FreeRDP
Loading...
Searching...
No Matches
tsg.c
1
23#include <freerdp/config.h>
24
25#include "../settings.h"
26
27#include <winpr/assert.h>
28#include <winpr/crt.h>
29#include <winpr/error.h>
30#include <winpr/print.h>
31#include <winpr/stream.h>
32
33#include <freerdp/log.h>
34
35#include "rpc_bind.h"
36#include "rpc_client.h"
37#include "tsg.h"
38#include "../utils.h"
39#include "../../crypto/opensslcompat.h"
40
41#define TSG_TAG FREERDP_TAG("core.gateway.tsg")
42
43#define TSG_CAPABILITY_TYPE_NAP 0x00000001
44
45#define TSG_PACKET_TYPE_HEADER 0x00004844
46#define TSG_PACKET_TYPE_VERSIONCAPS 0x00005643
47#define TSG_PACKET_TYPE_QUARCONFIGREQUEST 0x00005143
48#define TSG_PACKET_TYPE_QUARREQUEST 0x00005152
49#define TSG_PACKET_TYPE_RESPONSE 0x00005052
50#define TSG_PACKET_TYPE_QUARENC_RESPONSE 0x00004552
51#define TSG_PACKET_TYPE_CAPS_RESPONSE 0x00004350
52#define TSG_PACKET_TYPE_MSGREQUEST_PACKET 0x00004752
53#define TSG_PACKET_TYPE_MESSAGE_PACKET 0x00004750
54#define TSG_PACKET_TYPE_AUTH 0x00004054
55#define TSG_PACKET_TYPE_REAUTH 0x00005250
56
57typedef WCHAR* RESOURCENAME;
58
59typedef struct
60{
61 RESOURCENAME* resourceName;
62 UINT32 numResourceNames;
63 RESOURCENAME* alternateResourceNames;
64 UINT16 numAlternateResourceNames;
65 UINT32 Port;
66} TSENDPOINTINFO;
67
68typedef struct
69{
70 UINT16 ComponentId;
71 UINT16 PacketId;
72} TSG_PACKET_HEADER;
73
74typedef struct
75{
76 UINT32 capabilities;
77} TSG_CAPABILITY_NAP;
78
79typedef union
80{
81 TSG_CAPABILITY_NAP tsgCapNap;
82} TSG_CAPABILITIES_UNION;
83
84typedef struct
85{
86 UINT32 capabilityType;
87 TSG_CAPABILITIES_UNION tsgPacket;
88} TSG_PACKET_CAPABILITIES;
89
90typedef struct
91{
92 TSG_PACKET_HEADER tsgHeader;
93 TSG_PACKET_CAPABILITIES tsgCaps;
94 UINT32 numCapabilities;
95 UINT16 majorVersion;
96 UINT16 minorVersion;
97 UINT16 quarantineCapabilities;
98} TSG_PACKET_VERSIONCAPS;
99
100typedef struct
101{
102 UINT32 flags;
103} TSG_PACKET_QUARCONFIGREQUEST;
104
105typedef struct
106{
107 UINT32 flags;
108 WCHAR* machineName;
109 UINT32 nameLength;
110 BYTE* data;
111 UINT32 dataLen;
112} TSG_PACKET_QUARREQUEST;
113
114typedef struct
115{
116 BOOL enableAllRedirections;
117 BOOL disableAllRedirections;
118 BOOL driveRedirectionDisabled;
119 BOOL printerRedirectionDisabled;
120 BOOL portRedirectionDisabled;
121 BOOL reserved;
122 BOOL clipboardRedirectionDisabled;
123 BOOL pnpRedirectionDisabled;
124} TSG_REDIRECTION_FLAGS;
125
126typedef struct
127{
128 UINT32 flags;
129 UINT32 reserved;
130 const BYTE* responseData;
131 UINT32 responseDataLen;
132 TSG_REDIRECTION_FLAGS redirectionFlags;
133} TSG_PACKET_RESPONSE;
134
135typedef struct
136{
137 UINT32 flags;
138 UINT32 certChainLen;
139 WCHAR* certChainData;
140 GUID nonce;
141 TSG_PACKET_VERSIONCAPS versionCaps;
142} TSG_PACKET_QUARENC_RESPONSE;
143
144typedef struct
145{
146 INT32 isDisplayMandatory;
147 INT32 isConsentMandatory;
148 UINT32 msgBytes;
149 WCHAR* msgBuffer;
150} TSG_PACKET_STRING_MESSAGE;
151
152typedef struct
153{
154 UINT64 tunnelContext;
155} TSG_PACKET_REAUTH_MESSAGE;
156
157typedef struct
158{
159 UINT32 msgID;
160 UINT32 msgType;
161 INT32 isMsgPresent;
162} TSG_PACKET_MSG_RESPONSE;
163
164typedef struct
165{
166 TSG_PACKET_QUARENC_RESPONSE pktQuarEncResponse;
167 TSG_PACKET_MSG_RESPONSE pktConsentMessage;
168} TSG_PACKET_CAPS_RESPONSE;
169
170typedef struct
171{
172 UINT32 maxMessagesPerBatch;
173} TSG_PACKET_MSG_REQUEST;
174
175typedef struct
176{
177 TSG_PACKET_VERSIONCAPS tsgVersionCaps;
178 UINT32 cookieLen;
179 BYTE* cookie;
180} TSG_PACKET_AUTH;
181
182typedef union
183{
184 TSG_PACKET_VERSIONCAPS packetVersionCaps;
185 TSG_PACKET_AUTH packetAuth;
186} TSG_INITIAL_PACKET_TYPE_UNION;
187
188typedef struct
189{
190 UINT64 tunnelContext;
191 UINT32 packetId;
192 TSG_INITIAL_PACKET_TYPE_UNION tsgInitialPacket;
193} TSG_PACKET_REAUTH;
194
195typedef union
196{
197 TSG_PACKET_HEADER packetHeader;
198 TSG_PACKET_VERSIONCAPS packetVersionCaps;
199 TSG_PACKET_QUARCONFIGREQUEST packetQuarConfigRequest;
200 TSG_PACKET_QUARREQUEST packetQuarRequest;
201 TSG_PACKET_RESPONSE packetResponse;
202 TSG_PACKET_QUARENC_RESPONSE packetQuarEncResponse;
203 TSG_PACKET_CAPS_RESPONSE packetCapsResponse;
204 TSG_PACKET_MSG_REQUEST packetMsgRequest;
205 TSG_PACKET_MSG_RESPONSE packetMsgResponse;
206 TSG_PACKET_AUTH packetAuth;
207 TSG_PACKET_REAUTH packetReauth;
208} TSG_PACKET_TYPE_UNION;
209
210typedef struct
211{
212 UINT32 packetId;
213 TSG_PACKET_TYPE_UNION tsgPacket;
214} TSG_PACKET;
215
216struct rdp_tsg
217{
218 BIO* bio;
219 rdpRpc* rpc;
220 UINT16 Port;
221 LPWSTR Hostname;
222 TSG_STATE state;
223 UINT32 TunnelId;
224 UINT32 ChannelId;
225 BOOL reauthSequence;
226 rdpTransport* transport;
227 UINT64 ReauthTunnelContext;
228 CONTEXT_HANDLE TunnelContext;
229 CONTEXT_HANDLE ChannelContext;
230 CONTEXT_HANDLE NewTunnelContext;
231 CONTEXT_HANDLE NewChannelContext;
232 wLog* log;
233 TSG_PACKET_QUARENC_RESPONSE CapsResponse;
234 TSG_PACKET_QUARREQUEST QuarreQuest;
235};
236
237WINPR_ATTR_NODISCARD
238static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
239 TSG_PACKET_STRING_MESSAGE* msg);
240
241WINPR_ATTR_NODISCARD
242static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align);
243
244WINPR_ATTR_NODISCARD
245static const char* tsg_caps_to_string(UINT32 caps, char* buffer, size_t len)
246{
247 const UINT32 mask = ~(TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT |
248 TSG_MESSAGING_CAP_CONSENT_SIGN | TSG_MESSAGING_CAP_SERVICE_MSG |
249 TSG_MESSAGING_CAP_REAUTH);
250 const UINT32 val = caps & mask;
251
252 if ((caps & TSG_NAP_CAPABILITY_QUAR_SOH) != 0)
253 (void)winpr_str_append("TSG_NAP_CAPABILITY_QUAR_SOH", buffer, len, "|");
254 if ((caps & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
255 (void)winpr_str_append("TSG_NAP_CAPABILITY_IDLE_TIMEOUT", buffer, len, "|");
256 if ((caps & TSG_MESSAGING_CAP_CONSENT_SIGN) != 0)
257 (void)winpr_str_append("TSG_MESSAGING_CAP_CONSENT_SIGN", buffer, len, "|");
258 if ((caps & TSG_MESSAGING_CAP_SERVICE_MSG) != 0)
259 (void)winpr_str_append("TSG_MESSAGING_CAP_SERVICE_MSG", buffer, len, "|");
260 if ((caps & TSG_MESSAGING_CAP_REAUTH) != 0)
261 (void)winpr_str_append("TSG_MESSAGING_CAP_REAUTH", buffer, len, "|");
262
263 if (val != 0)
264 {
265 char number[32] = WINPR_C_ARRAY_INIT;
266 (void)_snprintf(number, sizeof(number), "TSG_UNKNOWN{0x%08" PRIx32 "}", val);
267 (void)winpr_str_append(number, buffer, len, "|");
268 }
269
270 return buffer;
271}
272
273WINPR_ATTR_NODISCARD
274static const char* tsg_packet_id_to_string(UINT32 packetId)
275{
276 switch (packetId)
277 {
278 case TSG_PACKET_TYPE_HEADER:
279 return "TSG_PACKET_TYPE_HEADER";
280 case TSG_PACKET_TYPE_VERSIONCAPS:
281 return "TSG_PACKET_TYPE_VERSIONCAPS";
282 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
283 return "TSG_PACKET_TYPE_QUARCONFIGREQUEST";
284 case TSG_PACKET_TYPE_QUARREQUEST:
285 return "TSG_PACKET_TYPE_QUARREQUEST";
286 case TSG_PACKET_TYPE_RESPONSE:
287 return "TSG_PACKET_TYPE_RESPONSE";
288 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
289 return "TSG_PACKET_TYPE_QUARENC_RESPONSE";
290 case TSG_CAPABILITY_TYPE_NAP:
291 return "TSG_CAPABILITY_TYPE_NAP";
292 case TSG_PACKET_TYPE_CAPS_RESPONSE:
293 return "TSG_PACKET_TYPE_CAPS_RESPONSE";
294 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
295 return "TSG_PACKET_TYPE_MSGREQUEST_PACKET";
296 case TSG_PACKET_TYPE_MESSAGE_PACKET:
297 return "TSG_PACKET_TYPE_MESSAGE_PACKET";
298 case TSG_PACKET_TYPE_AUTH:
299 return "TSG_PACKET_TYPE_AUTH";
300 case TSG_PACKET_TYPE_REAUTH:
301 return "TSG_PACKET_TYPE_REAUTH";
302 default:
303 return "UNKNOWN";
304 }
305}
306
307WINPR_ATTR_NODISCARD
308static const char* tsg_component_id_to_string(UINT16 ComponentId, char* buffer, size_t bytelen)
309{
310 const char* str = nullptr;
311
312#define ENTRY(x) \
313 case x: \
314 str = #x; \
315 break
316 switch (ComponentId)
317 {
318 ENTRY(TS_GATEWAY_TRANSPORT);
319 default:
320 str = "TS_UNKNOWN";
321 break;
322 }
323#undef ENTRY
324
325 (void)_snprintf(buffer, bytelen, "%s [0x%04" PRIx16 "]", str, ComponentId);
326 return buffer;
327}
328
329WINPR_ATTR_NODISCARD
330static const char* tsg_state_to_string(TSG_STATE state)
331{
332 switch (state)
333 {
334 case TSG_STATE_INITIAL:
335 return "TSG_STATE_INITIAL";
336 case TSG_STATE_CONNECTED:
337 return "TSG_STATE_CONNECTED";
338 case TSG_STATE_AUTHORIZED:
339 return "TSG_STATE_AUTHORIZED";
340 case TSG_STATE_CHANNEL_CREATED:
341 return "TSG_STATE_CHANNEL_CREATED";
342 case TSG_STATE_PIPE_CREATED:
343 return "TSG_STATE_PIPE_CREATED";
344 case TSG_STATE_TUNNEL_CLOSE_PENDING:
345 return "TSG_STATE_TUNNEL_CLOSE_PENDING";
346 case TSG_STATE_CHANNEL_CLOSE_PENDING:
347 return "TSG_STATE_CHANNEL_CLOSE_PENDING";
348 case TSG_STATE_FINAL:
349 return "TSG_STATE_FINAL";
350 default:
351 return "TSG_STATE_UNKNOWN";
352 }
353}
354
355WINPR_ATTR_NODISCARD
356static BOOL TsProxyReadTunnelContext(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext)
357{
358 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 20))
359 return FALSE;
360
361 WINPR_ASSERT(tunnelContext);
362 Stream_Read_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
363 Stream_Read(s, &tunnelContext->ContextUuid,
364 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
365 return TRUE;
366}
367
368WINPR_ATTR_NODISCARD
369static BOOL TsProxyWriteTunnelContext(WINPR_ATTR_UNUSED wLog* log, wStream* s,
370 const CONTEXT_HANDLE* tunnelContext)
371{
372 if (!Stream_EnsureRemainingCapacity(s, 20))
373 return FALSE;
374
375 Stream_Write_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
376 Stream_Write(s, &tunnelContext->ContextUuid,
377 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
378 return TRUE;
379}
380
381WINPR_ATTR_NODISCARD
382static BOOL tsg_ndr_pointer_write(WINPR_ATTR_UNUSED wLog* log, wStream* s, UINT32* index,
383 DWORD length)
384{
385 WINPR_ASSERT(index);
386 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
387
388 if (!s)
389 return FALSE;
390 if (!Stream_EnsureRemainingCapacity(s, 4))
391 return FALSE;
392
393 if (length > 0)
394 {
395 Stream_Write_UINT32(s, ndrPtr); /* mszGroupsNdrPtr (4 bytes) */
396 (*index) = (*index) + 1;
397 }
398 else
399 Stream_Write_UINT32(s, 0);
400 return TRUE;
401}
402
403WINPR_ATTR_NODISCARD
404static BOOL tsg_ndr_pointer_read(wLog* log, wStream* s, UINT32* index, UINT32* ptrval,
405 BOOL required)
406{
407 WINPR_ASSERT(index);
408 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
409
410 if (!s)
411 return FALSE;
412 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 4))
413 return FALSE;
414
415 const DWORD val = Stream_Get_UINT32(s);
416 if (ptrval)
417 *ptrval = val;
418
419 if (val != 0)
420 {
421 if (val != ndrPtr)
422 {
423 WLog_Print(log, WLOG_WARN, "Read NDR pointer 0x%04" PRIx32 " but expected 0x%04" PRIx32,
424 val, ndrPtr);
425 if ((val & 0xFFFF0000) != (ndrPtr & 0xFFFF0000))
426 return FALSE;
427 }
428 (*index)++;
429 }
430 else if (required)
431 {
432 WLog_Print(log, WLOG_ERROR, "NDR pointer == 0, but the field is required");
433 return FALSE;
434 }
435
436 return TRUE;
437}
438
439WINPR_ATTR_NODISCARD
440static BOOL tsg_ndr_write_conformant_array(WINPR_ATTR_UNUSED wLog* log, wStream* s,
441 const void* data, size_t length)
442{
443 const size_t pad = length % 4;
444 if ((length > UINT32_MAX) || !Stream_EnsureRemainingCapacity(s, 4ull + length))
445 return FALSE;
446
447 Stream_Write_UINT32(s, WINPR_ASSERTING_INT_CAST(uint32_t, length)); /* MaxCount (4 bytes) */
448 Stream_Write(s, data, length);
449 if (pad != 0)
450 Stream_Zero(s, 4 - pad);
451
452 return TRUE;
453}
454
455WINPR_ATTR_NODISCARD
456static BOOL tsg_ndr_write_string(WINPR_ATTR_UNUSED wLog* log, wStream* s, const WCHAR* str,
457 size_t length)
458{
459 const size_t pad = (length % 2) * sizeof(WCHAR);
460 if ((length > UINT32_MAX) ||
461 !Stream_EnsureRemainingCapacity(s, 12ull + length * sizeof(WCHAR) + pad))
462 return FALSE;
463
464 Stream_Write_UINT32(s, (UINT32)length); /* MaxCount (4 bytes) */
465 Stream_Write_UINT32(s, 0); /* Offset (4 bytes) */
466 Stream_Write_UINT32(s, (UINT32)length); /* ActualCount (4 bytes) */
467 if (!Stream_Write_UTF16_String(s, str, length)) /* Array */
468 return FALSE;
469 Stream_Zero(s, pad);
470 return TRUE;
471}
472
473WINPR_ATTR_NODISCARD
474static BOOL tsg_ndr_read_string(wLog* log, wStream* s, WCHAR** str, UINT32* pLengthInBytes)
475{
476 UINT32 MaxCount = 0;
477 UINT32 Offset = 0;
478 UINT32 ActualCount = 0;
479 WINPR_ASSERT(pLengthInBytes);
480 const UINT32 lengthInBytes = *pLengthInBytes;
481
482 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
483 return FALSE;
484
485 Stream_Read_UINT32(s, MaxCount); /* MaxCount (4 bytes) */
486 Stream_Read_UINT32(s, Offset); /* Offset (4 bytes) */
487 Stream_Read_UINT32(s, ActualCount); /* ActualCount (4 bytes) */
488 if (ActualCount > MaxCount)
489 {
490 WLog_Print(log, WLOG_ERROR,
491 "failed to read string, ActualCount (%" PRIu32 ") > MaxCount (%" PRIu32 ")",
492 ActualCount, MaxCount);
493 return FALSE;
494 }
495 if (Offset != 0)
496 {
497 WLog_Print(log, WLOG_ERROR, "Unsupported Offset (%" PRIu32 "), expected 0", Offset);
498 return FALSE;
499 }
500 if (ActualCount > lengthInBytes / sizeof(WCHAR))
501 {
502 WLog_Print(log, WLOG_ERROR,
503 "failed to read string, ActualCount (%" PRIu32
504 ") * sizeof(WCHAR) > lengthInBytes (%" PRIu32 ")",
505 ActualCount, lengthInBytes);
506 return FALSE;
507 }
508
509 const size_t start = Stream_GetPosition(s);
510 if (str)
511 *str = Stream_PointerAs(s, WCHAR);
512
513 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, ActualCount * sizeof(WCHAR)))
514 return FALSE;
515 Stream_Seek(s, ActualCount * sizeof(WCHAR));
516 const size_t end = Stream_GetPosition(s);
517 if ((start > end) || ((end - start) > UINT32_MAX))
518 return FALSE;
519 *pLengthInBytes = WINPR_ASSERTING_INT_CAST(UINT32, end - start);
520 const size_t pad = (ActualCount % 2);
521 return Stream_SafeSeek(s, pad * sizeof(WCHAR));
522}
523
524WINPR_ATTR_NODISCARD
525static BOOL tsg_ndr_read_packet_header(wLog* log, wStream* s, TSG_PACKET_HEADER* header)
526{
527 const UINT32 ComponentId = TS_GATEWAY_TRANSPORT;
528
529 WINPR_ASSERT(header);
530 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 2, sizeof(UINT16)))
531 return FALSE;
532 Stream_Read_UINT16(s, header->ComponentId);
533 Stream_Read_UINT16(s, header->PacketId);
534
535 if (ComponentId != header->ComponentId)
536 {
537 char buffer[64] = WINPR_C_ARRAY_INIT;
538 char buffer2[64] = WINPR_C_ARRAY_INIT;
539 WLog_Print(log, WLOG_ERROR, "Unexpected ComponentId: %s, Expected %s",
540 tsg_component_id_to_string(header->ComponentId, buffer, sizeof(buffer)),
541 tsg_component_id_to_string(ComponentId, buffer2, sizeof(buffer2)));
542 return FALSE;
543 }
544
545 return TRUE;
546}
547
548WINPR_ATTR_NODISCARD
549static BOOL tsg_ndr_write_packet_header(WINPR_ATTR_UNUSED wLog* log, wStream* s,
550 const TSG_PACKET_HEADER* header)
551{
552 WINPR_ASSERT(header);
553 if (!Stream_EnsureRemainingCapacity(s, 2ull * sizeof(UINT16)))
554 return FALSE;
555 Stream_Write_UINT16(s, header->ComponentId);
556 Stream_Write_UINT16(s, header->PacketId);
557 return TRUE;
558}
559
560WINPR_ATTR_NODISCARD
561static BOOL tsg_ndr_read_nap(wLog* log, wStream* s, TSG_CAPABILITY_NAP* nap)
562{
563 WINPR_ASSERT(nap);
564
565 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
566 return FALSE;
567 Stream_Read_UINT32(s, nap->capabilities);
568 {
569 char buffer[256] = WINPR_C_ARRAY_INIT;
570 WLog_Print(log, WLOG_DEBUG, "Received version caps %s",
571 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
572 }
573 return TRUE;
574}
575
576WINPR_ATTR_NODISCARD
577static BOOL tsg_ndr_write_nap(wLog* log, wStream* s, const TSG_CAPABILITY_NAP* nap)
578{
579 WINPR_ASSERT(nap);
580
581 if (!Stream_EnsureRemainingCapacity(s, 1ull * sizeof(UINT32)))
582 return FALSE;
583
584 {
585 char buffer[256] = WINPR_C_ARRAY_INIT;
586 WLog_Print(log, WLOG_DEBUG, "Sending version caps %s",
587 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
588 }
589 Stream_Write_UINT32(s, nap->capabilities);
590 return TRUE;
591}
592
593WINPR_ATTR_NODISCARD
594static BOOL tsg_ndr_read_tsg_caps(wLog* log, wStream* s, TSG_PACKET_CAPABILITIES* caps)
595{
596 UINT32 capabilityType = 0;
597 UINT32 count = 0;
598 WINPR_ASSERT(caps);
599
600 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 3, sizeof(UINT32)))
601 return FALSE;
602 Stream_Read_UINT32(s, count);
603 Stream_Read_UINT32(s, capabilityType);
604 Stream_Read_UINT32(s, caps->capabilityType);
605 if (capabilityType != caps->capabilityType)
606 {
607 WLog_Print(log, WLOG_ERROR,
608 "Inconsistent data, capabilityType 0x%08" PRIx32 " != 0x%08" PRIx32,
609 capabilityType, caps->capabilityType);
610 return FALSE;
611 }
612 switch (caps->capabilityType)
613 {
614 case TSG_CAPABILITY_TYPE_NAP:
615 if (count < 1)
616 {
617 WLog_Print(log, WLOG_ERROR, "Inconsistent data, capabilityType %s count=%" PRIu32,
618 tsg_packet_id_to_string(capabilityType), count);
619 return FALSE;
620 }
621 return tsg_ndr_read_nap(log, s, &caps->tsgPacket.tsgCapNap);
622 default:
623 WLog_Print(log, WLOG_ERROR,
624 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32
625 " [count=%" PRIu32 "]",
626 caps->capabilityType, count);
627 return FALSE;
628 }
629}
630
631WINPR_ATTR_NODISCARD
632static BOOL tsg_ndr_write_tsg_caps(wLog* log, wStream* s, const TSG_PACKET_CAPABILITIES* caps)
633{
634 WINPR_ASSERT(caps);
635
636 if (!Stream_EnsureRemainingCapacity(s, 2ull * sizeof(UINT32)))
637 return FALSE;
638 Stream_Write_UINT32(s, caps->capabilityType);
639 Stream_Write_UINT32(s, caps->capabilityType);
640
641 switch (caps->capabilityType)
642 {
643 case TSG_CAPABILITY_TYPE_NAP:
644 return tsg_ndr_write_nap(log, s, &caps->tsgPacket.tsgCapNap);
645 default:
646 WLog_Print(log, WLOG_ERROR,
647 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32,
648 caps->capabilityType);
649 return FALSE;
650 }
651}
652
653WINPR_ATTR_NODISCARD
654static BOOL tsg_ndr_read_version_caps(wLog* log, wStream* s, UINT32* index,
655 TSG_PACKET_VERSIONCAPS* caps)
656{
657 WINPR_ASSERT(caps);
658 if (!tsg_ndr_read_packet_header(log, s, &caps->tsgHeader))
659 return FALSE;
660
661 UINT32 TSGCapsPtr = 0;
662 if (!tsg_ndr_pointer_read(log, s, index, &TSGCapsPtr, TRUE))
663 return FALSE;
664
665 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 10))
666 return FALSE;
667 Stream_Read_UINT32(s, caps->numCapabilities);
668 Stream_Read_UINT16(s, caps->majorVersion);
669 Stream_Read_UINT16(s, caps->minorVersion);
670 Stream_Read_UINT16(s, caps->quarantineCapabilities);
671 /* 4-byte alignment */
672 if (!tsg_stream_align(log, s, 4))
673 return FALSE;
674
675 if (caps->numCapabilities > 1)
676 {
677 WLog_Print(log, WLOG_ERROR,
678 "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
679 caps->numCapabilities);
680 return FALSE;
681 }
682
683 return tsg_ndr_read_tsg_caps(log, s, &caps->tsgCaps);
684}
685
686WINPR_ATTR_NODISCARD
687static BOOL tsg_ndr_write_version_caps(wLog* log, wStream* s, UINT32* index,
688 const TSG_PACKET_VERSIONCAPS* caps)
689{
690 WINPR_ASSERT(caps);
691 if (!tsg_ndr_write_packet_header(log, s, &caps->tsgHeader))
692 return FALSE;
693
694 if (!tsg_ndr_pointer_write(log, s, index, 1)) /* TsgCapsPtr (4 bytes) */
695 return FALSE;
696
697 if (!Stream_EnsureRemainingCapacity(s, 10))
698 return FALSE;
699
700 if (caps->numCapabilities > 1)
701 {
702 WLog_Print(log, WLOG_ERROR,
703 "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
704 caps->numCapabilities);
705 return FALSE;
706 }
707 Stream_Write_UINT32(s, caps->numCapabilities);
708 Stream_Write_UINT16(s, caps->majorVersion);
709 Stream_Write_UINT16(s, caps->minorVersion);
710 Stream_Write_UINT16(s, caps->quarantineCapabilities);
711
712 /* 4-byte alignment (30 + 2) */
713 Stream_Write_UINT16(s, 0x0000); /* pad (2 bytes) */
714 Stream_Write_UINT32(s, caps->numCapabilities); /* MaxCount (4 bytes) */
715 return tsg_ndr_write_tsg_caps(log, s, &caps->tsgCaps);
716}
717
718WINPR_ATTR_NODISCARD
719static BOOL tsg_ndr_read_quarenc_response(wLog* log, wStream* s, UINT32* index,
720 TSG_PACKET_QUARENC_RESPONSE* quarenc)
721{
722 WINPR_ASSERT(quarenc);
723 UINT32 CertChainDataPtr = 0;
724 UINT32 VersionCapsPtr = 0;
725
726 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
727 return FALSE;
728 Stream_Read_UINT32(s, quarenc->flags);
729 Stream_Read_UINT32(s, quarenc->certChainLen);
730
731 if (!tsg_ndr_pointer_read(log, s, index, &CertChainDataPtr, quarenc->certChainLen != 0))
732 return FALSE;
733
734 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(quarenc->nonce)))
735 return FALSE;
736 Stream_Read(s, &quarenc->nonce, sizeof(quarenc->nonce));
737
738 return (tsg_ndr_pointer_read(log, s, index, &VersionCapsPtr, TRUE));
739}
740
741WINPR_ATTR_NODISCARD
742static BOOL tsg_ndr_read_quarenc_data(wLog* log, wStream* s, UINT32* index,
743 TSG_PACKET_QUARENC_RESPONSE* quarenc)
744{
745 WINPR_ASSERT(quarenc);
746
747 if (quarenc->certChainLen > 0)
748 {
749 /* [MS-TSGU] 2.2.9.2.1.6 TSG_PACKET_QUARENC_RESPONSE::certChainLen number of WCHAR */
750 UINT32 lengthInBytes = quarenc->certChainLen * sizeof(WCHAR);
751 if (!tsg_ndr_read_string(log, s, &quarenc->certChainData, &lengthInBytes))
752 return FALSE;
753 quarenc->certChainLen = lengthInBytes / sizeof(WCHAR);
754
755 /* 4-byte alignment */
756 if (!tsg_stream_align(log, s, 4))
757 return FALSE;
758 }
759
760 return tsg_ndr_read_version_caps(log, s, index, &quarenc->versionCaps);
761}
762
763WINPR_ATTR_NODISCARD
764static BOOL tsg_ndr_write_auth(wLog* log, wStream* s, UINT32* index, const TSG_PACKET_AUTH* auth)
765{
766 WINPR_ASSERT(auth);
767
768 if (!tsg_ndr_write_version_caps(log, s, index, &auth->tsgVersionCaps))
769 return FALSE;
770
771 if (!Stream_EnsureRemainingCapacity(s, 4))
772 return FALSE;
773
774 Stream_Write_UINT32(s, auth->cookieLen);
775 if (!tsg_ndr_pointer_write(log, s, index, auth->cookieLen))
776 return FALSE;
777
778 if (!Stream_EnsureRemainingCapacity(s, auth->cookieLen))
779 return FALSE;
780 Stream_Write(s, auth->cookie, auth->cookieLen);
781 return TRUE;
782}
783
784WINPR_ATTR_NODISCARD
785static BOOL tsg_ndr_write_reauth(wLog* log, wStream* s, UINT32* index,
786 const TSG_PACKET_REAUTH* auth)
787{
788 WINPR_ASSERT(auth);
789
790 if (!Stream_EnsureRemainingCapacity(s, 12))
791 return FALSE;
792
793 Stream_Write_UINT64(s, auth->tunnelContext); /* TunnelContext (8 bytes) */
794 Stream_Write_UINT32(s, auth->packetId); /* PacketId (4 bytes) */
795
796 switch (auth->packetId)
797 {
798 case TSG_PACKET_TYPE_VERSIONCAPS:
799 return tsg_ndr_write_version_caps(log, s, index,
800 &auth->tsgInitialPacket.packetVersionCaps);
801 case TSG_PACKET_TYPE_AUTH:
802 return tsg_ndr_write_auth(log, s, index, &auth->tsgInitialPacket.packetAuth);
803 default:
804 WLog_Print(log, WLOG_ERROR, "unexpected packetId %s",
805 tsg_packet_id_to_string(auth->packetId));
806 return FALSE;
807 }
808}
809
810WINPR_ATTR_NODISCARD
811static BOOL tsg_ndr_read_packet_redirection_flags(wLog* log, wStream* s,
812 TSG_REDIRECTION_FLAGS* redirectionFlags)
813{
814 WINPR_ASSERT(redirectionFlags);
815
816 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 8, sizeof(UINT32)))
817 return FALSE;
818
819 redirectionFlags->enableAllRedirections =
820 Stream_Get_INT32(s); /* EnableAllRedirections (4 bytes) */
821 redirectionFlags->disableAllRedirections =
822 Stream_Get_INT32(s); /* DisableAllRedirections (4 bytes) */
823 redirectionFlags->driveRedirectionDisabled =
824 Stream_Get_INT32(s); /* DriveRedirectionDisabled (4 bytes) */
825 redirectionFlags->printerRedirectionDisabled =
826 Stream_Get_INT32(s); /* PrinterRedirectionDisabled (4 bytes) */
827 redirectionFlags->portRedirectionDisabled =
828 Stream_Get_INT32(s); /* PortRedirectionDisabled (4 bytes) */
829 redirectionFlags->reserved = Stream_Get_INT32(s); /* Reserved (4 bytes) */
830 redirectionFlags->clipboardRedirectionDisabled =
831 Stream_Get_INT32(s); /* ClipboardRedirectionDisabled (4 bytes) */
832 redirectionFlags->pnpRedirectionDisabled =
833 Stream_Get_INT32(s); /* PnpRedirectionDisabled (4 bytes) */
834 return TRUE;
835}
836
837WINPR_ATTR_FORMAT_ARG(3, 4)
838static BOOL tsg_print(char** buffer, size_t* len, WINPR_FORMAT_ARG const char* fmt, ...)
839{
840 int rc = 0;
841 va_list ap = WINPR_C_ARRAY_INIT;
842 if (!buffer || !len || !fmt)
843 return FALSE;
844 va_start(ap, fmt);
845 rc = vsnprintf(*buffer, *len, fmt, ap);
846 va_end(ap);
847 if ((rc < 0) || ((size_t)rc > *len))
848 return FALSE;
849 *len -= (size_t)rc;
850 *buffer += (size_t)rc;
851 return TRUE;
852}
853
854WINPR_ATTR_NODISCARD
855static BOOL tsg_packet_header_to_string(char** buffer, size_t* length,
856 const TSG_PACKET_HEADER* header)
857{
858 WINPR_ASSERT(buffer);
859 WINPR_ASSERT(length);
860 WINPR_ASSERT(header);
861
862 return tsg_print(buffer, length,
863 "header { ComponentId=0x%04" PRIx16 ", PacketId=0x%04" PRIx16 " }",
864 header->ComponentId, header->PacketId);
865}
866
867WINPR_ATTR_NODISCARD
868static BOOL tsg_type_capability_nap_to_string(char** buffer, size_t* length,
869 const TSG_CAPABILITY_NAP* cur)
870{
871 WINPR_ASSERT(buffer);
872 WINPR_ASSERT(length);
873 WINPR_ASSERT(cur);
874
875 return tsg_print(buffer, length, "%s { capabilities=0x%08" PRIx32 " }",
876 tsg_packet_id_to_string(TSG_CAPABILITY_TYPE_NAP), cur->capabilities);
877}
878
879WINPR_ATTR_NODISCARD
880static BOOL tsg_packet_capabilities_to_string(char** buffer, size_t* length,
881 const TSG_PACKET_CAPABILITIES* caps, UINT32 numCaps)
882{
883 WINPR_ASSERT(buffer);
884 WINPR_ASSERT(length);
885 WINPR_ASSERT(caps);
886
887 if (!tsg_print(buffer, length, "capabilities { "))
888 return FALSE;
889
890 for (UINT32 x = 0; x < numCaps; x++)
891 {
892 const TSG_PACKET_CAPABILITIES* cur = &caps[x];
893 switch (cur->capabilityType)
894 {
895 case TSG_CAPABILITY_TYPE_NAP:
896 if (!tsg_type_capability_nap_to_string(buffer, length, &cur->tsgPacket.tsgCapNap))
897 return FALSE;
898 break;
899 default:
900 if (!tsg_print(buffer, length, "TSG_UNKNOWN_CAPABILITY"))
901 return FALSE;
902 break;
903 }
904 }
905 return tsg_print(buffer, length, " }");
906}
907
908static BOOL tsg_packet_versioncaps_to_string(char** buffer, size_t* length,
909 const TSG_PACKET_VERSIONCAPS* caps)
910{
911 WINPR_ASSERT(buffer);
912 WINPR_ASSERT(length);
913 WINPR_ASSERT(caps);
914
915 if (!tsg_print(buffer, length, "versioncaps { "))
916 return FALSE;
917 if (!tsg_packet_header_to_string(buffer, length, &caps->tsgHeader))
918 return FALSE;
919
920 if (!tsg_print(buffer, length, " "))
921 return FALSE;
922
923 if (caps->numCapabilities > 1)
924 {
925 tsg_print(buffer, length,
926 "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
927 caps->numCapabilities);
928 return FALSE;
929 }
930
931 if (!tsg_packet_capabilities_to_string(buffer, length, &caps->tsgCaps, caps->numCapabilities))
932 return FALSE;
933
934 if (!tsg_print(buffer, length,
935 " numCapabilities=0x%08" PRIx32 ", majorVersion=0x%04" PRIx16
936 ", minorVersion=0x%04" PRIx16 ", quarantineCapabilities=0x%04" PRIx16,
937 caps->numCapabilities, caps->majorVersion, caps->minorVersion,
938 caps->quarantineCapabilities))
939 return FALSE;
940
941 return tsg_print(buffer, length, " }");
942}
943
944WINPR_ATTR_NODISCARD
945static BOOL tsg_packet_quarconfigrequest_to_string(char** buffer, size_t* length,
946 const TSG_PACKET_QUARCONFIGREQUEST* caps)
947{
948 WINPR_ASSERT(buffer);
949 WINPR_ASSERT(length);
950 WINPR_ASSERT(caps);
951
952 if (!tsg_print(buffer, length, "quarconfigrequest { "))
953 return FALSE;
954
955 if (!tsg_print(buffer, length, " "))
956 return FALSE;
957
958 if (!tsg_print(buffer, length, " flags=0x%08" PRIx32, caps->flags))
959 return FALSE;
960
961 return tsg_print(buffer, length, " }");
962}
963
964WINPR_ATTR_NODISCARD
965static BOOL tsg_packet_quarrequest_to_string(char** buffer, size_t* length,
966 const TSG_PACKET_QUARREQUEST* caps)
967{
968 BOOL rc = FALSE;
969 char* name = nullptr;
970 char* strdata = nullptr;
971
972 WINPR_ASSERT(buffer);
973 WINPR_ASSERT(length);
974 WINPR_ASSERT(caps);
975
976 if (!tsg_print(buffer, length, "quarrequest { "))
977 return FALSE;
978
979 if (!tsg_print(buffer, length, " "))
980 return FALSE;
981
982 if (caps->nameLength > 0)
983 {
984 if (caps->nameLength > INT_MAX)
985 return FALSE;
986 name = ConvertWCharNToUtf8Alloc(caps->machineName, caps->nameLength, nullptr);
987 if (!name)
988 return FALSE;
989 }
990
991 strdata = winpr_BinToHexString(caps->data, caps->dataLen, TRUE);
992 if (strdata || (caps->dataLen == 0))
993 rc = tsg_print(buffer, length,
994 " flags=0x%08" PRIx32 ", machineName=%s [%" PRIu32 "], data[%" PRIu32 "]=%s",
995 caps->flags, name, caps->nameLength, caps->dataLen, strdata);
996 free(name);
997 free(strdata);
998 if (!rc)
999 return FALSE;
1000
1001 return tsg_print(buffer, length, " }");
1002}
1003
1004WINPR_ATTR_NODISCARD
1005static const char* tsg_bool_to_string(BOOL val)
1006{
1007 if (val)
1008 return "true";
1009 return "false";
1010}
1011
1012WINPR_ATTR_NODISCARD
1013static const char* tsg_redirection_flags_to_string(char* buffer, size_t size,
1014 const TSG_REDIRECTION_FLAGS* flags)
1015{
1016 WINPR_ASSERT(buffer || (size == 0));
1017 WINPR_ASSERT(flags);
1018
1019 (void)_snprintf(
1020 buffer, size,
1021 "enableAllRedirections=%s, disableAllRedirections=%s, driveRedirectionDisabled=%s, "
1022 "printerRedirectionDisabled=%s, portRedirectionDisabled=%s, reserved=%s, "
1023 "clipboardRedirectionDisabled=%s, pnpRedirectionDisabled=%s",
1024 tsg_bool_to_string(flags->enableAllRedirections),
1025 tsg_bool_to_string(flags->disableAllRedirections),
1026 tsg_bool_to_string(flags->driveRedirectionDisabled),
1027 tsg_bool_to_string(flags->printerRedirectionDisabled),
1028 tsg_bool_to_string(flags->portRedirectionDisabled), tsg_bool_to_string(flags->reserved),
1029 tsg_bool_to_string(flags->clipboardRedirectionDisabled),
1030 tsg_bool_to_string(flags->pnpRedirectionDisabled));
1031 return buffer;
1032}
1033
1034WINPR_ATTR_NODISCARD
1035static BOOL tsg_packet_response_to_string(char** buffer, size_t* length,
1036 const TSG_PACKET_RESPONSE* caps)
1037{
1038 BOOL rc = FALSE;
1039 char* strdata = nullptr;
1040 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
1041
1042 WINPR_ASSERT(buffer);
1043 WINPR_ASSERT(length);
1044 WINPR_ASSERT(caps);
1045
1046 if (!tsg_print(buffer, length, "response { "))
1047 return FALSE;
1048
1049 if (!tsg_print(buffer, length, " "))
1050 return FALSE;
1051
1052 strdata = winpr_BinToHexString(caps->responseData, caps->responseDataLen, TRUE);
1053 if (strdata || (caps->responseDataLen == 0))
1054 rc = tsg_print(
1055 buffer, length,
1056 " flags=0x%08" PRIx32 ", reserved=0x%08" PRIx32 ", responseData[%" PRIu32
1057 "]=%s, redirectionFlags={ %s }",
1058 caps->flags, caps->reserved, caps->responseDataLen, strdata,
1059 tsg_redirection_flags_to_string(tbuffer, ARRAYSIZE(tbuffer), &caps->redirectionFlags));
1060 free(strdata);
1061 if (!rc)
1062 return FALSE;
1063
1064 return tsg_print(buffer, length, " }");
1065}
1066
1067WINPR_ATTR_NODISCARD
1068static BOOL tsg_packet_quarenc_response_to_string(char** buffer, size_t* length,
1069 const TSG_PACKET_QUARENC_RESPONSE* caps)
1070{
1071 BOOL rc = FALSE;
1072 char* strdata = nullptr;
1073 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
1074 size_t size = ARRAYSIZE(tbuffer);
1075 char* ptbuffer = tbuffer;
1076
1077 WINPR_ASSERT(buffer);
1078 WINPR_ASSERT(length);
1079 WINPR_ASSERT(caps);
1080
1081 if (!tsg_print(buffer, length, "quarenc_response { "))
1082 return FALSE;
1083
1084 if (!tsg_print(buffer, length, " "))
1085 return FALSE;
1086
1087 char uuid[64] = WINPR_C_ARRAY_INIT;
1088 if (!guid2str(&caps->nonce, uuid, sizeof(uuid)))
1089 goto fail;
1090
1091 if (caps->certChainLen > 0)
1092 {
1093 if (caps->certChainLen > INT_MAX)
1094 goto fail;
1095 strdata = ConvertWCharNToUtf8Alloc(caps->certChainData, caps->certChainLen, nullptr);
1096 if (!strdata)
1097 goto fail;
1098 }
1099
1100 tsg_packet_versioncaps_to_string(&ptbuffer, &size, &caps->versionCaps);
1101 if (strdata || (caps->certChainLen == 0))
1102 rc =
1103 tsg_print(buffer, length,
1104 " flags=0x%08" PRIx32 ", certChain[%" PRIu32 "]=%s, nonce=%s, versionCaps=%s",
1105 caps->flags, caps->certChainLen, strdata, uuid, tbuffer);
1106
1107fail:
1108 free(strdata);
1109 if (!rc)
1110 return FALSE;
1111
1112 return tsg_print(buffer, length, " }");
1113}
1114
1115WINPR_ATTR_NODISCARD
1116static BOOL tsg_packet_message_response_to_string(char** buffer, size_t* length,
1117 const TSG_PACKET_MSG_RESPONSE* caps)
1118{
1119 WINPR_ASSERT(buffer);
1120 WINPR_ASSERT(length);
1121 WINPR_ASSERT(caps);
1122
1123 if (!tsg_print(buffer, length, "msg_response { "))
1124 return FALSE;
1125
1126 if (!tsg_print(buffer, length,
1127 " msgID=0x%08" PRIx32 ", msgType=0x%08" PRIx32 ", isMsgPresent=%" PRId32,
1128 caps->msgID, caps->msgType, caps->isMsgPresent))
1129 return FALSE;
1130
1131 return tsg_print(buffer, length, " }");
1132}
1133
1134WINPR_ATTR_NODISCARD
1135static BOOL tsg_packet_caps_response_to_string(char** buffer, size_t* length,
1136 const TSG_PACKET_CAPS_RESPONSE* caps)
1137{
1138 WINPR_ASSERT(buffer);
1139 WINPR_ASSERT(length);
1140 WINPR_ASSERT(caps);
1141
1142 if (!tsg_print(buffer, length, "caps_response { "))
1143 return FALSE;
1144
1145 if (!tsg_packet_quarenc_response_to_string(buffer, length, &caps->pktQuarEncResponse))
1146 return FALSE;
1147
1148 if (!tsg_packet_message_response_to_string(buffer, length, &caps->pktConsentMessage))
1149 return FALSE;
1150
1151 return tsg_print(buffer, length, " }");
1152}
1153
1154WINPR_ATTR_NODISCARD
1155static BOOL tsg_packet_message_request_to_string(char** buffer, size_t* length,
1156 const TSG_PACKET_MSG_REQUEST* caps)
1157{
1158 WINPR_ASSERT(buffer);
1159 WINPR_ASSERT(length);
1160 WINPR_ASSERT(caps);
1161
1162 if (!tsg_print(buffer, length, "caps_message_request { "))
1163 return FALSE;
1164
1165 if (!tsg_print(buffer, length, " maxMessagesPerBatch=%" PRIu32, caps->maxMessagesPerBatch))
1166 return FALSE;
1167
1168 return tsg_print(buffer, length, " }");
1169}
1170
1171WINPR_ATTR_NODISCARD
1172static BOOL tsg_packet_auth_to_string(char** buffer, size_t* length, const TSG_PACKET_AUTH* caps)
1173{
1174 BOOL rc = FALSE;
1175 char* strdata = nullptr;
1176 WINPR_ASSERT(buffer);
1177 WINPR_ASSERT(length);
1178 WINPR_ASSERT(caps);
1179
1180 if (!tsg_print(buffer, length, "caps_message_request { "))
1181 return FALSE;
1182
1183 if (!tsg_packet_versioncaps_to_string(buffer, length, &caps->tsgVersionCaps))
1184 return FALSE;
1185
1186 strdata = winpr_BinToHexString(caps->cookie, caps->cookieLen, TRUE);
1187 if (strdata || (caps->cookieLen == 0))
1188 rc = tsg_print(buffer, length, " cookie[%" PRIu32 "]=%s", caps->cookieLen, strdata);
1189 free(strdata);
1190 if (!rc)
1191 return FALSE;
1192
1193 return tsg_print(buffer, length, " }");
1194}
1195
1196WINPR_ATTR_NODISCARD
1197static BOOL tsg_packet_reauth_to_string(char** buffer, size_t* length,
1198 const TSG_PACKET_REAUTH* caps)
1199{
1200 BOOL rc = FALSE;
1201 WINPR_ASSERT(buffer);
1202 WINPR_ASSERT(length);
1203 WINPR_ASSERT(caps);
1204
1205 if (!tsg_print(buffer, length, "caps_message_request { "))
1206 return FALSE;
1207
1208 if (!tsg_print(buffer, length, " tunnelContext=0x%016" PRIx64 ", packetId=%s [0x%08" PRIx32 "]",
1209 caps->tunnelContext, tsg_packet_id_to_string(caps->packetId), caps->packetId))
1210 return FALSE;
1211
1212 switch (caps->packetId)
1213 {
1214 case TSG_PACKET_TYPE_VERSIONCAPS:
1215 rc = tsg_packet_versioncaps_to_string(buffer, length,
1216 &caps->tsgInitialPacket.packetVersionCaps);
1217 break;
1218 case TSG_PACKET_TYPE_AUTH:
1219 rc = tsg_packet_auth_to_string(buffer, length, &caps->tsgInitialPacket.packetAuth);
1220 break;
1221 default:
1222 rc = tsg_print(buffer, length, "TODO: Unhandled packet type %s [0x%08" PRIx32 "]",
1223 tsg_packet_id_to_string(caps->packetId), caps->packetId);
1224 break;
1225 }
1226
1227 if (!rc)
1228 return FALSE;
1229
1230 return tsg_print(buffer, length, " }");
1231}
1232
1233WINPR_ATTR_NODISCARD
1234static const char* tsg_packet_to_string(const TSG_PACKET* packet)
1235{
1236 size_t len = 8192;
1237 static char sbuffer[8193] = WINPR_C_ARRAY_INIT;
1238 char* buffer = sbuffer;
1239
1240 if (!tsg_print(&buffer, &len, "TSG_PACKET { packetId=%s [0x%08" PRIx32 "], ",
1241 tsg_packet_id_to_string(packet->packetId), packet->packetId))
1242 goto fail;
1243
1244 switch (packet->packetId)
1245 {
1246 case TSG_PACKET_TYPE_HEADER:
1247 if (!tsg_packet_header_to_string(&buffer, &len, &packet->tsgPacket.packetHeader))
1248 goto fail;
1249 break;
1250 case TSG_PACKET_TYPE_VERSIONCAPS:
1251 if (!tsg_packet_versioncaps_to_string(&buffer, &len,
1252 &packet->tsgPacket.packetVersionCaps))
1253 goto fail;
1254 break;
1255 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
1256 if (!tsg_packet_quarconfigrequest_to_string(&buffer, &len,
1257 &packet->tsgPacket.packetQuarConfigRequest))
1258 goto fail;
1259 break;
1260 case TSG_PACKET_TYPE_QUARREQUEST:
1261 if (!tsg_packet_quarrequest_to_string(&buffer, &len,
1262 &packet->tsgPacket.packetQuarRequest))
1263 goto fail;
1264 break;
1265 case TSG_PACKET_TYPE_RESPONSE:
1266 if (!tsg_packet_response_to_string(&buffer, &len, &packet->tsgPacket.packetResponse))
1267 goto fail;
1268 break;
1269 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
1270 if (!tsg_packet_quarenc_response_to_string(&buffer, &len,
1271 &packet->tsgPacket.packetQuarEncResponse))
1272 goto fail;
1273 break;
1274 case TSG_PACKET_TYPE_CAPS_RESPONSE:
1275 if (!tsg_packet_caps_response_to_string(&buffer, &len,
1276 &packet->tsgPacket.packetCapsResponse))
1277 goto fail;
1278 break;
1279 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
1280 if (!tsg_packet_message_request_to_string(&buffer, &len,
1281 &packet->tsgPacket.packetMsgRequest))
1282 goto fail;
1283 break;
1284 case TSG_PACKET_TYPE_MESSAGE_PACKET:
1285 if (!tsg_packet_message_response_to_string(&buffer, &len,
1286 &packet->tsgPacket.packetMsgResponse))
1287 goto fail;
1288 break;
1289 case TSG_PACKET_TYPE_AUTH:
1290 if (!tsg_packet_auth_to_string(&buffer, &len, &packet->tsgPacket.packetAuth))
1291 goto fail;
1292 break;
1293 case TSG_PACKET_TYPE_REAUTH:
1294 if (!tsg_packet_reauth_to_string(&buffer, &len, &packet->tsgPacket.packetReauth))
1295 goto fail;
1296 break;
1297 default:
1298 if (!tsg_print(&buffer, &len, "INVALID"))
1299 goto fail;
1300 break;
1301 }
1302
1303 if (!tsg_print(&buffer, &len, " }"))
1304 goto fail;
1305
1306fail:
1307 return sbuffer;
1308}
1309
1310WINPR_ATTR_NODISCARD
1311static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align)
1312{
1313 size_t pos = 0;
1314 size_t offset = 0;
1315
1316 if (!s)
1317 return FALSE;
1318
1319 pos = Stream_GetPosition(s);
1320
1321 if ((pos % align) != 0)
1322 offset = align - pos % align;
1323
1324 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, offset))
1325 return FALSE;
1326 Stream_Seek(s, offset);
1327 return TRUE;
1328}
1329
1330WINPR_ATTR_NODISCARD
1331static BIO_METHOD* BIO_s_tsg(void);
1367WINPR_ATTR_NODISCARD
1368static int TsProxySendToServer(handle_t IDL_handle, const byte pRpcMessage[], UINT32 count,
1369 const UINT32* lengths)
1370{
1371 wStream* s = nullptr;
1372 rdpTsg* tsg = nullptr;
1373 size_t length = 0;
1374 const byte* buffer1 = nullptr;
1375 const byte* buffer2 = nullptr;
1376 const byte* buffer3 = nullptr;
1377 UINT32 buffer1Length = 0;
1378 UINT32 buffer2Length = 0;
1379 UINT32 buffer3Length = 0;
1380 UINT32 numBuffers = 0;
1381 UINT32 totalDataBytes = 0;
1382 tsg = (rdpTsg*)IDL_handle;
1383 buffer1Length = buffer2Length = buffer3Length = 0;
1384
1385 if (count > 0)
1386 {
1387 numBuffers++;
1388 buffer1 = &pRpcMessage[0];
1389 buffer1Length = lengths[0];
1390 totalDataBytes += lengths[0] + 4;
1391 }
1392
1393 if (count > 1)
1394 {
1395 numBuffers++;
1396 buffer2 = &pRpcMessage[1];
1397 buffer2Length = lengths[1];
1398 totalDataBytes += lengths[1] + 4;
1399 }
1400
1401 if (count > 2)
1402 {
1403 numBuffers++;
1404 buffer3 = &pRpcMessage[2];
1405 buffer3Length = lengths[2];
1406 totalDataBytes += lengths[2] + 4;
1407 }
1408
1409 length = 28ull + totalDataBytes;
1410 if (length > INT_MAX)
1411 return -1;
1412 s = Stream_New(nullptr, length);
1413
1414 if (!s)
1415 {
1416 WLog_Print(tsg->log, WLOG_ERROR, "Stream_New failed!");
1417 return -1;
1418 }
1419
1420 /* PCHANNEL_CONTEXT_HANDLE_NOSERIALIZE_NR (20 bytes) */
1421 if (!TsProxyWriteTunnelContext(tsg->log, s, &tsg->ChannelContext))
1422 goto fail;
1423 Stream_Write_UINT32_BE(s, totalDataBytes); /* totalDataBytes (4 bytes) */
1424 Stream_Write_UINT32_BE(s, numBuffers); /* numBuffers (4 bytes) */
1425
1426 if (buffer1Length > 0)
1427 Stream_Write_UINT32_BE(s, buffer1Length); /* buffer1Length (4 bytes) */
1428
1429 if (buffer2Length > 0)
1430 Stream_Write_UINT32_BE(s, buffer2Length); /* buffer2Length (4 bytes) */
1431
1432 if (buffer3Length > 0)
1433 Stream_Write_UINT32_BE(s, buffer3Length); /* buffer3Length (4 bytes) */
1434
1435 if (buffer1Length > 0)
1436 Stream_Write(s, buffer1, buffer1Length); /* buffer1 (variable) */
1437
1438 if (buffer2Length > 0)
1439 Stream_Write(s, buffer2, buffer2Length); /* buffer2 (variable) */
1440
1441 if (buffer3Length > 0)
1442 Stream_Write(s, buffer3, buffer3Length); /* buffer3 (variable) */
1443
1444 if (!rpc_client_write_call(tsg->rpc, s, TsProxySendToServerOpnum))
1445 return -1;
1446
1447 return (int)length;
1448fail:
1449 Stream_Free(s, TRUE);
1450 return -1;
1451}
1452
1463WINPR_ATTR_NODISCARD
1464static BOOL TsProxyCreateTunnelWriteRequest(rdpTsg* tsg, const TSG_PACKET* tsgPacket)
1465{
1466 BOOL rc = FALSE;
1467 BOOL write = TRUE;
1468 UINT16 opnum = 0;
1469 wStream* s = nullptr;
1470 rdpRpc* rpc = nullptr;
1471
1472 if (!tsg || !tsg->rpc)
1473 return FALSE;
1474
1475 rpc = tsg->rpc;
1476 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_to_string(tsgPacket));
1477 s = Stream_New(nullptr, 108);
1478
1479 if (!s)
1480 return FALSE;
1481
1482 switch (tsgPacket->packetId)
1483 {
1484 case TSG_PACKET_TYPE_VERSIONCAPS:
1485 {
1486 UINT32 index = 0;
1487 const TSG_PACKET_VERSIONCAPS* packetVersionCaps =
1488 &tsgPacket->tsgPacket.packetVersionCaps;
1489
1490 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1491 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1492 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketVersionCapsPtr (4 bytes) */
1493 goto fail;
1494
1495 if (!tsg_ndr_write_version_caps(tsg->log, s, &index, packetVersionCaps))
1496 goto fail;
1501 /*
1502 * 8-byte constant (8A E3 13 71 02 F4 36 71) also observed here:
1503 * http://lists.samba.org/archive/cifs-protocol/2010-July/001543.html
1504 */
1505 Stream_Write_UINT8(s, 0x8A);
1506 Stream_Write_UINT8(s, 0xE3);
1507 Stream_Write_UINT8(s, 0x13);
1508 Stream_Write_UINT8(s, 0x71);
1509 Stream_Write_UINT8(s, 0x02);
1510 Stream_Write_UINT8(s, 0xF4);
1511 Stream_Write_UINT8(s, 0x36);
1512 Stream_Write_UINT8(s, 0x71);
1513 Stream_Write_UINT32(s, 0x00040001); /* 1.4 (version?) */
1514 Stream_Write_UINT32(s, 0x00000001); /* 1 (element count?) */
1515 /* p_cont_list_t */
1516 Stream_Write_UINT8(s, 2); /* ncontext_elem */
1517 Stream_Write_UINT8(s, 0x40); /* reserved1 */
1518 Stream_Write_UINT16(s, 0x0028); /* reserved2 */
1519 /* p_syntax_id_t */
1520 Stream_Write(s, &TSGU_UUID, sizeof(p_uuid_t));
1521 Stream_Write_UINT32(s, TSGU_SYNTAX_IF_VERSION);
1522 /* p_syntax_id_t */
1523 Stream_Write(s, &NDR_UUID, sizeof(p_uuid_t));
1524 Stream_Write_UINT32(s, NDR_SYNTAX_IF_VERSION);
1525 opnum = TsProxyCreateTunnelOpnum;
1526 }
1527 break;
1528
1529 case TSG_PACKET_TYPE_REAUTH:
1530 {
1531 const TSG_PACKET_REAUTH* packetReauth = &tsgPacket->tsgPacket.packetReauth;
1532 UINT32 index = 0;
1533 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1534 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1535 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketReauthPtr (4 bytes) */
1536 goto fail;
1537 if (!tsg_ndr_write_reauth(tsg->log, s, &index, packetReauth))
1538 goto fail;
1539 opnum = TsProxyCreateTunnelOpnum;
1540 }
1541 break;
1542
1543 default:
1544 WLog_Print(tsg->log, WLOG_WARN, "unexpected packetId %s",
1545 tsg_packet_id_to_string(tsgPacket->packetId));
1546 write = FALSE;
1547 break;
1548 }
1549
1550 rc = TRUE;
1551
1552 if (write)
1553 return rpc_client_write_call(rpc, s, opnum);
1554fail:
1555 Stream_Free(s, TRUE);
1556 return rc;
1557}
1558
1559WINPR_ATTR_NODISCARD
1560static BOOL tsg_ndr_read_consent_message(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1561 UINT32 msgType, BOOL isMessagePresent)
1562{
1563 TSG_PACKET_STRING_MESSAGE packetStringMessage = WINPR_C_ARRAY_INIT;
1564
1565 WINPR_ASSERT(context);
1566 WINPR_ASSERT(index);
1567
1568 if (!TsProxyReadPacketSTringMessage(log, s, index, &packetStringMessage))
1569 return FALSE;
1570
1571 if (context->instance && isMessagePresent)
1572 {
1573 return IFCALLRESULT(TRUE, context->instance->PresentGatewayMessage, context->instance,
1574 msgType, packetStringMessage.isDisplayMandatory != 0,
1575 packetStringMessage.isConsentMandatory != 0,
1576 packetStringMessage.msgBytes, packetStringMessage.msgBuffer);
1577 }
1578
1579 return TRUE;
1580}
1581
1582WINPR_ATTR_NODISCARD
1583static BOOL tsg_ndr_read_tunnel_context(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext,
1584 UINT32* tunnelId)
1585{
1586 if (!tsg_stream_align(log, s, 4))
1587 return FALSE;
1588
1589 /* TunnelContext (20 bytes) */
1590 if (!TsProxyReadTunnelContext(log, s, tunnelContext))
1591 return FALSE;
1592
1593 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1594 return FALSE;
1595
1596 WINPR_ASSERT(tunnelId);
1597 Stream_Read_UINT32(s, *tunnelId); /* TunnelId (4 bytes) */
1598
1599 INT32 ReturnValue = 0;
1600 Stream_Read_INT32(s, ReturnValue); /* ReturnValue (4 bytes) */
1601 if (ReturnValue != NO_ERROR)
1602 WLog_Print(log, WLOG_ERROR, "ReturnValue=%s", NtStatus2Tag(ReturnValue));
1603 return TRUE;
1604}
1605
1606WINPR_ATTR_NODISCARD
1607static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(wLog* log, wStream* s,
1608 TSG_PACKET_MSG_RESPONSE* pkt)
1609{
1610
1611 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 16))
1612 return FALSE;
1613
1614 Stream_Read_UINT32(s, pkt->msgID); /* MsgId (4 bytes) */
1615 Stream_Read_UINT32(s, pkt->msgType); /* MsgType (4 bytes) */
1616 Stream_Read_INT32(s, pkt->isMsgPresent); /* IsMsgPresent (4 bytes) */
1617 const uint32_t SwitchValue = Stream_Get_UINT32(s); /* SwitchValue (4 bytes) */
1618
1619 if (pkt->msgType != SwitchValue)
1620 {
1621 WLog_Print(log, WLOG_ERROR,
1622 "[MS-TSGU] 2.2.9.2.1.9 TSG_PACKET_MSG_RESPONSE MsgType[0x%08" PRIx32
1623 "] != MessageSwitchValue [0x%08" PRIx32 "]",
1624 pkt->msgType, SwitchValue);
1625 return FALSE;
1626 }
1627
1628 return TRUE;
1629}
1630
1631WINPR_ATTR_NODISCARD
1632static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(wLog* log, rdpContext* context, wStream* s,
1633 uint32_t* index, uint32_t MsgPtr,
1634 const TSG_PACKET_MSG_RESPONSE* pkg,
1635 uint64_t* reauthContext)
1636{
1637 WINPR_ASSERT(pkg);
1638
1639 if (MsgPtr == 0)
1640 {
1641 WLog_Print(log, WLOG_DEBUG,
1642 "Message {0x%08" PRIx32 "} [%s]::isMsgPresent=%" PRId32 ", MsgPtr=0x%08" PRIx32,
1643 pkg->msgType, tsg_packet_id_to_string(pkg->msgType), pkg->isMsgPresent, MsgPtr);
1644 return TRUE;
1645 }
1646
1647 switch (pkg->msgType)
1648 {
1649 case TSG_ASYNC_MESSAGE_CONSENT_MESSAGE:
1650 case TSG_ASYNC_MESSAGE_SERVICE_MESSAGE:
1651 return tsg_ndr_read_consent_message(log, context, s, index, pkg->msgType,
1652 pkg->isMsgPresent);
1653
1654 case TSG_ASYNC_MESSAGE_REAUTH:
1655 {
1656 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1657 return FALSE;
1658
1659 WINPR_ASSERT(reauthContext);
1660 const uint64_t val = Stream_Get_UINT64(s); /* TunnelContext (8 bytes) */
1661 if (pkg->isMsgPresent != 0)
1662 *reauthContext = val;
1663 return TRUE;
1664 }
1665
1666 default:
1667 WLog_Print(log, WLOG_ERROR, "Unexpected Message Type: 0x%" PRIx32 "", pkg->msgType);
1668 return FALSE;
1669 }
1670}
1671
1672WINPR_ATTR_NODISCARD
1673static BOOL tsg_ndr_read_caps_response(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1674 UINT32 PacketPtr, TSG_PACKET_CAPS_RESPONSE* caps,
1675 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId,
1676 uint64_t* reauthContext)
1677{
1678 UINT32 PacketQuarResponsePtr = 0;
1679
1680 WINPR_ASSERT(context);
1681 WINPR_ASSERT(index);
1682 WINPR_ASSERT(caps);
1683 WINPR_ASSERT(reauthContext);
1684
1685 if (!tsg_ndr_pointer_read(log, s, index, &PacketQuarResponsePtr, TRUE))
1686 goto fail;
1687
1688 if (!tsg_ndr_read_quarenc_response(log, s, index, &caps->pktQuarEncResponse))
1689 goto fail;
1690
1691 if (PacketPtr)
1692 {
1693 TSG_PACKET_MSG_RESPONSE pkg = WINPR_C_ARRAY_INIT;
1694 UINT32 MsgPtr = 0;
1695
1696 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(log, s, &pkg))
1697 goto fail;
1698
1699 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, TRUE))
1700 return FALSE;
1701
1702 if (!tsg_ndr_read_quarenc_data(log, s, index, &caps->pktQuarEncResponse))
1703 goto fail;
1704
1705 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(log, context, s, index, MsgPtr, &pkg,
1706 reauthContext))
1707 goto fail;
1708 }
1709
1710 return tsg_ndr_read_tunnel_context(log, s, tunnelContext, tunnelId);
1711fail:
1712 return FALSE;
1713}
1714
1715WINPR_ATTR_NODISCARD
1716static BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu,
1717 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId)
1718{
1719 BOOL rc = FALSE;
1720 UINT32 index = 0;
1721 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
1722 UINT32 SwitchValue = 0;
1723 rdpContext* context = nullptr;
1724 UINT32 PacketPtr = 0;
1725
1726 WINPR_ASSERT(tsg);
1727 WINPR_ASSERT(tsg->rpc);
1728 WINPR_ASSERT(tsg->rpc->transport);
1729
1730 context = transport_get_context(tsg->rpc->transport);
1731 WINPR_ASSERT(context);
1732
1733 if (!pdu)
1734 return FALSE;
1735
1736 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
1737 goto fail;
1738
1739 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 8))
1740 goto fail;
1741 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
1742 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
1743
1744 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
1745
1746 if ((packet.packetId == TSG_PACKET_TYPE_CAPS_RESPONSE) &&
1747 (SwitchValue == TSG_PACKET_TYPE_CAPS_RESPONSE))
1748 {
1749 if (!tsg_ndr_read_caps_response(tsg->log, context, pdu->s, &index, PacketPtr,
1750 &packet.tsgPacket.packetCapsResponse, tunnelContext,
1751 tunnelId, &tsg->ReauthTunnelContext))
1752 goto fail;
1753 tsg->CapsResponse = packet.tsgPacket.packetCapsResponse.pktQuarEncResponse;
1754 }
1755 else if ((packet.packetId == TSG_PACKET_TYPE_QUARENC_RESPONSE) &&
1756 (SwitchValue == TSG_PACKET_TYPE_QUARENC_RESPONSE))
1757 {
1758 UINT32 PacketQuarResponsePtr = 0;
1759
1760 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketQuarResponsePtr, TRUE))
1761 goto fail;
1762
1763 if (!tsg_ndr_read_quarenc_response(tsg->log, pdu->s, &index,
1764 &packet.tsgPacket.packetQuarEncResponse))
1765 goto fail;
1766
1767 if (!tsg_ndr_read_quarenc_data(tsg->log, pdu->s, &index,
1768 &packet.tsgPacket.packetQuarEncResponse))
1769 goto fail;
1770
1771 if (!tsg_ndr_read_tunnel_context(tsg->log, pdu->s, tunnelContext, tunnelId))
1772 goto fail;
1773
1774 tsg->CapsResponse = packet.tsgPacket.packetQuarEncResponse;
1775 }
1776 else
1777 {
1778 WLog_Print(tsg->log, WLOG_ERROR,
1779 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_CAPS_RESPONSE "
1780 "or TSG_PACKET_TYPE_QUARENC_RESPONSE",
1781 packet.packetId);
1782 goto fail;
1783 }
1784
1785 {
1786 const size_t rem = Stream_GetRemainingLength(pdu->s);
1787 if (rem != 0)
1788 {
1789 WLog_Print(tsg->log, WLOG_WARN, "Partially parsed %s, %" PRIuz " bytes remain",
1790 tsg_packet_id_to_string(packet.packetId), rem);
1791 }
1792 }
1793
1794 rc = TRUE;
1795fail:
1796 return rc;
1797}
1798
1809WINPR_ATTR_NODISCARD
1810static BOOL TsProxyAuthorizeTunnelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
1811{
1812 if (!tsg || !tsg->rpc || !tunnelContext)
1813 return FALSE;
1814
1815 rdpRpc* rpc = tsg->rpc;
1816
1817 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyAuthorizeTunnelWriteRequest");
1818 wStream* s = Stream_New(nullptr, 1024 + sizeof(WCHAR) * tsg->QuarreQuest.nameLength +
1819 tsg->QuarreQuest.dataLen);
1820
1821 if (!s)
1822 return FALSE;
1823
1824 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
1825 {
1826 Stream_Free(s, TRUE);
1827 return FALSE;
1828 }
1829
1830 /* 4-byte alignment */
1831 UINT32 index = 0;
1832 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* PacketId (4 bytes) */
1833 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* SwitchValue (4 bytes) */
1834 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketQuarRequestPtr (4 bytes) */
1835 goto fail;
1836 Stream_Write_UINT32(s, tsg->QuarreQuest.flags); /* Flags (4 bytes) */
1837 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* MachineNamePtr (4 bytes) */
1838 goto fail;
1839 Stream_Write_UINT32(s, tsg->QuarreQuest.nameLength); /* NameLength (4 bytes) */
1840 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* DataPtr (4 bytes) */
1841 goto fail;
1842 Stream_Write_UINT32(s, tsg->QuarreQuest.dataLen); /* DataLength (4 bytes) */
1843 /* MachineName */
1844 if (!tsg_ndr_write_string(tsg->log, s, tsg->QuarreQuest.machineName,
1845 tsg->QuarreQuest.nameLength))
1846 goto fail;
1847 /* data */
1848 if (!tsg_ndr_write_conformant_array(tsg->log, s, tsg->QuarreQuest.data,
1849 tsg->QuarreQuest.dataLen))
1850 goto fail;
1851
1852 Stream_SealLength(s);
1853 return rpc_client_write_call(rpc, s, TsProxyAuthorizeTunnelOpnum);
1854fail:
1855 Stream_Free(s, TRUE);
1856 return FALSE;
1857}
1858
1859WINPR_ATTR_NODISCARD
1860static UINT32 tsg_redir_to_flags(const TSG_REDIRECTION_FLAGS* redirect)
1861{
1862 UINT32 flags = 0;
1863 if (redirect->enableAllRedirections)
1864 flags |= HTTP_TUNNEL_REDIR_ENABLE_ALL;
1865 if (redirect->disableAllRedirections)
1866 flags |= HTTP_TUNNEL_REDIR_DISABLE_ALL;
1867
1868 if (redirect->driveRedirectionDisabled)
1869 flags |= HTTP_TUNNEL_REDIR_DISABLE_DRIVE;
1870 if (redirect->printerRedirectionDisabled)
1871 flags |= HTTP_TUNNEL_REDIR_DISABLE_PRINTER;
1872 if (redirect->portRedirectionDisabled)
1873 flags |= HTTP_TUNNEL_REDIR_DISABLE_PORT;
1874 if (redirect->clipboardRedirectionDisabled)
1875 flags |= HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD;
1876 if (redirect->pnpRedirectionDisabled)
1877 flags |= HTTP_TUNNEL_REDIR_DISABLE_PNP;
1878 return flags;
1879}
1880
1881WINPR_ATTR_NODISCARD
1882static BOOL tsg_redirect_apply(rdpTsg* tsg, const TSG_REDIRECTION_FLAGS* redirect)
1883{
1884 WINPR_ASSERT(tsg);
1885 WINPR_ASSERT(redirect);
1886
1887 rdpTransport* transport = tsg->transport;
1888 WINPR_ASSERT(transport);
1889
1890 rdpContext* context = transport_get_context(transport);
1891 UINT32 redirFlags = tsg_redir_to_flags(redirect);
1892 return utils_apply_gateway_policy(tsg->log, context, redirFlags, "TSG");
1893}
1894
1895WINPR_ATTR_NODISCARD
1896static BOOL tsg_ndr_read_timeout(wLog* log, wStream* s, size_t tlen)
1897{
1898 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1899 return FALSE;
1900
1901 if (tlen < sizeof(UINT32))
1902 {
1903 WLog_Print(log, WLOG_ERROR, "[IDLE_TIMEOUT] array element length %" PRIuz ", expected 4",
1904 tlen);
1905 return FALSE;
1906 }
1907
1908 const UINT32 idleTimeout = Stream_Get_UINT32(s);
1909 WLog_Print(log, WLOG_DEBUG, "[IDLE_TIMEOUT] idleTimeout=%" PRIu32 ": TODO: unused",
1910 idleTimeout);
1911 return TRUE;
1912}
1913
1914WINPR_ATTR_NODISCARD
1915static BOOL tsg_ndr_read_sohr(wLog* log, wStream* s, BOOL expected)
1916{
1917 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1918 return FALSE;
1919
1920 const UINT32 len = Stream_Get_UINT32(s);
1921 if (!expected)
1922 {
1923 if (len != 0)
1924 {
1925 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": skipping", len);
1926 return FALSE;
1927 }
1928 return TRUE;
1929 }
1930 else if (len == 0)
1931 {
1932 WLog_Print(log, WLOG_WARN, "[SOH] len=%" PRIu32 ": expected length > 0", len);
1933 }
1934
1935 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": TODO: unused", len);
1936 if (!Stream_SafeSeek(s, len))
1937 return FALSE;
1938
1939 winpr_HexLogDump(log, WLOG_DEBUG, Stream_Pointer(s), len);
1940 return TRUE;
1941}
1942
1943WINPR_ATTR_NODISCARD
1944static BOOL tsg_ndr_read_packet_response_data(rdpTsg* tsg, wStream* s,
1945 const TSG_PACKET_RESPONSE* response)
1946{
1947 WINPR_ASSERT(tsg);
1948
1949 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1950 return FALSE;
1951
1952 const uint32_t arrayMaxLen = Stream_Get_UINT32(s);
1953 const size_t rem = Stream_GetRemainingLength(s);
1954 if (arrayMaxLen != response->responseDataLen)
1955 {
1956 WLog_Print(tsg->log, WLOG_ERROR,
1957 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1958 " != NDR array len %" PRIu32,
1959 response->responseDataLen, arrayMaxLen);
1960 }
1961 if (response->responseDataLen > 0)
1962 {
1963 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1964 return FALSE;
1965
1966 if (tsg->CapsResponse.versionCaps.tsgCaps.capabilityType != TSG_CAPABILITY_TYPE_NAP)
1967 {
1968 WLog_Print(
1969 tsg->log, WLOG_ERROR,
1970 "2.2.9.2.1.5 TSG_PACKET_RESPONSE Negotiated Capabilities type is 0x%08" PRIx32
1971 ", expected TSG_CAPABILITY_TYPE_NAP[0x00000001]",
1972 tsg->CapsResponse.versionCaps.tsgCaps.capabilityType);
1973 return FALSE;
1974 }
1975 const UINT32 mask = (TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT);
1976 const UINT32 val =
1977 (tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities & mask);
1978 if ((val == mask) && (tsg->QuarreQuest.dataLen > 0))
1979 {
1980 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1981 return FALSE;
1982 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1983 return FALSE;
1984 }
1985 else if ((val == TSG_NAP_CAPABILITY_QUAR_SOH) && (tsg->QuarreQuest.dataLen > 0))
1986 {
1987 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1988 return FALSE;
1989 }
1990 else if ((val & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
1991 {
1992 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1993 return FALSE;
1994 if (!tsg_ndr_read_sohr(tsg->log, s, FALSE))
1995 return FALSE;
1996 }
1997 else
1998 {
1999 WLog_Print(
2000 tsg->log, WLOG_ERROR,
2001 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
2002 ", but neither TSG_NAP_CAPABILITY_QUAR_SOH nor "
2003 "TSG_NAP_CAPABILITY_IDLE_TIMEOUT are set, so expecting 0 (actually got %" PRIuz ")",
2004 response->responseDataLen, rem);
2005 return FALSE;
2006 }
2007 }
2008 else if (rem > 0)
2009 {
2010 char buffer[256] = WINPR_C_ARRAY_INIT;
2011 WLog_Print(tsg->log, WLOG_WARN,
2012 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
2013 ", but actually got %" PRIuz " [flags=%s], ignoring.",
2014 response->responseDataLen, rem,
2015 tsg_caps_to_string(
2016 tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities,
2017 buffer, sizeof(buffer)));
2018 if (!Stream_SafeSeek(s, rem))
2019 return FALSE;
2020 }
2021
2022 {
2023 const size_t trem = Stream_GetRemainingLength(s);
2024 if (trem > 0)
2025 {
2026 WLog_Print(tsg->log, WLOG_WARN,
2027 "2.2.9.2.1.5 TSG_PACKET_RESPONSE %" PRIuz " unhandled bytes remain", trem);
2028 }
2029 }
2030 return TRUE;
2031}
2032
2033WINPR_ATTR_NODISCARD
2034static BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
2035{
2036 BOOL rc = FALSE;
2037 UINT32 SwitchValue = 0;
2038 UINT32 index = 0;
2039 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
2040 UINT32 PacketPtr = 0;
2041 UINT32 PacketResponseDataPtr = 0;
2042
2043 WINPR_ASSERT(tsg);
2044 WINPR_ASSERT(pdu);
2045
2046 wLog* log = tsg->log;
2047 WINPR_ASSERT(log);
2048
2049 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketPtr, TRUE))
2050 goto fail;
2051
2052 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
2053 goto fail;
2054 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
2055 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
2056
2057 WLog_Print(log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
2058
2059 if (packet.packetId == E_PROXY_NAP_ACCESSDENIED)
2060 {
2061 WLog_Print(log, WLOG_ERROR, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)",
2062 E_PROXY_NAP_ACCESSDENIED);
2063 WLog_Print(log, WLOG_ERROR,
2064 "Ensure that the Gateway Connection Authorization Policy is correct");
2065 goto fail;
2066 }
2067
2068 if ((packet.packetId != TSG_PACKET_TYPE_RESPONSE) || (SwitchValue != TSG_PACKET_TYPE_RESPONSE))
2069 {
2070 WLog_Print(log, WLOG_ERROR,
2071 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_RESPONSE",
2072 packet.packetId);
2073 goto fail;
2074 }
2075
2076 if (!tsg_ndr_pointer_read(log, pdu->s, &index, nullptr, TRUE))
2077 goto fail;
2078
2079 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
2080 goto fail;
2081
2082 packet.tsgPacket.packetResponse.flags = Stream_Get_UINT32(pdu->s);
2083 if (packet.tsgPacket.packetResponse.flags != TSG_PACKET_TYPE_QUARREQUEST)
2084 {
2085 WLog_Print(log, WLOG_ERROR,
2086 "Unexpected Packet Response flags: 0x%08" PRIX32
2087 ", Expected TSG_PACKET_TYPE_QUARREQUEST",
2088 packet.tsgPacket.packetResponse.flags);
2089 goto fail;
2090 }
2091
2092 packet.tsgPacket.packetResponse.reserved = Stream_Get_UINT32(pdu->s);
2093
2094 packet.tsgPacket.packetResponse.responseData = nullptr;
2095 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketResponseDataPtr, FALSE))
2096 goto fail;
2097
2098 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 4))
2099 goto fail;
2100
2101 packet.tsgPacket.packetResponse.responseDataLen = Stream_Get_UINT32(pdu->s);
2102 if (packet.tsgPacket.packetResponse.responseDataLen > 24000)
2103 {
2104 WLog_Print(log, WLOG_ERROR,
2105 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32 " > maximum(24000)",
2106 packet.tsgPacket.packetResponse.responseDataLen);
2107 goto fail;
2108 }
2109 if ((PacketResponseDataPtr == 0) && (packet.tsgPacket.packetResponse.responseDataLen != 0))
2110 {
2111 WLog_Print(log, WLOG_ERROR,
2112 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32
2113 " but responseData = nullptr",
2114 packet.tsgPacket.packetResponse.responseDataLen);
2115 goto fail;
2116 }
2117
2118 if (!tsg_ndr_read_packet_redirection_flags(log, pdu->s,
2119 &packet.tsgPacket.packetResponse.redirectionFlags))
2120 goto fail;
2121
2122 packet.tsgPacket.packetResponse.responseData = Stream_Pointer(pdu->s);
2123 if (!tsg_ndr_read_packet_response_data(tsg, pdu->s, &packet.tsgPacket.packetResponse))
2124 goto fail;
2125
2126 rc = tsg_redirect_apply(tsg, &packet.tsgPacket.packetResponse.redirectionFlags);
2127
2128fail:
2129 return rc;
2130}
2131
2143WINPR_ATTR_NODISCARD
2144static BOOL TsProxyMakeTunnelCallWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext,
2145 UINT32 procId)
2146{
2147 wStream* s = nullptr;
2148 rdpRpc* rpc = nullptr;
2149
2150 if (!tsg || !tsg->rpc || !tunnelContext)
2151 return FALSE;
2152
2153 rpc = tsg->rpc;
2154 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyMakeTunnelCallWriteRequest");
2155 s = Stream_New(nullptr, 40);
2156
2157 if (!s)
2158 return FALSE;
2159
2160 /* TunnelContext (20 bytes) */
2161 UINT32 index = 0;
2162 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2163 goto fail;
2164 Stream_Write_UINT32(s, procId); /* ProcId (4 bytes) */
2165 /* 4-byte alignment */
2166 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* PacketId (4 bytes) */
2167 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* SwitchValue (4 bytes) */
2168 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketMsgRequestPtr (4 bytes) */
2169 goto fail;
2170 Stream_Write_UINT32(s, 0x00000001); /* MaxMessagesPerBatch (4 bytes) */
2171 return rpc_client_write_call(rpc, s, TsProxyMakeTunnelCallOpnum);
2172fail:
2173 Stream_Free(s, TRUE);
2174 return FALSE;
2175}
2176
2177WINPR_ATTR_NODISCARD
2178static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
2179 TSG_PACKET_STRING_MESSAGE* msg)
2180{
2181 UINT32 MsgPtr = 0;
2182
2183 WINPR_ASSERT(msg);
2184
2185 const TSG_PACKET_STRING_MESSAGE empty = WINPR_C_ARRAY_INIT;
2186 *msg = empty;
2187
2188 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
2189 return FALSE;
2190
2191 Stream_Read_INT32(s, msg->isDisplayMandatory); /* IsDisplayMandatory (4 bytes) */
2192 Stream_Read_INT32(s, msg->isConsentMandatory); /* IsConsentMandatory (4 bytes) */
2193 Stream_Read_UINT32(s, msg->msgBytes); /* MsgBytes (4 bytes) */
2194
2195 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, msg->msgBytes != 0))
2196 return FALSE;
2197
2198 if (msg->msgBytes > TSG_MESSAGING_MAX_MESSAGE_LENGTH)
2199 {
2200 WLog_Print(log, WLOG_ERROR, "Out of Spec Message Length %" PRIu32 "", msg->msgBytes);
2201 return FALSE;
2202 }
2203
2204 if (msg->msgBytes == 0)
2205 {
2206 WLog_Print(log, WLOG_DEBUG, "Empty message, skipping string read");
2207 return TRUE;
2208 }
2209
2210 return tsg_ndr_read_string(log, s, &msg->msgBuffer, &msg->msgBytes);
2211}
2212
2213WINPR_ATTR_NODISCARD
2214static BOOL TsProxyMakeTunnelCallReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
2215{
2216 BOOL rc = FALSE;
2217 UINT32 index = 0;
2218 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
2219 rdpContext* context = nullptr;
2220 TSG_PACKET_MSG_RESPONSE packetMsgResponse = WINPR_C_ARRAY_INIT;
2221 UINT32 PacketPtr = 0;
2222 UINT32 PacketMsgResponsePtr = 0;
2223
2224 WINPR_ASSERT(tsg);
2225 WINPR_ASSERT(tsg->rpc);
2226
2227 context = transport_get_context(tsg->rpc->transport);
2228 WINPR_ASSERT(context);
2229
2230 /* This is an asynchronous response */
2231
2232 if (!pdu)
2233 return FALSE;
2234
2235 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 28))
2236 goto fail;
2237
2238 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
2239 goto fail;
2240
2241 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
2242
2243 {
2244 const uint32_t SwitchValue = Stream_Get_UINT32(pdu->s); /* SwitchValue (4 bytes) */
2245 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
2246
2247 if ((packet.packetId != TSG_PACKET_TYPE_MESSAGE_PACKET) || (packet.packetId != SwitchValue))
2248 {
2249 WLog_Print(tsg->log, WLOG_ERROR,
2250 "Unexpected PacketId: 0x%08" PRIX32
2251 ", Expected TSG_PACKET_TYPE_MESSAGE_PACKET",
2252 packet.packetId);
2253 goto fail;
2254 }
2255 }
2256
2257 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketMsgResponsePtr, TRUE))
2258 goto fail;
2259
2260 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(tsg->log, pdu->s, &packetMsgResponse))
2261 goto fail;
2262
2263 {
2264 UINT32 MessagePtr = 0;
2265 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &MessagePtr, TRUE))
2266 goto fail;
2267
2268 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(tsg->log, context, pdu->s, &index, MessagePtr,
2269 &packetMsgResponse, &tsg->ReauthTunnelContext))
2270 goto fail;
2271 }
2272
2273 rc = TRUE;
2274fail:
2275 return rc;
2276}
2277
2288WINPR_ATTR_NODISCARD
2289static BOOL TsProxyCreateChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
2290{
2291 WINPR_ASSERT(tsg);
2292 WINPR_ASSERT(tunnelContext);
2293
2294 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCreateChannelWriteRequest");
2295
2296 if (!tsg->rpc || !tsg->Hostname)
2297 return FALSE;
2298
2299 rdpRpc* rpc = tsg->rpc;
2300 const size_t count = _wcslen(tsg->Hostname) + 1;
2301 if (count > UINT32_MAX)
2302 return FALSE;
2303
2304 wStream* s = Stream_New(nullptr, 60 + count * 2);
2305 if (!s)
2306 return FALSE;
2307
2308 /* TunnelContext (20 bytes) */
2309 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2310 goto fail;
2311
2312 /* TSENDPOINTINFO */
2313 {
2314 UINT32 index = 0;
2315 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2316 goto fail;
2317 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2318 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 0))
2319 goto fail;
2320 }
2321
2322 Stream_Write_UINT16(s, 0x0000); /* NumAlternateResourceNames (2 bytes) */
2323 Stream_Write_UINT16(s, 0x0000); /* Pad (2 bytes) */
2324 /* Port (4 bytes) */
2325 Stream_Write_UINT16(s, 0x0003); /* ProtocolId (RDP = 3) (2 bytes) */
2326 Stream_Write_UINT16(s, tsg->Port); /* PortNumber (0xD3D = 3389) (2 bytes) */
2327 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2328 {
2329 UINT32 index = 0;
2330 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2331 goto fail;
2332 }
2333 if (!tsg_ndr_write_string(tsg->log, s, tsg->Hostname, count))
2334 goto fail;
2335 return rpc_client_write_call(rpc, s, TsProxyCreateChannelOpnum);
2336
2337fail:
2338 Stream_Free(s, TRUE);
2339 return FALSE;
2340}
2341
2342WINPR_ATTR_NODISCARD
2343static BOOL TsProxyCreateChannelReadResponse(wLog* log, const RPC_PDU* pdu,
2344 CONTEXT_HANDLE* channelContext, UINT32* channelId)
2345{
2346 BOOL rc = FALSE;
2347
2348 WINPR_ASSERT(log);
2349 WINPR_ASSERT(pdu);
2350 WINPR_ASSERT(channelId);
2351
2352 WLog_Print(log, WLOG_DEBUG, "TsProxyCreateChannelReadResponse");
2353
2354 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 28))
2355 goto fail;
2356
2357 /* ChannelContext (20 bytes) */
2358 if (!TsProxyReadTunnelContext(log, pdu->s, channelContext))
2359 goto fail;
2360 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, pdu->s, 2, sizeof(UINT32)))
2361 goto fail;
2362 Stream_Read_UINT32(pdu->s, *channelId); /* ChannelId (4 bytes) */
2363 Stream_Seek_UINT32(pdu->s); /* ReturnValue (4 bytes) */
2364 rc = TRUE;
2365fail:
2366 return rc;
2367}
2368
2374WINPR_ATTR_NODISCARD
2375static BOOL TsProxyCloseChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* context)
2376{
2377 WINPR_ASSERT(tsg);
2378 WINPR_ASSERT(context);
2379
2380 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseChannelWriteRequest");
2381
2382 rdpRpc* rpc = tsg->rpc;
2383 WINPR_ASSERT(rpc);
2384
2385 wStream* s = Stream_New(nullptr, 20);
2386
2387 if (!s)
2388 return FALSE;
2389
2390 /* ChannelContext (20 bytes) */
2391 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2392 goto fail;
2393 return rpc_client_write_call(rpc, s, TsProxyCloseChannelOpnum);
2394fail:
2395 Stream_Free(s, TRUE);
2396 return FALSE;
2397}
2398
2399WINPR_ATTR_NODISCARD
2400static BOOL TsProxyCloseChannelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2401{
2402 BOOL rc = FALSE;
2403 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseChannelReadResponse");
2404
2405 if (!pdu)
2406 return FALSE;
2407
2408 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2409 goto fail;
2410
2411 /* ChannelContext (20 bytes) */
2412 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2413 goto fail;
2414
2415 {
2416 const size_t len = sizeof(UINT32);
2417 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2418 goto fail;
2419 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2420 rc = TRUE;
2421 }
2422fail:
2423 return rc;
2424}
2425
2431WINPR_ATTR_NODISCARD
2432static BOOL TsProxyCloseTunnelWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* context)
2433{
2434 WINPR_ASSERT(tsg);
2435 WINPR_ASSERT(context);
2436
2437 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseTunnelWriteRequest");
2438
2439 rdpRpc* rpc = tsg->rpc;
2440 WINPR_ASSERT(rpc);
2441
2442 wStream* s = Stream_New(nullptr, 20);
2443
2444 if (!s)
2445 return FALSE;
2446
2447 /* TunnelContext (20 bytes) */
2448 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2449 goto fail;
2450 return rpc_client_write_call(rpc, s, TsProxyCloseTunnelOpnum);
2451fail:
2452 Stream_Free(s, TRUE);
2453 return FALSE;
2454}
2455
2456WINPR_ATTR_NODISCARD
2457static BOOL TsProxyCloseTunnelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2458{
2459 BOOL rc = FALSE;
2460
2461 WINPR_ASSERT(log);
2462 WINPR_ASSERT(pdu);
2463 WINPR_ASSERT(context);
2464
2465 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseTunnelReadResponse");
2466
2467 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2468 goto fail;
2469
2470 /* TunnelContext (20 bytes) */
2471 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2472 goto fail;
2473 {
2474 const size_t len = sizeof(UINT32);
2475 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2476 goto fail;
2477 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2478 rc = TRUE;
2479 }
2480fail:
2481 return rc;
2482}
2483
2491WINPR_ATTR_NODISCARD
2492static BOOL TsProxySetupReceivePipeWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* channelContext)
2493{
2494 wStream* s = nullptr;
2495 rdpRpc* rpc = nullptr;
2496 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxySetupReceivePipeWriteRequest");
2497
2498 WINPR_ASSERT(tsg);
2499 WINPR_ASSERT(tsg->rpc);
2500
2501 if (!channelContext)
2502 return FALSE;
2503
2504 rpc = tsg->rpc;
2505 s = Stream_New(nullptr, 20);
2506
2507 if (!s)
2508 return FALSE;
2509
2510 /* ChannelContext (20 bytes) */
2511 if (!TsProxyWriteTunnelContext(tsg->log, s, channelContext))
2512 goto fail;
2513 return rpc_client_write_call(rpc, s, TsProxySetupReceivePipeOpnum);
2514fail:
2515 Stream_Free(s, TRUE);
2516 return FALSE;
2517}
2518
2519static BOOL tsg_transition_to_state(rdpTsg* tsg, TSG_STATE state)
2520{
2521 WINPR_ASSERT(tsg);
2522 const char* oldState = tsg_state_to_string(tsg->state);
2523 const char* newState = tsg_state_to_string(state);
2524
2525 WLog_Print(tsg->log, WLOG_DEBUG, "%s -> %s", oldState, newState);
2526 return tsg_set_state(tsg, state);
2527}
2528
2529WINPR_ATTR_NODISCARD
2530static BOOL tsg_initialize_version_caps(const rdpTsg* tsg,
2531 TSG_PACKET_VERSIONCAPS* packetVersionCaps)
2532{
2533 WINPR_ASSERT(tsg);
2534 WINPR_ASSERT(packetVersionCaps);
2535
2536 packetVersionCaps->tsgHeader.ComponentId = TS_GATEWAY_TRANSPORT;
2537 packetVersionCaps->tsgHeader.PacketId = TSG_PACKET_TYPE_VERSIONCAPS;
2538 packetVersionCaps->numCapabilities = 1;
2539 packetVersionCaps->majorVersion = 1;
2540 packetVersionCaps->minorVersion = 1;
2541 packetVersionCaps->quarantineCapabilities = 0;
2542 packetVersionCaps->tsgCaps.capabilityType = TSG_CAPABILITY_TYPE_NAP;
2543 /*
2544 * Using reduced capabilities appears to trigger
2545 * TSG_PACKET_TYPE_QUARENC_RESPONSE instead of TSG_PACKET_TYPE_CAPS_RESPONSE
2546 *
2547 * However, reduced capabilities may break connectivity with servers enforcing features,
2548 * such as "Only allow connections from Remote Desktop Services clients that support RD
2549 * Gateway messaging"
2550 */
2551
2552 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities =
2553 TSG_NAP_CAPABILITY_IDLE_TIMEOUT | TSG_MESSAGING_CAP_CONSENT_SIGN |
2554 TSG_MESSAGING_CAP_SERVICE_MSG | TSG_MESSAGING_CAP_REAUTH;
2555 if (tsg->QuarreQuest.dataLen > 0)
2556 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities |= TSG_NAP_CAPABILITY_QUAR_SOH;
2557
2558 return TRUE;
2559}
2560
2561static void resetCaps(rdpTsg* tsg)
2562{
2563 WINPR_ASSERT(tsg);
2564 const TSG_PACKET_QUARENC_RESPONSE empty = WINPR_C_ARRAY_INIT;
2565 tsg->CapsResponse = empty;
2566}
2567
2568BOOL tsg_proxy_begin(rdpTsg* tsg)
2569{
2570 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2571
2572 WINPR_ASSERT(tsg);
2573
2574 tsgPacket.packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2575 if (!tsg_initialize_version_caps(tsg, &tsgPacket.tsgPacket.packetVersionCaps) ||
2576 !TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2577 {
2578 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2579 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2580 return FALSE;
2581 }
2582
2583 resetCaps(tsg);
2584
2585 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2586}
2587
2588WINPR_ATTR_NODISCARD
2589static BOOL tsg_proxy_reauth(rdpTsg* tsg)
2590{
2591 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2592
2593 WINPR_ASSERT(tsg);
2594
2595 tsg->reauthSequence = TRUE;
2596 TSG_PACKET_REAUTH* packetReauth = &tsgPacket.tsgPacket.packetReauth;
2597
2598 tsgPacket.packetId = TSG_PACKET_TYPE_REAUTH;
2599 packetReauth->tunnelContext = tsg->ReauthTunnelContext;
2600 packetReauth->packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2601
2602 if (!tsg_initialize_version_caps(tsg, &packetReauth->tsgInitialPacket.packetVersionCaps))
2603 return FALSE;
2604
2605 if (!TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2606 {
2607 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2608 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2609 return FALSE;
2610 }
2611
2612 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2613 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2614 {
2615 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2616 (void)tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2617 return FALSE;
2618 }
2619
2620 resetCaps(tsg);
2621 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2622}
2623
2624WINPR_ATTR_NODISCARD
2625static BOOL tsg_recv_authorized(rdpTsg* tsg, const RPC_PDU* pdu)
2626{
2627 BOOL rc = FALSE;
2628
2629 WINPR_ASSERT(tsg);
2630 WINPR_ASSERT(pdu);
2631
2632 rdpRpc* rpc = tsg->rpc;
2633 WINPR_ASSERT(rpc);
2634
2635 RpcClientCall* call = rpc_client_call_find_by_id(rpc->log, rpc->client, pdu->CallId);
2636
2637 if (!call)
2638 return FALSE;
2639
2640 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2641 {
2642 if (!TsProxyMakeTunnelCallReadResponse(tsg, pdu))
2643 {
2644 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2645 return FALSE;
2646 }
2647 }
2648 else if (call->OpNum == TsProxyCreateChannelOpnum)
2649 {
2650 CONTEXT_HANDLE ChannelContext;
2651
2652 if (!TsProxyCreateChannelReadResponse(tsg->log, pdu, &ChannelContext, &tsg->ChannelId))
2653 {
2654 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannelReadResponse failure");
2655 return FALSE;
2656 }
2657
2658 if (!tsg->reauthSequence)
2659 CopyMemory(&tsg->ChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2660 else
2661 CopyMemory(&tsg->NewChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2662
2663 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CREATED))
2664 return FALSE;
2665
2666 if (!tsg->reauthSequence)
2667 {
2668 if (!TsProxySetupReceivePipeWriteRequest(tsg, &tsg->ChannelContext))
2669 {
2670 WLog_Print(tsg->log, WLOG_ERROR, "TsProxySetupReceivePipe failure");
2671 return FALSE;
2672 }
2673 }
2674 else
2675 {
2676 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->NewChannelContext))
2677 {
2678 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2679 return FALSE;
2680 }
2681
2682 if (!TsProxyCloseTunnelWriteRequest(tsg, &tsg->NewTunnelContext))
2683 {
2684 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelWriteRequest failure");
2685 return FALSE;
2686 }
2687 }
2688
2689 rc = tsg_transition_to_state(tsg, TSG_STATE_PIPE_CREATED);
2690 tsg->reauthSequence = FALSE;
2691 }
2692 else
2693 {
2694 WLog_Print(tsg->log, WLOG_ERROR, "TSG_STATE_AUTHORIZED unexpected OpNum: %" PRIu32 "\n",
2695 call->OpNum);
2696 }
2697 return rc;
2698}
2699
2700WINPR_ATTR_NODISCARD
2701static BOOL tsg_recv_pipe_created(rdpTsg* tsg, const RPC_PDU* pdu)
2702{
2703 BOOL rc = FALSE;
2704
2705 WINPR_ASSERT(tsg);
2706 WINPR_ASSERT(pdu);
2707
2708 rdpRpc* rpc = tsg->rpc;
2709 WINPR_ASSERT(rpc);
2710
2711 RpcClientCall* call = rpc_client_call_find_by_id(rpc->log, rpc->client, pdu->CallId);
2712
2713 if (!call)
2714 return FALSE;
2715
2716 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2717 {
2718 rc = TsProxyMakeTunnelCallReadResponse(tsg, pdu);
2719 if (!rc)
2720 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2721 }
2722 else if (call->OpNum == TsProxyCreateChannelOpnum)
2723 {
2724 CONTEXT_HANDLE ChannelContext;
2725
2726 rc = TsProxyCreateChannelReadResponse(tsg->log, pdu, &ChannelContext, &tsg->ChannelId);
2727 if (!rc)
2728 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannelReadResponse failure");
2729 else
2730 {
2731 if (!tsg->reauthSequence)
2732 CopyMemory(&tsg->ChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2733 else
2734 CopyMemory(&tsg->NewChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2735
2736 rc = tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CREATED);
2737 if (rc)
2738 {
2739 if (!tsg->reauthSequence)
2740 {
2741 rc = TsProxySetupReceivePipeWriteRequest(tsg, &tsg->ChannelContext);
2742 if (!rc)
2743 WLog_Print(tsg->log, WLOG_ERROR, "TsProxySetupReceivePipe failure");
2744 }
2745 else
2746 {
2747 rc = TsProxyCloseChannelWriteRequest(tsg, &tsg->NewChannelContext);
2748 if (!rc)
2749 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2750 else
2751 {
2752 rc = TsProxyCloseTunnelWriteRequest(tsg, &tsg->NewTunnelContext);
2753 if (!rc)
2754 WLog_Print(tsg->log, WLOG_ERROR,
2755 "TsProxyCloseTunnelWriteRequest failure");
2756 }
2757 }
2758
2759 if (rc)
2760 {
2761 rc = tsg_transition_to_state(tsg, TSG_STATE_PIPE_CREATED);
2762 tsg->reauthSequence = FALSE;
2763 }
2764 }
2765 }
2766 }
2767 else
2768 {
2769 WLog_Print(tsg->log, WLOG_ERROR, "TSG_STATE_AUTHORIZED unexpected OpNum: %" PRIu32 "\n",
2770 call->OpNum);
2771 }
2772 return rc;
2773}
2774
2775BOOL tsg_recv_pdu(rdpTsg* tsg, const RPC_PDU* pdu)
2776{
2777 BOOL rc = FALSE;
2778
2779 WINPR_ASSERT(tsg);
2780 WINPR_ASSERT(pdu);
2781
2782 if (!(pdu->Flags & RPC_PDU_FLAG_STUB))
2783 {
2784 const size_t len = 24;
2785 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, len))
2786 return FALSE;
2787 Stream_Seek(pdu->s, len);
2788 }
2789
2790 const TSG_STATE oldState = tsg->state;
2791 switch (tsg->state)
2792 {
2793 case TSG_STATE_INITIAL:
2794 {
2795 CONTEXT_HANDLE* TunnelContext = nullptr;
2796 TunnelContext = (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2797
2798 if (!TsProxyCreateTunnelReadResponse(tsg, pdu, TunnelContext, &tsg->TunnelId))
2799 {
2800 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnelReadResponse failure");
2801 return FALSE;
2802 }
2803
2804 if (!tsg_transition_to_state(tsg, TSG_STATE_CONNECTED))
2805 return FALSE;
2806
2807 if (!TsProxyAuthorizeTunnelWriteRequest(tsg, TunnelContext))
2808 {
2809 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnel failure");
2810 return FALSE;
2811 }
2812
2813 rc = TRUE;
2814 }
2815 break;
2816
2817 case TSG_STATE_CONNECTED:
2818 {
2819 CONTEXT_HANDLE* TunnelContext =
2820 (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2821
2822 if (!TsProxyAuthorizeTunnelReadResponse(tsg, pdu))
2823 {
2824 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnelReadResponse failure");
2825 return FALSE;
2826 }
2827
2828 if (!tsg_transition_to_state(tsg, TSG_STATE_AUTHORIZED))
2829 return FALSE;
2830
2831 if (!tsg->reauthSequence)
2832 {
2833 if (!TsProxyMakeTunnelCallWriteRequest(tsg, TunnelContext,
2834 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2835 {
2836 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2837 return FALSE;
2838 }
2839 }
2840
2841 if (!TsProxyCreateChannelWriteRequest(tsg, TunnelContext))
2842 {
2843 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannel failure");
2844 return FALSE;
2845 }
2846
2847 rc = TRUE;
2848 }
2849 break;
2850
2851 case TSG_STATE_AUTHORIZED:
2852 rc = tsg_recv_authorized(tsg, pdu);
2853 break;
2854
2855 case TSG_STATE_CHANNEL_CREATED:
2856 break;
2857
2858 case TSG_STATE_PIPE_CREATED:
2859 rc = tsg_recv_pipe_created(tsg, pdu);
2860 break;
2861
2862 case TSG_STATE_TUNNEL_CLOSE_PENDING:
2863 {
2864 CONTEXT_HANDLE ChannelContext;
2865
2866 if (!TsProxyCloseChannelReadResponse(tsg->log, pdu, &ChannelContext))
2867 {
2868 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelReadResponse failure");
2869 return FALSE;
2870 }
2871
2872 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING))
2873 return FALSE;
2874
2875 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->ChannelContext))
2876 {
2877 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2878 return FALSE;
2879 }
2880
2881 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2882 TSG_TUNNEL_CANCEL_ASYNC_MSG_REQUEST))
2883 {
2884 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2885 return FALSE;
2886 }
2887
2888 rc = TRUE;
2889 }
2890 break;
2891
2892 case TSG_STATE_CHANNEL_CLOSE_PENDING:
2893 {
2894 CONTEXT_HANDLE TunnelContext;
2895
2896 if (!TsProxyCloseTunnelReadResponse(tsg->log, pdu, &TunnelContext))
2897 {
2898 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelReadResponse failure");
2899 return FALSE;
2900 }
2901
2902 rc = tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2903 }
2904 break;
2905
2906 case TSG_STATE_FINAL:
2907 break;
2908 default:
2909 break;
2910 }
2911
2912 {
2913 const size_t rem = Stream_GetRemainingLength(pdu->s);
2914 if (rem > 0)
2915 {
2916 WLog_Print(tsg->log, WLOG_WARN, "[%s] unparsed bytes: %" PRIuz,
2917 tsg_state_to_string(oldState), rem);
2918 }
2919 }
2920
2921 rpc_client_call_advance(tsg->rpc->log, tsg->rpc->client, pdu->CallId,
2922 RPC_CLIENT_CALL_STATE_RECEIVE_PDU, rc);
2923 if (!rc)
2924 rpc_client_call_discard(tsg->rpc->log, tsg->rpc->client, pdu->CallId);
2925 return rc;
2926}
2927
2928BOOL tsg_check_event_handles(rdpTsg* tsg)
2929{
2930 WINPR_ASSERT(tsg);
2931 if (rpc_client_in_channel_recv(tsg->rpc) < 0)
2932 return FALSE;
2933
2934 if (rpc_client_out_channel_recv(tsg->rpc) < 0)
2935 return FALSE;
2936
2937 return TRUE;
2938}
2939
2940DWORD tsg_get_event_handles(rdpTsg* tsg, HANDLE* events, DWORD count)
2941{
2942 UINT32 nCount = 0;
2943 rdpRpc* rpc = tsg->rpc;
2944 RpcVirtualConnection* connection = rpc->VirtualConnection;
2945
2946 if (events && (nCount < count))
2947 {
2948 events[nCount] = rpc->client->PipeEvent;
2949 nCount++;
2950 }
2951 else
2952 return 0;
2953
2954 if (connection->DefaultInChannel && connection->DefaultInChannel->common.tls)
2955 {
2956 if (events && (nCount < count))
2957 {
2958 BIO_get_event(connection->DefaultInChannel->common.tls->bio, &events[nCount]);
2959 nCount++;
2960 }
2961 else
2962 return 0;
2963 }
2964
2965 if (connection->NonDefaultInChannel && connection->NonDefaultInChannel->common.tls)
2966 {
2967 if (events && (nCount < count))
2968 {
2969 BIO_get_event(connection->NonDefaultInChannel->common.tls->bio, &events[nCount]);
2970 nCount++;
2971 }
2972 else
2973 return 0;
2974 }
2975
2976 if (connection->DefaultOutChannel && connection->DefaultOutChannel->common.tls)
2977 {
2978 if (events && (nCount < count))
2979 {
2980 BIO_get_event(connection->DefaultOutChannel->common.tls->bio, &events[nCount]);
2981 nCount++;
2982 }
2983 else
2984 return 0;
2985 }
2986
2987 if (connection->NonDefaultOutChannel && connection->NonDefaultOutChannel->common.tls)
2988 {
2989 if (events && (nCount < count))
2990 {
2991 BIO_get_event(connection->NonDefaultOutChannel->common.tls->bio, &events[nCount]);
2992 nCount++;
2993 }
2994 else
2995 return 0;
2996 }
2997
2998 return nCount;
2999}
3000
3001WINPR_ATTR_NODISCARD
3002static BOOL tsg_set_hostname(rdpTsg* tsg, const char* hostname)
3003{
3004 WINPR_ASSERT(tsg);
3005 free(tsg->Hostname);
3006 tsg->Hostname = ConvertUtf8ToWCharAlloc(hostname, nullptr);
3007 return tsg->Hostname != nullptr;
3008}
3009
3010WINPR_ATTR_NODISCARD
3011static BOOL tsg_set_machine_name(rdpTsg* tsg, const char* machineName)
3012{
3013 WINPR_ASSERT(tsg);
3014
3015 free(tsg->QuarreQuest.machineName);
3016 tsg->QuarreQuest.machineName = nullptr;
3017 tsg->QuarreQuest.nameLength = 0;
3018 if (!machineName)
3019 return FALSE;
3020
3021 size_t size = 0;
3022 tsg->QuarreQuest.machineName = ConvertUtf8ToWCharAlloc(machineName, &size);
3023 tsg->QuarreQuest.nameLength = WINPR_ASSERTING_INT_CAST(uint32_t, size + 1ull);
3024 return tsg->QuarreQuest.machineName && (size > 0);
3025}
3026
3027BOOL tsg_connect(rdpTsg* tsg, const char* hostname, UINT16 port, DWORD timeout)
3028{
3029 UINT64 looptimeout = timeout * 1000ULL;
3030 DWORD nCount = 0;
3031 HANDLE events[MAXIMUM_WAIT_OBJECTS] = WINPR_C_ARRAY_INIT;
3032
3033 WINPR_ASSERT(tsg);
3034
3035 rdpRpc* rpc = tsg->rpc;
3036 WINPR_ASSERT(rpc);
3037
3038 rdpTransport* transport = rpc->transport;
3039 rdpContext* context = transport_get_context(transport);
3040 WINPR_ASSERT(context);
3041
3042 rdpSettings* settings = context->settings;
3043
3044 freerdp_set_last_error(context, ERROR_SUCCESS);
3045
3046 tsg->Port = port;
3047 tsg->transport = transport;
3048
3049 {
3050 const UINT32 GatewayPort = freerdp_settings_get_uint32(settings, FreeRDP_GatewayPort);
3051 if (GatewayPort == 0)
3052 {
3053 if (!freerdp_settings_set_uint32(settings, FreeRDP_GatewayPort, 443))
3054 return FALSE;
3055 }
3056 }
3057
3058 if (!tsg_set_hostname(tsg, hostname))
3059 return FALSE;
3060
3061 const char* ComputerName = freerdp_settings_get_string(settings, FreeRDP_ComputerName);
3062 if (!tsg_set_machine_name(tsg, ComputerName))
3063 return FALSE;
3064
3065 if (!rpc_connect(rpc, timeout))
3066 {
3067 WLog_Print(tsg->log, WLOG_ERROR, "rpc_connect error!");
3068 return FALSE;
3069 }
3070
3071 nCount = tsg_get_event_handles(tsg, events, ARRAYSIZE(events));
3072
3073 if (nCount == 0)
3074 return FALSE;
3075
3076 while (tsg->state != TSG_STATE_PIPE_CREATED)
3077 {
3078 const DWORD polltimeout = 250;
3079 DWORD status = WaitForMultipleObjects(nCount, events, FALSE, polltimeout);
3080 if (status == WAIT_TIMEOUT)
3081 {
3082 if (timeout > 0)
3083 {
3084 if (looptimeout < polltimeout)
3085 return FALSE;
3086 looptimeout -= polltimeout;
3087 }
3088 }
3089 else
3090 looptimeout = timeout * 1000ULL;
3091
3092 if (!tsg_check_event_handles(tsg))
3093 {
3094 WLog_Print(tsg->log, WLOG_ERROR, "tsg_check failure");
3095 transport_set_layer(transport, TRANSPORT_LAYER_CLOSED);
3096 return FALSE;
3097 }
3098 }
3099
3100 WLog_Print(tsg->log, WLOG_INFO, "TS Gateway Connection Success");
3101 tsg->bio = BIO_new(BIO_s_tsg());
3102
3103 if (!tsg->bio)
3104 return FALSE;
3105
3106 BIO_set_data(tsg->bio, (void*)tsg);
3107 return TRUE;
3108}
3109
3110BOOL tsg_disconnect(rdpTsg* tsg)
3111{
3131 if (!tsg)
3132 return FALSE;
3133
3134 if (tsg->state != TSG_STATE_TUNNEL_CLOSE_PENDING)
3135 {
3136 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->ChannelContext))
3137 return FALSE;
3138
3139 return tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING);
3140 }
3141
3142 return TRUE;
3143}
3144
3155WINPR_ATTR_NODISCARD
3156static int tsg_read(rdpTsg* tsg, BYTE* data, size_t length)
3157{
3158 rdpRpc* rpc = nullptr;
3159 int status = 0;
3160
3161 if (!tsg || !data)
3162 return -1;
3163
3164 rpc = tsg->rpc;
3165
3166 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3167 {
3168 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3169 return -1;
3170 }
3171
3172 do
3173 {
3174 status = rpc_client_receive_pipe_read(rpc->client, data, length);
3175
3176 if (status < 0)
3177 return -1;
3178
3179 if (!status && !transport_get_blocking(rpc->transport))
3180 return 0;
3181
3182 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3183 {
3184 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3185 return -1;
3186 }
3187
3188 if (status > 0)
3189 break;
3190
3191 if (transport_get_blocking(rpc->transport))
3192 {
3193 while (WaitForSingleObject(rpc->client->PipeEvent, 0) != WAIT_OBJECT_0)
3194 {
3195 if (!tsg_check_event_handles(tsg))
3196 return -1;
3197
3198 (void)WaitForSingleObject(rpc->client->PipeEvent, 100);
3199 }
3200 }
3201 } while (transport_get_blocking(rpc->transport));
3202
3203 return status;
3204}
3205
3206WINPR_ATTR_NODISCARD
3207static int tsg_write(rdpTsg* tsg, const BYTE* data, UINT32 length)
3208{
3209 int status = 0;
3210
3211 if (!tsg || !data || !tsg->rpc || !tsg->rpc->transport)
3212 return -1;
3213
3214 if (transport_get_layer(tsg->rpc->transport) == TRANSPORT_LAYER_CLOSED)
3215 {
3216 WLog_Print(tsg->log, WLOG_ERROR, "error, connection lost");
3217 return -1;
3218 }
3219
3220 status = TsProxySendToServer((handle_t)tsg, data, 1, &length);
3221
3222 if (status < 0)
3223 return -1;
3224
3225 return (int)length;
3226}
3227
3228rdpTsg* tsg_new(rdpTransport* transport)
3229{
3230 rdpTsg* tsg = (rdpTsg*)calloc(1, sizeof(rdpTsg));
3231
3232 if (!tsg)
3233 return nullptr;
3234 tsg->log = WLog_Get(TSG_TAG);
3235 tsg->transport = transport;
3236 tsg->rpc = rpc_new(tsg->transport);
3237
3238 if (!tsg->rpc)
3239 goto out_free;
3240
3241 return tsg;
3242out_free:
3243 free(tsg);
3244 return nullptr;
3245}
3246
3247void tsg_free(rdpTsg* tsg)
3248{
3249 if (tsg)
3250 {
3251 rpc_free(tsg->rpc);
3252 free(tsg->Hostname);
3253 free(tsg->QuarreQuest.machineName);
3254 free(tsg->QuarreQuest.data);
3255 free(tsg);
3256 }
3257}
3258
3259WINPR_ATTR_NODISCARD
3260static int transport_bio_tsg_write(BIO* bio, const char* buf, int num)
3261{
3262 int status = 0;
3263 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3264 BIO_clear_flags(bio, BIO_FLAGS_WRITE);
3265
3266 if (num < 0)
3267 return -1;
3268 status = tsg_write(tsg, (const BYTE*)buf, (UINT32)num);
3269
3270 if (status < 0)
3271 {
3272 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3273 return -1;
3274 }
3275 else if (status == 0)
3276 {
3277 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3278 WSASetLastError(WSAEWOULDBLOCK);
3279 }
3280 else
3281 {
3282 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3283 }
3284
3285 return status >= 0 ? status : -1;
3286}
3287
3288WINPR_ATTR_NODISCARD
3289static int transport_bio_tsg_read(BIO* bio, char* buf, int size)
3290{
3291 int status = 0;
3292 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3293
3294 if (!tsg || (size < 0))
3295 {
3296 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3297 return -1;
3298 }
3299
3300 BIO_clear_flags(bio, BIO_FLAGS_READ);
3301 status = tsg_read(tsg, (BYTE*)buf, (size_t)size);
3302
3303 if (status < 0)
3304 {
3305 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3306 return -1;
3307 }
3308 else if (status == 0)
3309 {
3310 BIO_set_flags(bio, BIO_FLAGS_READ);
3311 WSASetLastError(WSAEWOULDBLOCK);
3312 }
3313 else
3314 {
3315 BIO_set_flags(bio, BIO_FLAGS_READ);
3316 }
3317
3318 return status > 0 ? status : -1;
3319}
3320
3321WINPR_ATTR_NODISCARD
3322static int transport_bio_tsg_puts(BIO* bio, const char* str)
3323{
3324 WINPR_UNUSED(bio);
3325 WINPR_UNUSED(str);
3326 return -2;
3327}
3328
3329WINPR_ATTR_NODISCARD
3330// NOLINTNEXTLINE(readability-non-const-parameter)
3331static int transport_bio_tsg_gets(BIO* bio, char* str, int size)
3332{
3333 WINPR_UNUSED(bio);
3334 WINPR_UNUSED(str);
3335 WINPR_UNUSED(size);
3336 return 1;
3337}
3338
3339WINPR_ATTR_NODISCARD
3340static long transport_bio_tsg_ctrl(BIO* bio, int cmd, long arg1, void* arg2)
3341{
3342 long status = -1;
3343 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3344 RpcVirtualConnection* connection = tsg->rpc->VirtualConnection;
3345 RpcInChannel* inChannel = connection->DefaultInChannel;
3346 RpcOutChannel* outChannel = connection->DefaultOutChannel;
3347
3348 switch (cmd)
3349 {
3350 case BIO_CTRL_FLUSH:
3351 (void)BIO_flush(inChannel->common.tls->bio);
3352 (void)BIO_flush(outChannel->common.tls->bio);
3353 status = 1;
3354 break;
3355
3356 case BIO_C_GET_EVENT:
3357 if (arg2)
3358 {
3359 *((HANDLE*)arg2) = tsg->rpc->client->PipeEvent;
3360 status = 1;
3361 }
3362
3363 break;
3364
3365 case BIO_C_SET_NONBLOCK:
3366 status = 1;
3367 break;
3368
3369 case BIO_C_READ_BLOCKED:
3370 {
3371 BIO* cbio = outChannel->common.tls->underlying;
3372 status = BIO_read_blocked(cbio);
3373 }
3374 break;
3375
3376 case BIO_C_WRITE_BLOCKED:
3377 {
3378 BIO* cbio = inChannel->common.tls->underlying;
3379 status = BIO_write_blocked(cbio);
3380 }
3381 break;
3382
3383 case BIO_C_WAIT_READ:
3384 {
3385 int timeout = (int)arg1;
3386 BIO* cbio = outChannel->common.tls->underlying;
3387
3388 if (BIO_read_blocked(cbio))
3389 return BIO_wait_read(cbio, timeout);
3390 else if (BIO_write_blocked(cbio))
3391 return BIO_wait_write(cbio, timeout);
3392 else
3393 status = 1;
3394 }
3395 break;
3396
3397 case BIO_C_WAIT_WRITE:
3398 {
3399 int timeout = (int)arg1;
3400 BIO* cbio = inChannel->common.tls->underlying;
3401
3402 if (BIO_write_blocked(cbio))
3403 status = BIO_wait_write(cbio, timeout);
3404 else if (BIO_read_blocked(cbio))
3405 status = BIO_wait_read(cbio, timeout);
3406 else
3407 status = 1;
3408 }
3409 break;
3410#if OPENSSL_VERSION_NUMBER >= 0x30000000L
3411 case BIO_CTRL_GET_KTLS_SEND:
3412 status = 0;
3413 break;
3414 case BIO_CTRL_GET_KTLS_RECV:
3415 status = 0;
3416 break;
3417#endif
3418 default:
3419 break;
3420 }
3421
3422 return status;
3423}
3424
3425WINPR_ATTR_NODISCARD
3426static int transport_bio_tsg_new(BIO* bio)
3427{
3428 WINPR_ASSERT(bio);
3429 BIO_set_init(bio, 1);
3430 BIO_set_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3431 return 1;
3432}
3433
3434WINPR_ATTR_NODISCARD
3435static int transport_bio_tsg_free(BIO* bio)
3436{
3437 WINPR_ASSERT(bio);
3438 WINPR_UNUSED(bio);
3439 return 1;
3440}
3441
3442BIO_METHOD* BIO_s_tsg(void)
3443{
3444 static BIO_METHOD* bio_methods = nullptr;
3445
3446 if (bio_methods == nullptr)
3447 {
3448 if (!(bio_methods = BIO_meth_new(BIO_TYPE_TSG, "TSGateway")))
3449 return nullptr;
3450
3451 BIO_meth_set_write(bio_methods, transport_bio_tsg_write);
3452 BIO_meth_set_read(bio_methods, transport_bio_tsg_read);
3453 BIO_meth_set_puts(bio_methods, transport_bio_tsg_puts);
3454 BIO_meth_set_gets(bio_methods, transport_bio_tsg_gets);
3455 BIO_meth_set_ctrl(bio_methods, transport_bio_tsg_ctrl);
3456 BIO_meth_set_create(bio_methods, transport_bio_tsg_new);
3457 BIO_meth_set_destroy(bio_methods, transport_bio_tsg_free);
3458 }
3459
3460 return bio_methods;
3461}
3462
3463TSG_STATE tsg_get_state(rdpTsg* tsg)
3464{
3465 if (!tsg)
3466 return TSG_STATE_INITIAL;
3467
3468 return tsg->state;
3469}
3470
3471BIO* tsg_get_bio(rdpTsg* tsg)
3472{
3473 if (!tsg)
3474 return nullptr;
3475
3476 return tsg->bio;
3477}
3478
3479BOOL tsg_set_state(rdpTsg* tsg, TSG_STATE state)
3480{
3481 WINPR_ASSERT(tsg);
3482 tsg->state = state;
3483 return TRUE;
3484}
freerdp_settings_get_string
WINPR_ATTR_NODISCARD FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
freerdp_settings_set_uint32
WINPR_ATTR_NODISCARD FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 val)
Sets a UINT32 settings value.
freerdp_settings_get_uint32
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
CONTEXT_HANDLE
Definition winpr/include/winpr/rpc.h:26
RPC_PDU
Definition libfreerdp/core/gateway/rpc.h:66
p_uuid_t
Definition libfreerdp/core/gateway/rpc.h:150