FreeRDP
Loading...
Searching...
No Matches
rdstls.c
1
20#include <freerdp/config.h>
21
22#include "settings.h"
23
24#include <freerdp/log.h>
25#include <freerdp/error.h>
26#include <freerdp/settings.h>
27
28#include <winpr/assert.h>
29#include <winpr/stream.h>
30#include <winpr/wlog.h>
31
32#include "rdstls.h"
33#include "transport.h"
34#include "utils.h"
35
36#define RDSTLS_VERSION_1 0x01u
37#define RDSTLS_VERSION_2 0x02u
38
39#define RDSTLS_TYPE_CAPABILITIES 0x01
40#define RDSTLS_TYPE_AUTHREQ 0x02
41#define RDSTLS_TYPE_AUTHRSP 0x04
42
43#define RDSTLS_DATA_CAPABILITIES 0x01
44#define RDSTLS_DATA_PASSWORD_CREDS 0x01
45#define RDSTLS_DATA_AUTORECONNECT_COOKIE 0x02
46#define RDSTLS_DATA_FEDAUTH_TOKEN 0x03
47#define RDSTLS_DATA_RESULT_CODE 0x01
48
49typedef enum
50{
51 RDSTLS_STATE_INITIAL,
52 RDSTLS_STATE_CAPABILITIES,
53 RDSTLS_STATE_AUTH_REQ,
54 RDSTLS_STATE_AUTH_RSP,
55 RDSTLS_STATE_FINAL,
56} RDSTLS_STATE;
57
58typedef enum
59{
60
61 RDSTLS_RESULT_SUCCESS = 0x00000000,
62 RDSTLS_RESULT_ACCESS_DENIED = 0x00000005,
63 RDSTLS_RESULT_LOGON_FAILURE = 0x0000052e,
64 RDSTLS_RESULT_INVALID_LOGON_HOURS = 0x00000530,
65 RDSTLS_RESULT_PASSWORD_EXPIRED = 0x00000532,
66 RDSTLS_RESULT_ACCOUNT_DISABLED = 0x00000533,
67 RDSTLS_RESULT_PASSWORD_MUST_CHANGE = 0x00000773,
68 RDSTLS_RESULT_ACCOUNT_LOCKED_OUT = 0x00000775
69} RDSTLS_RESULT_CODE;
70
71struct rdp_rdstls
72{
73 BOOL server;
74 RDSTLS_STATE state;
75 rdpContext* context;
76 rdpTransport* transport;
77
78 RDSTLS_RESULT_CODE resultCode;
79 wLog* log;
80 uint16_t supportedVersions;
81};
82
83static const uint16_t RDSTLS_VERSION_MASK = RDSTLS_VERSION_1 | RDSTLS_VERSION_2;
84
85WINPR_ATTR_NODISCARD
86static const char* rdstls_result_code_str(UINT32 resultCode)
87{
88 switch (resultCode)
89 {
90 case RDSTLS_RESULT_SUCCESS:
91 return "RDSTLS_RESULT_SUCCESS";
92 case RDSTLS_RESULT_ACCESS_DENIED:
93 return "RDSTLS_RESULT_ACCESS_DENIED";
94 case RDSTLS_RESULT_LOGON_FAILURE:
95 return "RDSTLS_RESULT_LOGON_FAILURE";
96 case RDSTLS_RESULT_INVALID_LOGON_HOURS:
97 return "RDSTLS_RESULT_INVALID_LOGON_HOURS";
98 case RDSTLS_RESULT_PASSWORD_EXPIRED:
99 return "RDSTLS_RESULT_PASSWORD_EXPIRED";
100 case RDSTLS_RESULT_ACCOUNT_DISABLED:
101 return "RDSTLS_RESULT_ACCOUNT_DISABLED";
102 case RDSTLS_RESULT_PASSWORD_MUST_CHANGE:
103 return "RDSTLS_RESULT_PASSWORD_MUST_CHANGE";
104 case RDSTLS_RESULT_ACCOUNT_LOCKED_OUT:
105 return "RDSTLS_RESULT_ACCOUNT_LOCKED_OUT";
106 default:
107 return "RDSTLS_RESULT_UNKNOWN";
108 }
109}
110
111#define rdstls_required_role_is_server(rdstls, isServer) \
112 rdstls_required_role_is_server_((rdstls), (isServer), __FILE__, __func__, __LINE__)
113
114WINPR_ATTR_NODISCARD
115static BOOL rdstls_required_role_is_server_(const rdpRdstls* rdstls, BOOL isServer,
116 const char* file, const char* fkt, size_t line)
117{
118 WINPR_ASSERT(rdstls);
119 const BOOL rc = rdstls->server == isServer;
120 if (!rc)
121 {
122 const DWORD level = WLOG_ERROR;
123 if (WLog_IsLevelActive(rdstls->log, level))
124 WLog_PrintTextMessage(rdstls->log, level, line, file, fkt,
125 "Message not allowed in current role '%s'",
126 rdstls->server ? "server" : "client");
127 }
128 return rc;
129}
130
139rdpRdstls* rdstls_new(rdpContext* context, rdpTransport* transport)
140{
141 WINPR_ASSERT(context);
142 WINPR_ASSERT(transport);
143
144 rdpSettings* settings = context->settings;
145 WINPR_ASSERT(settings);
146
147 rdpRdstls* rdstls = (rdpRdstls*)calloc(1, sizeof(rdpRdstls));
148
149 if (!rdstls)
150 return nullptr;
151 rdstls->log = WLog_Get(FREERDP_TAG("core.rdstls"));
152 rdstls->supportedVersions = RDSTLS_VERSION_MASK;
153 rdstls->context = context;
154 rdstls->transport = transport;
155 rdstls->server = settings->ServerMode;
156
157 rdstls->resultCode = RDSTLS_RESULT_ACCESS_DENIED;
158 rdstls->state = RDSTLS_STATE_INITIAL;
159
160 return rdstls;
161}
162
168void rdstls_free(rdpRdstls* rdstls)
169{
170 free(rdstls);
171}
172
173WINPR_ATTR_NODISCARD
174static const char* rdstls_get_state_str(RDSTLS_STATE state)
175{
176 switch (state)
177 {
178 case RDSTLS_STATE_INITIAL:
179 return "RDSTLS_STATE_INITIAL";
180 case RDSTLS_STATE_CAPABILITIES:
181 return "RDSTLS_STATE_CAPABILITIES";
182 case RDSTLS_STATE_AUTH_REQ:
183 return "RDSTLS_STATE_AUTH_REQ";
184 case RDSTLS_STATE_AUTH_RSP:
185 return "RDSTLS_STATE_AUTH_RSP";
186 case RDSTLS_STATE_FINAL:
187 return "RDSTLS_STATE_FINAL";
188 default:
189 return "UNKNOWN";
190 }
191}
192
193WINPR_ATTR_NODISCARD
194static RDSTLS_STATE rdstls_get_state(rdpRdstls* rdstls)
195{
196 WINPR_ASSERT(rdstls);
197 return rdstls->state;
198}
199
200WINPR_ATTR_NODISCARD
201static BOOL check_transition(wLog* log, RDSTLS_STATE current, RDSTLS_STATE expected,
202 RDSTLS_STATE requested)
203{
204 if (requested != expected)
205 {
206 WLog_Print(log, WLOG_ERROR,
207 "Unexpected rdstls state transition from %s [%u] to %s [%u], expected %s [%u]",
208 rdstls_get_state_str(current), current, rdstls_get_state_str(requested),
209 requested, rdstls_get_state_str(expected), expected);
210 return FALSE;
211 }
212 return TRUE;
213}
214
215WINPR_ATTR_NODISCARD
216static BOOL rdstls_set_state(rdpRdstls* rdstls, RDSTLS_STATE state)
217{
218 BOOL rc = FALSE;
219 WINPR_ASSERT(rdstls);
220
221 WLog_Print(rdstls->log, WLOG_DEBUG, "-- %s\t--> %s", rdstls_get_state_str(rdstls->state),
222 rdstls_get_state_str(state));
223
224 switch (rdstls->state)
225 {
226 case RDSTLS_STATE_INITIAL:
227 rc = check_transition(rdstls->log, rdstls->state, RDSTLS_STATE_CAPABILITIES, state);
228 break;
229 case RDSTLS_STATE_CAPABILITIES:
230 rc = check_transition(rdstls->log, rdstls->state, RDSTLS_STATE_AUTH_REQ, state);
231 break;
232 case RDSTLS_STATE_AUTH_REQ:
233 rc = check_transition(rdstls->log, rdstls->state, RDSTLS_STATE_AUTH_RSP, state);
234 break;
235 case RDSTLS_STATE_AUTH_RSP:
236 rc = check_transition(rdstls->log, rdstls->state, RDSTLS_STATE_FINAL, state);
237 break;
238 case RDSTLS_STATE_FINAL:
239 rc = check_transition(rdstls->log, rdstls->state, RDSTLS_STATE_CAPABILITIES, state);
240 break;
241 default:
242 WLog_Print(rdstls->log, WLOG_ERROR,
243 "Invalid rdstls state %s [%u], requested transition to %s [%u]",
244 rdstls_get_state_str(rdstls->state), rdstls->state,
245 rdstls_get_state_str(state), state);
246 break;
247 }
248 if (rc)
249 rdstls->state = state;
250
251 return rc;
252}
253
254#define rdstls_check_state_requirements(rdstls, expected) \
255 rdstls_check_state_requirements_((rdstls), (expected), __FILE__, __func__, __LINE__)
256
257WINPR_ATTR_NODISCARD
258static BOOL rdstls_check_state_requirements_(rdpRdstls* rdstls, RDSTLS_STATE expected,
259 const char* file, const char* fkt, size_t line)
260{
261 const RDSTLS_STATE current = rdstls_get_state(rdstls);
262 if (current == expected)
263 return TRUE;
264
265 WINPR_ASSERT(rdstls);
266
267 const DWORD log_level = WLOG_ERROR;
268 if (WLog_IsLevelActive(rdstls->log, log_level))
269 WLog_PrintTextMessage(rdstls->log, log_level, line, file, fkt,
270 "Unexpected rdstls state %s [%u], expected %s [%u]",
271 rdstls_get_state_str(current), current,
272 rdstls_get_state_str(expected), expected);
273
274 return FALSE;
275}
276
277WINPR_ATTR_NODISCARD
278static BOOL rdstls_write_capabilities(WINPR_ATTR_UNUSED rdpRdstls* rdstls, wStream* s)
279{
280 if (!Stream_EnsureRemainingCapacity(s, 8))
281 return FALSE;
282
283 Stream_Write_UINT16(s, RDSTLS_VERSION_1);
284 Stream_Write_UINT16(s, RDSTLS_TYPE_CAPABILITIES);
285 Stream_Write_UINT16(s, RDSTLS_DATA_CAPABILITIES);
286 Stream_Write_UINT16(s, rdstls->supportedVersions);
287
288 return TRUE;
289}
290
291WINPR_ATTR_NODISCARD
292static SSIZE_T rdstls_write_string(wStream* s, const char* str)
293{
294 const size_t pos = Stream_GetPosition(s);
295
296 if (!Stream_EnsureRemainingCapacity(s, 2))
297 return -1;
298
299 if (!str)
300 {
301 /* Write unicode null */
302 Stream_Write_UINT16(s, 2);
303 if (!Stream_EnsureRemainingCapacity(s, 2))
304 return -1;
305
306 Stream_Write_UINT16(s, 0);
307 return (SSIZE_T)(Stream_GetPosition(s) - pos);
308 }
309
310 const SSIZE_T devNameWLen = ConvertUtf8ToWChar(str, nullptr, 0);
311 if (devNameWLen < 0)
312 return -1;
313 const size_t length = WINPR_ASSERTING_INT_CAST(size_t, devNameWLen) + 1;
314 const size_t slen = strlen(str);
315
316 Stream_Write_UINT16(s, (UINT16)length * sizeof(WCHAR));
317
318 if (!Stream_EnsureRemainingCapacity(s, length * sizeof(WCHAR)))
319 return -1;
320
321 if (Stream_Write_UTF16_String_From_UTF8(s, length, str, slen, TRUE) < 0)
322 return -1;
323
324 return (SSIZE_T)(Stream_GetPosition(s) - pos);
325}
326
327WINPR_ATTR_NODISCARD
328static BOOL rdstls_write_data(wStream* s, UINT32 length, const BYTE* data)
329{
330 WINPR_ASSERT(data || (length == 0));
331
332 if (!Stream_EnsureRemainingCapacity(s, 2) || (length > UINT16_MAX))
333 return FALSE;
334
335 Stream_Write_UINT16(s, (UINT16)length);
336
337 if (!Stream_EnsureRemainingCapacity(s, length))
338 return FALSE;
339
340 Stream_Write(s, data, length);
341
342 return TRUE;
343}
344
345WINPR_ATTR_NODISCARD
346static BOOL rdstls_write_cookie(wStream* s, const ARC_SC_PRIVATE_PACKET* cookie)
347{
348 WINPR_ASSERT(cookie);
349 const uint16_t length = sizeof(ARC_SC_PRIVATE_PACKET);
350 WINPR_STATIC_ASSERT(sizeof(ARC_SC_PRIVATE_PACKET) == 28);
351
352 if (!Stream_EnsureRemainingCapacity(s, 2))
353 return FALSE;
354
355 Stream_Write_UINT16(s, length);
356
357 if (!Stream_EnsureRemainingCapacity(s, length))
358 return FALSE;
359
360 Stream_Write_UINT32(s, cookie->cbLen);
361 Stream_Write_UINT32(s, cookie->version);
362 Stream_Write_UINT32(s, cookie->logonId);
363 Stream_Write(s, cookie->arcRandomBits, sizeof(cookie->arcRandomBits));
364 return TRUE;
365}
366
367WINPR_ATTR_NODISCARD
368static BOOL rdstls_read_cookie(wLog* log, wStream* s, ARC_SC_PRIVATE_PACKET* cookie)
369{
370 WINPR_ASSERT(cookie);
371 const uint16_t length = sizeof(ARC_SC_PRIVATE_PACKET);
372 WINPR_STATIC_ASSERT(sizeof(ARC_SC_PRIVATE_PACKET) == 28);
373
374 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, length + 2ull))
375 return FALSE;
376
377 const uint16_t len = Stream_Get_UINT16(s);
378 if (len != length)
379 {
380 WLog_Print(log, WLOG_ERROR,
381 "RDSTLS Cookie: Unexpected length %" PRIu16 ", expected %" PRIu16, len, length);
382 return FALSE;
383 }
384
385 cookie->cbLen = Stream_Get_UINT32(s);
386 cookie->version = Stream_Get_UINT32(s);
387 cookie->logonId = Stream_Get_UINT32(s);
388 Stream_Read(s, cookie->arcRandomBits, sizeof(cookie->arcRandomBits));
389 return TRUE;
390}
391
392WINPR_ATTR_NODISCARD
393static BOOL rdstls_write_authentication_request_with_password(rdpRdstls* rdstls, wStream* s)
394{
395 WINPR_ASSERT(rdstls);
396 WINPR_ASSERT(rdstls->context);
397
398 if (!rdstls_required_role_is_server(rdstls, FALSE))
399 return FALSE;
400 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
401 return FALSE;
402
403 WLog_Print(rdstls->log, WLOG_DEBUG, "Writing RDSTLS password authentication message");
404
405 rdpSettings* settings = rdstls->context->settings;
406 WINPR_ASSERT(settings);
407
408 if (!Stream_EnsureRemainingCapacity(s, 4))
409 return FALSE;
410
411 Stream_Write_UINT16(s, RDSTLS_TYPE_AUTHREQ);
412 Stream_Write_UINT16(s, RDSTLS_DATA_PASSWORD_CREDS);
413
414 if (!rdstls_write_data(s, settings->RedirectionGuidLength, settings->RedirectionGuid))
415 return FALSE;
416
417 if (rdstls_write_string(s, settings->Username) < 0)
418 return FALSE;
419
420 if (rdstls_write_string(s, settings->Domain) < 0)
421 return FALSE;
422
423 if (!rdstls_write_data(s, settings->RedirectionPasswordLength, settings->RedirectionPassword))
424 return FALSE;
425
426 return TRUE;
427}
428
429WINPR_ATTR_NODISCARD
430static BOOL rdstls_write_authentication_request_with_cookie(WINPR_ATTR_UNUSED rdpRdstls* rdstls,
431 WINPR_ATTR_UNUSED wStream* s)
432{
433 WINPR_ASSERT(rdstls);
434 WINPR_ASSERT(rdstls->context);
435
436 WLog_Print(rdstls->log, WLOG_DEBUG, "Writing RDSTLS cookie authentication message");
437
438 if (!rdstls_required_role_is_server(rdstls, FALSE))
439 return FALSE;
440 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
441 return FALSE;
442
443 rdpSettings* settings = rdstls->context->settings;
444 WINPR_ASSERT(settings);
445
446 if (!Stream_EnsureRemainingCapacity(s, 8))
447 return FALSE;
448
449 Stream_Write_UINT16(s, RDSTLS_TYPE_AUTHREQ);
450 Stream_Write_UINT16(s, RDSTLS_DATA_AUTORECONNECT_COOKIE);
451 Stream_Write_UINT32(s, settings->RedirectedSessionId);
452
453 return (rdstls_write_cookie(s, settings->ServerAutoReconnectCookie));
454}
455
456/*
457 * Warn if the endpoint FedAuth token targets a different virtual machine
458 * than the VM identifier passed via the .rdp `pcb` field / /pcb command
459 * line switch. The token payload starts with "VMID=<guid>&..."; a
460 * mismatch would be silently rejected by the server later on. This is a
461 * best-effort local sanity check.
462 */
463static void rdstls_check_fedauth_vmid(rdpRdstls* rdstls, const char* token, const char* selectedVm)
464{
465 WINPR_ASSERT(rdstls);
466 WINPR_ASSERT(token);
467
468 if (!selectedVm || !*selectedVm)
469 return;
470
471 const char* vmidField = strstr(token, "VMID=");
472 if (!vmidField)
473 return;
474 vmidField += 5;
475
476 const size_t vmLen = strlen(selectedVm);
477 const BOOL matches = (_strnicmp(vmidField, selectedVm, vmLen) == 0) &&
478 (vmidField[vmLen] == '\0' || vmidField[vmLen] == '&');
479 if (!matches)
480 {
481 WLog_Print(rdstls->log, WLOG_WARN,
482 "endpoint FedAuth token is issued for a different virtual machine "
483 "than the one selected for connection");
484 }
485}
486
487WINPR_ATTR_NODISCARD
488static BOOL rdstls_write_authentication_request_with_fedauth_token(rdpRdstls* rdstls, wStream* s)
489{
490 WINPR_ASSERT(rdstls);
491 WINPR_ASSERT(rdstls->context);
492
493 WLog_Print(rdstls->log, WLOG_DEBUG, "Writing RDSTLS FedAuth token authentication message");
494
495 if (!rdstls_required_role_is_server(rdstls, FALSE))
496 return FALSE;
497 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
498 return FALSE;
499
500 const rdpSettings* settings = rdstls->context->settings;
501 WINPR_ASSERT(settings);
502
503 const char* token = freerdp_settings_get_string(settings, FreeRDP_EndpointFedAuthToken);
504 if (!token || !*token)
505 {
506 WLog_Print(rdstls->log, WLOG_ERROR, "EndpointFedAuthToken not set");
507 return FALSE;
508 }
509
510 rdstls_check_fedauth_vmid(rdstls, token,
511 freerdp_settings_get_string(settings, FreeRDP_PreconnectionBlob));
512
513 const size_t utf8Length = strlen(token);
514 /* The wire length prefix is a UINT16 counting the token in UTF-16LE
515 * including a terminating NUL character. */
516 if (utf8Length >= UINT16_MAX / sizeof(WCHAR))
517 {
518 WLog_Print(rdstls->log, WLOG_ERROR,
519 "EndpointFedAuthToken length %" PRIuz " exceeds RDSTLS wire limit", utf8Length);
520 return FALSE;
521 }
522
523 const SSIZE_T wideLength = ConvertUtf8NToWChar(token, utf8Length, nullptr, 0);
524 if (wideLength < 0)
525 return FALSE;
526 const size_t wideLengthZero = WINPR_ASSERTING_INT_CAST(size_t, wideLength);
527 const size_t wideBytes = (wideLengthZero + 1ull) * sizeof(WCHAR);
528
529 if (!Stream_EnsureRemainingCapacity(s, 6 + wideBytes))
530 return FALSE;
531
532 Stream_Write_UINT16(s, RDSTLS_TYPE_AUTHREQ);
533 Stream_Write_UINT16(s, RDSTLS_DATA_FEDAUTH_TOKEN);
534 Stream_Write_UINT16(s, (UINT16)wideBytes);
535
536 return Stream_Write_UTF16_String_From_UTF8(s, wideLengthZero, token, utf8Length, TRUE) >= 0;
537}
538
539WINPR_ATTR_NODISCARD
540static BOOL rdstls_write_authentication_response(rdpRdstls* rdstls, wStream* s)
541{
542 WINPR_ASSERT(rdstls);
543
544 if (!rdstls_required_role_is_server(rdstls, TRUE))
545 return FALSE;
546 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_RSP))
547 return FALSE;
548 if (!Stream_EnsureRemainingCapacity(s, 8))
549 return FALSE;
550
551 Stream_Write_UINT16(s, RDSTLS_TYPE_AUTHRSP);
552 Stream_Write_UINT16(s, RDSTLS_DATA_RESULT_CODE);
553 Stream_Write_UINT32(s, rdstls->resultCode);
554
555 return TRUE;
556}
557
558#define rdstls_version_required(log, expected, actual) \
559 rdstls_version_required_((log), (expected), (actual), __FILE__, __func__, __LINE__)
560WINPR_ATTR_NODISCARD
561static BOOL rdstls_version_required_(wLog* log, uint16_t expected, uint16_t actual,
562 const char* file, const char* fkt, size_t line)
563{
564 if (actual < expected)
565 {
566 const DWORD level = WLOG_ERROR;
567 if (WLog_IsLevelActive(log, level))
568 {
569 WLog_PrintTextMessage(log, WLOG_ERROR, line, file, fkt,
570 "version=0x%04" PRIx16 ", expected at least 0x%04" PRIx16, actual,
571 expected);
572 }
573 return FALSE;
574 }
575 return TRUE;
576}
577
578#define rdstls_are_some_versions_supported(log, version, mask) \
579 rdstls_are_some_versions_supported_((log), (version), (mask), __FILE__, __func__, __LINE__)
580WINPR_ATTR_NODISCARD
581static BOOL rdstls_are_some_versions_supported_(wLog* log, uint16_t version, BOOL isMask,
582 const char* file, const char* fkt, size_t line)
583{
584 if (!isMask)
585 {
586 size_t cnt = 0;
587 for (size_t x = 0; x < 16; x++)
588 {
589 const unsigned val = 1 << x;
590 if ((version & val) != 0)
591 cnt++;
592 }
593 if (cnt != 1)
594 {
595 WLog_PrintTextMessage(log, WLOG_ERROR, line, file, fkt,
596 "received invalid version mask=0x%04" PRIx16
597 ", expected { 0x%04" PRIx32 ", 0x%04" PRIx32 "}",
598 version, RDSTLS_VERSION_1, RDSTLS_VERSION_2);
599 return FALSE;
600 }
601 }
602
603 if ((version & RDSTLS_VERSION_MASK) == 0)
604 {
605 const DWORD level = WLOG_ERROR;
606 if (WLog_IsLevelActive(log, level))
607 {
608 WLog_PrintTextMessage(log, WLOG_ERROR, line, file, fkt,
609 "received invalid version mask=0x%04" PRIx16
610 ", expected { 0x%04" PRIx32 ", 0x%04" PRIx32 "}",
611 version, RDSTLS_VERSION_1, RDSTLS_VERSION_2);
612 }
613 return FALSE;
614 }
615 return TRUE;
616}
617
618#define rdstls_is_version_supported(rdstls, version) \
619 rdstls_is_version_supported_((rdstls), (version), __FILE__, __func__, __LINE__)
620WINPR_ATTR_NODISCARD
621static BOOL rdstls_is_version_supported_(rdpRdstls* rdstls, uint16_t version, const char* file,
622 const char* fkt, size_t line)
623{
624 WINPR_ASSERT(rdstls);
625
626 if ((rdstls->supportedVersions & version) == 0)
627 {
628 const DWORD level = WLOG_ERROR;
629 if (WLog_IsLevelActive(rdstls->log, level))
630 {
631 WLog_PrintTextMessage(rdstls->log, WLOG_ERROR, line, file, fkt,
632 "received invalid version=0x%04" PRIx16
633 ", expected { 0x%04" PRIx32 ", 0x%04" PRIx32 "}",
634 version, RDSTLS_VERSION_1, RDSTLS_VERSION_2);
635 }
636 return FALSE;
637 }
638 return TRUE;
639}
640
641WINPR_ATTR_NODISCARD
642static BOOL rdstls_process_capabilities(rdpRdstls* rdstls, wStream* s)
643{
644 WINPR_ASSERT(rdstls);
645 if (!rdstls_required_role_is_server(rdstls, FALSE))
646 return FALSE;
647 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_CAPABILITIES))
648 return FALSE;
649
650 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 4))
651 return FALSE;
652
653 const UINT16 dataType = Stream_Get_UINT16(s);
654 if (dataType != RDSTLS_DATA_CAPABILITIES)
655 {
656 WLog_Print(rdstls->log, WLOG_ERROR,
657 "received invalid DataType=0x%04" PRIX16 ", expected 0x%04" PRIX32, dataType,
658 WINPR_CXX_COMPAT_CAST(UINT32, RDSTLS_DATA_CAPABILITIES));
659 return FALSE;
660 }
661
662 const UINT16 supportedVersions = Stream_Get_UINT16(s);
663 if (!rdstls_are_some_versions_supported(rdstls->log, supportedVersions, TRUE))
664 return FALSE;
665 rdstls->supportedVersions = supportedVersions & RDSTLS_VERSION_MASK;
666
667 return TRUE;
668}
669
670WINPR_ATTR_NODISCARD
671static BOOL rdstls_read_unicode_string(WINPR_ATTR_UNUSED wLog* log, wStream* s, char** str)
672{
673 WINPR_ASSERT(str);
674
675 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 2))
676 return FALSE;
677
678 const UINT16 length = Stream_Get_UINT16(s);
679
680 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, length))
681 return FALSE;
682
683 if (length <= 2)
684 {
685 *str = nullptr;
686 Stream_Seek(s, length);
687 return TRUE;
688 }
689
690 *str = Stream_Read_UTF16_String_As_UTF8(s, length / sizeof(WCHAR), nullptr);
691 return (*str) != nullptr;
692}
693
694WINPR_ATTR_NODISCARD
695static BOOL rdstls_read_data(WINPR_ATTR_UNUSED wLog* log, wStream* s, UINT16* pLength,
696 const BYTE** pData)
697{
698 WINPR_ASSERT(pLength);
699 WINPR_ASSERT(pData);
700
701 *pData = nullptr;
702 *pLength = 0;
703 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, 2))
704 return FALSE;
705
706 const UINT16 length = Stream_Get_UINT16(s);
707
708 if (!Stream_CheckAndLogRequiredLengthWLog(log, s, length))
709 return FALSE;
710
711 if (length <= 2)
712 {
713 Stream_Seek(s, length);
714 return TRUE;
715 }
716
717 *pData = Stream_ConstPointer(s);
718 *pLength = length;
719 Stream_Seek(s, length);
720 return TRUE;
721}
722
723WINPR_ATTR_NODISCARD
724static BOOL rdstls_cmp_data(wLog* log, const char* field, const BYTE* serverData,
725 const UINT32 serverDataLength, const BYTE* clientData,
726 const UINT16 clientDataLength)
727{
728 if (serverDataLength > 0)
729 {
730 if (clientDataLength == 0)
731 {
732 WLog_Print(log, WLOG_ERROR, "expected %s", field);
733 return FALSE;
734 }
735
736 if (serverDataLength > UINT16_MAX || serverDataLength != clientDataLength ||
737 memcmp(serverData, clientData, serverDataLength) != 0)
738 {
739 WLog_Print(log, WLOG_ERROR, "%s verification failed", field);
740 return FALSE;
741 }
742 }
743
744 return TRUE;
745}
746
747WINPR_ATTR_NODISCARD
748static BOOL rdstls_cmp_str(wLog* log, const char* field, const char* serverStr,
749 const char* clientStr)
750{
751 if (!utils_str_is_empty(serverStr))
752 {
753 if (utils_str_is_empty(clientStr))
754 {
755 WLog_Print(log, WLOG_ERROR, "expected %s", field);
756 return FALSE;
757 }
758
759 WINPR_ASSERT(serverStr);
760 WINPR_ASSERT(clientStr);
761 if (strcmp(serverStr, clientStr) != 0)
762 {
763 WLog_Print(log, WLOG_ERROR, "%s verification failed", field);
764 return FALSE;
765 }
766 }
767
768 return TRUE;
769}
770
771WINPR_ATTR_NODISCARD
772static BOOL rdstls_process_authentication_request_with_password(rdpRdstls* rdstls, wStream* s,
773 uint16_t version)
774{
775 WINPR_ASSERT(rdstls);
776 WINPR_ASSERT(rdstls->context);
777
778 if (!rdstls_version_required(rdstls->log, RDSTLS_VERSION_1, version))
779 return FALSE;
780 if (!rdstls_required_role_is_server(rdstls, TRUE))
781 return FALSE;
782 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
783 return FALSE;
784
785 BOOL rc = FALSE;
786
787 const BYTE* clientRedirectionGuid = nullptr;
788 UINT16 clientRedirectionGuidLength = 0;
789 char* clientPassword = nullptr;
790 char* clientUsername = nullptr;
791 char* clientDomain = nullptr;
792
793 const rdpSettings* settings = rdstls->context->settings;
794 WINPR_ASSERT(settings);
795
796 if (!rdstls_read_data(rdstls->log, s, &clientRedirectionGuidLength, &clientRedirectionGuid))
797 goto fail;
798
799 if (!rdstls_read_unicode_string(rdstls->log, s, &clientUsername))
800 goto fail;
801
802 if (!rdstls_read_unicode_string(rdstls->log, s, &clientDomain))
803 goto fail;
804
805 if (!rdstls_read_unicode_string(rdstls->log, s, &clientPassword))
806 goto fail;
807
808 {
809 const BYTE* serverRedirectionGuid =
810 freerdp_settings_get_pointer(settings, FreeRDP_RedirectionGuid);
811 const UINT32 serverRedirectionGuidLength =
812 freerdp_settings_get_uint32(settings, FreeRDP_RedirectionGuidLength);
813 const char* serverUsername = freerdp_settings_get_string(settings, FreeRDP_Username);
814 const char* serverDomain = freerdp_settings_get_string(settings, FreeRDP_Domain);
815 const char* serverPassword = freerdp_settings_get_string(settings, FreeRDP_Password);
816
817 if (!rdstls_cmp_data(rdstls->log, "RedirectionGuid", serverRedirectionGuid,
818 serverRedirectionGuidLength, clientRedirectionGuid,
819 clientRedirectionGuidLength))
820 rdstls->resultCode = RDSTLS_RESULT_ACCESS_DENIED;
821 else if (!rdstls_cmp_str(rdstls->log, "UserName", serverUsername, clientUsername))
822 rdstls->resultCode = RDSTLS_RESULT_LOGON_FAILURE;
823 else if (!rdstls_cmp_str(rdstls->log, "Domain", serverDomain, clientDomain))
824 rdstls->resultCode = RDSTLS_RESULT_LOGON_FAILURE;
825 else if (!rdstls_cmp_str(rdstls->log, "Password", serverPassword, clientPassword))
826 rdstls->resultCode = RDSTLS_RESULT_LOGON_FAILURE;
827 else
828 rdstls->resultCode = RDSTLS_RESULT_SUCCESS;
829 }
830 rc = TRUE;
831fail:
832 return rc;
833}
834
835WINPR_ATTR_NODISCARD
836static BOOL rdstls_process_authentication_request_with_cookie(rdpRdstls* rdstls, wStream* s,
837 uint16_t version)
838{
839 if (!rdstls_version_required(rdstls->log, RDSTLS_VERSION_1, version))
840 return FALSE;
841
842 if (!rdstls_required_role_is_server(rdstls, TRUE))
843 return FALSE;
844 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
845 return FALSE;
846
847 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 4))
848 return FALSE;
849
850 const rdpSettings* settings = rdstls->context->settings;
851 WINPR_ASSERT(settings);
852
853 const uint32_t id = Stream_Get_UINT32(s);
854 const uint32_t expected = freerdp_settings_get_uint32(settings, FreeRDP_RedirectedSessionId);
855 if (id != expected)
856 {
857 WLog_Print(rdstls->log, WLOG_ERROR,
858 "RDSTLS Cookie SessionId does not match RedirectedSessionId. Deny access.");
859 return FALSE;
860 }
861
862 ARC_SC_PRIVATE_PACKET cookie = WINPR_C_ARRAY_INIT;
863 if (!rdstls_read_cookie(rdstls->log, s, &cookie))
864 return FALSE;
865
866 const ARC_SC_PRIVATE_PACKET* expect =
867 freerdp_settings_get_pointer(settings, FreeRDP_ServerAutoReconnectCookie);
868 if (!expect)
869 {
870 WLog_Print(rdstls->log, WLOG_ERROR, "No RDSTLS Cookie provided by server. Deny access.");
871 return FALSE;
872 }
873
874 if (memcmp(expect, &cookie, sizeof(ARC_SC_PRIVATE_PACKET)) != 0)
875 {
876 WLog_Print(rdstls->log, WLOG_ERROR, "RDSTLS Cookie does not match. Deny access.");
877 return FALSE;
878 }
879
880 WLog_Print(rdstls->log, WLOG_DEBUG, "RDSTLS Cookie matches. Grant access.");
881 rdstls->resultCode = RDSTLS_RESULT_SUCCESS;
882 return TRUE;
883}
884
885WINPR_ATTR_NODISCARD
886static BOOL rdstls_process_authentication_request_with_fedauth_token(rdpRdstls* rdstls, wStream* s,
887 uint16_t version)
888{
889 WINPR_ASSERT(rdstls);
890
891 if (!rdstls_version_required(rdstls->log, RDSTLS_VERSION_2, version))
892 return FALSE;
893 if (!rdstls_required_role_is_server(rdstls, TRUE))
894 return FALSE;
895 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
896 return FALSE;
897 if ((rdstls->supportedVersions & RDSTLS_VERSION_2) == 0)
898 {
899 WLog_Print(rdstls->log, WLOG_ERROR, "FedAuth token only supported with RDSTLS_VERSION_2");
900 return FALSE;
901 }
902
903 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 2))
904 return FALSE;
905 const uint16_t wbytes = Stream_Get_UINT16(s);
906 if (wbytes == 0)
907 {
908 WLog_Print(rdstls->log, WLOG_ERROR, "Empty FedAuth token given by client. Deny access");
909 return FALSE;
910 }
911 if ((wbytes % sizeof(WCHAR)) != 0)
912 {
913 WLog_Print(rdstls->log, WLOG_ERROR,
914 "Invalid FedAuth token length %" PRIu16 "given by client. Must be even", wbytes);
915 return FALSE;
916 }
917 const size_t wcharlen = wbytes / sizeof(WCHAR);
918 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, wbytes))
919 return FALSE;
920
921 const rdpSettings* settings = rdstls->context->settings;
922 WINPR_ASSERT(settings);
923
924 size_t len = 0;
925 WCHAR* token =
926 freerdp_settings_get_string_as_utf16(settings, FreeRDP_EndpointFedAuthToken, &len);
927 if (!token || (len == 0))
928 {
929 free(token);
930 WLog_Print(rdstls->log, WLOG_ERROR,
931 "No FedAuth token provided by server to compare. Deny access");
932 return FALSE;
933 }
934
935 if (len != wcharlen)
936 {
937 WLog_Print(rdstls->log, WLOG_ERROR, "FedAuth token length does not match. Deny access");
938 free(token);
939 return FALSE;
940 }
941
942 const int rc = memcmp(token, Stream_Pointer(s), len * sizeof(WCHAR));
943 free(token);
944 if (rc != 0)
945 {
946 WLog_Print(rdstls->log, WLOG_ERROR, "FedAuth token does not match. Deny access");
947 return FALSE;
948 }
949
950 WLog_Print(rdstls->log, WLOG_INFO, "FedAuth token does match. Grant access");
951 return TRUE;
952}
953
954WINPR_ATTR_NODISCARD
955static BOOL rdstls_process_authentication_request(rdpRdstls* rdstls, wStream* s, uint16_t version)
956{
957 if (!rdstls_required_role_is_server(rdstls, TRUE))
958 return FALSE;
959
960 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
961 return FALSE;
962
963 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 2))
964 return FALSE;
965
966 const UINT16 dataType = Stream_Get_UINT16(s);
967 switch (dataType)
968 {
969 case RDSTLS_DATA_PASSWORD_CREDS:
970 if (!rdstls_process_authentication_request_with_password(rdstls, s, version))
971 return FALSE;
972 break;
973 case RDSTLS_DATA_AUTORECONNECT_COOKIE:
974 if (!rdstls_process_authentication_request_with_cookie(rdstls, s, version))
975 return FALSE;
976 break;
977 case RDSTLS_DATA_FEDAUTH_TOKEN:
978 if (!rdstls_process_authentication_request_with_fedauth_token(rdstls, s, version))
979 return FALSE;
980 break;
981 default:
982 WLog_Print(rdstls->log, WLOG_ERROR,
983 "received invalid DataType=0x%04" PRIX16 ", expected 0x%04" PRIX32
984 " or 0x%04" PRIX32,
985 dataType, WINPR_CXX_COMPAT_CAST(UINT32, RDSTLS_DATA_PASSWORD_CREDS),
986 WINPR_CXX_COMPAT_CAST(UINT32, RDSTLS_DATA_AUTORECONNECT_COOKIE));
987 return FALSE;
988 }
989
990 return TRUE;
991}
992
993WINPR_ATTR_NODISCARD
994static BOOL rdstls_process_authentication_response(rdpRdstls* rdstls, wStream* s)
995{
996 if (!rdstls_required_role_is_server(rdstls, FALSE))
997 return FALSE;
998 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_RSP))
999 return FALSE;
1000
1001 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 6))
1002 return FALSE;
1003
1004 const UINT16 dataType = Stream_Get_UINT16(s);
1005 if (dataType != RDSTLS_DATA_RESULT_CODE)
1006 {
1007 WLog_Print(rdstls->log, WLOG_ERROR,
1008 "received invalid DataType=0x%04" PRIX16 ", expected 0x%04" PRIX32, dataType,
1009 WINPR_CXX_COMPAT_CAST(UINT32, RDSTLS_DATA_RESULT_CODE));
1010 return FALSE;
1011 }
1012
1013 const UINT32 resultCode = Stream_Get_UINT32(s);
1014 if (resultCode != RDSTLS_RESULT_SUCCESS)
1015 {
1016 WLog_Print(rdstls->log, WLOG_ERROR, "resultCode: %s [0x%08" PRIX32 "]",
1017 rdstls_result_code_str(resultCode), resultCode);
1018
1019 UINT32 error = FREERDP_ERROR_CONNECT_UNDEFINED;
1020 switch (resultCode)
1021 {
1022 case RDSTLS_RESULT_ACCESS_DENIED:
1023 error = FREERDP_ERROR_CONNECT_ACCESS_DENIED;
1024 break;
1025 case RDSTLS_RESULT_ACCOUNT_DISABLED:
1026 error = FREERDP_ERROR_CONNECT_ACCOUNT_DISABLED;
1027 break;
1028 case RDSTLS_RESULT_ACCOUNT_LOCKED_OUT:
1029 error = FREERDP_ERROR_CONNECT_ACCOUNT_LOCKED_OUT;
1030 break;
1031 case RDSTLS_RESULT_LOGON_FAILURE:
1032 error = FREERDP_ERROR_CONNECT_LOGON_FAILURE;
1033 break;
1034 case RDSTLS_RESULT_INVALID_LOGON_HOURS:
1035 error = FREERDP_ERROR_CONNECT_ACCOUNT_RESTRICTION;
1036 break;
1037 case RDSTLS_RESULT_PASSWORD_EXPIRED:
1038 error = FREERDP_ERROR_CONNECT_PASSWORD_EXPIRED;
1039 break;
1040 case RDSTLS_RESULT_PASSWORD_MUST_CHANGE:
1041 error = FREERDP_ERROR_CONNECT_PASSWORD_MUST_CHANGE;
1042 break;
1043 default:
1044 WLog_Print(rdstls->log, WLOG_ERROR,
1045 "Unexpected resultCode: [0x%08" PRIX32 "], NTSTATUS=%s, Win32Error=%s",
1046 resultCode, GetSecurityStatusString((SECURITY_STATUS)resultCode),
1047 Win32ErrorCode2Tag(resultCode & 0xFFFF));
1048 error = FREERDP_ERROR_CONNECT_UNDEFINED;
1049 break;
1050 }
1051
1052 freerdp_set_last_error_if_not(rdstls->context, error);
1053 return FALSE;
1054 }
1055
1056 return TRUE;
1057}
1058
1059WINPR_ATTR_NODISCARD
1060static BOOL rdstls_send_capabilities(rdpRdstls* rdstls)
1061{
1062 BOOL rc = FALSE;
1063
1064 if (!rdstls_required_role_is_server(rdstls, TRUE))
1065 return FALSE;
1066
1067 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_CAPABILITIES))
1068 return FALSE;
1069
1070 wStream* s = Stream_New(nullptr, 512);
1071 if (!s)
1072 goto fail;
1073
1074 if (!rdstls_write_capabilities(rdstls, s))
1075 goto fail;
1076 if (transport_write(rdstls->transport, s) < 0)
1077 goto fail;
1078
1079 rc = rdstls_set_state(rdstls, RDSTLS_STATE_AUTH_REQ);
1080fail:
1081 Stream_Free(s, TRUE);
1082 return rc;
1083}
1084
1085WINPR_ATTR_NODISCARD
1086static BOOL rdstls_recv_authentication_request(rdpRdstls* rdstls, uint16_t* pVersion)
1087{
1088 BOOL rc = FALSE;
1089 WINPR_ASSERT(pVersion);
1090
1091 if (!rdstls_required_role_is_server(rdstls, TRUE))
1092 return FALSE;
1093 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
1094 return FALSE;
1095
1096 wStream* s = Stream_New(nullptr, 4096);
1097 if (!s)
1098 goto fail;
1099
1100 WINPR_ASSERT(rdstls);
1101
1102 {
1103 const int res = transport_read_pdu(rdstls->transport, s);
1104 if (res < 0)
1105 goto fail;
1106 }
1107
1108 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 4))
1109 goto fail;
1110
1111 const UINT16 version = Stream_Get_UINT16(s);
1112 if (!rdstls_is_version_supported(rdstls, version))
1113 goto fail;
1114 *pVersion = version;
1115
1116 const UINT16 pduType = Stream_Get_UINT16(s);
1117 switch (pduType)
1118 {
1119 case RDSTLS_TYPE_AUTHREQ:
1120 if (!rdstls_process_authentication_request(rdstls, s, version))
1121 goto fail;
1122 break;
1123 default:
1124 WLog_Print(rdstls->log, WLOG_ERROR,
1125 "Invalid RDSTLS PDU type [0x%04" PRIx16 "] while reading AUTHREQ", pduType);
1126 goto fail;
1127 }
1128
1129 rc = rdstls_set_state(rdstls, RDSTLS_STATE_AUTH_RSP);
1130fail:
1131 Stream_Free(s, TRUE);
1132 return rc;
1133}
1134
1135WINPR_ATTR_NODISCARD
1136static BOOL rdstls_send_authentication_response(rdpRdstls* rdstls, uint16_t version)
1137{
1138 BOOL rc = FALSE;
1139
1140 if (!rdstls_required_role_is_server(rdstls, TRUE))
1141 return FALSE;
1142
1143 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_RSP))
1144 return FALSE;
1145
1146 wStream* s = Stream_New(nullptr, 512);
1147 if (!s)
1148 goto fail;
1149
1150 if (!Stream_EnsureRemainingCapacity(s, 2))
1151 goto fail;
1152
1153 Stream_Write_UINT16(s, version);
1154
1155 if (!rdstls_write_authentication_response(rdstls, s))
1156 goto fail;
1157
1158 if (transport_write(rdstls->transport, s) < 0)
1159 goto fail;
1160
1161 rc = rdstls_set_state(rdstls, RDSTLS_STATE_FINAL);
1162fail:
1163 Stream_Free(s, TRUE);
1164 return rc;
1165}
1166
1167WINPR_ATTR_NODISCARD
1168static BOOL rdstls_recv_capabilities(rdpRdstls* rdstls)
1169{
1170 BOOL rc = FALSE;
1171
1172 if (!rdstls_required_role_is_server(rdstls, FALSE))
1173 return FALSE;
1174
1175 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_CAPABILITIES))
1176 return FALSE;
1177
1178 wStream* s = Stream_New(nullptr, 512);
1179 if (!s)
1180 goto fail;
1181
1182 WINPR_ASSERT(rdstls);
1183
1184 {
1185 const int res = transport_read_pdu(rdstls->transport, s);
1186 if (res < 0)
1187 goto fail;
1188 }
1189
1190 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 4))
1191 goto fail;
1192
1193 const UINT16 version = Stream_Get_UINT16(s);
1194 if (!rdstls_is_version_supported(rdstls, version))
1195 goto fail;
1196
1197 const UINT16 pduType = Stream_Get_UINT16(s);
1198 switch (pduType)
1199 {
1200 case RDSTLS_TYPE_CAPABILITIES:
1201 if (!rdstls_process_capabilities(rdstls, s))
1202 goto fail;
1203 break;
1204 default:
1205 WLog_Print(rdstls->log, WLOG_ERROR,
1206 "Invalid pduType 0x%04" PRIx16 " while reading capability", pduType);
1207 goto fail;
1208 }
1209
1210 rc = rdstls_set_state(rdstls, RDSTLS_STATE_AUTH_REQ);
1211fail:
1212 Stream_Free(s, TRUE);
1213 return rc;
1214}
1215
1216WINPR_ATTR_NODISCARD
1217static BOOL rdstls_send_authentication_request(rdpRdstls* rdstls, uint16_t* pVersion)
1218{
1219 WINPR_ASSERT(pVersion);
1220
1221 BOOL rc = FALSE;
1222
1223 if (!rdstls_required_role_is_server(rdstls, FALSE))
1224 return FALSE;
1225
1226 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_REQ))
1227 return FALSE;
1228
1229 wStream* s = Stream_New(nullptr, 4096);
1230 if (!s)
1231 goto fail;
1232
1233 WINPR_ASSERT(rdstls->context);
1234
1235 const rdpSettings* settings = rdstls->context->settings;
1236 WINPR_ASSERT(settings);
1237
1238 if (!Stream_EnsureRemainingCapacity(s, 2))
1239 goto fail;
1240
1241 const RDSTLS_STATE state = rdstls_get_state(rdstls);
1242 const char* fedAuthToken = freerdp_settings_get_string(settings, FreeRDP_EndpointFedAuthToken);
1243 BOOL useFedAuth = (state == RDSTLS_STATE_AUTH_REQ) && !utils_str_is_empty(fedAuthToken);
1244 if ((rdstls->supportedVersions & RDSTLS_VERSION_2) == 0)
1245 {
1246 useFedAuth = FALSE;
1247 WLog_Print(rdstls->log, WLOG_WARN,
1248 "Client has FedAuthToken ready, but server did not announce RDSTLS_VERSION_2.");
1249 }
1250
1251 *pVersion = useFedAuth ? RDSTLS_VERSION_2 : RDSTLS_VERSION_1;
1252 Stream_Write_UINT16(s, *pVersion);
1253
1254 if (useFedAuth)
1255 {
1256 if (!rdstls_write_authentication_request_with_fedauth_token(rdstls, s))
1257 goto fail;
1258 }
1259 else if (settings->RedirectionFlags & LB_PASSWORD_IS_PK_ENCRYPTED)
1260 {
1261 if (!rdstls_write_authentication_request_with_password(rdstls, s))
1262 goto fail;
1263 }
1264 else if (settings->ServerAutoReconnectCookie != nullptr)
1265 {
1266 if (!rdstls_write_authentication_request_with_cookie(rdstls, s))
1267 goto fail;
1268 }
1269 else
1270 {
1271 WLog_Print(rdstls->log, WLOG_ERROR,
1272 "cannot authenticate with FedAuth token, password or "
1273 "auto-reconnect cookie");
1274 goto fail;
1275 }
1276
1277 WINPR_ASSERT(rdstls);
1278 if (transport_write(rdstls->transport, s) < 0)
1279 goto fail;
1280
1281 rc = rdstls_set_state(rdstls, RDSTLS_STATE_AUTH_RSP);
1282fail:
1283 Stream_Free(s, TRUE);
1284 return rc;
1285}
1286
1287WINPR_ATTR_NODISCARD
1288static BOOL rdstls_recv_authentication_response(rdpRdstls* rdstls, uint16_t expected)
1289{
1290 BOOL rc = FALSE;
1291
1292 WINPR_ASSERT(rdstls);
1293
1294 if (!rdstls_required_role_is_server(rdstls, FALSE))
1295 return FALSE;
1296
1297 if (!rdstls_check_state_requirements(rdstls, RDSTLS_STATE_AUTH_RSP))
1298 return FALSE;
1299
1300 wStream* s = Stream_New(nullptr, 512);
1301 if (!s)
1302 goto fail;
1303
1304 {
1305 const int res = transport_read_pdu(rdstls->transport, s);
1306 if (res < 0)
1307 goto fail;
1308 }
1309
1310 if (!Stream_CheckAndLogRequiredLengthWLog(rdstls->log, s, 4))
1311 goto fail;
1312
1313 const UINT16 version = Stream_Get_UINT16(s);
1314 if (!rdstls_is_version_supported(rdstls, version))
1315 goto fail;
1316 if (version != expected)
1317 goto fail;
1318
1319 const UINT16 pduType = Stream_Get_UINT16(s);
1320 switch (pduType)
1321 {
1322 case RDSTLS_TYPE_AUTHRSP:
1323 if (!rdstls_process_authentication_response(rdstls, s))
1324 goto fail;
1325 break;
1326 default:
1327 WLog_Print(rdstls->log, WLOG_ERROR,
1328 "Invalid RDSTLS PDU type [0x%04" PRIx16 "] while reading AUTHRSP", pduType);
1329 goto fail;
1330 }
1331
1332 rc = rdstls_set_state(rdstls, RDSTLS_STATE_FINAL);
1333fail:
1334 Stream_Free(s, TRUE);
1335 return rc;
1336}
1337
1338WINPR_ATTR_NODISCARD
1339static int rdstls_server_authenticate(rdpRdstls* rdstls)
1340{
1341 WINPR_ASSERT(rdstls);
1342 uint16_t version = 0;
1343
1344 if (!rdstls_set_state(rdstls, RDSTLS_STATE_CAPABILITIES))
1345 return -1;
1346
1347 if (!rdstls_send_capabilities(rdstls))
1348 return -1;
1349
1350 if (!rdstls_recv_authentication_request(rdstls, &version))
1351 return -1;
1352
1353 if (!rdstls_send_authentication_response(rdstls, version))
1354 return -1;
1355
1356 if (rdstls->resultCode != RDSTLS_RESULT_SUCCESS)
1357 return -1;
1358
1359 return 1;
1360}
1361
1362WINPR_ATTR_NODISCARD
1363static int rdstls_client_authenticate(rdpRdstls* rdstls)
1364{
1365 if (!rdstls_set_state(rdstls, RDSTLS_STATE_CAPABILITIES))
1366 return -1;
1367
1368 if (!rdstls_recv_capabilities(rdstls))
1369 return -1;
1370
1371 uint16_t version = 0;
1372 if (!rdstls_send_authentication_request(rdstls, &version))
1373 return -1;
1374
1375 if (!rdstls_recv_authentication_response(rdstls, version))
1376 return -1;
1377
1378 return 1;
1379}
1380
1388int rdstls_authenticate(rdpRdstls* rdstls)
1389{
1390 WINPR_ASSERT(rdstls);
1391
1392 if (rdstls->server)
1393 return rdstls_server_authenticate(rdstls);
1394 else
1395 return rdstls_client_authenticate(rdstls);
1396}
1397
1398WINPR_ATTR_NODISCARD
1399static SSIZE_T rdstls_parse_pdu_data_type(wLog* log, UINT16 dataType, wStream* s)
1400{
1401 size_t pduLength = 0;
1402
1403 switch (dataType)
1404 {
1405 case RDSTLS_DATA_PASSWORD_CREDS:
1406 {
1407 if (Stream_GetRemainingLength(s) < 2)
1408 return 0;
1409
1410 const UINT16 redirGuidLength = Stream_Get_UINT16(s);
1411
1412 if (Stream_GetRemainingLength(s) < redirGuidLength)
1413 return 0;
1414 Stream_Seek(s, redirGuidLength);
1415
1416 if (Stream_GetRemainingLength(s) < 2)
1417 return 0;
1418
1419 const UINT16 usernameLength = Stream_Get_UINT16(s);
1420
1421 if (Stream_GetRemainingLength(s) < usernameLength)
1422 return 0;
1423 Stream_Seek(s, usernameLength);
1424
1425 if (Stream_GetRemainingLength(s) < 2)
1426 return 0;
1427 const UINT16 domainLength = Stream_Get_UINT16(s);
1428
1429 if (Stream_GetRemainingLength(s) < domainLength)
1430 return 0;
1431 Stream_Seek(s, domainLength);
1432
1433 if (Stream_GetRemainingLength(s) < 2)
1434 return 0;
1435 const UINT16 passwordLength = Stream_Get_UINT16(s);
1436
1437 if (passwordLength == 0)
1438 {
1439 WLog_Print(log, WLOG_ERROR, "invalid RDSLTS PASSWORD_CREDS: empty password");
1440 return -1;
1441 }
1442 else if ((redirGuidLength == 0) && (usernameLength == 0) && (domainLength == 0) &&
1443 (passwordLength == 0))
1444 {
1445 WLog_Print(log, WLOG_ERROR, "invalid RDSLTS PASSWORD_CREDS: lengths 0");
1446 return -1;
1447 }
1448 pduLength = Stream_GetPosition(s) + passwordLength;
1449 }
1450 break;
1451 case RDSTLS_DATA_AUTORECONNECT_COOKIE:
1452 {
1453 if (Stream_GetRemainingLength(s) < 6)
1454 return 0;
1455 Stream_Seek(s, 4);
1456 const UINT16 cookieLength = Stream_Get_UINT16(s);
1457 if (cookieLength == 0)
1458 {
1459 WLog_Print(log, WLOG_ERROR, "invalid RDSLTS COOKIE::length");
1460 return -1;
1461 }
1462 pduLength = Stream_GetPosition(s) + cookieLength;
1463 }
1464 break;
1465 case RDSTLS_DATA_FEDAUTH_TOKEN:
1466 {
1467 if (Stream_GetRemainingLength(s) < 6)
1468 return 0;
1469 Stream_Seek(s, 4);
1470 const UINT16 tokenLength = Stream_Get_UINT16(s);
1471 if (tokenLength == 0)
1472 {
1473 WLog_Print(log, WLOG_ERROR, "invalid RDSLTS FEDAUTH_TOKEN::length");
1474 return -1;
1475 }
1476 pduLength = Stream_GetPosition(s) + tokenLength;
1477 }
1478 break;
1479 default:
1480 WLog_Print(log, WLOG_ERROR, "invalid RDSLTS dataType");
1481 return -1;
1482 }
1483
1484 if (pduLength > SSIZE_MAX)
1485 return 0;
1486 return (SSIZE_T)pduLength;
1487}
1488
1489SSIZE_T rdstls_parse_pdu(wLog* log, wStream* stream)
1490{
1491 SSIZE_T pduLength = -1;
1492 wStream sbuffer = WINPR_C_ARRAY_INIT;
1493 wStream* s = Stream_StaticConstInit(&sbuffer, Stream_Buffer(stream), Stream_Length(stream));
1494
1495 if (Stream_GetRemainingLength(s) < 2)
1496 return 0;
1497
1498 const UINT16 version = Stream_Get_UINT16(s);
1499 if (!rdstls_are_some_versions_supported(log, version, FALSE))
1500 return -1;
1501
1502 if (Stream_GetRemainingLength(s) < 2)
1503 return 0;
1504
1505 const UINT16 pduType = Stream_Get_UINT16(s);
1506 switch (pduType)
1507 {
1508 case RDSTLS_TYPE_CAPABILITIES:
1509 pduLength = 8;
1510 break;
1511 case RDSTLS_TYPE_AUTHREQ:
1512 {
1513 if (Stream_GetRemainingLength(s) < 2)
1514 return 0;
1515
1516 const UINT16 dataType = Stream_Get_UINT16(s);
1517 pduLength = rdstls_parse_pdu_data_type(log, dataType, s);
1518 }
1519 break;
1520 case RDSTLS_TYPE_AUTHRSP:
1521 pduLength = 10;
1522 break;
1523 default:
1524 WLog_Print(log, WLOG_ERROR, "invalid RDSTLS PDU type");
1525 return -1;
1526 }
1527
1528 return pduLength;
1529}
freerdp_settings_get_pointer
WINPR_ATTR_NODISCARD FREERDP_API const void * freerdp_settings_get_pointer(const rdpSettings *settings, FreeRDP_Settings_Keys_Pointer id)
Returns a immutable pointer settings value.
Definition common/settings.c:1420
freerdp_settings_get_string
WINPR_ATTR_NODISCARD FREERDP_API const char * freerdp_settings_get_string(const rdpSettings *settings, FreeRDP_Settings_Keys_String id)
Returns a immutable string settings value.
freerdp_settings_get_uint32
WINPR_ATTR_NODISCARD FREERDP_API UINT32 freerdp_settings_get_uint32(const rdpSettings *settings, FreeRDP_Settings_Keys_UInt32 id)
Returns a UINT32 settings value.
freerdp_settings_get_string_as_utf16
FREERDP_API WCHAR * freerdp_settings_get_string_as_utf16(const rdpSettings *settings, FreeRDP_Settings_Keys_String id, size_t *pCharLen)
Return an allocated UTF16 string.
Definition common/settings.c:2295
ARC_SC_PRIVATE_PACKET
Definition settings_types.h:380