     ///
     /// Client implementation should log/display this error.

crates/ironrdp-cliprdr/src/lib.rs

@@ -15,7 +15,7 @@ use ironrdp_svc::{
 };
 use pdu::{
     Capabilities, ClientTemporaryDirectory, ClipboardFormat, ClipboardFormatId, ClipboardGeneralCapabilityFlags,
-    ClipboardPdu, ClipboardProtocolVersion, FileContentsResponse, FormatDataRequest, FormatListResponse,
+    ClipboardPdu, ClipboardProtocolVersion, FileContentsResponse, FormatDataRequest, FormatListResponse, LockDataId,
     OwnedFormatDataResponse,
 };
 use tracing::{error, info};
@@ -276,6 +276,32 @@ impl<R: Role> Cliprdr<R> {
 
         Ok(vec![into_cliprdr_message(pdu)].into())
     }
+
+    /// [2.2.4.6] Lock Clipboard Data PDU (CLIPRDR_LOCK_CLIPDATA)
+    ///
+    /// Locks clipboard data on the remote before file transfer. Should be called before
+    /// requesting file contents to ensure data stability during transfer.
+    ///
+    /// [2.2.4.6]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeclip/150bac72-bc7f-42e5-9e8e-cb5a0ddc7dbc
+    pub fn lock_clipboard(&self, clip_data_id: u32) -> PduResult<CliprdrSvcMessages<R>> {
+        ready_guard!(self, lock_clipboard);
+
+        let pdu = ClipboardPdu::LockData(LockDataId(clip_data_id));
+        Ok(vec![into_cliprdr_message(pdu)].into())
+    }
+
+    /// [2.2.4.7] Unlock Clipboard Data PDU (CLIPRDR_UNLOCK_CLIPDATA)
+    ///
+    /// Unlocks previously locked clipboard data. Should be called after file transfer
+    /// operations complete.
+    ///
+    /// [2.2.4.7]: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpeclip/e587a20c-fb7c-47d1-8698-4bcb92c48a38
+    pub fn unlock_clipboard(&self, clip_data_id: u32) -> PduResult<CliprdrSvcMessages<R>> {
+        ready_guard!(self, unlock_clipboard);
+
+        let pdu = ClipboardPdu::UnlockData(LockDataId(clip_data_id));
+        Ok(vec![into_cliprdr_message(pdu)].into())
+    }
 }
 
 impl<R: Role> SvcProcessor for Cliprdr<R> {

crates/ironrdp-server/src/server.rs

@@ -552,6 +552,10 @@ impl RdpServer {
                         ClipboardMessage::SendInitiateCopy(formats) => cliprdr.initiate_copy(&formats),
                         ClipboardMessage::SendFormatData(data) => cliprdr.submit_format_data(data),
                         ClipboardMessage::SendInitiatePaste(format) => cliprdr.initiate_paste(format),
+                        ClipboardMessage::SendLockClipboard { clip_data_id } => cliprdr.lock_clipboard(clip_data_id),
+                        ClipboardMessage::SendUnlockClipboard { clip_data_id } => {
+                            cliprdr.unlock_clipboard(clip_data_id)
+                        }
                         ClipboardMessage::Error(error) => {
                             error!(?error, "Handling clipboard event");
                             continue;

crates/ironrdp-web/src/session.rs

@@ -526,6 +526,14 @@ impl iron_remote_desktop::Session for Session {
                                         cliprdr.initiate_paste(format)
                                             .context("CLIPRDR initiate paste")?
                                     ),
+                                    ClipboardMessage::SendLockClipboard { clip_data_id } => Some(
+                                        cliprdr.lock_clipboard(clip_data_id)
+                                            .context("CLIPRDR lock clipboard")?
+                                    ),
+                                    ClipboardMessage::SendUnlockClipboard { clip_data_id } => Some(
+                                        cliprdr.unlock_clipboard(clip_data_id)
+                                            .context("CLIPRDR unlock clipboard")?
+                                    ),
                                     ClipboardMessage::Error(e) => {
                                         error!("Clipboard backend error: {}", e);
                                         None

ffi/src/clipboard/message.rs

@@ -14,6 +14,12 @@ pub mod ffi {
                 ironrdp::cliprdr::backend::ClipboardMessage::SendInitiatePaste(_) => {
                     ClipboardMessageType::SendInitiatePaste
                 }
+                ironrdp::cliprdr::backend::ClipboardMessage::SendLockClipboard { .. } => {
+                    ClipboardMessageType::SendLockClipboard
+                }
+                ironrdp::cliprdr::backend::ClipboardMessage::SendUnlockClipboard { .. } => {
+                    ClipboardMessageType::SendUnlockClipboard
+                }
                 ironrdp::cliprdr::backend::ClipboardMessage::Error(_) => ClipboardMessageType::Error,
             }
         }
@@ -51,6 +57,8 @@ pub mod ffi {
         SendInitiateCopy,
         SendFormatData,
         SendInitiatePaste,
+        SendLockClipboard,
+        SendUnlockClipboard,
         Error,
     }