ncacn_http.c

 
#include <freerdp/config.h>
 
#include "../settings.h"
#include "ncacn_http.h"
 
#include <winpr/crt.h>
#include <winpr/tchar.h>
#include <winpr/stream.h>
#include <winpr/dsparse.h>
 
#include "../utils.h"
 
#define TAG FREERDP_TAG("core.gateway.ntlm")
 
#define AUTH_PKG NTLM_SSP_NAME
 
static wStream* rpc_auth_http_request(HttpContext* http, const char* method, size_t contentLength,
                                      const SecBuffer* authToken, const char* auth_scheme)
{
  wStream* s = nullptr;
  HttpRequest* request = nullptr;
  char* base64AuthToken = nullptr;
  const char* uri = nullptr;
 
  if (!http || !method)
    goto fail;
 
  request = http_request_new();
 
  if (!request)
    goto fail;
 
  if (authToken)
    base64AuthToken = crypto_base64_encode(authToken->pvBuffer, authToken->cbBuffer);
 
  uri = http_context_get_uri(http);
 
  if (!http_request_set_method(request, method) ||
      !http_request_set_content_length(request, contentLength) ||
      !http_request_set_uri(request, uri))
    goto fail;
 
  if (base64AuthToken)
  {
    if (!http_request_set_auth_scheme(request, auth_scheme) ||
        !http_request_set_auth_param(request, base64AuthToken))
      goto fail;
  }
 
  s = http_request_write(http, request);
fail:
  http_request_free(request);
  free(base64AuthToken);
  return s;
}
 
BOOL rpc_ncacn_http_send_in_channel_request(RpcChannel* inChannel)
{
  wStream* s = nullptr;
  SSIZE_T status = 0;
  rdpCredsspAuth* auth = nullptr;
  HttpContext* http = nullptr;
  const SecBuffer* buffer = nullptr;
  int rc = 0;
 
  if (!inChannel || !inChannel->auth || !inChannel->http)
    return FALSE;
 
  auth = inChannel->auth;
  http = inChannel->http;
 
  rc = credssp_auth_authenticate(auth);
  if (rc < 0)
    return FALSE;
 
  const size_t contentLength = (rc == 0) ? 0 : 0x40000000;
  buffer = credssp_auth_have_output_token(auth) ? credssp_auth_get_output_buffer(auth) : nullptr;
  s = rpc_auth_http_request(http, "RPC_IN_DATA", contentLength, buffer,
                            credssp_auth_pkg_name(auth));
 
  if (!s)
    return -1;
 
  status = rpc_channel_write(inChannel, Stream_Buffer(s), Stream_Length(s));
  Stream_Free(s, TRUE);
  return (status > 0) ? 1 : -1;
}
 
BOOL rpc_ncacn_http_recv_in_channel_response(RpcChannel* inChannel, HttpResponse* response)
{
  size_t authTokenLength = 0;
  BYTE* authTokenData = nullptr;
 
  if (!inChannel || !response || !inChannel->auth)
    return FALSE;
 
  rdpCredsspAuth* auth = inChannel->auth;
  const char* token64 = http_response_get_auth_token(response, credssp_auth_pkg_name(auth));
 
  if (token64)
    crypto_base64_decode(token64, strlen(token64), &authTokenData, &authTokenLength);
 
  if (authTokenLength > UINT32_MAX)
  {
    free(authTokenData);
    return FALSE;
  }
 
  SecBuffer buffer = { .pvBuffer = authTokenData, .cbBuffer = (UINT32)authTokenLength };
 
  if (authTokenData && authTokenLength)
  {
    credssp_auth_take_input_buffer(auth, &buffer);
    return TRUE;
  }
 
  sspi_SecBufferFree(&buffer);
  return TRUE;
}
 
BOOL rpc_ncacn_http_auth_init(rdpContext* context, RpcChannel* channel)
{
  rdpTls* tls = nullptr;
  rdpCredsspAuth* auth = nullptr;
  rdpSettings* settings = nullptr;
  freerdp* instance = nullptr;
  auth_status rc = AUTH_FAILED;
  SEC_WINNT_AUTH_IDENTITY identity = WINPR_C_ARRAY_INIT;
 
  if (!context || !channel)
    return FALSE;
 
  tls = channel->tls;
  auth = channel->auth;
  settings = context->settings;
  instance = context->instance;
 
  if (!tls || !auth || !instance || !settings)
    return FALSE;
 
  rc = utils_authenticate_gateway(instance, GW_AUTH_HTTP);
  switch (rc)
  {
    case AUTH_SUCCESS:
    case AUTH_SKIP:
      break;
    case AUTH_CANCELLED:
      freerdp_set_last_error_log(instance->context, FREERDP_ERROR_CONNECT_CANCELLED);
      return FALSE;
    case AUTH_NO_CREDENTIALS:
      WLog_INFO(TAG, "No credentials provided - using nullptr identity");
      break;
    case AUTH_FAILED:
    default:
      return FALSE;
  }
 
  if (!credssp_auth_init(auth, AUTH_PKG, tls->Bindings))
    return FALSE;
 
  if (!identity_set_from_settings(&identity, settings, FreeRDP_GatewayUsername,
                                  FreeRDP_GatewayDomain, FreeRDP_GatewayPassword))
    return FALSE;
 
  const char* GatewayHostname = freerdp_settings_get_string(settings, FreeRDP_GatewayHostname);
  const char* GatewayUsername = freerdp_settings_get_string(settings, FreeRDP_GatewayUsername);
  SEC_WINNT_AUTH_IDENTITY* identityArg = (GatewayUsername ? &identity : nullptr);
  const BOOL res = credssp_auth_setup_client(auth, "HTTP", GatewayHostname, identityArg, nullptr);
 
  sspi_FreeAuthIdentity(&identity);
 
  credssp_auth_set_flags(auth, ISC_REQ_CONFIDENTIALITY);
 
  return res;
}
 
void rpc_ncacn_http_auth_uninit(RpcChannel* channel)
{
  if (!channel)
    return;
 
  credssp_auth_free(channel->auth);
  channel->auth = nullptr;
}
 
BOOL rpc_ncacn_http_send_out_channel_request(RpcChannel* outChannel, BOOL replacement)
{
  BOOL status = TRUE;
  wStream* s = nullptr;
  size_t contentLength = 0;
  rdpCredsspAuth* auth = nullptr;
  HttpContext* http = nullptr;
  const SecBuffer* buffer = nullptr;
  int rc = 0;
 
  if (!outChannel || !outChannel->auth || !outChannel->http)
    return FALSE;
 
  auth = outChannel->auth;
  http = outChannel->http;
 
  rc = credssp_auth_authenticate(auth);
  if (rc < 0)
    return FALSE;
 
  if (!replacement)
    contentLength = (rc == 0) ? 0 : 76;
  else
    contentLength = (rc == 0) ? 0 : 120;
 
  buffer = credssp_auth_have_output_token(auth) ? credssp_auth_get_output_buffer(auth) : nullptr;
  s = rpc_auth_http_request(http, "RPC_OUT_DATA", contentLength, buffer,
                            credssp_auth_pkg_name(auth));
 
  if (!s)
    return -1;
 
  if (rpc_channel_write(outChannel, Stream_Buffer(s), Stream_Length(s)) < 0)
    status = FALSE;
 
  Stream_Free(s, TRUE);
  return status;
}
 
BOOL rpc_ncacn_http_recv_out_channel_response(RpcChannel* outChannel, HttpResponse* response)
{
  size_t authTokenLength = 0;
  BYTE* authTokenData = nullptr;
 
  if (!outChannel || !response || !outChannel->auth)
    return FALSE;
 
  rdpCredsspAuth* auth = outChannel->auth;
  const char* token64 = http_response_get_auth_token(response, credssp_auth_pkg_name(auth));
 
  if (token64)
    crypto_base64_decode(token64, strlen(token64), &authTokenData, &authTokenLength);
 
  if (authTokenLength > UINT32_MAX)
  {
    free(authTokenData);
    return FALSE;
  }
  SecBuffer buffer = { .pvBuffer = authTokenData, .cbBuffer = (UINT32)authTokenLength };
 
  if (authTokenData && authTokenLength)
  {
    credssp_auth_take_input_buffer(auth, &buffer);
    return TRUE;
  }
 
  sspi_SecBufferFree(&buffer);
  return TRUE;
}
 
BOOL rpc_ncacn_http_is_final_request(RpcChannel* channel)
{
  WINPR_ASSERT(channel);
  return credssp_auth_is_complete(channel->auth);
}