FreeRDP
Loading...
Searching...
No Matches
tsg.c
1
23#include <freerdp/config.h>
24
25#include "../settings.h"
26
27#include <winpr/assert.h>
28#include <winpr/crt.h>
29#include <winpr/error.h>
30#include <winpr/print.h>
31#include <winpr/stream.h>
32
33#include <freerdp/log.h>
34
35#include "rpc_bind.h"
36#include "rpc_client.h"
37#include "tsg.h"
38#include "../utils.h"
39#include "../../crypto/opensslcompat.h"
40
41#define TAG FREERDP_TAG("core.gateway.tsg")
42
43#define TSG_CAPABILITY_TYPE_NAP 0x00000001
44
45#define TSG_PACKET_TYPE_HEADER 0x00004844
46#define TSG_PACKET_TYPE_VERSIONCAPS 0x00005643
47#define TSG_PACKET_TYPE_QUARCONFIGREQUEST 0x00005143
48#define TSG_PACKET_TYPE_QUARREQUEST 0x00005152
49#define TSG_PACKET_TYPE_RESPONSE 0x00005052
50#define TSG_PACKET_TYPE_QUARENC_RESPONSE 0x00004552
51#define TSG_PACKET_TYPE_CAPS_RESPONSE 0x00004350
52#define TSG_PACKET_TYPE_MSGREQUEST_PACKET 0x00004752
53#define TSG_PACKET_TYPE_MESSAGE_PACKET 0x00004750
54#define TSG_PACKET_TYPE_AUTH 0x00004054
55#define TSG_PACKET_TYPE_REAUTH 0x00005250
56
57typedef WCHAR* RESOURCENAME;
58
59typedef struct
60{
61 RESOURCENAME* resourceName;
62 UINT32 numResourceNames;
63 RESOURCENAME* alternateResourceNames;
64 UINT16 numAlternateResourceNames;
65 UINT32 Port;
66} TSENDPOINTINFO;
67
68typedef struct
69{
70 UINT16 ComponentId;
71 UINT16 PacketId;
72} TSG_PACKET_HEADER;
73
74typedef struct
75{
76 UINT32 capabilities;
77} TSG_CAPABILITY_NAP;
78
79typedef union
80{
81 TSG_CAPABILITY_NAP tsgCapNap;
82} TSG_CAPABILITIES_UNION;
83
84typedef struct
85{
86 UINT32 capabilityType;
87 TSG_CAPABILITIES_UNION tsgPacket;
88} TSG_PACKET_CAPABILITIES;
89
90typedef struct
91{
92 TSG_PACKET_HEADER tsgHeader;
93 TSG_PACKET_CAPABILITIES tsgCaps;
94 UINT32 numCapabilities;
95 UINT16 majorVersion;
96 UINT16 minorVersion;
97 UINT16 quarantineCapabilities;
98} TSG_PACKET_VERSIONCAPS;
99
100typedef struct
101{
102 UINT32 flags;
103} TSG_PACKET_QUARCONFIGREQUEST;
104
105typedef struct
106{
107 UINT32 flags;
108 WCHAR* machineName;
109 UINT32 nameLength;
110 BYTE* data;
111 UINT32 dataLen;
112} TSG_PACKET_QUARREQUEST;
113
114typedef struct
115{
116 BOOL enableAllRedirections;
117 BOOL disableAllRedirections;
118 BOOL driveRedirectionDisabled;
119 BOOL printerRedirectionDisabled;
120 BOOL portRedirectionDisabled;
121 BOOL reserved;
122 BOOL clipboardRedirectionDisabled;
123 BOOL pnpRedirectionDisabled;
124} TSG_REDIRECTION_FLAGS;
125
126typedef struct
127{
128 UINT32 flags;
129 UINT32 reserved;
130 const BYTE* responseData;
131 UINT32 responseDataLen;
132 TSG_REDIRECTION_FLAGS redirectionFlags;
133} TSG_PACKET_RESPONSE;
134
135typedef struct
136{
137 UINT32 flags;
138 UINT32 certChainLen;
139 WCHAR* certChainData;
140 GUID nonce;
141 TSG_PACKET_VERSIONCAPS versionCaps;
142} TSG_PACKET_QUARENC_RESPONSE;
143
144typedef struct
145{
146 INT32 isDisplayMandatory;
147 INT32 isConsentMandatory;
148 UINT32 msgBytes;
149 WCHAR* msgBuffer;
150} TSG_PACKET_STRING_MESSAGE;
151
152typedef struct
153{
154 UINT64 tunnelContext;
155} TSG_PACKET_REAUTH_MESSAGE;
156
157typedef struct
158{
159 UINT32 msgID;
160 UINT32 msgType;
161 INT32 isMsgPresent;
162} TSG_PACKET_MSG_RESPONSE;
163
164typedef struct
165{
166 TSG_PACKET_QUARENC_RESPONSE pktQuarEncResponse;
167 TSG_PACKET_MSG_RESPONSE pktConsentMessage;
168} TSG_PACKET_CAPS_RESPONSE;
169
170typedef struct
171{
172 UINT32 maxMessagesPerBatch;
173} TSG_PACKET_MSG_REQUEST;
174
175typedef struct
176{
177 TSG_PACKET_VERSIONCAPS tsgVersionCaps;
178 UINT32 cookieLen;
179 BYTE* cookie;
180} TSG_PACKET_AUTH;
181
182typedef union
183{
184 TSG_PACKET_VERSIONCAPS packetVersionCaps;
185 TSG_PACKET_AUTH packetAuth;
186} TSG_INITIAL_PACKET_TYPE_UNION;
187
188typedef struct
189{
190 UINT64 tunnelContext;
191 UINT32 packetId;
192 TSG_INITIAL_PACKET_TYPE_UNION tsgInitialPacket;
193} TSG_PACKET_REAUTH;
194
195typedef union
196{
197 TSG_PACKET_HEADER packetHeader;
198 TSG_PACKET_VERSIONCAPS packetVersionCaps;
199 TSG_PACKET_QUARCONFIGREQUEST packetQuarConfigRequest;
200 TSG_PACKET_QUARREQUEST packetQuarRequest;
201 TSG_PACKET_RESPONSE packetResponse;
202 TSG_PACKET_QUARENC_RESPONSE packetQuarEncResponse;
203 TSG_PACKET_CAPS_RESPONSE packetCapsResponse;
204 TSG_PACKET_MSG_REQUEST packetMsgRequest;
205 TSG_PACKET_MSG_RESPONSE packetMsgResponse;
206 TSG_PACKET_AUTH packetAuth;
207 TSG_PACKET_REAUTH packetReauth;
208} TSG_PACKET_TYPE_UNION;
209
210typedef struct
211{
212 UINT32 packetId;
213 TSG_PACKET_TYPE_UNION tsgPacket;
214} TSG_PACKET;
215
216struct rdp_tsg
217{
218 BIO* bio;
219 rdpRpc* rpc;
220 UINT16 Port;
221 LPWSTR Hostname;
222 TSG_STATE state;
223 UINT32 TunnelId;
224 UINT32 ChannelId;
225 BOOL reauthSequence;
226 rdpTransport* transport;
227 UINT64 ReauthTunnelContext;
228 CONTEXT_HANDLE TunnelContext;
229 CONTEXT_HANDLE ChannelContext;
230 CONTEXT_HANDLE NewTunnelContext;
231 CONTEXT_HANDLE NewChannelContext;
232 wLog* log;
233 TSG_PACKET_QUARENC_RESPONSE CapsResponse;
234 TSG_PACKET_QUARREQUEST QuarreQuest;
235};
236
237WINPR_ATTR_NODISCARD
238static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
239 TSG_PACKET_STRING_MESSAGE* msg);
240
241WINPR_ATTR_NODISCARD
242static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align);
243
244WINPR_ATTR_NODISCARD
245static const char* tsg_caps_to_string(UINT32 caps, char* buffer, size_t len)
246{
247 const UINT32 mask = ~(TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT |
248 TSG_MESSAGING_CAP_CONSENT_SIGN | TSG_MESSAGING_CAP_SERVICE_MSG |
249 TSG_MESSAGING_CAP_REAUTH);
250 const UINT32 val = caps & mask;
251
252 if ((caps & TSG_NAP_CAPABILITY_QUAR_SOH) != 0)
253 (void)winpr_str_append("TSG_NAP_CAPABILITY_QUAR_SOH", buffer, len, "|");
254 if ((caps & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
255 (void)winpr_str_append("TSG_NAP_CAPABILITY_IDLE_TIMEOUT", buffer, len, "|");
256 if ((caps & TSG_MESSAGING_CAP_CONSENT_SIGN) != 0)
257 (void)winpr_str_append("TSG_MESSAGING_CAP_CONSENT_SIGN", buffer, len, "|");
258 if ((caps & TSG_MESSAGING_CAP_SERVICE_MSG) != 0)
259 (void)winpr_str_append("TSG_MESSAGING_CAP_SERVICE_MSG", buffer, len, "|");
260 if ((caps & TSG_MESSAGING_CAP_REAUTH) != 0)
261 (void)winpr_str_append("TSG_MESSAGING_CAP_REAUTH", buffer, len, "|");
262
263 if (val != 0)
264 {
265 char number[32] = WINPR_C_ARRAY_INIT;
266 (void)_snprintf(number, sizeof(number), "TSG_UNKNOWN{0x%08" PRIx32 "}", val);
267 (void)winpr_str_append(number, buffer, len, "|");
268 }
269
270 return buffer;
271}
272
273WINPR_ATTR_NODISCARD
274static const char* tsg_packet_id_to_string(UINT32 packetId)
275{
276 switch (packetId)
277 {
278 case TSG_PACKET_TYPE_HEADER:
279 return "TSG_PACKET_TYPE_HEADER";
280 case TSG_PACKET_TYPE_VERSIONCAPS:
281 return "TSG_PACKET_TYPE_VERSIONCAPS";
282 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
283 return "TSG_PACKET_TYPE_QUARCONFIGREQUEST";
284 case TSG_PACKET_TYPE_QUARREQUEST:
285 return "TSG_PACKET_TYPE_QUARREQUEST";
286 case TSG_PACKET_TYPE_RESPONSE:
287 return "TSG_PACKET_TYPE_RESPONSE";
288 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
289 return "TSG_PACKET_TYPE_QUARENC_RESPONSE";
290 case TSG_CAPABILITY_TYPE_NAP:
291 return "TSG_CAPABILITY_TYPE_NAP";
292 case TSG_PACKET_TYPE_CAPS_RESPONSE:
293 return "TSG_PACKET_TYPE_CAPS_RESPONSE";
294 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
295 return "TSG_PACKET_TYPE_MSGREQUEST_PACKET";
296 case TSG_PACKET_TYPE_MESSAGE_PACKET:
297 return "TSG_PACKET_TYPE_MESSAGE_PACKET";
298 case TSG_PACKET_TYPE_AUTH:
299 return "TSG_PACKET_TYPE_AUTH";
300 case TSG_PACKET_TYPE_REAUTH:
301 return "TSG_PACKET_TYPE_REAUTH";
302 default:
303 return "UNKNOWN";
304 }
305}
306
307WINPR_ATTR_NODISCARD
308static const char* tsg_component_id_to_string(UINT16 ComponentId, char* buffer, size_t bytelen)
309{
310 const char* str = nullptr;
311
312#define ENTRY(x) \
313 case x: \
314 str = #x; \
315 break
316 switch (ComponentId)
317 {
318 ENTRY(TS_GATEWAY_TRANSPORT);
319 default:
320 str = "TS_UNKNOWN";
321 break;
322 }
323#undef ENTRY
324
325 (void)_snprintf(buffer, bytelen, "%s [0x%04" PRIx16 "]", str, ComponentId);
326 return buffer;
327}
328
329WINPR_ATTR_NODISCARD
330static const char* tsg_state_to_string(TSG_STATE state)
331{
332 switch (state)
333 {
334 case TSG_STATE_INITIAL:
335 return "TSG_STATE_INITIAL";
336 case TSG_STATE_CONNECTED:
337 return "TSG_STATE_CONNECTED";
338 case TSG_STATE_AUTHORIZED:
339 return "TSG_STATE_AUTHORIZED";
340 case TSG_STATE_CHANNEL_CREATED:
341 return "TSG_STATE_CHANNEL_CREATED";
342 case TSG_STATE_PIPE_CREATED:
343 return "TSG_STATE_PIPE_CREATED";
344 case TSG_STATE_TUNNEL_CLOSE_PENDING:
345 return "TSG_STATE_TUNNEL_CLOSE_PENDING";
346 case TSG_STATE_CHANNEL_CLOSE_PENDING:
347 return "TSG_STATE_CHANNEL_CLOSE_PENDING";
348 case TSG_STATE_FINAL:
349 return "TSG_STATE_FINAL";
350 default:
351 return "TSG_STATE_UNKNOWN";
352 }
353}
354
355WINPR_ATTR_NODISCARD
356static BOOL TsProxyReadTunnelContext(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext)
357{
358 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 20))
359 return FALSE;
360
361 WINPR_ASSERT(tunnelContext);
362 Stream_Read_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
363 Stream_Read(s, &tunnelContext->ContextUuid,
364 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
365 return TRUE;
366}
367
368WINPR_ATTR_NODISCARD
369static BOOL TsProxyWriteTunnelContext(WINPR_ATTR_UNUSED wLog* log, wStream* s,
370 const CONTEXT_HANDLE* tunnelContext)
371{
372 if (!Stream_EnsureRemainingCapacity(s, 20))
373 return FALSE;
374
375 Stream_Write_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
376 Stream_Write(s, &tunnelContext->ContextUuid,
377 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
378 return TRUE;
379}
380
381WINPR_ATTR_NODISCARD
382static BOOL tsg_ndr_pointer_write(WINPR_ATTR_UNUSED wLog* log, wStream* s, UINT32* index,
383 DWORD length)
384{
385 WINPR_ASSERT(index);
386 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
387
388 if (!s)
389 return FALSE;
390 if (!Stream_EnsureRemainingCapacity(s, 4))
391 return FALSE;
392
393 if (length > 0)
394 {
395 Stream_Write_UINT32(s, ndrPtr); /* mszGroupsNdrPtr (4 bytes) */
396 (*index) = (*index) + 1;
397 }
398 else
399 Stream_Write_UINT32(s, 0);
400 return TRUE;
401}
402
403WINPR_ATTR_NODISCARD
404static BOOL tsg_ndr_pointer_read(wLog* log, wStream* s, UINT32* index, UINT32* ptrval,
405 BOOL required)
406{
407 WINPR_ASSERT(index);
408 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
409
410 if (!s)
411 return FALSE;
412 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 4))
413 return FALSE;
414
415 const DWORD val = Stream_Get_UINT32(s);
416 if (ptrval)
417 *ptrval = val;
418
419 if (val != 0)
420 {
421 if (val != ndrPtr)
422 {
423 WLog_Print(log, WLOG_WARN, "Read NDR pointer 0x%04" PRIx32 " but expected 0x%04" PRIx32,
424 val, ndrPtr);
425 if ((val & 0xFFFF0000) != (ndrPtr & 0xFFFF0000))
426 return FALSE;
427 }
428 (*index)++;
429 }
430 else if (required)
431 {
432 WLog_Print(log, WLOG_ERROR, "NDR pointer == 0, but the field is required");
433 return FALSE;
434 }
435
436 return TRUE;
437}
438
439WINPR_ATTR_NODISCARD
440static BOOL tsg_ndr_write_conformant_array(WINPR_ATTR_UNUSED wLog* log, wStream* s,
441 const void* data, size_t length)
442{
443 const size_t pad = length % 4;
444 if ((length > UINT32_MAX) || !Stream_EnsureRemainingCapacity(s, 4ull + length))
445 return FALSE;
446
447 Stream_Write_UINT32(s, WINPR_ASSERTING_INT_CAST(uint32_t, length)); /* MaxCount (4 bytes) */
448 Stream_Write(s, data, length);
449 if (pad != 0)
450 Stream_Zero(s, 4 - pad);
451
452 return TRUE;
453}
454
455WINPR_ATTR_NODISCARD
456static BOOL tsg_ndr_write_string(WINPR_ATTR_UNUSED wLog* log, wStream* s, const WCHAR* str,
457 size_t length)
458{
459 const size_t pad = (length % 2) * sizeof(WCHAR);
460 if ((length > UINT32_MAX) ||
461 !Stream_EnsureRemainingCapacity(s, 12ull + length * sizeof(WCHAR) + pad))
462 return FALSE;
463
464 Stream_Write_UINT32(s, (UINT32)length); /* MaxCount (4 bytes) */
465 Stream_Write_UINT32(s, 0); /* Offset (4 bytes) */
466 Stream_Write_UINT32(s, (UINT32)length); /* ActualCount (4 bytes) */
467 if (!Stream_Write_UTF16_String(s, str, length)) /* Array */
468 return FALSE;
469 Stream_Zero(s, pad);
470 return TRUE;
471}
472
473WINPR_ATTR_NODISCARD
474static BOOL tsg_ndr_read_string(wLog* log, wStream* s, WCHAR** str, UINT32* pLengthInBytes)
475{
476 UINT32 MaxCount = 0;
477 UINT32 Offset = 0;
478 UINT32 ActualCount = 0;
479 WINPR_ASSERT(pLengthInBytes);
480 const UINT32 lengthInBytes = *pLengthInBytes;
481
482 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
483 return FALSE;
484
485 Stream_Read_UINT32(s, MaxCount); /* MaxCount (4 bytes) */
486 Stream_Read_UINT32(s, Offset); /* Offset (4 bytes) */
487 Stream_Read_UINT32(s, ActualCount); /* ActualCount (4 bytes) */
488 if (ActualCount > MaxCount)
489 {
490 WLog_Print(log, WLOG_ERROR,
491 "failed to read string, ActualCount (%" PRIu32 ") > MaxCount (%" PRIu32 ")",
492 ActualCount, MaxCount);
493 return FALSE;
494 }
495 if (Offset != 0)
496 {
497 WLog_Print(log, WLOG_ERROR, "Unsupported Offset (%" PRIu32 "), expected 0", Offset);
498 return FALSE;
499 }
500 if (ActualCount > lengthInBytes / sizeof(WCHAR))
501 {
502 WLog_Print(log, WLOG_ERROR,
503 "failed to read string, ActualCount (%" PRIu32
504 ") * sizeof(WCHAR) > lengthInBytes (%" PRIu32 ")",
505 ActualCount, lengthInBytes);
506 return FALSE;
507 }
508
509 const size_t start = Stream_GetPosition(s);
510 if (str)
511 *str = Stream_PointerAs(s, WCHAR);
512
513 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, ActualCount * sizeof(WCHAR)))
514 return FALSE;
515 Stream_Seek(s, ActualCount * sizeof(WCHAR));
516 const size_t end = Stream_GetPosition(s);
517 if ((start > end) || ((end - start) > UINT32_MAX))
518 return FALSE;
519 *pLengthInBytes = WINPR_ASSERTING_INT_CAST(UINT32, end - start);
520 const size_t pad = (ActualCount % 2);
521 return Stream_SafeSeek(s, pad * sizeof(WCHAR));
522}
523
524WINPR_ATTR_NODISCARD
525static BOOL tsg_ndr_read_packet_header(wLog* log, wStream* s, TSG_PACKET_HEADER* header)
526{
527 const UINT32 ComponentId = TS_GATEWAY_TRANSPORT;
528
529 WINPR_ASSERT(header);
530 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 2, sizeof(UINT16)))
531 return FALSE;
532 Stream_Read_UINT16(s, header->ComponentId);
533 Stream_Read_UINT16(s, header->PacketId);
534
535 if (ComponentId != header->ComponentId)
536 {
537 char buffer[64] = WINPR_C_ARRAY_INIT;
538 char buffer2[64] = WINPR_C_ARRAY_INIT;
539 WLog_Print(log, WLOG_ERROR, "Unexpected ComponentId: %s, Expected %s",
540 tsg_component_id_to_string(header->ComponentId, buffer, sizeof(buffer)),
541 tsg_component_id_to_string(ComponentId, buffer2, sizeof(buffer2)));
542 return FALSE;
543 }
544
545 return TRUE;
546}
547
548WINPR_ATTR_NODISCARD
549static BOOL tsg_ndr_write_packet_header(WINPR_ATTR_UNUSED wLog* log, wStream* s,
550 const TSG_PACKET_HEADER* header)
551{
552 WINPR_ASSERT(header);
553 if (!Stream_EnsureRemainingCapacity(s, 2ull * sizeof(UINT16)))
554 return FALSE;
555 Stream_Write_UINT16(s, header->ComponentId);
556 Stream_Write_UINT16(s, header->PacketId);
557 return TRUE;
558}
559
560WINPR_ATTR_NODISCARD
561static BOOL tsg_ndr_read_nap(wLog* log, wStream* s, TSG_CAPABILITY_NAP* nap)
562{
563 WINPR_ASSERT(nap);
564
565 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
566 return FALSE;
567 Stream_Read_UINT32(s, nap->capabilities);
568 {
569 char buffer[256] = WINPR_C_ARRAY_INIT;
570 WLog_Print(log, WLOG_DEBUG, "Received version caps %s",
571 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
572 }
573 return TRUE;
574}
575
576WINPR_ATTR_NODISCARD
577static BOOL tsg_ndr_write_nap(wLog* log, wStream* s, const TSG_CAPABILITY_NAP* nap)
578{
579 WINPR_ASSERT(nap);
580
581 if (!Stream_EnsureRemainingCapacity(s, 1ull * sizeof(UINT32)))
582 return FALSE;
583
584 {
585 char buffer[256] = WINPR_C_ARRAY_INIT;
586 WLog_Print(log, WLOG_DEBUG, "Sending version caps %s",
587 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
588 }
589 Stream_Write_UINT32(s, nap->capabilities);
590 return TRUE;
591}
592
593WINPR_ATTR_NODISCARD
594static BOOL tsg_ndr_read_tsg_caps(wLog* log, wStream* s, TSG_PACKET_CAPABILITIES* caps)
595{
596 UINT32 capabilityType = 0;
597 UINT32 count = 0;
598 WINPR_ASSERT(caps);
599
600 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 3, sizeof(UINT32)))
601 return FALSE;
602 Stream_Read_UINT32(s, count);
603 Stream_Read_UINT32(s, capabilityType);
604 Stream_Read_UINT32(s, caps->capabilityType);
605 if (capabilityType != caps->capabilityType)
606 {
607 WLog_Print(log, WLOG_ERROR,
608 "Inconsistent data, capabilityType 0x%08" PRIx32 " != 0x%08" PRIx32,
609 capabilityType, caps->capabilityType);
610 return FALSE;
611 }
612 switch (caps->capabilityType)
613 {
614 case TSG_CAPABILITY_TYPE_NAP:
615 if (count < 1)
616 {
617 WLog_Print(log, WLOG_ERROR, "Inconsistent data, capabilityType %s count=%" PRIu32,
618 tsg_packet_id_to_string(capabilityType), count);
619 return FALSE;
620 }
621 return tsg_ndr_read_nap(log, s, &caps->tsgPacket.tsgCapNap);
622 default:
623 WLog_Print(log, WLOG_ERROR,
624 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32
625 " [count=%" PRIu32 "]",
626 caps->capabilityType, count);
627 return FALSE;
628 }
629}
630
631WINPR_ATTR_NODISCARD
632static BOOL tsg_ndr_write_tsg_caps(wLog* log, wStream* s, const TSG_PACKET_CAPABILITIES* caps)
633{
634 WINPR_ASSERT(caps);
635
636 if (!Stream_EnsureRemainingCapacity(s, 2ull * sizeof(UINT32)))
637 return FALSE;
638 Stream_Write_UINT32(s, caps->capabilityType);
639 Stream_Write_UINT32(s, caps->capabilityType);
640
641 switch (caps->capabilityType)
642 {
643 case TSG_CAPABILITY_TYPE_NAP:
644 return tsg_ndr_write_nap(log, s, &caps->tsgPacket.tsgCapNap);
645 default:
646 WLog_Print(log, WLOG_ERROR,
647 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32,
648 caps->capabilityType);
649 return FALSE;
650 }
651}
652
653WINPR_ATTR_NODISCARD
654static BOOL tsg_ndr_read_version_caps(wLog* log, wStream* s, UINT32* index,
655 TSG_PACKET_VERSIONCAPS* caps)
656{
657 WINPR_ASSERT(caps);
658 if (!tsg_ndr_read_packet_header(log, s, &caps->tsgHeader))
659 return FALSE;
660
661 UINT32 TSGCapsPtr = 0;
662 if (!tsg_ndr_pointer_read(log, s, index, &TSGCapsPtr, TRUE))
663 return FALSE;
664
665 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 10))
666 return FALSE;
667 Stream_Read_UINT32(s, caps->numCapabilities);
668 Stream_Read_UINT16(s, caps->majorVersion);
669 Stream_Read_UINT16(s, caps->minorVersion);
670 Stream_Read_UINT16(s, caps->quarantineCapabilities);
671 /* 4-byte alignment */
672 if (!tsg_stream_align(log, s, 4))
673 return FALSE;
674
675 if (caps->numCapabilities > 1)
676 {
677 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
678 caps->numCapabilities);
679 return FALSE;
680 }
681
682 return tsg_ndr_read_tsg_caps(log, s, &caps->tsgCaps);
683}
684
685WINPR_ATTR_NODISCARD
686static BOOL tsg_ndr_write_version_caps(wLog* log, wStream* s, UINT32* index,
687 const TSG_PACKET_VERSIONCAPS* caps)
688{
689 WINPR_ASSERT(caps);
690 if (!tsg_ndr_write_packet_header(log, s, &caps->tsgHeader))
691 return FALSE;
692
693 if (!tsg_ndr_pointer_write(log, s, index, 1)) /* TsgCapsPtr (4 bytes) */
694 return FALSE;
695
696 if (!Stream_EnsureRemainingCapacity(s, 10))
697 return FALSE;
698
699 if (caps->numCapabilities > 1)
700 {
701 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
702 caps->numCapabilities);
703 return FALSE;
704 }
705 Stream_Write_UINT32(s, caps->numCapabilities);
706 Stream_Write_UINT16(s, caps->majorVersion);
707 Stream_Write_UINT16(s, caps->minorVersion);
708 Stream_Write_UINT16(s, caps->quarantineCapabilities);
709
710 /* 4-byte alignment (30 + 2) */
711 Stream_Write_UINT16(s, 0x0000); /* pad (2 bytes) */
712 Stream_Write_UINT32(s, caps->numCapabilities); /* MaxCount (4 bytes) */
713 return tsg_ndr_write_tsg_caps(log, s, &caps->tsgCaps);
714}
715
716WINPR_ATTR_NODISCARD
717static BOOL tsg_ndr_read_quarenc_response(wLog* log, wStream* s, UINT32* index,
718 TSG_PACKET_QUARENC_RESPONSE* quarenc)
719{
720 WINPR_ASSERT(quarenc);
721 UINT32 CertChainDataPtr = 0;
722 UINT32 VersionCapsPtr = 0;
723
724 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
725 return FALSE;
726 Stream_Read_UINT32(s, quarenc->flags);
727 Stream_Read_UINT32(s, quarenc->certChainLen);
728
729 if (!tsg_ndr_pointer_read(log, s, index, &CertChainDataPtr, quarenc->certChainLen != 0))
730 return FALSE;
731
732 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(quarenc->nonce)))
733 return FALSE;
734 Stream_Read(s, &quarenc->nonce, sizeof(quarenc->nonce));
735
736 return (tsg_ndr_pointer_read(log, s, index, &VersionCapsPtr, TRUE));
737}
738
739WINPR_ATTR_NODISCARD
740static BOOL tsg_ndr_read_quarenc_data(wLog* log, wStream* s, UINT32* index,
741 TSG_PACKET_QUARENC_RESPONSE* quarenc)
742{
743 WINPR_ASSERT(quarenc);
744
745 if (quarenc->certChainLen > 0)
746 {
747 /* [MS-TSGU] 2.2.9.2.1.6 TSG_PACKET_QUARENC_RESPONSE::certChainLen number of WCHAR */
748 UINT32 lengthInBytes = quarenc->certChainLen * sizeof(WCHAR);
749 if (!tsg_ndr_read_string(log, s, &quarenc->certChainData, &lengthInBytes))
750 return FALSE;
751 quarenc->certChainLen = lengthInBytes / sizeof(WCHAR);
752
753 /* 4-byte alignment */
754 if (!tsg_stream_align(log, s, 4))
755 return FALSE;
756 }
757
758 return tsg_ndr_read_version_caps(log, s, index, &quarenc->versionCaps);
759}
760
761WINPR_ATTR_NODISCARD
762static BOOL tsg_ndr_write_auth(wLog* log, wStream* s, UINT32* index, const TSG_PACKET_AUTH* auth)
763{
764 WINPR_ASSERT(auth);
765
766 if (!tsg_ndr_write_version_caps(log, s, index, &auth->tsgVersionCaps))
767 return FALSE;
768
769 if (!Stream_EnsureRemainingCapacity(s, 4))
770 return FALSE;
771
772 Stream_Write_UINT32(s, auth->cookieLen);
773 if (!tsg_ndr_pointer_write(log, s, index, auth->cookieLen))
774 return FALSE;
775
776 if (!Stream_EnsureRemainingCapacity(s, auth->cookieLen))
777 return FALSE;
778 Stream_Write(s, auth->cookie, auth->cookieLen);
779 return TRUE;
780}
781
782WINPR_ATTR_NODISCARD
783static BOOL tsg_ndr_write_reauth(wLog* log, wStream* s, UINT32* index,
784 const TSG_PACKET_REAUTH* auth)
785{
786 WINPR_ASSERT(auth);
787
788 if (!Stream_EnsureRemainingCapacity(s, 12))
789 return FALSE;
790
791 Stream_Write_UINT64(s, auth->tunnelContext); /* TunnelContext (8 bytes) */
792 Stream_Write_UINT32(s, auth->packetId); /* PacketId (4 bytes) */
793
794 switch (auth->packetId)
795 {
796 case TSG_PACKET_TYPE_VERSIONCAPS:
797 return tsg_ndr_write_version_caps(log, s, index,
798 &auth->tsgInitialPacket.packetVersionCaps);
799 case TSG_PACKET_TYPE_AUTH:
800 return tsg_ndr_write_auth(log, s, index, &auth->tsgInitialPacket.packetAuth);
801 default:
802 WLog_Print(log, WLOG_ERROR, "unexpected packetId %s",
803 tsg_packet_id_to_string(auth->packetId));
804 return FALSE;
805 }
806}
807
808WINPR_ATTR_NODISCARD
809static BOOL tsg_ndr_read_packet_redirection_flags(wLog* log, wStream* s,
810 TSG_REDIRECTION_FLAGS* redirectionFlags)
811{
812 WINPR_ASSERT(redirectionFlags);
813
814 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 8, sizeof(UINT32)))
815 return FALSE;
816
817 redirectionFlags->enableAllRedirections =
818 Stream_Get_INT32(s); /* EnableAllRedirections (4 bytes) */
819 redirectionFlags->disableAllRedirections =
820 Stream_Get_INT32(s); /* DisableAllRedirections (4 bytes) */
821 redirectionFlags->driveRedirectionDisabled =
822 Stream_Get_INT32(s); /* DriveRedirectionDisabled (4 bytes) */
823 redirectionFlags->printerRedirectionDisabled =
824 Stream_Get_INT32(s); /* PrinterRedirectionDisabled (4 bytes) */
825 redirectionFlags->portRedirectionDisabled =
826 Stream_Get_INT32(s); /* PortRedirectionDisabled (4 bytes) */
827 redirectionFlags->reserved = Stream_Get_INT32(s); /* Reserved (4 bytes) */
828 redirectionFlags->clipboardRedirectionDisabled =
829 Stream_Get_INT32(s); /* ClipboardRedirectionDisabled (4 bytes) */
830 redirectionFlags->pnpRedirectionDisabled =
831 Stream_Get_INT32(s); /* PnpRedirectionDisabled (4 bytes) */
832 return TRUE;
833}
834
835WINPR_ATTR_FORMAT_ARG(3, 4)
836static BOOL tsg_print(char** buffer, size_t* len, WINPR_FORMAT_ARG const char* fmt, ...)
837{
838 int rc = 0;
839 va_list ap = WINPR_C_ARRAY_INIT;
840 if (!buffer || !len || !fmt)
841 return FALSE;
842 va_start(ap, fmt);
843 rc = vsnprintf(*buffer, *len, fmt, ap);
844 va_end(ap);
845 if ((rc < 0) || ((size_t)rc > *len))
846 return FALSE;
847 *len -= (size_t)rc;
848 *buffer += (size_t)rc;
849 return TRUE;
850}
851
852WINPR_ATTR_NODISCARD
853static BOOL tsg_packet_header_to_string(char** buffer, size_t* length,
854 const TSG_PACKET_HEADER* header)
855{
856 WINPR_ASSERT(buffer);
857 WINPR_ASSERT(length);
858 WINPR_ASSERT(header);
859
860 return tsg_print(buffer, length,
861 "header { ComponentId=0x%04" PRIx16 ", PacketId=0x%04" PRIx16 " }",
862 header->ComponentId, header->PacketId);
863}
864
865WINPR_ATTR_NODISCARD
866static BOOL tsg_type_capability_nap_to_string(char** buffer, size_t* length,
867 const TSG_CAPABILITY_NAP* cur)
868{
869 WINPR_ASSERT(buffer);
870 WINPR_ASSERT(length);
871 WINPR_ASSERT(cur);
872
873 return tsg_print(buffer, length, "%s { capabilities=0x%08" PRIx32 " }",
874 tsg_packet_id_to_string(TSG_CAPABILITY_TYPE_NAP), cur->capabilities);
875}
876
877WINPR_ATTR_NODISCARD
878static BOOL tsg_packet_capabilities_to_string(char** buffer, size_t* length,
879 const TSG_PACKET_CAPABILITIES* caps, UINT32 numCaps)
880{
881 WINPR_ASSERT(buffer);
882 WINPR_ASSERT(length);
883 WINPR_ASSERT(caps);
884
885 if (!tsg_print(buffer, length, "capabilities { "))
886 return FALSE;
887
888 for (UINT32 x = 0; x < numCaps; x++)
889 {
890 const TSG_PACKET_CAPABILITIES* cur = &caps[x];
891 switch (cur->capabilityType)
892 {
893 case TSG_CAPABILITY_TYPE_NAP:
894 if (!tsg_type_capability_nap_to_string(buffer, length, &cur->tsgPacket.tsgCapNap))
895 return FALSE;
896 break;
897 default:
898 if (!tsg_print(buffer, length, "TSG_UNKNOWN_CAPABILITY"))
899 return FALSE;
900 break;
901 }
902 }
903 return tsg_print(buffer, length, " }");
904}
905
906static BOOL tsg_packet_versioncaps_to_string(char** buffer, size_t* length,
907 const TSG_PACKET_VERSIONCAPS* caps)
908{
909 WINPR_ASSERT(buffer);
910 WINPR_ASSERT(length);
911 WINPR_ASSERT(caps);
912
913 if (!tsg_print(buffer, length, "versioncaps { "))
914 return FALSE;
915 if (!tsg_packet_header_to_string(buffer, length, &caps->tsgHeader))
916 return FALSE;
917
918 if (!tsg_print(buffer, length, " "))
919 return FALSE;
920
921 if (caps->numCapabilities > 1)
922 {
923 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
924 caps->numCapabilities);
925 return FALSE;
926 }
927
928 if (!tsg_packet_capabilities_to_string(buffer, length, &caps->tsgCaps, caps->numCapabilities))
929 return FALSE;
930
931 if (!tsg_print(buffer, length,
932 " numCapabilities=0x%08" PRIx32 ", majorVersion=0x%04" PRIx16
933 ", minorVersion=0x%04" PRIx16 ", quarantineCapabilities=0x%04" PRIx16,
934 caps->numCapabilities, caps->majorVersion, caps->minorVersion,
935 caps->quarantineCapabilities))
936 return FALSE;
937
938 return tsg_print(buffer, length, " }");
939}
940
941WINPR_ATTR_NODISCARD
942static BOOL tsg_packet_quarconfigrequest_to_string(char** buffer, size_t* length,
943 const TSG_PACKET_QUARCONFIGREQUEST* caps)
944{
945 WINPR_ASSERT(buffer);
946 WINPR_ASSERT(length);
947 WINPR_ASSERT(caps);
948
949 if (!tsg_print(buffer, length, "quarconfigrequest { "))
950 return FALSE;
951
952 if (!tsg_print(buffer, length, " "))
953 return FALSE;
954
955 if (!tsg_print(buffer, length, " flags=0x%08" PRIx32, caps->flags))
956 return FALSE;
957
958 return tsg_print(buffer, length, " }");
959}
960
961WINPR_ATTR_NODISCARD
962static BOOL tsg_packet_quarrequest_to_string(char** buffer, size_t* length,
963 const TSG_PACKET_QUARREQUEST* caps)
964{
965 BOOL rc = FALSE;
966 char* name = nullptr;
967 char* strdata = nullptr;
968
969 WINPR_ASSERT(buffer);
970 WINPR_ASSERT(length);
971 WINPR_ASSERT(caps);
972
973 if (!tsg_print(buffer, length, "quarrequest { "))
974 return FALSE;
975
976 if (!tsg_print(buffer, length, " "))
977 return FALSE;
978
979 if (caps->nameLength > 0)
980 {
981 if (caps->nameLength > INT_MAX)
982 return FALSE;
983 name = ConvertWCharNToUtf8Alloc(caps->machineName, caps->nameLength, nullptr);
984 if (!name)
985 return FALSE;
986 }
987
988 strdata = winpr_BinToHexString(caps->data, caps->dataLen, TRUE);
989 if (strdata || (caps->dataLen == 0))
990 rc = tsg_print(buffer, length,
991 " flags=0x%08" PRIx32 ", machineName=%s [%" PRIu32 "], data[%" PRIu32 "]=%s",
992 caps->flags, name, caps->nameLength, caps->dataLen, strdata);
993 free(name);
994 free(strdata);
995 if (!rc)
996 return FALSE;
997
998 return tsg_print(buffer, length, " }");
999}
1000
1001WINPR_ATTR_NODISCARD
1002static const char* tsg_bool_to_string(BOOL val)
1003{
1004 if (val)
1005 return "true";
1006 return "false";
1007}
1008
1009WINPR_ATTR_NODISCARD
1010static const char* tsg_redirection_flags_to_string(char* buffer, size_t size,
1011 const TSG_REDIRECTION_FLAGS* flags)
1012{
1013 WINPR_ASSERT(buffer || (size == 0));
1014 WINPR_ASSERT(flags);
1015
1016 (void)_snprintf(
1017 buffer, size,
1018 "enableAllRedirections=%s, disableAllRedirections=%s, driveRedirectionDisabled=%s, "
1019 "printerRedirectionDisabled=%s, portRedirectionDisabled=%s, reserved=%s, "
1020 "clipboardRedirectionDisabled=%s, pnpRedirectionDisabled=%s",
1021 tsg_bool_to_string(flags->enableAllRedirections),
1022 tsg_bool_to_string(flags->disableAllRedirections),
1023 tsg_bool_to_string(flags->driveRedirectionDisabled),
1024 tsg_bool_to_string(flags->printerRedirectionDisabled),
1025 tsg_bool_to_string(flags->portRedirectionDisabled), tsg_bool_to_string(flags->reserved),
1026 tsg_bool_to_string(flags->clipboardRedirectionDisabled),
1027 tsg_bool_to_string(flags->pnpRedirectionDisabled));
1028 return buffer;
1029}
1030
1031WINPR_ATTR_NODISCARD
1032static BOOL tsg_packet_response_to_string(char** buffer, size_t* length,
1033 const TSG_PACKET_RESPONSE* caps)
1034{
1035 BOOL rc = FALSE;
1036 char* strdata = nullptr;
1037 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
1038
1039 WINPR_ASSERT(buffer);
1040 WINPR_ASSERT(length);
1041 WINPR_ASSERT(caps);
1042
1043 if (!tsg_print(buffer, length, "response { "))
1044 return FALSE;
1045
1046 if (!tsg_print(buffer, length, " "))
1047 return FALSE;
1048
1049 strdata = winpr_BinToHexString(caps->responseData, caps->responseDataLen, TRUE);
1050 if (strdata || (caps->responseDataLen == 0))
1051 rc = tsg_print(
1052 buffer, length,
1053 " flags=0x%08" PRIx32 ", reserved=0x%08" PRIx32 ", responseData[%" PRIu32
1054 "]=%s, redirectionFlags={ %s }",
1055 caps->flags, caps->reserved, caps->responseDataLen, strdata,
1056 tsg_redirection_flags_to_string(tbuffer, ARRAYSIZE(tbuffer), &caps->redirectionFlags));
1057 free(strdata);
1058 if (!rc)
1059 return FALSE;
1060
1061 return tsg_print(buffer, length, " }");
1062}
1063
1064WINPR_ATTR_NODISCARD
1065static BOOL tsg_packet_quarenc_response_to_string(char** buffer, size_t* length,
1066 const TSG_PACKET_QUARENC_RESPONSE* caps)
1067{
1068 BOOL rc = FALSE;
1069 char* strdata = nullptr;
1070 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
1071 size_t size = ARRAYSIZE(tbuffer);
1072 char* ptbuffer = tbuffer;
1073
1074 WINPR_ASSERT(buffer);
1075 WINPR_ASSERT(length);
1076 WINPR_ASSERT(caps);
1077
1078 if (!tsg_print(buffer, length, "quarenc_response { "))
1079 return FALSE;
1080
1081 if (!tsg_print(buffer, length, " "))
1082 return FALSE;
1083
1084 char uuid[64] = WINPR_C_ARRAY_INIT;
1085 if (!guid2str(&caps->nonce, uuid, sizeof(uuid)))
1086 goto fail;
1087
1088 if (caps->certChainLen > 0)
1089 {
1090 if (caps->certChainLen > INT_MAX)
1091 goto fail;
1092 strdata = ConvertWCharNToUtf8Alloc(caps->certChainData, caps->certChainLen, nullptr);
1093 if (!strdata)
1094 goto fail;
1095 }
1096
1097 tsg_packet_versioncaps_to_string(&ptbuffer, &size, &caps->versionCaps);
1098 if (strdata || (caps->certChainLen == 0))
1099 rc =
1100 tsg_print(buffer, length,
1101 " flags=0x%08" PRIx32 ", certChain[%" PRIu32 "]=%s, nonce=%s, versionCaps=%s",
1102 caps->flags, caps->certChainLen, strdata, uuid, tbuffer);
1103
1104fail:
1105 free(strdata);
1106 if (!rc)
1107 return FALSE;
1108
1109 return tsg_print(buffer, length, " }");
1110}
1111
1112WINPR_ATTR_NODISCARD
1113static BOOL tsg_packet_message_response_to_string(char** buffer, size_t* length,
1114 const TSG_PACKET_MSG_RESPONSE* caps)
1115{
1116 WINPR_ASSERT(buffer);
1117 WINPR_ASSERT(length);
1118 WINPR_ASSERT(caps);
1119
1120 if (!tsg_print(buffer, length, "msg_response { "))
1121 return FALSE;
1122
1123 if (!tsg_print(buffer, length,
1124 " msgID=0x%08" PRIx32 ", msgType=0x%08" PRIx32 ", isMsgPresent=%" PRId32,
1125 caps->msgID, caps->msgType, caps->isMsgPresent))
1126 return FALSE;
1127
1128 return tsg_print(buffer, length, " }");
1129}
1130
1131WINPR_ATTR_NODISCARD
1132static BOOL tsg_packet_caps_response_to_string(char** buffer, size_t* length,
1133 const TSG_PACKET_CAPS_RESPONSE* caps)
1134{
1135 WINPR_ASSERT(buffer);
1136 WINPR_ASSERT(length);
1137 WINPR_ASSERT(caps);
1138
1139 if (!tsg_print(buffer, length, "caps_response { "))
1140 return FALSE;
1141
1142 if (!tsg_packet_quarenc_response_to_string(buffer, length, &caps->pktQuarEncResponse))
1143 return FALSE;
1144
1145 if (!tsg_packet_message_response_to_string(buffer, length, &caps->pktConsentMessage))
1146 return FALSE;
1147
1148 return tsg_print(buffer, length, " }");
1149}
1150
1151WINPR_ATTR_NODISCARD
1152static BOOL tsg_packet_message_request_to_string(char** buffer, size_t* length,
1153 const TSG_PACKET_MSG_REQUEST* caps)
1154{
1155 WINPR_ASSERT(buffer);
1156 WINPR_ASSERT(length);
1157 WINPR_ASSERT(caps);
1158
1159 if (!tsg_print(buffer, length, "caps_message_request { "))
1160 return FALSE;
1161
1162 if (!tsg_print(buffer, length, " maxMessagesPerBatch=%" PRIu32, caps->maxMessagesPerBatch))
1163 return FALSE;
1164
1165 return tsg_print(buffer, length, " }");
1166}
1167
1168WINPR_ATTR_NODISCARD
1169static BOOL tsg_packet_auth_to_string(char** buffer, size_t* length, const TSG_PACKET_AUTH* caps)
1170{
1171 BOOL rc = FALSE;
1172 char* strdata = nullptr;
1173 WINPR_ASSERT(buffer);
1174 WINPR_ASSERT(length);
1175 WINPR_ASSERT(caps);
1176
1177 if (!tsg_print(buffer, length, "caps_message_request { "))
1178 return FALSE;
1179
1180 if (!tsg_packet_versioncaps_to_string(buffer, length, &caps->tsgVersionCaps))
1181 return FALSE;
1182
1183 strdata = winpr_BinToHexString(caps->cookie, caps->cookieLen, TRUE);
1184 if (strdata || (caps->cookieLen == 0))
1185 rc = tsg_print(buffer, length, " cookie[%" PRIu32 "]=%s", caps->cookieLen, strdata);
1186 free(strdata);
1187 if (!rc)
1188 return FALSE;
1189
1190 return tsg_print(buffer, length, " }");
1191}
1192
1193WINPR_ATTR_NODISCARD
1194static BOOL tsg_packet_reauth_to_string(char** buffer, size_t* length,
1195 const TSG_PACKET_REAUTH* caps)
1196{
1197 BOOL rc = FALSE;
1198 WINPR_ASSERT(buffer);
1199 WINPR_ASSERT(length);
1200 WINPR_ASSERT(caps);
1201
1202 if (!tsg_print(buffer, length, "caps_message_request { "))
1203 return FALSE;
1204
1205 if (!tsg_print(buffer, length, " tunnelContext=0x%016" PRIx64 ", packetId=%s [0x%08" PRIx32 "]",
1206 caps->tunnelContext, tsg_packet_id_to_string(caps->packetId), caps->packetId))
1207 return FALSE;
1208
1209 switch (caps->packetId)
1210 {
1211 case TSG_PACKET_TYPE_VERSIONCAPS:
1212 rc = tsg_packet_versioncaps_to_string(buffer, length,
1213 &caps->tsgInitialPacket.packetVersionCaps);
1214 break;
1215 case TSG_PACKET_TYPE_AUTH:
1216 rc = tsg_packet_auth_to_string(buffer, length, &caps->tsgInitialPacket.packetAuth);
1217 break;
1218 default:
1219 rc = tsg_print(buffer, length, "TODO: Unhandled packet type %s [0x%08" PRIx32 "]",
1220 tsg_packet_id_to_string(caps->packetId), caps->packetId);
1221 break;
1222 }
1223
1224 if (!rc)
1225 return FALSE;
1226
1227 return tsg_print(buffer, length, " }");
1228}
1229
1230WINPR_ATTR_NODISCARD
1231static const char* tsg_packet_to_string(const TSG_PACKET* packet)
1232{
1233 size_t len = 8192;
1234 static char sbuffer[8193] = WINPR_C_ARRAY_INIT;
1235 char* buffer = sbuffer;
1236
1237 if (!tsg_print(&buffer, &len, "TSG_PACKET { packetId=%s [0x%08" PRIx32 "], ",
1238 tsg_packet_id_to_string(packet->packetId), packet->packetId))
1239 goto fail;
1240
1241 switch (packet->packetId)
1242 {
1243 case TSG_PACKET_TYPE_HEADER:
1244 if (!tsg_packet_header_to_string(&buffer, &len, &packet->tsgPacket.packetHeader))
1245 goto fail;
1246 break;
1247 case TSG_PACKET_TYPE_VERSIONCAPS:
1248 if (!tsg_packet_versioncaps_to_string(&buffer, &len,
1249 &packet->tsgPacket.packetVersionCaps))
1250 goto fail;
1251 break;
1252 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
1253 if (!tsg_packet_quarconfigrequest_to_string(&buffer, &len,
1254 &packet->tsgPacket.packetQuarConfigRequest))
1255 goto fail;
1256 break;
1257 case TSG_PACKET_TYPE_QUARREQUEST:
1258 if (!tsg_packet_quarrequest_to_string(&buffer, &len,
1259 &packet->tsgPacket.packetQuarRequest))
1260 goto fail;
1261 break;
1262 case TSG_PACKET_TYPE_RESPONSE:
1263 if (!tsg_packet_response_to_string(&buffer, &len, &packet->tsgPacket.packetResponse))
1264 goto fail;
1265 break;
1266 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
1267 if (!tsg_packet_quarenc_response_to_string(&buffer, &len,
1268 &packet->tsgPacket.packetQuarEncResponse))
1269 goto fail;
1270 break;
1271 case TSG_PACKET_TYPE_CAPS_RESPONSE:
1272 if (!tsg_packet_caps_response_to_string(&buffer, &len,
1273 &packet->tsgPacket.packetCapsResponse))
1274 goto fail;
1275 break;
1276 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
1277 if (!tsg_packet_message_request_to_string(&buffer, &len,
1278 &packet->tsgPacket.packetMsgRequest))
1279 goto fail;
1280 break;
1281 case TSG_PACKET_TYPE_MESSAGE_PACKET:
1282 if (!tsg_packet_message_response_to_string(&buffer, &len,
1283 &packet->tsgPacket.packetMsgResponse))
1284 goto fail;
1285 break;
1286 case TSG_PACKET_TYPE_AUTH:
1287 if (!tsg_packet_auth_to_string(&buffer, &len, &packet->tsgPacket.packetAuth))
1288 goto fail;
1289 break;
1290 case TSG_PACKET_TYPE_REAUTH:
1291 if (!tsg_packet_reauth_to_string(&buffer, &len, &packet->tsgPacket.packetReauth))
1292 goto fail;
1293 break;
1294 default:
1295 if (!tsg_print(&buffer, &len, "INVALID"))
1296 goto fail;
1297 break;
1298 }
1299
1300 if (!tsg_print(&buffer, &len, " }"))
1301 goto fail;
1302
1303fail:
1304 return sbuffer;
1305}
1306
1307WINPR_ATTR_NODISCARD
1308static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align)
1309{
1310 size_t pos = 0;
1311 size_t offset = 0;
1312
1313 if (!s)
1314 return FALSE;
1315
1316 pos = Stream_GetPosition(s);
1317
1318 if ((pos % align) != 0)
1319 offset = align - pos % align;
1320
1321 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, offset))
1322 return FALSE;
1323 Stream_Seek(s, offset);
1324 return TRUE;
1325}
1326
1327WINPR_ATTR_NODISCARD
1328static BIO_METHOD* BIO_s_tsg(void);
1364WINPR_ATTR_NODISCARD
1365static int TsProxySendToServer(handle_t IDL_handle, const byte pRpcMessage[], UINT32 count,
1366 const UINT32* lengths)
1367{
1368 wStream* s = nullptr;
1369 rdpTsg* tsg = nullptr;
1370 size_t length = 0;
1371 const byte* buffer1 = nullptr;
1372 const byte* buffer2 = nullptr;
1373 const byte* buffer3 = nullptr;
1374 UINT32 buffer1Length = 0;
1375 UINT32 buffer2Length = 0;
1376 UINT32 buffer3Length = 0;
1377 UINT32 numBuffers = 0;
1378 UINT32 totalDataBytes = 0;
1379 tsg = (rdpTsg*)IDL_handle;
1380 buffer1Length = buffer2Length = buffer3Length = 0;
1381
1382 if (count > 0)
1383 {
1384 numBuffers++;
1385 buffer1 = &pRpcMessage[0];
1386 buffer1Length = lengths[0];
1387 totalDataBytes += lengths[0] + 4;
1388 }
1389
1390 if (count > 1)
1391 {
1392 numBuffers++;
1393 buffer2 = &pRpcMessage[1];
1394 buffer2Length = lengths[1];
1395 totalDataBytes += lengths[1] + 4;
1396 }
1397
1398 if (count > 2)
1399 {
1400 numBuffers++;
1401 buffer3 = &pRpcMessage[2];
1402 buffer3Length = lengths[2];
1403 totalDataBytes += lengths[2] + 4;
1404 }
1405
1406 length = 28ull + totalDataBytes;
1407 if (length > INT_MAX)
1408 return -1;
1409 s = Stream_New(nullptr, length);
1410
1411 if (!s)
1412 {
1413 WLog_Print(tsg->log, WLOG_ERROR, "Stream_New failed!");
1414 return -1;
1415 }
1416
1417 /* PCHANNEL_CONTEXT_HANDLE_NOSERIALIZE_NR (20 bytes) */
1418 if (!TsProxyWriteTunnelContext(tsg->log, s, &tsg->ChannelContext))
1419 goto fail;
1420 Stream_Write_UINT32_BE(s, totalDataBytes); /* totalDataBytes (4 bytes) */
1421 Stream_Write_UINT32_BE(s, numBuffers); /* numBuffers (4 bytes) */
1422
1423 if (buffer1Length > 0)
1424 Stream_Write_UINT32_BE(s, buffer1Length); /* buffer1Length (4 bytes) */
1425
1426 if (buffer2Length > 0)
1427 Stream_Write_UINT32_BE(s, buffer2Length); /* buffer2Length (4 bytes) */
1428
1429 if (buffer3Length > 0)
1430 Stream_Write_UINT32_BE(s, buffer3Length); /* buffer3Length (4 bytes) */
1431
1432 if (buffer1Length > 0)
1433 Stream_Write(s, buffer1, buffer1Length); /* buffer1 (variable) */
1434
1435 if (buffer2Length > 0)
1436 Stream_Write(s, buffer2, buffer2Length); /* buffer2 (variable) */
1437
1438 if (buffer3Length > 0)
1439 Stream_Write(s, buffer3, buffer3Length); /* buffer3 (variable) */
1440
1441 if (!rpc_client_write_call(tsg->rpc, s, TsProxySendToServerOpnum))
1442 return -1;
1443
1444 return (int)length;
1445fail:
1446 Stream_Free(s, TRUE);
1447 return -1;
1448}
1449
1460WINPR_ATTR_NODISCARD
1461static BOOL TsProxyCreateTunnelWriteRequest(rdpTsg* tsg, const TSG_PACKET* tsgPacket)
1462{
1463 BOOL rc = FALSE;
1464 BOOL write = TRUE;
1465 UINT16 opnum = 0;
1466 wStream* s = nullptr;
1467 rdpRpc* rpc = nullptr;
1468
1469 if (!tsg || !tsg->rpc)
1470 return FALSE;
1471
1472 rpc = tsg->rpc;
1473 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_to_string(tsgPacket));
1474 s = Stream_New(nullptr, 108);
1475
1476 if (!s)
1477 return FALSE;
1478
1479 switch (tsgPacket->packetId)
1480 {
1481 case TSG_PACKET_TYPE_VERSIONCAPS:
1482 {
1483 UINT32 index = 0;
1484 const TSG_PACKET_VERSIONCAPS* packetVersionCaps =
1485 &tsgPacket->tsgPacket.packetVersionCaps;
1486
1487 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1488 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1489 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketVersionCapsPtr (4 bytes) */
1490 goto fail;
1491
1492 if (!tsg_ndr_write_version_caps(tsg->log, s, &index, packetVersionCaps))
1493 goto fail;
1498 /*
1499 * 8-byte constant (8A E3 13 71 02 F4 36 71) also observed here:
1500 * http://lists.samba.org/archive/cifs-protocol/2010-July/001543.html
1501 */
1502 Stream_Write_UINT8(s, 0x8A);
1503 Stream_Write_UINT8(s, 0xE3);
1504 Stream_Write_UINT8(s, 0x13);
1505 Stream_Write_UINT8(s, 0x71);
1506 Stream_Write_UINT8(s, 0x02);
1507 Stream_Write_UINT8(s, 0xF4);
1508 Stream_Write_UINT8(s, 0x36);
1509 Stream_Write_UINT8(s, 0x71);
1510 Stream_Write_UINT32(s, 0x00040001); /* 1.4 (version?) */
1511 Stream_Write_UINT32(s, 0x00000001); /* 1 (element count?) */
1512 /* p_cont_list_t */
1513 Stream_Write_UINT8(s, 2); /* ncontext_elem */
1514 Stream_Write_UINT8(s, 0x40); /* reserved1 */
1515 Stream_Write_UINT16(s, 0x0028); /* reserved2 */
1516 /* p_syntax_id_t */
1517 Stream_Write(s, &TSGU_UUID, sizeof(p_uuid_t));
1518 Stream_Write_UINT32(s, TSGU_SYNTAX_IF_VERSION);
1519 /* p_syntax_id_t */
1520 Stream_Write(s, &NDR_UUID, sizeof(p_uuid_t));
1521 Stream_Write_UINT32(s, NDR_SYNTAX_IF_VERSION);
1522 opnum = TsProxyCreateTunnelOpnum;
1523 }
1524 break;
1525
1526 case TSG_PACKET_TYPE_REAUTH:
1527 {
1528 const TSG_PACKET_REAUTH* packetReauth = &tsgPacket->tsgPacket.packetReauth;
1529 UINT32 index = 0;
1530 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1531 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1532 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketReauthPtr (4 bytes) */
1533 goto fail;
1534 if (!tsg_ndr_write_reauth(tsg->log, s, &index, packetReauth))
1535 goto fail;
1536 opnum = TsProxyCreateTunnelOpnum;
1537 }
1538 break;
1539
1540 default:
1541 WLog_Print(tsg->log, WLOG_WARN, "unexpected packetId %s",
1542 tsg_packet_id_to_string(tsgPacket->packetId));
1543 write = FALSE;
1544 break;
1545 }
1546
1547 rc = TRUE;
1548
1549 if (write)
1550 return rpc_client_write_call(rpc, s, opnum);
1551fail:
1552 Stream_Free(s, TRUE);
1553 return rc;
1554}
1555
1556WINPR_ATTR_NODISCARD
1557static BOOL tsg_ndr_read_consent_message(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1558 UINT32 msgType, BOOL isMessagePresent)
1559{
1560 TSG_PACKET_STRING_MESSAGE packetStringMessage = WINPR_C_ARRAY_INIT;
1561
1562 WINPR_ASSERT(context);
1563 WINPR_ASSERT(index);
1564
1565 if (!TsProxyReadPacketSTringMessage(log, s, index, &packetStringMessage))
1566 return FALSE;
1567
1568 if (context->instance && isMessagePresent)
1569 {
1570 return IFCALLRESULT(TRUE, context->instance->PresentGatewayMessage, context->instance,
1571 msgType, packetStringMessage.isDisplayMandatory != 0,
1572 packetStringMessage.isConsentMandatory != 0,
1573 packetStringMessage.msgBytes, packetStringMessage.msgBuffer);
1574 }
1575
1576 return TRUE;
1577}
1578
1579WINPR_ATTR_NODISCARD
1580static BOOL tsg_ndr_read_tunnel_context(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext,
1581 UINT32* tunnelId)
1582{
1583 if (!tsg_stream_align(log, s, 4))
1584 return FALSE;
1585
1586 /* TunnelContext (20 bytes) */
1587 if (!TsProxyReadTunnelContext(log, s, tunnelContext))
1588 return FALSE;
1589
1590 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1591 return FALSE;
1592
1593 WINPR_ASSERT(tunnelId);
1594 Stream_Read_UINT32(s, *tunnelId); /* TunnelId (4 bytes) */
1595
1596 INT32 ReturnValue = 0;
1597 Stream_Read_INT32(s, ReturnValue); /* ReturnValue (4 bytes) */
1598 if (ReturnValue != NO_ERROR)
1599 WLog_WARN(TAG, "ReturnValue=%s", NtStatus2Tag(ReturnValue));
1600 return TRUE;
1601}
1602
1603WINPR_ATTR_NODISCARD
1604static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(wLog* log, wStream* s,
1605 TSG_PACKET_MSG_RESPONSE* pkt)
1606{
1607
1608 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 16))
1609 return FALSE;
1610
1611 Stream_Read_UINT32(s, pkt->msgID); /* MsgId (4 bytes) */
1612 Stream_Read_UINT32(s, pkt->msgType); /* MsgType (4 bytes) */
1613 Stream_Read_INT32(s, pkt->isMsgPresent); /* IsMsgPresent (4 bytes) */
1614 const uint32_t SwitchValue = Stream_Get_UINT32(s); /* SwitchValue (4 bytes) */
1615
1616 if (pkt->msgType != SwitchValue)
1617 {
1618 WLog_ERR(TAG,
1619 "[MS-TSGU] 2.2.9.2.1.9 TSG_PACKET_MSG_RESPONSE MsgType[0x%08" PRIx32
1620 "] != MessageSwitchValue [0x%08" PRIx32 "]",
1621 pkt->msgType, SwitchValue);
1622 return FALSE;
1623 }
1624
1625 return TRUE;
1626}
1627
1628WINPR_ATTR_NODISCARD
1629static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(wLog* log, rdpContext* context, wStream* s,
1630 uint32_t* index, uint32_t MsgPtr,
1631 const TSG_PACKET_MSG_RESPONSE* pkg,
1632 uint64_t* reauthContext)
1633{
1634 WINPR_ASSERT(pkg);
1635
1636 if (MsgPtr == 0)
1637 {
1638 WLog_Print(log, WLOG_DEBUG,
1639 "Message {0x%08" PRIx32 "} [%s]::isMsgPresent=%" PRId32 ", MsgPtr=0x%08" PRIx32,
1640 pkg->msgType, tsg_packet_id_to_string(pkg->msgType), pkg->isMsgPresent, MsgPtr);
1641 return TRUE;
1642 }
1643
1644 switch (pkg->msgType)
1645 {
1646 case TSG_ASYNC_MESSAGE_CONSENT_MESSAGE:
1647 case TSG_ASYNC_MESSAGE_SERVICE_MESSAGE:
1648 return tsg_ndr_read_consent_message(log, context, s, index, pkg->msgType,
1649 pkg->isMsgPresent);
1650
1651 case TSG_ASYNC_MESSAGE_REAUTH:
1652 {
1653 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1654 return FALSE;
1655
1656 WINPR_ASSERT(reauthContext);
1657 const uint64_t val = Stream_Get_UINT64(s); /* TunnelContext (8 bytes) */
1658 if (pkg->isMsgPresent != 0)
1659 *reauthContext = val;
1660 return TRUE;
1661 }
1662
1663 default:
1664 WLog_Print(log, WLOG_ERROR, "Unexpected Message Type: 0x%" PRIx32 "", pkg->msgType);
1665 return FALSE;
1666 }
1667}
1668
1669WINPR_ATTR_NODISCARD
1670static BOOL tsg_ndr_read_caps_response(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1671 UINT32 PacketPtr, TSG_PACKET_CAPS_RESPONSE* caps,
1672 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId,
1673 uint64_t* reauthContext)
1674{
1675 UINT32 PacketQuarResponsePtr = 0;
1676
1677 WINPR_ASSERT(context);
1678 WINPR_ASSERT(index);
1679 WINPR_ASSERT(caps);
1680 WINPR_ASSERT(reauthContext);
1681
1682 if (!tsg_ndr_pointer_read(log, s, index, &PacketQuarResponsePtr, TRUE))
1683 goto fail;
1684
1685 if (!tsg_ndr_read_quarenc_response(log, s, index, &caps->pktQuarEncResponse))
1686 goto fail;
1687
1688 if (PacketPtr)
1689 {
1690 TSG_PACKET_MSG_RESPONSE pkg = WINPR_C_ARRAY_INIT;
1691 UINT32 MsgPtr = 0;
1692
1693 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(log, s, &pkg))
1694 goto fail;
1695
1696 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, TRUE))
1697 return FALSE;
1698
1699 if (!tsg_ndr_read_quarenc_data(log, s, index, &caps->pktQuarEncResponse))
1700 goto fail;
1701
1702 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(log, context, s, index, MsgPtr, &pkg,
1703 reauthContext))
1704 goto fail;
1705 }
1706
1707 return tsg_ndr_read_tunnel_context(log, s, tunnelContext, tunnelId);
1708fail:
1709 return FALSE;
1710}
1711
1712WINPR_ATTR_NODISCARD
1713static BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu,
1714 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId)
1715{
1716 BOOL rc = FALSE;
1717 UINT32 index = 0;
1718 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
1719 UINT32 SwitchValue = 0;
1720 rdpContext* context = nullptr;
1721 UINT32 PacketPtr = 0;
1722
1723 WINPR_ASSERT(tsg);
1724 WINPR_ASSERT(tsg->rpc);
1725 WINPR_ASSERT(tsg->rpc->transport);
1726
1727 context = transport_get_context(tsg->rpc->transport);
1728 WINPR_ASSERT(context);
1729
1730 if (!pdu)
1731 return FALSE;
1732
1733 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
1734 goto fail;
1735
1736 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 8))
1737 goto fail;
1738 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
1739 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
1740
1741 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
1742
1743 if ((packet.packetId == TSG_PACKET_TYPE_CAPS_RESPONSE) &&
1744 (SwitchValue == TSG_PACKET_TYPE_CAPS_RESPONSE))
1745 {
1746 if (!tsg_ndr_read_caps_response(tsg->log, context, pdu->s, &index, PacketPtr,
1747 &packet.tsgPacket.packetCapsResponse, tunnelContext,
1748 tunnelId, &tsg->ReauthTunnelContext))
1749 goto fail;
1750 tsg->CapsResponse = packet.tsgPacket.packetCapsResponse.pktQuarEncResponse;
1751 }
1752 else if ((packet.packetId == TSG_PACKET_TYPE_QUARENC_RESPONSE) &&
1753 (SwitchValue == TSG_PACKET_TYPE_QUARENC_RESPONSE))
1754 {
1755 UINT32 PacketQuarResponsePtr = 0;
1756
1757 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketQuarResponsePtr, TRUE))
1758 goto fail;
1759
1760 if (!tsg_ndr_read_quarenc_response(tsg->log, pdu->s, &index,
1761 &packet.tsgPacket.packetQuarEncResponse))
1762 goto fail;
1763
1764 if (!tsg_ndr_read_quarenc_data(tsg->log, pdu->s, &index,
1765 &packet.tsgPacket.packetQuarEncResponse))
1766 goto fail;
1767
1768 if (!tsg_ndr_read_tunnel_context(tsg->log, pdu->s, tunnelContext, tunnelId))
1769 goto fail;
1770
1771 tsg->CapsResponse = packet.tsgPacket.packetQuarEncResponse;
1772 }
1773 else
1774 {
1775 WLog_Print(tsg->log, WLOG_ERROR,
1776 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_CAPS_RESPONSE "
1777 "or TSG_PACKET_TYPE_QUARENC_RESPONSE",
1778 packet.packetId);
1779 goto fail;
1780 }
1781
1782 {
1783 const size_t rem = Stream_GetRemainingLength(pdu->s);
1784 if (rem != 0)
1785 {
1786 WLog_Print(tsg->log, WLOG_WARN, "Partially parsed %s, %" PRIuz " bytes remain",
1787 tsg_packet_id_to_string(packet.packetId), rem);
1788 }
1789 }
1790
1791 rc = TRUE;
1792fail:
1793 return rc;
1794}
1795
1806WINPR_ATTR_NODISCARD
1807static BOOL TsProxyAuthorizeTunnelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
1808{
1809 if (!tsg || !tsg->rpc || !tunnelContext)
1810 return FALSE;
1811
1812 rdpRpc* rpc = tsg->rpc;
1813
1814 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyAuthorizeTunnelWriteRequest");
1815 wStream* s = Stream_New(nullptr, 1024 + sizeof(WCHAR) * tsg->QuarreQuest.nameLength +
1816 tsg->QuarreQuest.dataLen);
1817
1818 if (!s)
1819 return FALSE;
1820
1821 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
1822 {
1823 Stream_Free(s, TRUE);
1824 return FALSE;
1825 }
1826
1827 /* 4-byte alignment */
1828 UINT32 index = 0;
1829 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* PacketId (4 bytes) */
1830 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* SwitchValue (4 bytes) */
1831 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketQuarRequestPtr (4 bytes) */
1832 goto fail;
1833 Stream_Write_UINT32(s, tsg->QuarreQuest.flags); /* Flags (4 bytes) */
1834 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* MachineNamePtr (4 bytes) */
1835 goto fail;
1836 Stream_Write_UINT32(s, tsg->QuarreQuest.nameLength); /* NameLength (4 bytes) */
1837 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* DataPtr (4 bytes) */
1838 goto fail;
1839 Stream_Write_UINT32(s, tsg->QuarreQuest.dataLen); /* DataLength (4 bytes) */
1840 /* MachineName */
1841 if (!tsg_ndr_write_string(tsg->log, s, tsg->QuarreQuest.machineName,
1842 tsg->QuarreQuest.nameLength))
1843 goto fail;
1844 /* data */
1845 if (!tsg_ndr_write_conformant_array(tsg->log, s, tsg->QuarreQuest.data,
1846 tsg->QuarreQuest.dataLen))
1847 goto fail;
1848
1849 Stream_SealLength(s);
1850 return rpc_client_write_call(rpc, s, TsProxyAuthorizeTunnelOpnum);
1851fail:
1852 Stream_Free(s, TRUE);
1853 return FALSE;
1854}
1855
1856WINPR_ATTR_NODISCARD
1857static UINT32 tsg_redir_to_flags(const TSG_REDIRECTION_FLAGS* redirect)
1858{
1859 UINT32 flags = 0;
1860 if (redirect->enableAllRedirections)
1861 flags |= HTTP_TUNNEL_REDIR_ENABLE_ALL;
1862 if (redirect->disableAllRedirections)
1863 flags |= HTTP_TUNNEL_REDIR_DISABLE_ALL;
1864
1865 if (redirect->driveRedirectionDisabled)
1866 flags |= HTTP_TUNNEL_REDIR_DISABLE_DRIVE;
1867 if (redirect->printerRedirectionDisabled)
1868 flags |= HTTP_TUNNEL_REDIR_DISABLE_PRINTER;
1869 if (redirect->portRedirectionDisabled)
1870 flags |= HTTP_TUNNEL_REDIR_DISABLE_PORT;
1871 if (redirect->clipboardRedirectionDisabled)
1872 flags |= HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD;
1873 if (redirect->pnpRedirectionDisabled)
1874 flags |= HTTP_TUNNEL_REDIR_DISABLE_PNP;
1875 return flags;
1876}
1877
1878WINPR_ATTR_NODISCARD
1879static BOOL tsg_redirect_apply(rdpTsg* tsg, const TSG_REDIRECTION_FLAGS* redirect)
1880{
1881 WINPR_ASSERT(tsg);
1882 WINPR_ASSERT(redirect);
1883
1884 rdpTransport* transport = tsg->transport;
1885 WINPR_ASSERT(transport);
1886
1887 rdpContext* context = transport_get_context(transport);
1888 UINT32 redirFlags = tsg_redir_to_flags(redirect);
1889 return utils_apply_gateway_policy(tsg->log, context, redirFlags, "TSG");
1890}
1891
1892WINPR_ATTR_NODISCARD
1893static BOOL tsg_ndr_read_timeout(wLog* log, wStream* s, size_t tlen)
1894{
1895 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1896 return FALSE;
1897
1898 if (tlen < sizeof(UINT32))
1899 {
1900 WLog_Print(log, WLOG_ERROR, "[IDLE_TIMEOUT] array element length %" PRIuz ", expected 4",
1901 tlen);
1902 return FALSE;
1903 }
1904
1905 const UINT32 idleTimeout = Stream_Get_UINT32(s);
1906 WLog_Print(log, WLOG_DEBUG, "[IDLE_TIMEOUT] idleTimeout=%" PRIu32 ": TODO: unused",
1907 idleTimeout);
1908 return TRUE;
1909}
1910
1911WINPR_ATTR_NODISCARD
1912static BOOL tsg_ndr_read_sohr(wLog* log, wStream* s, BOOL expected)
1913{
1914 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1915 return FALSE;
1916
1917 const UINT32 len = Stream_Get_UINT32(s);
1918 if (!expected)
1919 {
1920 if (len != 0)
1921 {
1922 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": skipping", len);
1923 return FALSE;
1924 }
1925 return TRUE;
1926 }
1927 else if (len == 0)
1928 {
1929 WLog_Print(log, WLOG_WARN, "[SOH] len=%" PRIu32 ": expected length > 0", len);
1930 }
1931
1932 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": TODO: unused", len);
1933 if (!Stream_SafeSeek(s, len))
1934 return FALSE;
1935
1936 winpr_HexLogDump(log, WLOG_DEBUG, Stream_Pointer(s), len);
1937 return TRUE;
1938}
1939
1940WINPR_ATTR_NODISCARD
1941static BOOL tsg_ndr_read_packet_response_data(rdpTsg* tsg, wStream* s,
1942 const TSG_PACKET_RESPONSE* response)
1943{
1944 WINPR_ASSERT(tsg);
1945
1946 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1947 return FALSE;
1948
1949 const uint32_t arrayMaxLen = Stream_Get_UINT32(s);
1950 const size_t rem = Stream_GetRemainingLength(s);
1951 if (arrayMaxLen != response->responseDataLen)
1952 {
1953 WLog_Print(tsg->log, WLOG_ERROR,
1954 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1955 " != NDR array len %" PRIu32,
1956 response->responseDataLen, arrayMaxLen);
1957 }
1958 if (response->responseDataLen > 0)
1959 {
1960 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1961 return FALSE;
1962
1963 if (tsg->CapsResponse.versionCaps.tsgCaps.capabilityType != TSG_CAPABILITY_TYPE_NAP)
1964 {
1965 WLog_Print(
1966 tsg->log, WLOG_ERROR,
1967 "2.2.9.2.1.5 TSG_PACKET_RESPONSE Negotiated Capabilities type is 0x%08" PRIx32
1968 ", expected TSG_CAPABILITY_TYPE_NAP[0x00000001]",
1969 tsg->CapsResponse.versionCaps.tsgCaps.capabilityType);
1970 return FALSE;
1971 }
1972 const UINT32 mask = (TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT);
1973 const UINT32 val =
1974 (tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities & mask);
1975 if ((val == mask) && (tsg->QuarreQuest.dataLen > 0))
1976 {
1977 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1978 return FALSE;
1979 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1980 return FALSE;
1981 }
1982 else if ((val == TSG_NAP_CAPABILITY_QUAR_SOH) && (tsg->QuarreQuest.dataLen > 0))
1983 {
1984 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1985 return FALSE;
1986 }
1987 else if ((val & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
1988 {
1989 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1990 return FALSE;
1991 if (!tsg_ndr_read_sohr(tsg->log, s, FALSE))
1992 return FALSE;
1993 }
1994 else
1995 {
1996 WLog_Print(
1997 tsg->log, WLOG_ERROR,
1998 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1999 ", but neither TSG_NAP_CAPABILITY_QUAR_SOH nor "
2000 "TSG_NAP_CAPABILITY_IDLE_TIMEOUT are set, so expecting 0 (actually got %" PRIuz ")",
2001 response->responseDataLen, rem);
2002 return FALSE;
2003 }
2004 }
2005 else if (rem > 0)
2006 {
2007 char buffer[256] = WINPR_C_ARRAY_INIT;
2008 WLog_Print(tsg->log, WLOG_WARN,
2009 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
2010 ", but actually got %" PRIuz " [flags=%s], ignoring.",
2011 response->responseDataLen, rem,
2012 tsg_caps_to_string(
2013 tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities,
2014 buffer, sizeof(buffer)));
2015 if (!Stream_SafeSeek(s, rem))
2016 return FALSE;
2017 }
2018
2019 {
2020 const size_t trem = Stream_GetRemainingLength(s);
2021 if (trem > 0)
2022 {
2023 WLog_Print(tsg->log, WLOG_WARN,
2024 "2.2.9.2.1.5 TSG_PACKET_RESPONSE %" PRIuz " unhandled bytes remain", trem);
2025 }
2026 }
2027 return TRUE;
2028}
2029
2030WINPR_ATTR_NODISCARD
2031static BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
2032{
2033 BOOL rc = FALSE;
2034 UINT32 SwitchValue = 0;
2035 UINT32 index = 0;
2036 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
2037 UINT32 PacketPtr = 0;
2038 UINT32 PacketResponseDataPtr = 0;
2039
2040 WINPR_ASSERT(tsg);
2041 WINPR_ASSERT(pdu);
2042
2043 wLog* log = tsg->log;
2044 WINPR_ASSERT(log);
2045
2046 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketPtr, TRUE))
2047 goto fail;
2048
2049 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
2050 goto fail;
2051 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
2052 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
2053
2054 WLog_Print(log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
2055
2056 if (packet.packetId == E_PROXY_NAP_ACCESSDENIED)
2057 {
2058 WLog_Print(log, WLOG_ERROR, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)",
2059 E_PROXY_NAP_ACCESSDENIED);
2060 WLog_Print(log, WLOG_ERROR,
2061 "Ensure that the Gateway Connection Authorization Policy is correct");
2062 goto fail;
2063 }
2064
2065 if ((packet.packetId != TSG_PACKET_TYPE_RESPONSE) || (SwitchValue != TSG_PACKET_TYPE_RESPONSE))
2066 {
2067 WLog_Print(log, WLOG_ERROR,
2068 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_RESPONSE",
2069 packet.packetId);
2070 goto fail;
2071 }
2072
2073 if (!tsg_ndr_pointer_read(log, pdu->s, &index, nullptr, TRUE))
2074 goto fail;
2075
2076 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
2077 goto fail;
2078
2079 packet.tsgPacket.packetResponse.flags = Stream_Get_UINT32(pdu->s);
2080 if (packet.tsgPacket.packetResponse.flags != TSG_PACKET_TYPE_QUARREQUEST)
2081 {
2082 WLog_Print(log, WLOG_ERROR,
2083 "Unexpected Packet Response flags: 0x%08" PRIX32
2084 ", Expected TSG_PACKET_TYPE_QUARREQUEST",
2085 packet.tsgPacket.packetResponse.flags);
2086 goto fail;
2087 }
2088
2089 packet.tsgPacket.packetResponse.reserved = Stream_Get_UINT32(pdu->s);
2090
2091 packet.tsgPacket.packetResponse.responseData = nullptr;
2092 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketResponseDataPtr, FALSE))
2093 goto fail;
2094
2095 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 4))
2096 goto fail;
2097
2098 packet.tsgPacket.packetResponse.responseDataLen = Stream_Get_UINT32(pdu->s);
2099 if (packet.tsgPacket.packetResponse.responseDataLen > 24000)
2100 {
2101 WLog_Print(log, WLOG_ERROR,
2102 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32 " > maximum(24000)",
2103 packet.tsgPacket.packetResponse.responseDataLen);
2104 goto fail;
2105 }
2106 if ((PacketResponseDataPtr == 0) && (packet.tsgPacket.packetResponse.responseDataLen != 0))
2107 {
2108 WLog_Print(log, WLOG_ERROR,
2109 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32
2110 " but responseData = nullptr",
2111 packet.tsgPacket.packetResponse.responseDataLen);
2112 goto fail;
2113 }
2114
2115 if (!tsg_ndr_read_packet_redirection_flags(log, pdu->s,
2116 &packet.tsgPacket.packetResponse.redirectionFlags))
2117 goto fail;
2118
2119 packet.tsgPacket.packetResponse.responseData = Stream_Pointer(pdu->s);
2120 if (!tsg_ndr_read_packet_response_data(tsg, pdu->s, &packet.tsgPacket.packetResponse))
2121 goto fail;
2122
2123 rc = tsg_redirect_apply(tsg, &packet.tsgPacket.packetResponse.redirectionFlags);
2124
2125fail:
2126 return rc;
2127}
2128
2140WINPR_ATTR_NODISCARD
2141static BOOL TsProxyMakeTunnelCallWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext,
2142 UINT32 procId)
2143{
2144 wStream* s = nullptr;
2145 rdpRpc* rpc = nullptr;
2146
2147 if (!tsg || !tsg->rpc || !tunnelContext)
2148 return FALSE;
2149
2150 rpc = tsg->rpc;
2151 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyMakeTunnelCallWriteRequest");
2152 s = Stream_New(nullptr, 40);
2153
2154 if (!s)
2155 return FALSE;
2156
2157 /* TunnelContext (20 bytes) */
2158 UINT32 index = 0;
2159 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2160 goto fail;
2161 Stream_Write_UINT32(s, procId); /* ProcId (4 bytes) */
2162 /* 4-byte alignment */
2163 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* PacketId (4 bytes) */
2164 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* SwitchValue (4 bytes) */
2165 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketMsgRequestPtr (4 bytes) */
2166 goto fail;
2167 Stream_Write_UINT32(s, 0x00000001); /* MaxMessagesPerBatch (4 bytes) */
2168 return rpc_client_write_call(rpc, s, TsProxyMakeTunnelCallOpnum);
2169fail:
2170 Stream_Free(s, TRUE);
2171 return FALSE;
2172}
2173
2174WINPR_ATTR_NODISCARD
2175static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
2176 TSG_PACKET_STRING_MESSAGE* msg)
2177{
2178 UINT32 MsgPtr = 0;
2179
2180 WINPR_ASSERT(msg);
2181
2182 const TSG_PACKET_STRING_MESSAGE empty = WINPR_C_ARRAY_INIT;
2183 *msg = empty;
2184
2185 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
2186 return FALSE;
2187
2188 Stream_Read_INT32(s, msg->isDisplayMandatory); /* IsDisplayMandatory (4 bytes) */
2189 Stream_Read_INT32(s, msg->isConsentMandatory); /* IsConsentMandatory (4 bytes) */
2190 Stream_Read_UINT32(s, msg->msgBytes); /* MsgBytes (4 bytes) */
2191
2192 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, msg->msgBytes != 0))
2193 return FALSE;
2194
2195 if (msg->msgBytes > TSG_MESSAGING_MAX_MESSAGE_LENGTH)
2196 {
2197 WLog_Print(log, WLOG_ERROR, "Out of Spec Message Length %" PRIu32 "", msg->msgBytes);
2198 return FALSE;
2199 }
2200
2201 if (msg->msgBytes == 0)
2202 {
2203 WLog_Print(log, WLOG_DEBUG, "Empty message, skipping string read");
2204 return TRUE;
2205 }
2206
2207 return tsg_ndr_read_string(log, s, &msg->msgBuffer, &msg->msgBytes);
2208}
2209
2210WINPR_ATTR_NODISCARD
2211static BOOL TsProxyMakeTunnelCallReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
2212{
2213 BOOL rc = FALSE;
2214 UINT32 index = 0;
2215 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
2216 rdpContext* context = nullptr;
2217 TSG_PACKET_MSG_RESPONSE packetMsgResponse = WINPR_C_ARRAY_INIT;
2218 UINT32 PacketPtr = 0;
2219 UINT32 PacketMsgResponsePtr = 0;
2220
2221 WINPR_ASSERT(tsg);
2222 WINPR_ASSERT(tsg->rpc);
2223
2224 context = transport_get_context(tsg->rpc->transport);
2225 WINPR_ASSERT(context);
2226
2227 /* This is an asynchronous response */
2228
2229 if (!pdu)
2230 return FALSE;
2231
2232 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 28))
2233 goto fail;
2234
2235 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
2236 goto fail;
2237
2238 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
2239
2240 {
2241 const uint32_t SwitchValue = Stream_Get_UINT32(pdu->s); /* SwitchValue (4 bytes) */
2242 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
2243
2244 if ((packet.packetId != TSG_PACKET_TYPE_MESSAGE_PACKET) || (packet.packetId != SwitchValue))
2245 {
2246 WLog_Print(tsg->log, WLOG_ERROR,
2247 "Unexpected PacketId: 0x%08" PRIX32
2248 ", Expected TSG_PACKET_TYPE_MESSAGE_PACKET",
2249 packet.packetId);
2250 goto fail;
2251 }
2252 }
2253
2254 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketMsgResponsePtr, TRUE))
2255 goto fail;
2256
2257 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(tsg->log, pdu->s, &packetMsgResponse))
2258 goto fail;
2259
2260 {
2261 UINT32 MessagePtr = 0;
2262 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &MessagePtr, TRUE))
2263 goto fail;
2264
2265 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(tsg->log, context, pdu->s, &index, MessagePtr,
2266 &packetMsgResponse, &tsg->ReauthTunnelContext))
2267 goto fail;
2268 }
2269
2270 rc = TRUE;
2271fail:
2272 return rc;
2273}
2274
2285WINPR_ATTR_NODISCARD
2286static BOOL TsProxyCreateChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
2287{
2288 WINPR_ASSERT(tsg);
2289 WINPR_ASSERT(tunnelContext);
2290
2291 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCreateChannelWriteRequest");
2292
2293 if (!tsg->rpc || !tsg->Hostname)
2294 return FALSE;
2295
2296 rdpRpc* rpc = tsg->rpc;
2297 const size_t count = _wcslen(tsg->Hostname) + 1;
2298 if (count > UINT32_MAX)
2299 return FALSE;
2300
2301 wStream* s = Stream_New(nullptr, 60 + count * 2);
2302 if (!s)
2303 return FALSE;
2304
2305 /* TunnelContext (20 bytes) */
2306 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2307 goto fail;
2308
2309 /* TSENDPOINTINFO */
2310 {
2311 UINT32 index = 0;
2312 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2313 goto fail;
2314 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2315 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 0))
2316 goto fail;
2317 }
2318
2319 Stream_Write_UINT16(s, 0x0000); /* NumAlternateResourceNames (2 bytes) */
2320 Stream_Write_UINT16(s, 0x0000); /* Pad (2 bytes) */
2321 /* Port (4 bytes) */
2322 Stream_Write_UINT16(s, 0x0003); /* ProtocolId (RDP = 3) (2 bytes) */
2323 Stream_Write_UINT16(s, tsg->Port); /* PortNumber (0xD3D = 3389) (2 bytes) */
2324 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2325 {
2326 UINT32 index = 0;
2327 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2328 goto fail;
2329 }
2330 if (!tsg_ndr_write_string(tsg->log, s, tsg->Hostname, count))
2331 goto fail;
2332 return rpc_client_write_call(rpc, s, TsProxyCreateChannelOpnum);
2333
2334fail:
2335 Stream_Free(s, TRUE);
2336 return FALSE;
2337}
2338
2339WINPR_ATTR_NODISCARD
2340static BOOL TsProxyCreateChannelReadResponse(wLog* log, const RPC_PDU* pdu,
2341 CONTEXT_HANDLE* channelContext, UINT32* channelId)
2342{
2343 BOOL rc = FALSE;
2344
2345 WINPR_ASSERT(log);
2346 WINPR_ASSERT(pdu);
2347 WINPR_ASSERT(channelId);
2348
2349 WLog_Print(log, WLOG_DEBUG, "TsProxyCreateChannelReadResponse");
2350
2351 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 28))
2352 goto fail;
2353
2354 /* ChannelContext (20 bytes) */
2355 if (!TsProxyReadTunnelContext(log, pdu->s, channelContext))
2356 goto fail;
2357 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, pdu->s, 2, sizeof(UINT32)))
2358 goto fail;
2359 Stream_Read_UINT32(pdu->s, *channelId); /* ChannelId (4 bytes) */
2360 Stream_Seek_UINT32(pdu->s); /* ReturnValue (4 bytes) */
2361 rc = TRUE;
2362fail:
2363 return rc;
2364}
2365
2371WINPR_ATTR_NODISCARD
2372static BOOL TsProxyCloseChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* context)
2373{
2374 WINPR_ASSERT(tsg);
2375 WINPR_ASSERT(context);
2376
2377 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseChannelWriteRequest");
2378
2379 rdpRpc* rpc = tsg->rpc;
2380 WINPR_ASSERT(rpc);
2381
2382 wStream* s = Stream_New(nullptr, 20);
2383
2384 if (!s)
2385 return FALSE;
2386
2387 /* ChannelContext (20 bytes) */
2388 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2389 goto fail;
2390 return rpc_client_write_call(rpc, s, TsProxyCloseChannelOpnum);
2391fail:
2392 Stream_Free(s, TRUE);
2393 return FALSE;
2394}
2395
2396WINPR_ATTR_NODISCARD
2397static BOOL TsProxyCloseChannelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2398{
2399 BOOL rc = FALSE;
2400 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseChannelReadResponse");
2401
2402 if (!pdu)
2403 return FALSE;
2404
2405 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2406 goto fail;
2407
2408 /* ChannelContext (20 bytes) */
2409 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2410 goto fail;
2411
2412 {
2413 const size_t len = sizeof(UINT32);
2414 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2415 goto fail;
2416 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2417 rc = TRUE;
2418 }
2419fail:
2420 return rc;
2421}
2422
2428WINPR_ATTR_NODISCARD
2429static BOOL TsProxyCloseTunnelWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* context)
2430{
2431 WINPR_ASSERT(tsg);
2432 WINPR_ASSERT(context);
2433
2434 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseTunnelWriteRequest");
2435
2436 rdpRpc* rpc = tsg->rpc;
2437 WINPR_ASSERT(rpc);
2438
2439 wStream* s = Stream_New(nullptr, 20);
2440
2441 if (!s)
2442 return FALSE;
2443
2444 /* TunnelContext (20 bytes) */
2445 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2446 goto fail;
2447 return rpc_client_write_call(rpc, s, TsProxyCloseTunnelOpnum);
2448fail:
2449 Stream_Free(s, TRUE);
2450 return FALSE;
2451}
2452
2453WINPR_ATTR_NODISCARD
2454static BOOL TsProxyCloseTunnelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2455{
2456 BOOL rc = FALSE;
2457
2458 WINPR_ASSERT(log);
2459 WINPR_ASSERT(pdu);
2460 WINPR_ASSERT(context);
2461
2462 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseTunnelReadResponse");
2463
2464 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2465 goto fail;
2466
2467 /* TunnelContext (20 bytes) */
2468 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2469 goto fail;
2470 {
2471 const size_t len = sizeof(UINT32);
2472 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2473 goto fail;
2474 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2475 rc = TRUE;
2476 }
2477fail:
2478 return rc;
2479}
2480
2488WINPR_ATTR_NODISCARD
2489static BOOL TsProxySetupReceivePipeWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* channelContext)
2490{
2491 wStream* s = nullptr;
2492 rdpRpc* rpc = nullptr;
2493 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxySetupReceivePipeWriteRequest");
2494
2495 WINPR_ASSERT(tsg);
2496 WINPR_ASSERT(tsg->rpc);
2497
2498 if (!channelContext)
2499 return FALSE;
2500
2501 rpc = tsg->rpc;
2502 s = Stream_New(nullptr, 20);
2503
2504 if (!s)
2505 return FALSE;
2506
2507 /* ChannelContext (20 bytes) */
2508 if (!TsProxyWriteTunnelContext(tsg->log, s, channelContext))
2509 goto fail;
2510 return rpc_client_write_call(rpc, s, TsProxySetupReceivePipeOpnum);
2511fail:
2512 Stream_Free(s, TRUE);
2513 return FALSE;
2514}
2515
2516WINPR_ATTR_NODISCARD
2517static BOOL tsg_transition_to_state(rdpTsg* tsg, TSG_STATE state)
2518{
2519 WINPR_ASSERT(tsg);
2520 const char* oldState = tsg_state_to_string(tsg->state);
2521 const char* newState = tsg_state_to_string(state);
2522
2523 WLog_Print(tsg->log, WLOG_DEBUG, "%s -> %s", oldState, newState);
2524 return tsg_set_state(tsg, state);
2525}
2526
2527WINPR_ATTR_NODISCARD
2528static BOOL tsg_initialize_version_caps(const rdpTsg* tsg,
2529 TSG_PACKET_VERSIONCAPS* packetVersionCaps)
2530{
2531 WINPR_ASSERT(tsg);
2532 WINPR_ASSERT(packetVersionCaps);
2533
2534 packetVersionCaps->tsgHeader.ComponentId = TS_GATEWAY_TRANSPORT;
2535 packetVersionCaps->tsgHeader.PacketId = TSG_PACKET_TYPE_VERSIONCAPS;
2536 packetVersionCaps->numCapabilities = 1;
2537 packetVersionCaps->majorVersion = 1;
2538 packetVersionCaps->minorVersion = 1;
2539 packetVersionCaps->quarantineCapabilities = 0;
2540 packetVersionCaps->tsgCaps.capabilityType = TSG_CAPABILITY_TYPE_NAP;
2541 /*
2542 * Using reduced capabilities appears to trigger
2543 * TSG_PACKET_TYPE_QUARENC_RESPONSE instead of TSG_PACKET_TYPE_CAPS_RESPONSE
2544 *
2545 * However, reduced capabilities may break connectivity with servers enforcing features,
2546 * such as "Only allow connections from Remote Desktop Services clients that support RD
2547 * Gateway messaging"
2548 */
2549
2550 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities =
2551 TSG_NAP_CAPABILITY_IDLE_TIMEOUT | TSG_MESSAGING_CAP_CONSENT_SIGN |
2552 TSG_MESSAGING_CAP_SERVICE_MSG | TSG_MESSAGING_CAP_REAUTH;
2553 if (tsg->QuarreQuest.dataLen > 0)
2554 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities |= TSG_NAP_CAPABILITY_QUAR_SOH;
2555
2556 return TRUE;
2557}
2558
2559static void resetCaps(rdpTsg* tsg)
2560{
2561 WINPR_ASSERT(tsg);
2562 const TSG_PACKET_QUARENC_RESPONSE empty = WINPR_C_ARRAY_INIT;
2563 tsg->CapsResponse = empty;
2564}
2565
2566BOOL tsg_proxy_begin(rdpTsg* tsg)
2567{
2568 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2569
2570 WINPR_ASSERT(tsg);
2571
2572 tsgPacket.packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2573 if (!tsg_initialize_version_caps(tsg, &tsgPacket.tsgPacket.packetVersionCaps) ||
2574 !TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2575 {
2576 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2577 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2578 return FALSE;
2579 }
2580
2581 resetCaps(tsg);
2582
2583 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2584}
2585
2586WINPR_ATTR_NODISCARD
2587static BOOL tsg_proxy_reauth(rdpTsg* tsg)
2588{
2589 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2590
2591 WINPR_ASSERT(tsg);
2592
2593 tsg->reauthSequence = TRUE;
2594 TSG_PACKET_REAUTH* packetReauth = &tsgPacket.tsgPacket.packetReauth;
2595
2596 tsgPacket.packetId = TSG_PACKET_TYPE_REAUTH;
2597 packetReauth->tunnelContext = tsg->ReauthTunnelContext;
2598 packetReauth->packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2599
2600 if (!tsg_initialize_version_caps(tsg, &packetReauth->tsgInitialPacket.packetVersionCaps))
2601 return FALSE;
2602
2603 if (!TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2604 {
2605 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2606 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2607 return FALSE;
2608 }
2609
2610 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2611 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2612 {
2613 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2614 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2615 return FALSE;
2616 }
2617
2618 resetCaps(tsg);
2619 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2620}
2621
2622BOOL tsg_recv_pdu(rdpTsg* tsg, const RPC_PDU* pdu)
2623{
2624 BOOL rc = FALSE;
2625 RpcClientCall* call = nullptr;
2626 rdpRpc* rpc = nullptr;
2627
2628 WINPR_ASSERT(tsg);
2629 WINPR_ASSERT(pdu);
2630 WINPR_ASSERT(tsg->rpc);
2631
2632 rpc = tsg->rpc;
2633
2634 if (!(pdu->Flags & RPC_PDU_FLAG_STUB))
2635 {
2636 const size_t len = 24;
2637 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, len))
2638 return FALSE;
2639 Stream_Seek(pdu->s, len);
2640 }
2641
2642 const TSG_STATE oldState = tsg->state;
2643 switch (tsg->state)
2644 {
2645 case TSG_STATE_INITIAL:
2646 {
2647 CONTEXT_HANDLE* TunnelContext = nullptr;
2648 TunnelContext = (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2649
2650 if (!TsProxyCreateTunnelReadResponse(tsg, pdu, TunnelContext, &tsg->TunnelId))
2651 {
2652 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnelReadResponse failure");
2653 return FALSE;
2654 }
2655
2656 if (!tsg_transition_to_state(tsg, TSG_STATE_CONNECTED))
2657 return FALSE;
2658
2659 if (!TsProxyAuthorizeTunnelWriteRequest(tsg, TunnelContext))
2660 {
2661 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnel failure");
2662 return FALSE;
2663 }
2664
2665 rc = TRUE;
2666 }
2667 break;
2668
2669 case TSG_STATE_CONNECTED:
2670 {
2671 CONTEXT_HANDLE* TunnelContext =
2672 (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2673
2674 if (!TsProxyAuthorizeTunnelReadResponse(tsg, pdu))
2675 {
2676 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnelReadResponse failure");
2677 return FALSE;
2678 }
2679
2680 if (!tsg_transition_to_state(tsg, TSG_STATE_AUTHORIZED))
2681 return FALSE;
2682
2683 if (!tsg->reauthSequence)
2684 {
2685 if (!TsProxyMakeTunnelCallWriteRequest(tsg, TunnelContext,
2686 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2687 {
2688 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2689 return FALSE;
2690 }
2691 }
2692
2693 if (!TsProxyCreateChannelWriteRequest(tsg, TunnelContext))
2694 {
2695 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannel failure");
2696 return FALSE;
2697 }
2698
2699 rc = TRUE;
2700 }
2701 break;
2702
2703 case TSG_STATE_AUTHORIZED:
2704 call = rpc_client_call_find_by_id(rpc->client, pdu->CallId);
2705
2706 if (!call)
2707 return FALSE;
2708
2709 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2710 {
2711 if (!TsProxyMakeTunnelCallReadResponse(tsg, pdu))
2712 {
2713 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2714 return FALSE;
2715 }
2716
2717 rc = TRUE;
2718 }
2719 else if (call->OpNum == TsProxyCreateChannelOpnum)
2720 {
2721 CONTEXT_HANDLE ChannelContext;
2722
2723 if (!TsProxyCreateChannelReadResponse(tsg->log, pdu, &ChannelContext,
2724 &tsg->ChannelId))
2725 {
2726 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannelReadResponse failure");
2727 return FALSE;
2728 }
2729
2730 if (!tsg->reauthSequence)
2731 CopyMemory(&tsg->ChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2732 else
2733 CopyMemory(&tsg->NewChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2734
2735 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CREATED))
2736 return FALSE;
2737
2738 if (!tsg->reauthSequence)
2739 {
2740 if (!TsProxySetupReceivePipeWriteRequest(tsg, &tsg->ChannelContext))
2741 {
2742 WLog_Print(tsg->log, WLOG_ERROR, "TsProxySetupReceivePipe failure");
2743 return FALSE;
2744 }
2745 }
2746 else
2747 {
2748 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->NewChannelContext))
2749 {
2750 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2751 return FALSE;
2752 }
2753
2754 if (!TsProxyCloseTunnelWriteRequest(tsg, &tsg->NewTunnelContext))
2755 {
2756 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelWriteRequest failure");
2757 return FALSE;
2758 }
2759 }
2760
2761 rc = tsg_transition_to_state(tsg, TSG_STATE_PIPE_CREATED);
2762 tsg->reauthSequence = FALSE;
2763 }
2764 else
2765 {
2766 WLog_Print(tsg->log, WLOG_ERROR,
2767 "TSG_STATE_AUTHORIZED unexpected OpNum: %" PRIu32 "\n", call->OpNum);
2768 }
2769
2770 break;
2771
2772 case TSG_STATE_CHANNEL_CREATED:
2773 break;
2774
2775 case TSG_STATE_PIPE_CREATED:
2776 call = rpc_client_call_find_by_id(rpc->client, pdu->CallId);
2777
2778 if (!call)
2779 return FALSE;
2780
2781 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2782 {
2783 if (!TsProxyMakeTunnelCallReadResponse(tsg, pdu))
2784 {
2785 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2786 return FALSE;
2787 }
2788
2789 rc = TRUE;
2790
2791 if (tsg->ReauthTunnelContext)
2792 rc = tsg_proxy_reauth(tsg);
2793 }
2794 else if (call->OpNum == TsProxyCloseChannelOpnum)
2795 {
2796 CONTEXT_HANDLE ChannelContext;
2797
2798 if (!TsProxyCloseChannelReadResponse(tsg->log, pdu, &ChannelContext))
2799 {
2800 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelReadResponse failure");
2801 return FALSE;
2802 }
2803
2804 rc = TRUE;
2805 }
2806 else if (call->OpNum == TsProxyCloseTunnelOpnum)
2807 {
2808 CONTEXT_HANDLE TunnelContext;
2809
2810 if (!TsProxyCloseTunnelReadResponse(tsg->log, pdu, &TunnelContext))
2811 {
2812 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelReadResponse failure");
2813 return FALSE;
2814 }
2815
2816 rc = TRUE;
2817 }
2818
2819 break;
2820
2821 case TSG_STATE_TUNNEL_CLOSE_PENDING:
2822 {
2823 CONTEXT_HANDLE ChannelContext;
2824
2825 if (!TsProxyCloseChannelReadResponse(tsg->log, pdu, &ChannelContext))
2826 {
2827 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelReadResponse failure");
2828 return FALSE;
2829 }
2830
2831 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING))
2832 return FALSE;
2833
2834 if (!TsProxyCloseChannelWriteRequest(tsg, nullptr))
2835 {
2836 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2837 return FALSE;
2838 }
2839
2840 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2841 TSG_TUNNEL_CANCEL_ASYNC_MSG_REQUEST))
2842 {
2843 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2844 return FALSE;
2845 }
2846
2847 rc = TRUE;
2848 }
2849 break;
2850
2851 case TSG_STATE_CHANNEL_CLOSE_PENDING:
2852 {
2853 CONTEXT_HANDLE TunnelContext;
2854
2855 if (!TsProxyCloseTunnelReadResponse(tsg->log, pdu, &TunnelContext))
2856 {
2857 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelReadResponse failure");
2858 return FALSE;
2859 }
2860
2861 rc = tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2862 }
2863 break;
2864
2865 case TSG_STATE_FINAL:
2866 break;
2867 default:
2868 break;
2869 }
2870
2871 {
2872 const size_t rem = Stream_GetRemainingLength(pdu->s);
2873 if (rem > 0)
2874 {
2875 WLog_Print(tsg->log, WLOG_WARN, "[%s] unparsed bytes: %" PRIuz,
2876 tsg_state_to_string(oldState), rem);
2877 }
2878 }
2879 return rc;
2880}
2881
2882BOOL tsg_check_event_handles(rdpTsg* tsg)
2883{
2884 WINPR_ASSERT(tsg);
2885 if (rpc_client_in_channel_recv(tsg->rpc) < 0)
2886 return FALSE;
2887
2888 if (rpc_client_out_channel_recv(tsg->rpc) < 0)
2889 return FALSE;
2890
2891 return TRUE;
2892}
2893
2894DWORD tsg_get_event_handles(rdpTsg* tsg, HANDLE* events, DWORD count)
2895{
2896 UINT32 nCount = 0;
2897 rdpRpc* rpc = tsg->rpc;
2898 RpcVirtualConnection* connection = rpc->VirtualConnection;
2899
2900 if (events && (nCount < count))
2901 {
2902 events[nCount] = rpc->client->PipeEvent;
2903 nCount++;
2904 }
2905 else
2906 return 0;
2907
2908 if (connection->DefaultInChannel && connection->DefaultInChannel->common.tls)
2909 {
2910 if (events && (nCount < count))
2911 {
2912 BIO_get_event(connection->DefaultInChannel->common.tls->bio, &events[nCount]);
2913 nCount++;
2914 }
2915 else
2916 return 0;
2917 }
2918
2919 if (connection->NonDefaultInChannel && connection->NonDefaultInChannel->common.tls)
2920 {
2921 if (events && (nCount < count))
2922 {
2923 BIO_get_event(connection->NonDefaultInChannel->common.tls->bio, &events[nCount]);
2924 nCount++;
2925 }
2926 else
2927 return 0;
2928 }
2929
2930 if (connection->DefaultOutChannel && connection->DefaultOutChannel->common.tls)
2931 {
2932 if (events && (nCount < count))
2933 {
2934 BIO_get_event(connection->DefaultOutChannel->common.tls->bio, &events[nCount]);
2935 nCount++;
2936 }
2937 else
2938 return 0;
2939 }
2940
2941 if (connection->NonDefaultOutChannel && connection->NonDefaultOutChannel->common.tls)
2942 {
2943 if (events && (nCount < count))
2944 {
2945 BIO_get_event(connection->NonDefaultOutChannel->common.tls->bio, &events[nCount]);
2946 nCount++;
2947 }
2948 else
2949 return 0;
2950 }
2951
2952 return nCount;
2953}
2954
2955WINPR_ATTR_NODISCARD
2956static BOOL tsg_set_hostname(rdpTsg* tsg, const char* hostname)
2957{
2958 WINPR_ASSERT(tsg);
2959 free(tsg->Hostname);
2960 tsg->Hostname = ConvertUtf8ToWCharAlloc(hostname, nullptr);
2961 return tsg->Hostname != nullptr;
2962}
2963
2964WINPR_ATTR_NODISCARD
2965static BOOL tsg_set_machine_name(rdpTsg* tsg, const char* machineName)
2966{
2967 WINPR_ASSERT(tsg);
2968
2969 free(tsg->QuarreQuest.machineName);
2970 tsg->QuarreQuest.machineName = nullptr;
2971 tsg->QuarreQuest.nameLength = 0;
2972 if (!machineName)
2973 return FALSE;
2974
2975 size_t size = 0;
2976 tsg->QuarreQuest.machineName = ConvertUtf8ToWCharAlloc(machineName, &size);
2977 tsg->QuarreQuest.nameLength = WINPR_ASSERTING_INT_CAST(uint32_t, size + 1ull);
2978 return tsg->QuarreQuest.machineName && (size > 0);
2979}
2980
2981BOOL tsg_connect(rdpTsg* tsg, const char* hostname, UINT16 port, DWORD timeout)
2982{
2983 UINT64 looptimeout = timeout * 1000ULL;
2984 DWORD nCount = 0;
2985 HANDLE events[MAXIMUM_WAIT_OBJECTS] = WINPR_C_ARRAY_INIT;
2986
2987 WINPR_ASSERT(tsg);
2988
2989 rdpRpc* rpc = tsg->rpc;
2990 WINPR_ASSERT(rpc);
2991
2992 rdpTransport* transport = rpc->transport;
2993 rdpContext* context = transport_get_context(transport);
2994 WINPR_ASSERT(context);
2995
2996 rdpSettings* settings = context->settings;
2997
2998 freerdp_set_last_error(context, ERROR_SUCCESS);
2999
3000 tsg->Port = port;
3001 tsg->transport = transport;
3002
3003 {
3004 const UINT32 GatewayPort = freerdp_settings_get_uint32(settings, FreeRDP_GatewayPort);
3005 if (GatewayPort == 0)
3006 {
3007 if (!freerdp_settings_set_uint32(settings, FreeRDP_GatewayPort, 443))
3008 return FALSE;
3009 }
3010 }
3011
3012 if (!tsg_set_hostname(tsg, hostname))
3013 return FALSE;
3014
3015 const char* ComputerName = freerdp_settings_get_string(settings, FreeRDP_ComputerName);
3016 if (!tsg_set_machine_name(tsg, ComputerName))
3017 return FALSE;
3018
3019 if (!rpc_connect(rpc, timeout))
3020 {
3021 WLog_Print(tsg->log, WLOG_ERROR, "rpc_connect error!");
3022 return FALSE;
3023 }
3024
3025 nCount = tsg_get_event_handles(tsg, events, ARRAYSIZE(events));
3026
3027 if (nCount == 0)
3028 return FALSE;
3029
3030 while (tsg->state != TSG_STATE_PIPE_CREATED)
3031 {
3032 const DWORD polltimeout = 250;
3033 DWORD status = WaitForMultipleObjects(nCount, events, FALSE, polltimeout);
3034 if (status == WAIT_TIMEOUT)
3035 {
3036 if (timeout > 0)
3037 {
3038 if (looptimeout < polltimeout)
3039 return FALSE;
3040 looptimeout -= polltimeout;
3041 }
3042 }
3043 else
3044 looptimeout = timeout * 1000ULL;
3045
3046 if (!tsg_check_event_handles(tsg))
3047 {
3048 WLog_Print(tsg->log, WLOG_ERROR, "tsg_check failure");
3049 transport_set_layer(transport, TRANSPORT_LAYER_CLOSED);
3050 return FALSE;
3051 }
3052 }
3053
3054 WLog_Print(tsg->log, WLOG_INFO, "TS Gateway Connection Success");
3055 tsg->bio = BIO_new(BIO_s_tsg());
3056
3057 if (!tsg->bio)
3058 return FALSE;
3059
3060 BIO_set_data(tsg->bio, (void*)tsg);
3061 return TRUE;
3062}
3063
3064BOOL tsg_disconnect(rdpTsg* tsg)
3065{
3085 if (!tsg)
3086 return FALSE;
3087
3088 if (tsg->state != TSG_STATE_TUNNEL_CLOSE_PENDING)
3089 {
3090 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->ChannelContext))
3091 return FALSE;
3092
3093 return tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING);
3094 }
3095
3096 return TRUE;
3097}
3098
3109WINPR_ATTR_NODISCARD
3110static int tsg_read(rdpTsg* tsg, BYTE* data, size_t length)
3111{
3112 rdpRpc* rpc = nullptr;
3113 int status = 0;
3114
3115 if (!tsg || !data)
3116 return -1;
3117
3118 rpc = tsg->rpc;
3119
3120 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3121 {
3122 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3123 return -1;
3124 }
3125
3126 do
3127 {
3128 status = rpc_client_receive_pipe_read(rpc->client, data, length);
3129
3130 if (status < 0)
3131 return -1;
3132
3133 if (!status && !transport_get_blocking(rpc->transport))
3134 return 0;
3135
3136 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3137 {
3138 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3139 return -1;
3140 }
3141
3142 if (status > 0)
3143 break;
3144
3145 if (transport_get_blocking(rpc->transport))
3146 {
3147 while (WaitForSingleObject(rpc->client->PipeEvent, 0) != WAIT_OBJECT_0)
3148 {
3149 if (!tsg_check_event_handles(tsg))
3150 return -1;
3151
3152 (void)WaitForSingleObject(rpc->client->PipeEvent, 100);
3153 }
3154 }
3155 } while (transport_get_blocking(rpc->transport));
3156
3157 return status;
3158}
3159
3160WINPR_ATTR_NODISCARD
3161static int tsg_write(rdpTsg* tsg, const BYTE* data, UINT32 length)
3162{
3163 int status = 0;
3164
3165 if (!tsg || !data || !tsg->rpc || !tsg->rpc->transport)
3166 return -1;
3167
3168 if (transport_get_layer(tsg->rpc->transport) == TRANSPORT_LAYER_CLOSED)
3169 {
3170 WLog_Print(tsg->log, WLOG_ERROR, "error, connection lost");
3171 return -1;
3172 }
3173
3174 status = TsProxySendToServer((handle_t)tsg, data, 1, &length);
3175
3176 if (status < 0)
3177 return -1;
3178
3179 return (int)length;
3180}
3181
3182rdpTsg* tsg_new(rdpTransport* transport)
3183{
3184 rdpTsg* tsg = (rdpTsg*)calloc(1, sizeof(rdpTsg));
3185
3186 if (!tsg)
3187 return nullptr;
3188 tsg->log = WLog_Get(TAG);
3189 tsg->transport = transport;
3190 tsg->rpc = rpc_new(tsg->transport);
3191
3192 if (!tsg->rpc)
3193 goto out_free;
3194
3195 return tsg;
3196out_free:
3197 free(tsg);
3198 return nullptr;
3199}
3200
3201void tsg_free(rdpTsg* tsg)
3202{
3203 if (tsg)
3204 {
3205 rpc_free(tsg->rpc);
3206 free(tsg->Hostname);
3207 free(tsg->QuarreQuest.machineName);
3208 free(tsg->QuarreQuest.data);
3209 free(tsg);
3210 }
3211}
3212
3213WINPR_ATTR_NODISCARD
3214static int transport_bio_tsg_write(BIO* bio, const char* buf, int num)
3215{
3216 int status = 0;
3217 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3218 BIO_clear_flags(bio, BIO_FLAGS_WRITE);
3219
3220 if (num < 0)
3221 return -1;
3222 status = tsg_write(tsg, (const BYTE*)buf, (UINT32)num);
3223
3224 if (status < 0)
3225 {
3226 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3227 return -1;
3228 }
3229 else if (status == 0)
3230 {
3231 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3232 WSASetLastError(WSAEWOULDBLOCK);
3233 }
3234 else
3235 {
3236 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3237 }
3238
3239 return status >= 0 ? status : -1;
3240}
3241
3242WINPR_ATTR_NODISCARD
3243static int transport_bio_tsg_read(BIO* bio, char* buf, int size)
3244{
3245 int status = 0;
3246 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3247
3248 if (!tsg || (size < 0))
3249 {
3250 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3251 return -1;
3252 }
3253
3254 BIO_clear_flags(bio, BIO_FLAGS_READ);
3255 status = tsg_read(tsg, (BYTE*)buf, (size_t)size);
3256
3257 if (status < 0)
3258 {
3259 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3260 return -1;
3261 }
3262 else if (status == 0)
3263 {
3264 BIO_set_flags(bio, BIO_FLAGS_READ);
3265 WSASetLastError(WSAEWOULDBLOCK);
3266 }
3267 else
3268 {
3269 BIO_set_flags(bio, BIO_FLAGS_READ);
3270 }
3271
3272 return status > 0 ? status : -1;
3273}
3274
3275WINPR_ATTR_NODISCARD
3276static int transport_bio_tsg_puts(BIO* bio, const char* str)
3277{
3278 WINPR_UNUSED(bio);
3279 WINPR_UNUSED(str);
3280 return -2;
3281}
3282
3283WINPR_ATTR_NODISCARD
3284// NOLINTNEXTLINE(readability-non-const-parameter)
3285static int transport_bio_tsg_gets(BIO* bio, char* str, int size)
3286{
3287 WINPR_UNUSED(bio);
3288 WINPR_UNUSED(str);
3289 WINPR_UNUSED(size);
3290 return 1;
3291}
3292
3293WINPR_ATTR_NODISCARD
3294static long transport_bio_tsg_ctrl(BIO* bio, int cmd, long arg1, void* arg2)
3295{
3296 long status = -1;
3297 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3298 RpcVirtualConnection* connection = tsg->rpc->VirtualConnection;
3299 RpcInChannel* inChannel = connection->DefaultInChannel;
3300 RpcOutChannel* outChannel = connection->DefaultOutChannel;
3301
3302 switch (cmd)
3303 {
3304 case BIO_CTRL_FLUSH:
3305 (void)BIO_flush(inChannel->common.tls->bio);
3306 (void)BIO_flush(outChannel->common.tls->bio);
3307 status = 1;
3308 break;
3309
3310 case BIO_C_GET_EVENT:
3311 if (arg2)
3312 {
3313 *((HANDLE*)arg2) = tsg->rpc->client->PipeEvent;
3314 status = 1;
3315 }
3316
3317 break;
3318
3319 case BIO_C_SET_NONBLOCK:
3320 status = 1;
3321 break;
3322
3323 case BIO_C_READ_BLOCKED:
3324 {
3325 BIO* cbio = outChannel->common.bio;
3326 status = BIO_read_blocked(cbio);
3327 }
3328 break;
3329
3330 case BIO_C_WRITE_BLOCKED:
3331 {
3332 BIO* cbio = inChannel->common.bio;
3333 status = BIO_write_blocked(cbio);
3334 }
3335 break;
3336
3337 case BIO_C_WAIT_READ:
3338 {
3339 int timeout = (int)arg1;
3340 BIO* cbio = outChannel->common.bio;
3341
3342 if (BIO_read_blocked(cbio))
3343 return BIO_wait_read(cbio, timeout);
3344 else if (BIO_write_blocked(cbio))
3345 return BIO_wait_write(cbio, timeout);
3346 else
3347 status = 1;
3348 }
3349 break;
3350
3351 case BIO_C_WAIT_WRITE:
3352 {
3353 int timeout = (int)arg1;
3354 BIO* cbio = inChannel->common.bio;
3355
3356 if (BIO_write_blocked(cbio))
3357 status = BIO_wait_write(cbio, timeout);
3358 else if (BIO_read_blocked(cbio))
3359 status = BIO_wait_read(cbio, timeout);
3360 else
3361 status = 1;
3362 }
3363 break;
3364#if OPENSSL_VERSION_NUMBER >= 0x30000000L
3365 case BIO_CTRL_GET_KTLS_SEND:
3366 status = 0;
3367 break;
3368 case BIO_CTRL_GET_KTLS_RECV:
3369 status = 0;
3370 break;
3371#endif
3372 default:
3373 break;
3374 }
3375
3376 return status;
3377}
3378
3379WINPR_ATTR_NODISCARD
3380static int transport_bio_tsg_new(BIO* bio)
3381{
3382 WINPR_ASSERT(bio);
3383 BIO_set_init(bio, 1);
3384 BIO_set_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3385 return 1;
3386}
3387
3388WINPR_ATTR_NODISCARD
3389static int transport_bio_tsg_free(BIO* bio)
3390{
3391 WINPR_ASSERT(bio);
3392 WINPR_UNUSED(bio);
3393 return 1;
3394}
3395
3396BIO_METHOD* BIO_s_tsg(void)
3397{
3398 static BIO_METHOD* bio_methods = nullptr;
3399
3400 if (bio_methods == nullptr)
3401 {
3402 if (!(bio_methods = BIO_meth_new(BIO_TYPE_TSG, "TSGateway")))
3403 return nullptr;
3404
3405 BIO_meth_set_write(bio_methods, transport_bio_tsg_write);
3406 BIO_meth_set_read(bio_methods, transport_bio_tsg_read);
3407 BIO_meth_set_puts(bio_methods, transport_bio_tsg_puts);
3408 BIO_meth_set_gets(bio_methods, transport_bio_tsg_gets);
3409 BIO_meth_set_ctrl(bio_methods, transport_bio_tsg_ctrl);
3410 BIO_meth_set_create(bio_methods, transport_bio_tsg_new);
3411 BIO_meth_set_destroy(bio_methods, transport_bio_tsg_free);
3412 }
3413
3414 return bio_methods;
3415}
3416
3417TSG_STATE tsg_get_state(rdpTsg* tsg)
3418{
3419 if (!tsg)
3420 return TSG_STATE_INITIAL;
3421
3422 return tsg->state;
3423}
3424
3425BIO* tsg_get_bio(rdpTsg* tsg)
3426{
3427 if (!tsg)
3428 return nullptr;
3429
3430 return tsg->bio;
3431}
3432
3433BOOL tsg_set_state(rdpTsg* tsg, TSG_STATE state)
3434{
3435 WINPR_ASSERT(tsg);
3436 tsg->state = state;
3437 return TRUE;
3438}
freerdp_settings_get_string
WINPR_ATTR_NODISCARD FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
freerdp_settings_set_uint32
WINPR_ATTR_NODISCARD FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 val)
Sets a UINT32 settings value.
freerdp_settings_get_uint32
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
CONTEXT_HANDLE
Definition winpr/include/winpr/rpc.h:26
RPC_PDU
Definition libfreerdp/core/gateway/rpc.h:66
p_uuid_t
Definition libfreerdp/core/gateway/rpc.h:150