FreeRDP
Loading...
Searching...
No Matches
tsg.c
1
23#include <freerdp/config.h>
24
25#include "../settings.h"
26
27#include <winpr/assert.h>
28#include <winpr/crt.h>
29#include <winpr/error.h>
30#include <winpr/print.h>
31#include <winpr/stream.h>
32
33#include <freerdp/log.h>
34
35#include "rpc_bind.h"
36#include "rpc_client.h"
37#include "tsg.h"
38#include "../utils.h"
39#include "../../crypto/opensslcompat.h"
40
41#define TAG FREERDP_TAG("core.gateway.tsg")
42
43#define TSG_CAPABILITY_TYPE_NAP 0x00000001
44
45#define TSG_PACKET_TYPE_HEADER 0x00004844
46#define TSG_PACKET_TYPE_VERSIONCAPS 0x00005643
47#define TSG_PACKET_TYPE_QUARCONFIGREQUEST 0x00005143
48#define TSG_PACKET_TYPE_QUARREQUEST 0x00005152
49#define TSG_PACKET_TYPE_RESPONSE 0x00005052
50#define TSG_PACKET_TYPE_QUARENC_RESPONSE 0x00004552
51#define TSG_PACKET_TYPE_CAPS_RESPONSE 0x00004350
52#define TSG_PACKET_TYPE_MSGREQUEST_PACKET 0x00004752
53#define TSG_PACKET_TYPE_MESSAGE_PACKET 0x00004750
54#define TSG_PACKET_TYPE_AUTH 0x00004054
55#define TSG_PACKET_TYPE_REAUTH 0x00005250
56
57typedef WCHAR* RESOURCENAME;
58
59typedef struct
60{
61 RESOURCENAME* resourceName;
62 UINT32 numResourceNames;
63 RESOURCENAME* alternateResourceNames;
64 UINT16 numAlternateResourceNames;
65 UINT32 Port;
66} TSENDPOINTINFO;
67
68typedef struct
69{
70 UINT16 ComponentId;
71 UINT16 PacketId;
72} TSG_PACKET_HEADER;
73
74typedef struct
75{
76 UINT32 capabilities;
77} TSG_CAPABILITY_NAP;
78
79typedef union
80{
81 TSG_CAPABILITY_NAP tsgCapNap;
82} TSG_CAPABILITIES_UNION;
83
84typedef struct
85{
86 UINT32 capabilityType;
87 TSG_CAPABILITIES_UNION tsgPacket;
88} TSG_PACKET_CAPABILITIES;
89
90typedef struct
91{
92 TSG_PACKET_HEADER tsgHeader;
93 TSG_PACKET_CAPABILITIES tsgCaps;
94 UINT32 numCapabilities;
95 UINT16 majorVersion;
96 UINT16 minorVersion;
97 UINT16 quarantineCapabilities;
98} TSG_PACKET_VERSIONCAPS;
99
100typedef struct
101{
102 UINT32 flags;
103} TSG_PACKET_QUARCONFIGREQUEST;
104
105typedef struct
106{
107 UINT32 flags;
108 WCHAR* machineName;
109 UINT32 nameLength;
110 BYTE* data;
111 UINT32 dataLen;
112} TSG_PACKET_QUARREQUEST;
113
114typedef struct
115{
116 BOOL enableAllRedirections;
117 BOOL disableAllRedirections;
118 BOOL driveRedirectionDisabled;
119 BOOL printerRedirectionDisabled;
120 BOOL portRedirectionDisabled;
121 BOOL reserved;
122 BOOL clipboardRedirectionDisabled;
123 BOOL pnpRedirectionDisabled;
124} TSG_REDIRECTION_FLAGS;
125
126typedef struct
127{
128 UINT32 flags;
129 UINT32 reserved;
130 const BYTE* responseData;
131 UINT32 responseDataLen;
132 TSG_REDIRECTION_FLAGS redirectionFlags;
133} TSG_PACKET_RESPONSE;
134
135typedef struct
136{
137 UINT32 flags;
138 UINT32 certChainLen;
139 WCHAR* certChainData;
140 GUID nonce;
141 TSG_PACKET_VERSIONCAPS versionCaps;
142} TSG_PACKET_QUARENC_RESPONSE;
143
144typedef struct
145{
146 INT32 isDisplayMandatory;
147 INT32 isConsentMandatory;
148 UINT32 msgBytes;
149 WCHAR* msgBuffer;
150} TSG_PACKET_STRING_MESSAGE;
151
152typedef struct
153{
154 UINT64 tunnelContext;
155} TSG_PACKET_REAUTH_MESSAGE;
156
157typedef struct
158{
159 UINT32 msgID;
160 UINT32 msgType;
161 INT32 isMsgPresent;
162} TSG_PACKET_MSG_RESPONSE;
163
164typedef struct
165{
166 TSG_PACKET_QUARENC_RESPONSE pktQuarEncResponse;
167 TSG_PACKET_MSG_RESPONSE pktConsentMessage;
168} TSG_PACKET_CAPS_RESPONSE;
169
170typedef struct
171{
172 UINT32 maxMessagesPerBatch;
173} TSG_PACKET_MSG_REQUEST;
174
175typedef struct
176{
177 TSG_PACKET_VERSIONCAPS tsgVersionCaps;
178 UINT32 cookieLen;
179 BYTE* cookie;
180} TSG_PACKET_AUTH;
181
182typedef union
183{
184 TSG_PACKET_VERSIONCAPS packetVersionCaps;
185 TSG_PACKET_AUTH packetAuth;
186} TSG_INITIAL_PACKET_TYPE_UNION;
187
188typedef struct
189{
190 UINT64 tunnelContext;
191 UINT32 packetId;
192 TSG_INITIAL_PACKET_TYPE_UNION tsgInitialPacket;
193} TSG_PACKET_REAUTH;
194
195typedef union
196{
197 TSG_PACKET_HEADER packetHeader;
198 TSG_PACKET_VERSIONCAPS packetVersionCaps;
199 TSG_PACKET_QUARCONFIGREQUEST packetQuarConfigRequest;
200 TSG_PACKET_QUARREQUEST packetQuarRequest;
201 TSG_PACKET_RESPONSE packetResponse;
202 TSG_PACKET_QUARENC_RESPONSE packetQuarEncResponse;
203 TSG_PACKET_CAPS_RESPONSE packetCapsResponse;
204 TSG_PACKET_MSG_REQUEST packetMsgRequest;
205 TSG_PACKET_MSG_RESPONSE packetMsgResponse;
206 TSG_PACKET_AUTH packetAuth;
207 TSG_PACKET_REAUTH packetReauth;
208} TSG_PACKET_TYPE_UNION;
209
210typedef struct
211{
212 UINT32 packetId;
213 TSG_PACKET_TYPE_UNION tsgPacket;
214} TSG_PACKET;
215
216struct rdp_tsg
217{
218 BIO* bio;
219 rdpRpc* rpc;
220 UINT16 Port;
221 LPWSTR Hostname;
222 TSG_STATE state;
223 UINT32 TunnelId;
224 UINT32 ChannelId;
225 BOOL reauthSequence;
226 rdpTransport* transport;
227 UINT64 ReauthTunnelContext;
228 CONTEXT_HANDLE TunnelContext;
229 CONTEXT_HANDLE ChannelContext;
230 CONTEXT_HANDLE NewTunnelContext;
231 CONTEXT_HANDLE NewChannelContext;
232 wLog* log;
233 TSG_PACKET_QUARENC_RESPONSE CapsResponse;
234 TSG_PACKET_QUARREQUEST QuarreQuest;
235};
236
237static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
238 TSG_PACKET_STRING_MESSAGE* msg);
239static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align);
240
241static const char* tsg_caps_to_string(UINT32 caps, char* buffer, size_t len)
242{
243 const UINT32 mask = ~(TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT |
244 TSG_MESSAGING_CAP_CONSENT_SIGN | TSG_MESSAGING_CAP_SERVICE_MSG |
245 TSG_MESSAGING_CAP_REAUTH);
246 const UINT32 val = caps & mask;
247
248 if ((caps & TSG_NAP_CAPABILITY_QUAR_SOH) != 0)
249 (void)winpr_str_append("TSG_NAP_CAPABILITY_QUAR_SOH", buffer, len, "|");
250 if ((caps & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
251 (void)winpr_str_append("TSG_NAP_CAPABILITY_IDLE_TIMEOUT", buffer, len, "|");
252 if ((caps & TSG_MESSAGING_CAP_CONSENT_SIGN) != 0)
253 (void)winpr_str_append("TSG_MESSAGING_CAP_CONSENT_SIGN", buffer, len, "|");
254 if ((caps & TSG_MESSAGING_CAP_SERVICE_MSG) != 0)
255 (void)winpr_str_append("TSG_MESSAGING_CAP_SERVICE_MSG", buffer, len, "|");
256 if ((caps & TSG_MESSAGING_CAP_REAUTH) != 0)
257 (void)winpr_str_append("TSG_MESSAGING_CAP_REAUTH", buffer, len, "|");
258
259 if (val != 0)
260 {
261 char number[32] = WINPR_C_ARRAY_INIT;
262 (void)_snprintf(number, sizeof(number), "TSG_UNKNOWN{0x%08" PRIx32 "}", val);
263 (void)winpr_str_append(number, buffer, len, "|");
264 }
265
266 return buffer;
267}
268
269static const char* tsg_packet_id_to_string(UINT32 packetId)
270{
271 switch (packetId)
272 {
273 case TSG_PACKET_TYPE_HEADER:
274 return "TSG_PACKET_TYPE_HEADER";
275 case TSG_PACKET_TYPE_VERSIONCAPS:
276 return "TSG_PACKET_TYPE_VERSIONCAPS";
277 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
278 return "TSG_PACKET_TYPE_QUARCONFIGREQUEST";
279 case TSG_PACKET_TYPE_QUARREQUEST:
280 return "TSG_PACKET_TYPE_QUARREQUEST";
281 case TSG_PACKET_TYPE_RESPONSE:
282 return "TSG_PACKET_TYPE_RESPONSE";
283 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
284 return "TSG_PACKET_TYPE_QUARENC_RESPONSE";
285 case TSG_CAPABILITY_TYPE_NAP:
286 return "TSG_CAPABILITY_TYPE_NAP";
287 case TSG_PACKET_TYPE_CAPS_RESPONSE:
288 return "TSG_PACKET_TYPE_CAPS_RESPONSE";
289 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
290 return "TSG_PACKET_TYPE_MSGREQUEST_PACKET";
291 case TSG_PACKET_TYPE_MESSAGE_PACKET:
292 return "TSG_PACKET_TYPE_MESSAGE_PACKET";
293 case TSG_PACKET_TYPE_AUTH:
294 return "TSG_PACKET_TYPE_AUTH";
295 case TSG_PACKET_TYPE_REAUTH:
296 return "TSG_PACKET_TYPE_REAUTH";
297 default:
298 return "UNKNOWN";
299 }
300}
301
302static const char* tsg_component_id_to_string(UINT16 ComponentId, char* buffer, size_t bytelen)
303{
304 const char* str = nullptr;
305
306#define ENTRY(x) \
307 case x: \
308 str = #x; \
309 break
310 switch (ComponentId)
311 {
312 ENTRY(TS_GATEWAY_TRANSPORT);
313 default:
314 str = "TS_UNKNOWN";
315 break;
316 }
317#undef ENTRY
318
319 (void)_snprintf(buffer, bytelen, "%s [0x%04" PRIx16 "]", str, ComponentId);
320 return buffer;
321}
322
323static const char* tsg_state_to_string(TSG_STATE state)
324{
325 switch (state)
326 {
327 case TSG_STATE_INITIAL:
328 return "TSG_STATE_INITIAL";
329 case TSG_STATE_CONNECTED:
330 return "TSG_STATE_CONNECTED";
331 case TSG_STATE_AUTHORIZED:
332 return "TSG_STATE_AUTHORIZED";
333 case TSG_STATE_CHANNEL_CREATED:
334 return "TSG_STATE_CHANNEL_CREATED";
335 case TSG_STATE_PIPE_CREATED:
336 return "TSG_STATE_PIPE_CREATED";
337 case TSG_STATE_TUNNEL_CLOSE_PENDING:
338 return "TSG_STATE_TUNNEL_CLOSE_PENDING";
339 case TSG_STATE_CHANNEL_CLOSE_PENDING:
340 return "TSG_STATE_CHANNEL_CLOSE_PENDING";
341 case TSG_STATE_FINAL:
342 return "TSG_STATE_FINAL";
343 default:
344 return "TSG_STATE_UNKNOWN";
345 }
346}
347
348static BOOL TsProxyReadTunnelContext(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext)
349{
350 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 20))
351 return FALSE;
352
353 WINPR_ASSERT(tunnelContext);
354 Stream_Read_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
355 Stream_Read(s, &tunnelContext->ContextUuid,
356 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
357 return TRUE;
358}
359
360static BOOL TsProxyWriteTunnelContext(WINPR_ATTR_UNUSED wLog* log, wStream* s,
361 const CONTEXT_HANDLE* tunnelContext)
362{
363 if (!Stream_EnsureRemainingCapacity(s, 20))
364 return FALSE;
365
366 Stream_Write_UINT32(s, tunnelContext->ContextType); /* ContextType (4 bytes) */
367 Stream_Write(s, &tunnelContext->ContextUuid,
368 sizeof(tunnelContext->ContextUuid)); /* ContextUuid (16 bytes) */
369 return TRUE;
370}
371
372static BOOL tsg_ndr_pointer_write(WINPR_ATTR_UNUSED wLog* log, wStream* s, UINT32* index,
373 DWORD length)
374{
375 WINPR_ASSERT(index);
376 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
377
378 if (!s)
379 return FALSE;
380 if (!Stream_EnsureRemainingCapacity(s, 4))
381 return FALSE;
382
383 if (length > 0)
384 {
385 Stream_Write_UINT32(s, ndrPtr); /* mszGroupsNdrPtr (4 bytes) */
386 (*index) = (*index) + 1;
387 }
388 else
389 Stream_Write_UINT32(s, 0);
390 return TRUE;
391}
392
393static BOOL tsg_ndr_pointer_read(wLog* log, wStream* s, UINT32* index, UINT32* ptrval,
394 BOOL required)
395{
396 WINPR_ASSERT(index);
397 const UINT32 ndrPtr = 0x20000 + (*index) * 4;
398
399 if (!s)
400 return FALSE;
401 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 4))
402 return FALSE;
403
404 const DWORD val = Stream_Get_UINT32(s);
405 if (ptrval)
406 *ptrval = val;
407
408 if (val != 0)
409 {
410 if (val != ndrPtr)
411 {
412 WLog_Print(log, WLOG_WARN, "Read NDR pointer 0x%04" PRIx32 " but expected 0x%04" PRIx32,
413 val, ndrPtr);
414 if ((val & 0xFFFF0000) != (ndrPtr & 0xFFFF0000))
415 return FALSE;
416 }
417 (*index)++;
418 }
419 else if (required)
420 {
421 WLog_Print(log, WLOG_ERROR, "NDR pointer == 0, but the field is required");
422 return FALSE;
423 }
424
425 return TRUE;
426}
427
428static BOOL tsg_ndr_write_conformant_array(WINPR_ATTR_UNUSED wLog* log, wStream* s,
429 const void* data, size_t length)
430{
431 const size_t pad = length % 4;
432 if ((length > UINT32_MAX) || !Stream_EnsureRemainingCapacity(s, 4ull + length))
433 return FALSE;
434
435 Stream_Write_UINT32(s, WINPR_ASSERTING_INT_CAST(uint32_t, length)); /* MaxCount (4 bytes) */
436 Stream_Write(s, data, length);
437 if (pad != 0)
438 Stream_Zero(s, 4 - pad);
439
440 return TRUE;
441}
442
443static BOOL tsg_ndr_write_string(WINPR_ATTR_UNUSED wLog* log, wStream* s, const WCHAR* str,
444 size_t length)
445{
446 const size_t pad = (length % 2) * sizeof(WCHAR);
447 if ((length > UINT32_MAX) ||
448 !Stream_EnsureRemainingCapacity(s, 12ull + length * sizeof(WCHAR) + pad))
449 return FALSE;
450
451 Stream_Write_UINT32(s, (UINT32)length); /* MaxCount (4 bytes) */
452 Stream_Write_UINT32(s, 0); /* Offset (4 bytes) */
453 Stream_Write_UINT32(s, (UINT32)length); /* ActualCount (4 bytes) */
454 if (!Stream_Write_UTF16_String(s, str, length)) /* Array */
455 return FALSE;
456 Stream_Zero(s, pad);
457 return TRUE;
458}
459
460static BOOL tsg_ndr_read_string(wLog* log, wStream* s, WCHAR** str, UINT32 lengthInBytes)
461{
462 UINT32 MaxCount = 0;
463 UINT32 Offset = 0;
464 UINT32 ActualCount = 0;
465
466 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
467 return FALSE;
468
469 Stream_Read_UINT32(s, MaxCount); /* MaxCount (4 bytes) */
470 Stream_Read_UINT32(s, Offset); /* Offset (4 bytes) */
471 Stream_Read_UINT32(s, ActualCount); /* ActualCount (4 bytes) */
472 if (ActualCount > MaxCount)
473 {
474 WLog_Print(log, WLOG_ERROR,
475 "failed to read string, ActualCount (%" PRIu32 ") > MaxCount (%" PRIu32 ")",
476 ActualCount, MaxCount);
477 return FALSE;
478 }
479 if (Offset != 0)
480 {
481 WLog_Print(log, WLOG_ERROR, "Unsupported Offset (%" PRIu32 "), expected 0", Offset);
482 return FALSE;
483 }
484 if (ActualCount > lengthInBytes / sizeof(WCHAR))
485 {
486 WLog_Print(log, WLOG_ERROR,
487 "failed to read string, ActualCount (%" PRIu32
488 ") * sizeof(WCHAR) > lengthInBytes (%" PRIu32 ")",
489 ActualCount, lengthInBytes);
490 return FALSE;
491 }
492 if (str)
493 *str = Stream_PointerAs(s, WCHAR);
494
495 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, ActualCount * sizeof(WCHAR)))
496 return FALSE;
497 Stream_Seek(s, ActualCount * sizeof(WCHAR));
498
499 const size_t pad = (ActualCount % 2);
500 return Stream_SafeSeek(s, pad * sizeof(WCHAR));
501}
502
503static BOOL tsg_ndr_read_packet_header(wLog* log, wStream* s, TSG_PACKET_HEADER* header)
504{
505 const UINT32 ComponentId = TS_GATEWAY_TRANSPORT;
506
507 WINPR_ASSERT(header);
508 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 2, sizeof(UINT16)))
509 return FALSE;
510 Stream_Read_UINT16(s, header->ComponentId);
511 Stream_Read_UINT16(s, header->PacketId);
512
513 if (ComponentId != header->ComponentId)
514 {
515 char buffer[64] = WINPR_C_ARRAY_INIT;
516 char buffer2[64] = WINPR_C_ARRAY_INIT;
517 WLog_Print(log, WLOG_ERROR, "Unexpected ComponentId: %s, Expected %s",
518 tsg_component_id_to_string(header->ComponentId, buffer, sizeof(buffer)),
519 tsg_component_id_to_string(ComponentId, buffer2, sizeof(buffer2)));
520 return FALSE;
521 }
522
523 return TRUE;
524}
525
526static BOOL tsg_ndr_write_packet_header(WINPR_ATTR_UNUSED wLog* log, wStream* s,
527 const TSG_PACKET_HEADER* header)
528{
529 WINPR_ASSERT(header);
530 if (!Stream_EnsureRemainingCapacity(s, 2 * sizeof(UINT16)))
531 return FALSE;
532 Stream_Write_UINT16(s, header->ComponentId);
533 Stream_Write_UINT16(s, header->PacketId);
534 return TRUE;
535}
536
537static BOOL tsg_ndr_read_nap(wLog* log, wStream* s, TSG_CAPABILITY_NAP* nap)
538{
539 WINPR_ASSERT(nap);
540
541 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
542 return FALSE;
543 Stream_Read_UINT32(s, nap->capabilities);
544 {
545 char buffer[256] = WINPR_C_ARRAY_INIT;
546 WLog_Print(log, WLOG_DEBUG, "Received version caps %s",
547 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
548 }
549 return TRUE;
550}
551
552static BOOL tsg_ndr_write_nap(wLog* log, wStream* s, const TSG_CAPABILITY_NAP* nap)
553{
554 WINPR_ASSERT(nap);
555
556 if (!Stream_EnsureRemainingCapacity(s, 1 * sizeof(UINT32)))
557 return FALSE;
558
559 {
560 char buffer[256] = WINPR_C_ARRAY_INIT;
561 WLog_Print(log, WLOG_DEBUG, "Sending version caps %s",
562 tsg_caps_to_string(nap->capabilities, buffer, sizeof(buffer)));
563 }
564 Stream_Write_UINT32(s, nap->capabilities);
565 return TRUE;
566}
567
568static BOOL tsg_ndr_read_tsg_caps(wLog* log, wStream* s, TSG_PACKET_CAPABILITIES* caps)
569{
570 UINT32 capabilityType = 0;
571 UINT32 count = 0;
572 WINPR_ASSERT(caps);
573
574 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 3, sizeof(UINT32)))
575 return FALSE;
576 Stream_Read_UINT32(s, count);
577 Stream_Read_UINT32(s, capabilityType);
578 Stream_Read_UINT32(s, caps->capabilityType);
579 if (capabilityType != caps->capabilityType)
580 {
581 WLog_Print(log, WLOG_ERROR,
582 "Inconsistent data, capabilityType 0x%08" PRIx32 " != 0x%08" PRIx32,
583 capabilityType, caps->capabilityType);
584 return FALSE;
585 }
586 switch (caps->capabilityType)
587 {
588 case TSG_CAPABILITY_TYPE_NAP:
589 if (count < 1)
590 {
591 WLog_Print(log, WLOG_ERROR, "Inconsistent data, capabilityType %s count=%" PRIu32,
592 tsg_packet_id_to_string(capabilityType), count);
593 return FALSE;
594 }
595 return tsg_ndr_read_nap(log, s, &caps->tsgPacket.tsgCapNap);
596 default:
597 WLog_Print(log, WLOG_ERROR,
598 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32
599 " [count=%" PRIu32 "]",
600 caps->capabilityType, count);
601 return FALSE;
602 }
603}
604
605static BOOL tsg_ndr_write_tsg_caps(wLog* log, wStream* s, const TSG_PACKET_CAPABILITIES* caps)
606{
607 WINPR_ASSERT(caps);
608
609 if (!Stream_EnsureRemainingCapacity(s, 2 * sizeof(UINT32)))
610 return FALSE;
611 Stream_Write_UINT32(s, caps->capabilityType);
612 Stream_Write_UINT32(s, caps->capabilityType);
613
614 switch (caps->capabilityType)
615 {
616 case TSG_CAPABILITY_TYPE_NAP:
617 return tsg_ndr_write_nap(log, s, &caps->tsgPacket.tsgCapNap);
618 default:
619 WLog_Print(log, WLOG_ERROR,
620 "unknown TSG_PACKET_CAPABILITIES::capabilityType 0x%04" PRIx32,
621 caps->capabilityType);
622 return FALSE;
623 }
624}
625
626static BOOL tsg_ndr_read_version_caps(wLog* log, wStream* s, UINT32* index,
627 TSG_PACKET_VERSIONCAPS* caps)
628{
629 WINPR_ASSERT(caps);
630 if (!tsg_ndr_read_packet_header(log, s, &caps->tsgHeader))
631 return FALSE;
632
633 UINT32 TSGCapsPtr = 0;
634 if (!tsg_ndr_pointer_read(log, s, index, &TSGCapsPtr, TRUE))
635 return FALSE;
636
637 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 10))
638 return FALSE;
639 Stream_Read_UINT32(s, caps->numCapabilities);
640 Stream_Read_UINT16(s, caps->majorVersion);
641 Stream_Read_UINT16(s, caps->minorVersion);
642 Stream_Read_UINT16(s, caps->quarantineCapabilities);
643 /* 4-byte alignment */
644 if (!tsg_stream_align(log, s, 4))
645 return FALSE;
646
647 if (caps->numCapabilities > 1)
648 {
649 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
650 caps->numCapabilities);
651 return FALSE;
652 }
653
654 return tsg_ndr_read_tsg_caps(log, s, &caps->tsgCaps);
655}
656
657static BOOL tsg_ndr_write_version_caps(wLog* log, wStream* s, UINT32* index,
658 const TSG_PACKET_VERSIONCAPS* caps)
659{
660 WINPR_ASSERT(caps);
661 if (!tsg_ndr_write_packet_header(log, s, &caps->tsgHeader))
662 return FALSE;
663
664 if (!tsg_ndr_pointer_write(log, s, index, 1)) /* TsgCapsPtr (4 bytes) */
665 return FALSE;
666
667 if (!Stream_EnsureRemainingCapacity(s, 10))
668 return FALSE;
669
670 if (caps->numCapabilities > 1)
671 {
672 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
673 caps->numCapabilities);
674 return FALSE;
675 }
676 Stream_Write_UINT32(s, caps->numCapabilities);
677 Stream_Write_UINT16(s, caps->majorVersion);
678 Stream_Write_UINT16(s, caps->minorVersion);
679 Stream_Write_UINT16(s, caps->quarantineCapabilities);
680
681 /* 4-byte alignment (30 + 2) */
682 Stream_Write_UINT16(s, 0x0000); /* pad (2 bytes) */
683 Stream_Write_UINT32(s, caps->numCapabilities); /* MaxCount (4 bytes) */
684 return tsg_ndr_write_tsg_caps(log, s, &caps->tsgCaps);
685}
686
687static BOOL tsg_ndr_read_quarenc_response(wLog* log, wStream* s, UINT32* index,
688 TSG_PACKET_QUARENC_RESPONSE* quarenc)
689{
690 WINPR_ASSERT(quarenc);
691 UINT32 CertChainDataPtr = 0;
692 UINT32 VersionCapsPtr = 0;
693
694 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
695 return FALSE;
696 Stream_Read_UINT32(s, quarenc->flags);
697 Stream_Read_UINT32(s, quarenc->certChainLen);
698
699 if (!tsg_ndr_pointer_read(log, s, index, &CertChainDataPtr, quarenc->certChainLen != 0))
700 return FALSE;
701
702 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(quarenc->nonce)))
703 return FALSE;
704 Stream_Read(s, &quarenc->nonce, sizeof(quarenc->nonce));
705
706 return (tsg_ndr_pointer_read(log, s, index, &VersionCapsPtr, TRUE));
707}
708
709static BOOL tsg_ndr_read_quarenc_data(wLog* log, wStream* s, UINT32* index,
710 TSG_PACKET_QUARENC_RESPONSE* quarenc)
711{
712 WINPR_ASSERT(quarenc);
713
714 if (quarenc->certChainLen > 0)
715 {
716 /* [MS-TSGU] 2.2.9.2.1.6 TSG_PACKET_QUARENC_RESPONSE::certChainLen number of WCHAR */
717 if (!tsg_ndr_read_string(log, s, &quarenc->certChainData,
718 quarenc->certChainLen * sizeof(WCHAR)))
719 return FALSE;
720 /* 4-byte alignment */
721 if (!tsg_stream_align(log, s, 4))
722 return FALSE;
723 }
724
725 return tsg_ndr_read_version_caps(log, s, index, &quarenc->versionCaps);
726}
727
728static BOOL tsg_ndr_write_auth(wLog* log, wStream* s, UINT32* index, const TSG_PACKET_AUTH* auth)
729{
730 WINPR_ASSERT(auth);
731
732 if (!tsg_ndr_write_version_caps(log, s, index, &auth->tsgVersionCaps))
733 return FALSE;
734
735 if (!Stream_EnsureRemainingCapacity(s, 4))
736 return FALSE;
737
738 Stream_Write_UINT32(s, auth->cookieLen);
739 if (!tsg_ndr_pointer_write(log, s, index, auth->cookieLen))
740 return FALSE;
741
742 if (!Stream_EnsureRemainingCapacity(s, auth->cookieLen))
743 return FALSE;
744 Stream_Write(s, auth->cookie, auth->cookieLen);
745 return TRUE;
746}
747
748static BOOL tsg_ndr_write_reauth(wLog* log, wStream* s, UINT32* index,
749 const TSG_PACKET_REAUTH* auth)
750{
751 WINPR_ASSERT(auth);
752
753 if (!Stream_EnsureRemainingCapacity(s, 12))
754 return FALSE;
755
756 Stream_Write_UINT64(s, auth->tunnelContext); /* TunnelContext (8 bytes) */
757 Stream_Write_UINT32(s, auth->packetId); /* PacketId (4 bytes) */
758
759 switch (auth->packetId)
760 {
761 case TSG_PACKET_TYPE_VERSIONCAPS:
762 return tsg_ndr_write_version_caps(log, s, index,
763 &auth->tsgInitialPacket.packetVersionCaps);
764 case TSG_PACKET_TYPE_AUTH:
765 return tsg_ndr_write_auth(log, s, index, &auth->tsgInitialPacket.packetAuth);
766 default:
767 WLog_Print(log, WLOG_ERROR, "unexpected packetId %s",
768 tsg_packet_id_to_string(auth->packetId));
769 return FALSE;
770 }
771}
772
773static BOOL tsg_ndr_read_packet_redirection_flags(wLog* log, wStream* s,
774 TSG_REDIRECTION_FLAGS* redirectionFlags)
775{
776 WINPR_ASSERT(redirectionFlags);
777
778 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 8, sizeof(UINT32)))
779 return FALSE;
780
781 redirectionFlags->enableAllRedirections =
782 Stream_Get_INT32(s); /* EnableAllRedirections (4 bytes) */
783 redirectionFlags->disableAllRedirections =
784 Stream_Get_INT32(s); /* DisableAllRedirections (4 bytes) */
785 redirectionFlags->driveRedirectionDisabled =
786 Stream_Get_INT32(s); /* DriveRedirectionDisabled (4 bytes) */
787 redirectionFlags->printerRedirectionDisabled =
788 Stream_Get_INT32(s); /* PrinterRedirectionDisabled (4 bytes) */
789 redirectionFlags->portRedirectionDisabled =
790 Stream_Get_INT32(s); /* PortRedirectionDisabled (4 bytes) */
791 redirectionFlags->reserved = Stream_Get_INT32(s); /* Reserved (4 bytes) */
792 redirectionFlags->clipboardRedirectionDisabled =
793 Stream_Get_INT32(s); /* ClipboardRedirectionDisabled (4 bytes) */
794 redirectionFlags->pnpRedirectionDisabled =
795 Stream_Get_INT32(s); /* PnpRedirectionDisabled (4 bytes) */
796 return TRUE;
797}
798
799WINPR_ATTR_FORMAT_ARG(3, 4)
800static BOOL tsg_print(char** buffer, size_t* len, WINPR_FORMAT_ARG const char* fmt, ...)
801{
802 int rc = 0;
803 va_list ap = WINPR_C_ARRAY_INIT;
804 if (!buffer || !len || !fmt)
805 return FALSE;
806 va_start(ap, fmt);
807 rc = vsnprintf(*buffer, *len, fmt, ap);
808 va_end(ap);
809 if ((rc < 0) || ((size_t)rc > *len))
810 return FALSE;
811 *len -= (size_t)rc;
812 *buffer += (size_t)rc;
813 return TRUE;
814}
815
816static BOOL tsg_packet_header_to_string(char** buffer, size_t* length,
817 const TSG_PACKET_HEADER* header)
818{
819 WINPR_ASSERT(buffer);
820 WINPR_ASSERT(length);
821 WINPR_ASSERT(header);
822
823 return tsg_print(buffer, length,
824 "header { ComponentId=0x%04" PRIx16 ", PacketId=0x%04" PRIx16 " }",
825 header->ComponentId, header->PacketId);
826}
827
828static BOOL tsg_type_capability_nap_to_string(char** buffer, size_t* length,
829 const TSG_CAPABILITY_NAP* cur)
830{
831 WINPR_ASSERT(buffer);
832 WINPR_ASSERT(length);
833 WINPR_ASSERT(cur);
834
835 return tsg_print(buffer, length, "%s { capabilities=0x%08" PRIx32 " }",
836 tsg_packet_id_to_string(TSG_CAPABILITY_TYPE_NAP), cur->capabilities);
837}
838
839static BOOL tsg_packet_capabilities_to_string(char** buffer, size_t* length,
840 const TSG_PACKET_CAPABILITIES* caps, UINT32 numCaps)
841{
842 WINPR_ASSERT(buffer);
843 WINPR_ASSERT(length);
844 WINPR_ASSERT(caps);
845
846 if (!tsg_print(buffer, length, "capabilities { "))
847 return FALSE;
848
849 for (UINT32 x = 0; x < numCaps; x++)
850 {
851 const TSG_PACKET_CAPABILITIES* cur = &caps[x];
852 switch (cur->capabilityType)
853 {
854 case TSG_CAPABILITY_TYPE_NAP:
855 if (!tsg_type_capability_nap_to_string(buffer, length, &cur->tsgPacket.tsgCapNap))
856 return FALSE;
857 break;
858 default:
859 if (!tsg_print(buffer, length, "TSG_UNKNOWN_CAPABILITY"))
860 return FALSE;
861 break;
862 }
863 }
864 return tsg_print(buffer, length, " }");
865}
866
867static BOOL tsg_packet_versioncaps_to_string(char** buffer, size_t* length,
868 const TSG_PACKET_VERSIONCAPS* caps)
869{
870 WINPR_ASSERT(buffer);
871 WINPR_ASSERT(length);
872 WINPR_ASSERT(caps);
873
874 if (!tsg_print(buffer, length, "versioncaps { "))
875 return FALSE;
876 if (!tsg_packet_header_to_string(buffer, length, &caps->tsgHeader))
877 return FALSE;
878
879 if (!tsg_print(buffer, length, " "))
880 return FALSE;
881
882 if (caps->numCapabilities > 1)
883 {
884 WLog_ERR(TAG, "TSG_PACKET_VERSIONCAPS::numCapabilities > 1 (%" PRIu32 "), not supported!",
885 caps->numCapabilities);
886 return FALSE;
887 }
888
889 if (!tsg_packet_capabilities_to_string(buffer, length, &caps->tsgCaps, caps->numCapabilities))
890 return FALSE;
891
892 if (!tsg_print(buffer, length,
893 " numCapabilities=0x%08" PRIx32 ", majorVersion=0x%04" PRIx16
894 ", minorVersion=0x%04" PRIx16 ", quarantineCapabilities=0x%04" PRIx16,
895 caps->numCapabilities, caps->majorVersion, caps->minorVersion,
896 caps->quarantineCapabilities))
897 return FALSE;
898
899 return tsg_print(buffer, length, " }");
900}
901
902static BOOL tsg_packet_quarconfigrequest_to_string(char** buffer, size_t* length,
903 const TSG_PACKET_QUARCONFIGREQUEST* caps)
904{
905 WINPR_ASSERT(buffer);
906 WINPR_ASSERT(length);
907 WINPR_ASSERT(caps);
908
909 if (!tsg_print(buffer, length, "quarconfigrequest { "))
910 return FALSE;
911
912 if (!tsg_print(buffer, length, " "))
913 return FALSE;
914
915 if (!tsg_print(buffer, length, " flags=0x%08" PRIx32, caps->flags))
916 return FALSE;
917
918 return tsg_print(buffer, length, " }");
919}
920
921static BOOL tsg_packet_quarrequest_to_string(char** buffer, size_t* length,
922 const TSG_PACKET_QUARREQUEST* caps)
923{
924 BOOL rc = FALSE;
925 char* name = nullptr;
926 char* strdata = nullptr;
927
928 WINPR_ASSERT(buffer);
929 WINPR_ASSERT(length);
930 WINPR_ASSERT(caps);
931
932 if (!tsg_print(buffer, length, "quarrequest { "))
933 return FALSE;
934
935 if (!tsg_print(buffer, length, " "))
936 return FALSE;
937
938 if (caps->nameLength > 0)
939 {
940 if (caps->nameLength > INT_MAX)
941 return FALSE;
942 name = ConvertWCharNToUtf8Alloc(caps->machineName, caps->nameLength, nullptr);
943 if (!name)
944 return FALSE;
945 }
946
947 strdata = winpr_BinToHexString(caps->data, caps->dataLen, TRUE);
948 if (strdata || (caps->dataLen == 0))
949 rc = tsg_print(buffer, length,
950 " flags=0x%08" PRIx32 ", machineName=%s [%" PRIu32 "], data[%" PRIu32 "]=%s",
951 caps->flags, name, caps->nameLength, caps->dataLen, strdata);
952 free(name);
953 free(strdata);
954 if (!rc)
955 return FALSE;
956
957 return tsg_print(buffer, length, " }");
958}
959
960static const char* tsg_bool_to_string(BOOL val)
961{
962 if (val)
963 return "true";
964 return "false";
965}
966
967static const char* tsg_redirection_flags_to_string(char* buffer, size_t size,
968 const TSG_REDIRECTION_FLAGS* flags)
969{
970 WINPR_ASSERT(buffer || (size == 0));
971 WINPR_ASSERT(flags);
972
973 (void)_snprintf(
974 buffer, size,
975 "enableAllRedirections=%s, disableAllRedirections=%s, driveRedirectionDisabled=%s, "
976 "printerRedirectionDisabled=%s, portRedirectionDisabled=%s, reserved=%s, "
977 "clipboardRedirectionDisabled=%s, pnpRedirectionDisabled=%s",
978 tsg_bool_to_string(flags->enableAllRedirections),
979 tsg_bool_to_string(flags->disableAllRedirections),
980 tsg_bool_to_string(flags->driveRedirectionDisabled),
981 tsg_bool_to_string(flags->printerRedirectionDisabled),
982 tsg_bool_to_string(flags->portRedirectionDisabled), tsg_bool_to_string(flags->reserved),
983 tsg_bool_to_string(flags->clipboardRedirectionDisabled),
984 tsg_bool_to_string(flags->pnpRedirectionDisabled));
985 return buffer;
986}
987
988static BOOL tsg_packet_response_to_string(char** buffer, size_t* length,
989 const TSG_PACKET_RESPONSE* caps)
990{
991 BOOL rc = FALSE;
992 char* strdata = nullptr;
993 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
994
995 WINPR_ASSERT(buffer);
996 WINPR_ASSERT(length);
997 WINPR_ASSERT(caps);
998
999 if (!tsg_print(buffer, length, "response { "))
1000 return FALSE;
1001
1002 if (!tsg_print(buffer, length, " "))
1003 return FALSE;
1004
1005 strdata = winpr_BinToHexString(caps->responseData, caps->responseDataLen, TRUE);
1006 if (strdata || (caps->responseDataLen == 0))
1007 rc = tsg_print(
1008 buffer, length,
1009 " flags=0x%08" PRIx32 ", reserved=0x%08" PRIx32 ", responseData[%" PRIu32
1010 "]=%s, redirectionFlags={ %s }",
1011 caps->flags, caps->reserved, caps->responseDataLen, strdata,
1012 tsg_redirection_flags_to_string(tbuffer, ARRAYSIZE(tbuffer), &caps->redirectionFlags));
1013 free(strdata);
1014 if (!rc)
1015 return FALSE;
1016
1017 return tsg_print(buffer, length, " }");
1018}
1019
1020static BOOL tsg_packet_quarenc_response_to_string(char** buffer, size_t* length,
1021 const TSG_PACKET_QUARENC_RESPONSE* caps)
1022{
1023 BOOL rc = FALSE;
1024 char* strdata = nullptr;
1025 char tbuffer[8192] = WINPR_C_ARRAY_INIT;
1026 size_t size = ARRAYSIZE(tbuffer);
1027 char* ptbuffer = tbuffer;
1028
1029 WINPR_ASSERT(buffer);
1030 WINPR_ASSERT(length);
1031 WINPR_ASSERT(caps);
1032
1033 if (!tsg_print(buffer, length, "quarenc_response { "))
1034 return FALSE;
1035
1036 if (!tsg_print(buffer, length, " "))
1037 return FALSE;
1038
1039 char uuid[64] = WINPR_C_ARRAY_INIT;
1040 guid2str(&caps->nonce, uuid, sizeof(uuid));
1041
1042 if (caps->certChainLen > 0)
1043 {
1044 if (caps->certChainLen > INT_MAX)
1045 goto fail;
1046 strdata = ConvertWCharNToUtf8Alloc(caps->certChainData, caps->certChainLen, nullptr);
1047 if (!strdata)
1048 goto fail;
1049 }
1050
1051 tsg_packet_versioncaps_to_string(&ptbuffer, &size, &caps->versionCaps);
1052 if (strdata || (caps->certChainLen == 0))
1053 rc =
1054 tsg_print(buffer, length,
1055 " flags=0x%08" PRIx32 ", certChain[%" PRIu32 "]=%s, nonce=%s, versionCaps=%s",
1056 caps->flags, caps->certChainLen, strdata, uuid, tbuffer);
1057
1058fail:
1059 free(strdata);
1060 if (!rc)
1061 return FALSE;
1062
1063 return tsg_print(buffer, length, " }");
1064}
1065
1066static BOOL tsg_packet_message_response_to_string(char** buffer, size_t* length,
1067 const TSG_PACKET_MSG_RESPONSE* caps)
1068{
1069 WINPR_ASSERT(buffer);
1070 WINPR_ASSERT(length);
1071 WINPR_ASSERT(caps);
1072
1073 if (!tsg_print(buffer, length, "msg_response { "))
1074 return FALSE;
1075
1076 if (!tsg_print(buffer, length,
1077 " msgID=0x%08" PRIx32 ", msgType=0x%08" PRIx32 ", isMsgPresent=%" PRId32,
1078 caps->msgID, caps->msgType, caps->isMsgPresent))
1079 return FALSE;
1080
1081 return tsg_print(buffer, length, " }");
1082}
1083
1084static BOOL tsg_packet_caps_response_to_string(char** buffer, size_t* length,
1085 const TSG_PACKET_CAPS_RESPONSE* caps)
1086{
1087 WINPR_ASSERT(buffer);
1088 WINPR_ASSERT(length);
1089 WINPR_ASSERT(caps);
1090
1091 if (!tsg_print(buffer, length, "caps_response { "))
1092 return FALSE;
1093
1094 if (!tsg_packet_quarenc_response_to_string(buffer, length, &caps->pktQuarEncResponse))
1095 return FALSE;
1096
1097 if (!tsg_packet_message_response_to_string(buffer, length, &caps->pktConsentMessage))
1098 return FALSE;
1099
1100 return tsg_print(buffer, length, " }");
1101}
1102
1103static BOOL tsg_packet_message_request_to_string(char** buffer, size_t* length,
1104 const TSG_PACKET_MSG_REQUEST* caps)
1105{
1106 WINPR_ASSERT(buffer);
1107 WINPR_ASSERT(length);
1108 WINPR_ASSERT(caps);
1109
1110 if (!tsg_print(buffer, length, "caps_message_request { "))
1111 return FALSE;
1112
1113 if (!tsg_print(buffer, length, " maxMessagesPerBatch=%" PRIu32, caps->maxMessagesPerBatch))
1114 return FALSE;
1115
1116 return tsg_print(buffer, length, " }");
1117}
1118
1119static BOOL tsg_packet_auth_to_string(char** buffer, size_t* length, const TSG_PACKET_AUTH* caps)
1120{
1121 BOOL rc = FALSE;
1122 char* strdata = nullptr;
1123 WINPR_ASSERT(buffer);
1124 WINPR_ASSERT(length);
1125 WINPR_ASSERT(caps);
1126
1127 if (!tsg_print(buffer, length, "caps_message_request { "))
1128 return FALSE;
1129
1130 if (!tsg_packet_versioncaps_to_string(buffer, length, &caps->tsgVersionCaps))
1131 return FALSE;
1132
1133 strdata = winpr_BinToHexString(caps->cookie, caps->cookieLen, TRUE);
1134 if (strdata || (caps->cookieLen == 0))
1135 rc = tsg_print(buffer, length, " cookie[%" PRIu32 "]=%s", caps->cookieLen, strdata);
1136 free(strdata);
1137 if (!rc)
1138 return FALSE;
1139
1140 return tsg_print(buffer, length, " }");
1141}
1142
1143static BOOL tsg_packet_reauth_to_string(char** buffer, size_t* length,
1144 const TSG_PACKET_REAUTH* caps)
1145{
1146 BOOL rc = FALSE;
1147 WINPR_ASSERT(buffer);
1148 WINPR_ASSERT(length);
1149 WINPR_ASSERT(caps);
1150
1151 if (!tsg_print(buffer, length, "caps_message_request { "))
1152 return FALSE;
1153
1154 if (!tsg_print(buffer, length, " tunnelContext=0x%016" PRIx64 ", packetId=%s [0x%08" PRIx32 "]",
1155 caps->tunnelContext, tsg_packet_id_to_string(caps->packetId), caps->packetId))
1156 return FALSE;
1157
1158 switch (caps->packetId)
1159 {
1160 case TSG_PACKET_TYPE_VERSIONCAPS:
1161 rc = tsg_packet_versioncaps_to_string(buffer, length,
1162 &caps->tsgInitialPacket.packetVersionCaps);
1163 break;
1164 case TSG_PACKET_TYPE_AUTH:
1165 rc = tsg_packet_auth_to_string(buffer, length, &caps->tsgInitialPacket.packetAuth);
1166 break;
1167 default:
1168 rc = tsg_print(buffer, length, "TODO: Unhandled packet type %s [0x%08" PRIx32 "]",
1169 tsg_packet_id_to_string(caps->packetId), caps->packetId);
1170 break;
1171 }
1172
1173 if (!rc)
1174 return FALSE;
1175
1176 return tsg_print(buffer, length, " }");
1177}
1178
1179static const char* tsg_packet_to_string(const TSG_PACKET* packet)
1180{
1181 size_t len = 8192;
1182 static char sbuffer[8193] = WINPR_C_ARRAY_INIT;
1183 char* buffer = sbuffer;
1184
1185 if (!tsg_print(&buffer, &len, "TSG_PACKET { packetId=%s [0x%08" PRIx32 "], ",
1186 tsg_packet_id_to_string(packet->packetId), packet->packetId))
1187 goto fail;
1188
1189 switch (packet->packetId)
1190 {
1191 case TSG_PACKET_TYPE_HEADER:
1192 if (!tsg_packet_header_to_string(&buffer, &len, &packet->tsgPacket.packetHeader))
1193 goto fail;
1194 break;
1195 case TSG_PACKET_TYPE_VERSIONCAPS:
1196 if (!tsg_packet_versioncaps_to_string(&buffer, &len,
1197 &packet->tsgPacket.packetVersionCaps))
1198 goto fail;
1199 break;
1200 case TSG_PACKET_TYPE_QUARCONFIGREQUEST:
1201 if (!tsg_packet_quarconfigrequest_to_string(&buffer, &len,
1202 &packet->tsgPacket.packetQuarConfigRequest))
1203 goto fail;
1204 break;
1205 case TSG_PACKET_TYPE_QUARREQUEST:
1206 if (!tsg_packet_quarrequest_to_string(&buffer, &len,
1207 &packet->tsgPacket.packetQuarRequest))
1208 goto fail;
1209 break;
1210 case TSG_PACKET_TYPE_RESPONSE:
1211 if (!tsg_packet_response_to_string(&buffer, &len, &packet->tsgPacket.packetResponse))
1212 goto fail;
1213 break;
1214 case TSG_PACKET_TYPE_QUARENC_RESPONSE:
1215 if (!tsg_packet_quarenc_response_to_string(&buffer, &len,
1216 &packet->tsgPacket.packetQuarEncResponse))
1217 goto fail;
1218 break;
1219 case TSG_PACKET_TYPE_CAPS_RESPONSE:
1220 if (!tsg_packet_caps_response_to_string(&buffer, &len,
1221 &packet->tsgPacket.packetCapsResponse))
1222 goto fail;
1223 break;
1224 case TSG_PACKET_TYPE_MSGREQUEST_PACKET:
1225 if (!tsg_packet_message_request_to_string(&buffer, &len,
1226 &packet->tsgPacket.packetMsgRequest))
1227 goto fail;
1228 break;
1229 case TSG_PACKET_TYPE_MESSAGE_PACKET:
1230 if (!tsg_packet_message_response_to_string(&buffer, &len,
1231 &packet->tsgPacket.packetMsgResponse))
1232 goto fail;
1233 break;
1234 case TSG_PACKET_TYPE_AUTH:
1235 if (!tsg_packet_auth_to_string(&buffer, &len, &packet->tsgPacket.packetAuth))
1236 goto fail;
1237 break;
1238 case TSG_PACKET_TYPE_REAUTH:
1239 if (!tsg_packet_reauth_to_string(&buffer, &len, &packet->tsgPacket.packetReauth))
1240 goto fail;
1241 break;
1242 default:
1243 if (!tsg_print(&buffer, &len, "INVALID"))
1244 goto fail;
1245 break;
1246 }
1247
1248 if (!tsg_print(&buffer, &len, " }"))
1249 goto fail;
1250
1251fail:
1252 return sbuffer;
1253}
1254
1255static BOOL tsg_stream_align(wLog* log, wStream* s, size_t align)
1256{
1257 size_t pos = 0;
1258 size_t offset = 0;
1259
1260 if (!s)
1261 return FALSE;
1262
1263 pos = Stream_GetPosition(s);
1264
1265 if ((pos % align) != 0)
1266 offset = align - pos % align;
1267
1268 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, offset))
1269 return FALSE;
1270 Stream_Seek(s, offset);
1271 return TRUE;
1272}
1273
1274static BIO_METHOD* BIO_s_tsg(void);
1311static int TsProxySendToServer(handle_t IDL_handle, const byte pRpcMessage[], UINT32 count,
1312 const UINT32* lengths)
1313{
1314 wStream* s = nullptr;
1315 rdpTsg* tsg = nullptr;
1316 size_t length = 0;
1317 const byte* buffer1 = nullptr;
1318 const byte* buffer2 = nullptr;
1319 const byte* buffer3 = nullptr;
1320 UINT32 buffer1Length = 0;
1321 UINT32 buffer2Length = 0;
1322 UINT32 buffer3Length = 0;
1323 UINT32 numBuffers = 0;
1324 UINT32 totalDataBytes = 0;
1325 tsg = (rdpTsg*)IDL_handle;
1326 buffer1Length = buffer2Length = buffer3Length = 0;
1327
1328 if (count > 0)
1329 {
1330 numBuffers++;
1331 buffer1 = &pRpcMessage[0];
1332 buffer1Length = lengths[0];
1333 totalDataBytes += lengths[0] + 4;
1334 }
1335
1336 if (count > 1)
1337 {
1338 numBuffers++;
1339 buffer2 = &pRpcMessage[1];
1340 buffer2Length = lengths[1];
1341 totalDataBytes += lengths[1] + 4;
1342 }
1343
1344 if (count > 2)
1345 {
1346 numBuffers++;
1347 buffer3 = &pRpcMessage[2];
1348 buffer3Length = lengths[2];
1349 totalDataBytes += lengths[2] + 4;
1350 }
1351
1352 length = 28ull + totalDataBytes;
1353 if (length > INT_MAX)
1354 return -1;
1355 s = Stream_New(nullptr, length);
1356
1357 if (!s)
1358 {
1359 WLog_Print(tsg->log, WLOG_ERROR, "Stream_New failed!");
1360 return -1;
1361 }
1362
1363 /* PCHANNEL_CONTEXT_HANDLE_NOSERIALIZE_NR (20 bytes) */
1364 if (!TsProxyWriteTunnelContext(tsg->log, s, &tsg->ChannelContext))
1365 goto fail;
1366 Stream_Write_UINT32_BE(s, totalDataBytes); /* totalDataBytes (4 bytes) */
1367 Stream_Write_UINT32_BE(s, numBuffers); /* numBuffers (4 bytes) */
1368
1369 if (buffer1Length > 0)
1370 Stream_Write_UINT32_BE(s, buffer1Length); /* buffer1Length (4 bytes) */
1371
1372 if (buffer2Length > 0)
1373 Stream_Write_UINT32_BE(s, buffer2Length); /* buffer2Length (4 bytes) */
1374
1375 if (buffer3Length > 0)
1376 Stream_Write_UINT32_BE(s, buffer3Length); /* buffer3Length (4 bytes) */
1377
1378 if (buffer1Length > 0)
1379 Stream_Write(s, buffer1, buffer1Length); /* buffer1 (variable) */
1380
1381 if (buffer2Length > 0)
1382 Stream_Write(s, buffer2, buffer2Length); /* buffer2 (variable) */
1383
1384 if (buffer3Length > 0)
1385 Stream_Write(s, buffer3, buffer3Length); /* buffer3 (variable) */
1386
1387 if (!rpc_client_write_call(tsg->rpc, s, TsProxySendToServerOpnum))
1388 return -1;
1389
1390 return (int)length;
1391fail:
1392 Stream_Free(s, TRUE);
1393 return -1;
1394}
1395
1407static BOOL TsProxyCreateTunnelWriteRequest(rdpTsg* tsg, const TSG_PACKET* tsgPacket)
1408{
1409 BOOL rc = FALSE;
1410 BOOL write = TRUE;
1411 UINT16 opnum = 0;
1412 wStream* s = nullptr;
1413 rdpRpc* rpc = nullptr;
1414
1415 if (!tsg || !tsg->rpc)
1416 return FALSE;
1417
1418 rpc = tsg->rpc;
1419 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_to_string(tsgPacket));
1420 s = Stream_New(nullptr, 108);
1421
1422 if (!s)
1423 return FALSE;
1424
1425 switch (tsgPacket->packetId)
1426 {
1427 case TSG_PACKET_TYPE_VERSIONCAPS:
1428 {
1429 UINT32 index = 0;
1430 const TSG_PACKET_VERSIONCAPS* packetVersionCaps =
1431 &tsgPacket->tsgPacket.packetVersionCaps;
1432
1433 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1434 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1435 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketVersionCapsPtr (4 bytes) */
1436 goto fail;
1437
1438 if (!tsg_ndr_write_version_caps(tsg->log, s, &index, packetVersionCaps))
1439 goto fail;
1444 /*
1445 * 8-byte constant (8A E3 13 71 02 F4 36 71) also observed here:
1446 * http://lists.samba.org/archive/cifs-protocol/2010-July/001543.html
1447 */
1448 Stream_Write_UINT8(s, 0x8A);
1449 Stream_Write_UINT8(s, 0xE3);
1450 Stream_Write_UINT8(s, 0x13);
1451 Stream_Write_UINT8(s, 0x71);
1452 Stream_Write_UINT8(s, 0x02);
1453 Stream_Write_UINT8(s, 0xF4);
1454 Stream_Write_UINT8(s, 0x36);
1455 Stream_Write_UINT8(s, 0x71);
1456 Stream_Write_UINT32(s, 0x00040001); /* 1.4 (version?) */
1457 Stream_Write_UINT32(s, 0x00000001); /* 1 (element count?) */
1458 /* p_cont_list_t */
1459 Stream_Write_UINT8(s, 2); /* ncontext_elem */
1460 Stream_Write_UINT8(s, 0x40); /* reserved1 */
1461 Stream_Write_UINT16(s, 0x0028); /* reserved2 */
1462 /* p_syntax_id_t */
1463 Stream_Write(s, &TSGU_UUID, sizeof(p_uuid_t));
1464 Stream_Write_UINT32(s, TSGU_SYNTAX_IF_VERSION);
1465 /* p_syntax_id_t */
1466 Stream_Write(s, &NDR_UUID, sizeof(p_uuid_t));
1467 Stream_Write_UINT32(s, NDR_SYNTAX_IF_VERSION);
1468 opnum = TsProxyCreateTunnelOpnum;
1469 }
1470 break;
1471
1472 case TSG_PACKET_TYPE_REAUTH:
1473 {
1474 const TSG_PACKET_REAUTH* packetReauth = &tsgPacket->tsgPacket.packetReauth;
1475 UINT32 index = 0;
1476 Stream_Write_UINT32(s, tsgPacket->packetId); /* PacketId (4 bytes) */
1477 Stream_Write_UINT32(s, tsgPacket->packetId); /* SwitchValue (4 bytes) */
1478 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketReauthPtr (4 bytes) */
1479 goto fail;
1480 if (!tsg_ndr_write_reauth(tsg->log, s, &index, packetReauth))
1481 goto fail;
1482 opnum = TsProxyCreateTunnelOpnum;
1483 }
1484 break;
1485
1486 default:
1487 WLog_Print(tsg->log, WLOG_WARN, "unexpected packetId %s",
1488 tsg_packet_id_to_string(tsgPacket->packetId));
1489 write = FALSE;
1490 break;
1491 }
1492
1493 rc = TRUE;
1494
1495 if (write)
1496 return rpc_client_write_call(rpc, s, opnum);
1497fail:
1498 Stream_Free(s, TRUE);
1499 return rc;
1500}
1501
1502static BOOL tsg_ndr_read_consent_message(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1503 BOOL isMessagePresent)
1504{
1505 TSG_PACKET_STRING_MESSAGE packetStringMessage = WINPR_C_ARRAY_INIT;
1506
1507 WINPR_ASSERT(context);
1508 WINPR_ASSERT(index);
1509
1510 if (!TsProxyReadPacketSTringMessage(log, s, index, &packetStringMessage))
1511 return FALSE;
1512
1513 if (context->instance && isMessagePresent)
1514 {
1515 return IFCALLRESULT(TRUE, context->instance->PresentGatewayMessage, context->instance,
1516 TSG_ASYNC_MESSAGE_CONSENT_MESSAGE ? GATEWAY_MESSAGE_CONSENT
1517 : TSG_ASYNC_MESSAGE_SERVICE_MESSAGE,
1518 packetStringMessage.isDisplayMandatory != 0,
1519 packetStringMessage.isConsentMandatory != 0,
1520 packetStringMessage.msgBytes, packetStringMessage.msgBuffer);
1521 }
1522
1523 return TRUE;
1524}
1525
1526static BOOL tsg_ndr_read_tunnel_context(wLog* log, wStream* s, CONTEXT_HANDLE* tunnelContext,
1527 UINT32* tunnelId)
1528{
1529 if (!tsg_stream_align(log, s, 4))
1530 return FALSE;
1531
1532 /* TunnelContext (20 bytes) */
1533 if (!TsProxyReadTunnelContext(log, s, tunnelContext))
1534 return FALSE;
1535
1536 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1537 return FALSE;
1538
1539 WINPR_ASSERT(tunnelId);
1540 Stream_Read_UINT32(s, *tunnelId); /* TunnelId (4 bytes) */
1541
1542 INT32 ReturnValue = 0;
1543 Stream_Read_INT32(s, ReturnValue); /* ReturnValue (4 bytes) */
1544 if (ReturnValue != NO_ERROR)
1545 WLog_WARN(TAG, "ReturnValue=%s", NtStatus2Tag(ReturnValue));
1546 return TRUE;
1547}
1548
1549static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(wLog* log, wStream* s,
1550 TSG_PACKET_MSG_RESPONSE* pkt)
1551{
1552
1553 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 16))
1554 return FALSE;
1555
1556 Stream_Read_UINT32(s, pkt->msgID); /* MsgId (4 bytes) */
1557 Stream_Read_UINT32(s, pkt->msgType); /* MsgType (4 bytes) */
1558 Stream_Read_INT32(s, pkt->isMsgPresent); /* IsMsgPresent (4 bytes) */
1559 const uint32_t SwitchValue = Stream_Get_UINT32(s); /* SwitchValue (4 bytes) */
1560
1561 if (pkt->msgType != SwitchValue)
1562 {
1563 WLog_ERR(TAG,
1564 "[MS-TSGU] 2.2.9.2.1.9 TSG_PACKET_MSG_RESPONSE MsgType[0x%08" PRIx32
1565 "] != MessageSwitchValue [0x%08" PRIx32 "]",
1566 pkt->msgType, SwitchValue);
1567 return FALSE;
1568 }
1569
1570 return TRUE;
1571}
1572
1573static BOOL tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(wLog* log, rdpContext* context, wStream* s,
1574 uint32_t* index, uint32_t MsgPtr,
1575 const TSG_PACKET_MSG_RESPONSE* pkg,
1576 uint64_t* reauthContext)
1577{
1578 WINPR_ASSERT(pkg);
1579
1580 if (MsgPtr == 0)
1581 {
1582 WLog_Print(log, WLOG_DEBUG,
1583 "Message {0x%08" PRIx32 "} [%s]::isMsgPresent=%" PRId32 ", MsgPtr=0x%08" PRIx32,
1584 pkg->msgType, tsg_packet_id_to_string(pkg->msgType), pkg->isMsgPresent, MsgPtr);
1585 return TRUE;
1586 }
1587
1588 switch (pkg->msgType)
1589 {
1590 case TSG_ASYNC_MESSAGE_CONSENT_MESSAGE:
1591 case TSG_ASYNC_MESSAGE_SERVICE_MESSAGE:
1592 return tsg_ndr_read_consent_message(log, context, s, index, pkg->isMsgPresent);
1593
1594 case TSG_ASYNC_MESSAGE_REAUTH:
1595 {
1596 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 8))
1597 return FALSE;
1598
1599 WINPR_ASSERT(reauthContext);
1600 const uint64_t val = Stream_Get_UINT64(s); /* TunnelContext (8 bytes) */
1601 if (pkg->isMsgPresent != 0)
1602 *reauthContext = val;
1603 return TRUE;
1604 }
1605
1606 default:
1607 WLog_Print(log, WLOG_ERROR, "Unexpected Message Type: 0x%" PRIx32 "", pkg->msgType);
1608 return FALSE;
1609 }
1610}
1611
1612static BOOL tsg_ndr_read_caps_response(wLog* log, rdpContext* context, wStream* s, UINT32* index,
1613 UINT32 PacketPtr, TSG_PACKET_CAPS_RESPONSE* caps,
1614 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId,
1615 uint64_t* reauthContext)
1616{
1617 UINT32 PacketQuarResponsePtr = 0;
1618
1619 WINPR_ASSERT(context);
1620 WINPR_ASSERT(index);
1621 WINPR_ASSERT(caps);
1622 WINPR_ASSERT(reauthContext);
1623
1624 if (!tsg_ndr_pointer_read(log, s, index, &PacketQuarResponsePtr, TRUE))
1625 goto fail;
1626
1627 if (!tsg_ndr_read_quarenc_response(log, s, index, &caps->pktQuarEncResponse))
1628 goto fail;
1629
1630 if (PacketPtr)
1631 {
1632 TSG_PACKET_MSG_RESPONSE pkg = WINPR_C_ARRAY_INIT;
1633 UINT32 MsgPtr = 0;
1634
1635 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(log, s, &pkg))
1636 goto fail;
1637
1638 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, TRUE))
1639 return FALSE;
1640
1641 if (!tsg_ndr_read_quarenc_data(log, s, index, &caps->pktQuarEncResponse))
1642 goto fail;
1643
1644 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(log, context, s, index, MsgPtr, &pkg,
1645 reauthContext))
1646 goto fail;
1647 }
1648
1649 return tsg_ndr_read_tunnel_context(log, s, tunnelContext, tunnelId);
1650fail:
1651 return FALSE;
1652}
1653
1654static BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu,
1655 CONTEXT_HANDLE* tunnelContext, UINT32* tunnelId)
1656{
1657 BOOL rc = FALSE;
1658 UINT32 index = 0;
1659 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
1660 UINT32 SwitchValue = 0;
1661 rdpContext* context = nullptr;
1662 UINT32 PacketPtr = 0;
1663
1664 WINPR_ASSERT(tsg);
1665 WINPR_ASSERT(tsg->rpc);
1666 WINPR_ASSERT(tsg->rpc->transport);
1667
1668 context = transport_get_context(tsg->rpc->transport);
1669 WINPR_ASSERT(context);
1670
1671 if (!pdu)
1672 return FALSE;
1673
1674 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
1675 goto fail;
1676
1677 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 8))
1678 goto fail;
1679 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
1680 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
1681
1682 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
1683
1684 if ((packet.packetId == TSG_PACKET_TYPE_CAPS_RESPONSE) &&
1685 (SwitchValue == TSG_PACKET_TYPE_CAPS_RESPONSE))
1686 {
1687 if (!tsg_ndr_read_caps_response(tsg->log, context, pdu->s, &index, PacketPtr,
1688 &packet.tsgPacket.packetCapsResponse, tunnelContext,
1689 tunnelId, &tsg->ReauthTunnelContext))
1690 goto fail;
1691 tsg->CapsResponse = packet.tsgPacket.packetCapsResponse.pktQuarEncResponse;
1692 }
1693 else if ((packet.packetId == TSG_PACKET_TYPE_QUARENC_RESPONSE) &&
1694 (SwitchValue == TSG_PACKET_TYPE_QUARENC_RESPONSE))
1695 {
1696 UINT32 PacketQuarResponsePtr = 0;
1697
1698 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketQuarResponsePtr, TRUE))
1699 goto fail;
1700
1701 if (!tsg_ndr_read_quarenc_response(tsg->log, pdu->s, &index,
1702 &packet.tsgPacket.packetQuarEncResponse))
1703 goto fail;
1704
1705 if (!tsg_ndr_read_quarenc_data(tsg->log, pdu->s, &index,
1706 &packet.tsgPacket.packetQuarEncResponse))
1707 goto fail;
1708
1709 if (!tsg_ndr_read_tunnel_context(tsg->log, pdu->s, tunnelContext, tunnelId))
1710 goto fail;
1711
1712 tsg->CapsResponse = packet.tsgPacket.packetQuarEncResponse;
1713 }
1714 else
1715 {
1716 WLog_Print(tsg->log, WLOG_ERROR,
1717 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_CAPS_RESPONSE "
1718 "or TSG_PACKET_TYPE_QUARENC_RESPONSE",
1719 packet.packetId);
1720 goto fail;
1721 }
1722
1723 {
1724 const size_t rem = Stream_GetRemainingLength(pdu->s);
1725 if (rem != 0)
1726 {
1727 WLog_Print(tsg->log, WLOG_WARN, "Partially parsed %s, %" PRIuz " bytes remain",
1728 tsg_packet_id_to_string(packet.packetId), rem);
1729 }
1730 }
1731
1732 rc = TRUE;
1733fail:
1734 return rc;
1735}
1736
1748static BOOL TsProxyAuthorizeTunnelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
1749{
1750 if (!tsg || !tsg->rpc || !tunnelContext)
1751 return FALSE;
1752
1753 rdpRpc* rpc = tsg->rpc;
1754
1755 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyAuthorizeTunnelWriteRequest");
1756 wStream* s = Stream_New(nullptr, 1024 + sizeof(WCHAR) * tsg->QuarreQuest.nameLength +
1757 tsg->QuarreQuest.dataLen);
1758
1759 if (!s)
1760 return FALSE;
1761
1762 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
1763 {
1764 Stream_Free(s, TRUE);
1765 return FALSE;
1766 }
1767
1768 /* 4-byte alignment */
1769 UINT32 index = 0;
1770 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* PacketId (4 bytes) */
1771 Stream_Write_UINT32(s, TSG_PACKET_TYPE_QUARREQUEST); /* SwitchValue (4 bytes) */
1772 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketQuarRequestPtr (4 bytes) */
1773 goto fail;
1774 Stream_Write_UINT32(s, tsg->QuarreQuest.flags); /* Flags (4 bytes) */
1775 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* MachineNamePtr (4 bytes) */
1776 goto fail;
1777 Stream_Write_UINT32(s, tsg->QuarreQuest.nameLength); /* NameLength (4 bytes) */
1778 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* DataPtr (4 bytes) */
1779 goto fail;
1780 Stream_Write_UINT32(s, tsg->QuarreQuest.dataLen); /* DataLength (4 bytes) */
1781 /* MachineName */
1782 if (!tsg_ndr_write_string(tsg->log, s, tsg->QuarreQuest.machineName,
1783 tsg->QuarreQuest.nameLength))
1784 goto fail;
1785 /* data */
1786 if (!tsg_ndr_write_conformant_array(tsg->log, s, tsg->QuarreQuest.data,
1787 tsg->QuarreQuest.dataLen))
1788 goto fail;
1789
1790 Stream_SealLength(s);
1791 return rpc_client_write_call(rpc, s, TsProxyAuthorizeTunnelOpnum);
1792fail:
1793 Stream_Free(s, TRUE);
1794 return FALSE;
1795}
1796
1797static UINT32 tsg_redir_to_flags(const TSG_REDIRECTION_FLAGS* redirect)
1798{
1799 UINT32 flags = 0;
1800 if (redirect->enableAllRedirections)
1801 flags |= HTTP_TUNNEL_REDIR_ENABLE_ALL;
1802 if (redirect->disableAllRedirections)
1803 flags |= HTTP_TUNNEL_REDIR_DISABLE_ALL;
1804
1805 if (redirect->driveRedirectionDisabled)
1806 flags |= HTTP_TUNNEL_REDIR_DISABLE_DRIVE;
1807 if (redirect->printerRedirectionDisabled)
1808 flags |= HTTP_TUNNEL_REDIR_DISABLE_PRINTER;
1809 if (redirect->portRedirectionDisabled)
1810 flags |= HTTP_TUNNEL_REDIR_DISABLE_PORT;
1811 if (redirect->clipboardRedirectionDisabled)
1812 flags |= HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD;
1813 if (redirect->pnpRedirectionDisabled)
1814 flags |= HTTP_TUNNEL_REDIR_DISABLE_PNP;
1815 return flags;
1816}
1817
1818static BOOL tsg_redirect_apply(rdpTsg* tsg, const TSG_REDIRECTION_FLAGS* redirect)
1819{
1820 WINPR_ASSERT(tsg);
1821 WINPR_ASSERT(redirect);
1822
1823 rdpTransport* transport = tsg->transport;
1824 WINPR_ASSERT(transport);
1825
1826 rdpContext* context = transport_get_context(transport);
1827 UINT32 redirFlags = tsg_redir_to_flags(redirect);
1828 return utils_apply_gateway_policy(tsg->log, context, redirFlags, "TSG");
1829}
1830
1831static BOOL tsg_ndr_read_timeout(wLog* log, wStream* s, size_t tlen)
1832{
1833 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1834 return FALSE;
1835
1836 if (tlen < sizeof(UINT32))
1837 {
1838 WLog_Print(log, WLOG_ERROR, "[IDLE_TIMEOUT] array element length %" PRIuz ", expected 4",
1839 tlen);
1840 return FALSE;
1841 }
1842
1843 const UINT32 idleTimeout = Stream_Get_UINT32(s);
1844 WLog_Print(log, WLOG_DEBUG, "[IDLE_TIMEOUT] idleTimeout=%" PRIu32 ": TODO: unused",
1845 idleTimeout);
1846 return TRUE;
1847}
1848
1849static BOOL tsg_ndr_read_sohr(wLog* log, wStream* s, BOOL expected)
1850{
1851 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, s, 1, sizeof(UINT32)))
1852 return FALSE;
1853
1854 const UINT32 len = Stream_Get_UINT32(s);
1855 if (!expected)
1856 {
1857 if (len != 0)
1858 {
1859 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": skipping", len);
1860 return FALSE;
1861 }
1862 return TRUE;
1863 }
1864 else if (len == 0)
1865 {
1866 WLog_Print(log, WLOG_WARN, "[SOH] len=%" PRIu32 ": expected length > 0", len);
1867 }
1868
1869 WLog_Print(log, WLOG_DEBUG, "[SOH] len=%" PRIu32 ": TODO: unused", len);
1870 if (!Stream_SafeSeek(s, len))
1871 return FALSE;
1872
1873 winpr_HexLogDump(log, WLOG_DEBUG, Stream_Pointer(s), len);
1874 return TRUE;
1875}
1876
1877static BOOL tsg_ndr_read_packet_response_data(rdpTsg* tsg, wStream* s,
1878 const TSG_PACKET_RESPONSE* response)
1879{
1880 WINPR_ASSERT(tsg);
1881
1882 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1883 return FALSE;
1884
1885 const uint32_t arrayMaxLen = Stream_Get_UINT32(s);
1886 const size_t rem = Stream_GetRemainingLength(s);
1887 if (arrayMaxLen != response->responseDataLen)
1888 {
1889 WLog_Print(tsg->log, WLOG_ERROR,
1890 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1891 " != NDR array len %" PRIu32,
1892 response->responseDataLen, arrayMaxLen);
1893 }
1894 if (response->responseDataLen > 0)
1895 {
1896 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(tsg->log, s, 1, 4))
1897 return FALSE;
1898
1899 if (tsg->CapsResponse.versionCaps.tsgCaps.capabilityType != TSG_CAPABILITY_TYPE_NAP)
1900 {
1901 WLog_Print(
1902 tsg->log, WLOG_ERROR,
1903 "2.2.9.2.1.5 TSG_PACKET_RESPONSE Negotiated Capabilities type is 0x%08" PRIx32
1904 ", expected TSG_CAPABILITY_TYPE_NAP[0x00000001]",
1905 tsg->CapsResponse.versionCaps.tsgCaps.capabilityType);
1906 return FALSE;
1907 }
1908 const UINT32 mask = (TSG_NAP_CAPABILITY_QUAR_SOH | TSG_NAP_CAPABILITY_IDLE_TIMEOUT);
1909 const UINT32 val =
1910 (tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities & mask);
1911 if ((val == mask) && (tsg->QuarreQuest.dataLen > 0))
1912 {
1913 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1914 return FALSE;
1915 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1916 return FALSE;
1917 }
1918 else if ((val == TSG_NAP_CAPABILITY_QUAR_SOH) && (tsg->QuarreQuest.dataLen > 0))
1919 {
1920 if (!tsg_ndr_read_sohr(tsg->log, s, TRUE))
1921 return FALSE;
1922 }
1923 else if ((val & TSG_NAP_CAPABILITY_IDLE_TIMEOUT) != 0)
1924 {
1925 if (!tsg_ndr_read_timeout(tsg->log, s, arrayMaxLen))
1926 return FALSE;
1927 if (!tsg_ndr_read_sohr(tsg->log, s, FALSE))
1928 return FALSE;
1929 }
1930 else
1931 {
1932 WLog_Print(
1933 tsg->log, WLOG_ERROR,
1934 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1935 ", but neither TSG_NAP_CAPABILITY_QUAR_SOH nor "
1936 "TSG_NAP_CAPABILITY_IDLE_TIMEOUT are set, so expecting 0 (actually got %" PRIuz ")",
1937 response->responseDataLen, rem);
1938 return FALSE;
1939 }
1940 }
1941 else if (rem > 0)
1942 {
1943 char buffer[256] = WINPR_C_ARRAY_INIT;
1944 WLog_Print(tsg->log, WLOG_WARN,
1945 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen=%" PRIu32
1946 ", but actually got %" PRIuz " [flags=%s], ignoring.",
1947 response->responseDataLen, rem,
1948 tsg_caps_to_string(
1949 tsg->CapsResponse.versionCaps.tsgCaps.tsgPacket.tsgCapNap.capabilities,
1950 buffer, sizeof(buffer)));
1951 if (!Stream_SafeSeek(s, rem))
1952 return FALSE;
1953 }
1954
1955 {
1956 const size_t trem = Stream_GetRemainingLength(s);
1957 if (trem > 0)
1958 {
1959 WLog_Print(tsg->log, WLOG_WARN,
1960 "2.2.9.2.1.5 TSG_PACKET_RESPONSE %" PRIuz " unhandled bytes remain", trem);
1961 }
1962 }
1963 return TRUE;
1964}
1965
1966static BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
1967{
1968 BOOL rc = FALSE;
1969 UINT32 SwitchValue = 0;
1970 UINT32 index = 0;
1971 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
1972 UINT32 PacketPtr = 0;
1973 UINT32 PacketResponseDataPtr = 0;
1974
1975 WINPR_ASSERT(tsg);
1976 WINPR_ASSERT(pdu);
1977
1978 wLog* log = tsg->log;
1979 WINPR_ASSERT(log);
1980
1981 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketPtr, TRUE))
1982 goto fail;
1983
1984 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
1985 goto fail;
1986 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
1987 Stream_Read_UINT32(pdu->s, SwitchValue); /* SwitchValue (4 bytes) */
1988
1989 WLog_Print(log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
1990
1991 if (packet.packetId == E_PROXY_NAP_ACCESSDENIED)
1992 {
1993 WLog_Print(log, WLOG_ERROR, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)",
1994 E_PROXY_NAP_ACCESSDENIED);
1995 WLog_Print(log, WLOG_ERROR,
1996 "Ensure that the Gateway Connection Authorization Policy is correct");
1997 goto fail;
1998 }
1999
2000 if ((packet.packetId != TSG_PACKET_TYPE_RESPONSE) || (SwitchValue != TSG_PACKET_TYPE_RESPONSE))
2001 {
2002 WLog_Print(log, WLOG_ERROR,
2003 "Unexpected PacketId: 0x%08" PRIX32 ", Expected TSG_PACKET_TYPE_RESPONSE",
2004 packet.packetId);
2005 goto fail;
2006 }
2007
2008 if (!tsg_ndr_pointer_read(log, pdu->s, &index, nullptr, TRUE))
2009 goto fail;
2010
2011 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 8))
2012 goto fail;
2013
2014 packet.tsgPacket.packetResponse.flags = Stream_Get_UINT32(pdu->s);
2015 if (packet.tsgPacket.packetResponse.flags != TSG_PACKET_TYPE_QUARREQUEST)
2016 {
2017 WLog_Print(log, WLOG_ERROR,
2018 "Unexpected Packet Response flags: 0x%08" PRIX32
2019 ", Expected TSG_PACKET_TYPE_QUARREQUEST",
2020 packet.tsgPacket.packetResponse.flags);
2021 goto fail;
2022 }
2023
2024 packet.tsgPacket.packetResponse.reserved = Stream_Get_UINT32(pdu->s);
2025
2026 packet.tsgPacket.packetResponse.responseData = nullptr;
2027 if (!tsg_ndr_pointer_read(log, pdu->s, &index, &PacketResponseDataPtr, FALSE))
2028 goto fail;
2029
2030 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 4))
2031 goto fail;
2032
2033 packet.tsgPacket.packetResponse.responseDataLen = Stream_Get_UINT32(pdu->s);
2034 if (packet.tsgPacket.packetResponse.responseDataLen > 24000)
2035 {
2036 WLog_Print(log, WLOG_ERROR,
2037 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32 " > maximum(24000)",
2038 packet.tsgPacket.packetResponse.responseDataLen);
2039 goto fail;
2040 }
2041 if ((PacketResponseDataPtr == 0) && (packet.tsgPacket.packetResponse.responseDataLen != 0))
2042 {
2043 WLog_Print(log, WLOG_ERROR,
2044 "2.2.9.2.1.5 TSG_PACKET_RESPONSE::responseDataLen %" PRIu32
2045 " but responseData = nullptr",
2046 packet.tsgPacket.packetResponse.responseDataLen);
2047 goto fail;
2048 }
2049
2050 if (!tsg_ndr_read_packet_redirection_flags(log, pdu->s,
2051 &packet.tsgPacket.packetResponse.redirectionFlags))
2052 goto fail;
2053
2054 packet.tsgPacket.packetResponse.responseData = Stream_Pointer(pdu->s);
2055 if (!tsg_ndr_read_packet_response_data(tsg, pdu->s, &packet.tsgPacket.packetResponse))
2056 goto fail;
2057
2058 rc = tsg_redirect_apply(tsg, &packet.tsgPacket.packetResponse.redirectionFlags);
2059
2060fail:
2061 return rc;
2062}
2063
2075static BOOL TsProxyMakeTunnelCallWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext,
2076 UINT32 procId)
2077{
2078 wStream* s = nullptr;
2079 rdpRpc* rpc = nullptr;
2080
2081 if (!tsg || !tsg->rpc || !tunnelContext)
2082 return FALSE;
2083
2084 rpc = tsg->rpc;
2085 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyMakeTunnelCallWriteRequest");
2086 s = Stream_New(nullptr, 40);
2087
2088 if (!s)
2089 return FALSE;
2090
2091 /* TunnelContext (20 bytes) */
2092 UINT32 index = 0;
2093 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2094 goto fail;
2095 Stream_Write_UINT32(s, procId); /* ProcId (4 bytes) */
2096 /* 4-byte alignment */
2097 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* PacketId (4 bytes) */
2098 Stream_Write_UINT32(s, TSG_PACKET_TYPE_MSGREQUEST_PACKET); /* SwitchValue (4 bytes) */
2099 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1)) /* PacketMsgRequestPtr (4 bytes) */
2100 goto fail;
2101 Stream_Write_UINT32(s, 0x00000001); /* MaxMessagesPerBatch (4 bytes) */
2102 return rpc_client_write_call(rpc, s, TsProxyMakeTunnelCallOpnum);
2103fail:
2104 Stream_Free(s, TRUE);
2105 return FALSE;
2106}
2107
2108static BOOL TsProxyReadPacketSTringMessage(wLog* log, wStream* s, uint32_t* index,
2109 TSG_PACKET_STRING_MESSAGE* msg)
2110{
2111 UINT32 MsgPtr = 0;
2112
2113 WINPR_ASSERT(msg);
2114
2115 const TSG_PACKET_STRING_MESSAGE empty = WINPR_C_ARRAY_INIT;
2116 *msg = empty;
2117
2118 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 12))
2119 return FALSE;
2120
2121 Stream_Read_INT32(s, msg->isDisplayMandatory); /* IsDisplayMandatory (4 bytes) */
2122 Stream_Read_INT32(s, msg->isConsentMandatory); /* IsConsentMandatory (4 bytes) */
2123 Stream_Read_UINT32(s, msg->msgBytes); /* MsgBytes (4 bytes) */
2124
2125 if (!tsg_ndr_pointer_read(log, s, index, &MsgPtr, msg->msgBytes != 0))
2126 return FALSE;
2127
2128 if (msg->msgBytes > TSG_MESSAGING_MAX_MESSAGE_LENGTH)
2129 {
2130 WLog_Print(log, WLOG_ERROR, "Out of Spec Message Length %" PRIu32 "", msg->msgBytes);
2131 return FALSE;
2132 }
2133
2134 if (msg->msgBytes == 0)
2135 {
2136 WLog_Print(log, WLOG_DEBUG, "Empty message, skipping string read");
2137 return TRUE;
2138 }
2139
2140 return tsg_ndr_read_string(log, s, &msg->msgBuffer, msg->msgBytes);
2141}
2142
2143static BOOL TsProxyMakeTunnelCallReadResponse(rdpTsg* tsg, const RPC_PDU* pdu)
2144{
2145 BOOL rc = FALSE;
2146 UINT32 index = 0;
2147 TSG_PACKET packet = WINPR_C_ARRAY_INIT;
2148 rdpContext* context = nullptr;
2149 TSG_PACKET_MSG_RESPONSE packetMsgResponse = WINPR_C_ARRAY_INIT;
2150 UINT32 PacketPtr = 0;
2151 UINT32 PacketMsgResponsePtr = 0;
2152
2153 WINPR_ASSERT(tsg);
2154 WINPR_ASSERT(tsg->rpc);
2155
2156 context = transport_get_context(tsg->rpc->transport);
2157 WINPR_ASSERT(context);
2158
2159 /* This is an asynchronous response */
2160
2161 if (!pdu)
2162 return FALSE;
2163
2164 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, 28))
2165 goto fail;
2166
2167 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketPtr, TRUE))
2168 goto fail;
2169
2170 Stream_Read_UINT32(pdu->s, packet.packetId); /* PacketId (4 bytes) */
2171
2172 {
2173 const uint32_t SwitchValue = Stream_Get_UINT32(pdu->s); /* SwitchValue (4 bytes) */
2174 WLog_Print(tsg->log, WLOG_DEBUG, "%s", tsg_packet_id_to_string(packet.packetId));
2175
2176 if ((packet.packetId != TSG_PACKET_TYPE_MESSAGE_PACKET) || (packet.packetId != SwitchValue))
2177 {
2178 WLog_Print(tsg->log, WLOG_ERROR,
2179 "Unexpected PacketId: 0x%08" PRIX32
2180 ", Expected TSG_PACKET_TYPE_MESSAGE_PACKET",
2181 packet.packetId);
2182 goto fail;
2183 }
2184 }
2185
2186 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &PacketMsgResponsePtr, TRUE))
2187 goto fail;
2188
2189 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE_header(tsg->log, pdu->s, &packetMsgResponse))
2190 goto fail;
2191
2192 {
2193 UINT32 MessagePtr = 0;
2194 if (!tsg_ndr_pointer_read(tsg->log, pdu->s, &index, &MessagePtr, TRUE))
2195 goto fail;
2196
2197 if (!tsg_ndr_read_TSG_PACKET_MSG_RESPONSE(tsg->log, context, pdu->s, &index, MessagePtr,
2198 &packetMsgResponse, &tsg->ReauthTunnelContext))
2199 goto fail;
2200 }
2201
2202 rc = TRUE;
2203fail:
2204 return rc;
2205}
2206
2218static BOOL TsProxyCreateChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* tunnelContext)
2219{
2220 WINPR_ASSERT(tsg);
2221 WINPR_ASSERT(tunnelContext);
2222
2223 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCreateChannelWriteRequest");
2224
2225 if (!tsg->rpc || !tsg->Hostname)
2226 return FALSE;
2227
2228 rdpRpc* rpc = tsg->rpc;
2229 const size_t count = _wcslen(tsg->Hostname) + 1;
2230 if (count > UINT32_MAX)
2231 return FALSE;
2232
2233 wStream* s = Stream_New(nullptr, 60 + count * 2);
2234 if (!s)
2235 return FALSE;
2236
2237 /* TunnelContext (20 bytes) */
2238 if (!TsProxyWriteTunnelContext(tsg->log, s, tunnelContext))
2239 goto fail;
2240
2241 /* TSENDPOINTINFO */
2242 {
2243 UINT32 index = 0;
2244 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2245 goto fail;
2246 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2247 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 0))
2248 goto fail;
2249 }
2250
2251 Stream_Write_UINT16(s, 0x0000); /* NumAlternateResourceNames (2 bytes) */
2252 Stream_Write_UINT16(s, 0x0000); /* Pad (2 bytes) */
2253 /* Port (4 bytes) */
2254 Stream_Write_UINT16(s, 0x0003); /* ProtocolId (RDP = 3) (2 bytes) */
2255 Stream_Write_UINT16(s, tsg->Port); /* PortNumber (0xD3D = 3389) (2 bytes) */
2256 Stream_Write_UINT32(s, 0x00000001); /* NumResourceNames (4 bytes) */
2257 {
2258 UINT32 index = 0;
2259 if (!tsg_ndr_pointer_write(tsg->log, s, &index, 1))
2260 goto fail;
2261 }
2262 if (!tsg_ndr_write_string(tsg->log, s, tsg->Hostname, count))
2263 goto fail;
2264 return rpc_client_write_call(rpc, s, TsProxyCreateChannelOpnum);
2265
2266fail:
2267 Stream_Free(s, TRUE);
2268 return FALSE;
2269}
2270
2271static BOOL TsProxyCreateChannelReadResponse(wLog* log, const RPC_PDU* pdu,
2272 CONTEXT_HANDLE* channelContext, UINT32* channelId)
2273{
2274 BOOL rc = FALSE;
2275
2276 WINPR_ASSERT(log);
2277 WINPR_ASSERT(pdu);
2278 WINPR_ASSERT(channelId);
2279
2280 WLog_Print(log, WLOG_DEBUG, "TsProxyCreateChannelReadResponse");
2281
2282 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 28))
2283 goto fail;
2284
2285 /* ChannelContext (20 bytes) */
2286 if (!TsProxyReadTunnelContext(log, pdu->s, channelContext))
2287 goto fail;
2288 if (!Stream_CheckAndLogRequiredLengthOfSizeWLog(log, pdu->s, 2, sizeof(UINT32)))
2289 goto fail;
2290 Stream_Read_UINT32(pdu->s, *channelId); /* ChannelId (4 bytes) */
2291 Stream_Seek_UINT32(pdu->s); /* ReturnValue (4 bytes) */
2292 rc = TRUE;
2293fail:
2294 return rc;
2295}
2296
2303static BOOL TsProxyCloseChannelWriteRequest(rdpTsg* tsg, CONTEXT_HANDLE* context)
2304{
2305 WINPR_ASSERT(tsg);
2306 WINPR_ASSERT(context);
2307
2308 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseChannelWriteRequest");
2309
2310 rdpRpc* rpc = tsg->rpc;
2311 WINPR_ASSERT(rpc);
2312
2313 wStream* s = Stream_New(nullptr, 20);
2314
2315 if (!s)
2316 return FALSE;
2317
2318 /* ChannelContext (20 bytes) */
2319 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2320 goto fail;
2321 return rpc_client_write_call(rpc, s, TsProxyCloseChannelOpnum);
2322fail:
2323 Stream_Free(s, TRUE);
2324 return FALSE;
2325}
2326
2327static BOOL TsProxyCloseChannelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2328{
2329 BOOL rc = FALSE;
2330 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseChannelReadResponse");
2331
2332 if (!pdu)
2333 return FALSE;
2334
2335 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2336 goto fail;
2337
2338 /* ChannelContext (20 bytes) */
2339 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2340 goto fail;
2341
2342 {
2343 const size_t len = sizeof(UINT32);
2344 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2345 goto fail;
2346 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2347 rc = TRUE;
2348 }
2349fail:
2350 return rc;
2351}
2352
2359static BOOL TsProxyCloseTunnelWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* context)
2360{
2361 WINPR_ASSERT(tsg);
2362 WINPR_ASSERT(context);
2363
2364 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxyCloseTunnelWriteRequest");
2365
2366 rdpRpc* rpc = tsg->rpc;
2367 WINPR_ASSERT(rpc);
2368
2369 wStream* s = Stream_New(nullptr, 20);
2370
2371 if (!s)
2372 return FALSE;
2373
2374 /* TunnelContext (20 bytes) */
2375 if (!TsProxyWriteTunnelContext(tsg->log, s, context))
2376 goto fail;
2377 return rpc_client_write_call(rpc, s, TsProxyCloseTunnelOpnum);
2378fail:
2379 Stream_Free(s, TRUE);
2380 return FALSE;
2381}
2382
2383static BOOL TsProxyCloseTunnelReadResponse(wLog* log, const RPC_PDU* pdu, CONTEXT_HANDLE* context)
2384{
2385 BOOL rc = FALSE;
2386
2387 WINPR_ASSERT(log);
2388 WINPR_ASSERT(pdu);
2389 WINPR_ASSERT(context);
2390
2391 WLog_Print(log, WLOG_DEBUG, "TsProxyCloseTunnelReadResponse");
2392
2393 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, 24))
2394 goto fail;
2395
2396 /* TunnelContext (20 bytes) */
2397 if (!TsProxyReadTunnelContext(log, pdu->s, context))
2398 goto fail;
2399 {
2400 const size_t len = sizeof(UINT32);
2401 if (!Stream_CheckAndLogRequiredLengthWLog(log, pdu->s, len))
2402 goto fail;
2403 Stream_Seek(pdu->s, len); /* ReturnValue (4 bytes) */
2404 rc = TRUE;
2405 }
2406fail:
2407 return rc;
2408}
2409
2418static BOOL TsProxySetupReceivePipeWriteRequest(rdpTsg* tsg, const CONTEXT_HANDLE* channelContext)
2419{
2420 wStream* s = nullptr;
2421 rdpRpc* rpc = nullptr;
2422 WLog_Print(tsg->log, WLOG_DEBUG, "TsProxySetupReceivePipeWriteRequest");
2423
2424 WINPR_ASSERT(tsg);
2425 WINPR_ASSERT(tsg->rpc);
2426
2427 if (!channelContext)
2428 return FALSE;
2429
2430 rpc = tsg->rpc;
2431 s = Stream_New(nullptr, 20);
2432
2433 if (!s)
2434 return FALSE;
2435
2436 /* ChannelContext (20 bytes) */
2437 if (!TsProxyWriteTunnelContext(tsg->log, s, channelContext))
2438 goto fail;
2439 return rpc_client_write_call(rpc, s, TsProxySetupReceivePipeOpnum);
2440fail:
2441 Stream_Free(s, TRUE);
2442 return FALSE;
2443}
2444
2445static BOOL tsg_transition_to_state(rdpTsg* tsg, TSG_STATE state)
2446{
2447 WINPR_ASSERT(tsg);
2448 const char* oldState = tsg_state_to_string(tsg->state);
2449 const char* newState = tsg_state_to_string(state);
2450
2451 WLog_Print(tsg->log, WLOG_DEBUG, "%s -> %s", oldState, newState);
2452 return tsg_set_state(tsg, state);
2453}
2454
2455static BOOL tsg_initialize_version_caps(const rdpTsg* tsg,
2456 TSG_PACKET_VERSIONCAPS* packetVersionCaps)
2457{
2458 WINPR_ASSERT(tsg);
2459 WINPR_ASSERT(packetVersionCaps);
2460
2461 packetVersionCaps->tsgHeader.ComponentId = TS_GATEWAY_TRANSPORT;
2462 packetVersionCaps->tsgHeader.PacketId = TSG_PACKET_TYPE_VERSIONCAPS;
2463 packetVersionCaps->numCapabilities = 1;
2464 packetVersionCaps->majorVersion = 1;
2465 packetVersionCaps->minorVersion = 1;
2466 packetVersionCaps->quarantineCapabilities = 0;
2467 packetVersionCaps->tsgCaps.capabilityType = TSG_CAPABILITY_TYPE_NAP;
2468 /*
2469 * Using reduced capabilities appears to trigger
2470 * TSG_PACKET_TYPE_QUARENC_RESPONSE instead of TSG_PACKET_TYPE_CAPS_RESPONSE
2471 *
2472 * However, reduced capabilities may break connectivity with servers enforcing features,
2473 * such as "Only allow connections from Remote Desktop Services clients that support RD
2474 * Gateway messaging"
2475 */
2476
2477 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities =
2478 TSG_NAP_CAPABILITY_IDLE_TIMEOUT | TSG_MESSAGING_CAP_CONSENT_SIGN |
2479 TSG_MESSAGING_CAP_SERVICE_MSG | TSG_MESSAGING_CAP_REAUTH;
2480 if (tsg->QuarreQuest.dataLen > 0)
2481 packetVersionCaps->tsgCaps.tsgPacket.tsgCapNap.capabilities |= TSG_NAP_CAPABILITY_QUAR_SOH;
2482
2483 return TRUE;
2484}
2485
2486static void resetCaps(rdpTsg* tsg)
2487{
2488 WINPR_ASSERT(tsg);
2489 const TSG_PACKET_QUARENC_RESPONSE empty = WINPR_C_ARRAY_INIT;
2490 tsg->CapsResponse = empty;
2491}
2492
2493BOOL tsg_proxy_begin(rdpTsg* tsg)
2494{
2495 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2496
2497 WINPR_ASSERT(tsg);
2498
2499 tsgPacket.packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2500 if (!tsg_initialize_version_caps(tsg, &tsgPacket.tsgPacket.packetVersionCaps) ||
2501 !TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2502 {
2503 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2504 tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2505 return FALSE;
2506 }
2507
2508 resetCaps(tsg);
2509
2510 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2511}
2512
2513static BOOL tsg_proxy_reauth(rdpTsg* tsg)
2514{
2515 TSG_PACKET tsgPacket = WINPR_C_ARRAY_INIT;
2516
2517 WINPR_ASSERT(tsg);
2518
2519 tsg->reauthSequence = TRUE;
2520 TSG_PACKET_REAUTH* packetReauth = &tsgPacket.tsgPacket.packetReauth;
2521
2522 tsgPacket.packetId = TSG_PACKET_TYPE_REAUTH;
2523 packetReauth->tunnelContext = tsg->ReauthTunnelContext;
2524 packetReauth->packetId = TSG_PACKET_TYPE_VERSIONCAPS;
2525
2526 if (!tsg_initialize_version_caps(tsg, &packetReauth->tsgInitialPacket.packetVersionCaps))
2527 return FALSE;
2528
2529 if (!TsProxyCreateTunnelWriteRequest(tsg, &tsgPacket))
2530 {
2531 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnel failure");
2532 tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2533 return FALSE;
2534 }
2535
2536 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2537 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2538 {
2539 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2540 tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2541 return FALSE;
2542 }
2543
2544 resetCaps(tsg);
2545 return tsg_transition_to_state(tsg, TSG_STATE_INITIAL);
2546}
2547
2548BOOL tsg_recv_pdu(rdpTsg* tsg, const RPC_PDU* pdu)
2549{
2550 BOOL rc = FALSE;
2551 RpcClientCall* call = nullptr;
2552 rdpRpc* rpc = nullptr;
2553
2554 WINPR_ASSERT(tsg);
2555 WINPR_ASSERT(pdu);
2556 WINPR_ASSERT(tsg->rpc);
2557
2558 rpc = tsg->rpc;
2559
2560 if (!(pdu->Flags & RPC_PDU_FLAG_STUB))
2561 {
2562 const size_t len = 24;
2563 if (!Stream_CheckAndLogRequiredLengthWLog(tsg->log, pdu->s, len))
2564 return FALSE;
2565 Stream_Seek(pdu->s, len);
2566 }
2567
2568 const TSG_STATE oldState = tsg->state;
2569 switch (tsg->state)
2570 {
2571 case TSG_STATE_INITIAL:
2572 {
2573 CONTEXT_HANDLE* TunnelContext = nullptr;
2574 TunnelContext = (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2575
2576 if (!TsProxyCreateTunnelReadResponse(tsg, pdu, TunnelContext, &tsg->TunnelId))
2577 {
2578 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateTunnelReadResponse failure");
2579 return FALSE;
2580 }
2581
2582 if (!tsg_transition_to_state(tsg, TSG_STATE_CONNECTED))
2583 return FALSE;
2584
2585 if (!TsProxyAuthorizeTunnelWriteRequest(tsg, TunnelContext))
2586 {
2587 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnel failure");
2588 return FALSE;
2589 }
2590
2591 rc = TRUE;
2592 }
2593 break;
2594
2595 case TSG_STATE_CONNECTED:
2596 {
2597 CONTEXT_HANDLE* TunnelContext =
2598 (tsg->reauthSequence) ? &tsg->NewTunnelContext : &tsg->TunnelContext;
2599
2600 if (!TsProxyAuthorizeTunnelReadResponse(tsg, pdu))
2601 {
2602 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyAuthorizeTunnelReadResponse failure");
2603 return FALSE;
2604 }
2605
2606 if (!tsg_transition_to_state(tsg, TSG_STATE_AUTHORIZED))
2607 return FALSE;
2608
2609 if (!tsg->reauthSequence)
2610 {
2611 if (!TsProxyMakeTunnelCallWriteRequest(tsg, TunnelContext,
2612 TSG_TUNNEL_CALL_ASYNC_MSG_REQUEST))
2613 {
2614 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2615 return FALSE;
2616 }
2617 }
2618
2619 if (!TsProxyCreateChannelWriteRequest(tsg, TunnelContext))
2620 {
2621 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannel failure");
2622 return FALSE;
2623 }
2624
2625 rc = TRUE;
2626 }
2627 break;
2628
2629 case TSG_STATE_AUTHORIZED:
2630 call = rpc_client_call_find_by_id(rpc->client, pdu->CallId);
2631
2632 if (!call)
2633 return FALSE;
2634
2635 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2636 {
2637 if (!TsProxyMakeTunnelCallReadResponse(tsg, pdu))
2638 {
2639 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2640 return FALSE;
2641 }
2642
2643 rc = TRUE;
2644 }
2645 else if (call->OpNum == TsProxyCreateChannelOpnum)
2646 {
2647 CONTEXT_HANDLE ChannelContext;
2648
2649 if (!TsProxyCreateChannelReadResponse(tsg->log, pdu, &ChannelContext,
2650 &tsg->ChannelId))
2651 {
2652 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCreateChannelReadResponse failure");
2653 return FALSE;
2654 }
2655
2656 if (!tsg->reauthSequence)
2657 CopyMemory(&tsg->ChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2658 else
2659 CopyMemory(&tsg->NewChannelContext, &ChannelContext, sizeof(CONTEXT_HANDLE));
2660
2661 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CREATED))
2662 return FALSE;
2663
2664 if (!tsg->reauthSequence)
2665 {
2666 if (!TsProxySetupReceivePipeWriteRequest(tsg, &tsg->ChannelContext))
2667 {
2668 WLog_Print(tsg->log, WLOG_ERROR, "TsProxySetupReceivePipe failure");
2669 return FALSE;
2670 }
2671 }
2672 else
2673 {
2674 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->NewChannelContext))
2675 {
2676 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2677 return FALSE;
2678 }
2679
2680 if (!TsProxyCloseTunnelWriteRequest(tsg, &tsg->NewTunnelContext))
2681 {
2682 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelWriteRequest failure");
2683 return FALSE;
2684 }
2685 }
2686
2687 rc = tsg_transition_to_state(tsg, TSG_STATE_PIPE_CREATED);
2688 tsg->reauthSequence = FALSE;
2689 }
2690 else
2691 {
2692 WLog_Print(tsg->log, WLOG_ERROR,
2693 "TSG_STATE_AUTHORIZED unexpected OpNum: %" PRIu32 "\n", call->OpNum);
2694 }
2695
2696 break;
2697
2698 case TSG_STATE_CHANNEL_CREATED:
2699 break;
2700
2701 case TSG_STATE_PIPE_CREATED:
2702 call = rpc_client_call_find_by_id(rpc->client, pdu->CallId);
2703
2704 if (!call)
2705 return FALSE;
2706
2707 if (call->OpNum == TsProxyMakeTunnelCallOpnum)
2708 {
2709 if (!TsProxyMakeTunnelCallReadResponse(tsg, pdu))
2710 {
2711 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCallReadResponse failure");
2712 return FALSE;
2713 }
2714
2715 rc = TRUE;
2716
2717 if (tsg->ReauthTunnelContext)
2718 rc = tsg_proxy_reauth(tsg);
2719 }
2720 else if (call->OpNum == TsProxyCloseChannelOpnum)
2721 {
2722 CONTEXT_HANDLE ChannelContext;
2723
2724 if (!TsProxyCloseChannelReadResponse(tsg->log, pdu, &ChannelContext))
2725 {
2726 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelReadResponse failure");
2727 return FALSE;
2728 }
2729
2730 rc = TRUE;
2731 }
2732 else if (call->OpNum == TsProxyCloseTunnelOpnum)
2733 {
2734 CONTEXT_HANDLE TunnelContext;
2735
2736 if (!TsProxyCloseTunnelReadResponse(tsg->log, pdu, &TunnelContext))
2737 {
2738 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelReadResponse failure");
2739 return FALSE;
2740 }
2741
2742 rc = TRUE;
2743 }
2744
2745 break;
2746
2747 case TSG_STATE_TUNNEL_CLOSE_PENDING:
2748 {
2749 CONTEXT_HANDLE ChannelContext;
2750
2751 if (!TsProxyCloseChannelReadResponse(tsg->log, pdu, &ChannelContext))
2752 {
2753 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelReadResponse failure");
2754 return FALSE;
2755 }
2756
2757 if (!tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING))
2758 return FALSE;
2759
2760 if (!TsProxyCloseChannelWriteRequest(tsg, nullptr))
2761 {
2762 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseChannelWriteRequest failure");
2763 return FALSE;
2764 }
2765
2766 if (!TsProxyMakeTunnelCallWriteRequest(tsg, &tsg->TunnelContext,
2767 TSG_TUNNEL_CANCEL_ASYNC_MSG_REQUEST))
2768 {
2769 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyMakeTunnelCall failure");
2770 return FALSE;
2771 }
2772
2773 rc = TRUE;
2774 }
2775 break;
2776
2777 case TSG_STATE_CHANNEL_CLOSE_PENDING:
2778 {
2779 CONTEXT_HANDLE TunnelContext;
2780
2781 if (!TsProxyCloseTunnelReadResponse(tsg->log, pdu, &TunnelContext))
2782 {
2783 WLog_Print(tsg->log, WLOG_ERROR, "TsProxyCloseTunnelReadResponse failure");
2784 return FALSE;
2785 }
2786
2787 rc = tsg_transition_to_state(tsg, TSG_STATE_FINAL);
2788 }
2789 break;
2790
2791 case TSG_STATE_FINAL:
2792 break;
2793 default:
2794 break;
2795 }
2796
2797 {
2798 const size_t rem = Stream_GetRemainingLength(pdu->s);
2799 if (rem > 0)
2800 {
2801 WLog_Print(tsg->log, WLOG_WARN, "[%s] unparsed bytes: %" PRIuz,
2802 tsg_state_to_string(oldState), rem);
2803 }
2804 }
2805 return rc;
2806}
2807
2808BOOL tsg_check_event_handles(rdpTsg* tsg)
2809{
2810 WINPR_ASSERT(tsg);
2811 if (rpc_client_in_channel_recv(tsg->rpc) < 0)
2812 return FALSE;
2813
2814 if (rpc_client_out_channel_recv(tsg->rpc) < 0)
2815 return FALSE;
2816
2817 return TRUE;
2818}
2819
2820DWORD tsg_get_event_handles(rdpTsg* tsg, HANDLE* events, DWORD count)
2821{
2822 UINT32 nCount = 0;
2823 rdpRpc* rpc = tsg->rpc;
2824 RpcVirtualConnection* connection = rpc->VirtualConnection;
2825
2826 if (events && (nCount < count))
2827 {
2828 events[nCount] = rpc->client->PipeEvent;
2829 nCount++;
2830 }
2831 else
2832 return 0;
2833
2834 if (connection->DefaultInChannel && connection->DefaultInChannel->common.tls)
2835 {
2836 if (events && (nCount < count))
2837 {
2838 BIO_get_event(connection->DefaultInChannel->common.tls->bio, &events[nCount]);
2839 nCount++;
2840 }
2841 else
2842 return 0;
2843 }
2844
2845 if (connection->NonDefaultInChannel && connection->NonDefaultInChannel->common.tls)
2846 {
2847 if (events && (nCount < count))
2848 {
2849 BIO_get_event(connection->NonDefaultInChannel->common.tls->bio, &events[nCount]);
2850 nCount++;
2851 }
2852 else
2853 return 0;
2854 }
2855
2856 if (connection->DefaultOutChannel && connection->DefaultOutChannel->common.tls)
2857 {
2858 if (events && (nCount < count))
2859 {
2860 BIO_get_event(connection->DefaultOutChannel->common.tls->bio, &events[nCount]);
2861 nCount++;
2862 }
2863 else
2864 return 0;
2865 }
2866
2867 if (connection->NonDefaultOutChannel && connection->NonDefaultOutChannel->common.tls)
2868 {
2869 if (events && (nCount < count))
2870 {
2871 BIO_get_event(connection->NonDefaultOutChannel->common.tls->bio, &events[nCount]);
2872 nCount++;
2873 }
2874 else
2875 return 0;
2876 }
2877
2878 return nCount;
2879}
2880
2881static BOOL tsg_set_hostname(rdpTsg* tsg, const char* hostname)
2882{
2883 WINPR_ASSERT(tsg);
2884 free(tsg->Hostname);
2885 tsg->Hostname = ConvertUtf8ToWCharAlloc(hostname, nullptr);
2886 return tsg->Hostname != nullptr;
2887}
2888
2889static BOOL tsg_set_machine_name(rdpTsg* tsg, const char* machineName)
2890{
2891 WINPR_ASSERT(tsg);
2892
2893 free(tsg->QuarreQuest.machineName);
2894 tsg->QuarreQuest.machineName = nullptr;
2895 tsg->QuarreQuest.nameLength = 0;
2896 if (!machineName)
2897 return FALSE;
2898
2899 size_t size = 0;
2900 tsg->QuarreQuest.machineName = ConvertUtf8ToWCharAlloc(machineName, &size);
2901 tsg->QuarreQuest.nameLength = WINPR_ASSERTING_INT_CAST(uint32_t, size + 1ull);
2902 return tsg->QuarreQuest.machineName && (size > 0);
2903}
2904
2905BOOL tsg_connect(rdpTsg* tsg, const char* hostname, UINT16 port, DWORD timeout)
2906{
2907 UINT64 looptimeout = timeout * 1000ULL;
2908 DWORD nCount = 0;
2909 HANDLE events[MAXIMUM_WAIT_OBJECTS] = WINPR_C_ARRAY_INIT;
2910
2911 WINPR_ASSERT(tsg);
2912
2913 rdpRpc* rpc = tsg->rpc;
2914 WINPR_ASSERT(rpc);
2915
2916 rdpTransport* transport = rpc->transport;
2917 rdpContext* context = transport_get_context(transport);
2918 WINPR_ASSERT(context);
2919
2920 rdpSettings* settings = context->settings;
2921
2922 freerdp_set_last_error(context, ERROR_SUCCESS);
2923
2924 tsg->Port = port;
2925 tsg->transport = transport;
2926
2927 {
2928 const UINT32 GatewayPort = freerdp_settings_get_uint32(settings, FreeRDP_GatewayPort);
2929 if (GatewayPort == 0)
2930 {
2931 if (!freerdp_settings_set_uint32(settings, FreeRDP_GatewayPort, 443))
2932 return FALSE;
2933 }
2934 }
2935
2936 if (!tsg_set_hostname(tsg, hostname))
2937 return FALSE;
2938
2939 const char* ComputerName = freerdp_settings_get_string(settings, FreeRDP_ComputerName);
2940 if (!tsg_set_machine_name(tsg, ComputerName))
2941 return FALSE;
2942
2943 if (!rpc_connect(rpc, timeout))
2944 {
2945 WLog_Print(tsg->log, WLOG_ERROR, "rpc_connect error!");
2946 return FALSE;
2947 }
2948
2949 nCount = tsg_get_event_handles(tsg, events, ARRAYSIZE(events));
2950
2951 if (nCount == 0)
2952 return FALSE;
2953
2954 while (tsg->state != TSG_STATE_PIPE_CREATED)
2955 {
2956 const DWORD polltimeout = 250;
2957 DWORD status = WaitForMultipleObjects(nCount, events, FALSE, polltimeout);
2958 if (status == WAIT_TIMEOUT)
2959 {
2960 if (timeout > 0)
2961 {
2962 if (looptimeout < polltimeout)
2963 return FALSE;
2964 looptimeout -= polltimeout;
2965 }
2966 }
2967 else
2968 looptimeout = timeout * 1000ULL;
2969
2970 if (!tsg_check_event_handles(tsg))
2971 {
2972 WLog_Print(tsg->log, WLOG_ERROR, "tsg_check failure");
2973 transport_set_layer(transport, TRANSPORT_LAYER_CLOSED);
2974 return FALSE;
2975 }
2976 }
2977
2978 WLog_Print(tsg->log, WLOG_INFO, "TS Gateway Connection Success");
2979 tsg->bio = BIO_new(BIO_s_tsg());
2980
2981 if (!tsg->bio)
2982 return FALSE;
2983
2984 BIO_set_data(tsg->bio, (void*)tsg);
2985 return TRUE;
2986}
2987
2988BOOL tsg_disconnect(rdpTsg* tsg)
2989{
3009 if (!tsg)
3010 return FALSE;
3011
3012 if (tsg->state != TSG_STATE_TUNNEL_CLOSE_PENDING)
3013 {
3014 if (!TsProxyCloseChannelWriteRequest(tsg, &tsg->ChannelContext))
3015 return FALSE;
3016
3017 return tsg_transition_to_state(tsg, TSG_STATE_CHANNEL_CLOSE_PENDING);
3018 }
3019
3020 return TRUE;
3021}
3022
3034static int tsg_read(rdpTsg* tsg, BYTE* data, size_t length)
3035{
3036 rdpRpc* rpc = nullptr;
3037 int status = 0;
3038
3039 if (!tsg || !data)
3040 return -1;
3041
3042 rpc = tsg->rpc;
3043
3044 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3045 {
3046 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3047 return -1;
3048 }
3049
3050 do
3051 {
3052 status = rpc_client_receive_pipe_read(rpc->client, data, length);
3053
3054 if (status < 0)
3055 return -1;
3056
3057 if (!status && !transport_get_blocking(rpc->transport))
3058 return 0;
3059
3060 if (transport_get_layer(rpc->transport) == TRANSPORT_LAYER_CLOSED)
3061 {
3062 WLog_Print(tsg->log, WLOG_ERROR, "tsg_read error: connection lost");
3063 return -1;
3064 }
3065
3066 if (status > 0)
3067 break;
3068
3069 if (transport_get_blocking(rpc->transport))
3070 {
3071 while (WaitForSingleObject(rpc->client->PipeEvent, 0) != WAIT_OBJECT_0)
3072 {
3073 if (!tsg_check_event_handles(tsg))
3074 return -1;
3075
3076 (void)WaitForSingleObject(rpc->client->PipeEvent, 100);
3077 }
3078 }
3079 } while (transport_get_blocking(rpc->transport));
3080
3081 return status;
3082}
3083
3084static int tsg_write(rdpTsg* tsg, const BYTE* data, UINT32 length)
3085{
3086 int status = 0;
3087
3088 if (!tsg || !data || !tsg->rpc || !tsg->rpc->transport)
3089 return -1;
3090
3091 if (transport_get_layer(tsg->rpc->transport) == TRANSPORT_LAYER_CLOSED)
3092 {
3093 WLog_Print(tsg->log, WLOG_ERROR, "error, connection lost");
3094 return -1;
3095 }
3096
3097 status = TsProxySendToServer((handle_t)tsg, data, 1, &length);
3098
3099 if (status < 0)
3100 return -1;
3101
3102 return (int)length;
3103}
3104
3105rdpTsg* tsg_new(rdpTransport* transport)
3106{
3107 rdpTsg* tsg = (rdpTsg*)calloc(1, sizeof(rdpTsg));
3108
3109 if (!tsg)
3110 return nullptr;
3111 tsg->log = WLog_Get(TAG);
3112 tsg->transport = transport;
3113 tsg->rpc = rpc_new(tsg->transport);
3114
3115 if (!tsg->rpc)
3116 goto out_free;
3117
3118 return tsg;
3119out_free:
3120 free(tsg);
3121 return nullptr;
3122}
3123
3124void tsg_free(rdpTsg* tsg)
3125{
3126 if (tsg)
3127 {
3128 rpc_free(tsg->rpc);
3129 free(tsg->Hostname);
3130 free(tsg->QuarreQuest.machineName);
3131 free(tsg->QuarreQuest.data);
3132 free(tsg);
3133 }
3134}
3135
3136static int transport_bio_tsg_write(BIO* bio, const char* buf, int num)
3137{
3138 int status = 0;
3139 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3140 BIO_clear_flags(bio, BIO_FLAGS_WRITE);
3141
3142 if (num < 0)
3143 return -1;
3144 status = tsg_write(tsg, (const BYTE*)buf, (UINT32)num);
3145
3146 if (status < 0)
3147 {
3148 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3149 return -1;
3150 }
3151 else if (status == 0)
3152 {
3153 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3154 WSASetLastError(WSAEWOULDBLOCK);
3155 }
3156 else
3157 {
3158 BIO_set_flags(bio, BIO_FLAGS_WRITE);
3159 }
3160
3161 return status >= 0 ? status : -1;
3162}
3163
3164static int transport_bio_tsg_read(BIO* bio, char* buf, int size)
3165{
3166 int status = 0;
3167 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3168
3169 if (!tsg || (size < 0))
3170 {
3171 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3172 return -1;
3173 }
3174
3175 BIO_clear_flags(bio, BIO_FLAGS_READ);
3176 status = tsg_read(tsg, (BYTE*)buf, (size_t)size);
3177
3178 if (status < 0)
3179 {
3180 BIO_clear_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3181 return -1;
3182 }
3183 else if (status == 0)
3184 {
3185 BIO_set_flags(bio, BIO_FLAGS_READ);
3186 WSASetLastError(WSAEWOULDBLOCK);
3187 }
3188 else
3189 {
3190 BIO_set_flags(bio, BIO_FLAGS_READ);
3191 }
3192
3193 return status > 0 ? status : -1;
3194}
3195
3196static int transport_bio_tsg_puts(BIO* bio, const char* str)
3197{
3198 WINPR_UNUSED(bio);
3199 WINPR_UNUSED(str);
3200 return -2;
3201}
3202
3203// NOLINTNEXTLINE(readability-non-const-parameter)
3204static int transport_bio_tsg_gets(BIO* bio, char* str, int size)
3205{
3206 WINPR_UNUSED(bio);
3207 WINPR_UNUSED(str);
3208 WINPR_UNUSED(size);
3209 return 1;
3210}
3211
3212static long transport_bio_tsg_ctrl(BIO* bio, int cmd, long arg1, void* arg2)
3213{
3214 long status = -1;
3215 rdpTsg* tsg = (rdpTsg*)BIO_get_data(bio);
3216 RpcVirtualConnection* connection = tsg->rpc->VirtualConnection;
3217 RpcInChannel* inChannel = connection->DefaultInChannel;
3218 RpcOutChannel* outChannel = connection->DefaultOutChannel;
3219
3220 switch (cmd)
3221 {
3222 case BIO_CTRL_FLUSH:
3223 (void)BIO_flush(inChannel->common.tls->bio);
3224 (void)BIO_flush(outChannel->common.tls->bio);
3225 status = 1;
3226 break;
3227
3228 case BIO_C_GET_EVENT:
3229 if (arg2)
3230 {
3231 *((HANDLE*)arg2) = tsg->rpc->client->PipeEvent;
3232 status = 1;
3233 }
3234
3235 break;
3236
3237 case BIO_C_SET_NONBLOCK:
3238 status = 1;
3239 break;
3240
3241 case BIO_C_READ_BLOCKED:
3242 {
3243 BIO* cbio = outChannel->common.bio;
3244 status = BIO_read_blocked(cbio);
3245 }
3246 break;
3247
3248 case BIO_C_WRITE_BLOCKED:
3249 {
3250 BIO* cbio = inChannel->common.bio;
3251 status = BIO_write_blocked(cbio);
3252 }
3253 break;
3254
3255 case BIO_C_WAIT_READ:
3256 {
3257 int timeout = (int)arg1;
3258 BIO* cbio = outChannel->common.bio;
3259
3260 if (BIO_read_blocked(cbio))
3261 return BIO_wait_read(cbio, timeout);
3262 else if (BIO_write_blocked(cbio))
3263 return BIO_wait_write(cbio, timeout);
3264 else
3265 status = 1;
3266 }
3267 break;
3268
3269 case BIO_C_WAIT_WRITE:
3270 {
3271 int timeout = (int)arg1;
3272 BIO* cbio = inChannel->common.bio;
3273
3274 if (BIO_write_blocked(cbio))
3275 status = BIO_wait_write(cbio, timeout);
3276 else if (BIO_read_blocked(cbio))
3277 status = BIO_wait_read(cbio, timeout);
3278 else
3279 status = 1;
3280 }
3281 break;
3282#if OPENSSL_VERSION_NUMBER >= 0x30000000L
3283 case BIO_CTRL_GET_KTLS_SEND:
3284 status = 0;
3285 break;
3286 case BIO_CTRL_GET_KTLS_RECV:
3287 status = 0;
3288 break;
3289#endif
3290 default:
3291 break;
3292 }
3293
3294 return status;
3295}
3296
3297static int transport_bio_tsg_new(BIO* bio)
3298{
3299 WINPR_ASSERT(bio);
3300 BIO_set_init(bio, 1);
3301 BIO_set_flags(bio, BIO_FLAGS_SHOULD_RETRY);
3302 return 1;
3303}
3304
3305static int transport_bio_tsg_free(BIO* bio)
3306{
3307 WINPR_ASSERT(bio);
3308 WINPR_UNUSED(bio);
3309 return 1;
3310}
3311
3312BIO_METHOD* BIO_s_tsg(void)
3313{
3314 static BIO_METHOD* bio_methods = nullptr;
3315
3316 if (bio_methods == nullptr)
3317 {
3318 if (!(bio_methods = BIO_meth_new(BIO_TYPE_TSG, "TSGateway")))
3319 return nullptr;
3320
3321 BIO_meth_set_write(bio_methods, transport_bio_tsg_write);
3322 BIO_meth_set_read(bio_methods, transport_bio_tsg_read);
3323 BIO_meth_set_puts(bio_methods, transport_bio_tsg_puts);
3324 BIO_meth_set_gets(bio_methods, transport_bio_tsg_gets);
3325 BIO_meth_set_ctrl(bio_methods, transport_bio_tsg_ctrl);
3326 BIO_meth_set_create(bio_methods, transport_bio_tsg_new);
3327 BIO_meth_set_destroy(bio_methods, transport_bio_tsg_free);
3328 }
3329
3330 return bio_methods;
3331}
3332
3333TSG_STATE tsg_get_state(rdpTsg* tsg)
3334{
3335 if (!tsg)
3336 return TSG_STATE_INITIAL;
3337
3338 return tsg->state;
3339}
3340
3341BIO* tsg_get_bio(rdpTsg* tsg)
3342{
3343 if (!tsg)
3344 return nullptr;
3345
3346 return tsg->bio;
3347}
3348
3349BOOL tsg_set_state(rdpTsg* tsg, TSG_STATE state)
3350{
3351 WINPR_ASSERT(tsg);
3352 tsg->state = state;
3353 return TRUE;
3354}
freerdp_settings_get_string
WINPR_ATTR_NODISCARD FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
freerdp_settings_set_uint32
WINPR_ATTR_NODISCARD FREERDP_API BOOL freerdp_settings_set_uint32(rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id, UINT32 val)
Sets a UINT32 settings value.
freerdp_settings_get_uint32
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
CONTEXT_HANDLE
Definition winpr/include/winpr/rpc.h:26
RPC_PDU
Definition libfreerdp/core/gateway/rpc.h:66
p_uuid_t
Definition libfreerdp/core/gateway/rpc.h:150