FreeRDP
Loading...
Searching...
No Matches
rts.c
1
20#include <freerdp/config.h>
21
22#include <winpr/assert.h>
23#include <winpr/cast.h>
24#include <winpr/crt.h>
25#include <winpr/crypto.h>
26
27#include <freerdp/log.h>
28
29#include "ncacn_http.h"
30#include "rpc_client.h"
31#include "rts_signature.h"
32
33#include "rts.h"
34
35#define TAG FREERDP_TAG("core.gateway.rts")
36
70static int rts_destination_command_read(rdpRpc* rpc, wStream* buffer, UINT32* Destination);
71
72static const char* rts_command_to_string(UINT32 cmd, char* buffer, size_t len)
73{
74 const char* str = nullptr;
75
76#undef ENTRY
77#define ENTRY(x) \
78 case x: \
79 str = "#x"; \
80 break
81
82 switch (cmd)
83 {
84 ENTRY(RTS_CMD_RECEIVE_WINDOW_SIZE);
85 ENTRY(RTS_CMD_FLOW_CONTROL_ACK);
86 ENTRY(RTS_CMD_CONNECTION_TIMEOUT);
87 ENTRY(RTS_CMD_COOKIE);
88 ENTRY(RTS_CMD_CHANNEL_LIFETIME);
89 ENTRY(RTS_CMD_CLIENT_KEEPALIVE);
90 ENTRY(RTS_CMD_VERSION);
91 ENTRY(RTS_CMD_EMPTY);
92 ENTRY(RTS_CMD_PADDING);
93 ENTRY(RTS_CMD_NEGATIVE_ANCE);
94 ENTRY(RTS_CMD_ANCE);
95 ENTRY(RTS_CMD_CLIENT_ADDRESS);
96 ENTRY(RTS_CMD_ASSOCIATION_GROUP_ID);
97 ENTRY(RTS_CMD_DESTINATION);
98 ENTRY(RTS_CMD_PING_TRAFFIC_SENT_NOTIFY);
99 ENTRY(RTS_CMD_LAST_ID);
100 default:
101 str = "RTS_CMD_UNKNOWN";
102 break;
103 }
104
105#undef ENTRY
106
107 (void)_snprintf(buffer, len, "%s [0x%08" PRIx32 "]", str, cmd);
108 return buffer;
109}
110
111static const char* rts_pdu_ptype_to_string(UINT32 ptype)
112{
113 switch (ptype)
114 {
115 case PTYPE_REQUEST:
116 return "PTYPE_REQUEST";
117 case PTYPE_PING:
118 return "PTYPE_PING";
119 case PTYPE_RESPONSE:
120 return "PTYPE_RESPONSE";
121 case PTYPE_FAULT:
122 return "PTYPE_FAULT";
123 case PTYPE_WORKING:
124 return "PTYPE_WORKING";
125 case PTYPE_NOCALL:
126 return "PTYPE_NOCALL";
127 case PTYPE_REJECT:
128 return "PTYPE_REJECT";
129 case PTYPE_ACK:
130 return "PTYPE_ACK";
131 case PTYPE_CL_CANCEL:
132 return "PTYPE_CL_CANCEL";
133 case PTYPE_FACK:
134 return "PTYPE_FACK";
135 case PTYPE_CANCEL_ACK:
136 return "PTYPE_CANCEL_ACK";
137 case PTYPE_BIND:
138 return "PTYPE_BIND";
139 case PTYPE_BIND_ACK:
140 return "PTYPE_BIND_ACK";
141 case PTYPE_BIND_NAK:
142 return "PTYPE_BIND_NAK";
143 case PTYPE_ALTER_CONTEXT:
144 return "PTYPE_ALTER_CONTEXT";
145 case PTYPE_ALTER_CONTEXT_RESP:
146 return "PTYPE_ALTER_CONTEXT_RESP";
147 case PTYPE_RPC_AUTH_3:
148 return "PTYPE_RPC_AUTH_3";
149 case PTYPE_SHUTDOWN:
150 return "PTYPE_SHUTDOWN";
151 case PTYPE_CO_CANCEL:
152 return "PTYPE_CO_CANCEL";
153 case PTYPE_ORPHANED:
154 return "PTYPE_ORPHANED";
155 case PTYPE_RTS:
156 return "PTYPE_RTS";
157 default:
158 return "UNKNOWN";
159 }
160}
161
162static rpcconn_rts_hdr_t rts_pdu_header_init(void)
163{
164 rpcconn_rts_hdr_t header = WINPR_C_ARRAY_INIT;
165 header.header.rpc_vers = 5;
166 header.header.rpc_vers_minor = 0;
167 header.header.ptype = PTYPE_RTS;
168 header.header.packed_drep[0] = 0x10;
169 header.header.packed_drep[1] = 0x00;
170 header.header.packed_drep[2] = 0x00;
171 header.header.packed_drep[3] = 0x00;
172 header.header.pfc_flags = PFC_FIRST_FRAG | PFC_LAST_FRAG;
173 header.header.auth_length = 0;
174 header.header.call_id = 0;
175
176 return header;
177}
178
179static BOOL rts_align_stream(wStream* s, size_t alignment, BOOL silent)
180{
181 size_t pos = 0;
182 size_t pad = 0;
183
184 WINPR_ASSERT(s);
185 WINPR_ASSERT(alignment > 0);
186
187 pos = Stream_GetPosition(s);
188 pad = rpc_offset_align(&pos, alignment);
189 return Stream_ConditionalSafeSeek(s, pad, silent);
190}
191
192static char* sdup(const void* src, size_t length)
193{
194 char* dst = nullptr;
195 WINPR_ASSERT(src || (length == 0));
196 if (length == 0)
197 return nullptr;
198
199 dst = calloc(length + 1, sizeof(char));
200 if (!dst)
201 return nullptr;
202 memcpy(dst, src, length);
203 return dst;
204}
205
206static BOOL rts_write_common_pdu_header(wStream* s, const rpcconn_common_hdr_t* header)
207{
208 WINPR_ASSERT(s);
209 WINPR_ASSERT(header);
210 if (!Stream_EnsureRemainingCapacity(s, sizeof(rpcconn_common_hdr_t)))
211 return FALSE;
212
213 Stream_Write_UINT8(s, header->rpc_vers);
214 Stream_Write_UINT8(s, header->rpc_vers_minor);
215 Stream_Write_UINT8(s, header->ptype);
216 Stream_Write_UINT8(s, header->pfc_flags);
217 Stream_Write(s, header->packed_drep, ARRAYSIZE(header->packed_drep));
218 Stream_Write_UINT16(s, header->frag_length);
219 Stream_Write_UINT16(s, header->auth_length);
220 Stream_Write_UINT32(s, header->call_id);
221 return TRUE;
222}
223
224rts_pdu_status_t rts_read_common_pdu_header(wStream* s, rpcconn_common_hdr_t* header,
225 BOOL ignoreErrors)
226{
227 WINPR_ASSERT(s);
228 WINPR_ASSERT(header);
229
230 if (!ignoreErrors)
231 {
232 if (!Stream_CheckAndLogRequiredLength(TAG, s, sizeof(rpcconn_common_hdr_t)))
233 return RTS_PDU_INCOMPLETE;
234 }
235 else
236 {
237 const size_t sz = Stream_GetRemainingLength(s);
238 if (sz < sizeof(rpcconn_common_hdr_t))
239 return RTS_PDU_INCOMPLETE;
240 }
241
242 Stream_Read_UINT8(s, header->rpc_vers);
243 Stream_Read_UINT8(s, header->rpc_vers_minor);
244 Stream_Read_UINT8(s, header->ptype);
245 Stream_Read_UINT8(s, header->pfc_flags);
246 Stream_Read(s, header->packed_drep, ARRAYSIZE(header->packed_drep));
247 Stream_Read_UINT16(s, header->frag_length);
248 Stream_Read_UINT16(s, header->auth_length);
249 Stream_Read_UINT32(s, header->call_id);
250
251 if (header->frag_length < sizeof(rpcconn_common_hdr_t))
252 {
253 if (!ignoreErrors)
254 WLog_WARN(TAG, "Invalid header->frag_length of %" PRIu16 ", expected %" PRIuz,
255 header->frag_length, sizeof(rpcconn_common_hdr_t));
256 return RTS_PDU_FAIL;
257 }
258 if (header->auth_length > header->frag_length - 8ull)
259 {
260 if (!ignoreErrors)
261 WLog_WARN(TAG,
262 "Invalid header->auth_length(%" PRIu16 ") > header->frag_length(%" PRIu16
263 ") - 8ull",
264 header->frag_length, header->auth_length);
265 return RTS_PDU_FAIL;
266 }
267
268 if (!ignoreErrors)
269 {
270 if (!Stream_CheckAndLogRequiredLength(TAG, s,
271 header->frag_length - sizeof(rpcconn_common_hdr_t)))
272 return RTS_PDU_INCOMPLETE;
273 }
274 else
275 {
276 const size_t sz2 = Stream_GetRemainingLength(s);
277 if (sz2 < header->frag_length - sizeof(rpcconn_common_hdr_t))
278 return RTS_PDU_INCOMPLETE;
279 }
280 return RTS_PDU_VALID;
281}
282
283static BOOL rts_read_auth_verifier_no_checks(wStream* s, auth_verifier_co_t* auth,
284 const rpcconn_common_hdr_t* header, size_t* startPos,
285 BOOL silent)
286{
287 WINPR_ASSERT(s);
288 WINPR_ASSERT(auth);
289 WINPR_ASSERT(header);
290
291 WINPR_ASSERT(header->frag_length > header->auth_length + 8);
292
293 if (startPos)
294 *startPos = Stream_GetPosition(s);
295
296 /* Read the auth verifier and check padding matches frag_length */
297 {
298 const size_t expected = header->frag_length - header->auth_length - 8;
299
300 if (!Stream_SetPosition(s, expected))
301 return FALSE;
302 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 8, silent))
303 return FALSE;
304
305 Stream_Read_UINT8(s, auth->auth_type);
306 Stream_Read_UINT8(s, auth->auth_level);
307 Stream_Read_UINT8(s, auth->auth_pad_length);
308 Stream_Read_UINT8(s, auth->auth_reserved);
309 Stream_Read_UINT32(s, auth->auth_context_id);
310 }
311
312 if (header->auth_length != 0)
313 {
314 const void* ptr = Stream_Pointer(s);
315 if (!Stream_ConditionalSafeSeek(s, header->auth_length, silent))
316 return FALSE;
317 auth->auth_value = (BYTE*)sdup(ptr, header->auth_length);
318 if (auth->auth_value == nullptr)
319 return FALSE;
320 }
321
322 return TRUE;
323}
324
325static BOOL rts_read_auth_verifier(wStream* s, auth_verifier_co_t* auth,
326 const rpcconn_common_hdr_t* header, BOOL silent)
327{
328 size_t pos = 0;
329 WINPR_ASSERT(s);
330 WINPR_ASSERT(auth);
331 WINPR_ASSERT(header);
332
333 if (!rts_read_auth_verifier_no_checks(s, auth, header, &pos, silent))
334 return FALSE;
335
336 const size_t expected = header->frag_length - header->auth_length - 8;
337 WINPR_ASSERT(pos + auth->auth_pad_length == expected);
338 return pos + auth->auth_pad_length == expected;
339}
340
341static BOOL rts_read_auth_verifier_with_stub(wStream* s, auth_verifier_co_t* auth,
342 rpcconn_common_hdr_t* header, BOOL silent)
343{
344 size_t pos = 0;
345 size_t alloc_hint = 0;
346 BYTE** ptr = nullptr;
347
348 if (!rts_read_auth_verifier_no_checks(s, auth, header, &pos, silent))
349 return FALSE;
350
351 switch (header->ptype)
352 {
353 case PTYPE_FAULT:
354 {
356 alloc_hint = hdr->alloc_hint;
357 ptr = &hdr->stub_data;
358 }
359 break;
360 case PTYPE_RESPONSE:
361 {
363 alloc_hint = hdr->alloc_hint;
364 ptr = &hdr->stub_data;
365 }
366 break;
367 case PTYPE_REQUEST:
368 {
370 alloc_hint = hdr->alloc_hint;
371 ptr = &hdr->stub_data;
372 }
373 break;
374 default:
375 return FALSE;
376 }
377
378 if (alloc_hint > 0)
379 {
380 const size_t off = header->auth_length + 8 + auth->auth_pad_length + pos;
381 const size_t size = header->frag_length - MIN(header->frag_length, off);
382 const void* src = Stream_Buffer(s) + pos;
383
384 if (off > header->frag_length)
385 WLog_WARN(TAG,
386 "Unexpected alloc_hint(%" PRIuz ") for PDU %s: size %" PRIuz
387 ", frag_length %" PRIu16 ", offset %" PRIuz,
388 alloc_hint, rts_pdu_ptype_to_string(header->ptype), size, header->frag_length,
389 off);
390
391 *ptr = nullptr;
392 if (size > 0)
393 {
394 *ptr = (BYTE*)sdup(src, size);
395 if (!*ptr)
396 return FALSE;
397 }
398 }
399
400 return TRUE;
401}
402
403static void rts_free_auth_verifier(auth_verifier_co_t* auth)
404{
405 if (!auth)
406 return;
407 free(auth->auth_value);
408}
409
410static BOOL rts_write_auth_verifier(wStream* s, const auth_verifier_co_t* auth,
411 const rpcconn_common_hdr_t* header)
412{
413 size_t pos = 0;
414 UINT8 auth_pad_length = 0;
415
416 WINPR_ASSERT(s);
417 WINPR_ASSERT(auth);
418 WINPR_ASSERT(header);
419
420 /* Align start to a multiple of 4 */
421 pos = Stream_GetPosition(s);
422 if ((pos % 4) != 0)
423 {
424 auth_pad_length = 4 - (pos % 4);
425 if (!Stream_EnsureRemainingCapacity(s, auth_pad_length))
426 return FALSE;
427 Stream_Zero(s, auth_pad_length);
428 }
429
430#if defined(WITH_VERBOSE_WINPR_ASSERT) && (WITH_VERBOSE_WINPR_ASSERT != 0)
431 WINPR_ASSERT(header->frag_length + 8ull > header->auth_length);
432 {
433 size_t apos = Stream_GetPosition(s);
434 size_t expected = header->frag_length - header->auth_length - 8;
435
436 WINPR_ASSERT(apos == expected);
437 }
438#endif
439
440 if (!Stream_EnsureRemainingCapacity(s, sizeof(auth_verifier_co_t)))
441 return FALSE;
442
443 Stream_Write_UINT8(s, auth->auth_type);
444 Stream_Write_UINT8(s, auth->auth_level);
445 Stream_Write_UINT8(s, auth_pad_length);
446 Stream_Write_UINT8(s, 0); /* auth->auth_reserved */
447 Stream_Write_UINT32(s, auth->auth_context_id);
448
449 if (!Stream_EnsureRemainingCapacity(s, header->auth_length))
450 return FALSE;
451 Stream_Write(s, auth->auth_value, header->auth_length);
452 return TRUE;
453}
454
455static BOOL rts_read_version(wStream* s, p_rt_version_t* version, BOOL silent)
456{
457 WINPR_ASSERT(s);
458 WINPR_ASSERT(version);
459
460 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 2 * sizeof(UINT8), silent))
461 return FALSE;
462 Stream_Read_UINT8(s, version->major);
463 Stream_Read_UINT8(s, version->minor);
464 return TRUE;
465}
466
467static void rts_free_supported_versions(p_rt_versions_supported_t* versions)
468{
469 if (!versions)
470 return;
471 free(versions->p_protocols);
472 versions->p_protocols = nullptr;
473}
474
475static BOOL rts_read_supported_versions(wStream* s, p_rt_versions_supported_t* versions,
476 BOOL silent)
477{
478 WINPR_ASSERT(s);
479 WINPR_ASSERT(versions);
480
481 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, sizeof(UINT8), silent))
482 return FALSE;
483
484 Stream_Read_UINT8(s, versions->n_protocols); /* count */
485
486 if (versions->n_protocols > 0)
487 {
488 versions->p_protocols = calloc(versions->n_protocols, sizeof(p_rt_version_t));
489 if (!versions->p_protocols)
490 return FALSE;
491 }
492 for (BYTE x = 0; x < versions->n_protocols; x++)
493 {
494 p_rt_version_t* version = &versions->p_protocols[x];
495 if (!rts_read_version(s, version, silent)) /* size_is(n_protocols) */
496 {
497 rts_free_supported_versions(versions);
498 return FALSE;
499 }
500 }
501
502 return TRUE;
503}
504
505static BOOL rts_read_port_any(wStream* s, port_any_t* port, BOOL silent)
506{
507 WINPR_ASSERT(s);
508 WINPR_ASSERT(port);
509
510 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, sizeof(UINT16), silent))
511 return FALSE;
512
513 Stream_Read_UINT16(s, port->length);
514 if (port->length == 0)
515 return TRUE;
516
517 const void* ptr = Stream_ConstPointer(s);
518 if (!Stream_ConditionalSafeSeek(s, port->length, silent))
519 return FALSE;
520 port->port_spec = sdup(ptr, port->length);
521 return port->port_spec != nullptr;
522}
523
524static void rts_free_port_any(port_any_t* port)
525{
526 if (!port)
527 return;
528 free(port->port_spec);
529}
530
531static BOOL rts_read_uuid(wStream* s, p_uuid_t* uuid, BOOL silent)
532{
533 WINPR_ASSERT(s);
534 WINPR_ASSERT(uuid);
535
536 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, sizeof(p_uuid_t), silent))
537 return FALSE;
538
539 Stream_Read_UINT32(s, uuid->time_low);
540 Stream_Read_UINT16(s, uuid->time_mid);
541 Stream_Read_UINT16(s, uuid->time_hi_and_version);
542 Stream_Read_UINT8(s, uuid->clock_seq_hi_and_reserved);
543 Stream_Read_UINT8(s, uuid->clock_seq_low);
544 Stream_Read(s, uuid->node, ARRAYSIZE(uuid->node));
545 return TRUE;
546}
547
548static BOOL rts_write_uuid(wStream* s, const p_uuid_t* uuid)
549{
550 WINPR_ASSERT(s);
551 WINPR_ASSERT(uuid);
552
553 if (!Stream_EnsureRemainingCapacity(s, sizeof(p_uuid_t)))
554 return FALSE;
555
556 Stream_Write_UINT32(s, uuid->time_low);
557 Stream_Write_UINT16(s, uuid->time_mid);
558 Stream_Write_UINT16(s, uuid->time_hi_and_version);
559 Stream_Write_UINT8(s, uuid->clock_seq_hi_and_reserved);
560 Stream_Write_UINT8(s, uuid->clock_seq_low);
561 Stream_Write(s, uuid->node, ARRAYSIZE(uuid->node));
562 return TRUE;
563}
564
565static p_syntax_id_t* rts_syntax_id_new(size_t count)
566{
567 return calloc(count, sizeof(p_syntax_id_t));
568}
569
570static void rts_syntax_id_free(p_syntax_id_t* ptr)
571{
572 free(ptr);
573}
574
575static BOOL rts_read_syntax_id(wStream* s, p_syntax_id_t* syntax_id, BOOL silent)
576{
577 WINPR_ASSERT(s);
578 WINPR_ASSERT(syntax_id);
579
580 if (!rts_read_uuid(s, &syntax_id->if_uuid, silent))
581 return FALSE;
582
583 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
584 return FALSE;
585
586 Stream_Read_UINT32(s, syntax_id->if_version);
587 return TRUE;
588}
589
590static BOOL rts_write_syntax_id(wStream* s, const p_syntax_id_t* syntax_id)
591{
592 WINPR_ASSERT(s);
593 WINPR_ASSERT(syntax_id);
594
595 if (!rts_write_uuid(s, &syntax_id->if_uuid))
596 return FALSE;
597
598 if (!Stream_EnsureRemainingCapacity(s, 4))
599 return FALSE;
600
601 Stream_Write_UINT32(s, syntax_id->if_version);
602 return TRUE;
603}
604
605static void rts_context_elem_free(p_cont_elem_t* ptr)
606{
607 if (!ptr)
608 return;
609 rts_syntax_id_free(ptr->transfer_syntaxes);
610 free(ptr);
611}
612
613WINPR_ATTR_MALLOC(rts_context_elem_free, 1)
614WINPR_ATTR_NODISCARD
615static p_cont_elem_t* rts_context_elem_new(size_t count)
616{
617 p_cont_elem_t* ctx = calloc(count, sizeof(p_cont_elem_t));
618 return ctx;
619}
620
621static BOOL rts_read_context_elem(wStream* s, p_cont_elem_t* element, BOOL silent)
622{
623 WINPR_ASSERT(s);
624 WINPR_ASSERT(element);
625
626 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
627 return FALSE;
628
629 Stream_Read_UINT16(s, element->p_cont_id);
630 Stream_Read_UINT8(s, element->n_transfer_syn); /* number of items */
631 Stream_Read_UINT8(s, element->reserved); /* alignment pad, m.b.z. */
632
633 if (!rts_read_syntax_id(s, &element->abstract_syntax, silent)) /* transfer syntax list */
634 return FALSE;
635
636 if (element->n_transfer_syn > 0)
637 {
638 element->transfer_syntaxes = rts_syntax_id_new(element->n_transfer_syn);
639 if (!element->transfer_syntaxes)
640 return FALSE;
641 for (BYTE x = 0; x < element->n_transfer_syn; x++)
642 {
643 p_syntax_id_t* syn = &element->transfer_syntaxes[x];
644 if (!rts_read_syntax_id(s, syn, silent)) /* size_is(n_transfer_syn) */
645 return FALSE;
646 }
647 }
648
649 return TRUE;
650}
651
652static BOOL rts_write_context_elem(wStream* s, const p_cont_elem_t* element)
653{
654 WINPR_ASSERT(s);
655 WINPR_ASSERT(element);
656
657 if (!Stream_EnsureRemainingCapacity(s, 4))
658 return FALSE;
659 Stream_Write_UINT16(s, element->p_cont_id);
660 Stream_Write_UINT8(s, element->n_transfer_syn); /* number of items */
661 Stream_Write_UINT8(s, element->reserved); /* alignment pad, m.b.z. */
662 if (!rts_write_syntax_id(s, &element->abstract_syntax)) /* transfer syntax list */
663 return FALSE;
664
665 for (BYTE x = 0; x < element->n_transfer_syn; x++)
666 {
667 const p_syntax_id_t* syn = &element->transfer_syntaxes[x];
668 if (!rts_write_syntax_id(s, syn)) /* size_is(n_transfer_syn) */
669 return FALSE;
670 }
671
672 return TRUE;
673}
674
675static BOOL rts_read_context_list(wStream* s, p_cont_list_t* list, BOOL silent)
676{
677 WINPR_ASSERT(s);
678 WINPR_ASSERT(list);
679
680 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
681 return FALSE;
682 Stream_Read_UINT8(s, list->n_context_elem); /* number of items */
683 Stream_Read_UINT8(s, list->reserved); /* alignment pad, m.b.z. */
684 Stream_Read_UINT16(s, list->reserved2); /* alignment pad, m.b.z. */
685
686 if (list->n_context_elem > 0)
687 {
688 list->p_cont_elem = rts_context_elem_new(list->n_context_elem);
689 if (!list->p_cont_elem)
690 return FALSE;
691 for (BYTE x = 0; x < list->n_context_elem; x++)
692 {
693 p_cont_elem_t* element = &list->p_cont_elem[x];
694 if (!rts_read_context_elem(s, element, silent))
695 return FALSE;
696 }
697 }
698 return TRUE;
699}
700
701static void rts_free_context_list(p_cont_list_t* list)
702{
703 if (!list)
704 return;
705 rts_context_elem_free(list->p_cont_elem);
706}
707
708static BOOL rts_write_context_list(wStream* s, const p_cont_list_t* list)
709{
710 WINPR_ASSERT(s);
711 WINPR_ASSERT(list);
712
713 if (!Stream_EnsureRemainingCapacity(s, 4))
714 return FALSE;
715 Stream_Write_UINT8(s, list->n_context_elem); /* number of items */
716 Stream_Write_UINT8(s, 0); /* alignment pad, m.b.z. */
717 Stream_Write_UINT16(s, 0); /* alignment pad, m.b.z. */
718
719 for (BYTE x = 0; x < list->n_context_elem; x++)
720 {
721 const p_cont_elem_t* element = &list->p_cont_elem[x];
722 if (!rts_write_context_elem(s, element))
723 return FALSE;
724 }
725 return TRUE;
726}
727
728static p_result_t* rts_result_new(size_t count)
729{
730 return calloc(count, sizeof(p_result_t));
731}
732
733static void rts_result_free(p_result_t* results)
734{
735 if (!results)
736 return;
737 free(results);
738}
739
740static BOOL rts_read_result(wStream* s, p_result_t* result, BOOL silent)
741{
742 WINPR_ASSERT(s);
743 WINPR_ASSERT(result);
744
745 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 2, silent))
746 return FALSE;
747
748 const UINT16 res = Stream_Get_UINT16(s);
749 switch (res)
750 {
751 case acceptance:
752 case user_rejection:
753 case provider_rejection:
754 case negotiate_ack:
755 break;
756 default:
757 WLog_ERR(TAG, "Invalid p_cont_def_result_t %" PRIu16, res);
758 return FALSE;
759 }
760 result->result = (p_cont_def_result_t)res;
761
762 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 2, silent))
763 return FALSE;
764
765 const UINT16 reason = Stream_Get_UINT16(s);
766 switch (reason)
767 {
768 case reason_not_specified:
769 case abstract_syntax_not_supported:
770 case proposed_transfer_syntaxes_not_supported:
771 case local_limit_exceeded:
772 break;
773 default:
774 WLog_ERR(TAG, "Invalid p_provider_reason_t %" PRIu16, reason);
775 return FALSE;
776 }
777 result->reason = (p_provider_reason_t)reason;
778 return rts_read_syntax_id(s, &result->transfer_syntax, silent);
779}
780
781static void rts_free_result(p_result_t* result)
782{
783 if (!result)
784 return;
785}
786
787static BOOL rts_read_result_list(wStream* s, p_result_list_t* list, BOOL silent)
788{
789 WINPR_ASSERT(s);
790 WINPR_ASSERT(list);
791
792 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
793 return FALSE;
794 Stream_Read_UINT8(s, list->n_results); /* count */
795 Stream_Read_UINT8(s, list->reserved); /* alignment pad, m.b.z. */
796 Stream_Read_UINT16(s, list->reserved2); /* alignment pad, m.b.z. */
797
798 if (list->n_results > 0)
799 {
800 list->p_results = rts_result_new(list->n_results);
801 if (!list->p_results)
802 return FALSE;
803
804 for (BYTE x = 0; x < list->n_results; x++)
805 {
806 p_result_t* result = &list->p_results[x]; /* size_is(n_results) */
807 if (!rts_read_result(s, result, silent))
808 return FALSE;
809 }
810 }
811
812 return TRUE;
813}
814
815static void rts_free_result_list(p_result_list_t* list)
816{
817 if (!list)
818 return;
819 for (BYTE x = 0; x < list->n_results; x++)
820 {
821 p_result_t* result = &list->p_results[x];
822 rts_free_result(result);
823 }
824 rts_result_free(list->p_results);
825}
826
827static void rts_free_pdu_alter_context(rpcconn_alter_context_hdr_t* ctx)
828{
829 if (!ctx)
830 return;
831
832 rts_free_context_list(&ctx->p_context_elem);
833 rts_free_auth_verifier(&ctx->auth_verifier);
834}
835
836static BOOL rts_read_pdu_alter_context(wStream* s, rpcconn_alter_context_hdr_t* ctx, BOOL silent)
837{
838 WINPR_ASSERT(s);
839 WINPR_ASSERT(ctx);
840
841 if (!Stream_ConditionalCheckAndLogRequiredLength(
842 TAG, s, sizeof(rpcconn_alter_context_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
843 return FALSE;
844
845 Stream_Read_UINT16(s, ctx->max_xmit_frag);
846 Stream_Read_UINT16(s, ctx->max_recv_frag);
847 Stream_Read_UINT32(s, ctx->assoc_group_id);
848
849 if (!rts_read_context_list(s, &ctx->p_context_elem, silent))
850 return FALSE;
851
852 if (!rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent))
853 return FALSE;
854
855 return TRUE;
856}
857
858static BOOL rts_read_pdu_alter_context_response(wStream* s,
860 BOOL silent)
861{
862 WINPR_ASSERT(s);
863 WINPR_ASSERT(ctx);
864
865 if (!Stream_ConditionalCheckAndLogRequiredLength(
867 silent))
868 return FALSE;
869 Stream_Read_UINT16(s, ctx->max_xmit_frag);
870 Stream_Read_UINT16(s, ctx->max_recv_frag);
871 Stream_Read_UINT32(s, ctx->assoc_group_id);
872
873 if (!rts_read_port_any(s, &ctx->sec_addr, silent))
874 return FALSE;
875
876 if (!rts_align_stream(s, 4, silent))
877 return FALSE;
878
879 if (!rts_read_result_list(s, &ctx->p_result_list, silent))
880 return FALSE;
881
882 if (!rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent))
883 return FALSE;
884
885 return TRUE;
886}
887
888static void rts_free_pdu_alter_context_response(rpcconn_alter_context_response_hdr_t* ctx)
889{
890 if (!ctx)
891 return;
892
893 rts_free_port_any(&ctx->sec_addr);
894 rts_free_result_list(&ctx->p_result_list);
895 rts_free_auth_verifier(&ctx->auth_verifier);
896}
897
898static BOOL rts_read_pdu_bind(wStream* s, rpcconn_bind_hdr_t* ctx, BOOL silent)
899{
900 WINPR_ASSERT(s);
901 WINPR_ASSERT(ctx);
902
903 if (!Stream_ConditionalCheckAndLogRequiredLength(
904 TAG, s, sizeof(rpcconn_bind_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
905 return FALSE;
906 Stream_Read_UINT16(s, ctx->max_xmit_frag);
907 Stream_Read_UINT16(s, ctx->max_recv_frag);
908 Stream_Read_UINT32(s, ctx->assoc_group_id);
909
910 if (!rts_read_context_list(s, &ctx->p_context_elem, silent))
911 return FALSE;
912
913 if (!rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent))
914 return FALSE;
915
916 return TRUE;
917}
918
919static void rts_free_pdu_bind(rpcconn_bind_hdr_t* ctx)
920{
921 if (!ctx)
922 return;
923 rts_free_context_list(&ctx->p_context_elem);
924 rts_free_auth_verifier(&ctx->auth_verifier);
925}
926
927static BOOL rts_read_pdu_bind_ack(wStream* s, rpcconn_bind_ack_hdr_t* ctx, BOOL silent)
928{
929 WINPR_ASSERT(s);
930 WINPR_ASSERT(ctx);
931
932 if (!Stream_CheckAndLogRequiredLength(
933 TAG, s, sizeof(rpcconn_bind_ack_hdr_t) - sizeof(rpcconn_common_hdr_t)))
934 return FALSE;
935 Stream_Read_UINT16(s, ctx->max_xmit_frag);
936 Stream_Read_UINT16(s, ctx->max_recv_frag);
937 Stream_Read_UINT32(s, ctx->assoc_group_id);
938
939 if (!rts_read_port_any(s, &ctx->sec_addr, silent))
940 return FALSE;
941
942 if (!rts_align_stream(s, 4, silent))
943 return FALSE;
944
945 if (!rts_read_result_list(s, &ctx->p_result_list, silent))
946 return FALSE;
947
948 return rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent);
949}
950
951static void rts_free_pdu_bind_ack(rpcconn_bind_ack_hdr_t* ctx)
952{
953 if (!ctx)
954 return;
955 rts_free_port_any(&ctx->sec_addr);
956 rts_free_result_list(&ctx->p_result_list);
957 rts_free_auth_verifier(&ctx->auth_verifier);
958}
959
960static BOOL rts_read_pdu_bind_nak(wStream* s, rpcconn_bind_nak_hdr_t* ctx, BOOL silent)
961{
962 WINPR_ASSERT(s);
963 WINPR_ASSERT(ctx);
964
965 if (!Stream_ConditionalCheckAndLogRequiredLength(
966 TAG, s, sizeof(rpcconn_bind_nak_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
967 return FALSE;
968 Stream_Read_UINT16(s, ctx->provider_reject_reason);
969 return rts_read_supported_versions(s, &ctx->versions, silent);
970}
971
972static void rts_free_pdu_bind_nak(rpcconn_bind_nak_hdr_t* ctx)
973{
974 if (!ctx)
975 return;
976
977 rts_free_supported_versions(&ctx->versions);
978}
979
980static BOOL rts_read_pdu_auth3(wStream* s, rpcconn_rpc_auth_3_hdr_t* ctx, BOOL silent)
981{
982 WINPR_ASSERT(s);
983 WINPR_ASSERT(ctx);
984
985 if (!Stream_ConditionalCheckAndLogRequiredLength(
986 TAG, s, sizeof(rpcconn_rpc_auth_3_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
987 return FALSE;
988 Stream_Read_UINT16(s, ctx->max_xmit_frag);
989 Stream_Read_UINT16(s, ctx->max_recv_frag);
990
991 return rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent);
992}
993
994static void rts_free_pdu_auth3(rpcconn_rpc_auth_3_hdr_t* ctx)
995{
996 if (!ctx)
997 return;
998 rts_free_auth_verifier(&ctx->auth_verifier);
999}
1000
1001static BOOL rts_read_pdu_fault(wStream* s, rpcconn_fault_hdr_t* ctx, BOOL silent)
1002{
1003 WINPR_ASSERT(s);
1004 WINPR_ASSERT(ctx);
1005
1006 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 12, silent))
1007 return FALSE;
1008 Stream_Read_UINT32(s, ctx->alloc_hint);
1009 Stream_Read_UINT16(s, ctx->p_cont_id);
1010 Stream_Read_UINT8(s, ctx->cancel_count);
1011 Stream_Read_UINT8(s, ctx->reserved);
1012 Stream_Read_UINT32(s, ctx->status);
1013
1014 WLog_WARN(TAG, "status=%s", Win32ErrorCode2Tag(ctx->status & 0xFFFF));
1015 return rts_read_auth_verifier_with_stub(s, &ctx->auth_verifier, &ctx->header, silent);
1016}
1017
1018static void rts_free_pdu_fault(rpcconn_fault_hdr_t* ctx)
1019{
1020 if (!ctx)
1021 return;
1022 rts_free_auth_verifier(&ctx->auth_verifier);
1023}
1024
1025static BOOL rts_read_pdu_cancel_ack(wStream* s, rpcconn_cancel_hdr_t* ctx, BOOL silent)
1026{
1027 WINPR_ASSERT(s);
1028 WINPR_ASSERT(ctx);
1029
1030 if (!Stream_ConditionalCheckAndLogRequiredLength(
1031 TAG, s, sizeof(rpcconn_cancel_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
1032 return FALSE;
1033 return rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent);
1034}
1035
1036static void rts_free_pdu_cancel_ack(rpcconn_cancel_hdr_t* ctx)
1037{
1038 if (!ctx)
1039 return;
1040 rts_free_auth_verifier(&ctx->auth_verifier);
1041}
1042
1043static BOOL rts_read_pdu_orphaned(wStream* s, rpcconn_orphaned_hdr_t* ctx, BOOL silent)
1044{
1045 WINPR_ASSERT(s);
1046 WINPR_ASSERT(ctx);
1047
1048 if (!Stream_ConditionalCheckAndLogRequiredLength(
1049 TAG, s, sizeof(rpcconn_orphaned_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
1050 return FALSE;
1051 return rts_read_auth_verifier(s, &ctx->auth_verifier, &ctx->header, silent);
1052}
1053
1054static void rts_free_pdu_orphaned(rpcconn_orphaned_hdr_t* ctx)
1055{
1056 if (!ctx)
1057 return;
1058 rts_free_auth_verifier(&ctx->auth_verifier);
1059}
1060
1061static BOOL rts_read_pdu_request(wStream* s, rpcconn_request_hdr_t* ctx, BOOL silent)
1062{
1063 WINPR_ASSERT(s);
1064 WINPR_ASSERT(ctx);
1065
1066 if (!Stream_ConditionalCheckAndLogRequiredLength(
1067 TAG, s, sizeof(rpcconn_request_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
1068 return FALSE;
1069 Stream_Read_UINT32(s, ctx->alloc_hint);
1070 Stream_Read_UINT16(s, ctx->p_cont_id);
1071 Stream_Read_UINT16(s, ctx->opnum);
1072 if (!rts_read_uuid(s, &ctx->object, silent))
1073 return FALSE;
1074
1075 return rts_read_auth_verifier_with_stub(s, &ctx->auth_verifier, &ctx->header, silent);
1076}
1077
1078static void rts_free_pdu_request(rpcconn_request_hdr_t* ctx)
1079{
1080 if (!ctx)
1081 return;
1082 rts_free_auth_verifier(&ctx->auth_verifier);
1083}
1084
1085static BOOL rts_read_pdu_response(wStream* s, rpcconn_response_hdr_t* ctx, BOOL silent)
1086{
1087 WINPR_ASSERT(s);
1088 WINPR_ASSERT(ctx);
1089
1090 if (!Stream_ConditionalCheckAndLogRequiredLength(
1091 TAG, s, sizeof(rpcconn_response_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
1092 return FALSE;
1093 Stream_Read_UINT32(s, ctx->alloc_hint);
1094 Stream_Read_UINT16(s, ctx->p_cont_id);
1095 Stream_Read_UINT8(s, ctx->cancel_count);
1096 Stream_Read_UINT8(s, ctx->reserved);
1097
1098 if (!rts_align_stream(s, 8, silent))
1099 return FALSE;
1100
1101 return rts_read_auth_verifier_with_stub(s, &ctx->auth_verifier, &ctx->header, silent);
1102}
1103
1104static void rts_free_pdu_response(rpcconn_response_hdr_t* ctx)
1105{
1106 if (!ctx)
1107 return;
1108 free(ctx->stub_data);
1109 rts_free_auth_verifier(&ctx->auth_verifier);
1110}
1111
1112static BOOL rts_read_pdu_rts(wStream* s, rpcconn_rts_hdr_t* ctx, BOOL silent)
1113{
1114 WINPR_ASSERT(s);
1115 WINPR_ASSERT(ctx);
1116
1117 if (!Stream_ConditionalCheckAndLogRequiredLength(
1118 TAG, s, sizeof(rpcconn_rts_hdr_t) - sizeof(rpcconn_common_hdr_t), silent))
1119 return FALSE;
1120
1121 Stream_Read_UINT16(s, ctx->Flags);
1122 Stream_Read_UINT16(s, ctx->NumberOfCommands);
1123 return TRUE;
1124}
1125
1126static void rts_free_pdu_rts(rpcconn_rts_hdr_t* ctx)
1127{
1128 WINPR_UNUSED(ctx);
1129}
1130
1131void rts_free_pdu_header(rpcconn_hdr_t* header, BOOL allocated)
1132{
1133 if (!header)
1134 return;
1135
1136 switch (header->common.ptype)
1137 {
1138 case PTYPE_ALTER_CONTEXT:
1139 rts_free_pdu_alter_context(&header->alter_context);
1140 break;
1141 case PTYPE_ALTER_CONTEXT_RESP:
1142 rts_free_pdu_alter_context_response(&header->alter_context_response);
1143 break;
1144 case PTYPE_BIND:
1145 rts_free_pdu_bind(&header->bind);
1146 break;
1147 case PTYPE_BIND_ACK:
1148 rts_free_pdu_bind_ack(&header->bind_ack);
1149 break;
1150 case PTYPE_BIND_NAK:
1151 rts_free_pdu_bind_nak(&header->bind_nak);
1152 break;
1153 case PTYPE_RPC_AUTH_3:
1154 rts_free_pdu_auth3(&header->rpc_auth_3);
1155 break;
1156 case PTYPE_CANCEL_ACK:
1157 rts_free_pdu_cancel_ack(&header->cancel);
1158 break;
1159 case PTYPE_FAULT:
1160 rts_free_pdu_fault(&header->fault);
1161 break;
1162 case PTYPE_ORPHANED:
1163 rts_free_pdu_orphaned(&header->orphaned);
1164 break;
1165 case PTYPE_REQUEST:
1166 rts_free_pdu_request(&header->request);
1167 break;
1168 case PTYPE_RESPONSE:
1169 rts_free_pdu_response(&header->response);
1170 break;
1171 case PTYPE_RTS:
1172 rts_free_pdu_rts(&header->rts);
1173 break;
1174 /* No extra fields */
1175 case PTYPE_SHUTDOWN:
1176 break;
1177
1178 /* not handled */
1179 case PTYPE_PING:
1180 case PTYPE_WORKING:
1181 case PTYPE_NOCALL:
1182 case PTYPE_REJECT:
1183 case PTYPE_ACK:
1184 case PTYPE_CL_CANCEL:
1185 case PTYPE_FACK:
1186 case PTYPE_CO_CANCEL:
1187 default:
1188 break;
1189 }
1190
1191 if (allocated)
1192 free(header);
1193}
1194
1195BOOL rts_read_pdu_header(wStream* s, rpcconn_hdr_t* header)
1196{
1197 return rts_read_pdu_header_ex(s, header, FALSE);
1198}
1199
1200BOOL rts_read_pdu_header_ex(wStream* s, rpcconn_hdr_t* header, BOOL silent)
1201{
1202 BOOL rc = FALSE;
1203 WINPR_ASSERT(s);
1204 WINPR_ASSERT(header);
1205
1206 const rts_pdu_status_t status = rts_read_common_pdu_header(s, &header->common, silent);
1207 if (status != RTS_PDU_VALID)
1208 return FALSE;
1209
1210 WLog_DBG(TAG, "Reading PDU type %s", rts_pdu_ptype_to_string(header->common.ptype));
1211
1212 switch (header->common.ptype)
1213 {
1214 case PTYPE_ALTER_CONTEXT:
1215 rc = rts_read_pdu_alter_context(s, &header->alter_context, silent);
1216 break;
1217 case PTYPE_ALTER_CONTEXT_RESP:
1218 rc = rts_read_pdu_alter_context_response(s, &header->alter_context_response, silent);
1219 break;
1220 case PTYPE_BIND:
1221 rc = rts_read_pdu_bind(s, &header->bind, silent);
1222 break;
1223 case PTYPE_BIND_ACK:
1224 rc = rts_read_pdu_bind_ack(s, &header->bind_ack, silent);
1225 break;
1226 case PTYPE_BIND_NAK:
1227 rc = rts_read_pdu_bind_nak(s, &header->bind_nak, silent);
1228 break;
1229 case PTYPE_RPC_AUTH_3:
1230 rc = rts_read_pdu_auth3(s, &header->rpc_auth_3, silent);
1231 break;
1232 case PTYPE_CANCEL_ACK:
1233 rc = rts_read_pdu_cancel_ack(s, &header->cancel, silent);
1234 break;
1235 case PTYPE_FAULT:
1236 rc = rts_read_pdu_fault(s, &header->fault, silent);
1237 break;
1238 case PTYPE_ORPHANED:
1239 rc = rts_read_pdu_orphaned(s, &header->orphaned, silent);
1240 break;
1241 case PTYPE_REQUEST:
1242 rc = rts_read_pdu_request(s, &header->request, silent);
1243 break;
1244 case PTYPE_RESPONSE:
1245 rc = rts_read_pdu_response(s, &header->response, silent);
1246 break;
1247 case PTYPE_RTS:
1248 rc = rts_read_pdu_rts(s, &header->rts, silent);
1249 break;
1250 case PTYPE_SHUTDOWN:
1251 rc = TRUE; /* No extra fields */
1252 break;
1253
1254 /* not handled */
1255 case PTYPE_PING:
1256 case PTYPE_WORKING:
1257 case PTYPE_NOCALL:
1258 case PTYPE_REJECT:
1259 case PTYPE_ACK:
1260 case PTYPE_CL_CANCEL:
1261 case PTYPE_FACK:
1262 case PTYPE_CO_CANCEL:
1263 default:
1264 break;
1265 }
1266
1267 return rc;
1268}
1269
1270static BOOL rts_write_pdu_header(wStream* s, const rpcconn_rts_hdr_t* header)
1271{
1272 WINPR_ASSERT(s);
1273 WINPR_ASSERT(header);
1274 if (!Stream_EnsureRemainingCapacity(s, sizeof(rpcconn_rts_hdr_t)))
1275 return FALSE;
1276
1277 if (!rts_write_common_pdu_header(s, &header->header))
1278 return FALSE;
1279
1280 Stream_Write_UINT16(s, header->Flags);
1281 Stream_Write_UINT16(s, header->NumberOfCommands);
1282 return TRUE;
1283}
1284
1285/* [MS-RPCH] 2.2.3.5.1 ReceiveWindowSize */
1286static BOOL rts_receive_window_size_command_read(rdpRpc* rpc, wStream* buffer,
1287 UINT32* ReceiveWindowSize)
1288{
1289 WINPR_ASSERT(rpc);
1290 WINPR_ASSERT(buffer);
1291
1292 if (!Stream_CheckAndLogRequiredLength(TAG, buffer, 8))
1293 return FALSE;
1294 const uint32_t CommandType = Stream_Get_UINT32(buffer);
1295 if (CommandType != RTS_CMD_RECEIVE_WINDOW_SIZE)
1296 {
1297 WLog_Print(rpc->log, WLOG_ERROR,
1298 "[MS-RPCH] 2.2.3.5.1 ReceiveWindowSize::CommandType must be 0x%08" PRIx32
1299 ", got "
1300 "0x%08" PRIx32,
1301 WINPR_CXX_COMPAT_CAST(UINT32, RTS_CMD_RECEIVE_WINDOW_SIZE), CommandType);
1302 return FALSE;
1303 }
1304 const UINT32 val = Stream_Get_UINT32(buffer);
1305 if (ReceiveWindowSize)
1306 *ReceiveWindowSize = val; /* ReceiveWindowSize (4 bytes) */
1307
1308 return TRUE;
1309}
1310
1311/* [MS-RPCH] 2.2.3.5.1 ReceiveWindowSize */
1312static BOOL rts_receive_window_size_command_write(wStream* s, UINT32 ReceiveWindowSize)
1313{
1314 WINPR_ASSERT(s);
1315
1316 if (!Stream_EnsureRemainingCapacity(s, 2 * sizeof(UINT32)))
1317 return FALSE;
1318
1319 Stream_Write_UINT32(s, RTS_CMD_RECEIVE_WINDOW_SIZE); /* CommandType (4 bytes) */
1320 Stream_Write_UINT32(s, ReceiveWindowSize); /* ReceiveWindowSize (4 bytes) */
1321
1322 return TRUE;
1323}
1324
1325/* [MS-RPCH] 2.2.3.5.2 FlowControlAck */
1326static int rts_flow_control_ack_command_read(rdpRpc* rpc, wStream* buffer, UINT32* BytesReceived,
1327 UINT32* AvailableWindow, BYTE* ChannelCookie)
1328{
1329 UINT32 val = 0;
1330 UINT32 Command = 0;
1331
1332 WINPR_ASSERT(rpc);
1333 WINPR_ASSERT(buffer);
1334
1335 int rc = rts_destination_command_read(rpc, buffer, &Command);
1336 if (rc < 0)
1337 return rc;
1338
1339 if (Command != RTS_CMD_FLOW_CONTROL_ACK)
1340 {
1341 char buffer1[64] = WINPR_C_ARRAY_INIT;
1342 char buffer2[64] = WINPR_C_ARRAY_INIT;
1343 WLog_Print(rpc->log, WLOG_ERROR, "got command %s, expected %s",
1344 rts_command_to_string(Command, buffer1, sizeof(buffer1)),
1345 rts_command_to_string(RTS_CMD_FLOW_CONTROL_ACK, buffer2, sizeof(buffer2)));
1346 return -1;
1347 }
1348
1349 /* Ack (24 bytes) */
1350 if (!Stream_CheckAndLogRequiredLength(TAG, buffer, 24))
1351 return -1;
1352
1353 Stream_Read_UINT32(buffer, val);
1354 if (BytesReceived)
1355 *BytesReceived = val; /* BytesReceived (4 bytes) */
1356
1357 Stream_Read_UINT32(buffer, val);
1358 if (AvailableWindow)
1359 *AvailableWindow = val; /* AvailableWindow (4 bytes) */
1360
1361 if (ChannelCookie)
1362 Stream_Read(buffer, ChannelCookie, 16); /* ChannelCookie (16 bytes) */
1363 else
1364 Stream_Seek(buffer, 16);
1365 return 24;
1366}
1367
1368/* [MS-RPCH] 2.2.3.5.2 FlowControlAck */
1369static BOOL rts_flow_control_ack_command_write(wStream* s, UINT32 BytesReceived,
1370 UINT32 AvailableWindow, BYTE* ChannelCookie)
1371{
1372 WINPR_ASSERT(s);
1373
1374 if (!Stream_EnsureRemainingCapacity(s, 28))
1375 return FALSE;
1376
1377 Stream_Write_UINT32(s, RTS_CMD_FLOW_CONTROL_ACK); /* CommandType (4 bytes) */
1378 Stream_Write_UINT32(s, BytesReceived); /* BytesReceived (4 bytes) */
1379 Stream_Write_UINT32(s, AvailableWindow); /* AvailableWindow (4 bytes) */
1380 Stream_Write(s, ChannelCookie, 16); /* ChannelCookie (16 bytes) */
1381
1382 return TRUE;
1383}
1384
1385/* [MS-RPCH] 2.2.3.5.3 ConnectionTimeout */
1386static BOOL rts_connection_timeout_command_read(WINPR_ATTR_UNUSED rdpRpc* rpc, wStream* buffer,
1387 UINT32* ConnectionTimeout)
1388{
1389 WINPR_ASSERT(rpc);
1390 WINPR_ASSERT(buffer);
1391
1392 if (!Stream_CheckAndLogRequiredLength(TAG, buffer, 8))
1393 return FALSE;
1394
1395 const uint32_t CommandType = Stream_Get_UINT32(buffer);
1396 if (CommandType != RTS_CMD_CONNECTION_TIMEOUT)
1397 {
1398 WLog_Print(rpc->log, WLOG_ERROR,
1399 "[MS-RPCH] 2.2.3.5.3 ConnectionTimeout::CommandType must be 0x%08" PRIx32
1400 ", got "
1401 "0x%08" PRIx32,
1402 WINPR_CXX_COMPAT_CAST(UINT32, RTS_CMD_CONNECTION_TIMEOUT), CommandType);
1403 return FALSE;
1404 }
1405 const UINT32 val = Stream_Get_UINT32(buffer);
1406 if (ConnectionTimeout)
1407 *ConnectionTimeout = val; /* ConnectionTimeout (4 bytes) */
1408
1409 return TRUE;
1410}
1411
1412static BOOL rts_cookie_command_write(wStream* s, const BYTE* Cookie)
1413{
1414 WINPR_ASSERT(s);
1415
1416 if (!Stream_EnsureRemainingCapacity(s, 20))
1417 return FALSE;
1418
1419 Stream_Write_UINT32(s, RTS_CMD_COOKIE); /* CommandType (4 bytes) */
1420 Stream_Write(s, Cookie, 16); /* Cookie (16 bytes) */
1421
1422 return TRUE;
1423}
1424
1425static BOOL rts_channel_lifetime_command_write(wStream* s, UINT32 ChannelLifetime)
1426{
1427 WINPR_ASSERT(s);
1428
1429 if (!Stream_EnsureRemainingCapacity(s, 8))
1430 return FALSE;
1431 Stream_Write_UINT32(s, RTS_CMD_CHANNEL_LIFETIME); /* CommandType (4 bytes) */
1432 Stream_Write_UINT32(s, ChannelLifetime); /* ChannelLifetime (4 bytes) */
1433
1434 return TRUE;
1435}
1436
1437static BOOL rts_client_keepalive_command_write(wStream* s, UINT32 ClientKeepalive)
1438{
1439 WINPR_ASSERT(s);
1440
1441 if (!Stream_EnsureRemainingCapacity(s, 8))
1442 return FALSE;
1449 Stream_Write_UINT32(s, RTS_CMD_CLIENT_KEEPALIVE); /* CommandType (4 bytes) */
1450 Stream_Write_UINT32(s, ClientKeepalive); /* ClientKeepalive (4 bytes) */
1451
1452 return TRUE;
1453}
1454
1455/* [MS-RPCH] 2.2.3.5.7 Version */
1456static BOOL rts_version_command_read(rdpRpc* rpc, wStream* buffer, uint32_t* pversion)
1457{
1458 WINPR_ASSERT(rpc);
1459 WINPR_ASSERT(buffer);
1460
1461 if (!Stream_EnsureRemainingCapacity(buffer, 8))
1462 return FALSE;
1463
1464 const uint32_t CommandType = Stream_Get_UINT32(buffer); /* CommandType (4 bytes) */
1465 if (CommandType != RTS_CMD_VERSION)
1466 {
1467 WLog_Print(rpc->log, WLOG_ERROR,
1468 "[MS-RPCH] 2.2.3.5.7 Version::CommandType must be 0x%08" PRIx32 ", got "
1469 "0x%08" PRIx32,
1470 WINPR_CXX_COMPAT_CAST(UINT32, RTS_CMD_VERSION), CommandType);
1471 return FALSE;
1472 }
1473 const uint32_t version = Stream_Get_UINT32(buffer); /* Version (4 bytes) */
1474 if (version != 1)
1475 {
1476 WLog_Print(rpc->log, WLOG_WARN,
1477 "[MS-RPCH] 2.2.3.5.7 Version::Version should be 0x00000001, got 0x%08" PRIx32,
1478 version);
1479 }
1480 if (pversion)
1481 *pversion = version;
1482
1483 return TRUE;
1484}
1485
1486/* [MS-RPCH] 2.2.3.5.7 Version */
1487static BOOL rts_version_command_write(wStream* buffer)
1488{
1489 WINPR_ASSERT(buffer);
1490
1491 if (!Stream_EnsureRemainingCapacity((buffer), 8))
1492 return FALSE;
1493
1494 Stream_Write_UINT32(buffer, RTS_CMD_VERSION); /* CommandType (4 bytes) */
1495 Stream_Write_UINT32(buffer, 1); /* Version (4 bytes) */
1496
1497 return TRUE;
1498}
1499
1500static BOOL rts_empty_command_write(wStream* s)
1501{
1502 WINPR_ASSERT(s);
1503
1504 if (!Stream_EnsureRemainingCapacity(s, 8))
1505 return FALSE;
1506
1507 Stream_Write_UINT32(s, RTS_CMD_EMPTY); /* CommandType (4 bytes) */
1508
1509 return TRUE;
1510}
1511
1512static BOOL rts_padding_command_read(wStream* s, size_t* length, BOOL silent)
1513{
1514 UINT32 ConformanceCount = 0;
1515 WINPR_ASSERT(s);
1516 WINPR_ASSERT(length);
1517 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
1518 return FALSE;
1519 Stream_Read_UINT32(s, ConformanceCount); /* ConformanceCount (4 bytes) */
1520 *length = ConformanceCount + 4;
1521 return TRUE;
1522}
1523
1524static BOOL rts_client_address_command_read(wStream* s, size_t* length, BOOL silent)
1525{
1526 UINT32 AddressType = 0;
1527
1528 WINPR_ASSERT(s);
1529 WINPR_ASSERT(length);
1530
1531 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, 4, silent))
1532 return FALSE;
1533 Stream_Read_UINT32(s, AddressType); /* AddressType (4 bytes) */
1534
1535 if (AddressType == 0)
1536 {
1537 /* ClientAddress (4 bytes) */
1538 /* padding (12 bytes) */
1539 *length = 4 + 4 + 12;
1540 }
1541 else
1542 {
1543 /* ClientAddress (16 bytes) */
1544 /* padding (12 bytes) */
1545 *length = 4 + 16 + 12;
1546 }
1547 return TRUE;
1548}
1549
1550static BOOL rts_association_group_id_command_write(wStream* s, const BYTE* AssociationGroupId)
1551{
1552 WINPR_ASSERT(s);
1553
1554 if (!Stream_EnsureRemainingCapacity(s, 20))
1555 return FALSE;
1556
1557 Stream_Write_UINT32(s, RTS_CMD_ASSOCIATION_GROUP_ID); /* CommandType (4 bytes) */
1558 Stream_Write(s, AssociationGroupId, 16); /* AssociationGroupId (16 bytes) */
1559
1560 return TRUE;
1561}
1562
1563static int rts_destination_command_read(WINPR_ATTR_UNUSED rdpRpc* rpc, wStream* buffer,
1564 UINT32* Destination)
1565{
1566 UINT32 val = 0;
1567 WINPR_ASSERT(rpc);
1568 WINPR_ASSERT(buffer);
1569
1570 if (!Stream_CheckAndLogRequiredLength(TAG, buffer, 4))
1571 return -1;
1572 Stream_Read_UINT32(buffer, val);
1573 if (Destination)
1574 *Destination = val; /* Destination (4 bytes) */
1575
1576 return 4;
1577}
1578
1579static BOOL rts_destination_command_write(wStream* s, UINT32 Destination)
1580{
1581 WINPR_ASSERT(s);
1582
1583 if (!Stream_EnsureRemainingCapacity(s, 8))
1584 return FALSE;
1585
1586 Stream_Write_UINT32(s, RTS_CMD_DESTINATION); /* CommandType (4 bytes) */
1587 Stream_Write_UINT32(s, Destination); /* Destination (4 bytes) */
1588
1589 return TRUE;
1590}
1591
1592#define rts_send_buffer(channel, s, frag_length) \
1593 rts_send_buffer_int((channel), (s), (frag_length), __FILE__, __LINE__, __func__)
1594static BOOL rts_send_buffer_int(RpcChannel* channel, wStream* s, size_t frag_length,
1595 const char* file, size_t line, const char* fkt)
1596{
1597 BOOL status = FALSE;
1598 SSIZE_T rc = 0;
1599
1600 WINPR_ASSERT(channel);
1601 WINPR_ASSERT(channel->rpc);
1602 WINPR_ASSERT(s);
1603
1604 Stream_SealLength(s);
1605
1606 const DWORD level = WLOG_TRACE;
1607 if (WLog_IsLevelActive(channel->rpc->log, level))
1608 {
1609 WLog_PrintTextMessage(channel->rpc->log, level, line, file, fkt,
1610 "Sending [%s] %" PRIuz " bytes", fkt, Stream_Length(s));
1611 }
1612 if (Stream_Length(s) < sizeof(rpcconn_common_hdr_t))
1613 goto fail;
1614 if (Stream_Length(s) != frag_length)
1615 goto fail;
1616
1617 rc = rpc_channel_write(channel, Stream_Buffer(s), Stream_Length(s));
1618 if (rc < 0)
1619 goto fail;
1620 if ((size_t)rc != Stream_Length(s))
1621 goto fail;
1622 status = TRUE;
1623fail:
1624 return status;
1625}
1626
1627/* CONN/A Sequence */
1628
1629BOOL rts_send_CONN_A1_pdu(rdpRpc* rpc)
1630{
1631 BOOL status = FALSE;
1632 wStream* buffer = nullptr;
1633 rpcconn_rts_hdr_t header = rts_pdu_header_init();
1634 UINT32 ReceiveWindowSize = 0;
1635 BYTE* OUTChannelCookie = nullptr;
1636 BYTE* VirtualConnectionCookie = nullptr;
1637 RpcVirtualConnection* connection = nullptr;
1638 RpcOutChannel* outChannel = nullptr;
1639
1640 WINPR_ASSERT(rpc);
1641
1642 connection = rpc->VirtualConnection;
1643 WINPR_ASSERT(connection);
1644
1645 outChannel = connection->DefaultOutChannel;
1646 WINPR_ASSERT(outChannel);
1647
1648 header.header.frag_length = 76;
1649 header.Flags = RTS_FLAG_NONE;
1650 header.NumberOfCommands = 4;
1651
1652 WLog_DBG(TAG, "Sending CONN/A1 RTS PDU");
1653 VirtualConnectionCookie = (BYTE*)&(connection->Cookie);
1654 OUTChannelCookie = (BYTE*)&(outChannel->common.Cookie);
1655 ReceiveWindowSize = outChannel->ReceiveWindow;
1656
1657 buffer = Stream_New(nullptr, header.header.frag_length);
1658
1659 if (!buffer)
1660 return -1;
1661
1662 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
1663 goto fail;
1664 status = rts_version_command_write(buffer); /* Version (8 bytes) */
1665 if (!status)
1666 goto fail;
1667 status = rts_cookie_command_write(
1668 buffer, VirtualConnectionCookie); /* VirtualConnectionCookie (20 bytes) */
1669 if (!status)
1670 goto fail;
1671 status = rts_cookie_command_write(buffer, OUTChannelCookie); /* OUTChannelCookie (20 bytes) */
1672 if (!status)
1673 goto fail;
1674 status = rts_receive_window_size_command_write(
1675 buffer, ReceiveWindowSize); /* ReceiveWindowSize (8 bytes) */
1676 if (!status)
1677 goto fail;
1678 status = rts_send_buffer(&outChannel->common, buffer, header.header.frag_length);
1679fail:
1680 Stream_Free(buffer, TRUE);
1681 return status;
1682}
1683
1684BOOL rts_recv_CONN_A3_pdu(rdpRpc* rpc, wStream* buffer)
1685{
1686 BOOL rc = FALSE;
1687 UINT32 ConnectionTimeout = 0;
1688
1689 rpcconn_hdr_t header = WINPR_C_ARRAY_INIT;
1690 if (!rts_read_pdu_header(buffer, &header))
1691 goto fail;
1692
1693 if (header.rts.Flags != RTS_FLAG_NONE)
1694 {
1695 WLog_Print(rpc->log, WLOG_ERROR,
1696 "[MS-RPCH] 2.2.4.4 CONN/A3 RTS PDU unexpected Flags=0x%08" PRIx32
1697 ", expected 0x%08" PRIx32,
1698 header.rts.Flags, WINPR_CXX_COMPAT_CAST(UINT32, RTS_FLAG_NONE));
1699 goto fail;
1700 }
1701 if (header.rts.NumberOfCommands != 1)
1702 {
1703 WLog_Print(rpc->log, WLOG_ERROR,
1704 "[MS-RPCH] 2.2.4.4 CONN/A3 RTS PDU unexpected NumberOfCommands=%" PRIu32
1705 ", expected 1",
1706 header.rts.NumberOfCommands);
1707 goto fail;
1708 }
1709
1710 if (!rts_connection_timeout_command_read(rpc, buffer, &ConnectionTimeout))
1711 goto fail;
1712
1713 WLog_Print(rpc->log, WLOG_DEBUG, "Receiving CONN/A3 RTS PDU: ConnectionTimeout: %" PRIu32 "",
1714 ConnectionTimeout);
1715
1716 WINPR_ASSERT(rpc);
1717 WINPR_ASSERT(rpc->VirtualConnection);
1718 WINPR_ASSERT(rpc->VirtualConnection->DefaultInChannel);
1719
1720 rpc->VirtualConnection->DefaultInChannel->PingOriginator.ConnectionTimeout = ConnectionTimeout;
1721
1722 rc = TRUE;
1723
1724fail:
1725 rts_free_pdu_header(&header, FALSE);
1726 return rc;
1727}
1728
1729/* CONN/B Sequence */
1730
1731BOOL rts_send_CONN_B1_pdu(rdpRpc* rpc)
1732{
1733 BOOL status = FALSE;
1734 wStream* buffer = nullptr;
1735 rpcconn_rts_hdr_t header = rts_pdu_header_init();
1736 BYTE* INChannelCookie = nullptr;
1737 BYTE* AssociationGroupId = nullptr;
1738 BYTE* VirtualConnectionCookie = nullptr;
1739 RpcVirtualConnection* connection = nullptr;
1740 RpcInChannel* inChannel = nullptr;
1741
1742 WINPR_ASSERT(rpc);
1743
1744 connection = rpc->VirtualConnection;
1745 WINPR_ASSERT(connection);
1746
1747 inChannel = connection->DefaultInChannel;
1748 WINPR_ASSERT(inChannel);
1749
1750 header.header.frag_length = 104;
1751 header.Flags = RTS_FLAG_NONE;
1752 header.NumberOfCommands = 6;
1753
1754 WLog_DBG(TAG, "Sending CONN/B1 RTS PDU");
1755
1756 VirtualConnectionCookie = (BYTE*)&(connection->Cookie);
1757 INChannelCookie = (BYTE*)&(inChannel->common.Cookie);
1758 AssociationGroupId = (BYTE*)&(connection->AssociationGroupId);
1759 buffer = Stream_New(nullptr, header.header.frag_length);
1760
1761 if (!buffer)
1762 goto fail;
1763 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
1764 goto fail;
1765 if (!rts_version_command_write(buffer)) /* Version (8 bytes) */
1766 goto fail;
1767 if (!rts_cookie_command_write(buffer,
1768 VirtualConnectionCookie)) /* VirtualConnectionCookie (20 bytes) */
1769 goto fail;
1770 if (!rts_cookie_command_write(buffer, INChannelCookie)) /* INChannelCookie (20 bytes) */
1771 goto fail;
1772 if (!rts_channel_lifetime_command_write(buffer,
1773 rpc->ChannelLifetime)) /* ChannelLifetime (8 bytes) */
1774 goto fail;
1775 if (!rts_client_keepalive_command_write(buffer,
1776 rpc->KeepAliveInterval)) /* ClientKeepalive (8 bytes) */
1777 goto fail;
1778 if (!rts_association_group_id_command_write(
1779 buffer, AssociationGroupId)) /* AssociationGroupId (20 bytes) */
1780 goto fail;
1781 status = rts_send_buffer(&inChannel->common, buffer, header.header.frag_length);
1782fail:
1783 Stream_Free(buffer, TRUE);
1784 return status;
1785}
1786
1787/* [MS-RPCH] 2.2.4.9 CONN/C2 RTS PDU */
1788
1789BOOL rts_recv_CONN_C2_pdu(rdpRpc* rpc, wStream* buffer)
1790{
1791 BOOL rc = FALSE;
1792 UINT32 ReceiveWindowSize = 0;
1793 UINT32 ConnectionTimeout = 0;
1794
1795 WINPR_ASSERT(rpc);
1796 WINPR_ASSERT(buffer);
1797
1798 rpcconn_hdr_t header = WINPR_C_ARRAY_INIT;
1799 if (!rts_read_pdu_header(buffer, &header))
1800 goto fail;
1801
1802 if (header.rts.Flags != RTS_FLAG_NONE)
1803 {
1804 WLog_Print(rpc->log, WLOG_ERROR,
1805 "[MS-RPCH] 2.2.4.9 CONN/C2 RTS PDU unexpected Flags=0x%08" PRIx32
1806 ", expected 0x%08" PRIx32,
1807 header.rts.Flags, WINPR_CXX_COMPAT_CAST(UINT32, RTS_FLAG_NONE));
1808 goto fail;
1809 }
1810 if (header.rts.NumberOfCommands != 3)
1811 {
1812 WLog_Print(rpc->log, WLOG_ERROR,
1813 "[MS-RPCH] 2.2.4.9 CONN/C2 RTS PDU unexpected NumberOfCommands=%" PRIu32
1814 ", expected 3",
1815 header.rts.NumberOfCommands);
1816 goto fail;
1817 }
1818 if (!rts_version_command_read(rpc, buffer, nullptr))
1819 goto fail;
1820
1821 if (!rts_receive_window_size_command_read(rpc, buffer, &ReceiveWindowSize))
1822 goto fail;
1823
1824 if (!rts_connection_timeout_command_read(rpc, buffer, &ConnectionTimeout))
1825 goto fail;
1826
1827 WLog_Print(rpc->log, WLOG_DEBUG,
1828 "Receiving CONN/C2 RTS PDU: ConnectionTimeout: %" PRIu32
1829 " ReceiveWindowSize: %" PRIu32 "",
1830 ConnectionTimeout, ReceiveWindowSize);
1831
1832 WINPR_ASSERT(rpc);
1833 WINPR_ASSERT(rpc->VirtualConnection);
1834 WINPR_ASSERT(rpc->VirtualConnection->DefaultInChannel);
1835
1836 rpc->VirtualConnection->DefaultInChannel->PingOriginator.ConnectionTimeout = ConnectionTimeout;
1837 rpc->VirtualConnection->DefaultInChannel->PeerReceiveWindow = ReceiveWindowSize;
1838
1839 rc = TRUE;
1840
1841fail:
1842 rts_free_pdu_header(&header, FALSE);
1843 return rc;
1844}
1845
1846/* Out-of-Sequence PDUs */
1847
1848BOOL rts_send_flow_control_ack_pdu(rdpRpc* rpc)
1849{
1850 BOOL status = FALSE;
1851 wStream* buffer = nullptr;
1852 rpcconn_rts_hdr_t header = rts_pdu_header_init();
1853 UINT32 BytesReceived = 0;
1854 UINT32 AvailableWindow = 0;
1855 BYTE* ChannelCookie = nullptr;
1856 RpcVirtualConnection* connection = nullptr;
1857 RpcInChannel* inChannel = nullptr;
1858 RpcOutChannel* outChannel = nullptr;
1859
1860 WINPR_ASSERT(rpc);
1861
1862 connection = rpc->VirtualConnection;
1863 WINPR_ASSERT(connection);
1864
1865 inChannel = connection->DefaultInChannel;
1866 WINPR_ASSERT(inChannel);
1867
1868 outChannel = connection->DefaultOutChannel;
1869 WINPR_ASSERT(outChannel);
1870
1871 header.header.frag_length = 56;
1872 header.Flags = RTS_FLAG_OTHER_CMD;
1873 header.NumberOfCommands = 2;
1874
1875 WLog_DBG(TAG, "Sending FlowControlAck RTS PDU");
1876
1877 BytesReceived = outChannel->BytesReceived;
1878 AvailableWindow = outChannel->AvailableWindowAdvertised;
1879 ChannelCookie = (BYTE*)&(outChannel->common.Cookie);
1880 outChannel->ReceiverAvailableWindow = outChannel->AvailableWindowAdvertised;
1881 buffer = Stream_New(nullptr, header.header.frag_length);
1882
1883 if (!buffer)
1884 goto fail;
1885
1886 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
1887 goto fail;
1888 if (!rts_destination_command_write(buffer, FDOutProxy)) /* Destination Command (8 bytes) */
1889 goto fail;
1890
1891 /* FlowControlAck Command (28 bytes) */
1892 if (!rts_flow_control_ack_command_write(buffer, BytesReceived, AvailableWindow, ChannelCookie))
1893 goto fail;
1894
1895 status = rts_send_buffer(&inChannel->common, buffer, header.header.frag_length);
1896fail:
1897 Stream_Free(buffer, TRUE);
1898 return status;
1899}
1900
1901static int rts_recv_flow_control_ack_pdu(rdpRpc* rpc, wStream* buffer)
1902{
1903 int rc = 0;
1904 UINT32 BytesReceived = 0;
1905 UINT32 AvailableWindow = 0;
1906 BYTE ChannelCookie[16] = WINPR_C_ARRAY_INIT;
1907
1908 rc = rts_flow_control_ack_command_read(rpc, buffer, &BytesReceived, &AvailableWindow,
1909 (BYTE*)&ChannelCookie);
1910 if (rc < 0)
1911 return rc;
1912 WLog_ERR(TAG,
1913 "Receiving FlowControlAck RTS PDU: BytesReceived: %" PRIu32
1914 " AvailableWindow: %" PRIu32 "",
1915 BytesReceived, AvailableWindow);
1916
1917 WINPR_ASSERT(rpc->VirtualConnection);
1918 WINPR_ASSERT(rpc->VirtualConnection->DefaultInChannel);
1919
1920 rpc->VirtualConnection->DefaultInChannel->SenderAvailableWindow =
1921 AvailableWindow - (rpc->VirtualConnection->DefaultInChannel->BytesSent - BytesReceived);
1922 return 1;
1923}
1924
1925static int rts_recv_flow_control_ack_with_destination_pdu(rdpRpc* rpc, wStream* buffer)
1926{
1927 UINT32 Command = 0;
1928 UINT32 Destination = 0;
1929 UINT32 BytesReceived = 0;
1930 UINT32 AvailableWindow = 0;
1931 BYTE ChannelCookie[16] = WINPR_C_ARRAY_INIT;
1949 int rc = rts_destination_command_read(rpc, buffer, &Command);
1950 if (rc < 0)
1951 return rc;
1952
1953 if (Command != RTS_CMD_DESTINATION)
1954 {
1955 char buffer1[64] = WINPR_C_ARRAY_INIT;
1956 char buffer2[64] = WINPR_C_ARRAY_INIT;
1957 WLog_Print(rpc->log, WLOG_ERROR, "got command %s, expected %s",
1958 rts_command_to_string(Command, buffer1, sizeof(buffer1)),
1959 rts_command_to_string(RTS_CMD_DESTINATION, buffer2, sizeof(buffer2)));
1960 return -1;
1961 }
1962
1963 rc = rts_destination_command_read(rpc, buffer, &Destination);
1964 if (rc < 0)
1965 return rc;
1966
1967 switch (Destination)
1968 {
1969 case FDClient:
1970 break;
1971 case FDInProxy:
1972 break;
1973 case FDServer:
1974 break;
1975 case FDOutProxy:
1976 break;
1977 default:
1978 WLog_Print(rpc->log, WLOG_ERROR,
1979 "got destination %" PRIu32
1980 ", expected one of [FDClient[0]|FDInProxy[1]|FDServer[2]|FDOutProxy[3]",
1981 Destination);
1982 return -1;
1983 }
1984
1985 rc = rts_flow_control_ack_command_read(rpc, buffer, &BytesReceived, &AvailableWindow,
1986 ChannelCookie);
1987 if (rc < 0)
1988 return rc;
1989
1990 WLog_DBG(TAG,
1991 "Receiving FlowControlAckWithDestination RTS PDU: BytesReceived: %" PRIu32
1992 " AvailableWindow: %" PRIu32 "",
1993 BytesReceived, AvailableWindow);
1994
1995 WINPR_ASSERT(rpc->VirtualConnection);
1996 WINPR_ASSERT(rpc->VirtualConnection->DefaultInChannel);
1997 rpc->VirtualConnection->DefaultInChannel->SenderAvailableWindow =
1998 AvailableWindow - (rpc->VirtualConnection->DefaultInChannel->BytesSent - BytesReceived);
1999 return 1;
2000}
2001
2002BOOL rts_recv_ping_pdu(rdpRpc* rpc, wStream* s)
2003{
2004 BOOL rc = FALSE;
2005 rpcconn_hdr_t header = WINPR_C_ARRAY_INIT;
2006
2007 WINPR_ASSERT(rpc);
2008 WINPR_ASSERT(rpc->auth);
2009 WINPR_ASSERT(s);
2010
2011 if (!rts_read_pdu_header(s, &header))
2012 goto fail;
2013
2014 rc = TRUE;
2015 if (header.common.ptype != PTYPE_RTS)
2016 {
2017 WLog_Print(rpc->log, WLOG_ERROR, "received invalid ping PDU, type is 0x%" PRIx32,
2018 header.common.ptype);
2019 rc = FALSE;
2020 }
2021 if (header.rts.Flags != RTS_FLAG_PING)
2022 {
2023 WLog_Print(rpc->log, WLOG_ERROR, "received unexpected ping PDU::Flags 0x%" PRIx32,
2024 header.rts.Flags);
2025 rc = FALSE;
2026 }
2027fail:
2028 rts_free_pdu_header(&header, FALSE);
2029 return rc;
2030}
2031
2032static int rts_send_ping_pdu(rdpRpc* rpc)
2033{
2034 BOOL status = FALSE;
2035 wStream* buffer = nullptr;
2036 rpcconn_rts_hdr_t header = rts_pdu_header_init();
2037 RpcInChannel* inChannel = nullptr;
2038
2039 WINPR_ASSERT(rpc);
2040 WINPR_ASSERT(rpc->VirtualConnection);
2041
2042 inChannel = rpc->VirtualConnection->DefaultInChannel;
2043 WINPR_ASSERT(inChannel);
2044
2045 header.header.frag_length = 20;
2046 header.Flags = RTS_FLAG_PING;
2047 header.NumberOfCommands = 0;
2048
2049 WLog_DBG(TAG, "Sending Ping RTS PDU");
2050 buffer = Stream_New(nullptr, header.header.frag_length);
2051
2052 if (!buffer)
2053 goto fail;
2054
2055 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
2056 goto fail;
2057 status = rts_send_buffer(&inChannel->common, buffer, header.header.frag_length);
2058fail:
2059 Stream_Free(buffer, TRUE);
2060 return (status) ? 1 : -1;
2061}
2062
2063BOOL rts_command_length(UINT32 CommandType, wStream* s, size_t* length, BOOL silent)
2064{
2065 size_t padding = 0;
2066 size_t CommandLength = 0;
2067
2068 WINPR_ASSERT(s);
2069
2070 switch (CommandType)
2071 {
2072 case RTS_CMD_RECEIVE_WINDOW_SIZE:
2073 CommandLength = RTS_CMD_RECEIVE_WINDOW_SIZE_LENGTH;
2074 break;
2075
2076 case RTS_CMD_FLOW_CONTROL_ACK:
2077 CommandLength = RTS_CMD_FLOW_CONTROL_ACK_LENGTH;
2078 break;
2079
2080 case RTS_CMD_CONNECTION_TIMEOUT:
2081 CommandLength = RTS_CMD_CONNECTION_TIMEOUT_LENGTH;
2082 break;
2083
2084 case RTS_CMD_COOKIE:
2085 CommandLength = RTS_CMD_COOKIE_LENGTH;
2086 break;
2087
2088 case RTS_CMD_CHANNEL_LIFETIME:
2089 CommandLength = RTS_CMD_CHANNEL_LIFETIME_LENGTH;
2090 break;
2091
2092 case RTS_CMD_CLIENT_KEEPALIVE:
2093 CommandLength = RTS_CMD_CLIENT_KEEPALIVE_LENGTH;
2094 break;
2095
2096 case RTS_CMD_VERSION:
2097 CommandLength = RTS_CMD_VERSION_LENGTH;
2098 break;
2099
2100 case RTS_CMD_EMPTY:
2101 CommandLength = RTS_CMD_EMPTY_LENGTH;
2102 break;
2103
2104 case RTS_CMD_PADDING: /* variable-size */
2105 if (!rts_padding_command_read(s, &padding, silent))
2106 return FALSE;
2107 break;
2108
2109 case RTS_CMD_NEGATIVE_ANCE:
2110 CommandLength = RTS_CMD_NEGATIVE_ANCE_LENGTH;
2111 break;
2112
2113 case RTS_CMD_ANCE:
2114 CommandLength = RTS_CMD_ANCE_LENGTH;
2115 break;
2116
2117 case RTS_CMD_CLIENT_ADDRESS: /* variable-size */
2118 if (!rts_client_address_command_read(s, &CommandLength, silent))
2119 return FALSE;
2120 break;
2121
2122 case RTS_CMD_ASSOCIATION_GROUP_ID:
2123 CommandLength = RTS_CMD_ASSOCIATION_GROUP_ID_LENGTH;
2124 break;
2125
2126 case RTS_CMD_DESTINATION:
2127 CommandLength = RTS_CMD_DESTINATION_LENGTH;
2128 break;
2129
2130 case RTS_CMD_PING_TRAFFIC_SENT_NOTIFY:
2131 CommandLength = RTS_CMD_PING_TRAFFIC_SENT_NOTIFY_LENGTH;
2132 break;
2133
2134 default:
2135 WLog_ERR(TAG, "Error: Unknown RTS Command Type: 0x%" PRIx32 "", CommandType);
2136 return FALSE;
2137 }
2138
2139 CommandLength += padding;
2140 if (!Stream_ConditionalCheckAndLogRequiredLength(TAG, s, CommandLength, silent))
2141 return FALSE;
2142
2143 if (length)
2144 *length = CommandLength;
2145 return TRUE;
2146}
2147
2148static int rts_send_OUT_R2_A7_pdu(rdpRpc* rpc)
2149{
2150 BOOL status = FALSE;
2151 wStream* buffer = nullptr;
2152 rpcconn_rts_hdr_t header = rts_pdu_header_init();
2153 BYTE* SuccessorChannelCookie = nullptr;
2154 RpcInChannel* inChannel = nullptr;
2155 RpcOutChannel* nextOutChannel = nullptr;
2156
2157 WINPR_ASSERT(rpc);
2158 WINPR_ASSERT(rpc->VirtualConnection);
2159
2160 inChannel = rpc->VirtualConnection->DefaultInChannel;
2161 WINPR_ASSERT(inChannel);
2162
2163 nextOutChannel = rpc->VirtualConnection->NonDefaultOutChannel;
2164 WINPR_ASSERT(nextOutChannel);
2165
2166 header.header.frag_length = 56;
2167 header.Flags = RTS_FLAG_OUT_CHANNEL;
2168 header.NumberOfCommands = 3;
2169
2170 WLog_DBG(TAG, "Sending OUT_R2/A7 RTS PDU");
2171
2172 SuccessorChannelCookie = (BYTE*)&(nextOutChannel->common.Cookie);
2173 buffer = Stream_New(nullptr, header.header.frag_length);
2174
2175 if (!buffer)
2176 return -1;
2177
2178 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
2179 goto fail;
2180 if (!rts_destination_command_write(buffer, FDServer)) /* Destination (8 bytes)*/
2181 goto fail;
2182 if (!rts_cookie_command_write(buffer,
2183 SuccessorChannelCookie)) /* SuccessorChannelCookie (20 bytes) */
2184 goto fail;
2185 if (!rts_version_command_write(buffer)) /* Version (8 bytes) */
2186 goto fail;
2187 status = rts_send_buffer(&inChannel->common, buffer, header.header.frag_length);
2188fail:
2189 Stream_Free(buffer, TRUE);
2190 return (status) ? 1 : -1;
2191}
2192
2193static int rts_send_OUT_R2_C1_pdu(rdpRpc* rpc)
2194{
2195 BOOL status = FALSE;
2196 wStream* buffer = nullptr;
2197 rpcconn_rts_hdr_t header = rts_pdu_header_init();
2198 RpcOutChannel* nextOutChannel = nullptr;
2199
2200 WINPR_ASSERT(rpc);
2201 WINPR_ASSERT(rpc->VirtualConnection);
2202
2203 nextOutChannel = rpc->VirtualConnection->NonDefaultOutChannel;
2204 WINPR_ASSERT(nextOutChannel);
2205
2206 header.header.frag_length = 24;
2207 header.Flags = RTS_FLAG_PING;
2208 header.NumberOfCommands = 1;
2209
2210 WLog_DBG(TAG, "Sending OUT_R2/C1 RTS PDU");
2211 buffer = Stream_New(nullptr, header.header.frag_length);
2212
2213 if (!buffer)
2214 return -1;
2215
2216 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
2217 goto fail;
2218
2219 if (!rts_empty_command_write(buffer)) /* Empty command (4 bytes) */
2220 goto fail;
2221 status = rts_send_buffer(&nextOutChannel->common, buffer, header.header.frag_length);
2222fail:
2223 Stream_Free(buffer, TRUE);
2224 return (status) ? 1 : -1;
2225}
2226
2227BOOL rts_send_OUT_R1_A3_pdu(rdpRpc* rpc)
2228{
2229 BOOL status = FALSE;
2230 wStream* buffer = nullptr;
2231 rpcconn_rts_hdr_t header = rts_pdu_header_init();
2232 UINT32 ReceiveWindowSize = 0;
2233 BYTE* VirtualConnectionCookie = nullptr;
2234 BYTE* PredecessorChannelCookie = nullptr;
2235 BYTE* SuccessorChannelCookie = nullptr;
2236 RpcVirtualConnection* connection = nullptr;
2237 RpcOutChannel* outChannel = nullptr;
2238 RpcOutChannel* nextOutChannel = nullptr;
2239
2240 WINPR_ASSERT(rpc);
2241
2242 connection = rpc->VirtualConnection;
2243 WINPR_ASSERT(connection);
2244
2245 outChannel = connection->DefaultOutChannel;
2246 WINPR_ASSERT(outChannel);
2247
2248 nextOutChannel = connection->NonDefaultOutChannel;
2249 WINPR_ASSERT(nextOutChannel);
2250
2251 header.header.frag_length = 96;
2252 header.Flags = RTS_FLAG_RECYCLE_CHANNEL;
2253 header.NumberOfCommands = 5;
2254
2255 WLog_DBG(TAG, "Sending OUT_R1/A3 RTS PDU");
2256
2257 VirtualConnectionCookie = (BYTE*)&(connection->Cookie);
2258 PredecessorChannelCookie = (BYTE*)&(outChannel->common.Cookie);
2259 SuccessorChannelCookie = (BYTE*)&(nextOutChannel->common.Cookie);
2260 ReceiveWindowSize = outChannel->ReceiveWindow;
2261 buffer = Stream_New(nullptr, header.header.frag_length);
2262
2263 if (!buffer)
2264 return -1;
2265
2266 if (!rts_write_pdu_header(buffer, &header)) /* RTS Header (20 bytes) */
2267 goto fail;
2268 if (!rts_version_command_write(buffer)) /* Version (8 bytes) */
2269 goto fail;
2270 if (!rts_cookie_command_write(buffer,
2271 VirtualConnectionCookie)) /* VirtualConnectionCookie (20 bytes) */
2272 goto fail;
2273 if (!rts_cookie_command_write(
2274 buffer, PredecessorChannelCookie)) /* PredecessorChannelCookie (20 bytes) */
2275 goto fail;
2276 if (!rts_cookie_command_write(buffer,
2277 SuccessorChannelCookie)) /* SuccessorChannelCookie (20 bytes) */
2278 goto fail;
2279 if (!rts_receive_window_size_command_write(buffer,
2280 ReceiveWindowSize)) /* ReceiveWindowSize (8 bytes) */
2281 goto fail;
2282
2283 status = rts_send_buffer(&nextOutChannel->common, buffer, header.header.frag_length);
2284fail:
2285 Stream_Free(buffer, TRUE);
2286 return status;
2287}
2288
2289static int rts_recv_OUT_R1_A2_pdu(rdpRpc* rpc, wStream* buffer)
2290{
2291 int status = 0;
2292 UINT32 Destination = 0;
2293 WINPR_ASSERT(rpc);
2294 WINPR_ASSERT(buffer);
2295
2296 RpcVirtualConnection* connection = rpc->VirtualConnection;
2297 WINPR_ASSERT(connection);
2298
2299 WLog_DBG(TAG, "Receiving OUT R1/A2 RTS PDU");
2300
2301 status = rts_destination_command_read(rpc, buffer, &Destination);
2302 if (status < 0)
2303 return status;
2304
2305 connection->NonDefaultOutChannel = rpc_out_channel_new(rpc, &connection->Cookie);
2306
2307 if (!connection->NonDefaultOutChannel)
2308 return -1;
2309
2310 status = rpc_out_channel_replacement_connect(connection->NonDefaultOutChannel, 5000);
2311
2312 if (status < 0)
2313 {
2314 WLog_ERR(TAG, "rpc_out_channel_replacement_connect failure");
2315 return -1;
2316 }
2317
2318 rpc_out_channel_transition_to_state(connection->DefaultOutChannel,
2319 CLIENT_OUT_CHANNEL_STATE_OPENED_A6W);
2320 return 1;
2321}
2322
2323static int rts_recv_OUT_R2_A6_pdu(rdpRpc* rpc, WINPR_ATTR_UNUSED wStream* buffer)
2324{
2325 int status = 0;
2326 RpcVirtualConnection* connection = nullptr;
2327
2328 WINPR_ASSERT(rpc);
2329 WINPR_ASSERT(buffer);
2330
2331 connection = rpc->VirtualConnection;
2332 WINPR_ASSERT(connection);
2333
2334 WLog_DBG(TAG, "Receiving OUT R2/A6 RTS PDU");
2335 status = rts_send_OUT_R2_C1_pdu(rpc);
2336
2337 if (status < 0)
2338 {
2339 WLog_ERR(TAG, "rts_send_OUT_R2_C1_pdu failure");
2340 return -1;
2341 }
2342
2343 status = rts_send_OUT_R2_A7_pdu(rpc);
2344
2345 if (status < 0)
2346 {
2347 WLog_ERR(TAG, "rts_send_OUT_R2_A7_pdu failure");
2348 return -1;
2349 }
2350
2351 rpc_out_channel_transition_to_state(connection->NonDefaultOutChannel,
2352 CLIENT_OUT_CHANNEL_STATE_OPENED_B3W);
2353 rpc_out_channel_transition_to_state(connection->DefaultOutChannel,
2354 CLIENT_OUT_CHANNEL_STATE_OPENED_B3W);
2355 return 1;
2356}
2357
2358static int rts_recv_OUT_R2_B3_pdu(rdpRpc* rpc, WINPR_ATTR_UNUSED wStream* buffer)
2359{
2360 RpcVirtualConnection* connection = nullptr;
2361
2362 WINPR_ASSERT(rpc);
2363 WINPR_ASSERT(buffer);
2364
2365 connection = rpc->VirtualConnection;
2366 WINPR_ASSERT(connection);
2367
2368 WLog_DBG(TAG, "Receiving OUT R2/B3 RTS PDU");
2369 rpc_out_channel_transition_to_state(connection->DefaultOutChannel,
2370 CLIENT_OUT_CHANNEL_STATE_RECYCLED);
2371 return 1;
2372}
2373
2374BOOL rts_recv_out_of_sequence_pdu(rdpRpc* rpc, wStream* buffer, const rpcconn_hdr_t* header)
2375{
2376 BOOL status = FALSE;
2377 size_t length = 0;
2378 RtsPduSignature signature = WINPR_C_ARRAY_INIT;
2379 RpcVirtualConnection* connection = nullptr;
2380
2381 WINPR_ASSERT(rpc);
2382 WINPR_ASSERT(buffer);
2383 WINPR_ASSERT(header);
2384
2385 wLog* log = WLog_Get(TAG);
2386
2387 const size_t total = Stream_Length(buffer);
2388 length = header->common.frag_length;
2389 if (total < length)
2390 {
2391 WLog_Print(log, WLOG_ERROR, "PDU length %" PRIuz " does not match available data %" PRIuz,
2392 length, total);
2393 return FALSE;
2394 }
2395
2396 connection = rpc->VirtualConnection;
2397
2398 if (!connection)
2399 {
2400 WLog_Print(log, WLOG_ERROR, "not connected, aborting");
2401 return FALSE;
2402 }
2403
2404 if (!rts_extract_pdu_signature(&signature, buffer, header))
2405 return FALSE;
2406
2407 rts_print_pdu_signature(log, WLOG_TRACE, &signature);
2408
2409 if (memcmp(&signature, &RTS_PDU_FLOW_CONTROL_ACK_SIGNATURE, sizeof(signature)) == 0)
2410 {
2411 status = rts_recv_flow_control_ack_pdu(rpc, buffer);
2412 }
2413 else if (memcmp(&signature, &RTS_PDU_FLOW_CONTROL_ACK_WITH_DESTINATION_SIGNATURE,
2414 sizeof(signature)) == 0)
2415 {
2416 status = rts_recv_flow_control_ack_with_destination_pdu(rpc, buffer);
2417 }
2418 else if (memcmp(&signature, &RTS_PDU_PING_SIGNATURE, sizeof(signature)) == 0)
2419 {
2420 status = rts_send_ping_pdu(rpc);
2421 }
2422 else
2423 {
2424 if (connection->DefaultOutChannel->State == CLIENT_OUT_CHANNEL_STATE_OPENED)
2425 {
2426 if (memcmp(&signature, &RTS_PDU_OUT_R1_A2_SIGNATURE, sizeof(signature)) == 0)
2427 {
2428 status = rts_recv_OUT_R1_A2_pdu(rpc, buffer);
2429 }
2430 }
2431 else if (connection->DefaultOutChannel->State == CLIENT_OUT_CHANNEL_STATE_OPENED_A6W)
2432 {
2433 if (memcmp(&signature, &RTS_PDU_OUT_R2_A6_SIGNATURE, sizeof(signature)) == 0)
2434 {
2435 status = rts_recv_OUT_R2_A6_pdu(rpc, buffer);
2436 }
2437 }
2438 else if (connection->DefaultOutChannel->State == CLIENT_OUT_CHANNEL_STATE_OPENED_B3W)
2439 {
2440 if (memcmp(&signature, &RTS_PDU_OUT_R2_B3_SIGNATURE, sizeof(signature)) == 0)
2441 {
2442 status = rts_recv_OUT_R2_B3_pdu(rpc, buffer);
2443 }
2444 }
2445 }
2446
2447 if (!status)
2448 {
2449 const UINT32 SignatureId = rts_identify_pdu_signature(&signature, nullptr);
2450 WLog_Print(log, WLOG_ERROR, "error parsing RTS PDU with signature id: 0x%08" PRIX32 "",
2451 SignatureId);
2452 rts_print_pdu_signature(log, WLOG_ERROR, &signature);
2453 }
2454
2455 const size_t rem = Stream_GetRemainingLength(buffer);
2456 if (rem > 0)
2457 {
2458 WLog_Print(log, WLOG_ERROR, "%" PRIuz " bytes or %" PRIuz " total not parsed, aborting",
2459 rem, total);
2460 rts_print_pdu_signature(log, WLOG_ERROR, &signature);
2461 return FALSE;
2462 }
2463
2464 return status;
2465}
2466
2467BOOL rts_write_pdu_auth3(wStream* s, const rpcconn_rpc_auth_3_hdr_t* auth)
2468{
2469 WINPR_ASSERT(s);
2470 WINPR_ASSERT(auth);
2471
2472 if (!rts_write_common_pdu_header(s, &auth->header))
2473 return FALSE;
2474
2475 if (!Stream_EnsureRemainingCapacity(s, 2 * sizeof(UINT16)))
2476 return FALSE;
2477
2478 Stream_Write_UINT16(s, auth->max_xmit_frag);
2479 Stream_Write_UINT16(s, auth->max_recv_frag);
2480
2481 return rts_write_auth_verifier(s, &auth->auth_verifier, &auth->header);
2482}
2483
2484BOOL rts_write_pdu_bind(wStream* s, const rpcconn_bind_hdr_t* bind)
2485{
2486
2487 WINPR_ASSERT(s);
2488 WINPR_ASSERT(bind);
2489
2490 if (!rts_write_common_pdu_header(s, &bind->header))
2491 return FALSE;
2492
2493 if (!Stream_EnsureRemainingCapacity(s, 8))
2494 return FALSE;
2495
2496 Stream_Write_UINT16(s, bind->max_xmit_frag);
2497 Stream_Write_UINT16(s, bind->max_recv_frag);
2498 Stream_Write_UINT32(s, bind->assoc_group_id);
2499
2500 if (!rts_write_context_list(s, &bind->p_context_elem))
2501 return FALSE;
2502
2503 return rts_write_auth_verifier(s, &bind->auth_verifier, &bind->header);
2504}
2505
2506BOOL rts_conditional_check_and_log(const char* tag, wStream* s, size_t size, BOOL silent,
2507 const char* fkt, const char* file, size_t line)
2508{
2509 if (silent)
2510 {
2511 const size_t rem = Stream_GetRemainingLength(s);
2512 return (rem >= size);
2513 }
2514
2515 return Stream_CheckAndLogRequiredLengthEx(tag, WLOG_WARN, s, size, 1, "%s(%s:%" PRIuz ")", fkt,
2516 file, line);
2517}
2518
2519BOOL rts_conditional_safe_seek(wStream* s, size_t size, BOOL silent, const char* fkt,
2520 const char* file, size_t line)
2521{
2522 if (silent)
2523 {
2524 const size_t rem = Stream_GetRemainingLength(s);
2525 if (rem < size)
2526 return FALSE;
2527 }
2528 return Stream_SafeSeekEx(s, size, file, line, fkt);
2529}