libfreerdp/core/nego.c

   1 /**
   2  * FreeRDP: A Remote Desktop Protocol Implementation
   3  * RDP Protocol Security Negotiation
   4  *
   5  * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
   6  *
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *     http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  */
  19
  20 #ifdef HAVE_CONFIG_H
  21 #include "config.h"
  22 #endif
  23
  24 #include <stdio.h>
  25 #include <string.h>
  26
  27 #include <winpr/crt.h>
  28
  29 #include "tpkt.h"
  30
  31 #include "nego.h"
  32
  33 #include "transport.h"
  34
  35 static const char* const NEGO_STATE_STRINGS[] =
  36 {
  37         "NEGO_STATE_INITIAL",
  38         "NEGO_STATE_EXT",
  39         "NEGO_STATE_NLA",
  40         "NEGO_STATE_TLS",
  41         "NEGO_STATE_RDP",
  42         "NEGO_STATE_FAIL",
  43         "NEGO_STATE_FINAL"
  44 };
  45
  46 static const char PROTOCOL_SECURITY_STRINGS[4][4] =
  47 {
  48         "RDP",
  49         "TLS",
  50         "NLA",
  51         "EXT"
  52 };
  53
  54 BOOL nego_security_connect(rdpNego* nego);
  55
  56 /**
  57  * Negotiate protocol security and connect.
  58  * @param nego
  59  * @return
  60  */
  61
  62 BOOL nego_connect(rdpNego* nego)
  63 {
  64         if (nego->state == NEGO_STATE_INITIAL)
  65         {
  66                 if (nego->enabled_protocols[PROTOCOL_EXT])
  67                 {
  68                         nego->state = NEGO_STATE_EXT;
  69                 }
  70                 else if (nego->enabled_protocols[PROTOCOL_NLA])
  71                 {
  72                         nego->state = NEGO_STATE_NLA;
  73                 }
  74                 else if (nego->enabled_protocols[PROTOCOL_TLS])
  75                 {
  76                         nego->state = NEGO_STATE_TLS;
  77                 }
  78                 else if (nego->enabled_protocols[PROTOCOL_RDP])
  79                 {
  80                         nego->state = NEGO_STATE_RDP;
  81                 }
  82                 else
  83                 {
  84                         DEBUG_NEGO("No security protocol is enabled");
  85                         nego->state = NEGO_STATE_FAIL;
  86                 }
  87
  88                 if (!nego->NegotiateSecurityLayer)
  89                 {
  90                         DEBUG_NEGO("Security Layer Negotiation is disabled");
  91                         /* attempt only the highest enabled protocol (see nego_attempt_*) */
  92
  93                         nego->enabled_protocols[PROTOCOL_NLA] = FALSE;
  94                         nego->enabled_protocols[PROTOCOL_TLS] = FALSE;
  95                         nego->enabled_protocols[PROTOCOL_RDP] = FALSE;
  96                         nego->enabled_protocols[PROTOCOL_EXT] = FALSE;
  97
  98                         if (nego->state == NEGO_STATE_EXT)
  99                         {
 100                                 nego->enabled_protocols[PROTOCOL_EXT] = TRUE;
 101                                 nego->enabled_protocols[PROTOCOL_NLA] = TRUE;
 102                                 nego->selected_protocol = PROTOCOL_EXT;
 103                         }
 104                         else if (nego->state == NEGO_STATE_NLA)
 105                         {
 106                                 nego->enabled_protocols[PROTOCOL_NLA] = TRUE;
 107                                 nego->selected_protocol = PROTOCOL_NLA;
 108                         }
 109                         else if (nego->state == NEGO_STATE_TLS)
 110                         {
 111                                 nego->enabled_protocols[PROTOCOL_TLS] = TRUE;
 112                                 nego->selected_protocol = PROTOCOL_TLS;
 113                         }
 114                         else if (nego->state == NEGO_STATE_RDP)
 115                         {
 116                                 nego->enabled_protocols[PROTOCOL_RDP] = TRUE;
 117                                 nego->selected_protocol = PROTOCOL_RDP;
 118                         }
 119                 }
 120
 121                 if (!nego_send_preconnection_pdu(nego))
 122                 {
 123                         DEBUG_NEGO("Failed to send preconnection pdu");
 124                         nego->state = NEGO_STATE_FINAL;
 125                         return FALSE;
 126                 }
 127         }
 128
 129         do
 130         {
 131                 DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
 132
 133                 nego_send(nego);
 134
 135                 if (nego->state == NEGO_STATE_FAIL)
 136                 {
 137                         DEBUG_NEGO("Protocol Security Negotiation Failure");
 138                         nego->state = NEGO_STATE_FINAL;
 139                         return FALSE;
 140                 }
 141         }
 142         while (nego->state != NEGO_STATE_FINAL);
 143
 144         DEBUG_NEGO("Negotiated %s security", PROTOCOL_SECURITY_STRINGS[nego->selected_protocol]);
 145
 146         /* update settings with negotiated protocol security */
 147         nego->transport->settings->RequestedProtocols = nego->requested_protocols;
 148         nego->transport->settings->SelectedProtocol = nego->selected_protocol;
 149         nego->transport->settings->NegotiationFlags = nego->flags;
 150
 151         if (nego->selected_protocol == PROTOCOL_RDP)
 152         {
 153                 nego->transport->settings->DisableEncryption = TRUE;
 154                 nego->transport->settings->EncryptionMethods = ENCRYPTION_METHOD_40BIT | ENCRYPTION_METHOD_128BIT | ENCRYPTION_METHOD_FIPS;
 155                 nego->transport->settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
 156         }
 157
 158         /* finally connect security layer (if not already done) */
 159         if (!nego_security_connect(nego))
 160         {
 161                 DEBUG_NEGO("Failed to connect with %s security", PROTOCOL_SECURITY_STRINGS[nego->selected_protocol]);
 162                 return FALSE;
 163         }
 164
 165         return TRUE;
 166 }
 167
 168 /* connect to selected security layer */
 169 BOOL nego_security_connect(rdpNego* nego)
 170 {
 171         if (!nego->tcp_connected)
 172         {
 173                 nego->security_connected = FALSE;
 174         }
 175         else if (!nego->security_connected)
 176         {
 177                 if (nego->selected_protocol == PROTOCOL_NLA)
 178                 {
 179                         DEBUG_NEGO("nego_security_connect with PROTOCOL_NLA");
 180                         nego->security_connected = transport_connect_nla(nego->transport);
 181                 }
 182                 else if (nego->selected_protocol == PROTOCOL_TLS)
 183                 {
 184                         DEBUG_NEGO("nego_security_connect with PROTOCOL_TLS");
 185                         nego->security_connected = transport_connect_tls(nego->transport);
 186                 }
 187                 else if (nego->selected_protocol == PROTOCOL_RDP)
 188                 {
 189                         DEBUG_NEGO("nego_security_connect with PROTOCOL_RDP");
 190                         nego->security_connected = transport_connect_rdp(nego->transport);
 191                 }
 192                 else
 193                 {
 194                         DEBUG_NEGO("cannot connect security layer because no protocol has been selected yet.");
 195                 }
 196         }
 197
 198         return nego->security_connected;
 199 }
 200
 201 /**
 202  * Connect TCP layer.
 203  * @param nego
 204  * @return
 205  */
 206
 207 BOOL nego_tcp_connect(rdpNego* nego)
 208 {
 209         if (!nego->tcp_connected)
 210                 nego->tcp_connected = transport_connect(nego->transport, nego->hostname, nego->port);
 211
 212         return nego->tcp_connected;
 213 }
 214
 215 /**
 216  * Connect TCP layer. For direct approach, connect security layer as well.
 217  * @param nego
 218  * @return
 219  */
 220
 221 BOOL nego_transport_connect(rdpNego* nego)
 222 {
 223         nego_tcp_connect(nego);
 224
 225         if (nego->tcp_connected && !nego->NegotiateSecurityLayer)
 226                 return nego_security_connect(nego);
 227
 228         return nego->tcp_connected;
 229 }
 230
 231 /**
 232  * Disconnect TCP layer.
 233  * @param nego
 234  * @return
 235  */
 236
 237 int nego_transport_disconnect(rdpNego* nego)
 238 {
 239         if (nego->tcp_connected)
 240                 transport_disconnect(nego->transport);
 241
 242         nego->tcp_connected = FALSE;
 243         nego->security_connected = FALSE;
 244
 245         return 1;
 246 }
 247
 248 /**
 249  * Send preconnection information if enabled.
 250  * @param nego
 251  * @return
 252  */
 253
 254 BOOL nego_send_preconnection_pdu(rdpNego* nego)
 255 {
 256         wStream* s;
 257         UINT32 cbSize;
 258         UINT16 cchPCB = 0;
 259         WCHAR* wszPCB = NULL;
 260
 261         if (!nego->send_preconnection_pdu)
 262                 return TRUE;
 263
 264         DEBUG_NEGO("Sending preconnection PDU");
 265
 266         if (!nego_tcp_connect(nego))
 267                 return FALSE;
 268
 269         /* it's easier to always send the version 2 PDU, and it's just 2 bytes overhead */
 270         cbSize = PRECONNECTION_PDU_V2_MIN_SIZE;
 271
 272         if (nego->preconnection_blob)
 273         {
 274                 cchPCB = (UINT16) ConvertToUnicode(CP_UTF8, 0, nego->preconnection_blob, -1, &wszPCB, 0);
 275                 cchPCB += 1; /* zero-termination */
 276                 cbSize += cchPCB * 2;
 277         }
 278
 279         s = Stream_New(NULL, cbSize);
 280
 281         Stream_Write_UINT32(s, cbSize); /* cbSize */
 282         Stream_Write_UINT32(s, 0); /* Flags */
 283         Stream_Write_UINT32(s, PRECONNECTION_PDU_V2); /* Version */
 284         Stream_Write_UINT32(s, nego->preconnection_id); /* Id */
 285         Stream_Write_UINT16(s, cchPCB); /* cchPCB */
 286
 287         if (wszPCB)
 288         {
 289                 Stream_Write(s, wszPCB, cchPCB * 2); /* wszPCB */
 290                 free(wszPCB);
 291         }
 292
 293         Stream_SealLength(s);
 294
 295         if (transport_write(nego->transport, s) < 0)
 296         {
 297                 Stream_Free(s, TRUE);
 298                 return FALSE;
 299         }
 300
 301         Stream_Free(s, TRUE);
 302
 303         return TRUE;
 304 }
 305
 306 /**
 307  * Attempt negotiating NLA + TLS extended security.
 308  * @param nego
 309  */
 310
 311 void nego_attempt_ext(rdpNego* nego)
 312 {
 313         nego->requested_protocols = PROTOCOL_NLA | PROTOCOL_TLS | PROTOCOL_EXT;
 314
 315         DEBUG_NEGO("Attempting NLA extended security");
 316
 317         if (!nego_transport_connect(nego))
 318         {
 319                 nego->state = NEGO_STATE_FAIL;
 320                 return;
 321         }
 322
 323         if (!nego_send_negotiation_request(nego))
 324         {
 325                 nego->state = NEGO_STATE_FAIL;
 326                 return;
 327         }
 328
 329         if (!nego_recv_response(nego))
 330         {
 331                 nego->state = NEGO_STATE_FAIL;
 332                 return;
 333         }
 334
 335         DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
 336
 337         if (nego->state != NEGO_STATE_FINAL)
 338         {
 339                 nego_transport_disconnect(nego);
 340
 341                 if (nego->enabled_protocols[PROTOCOL_NLA])
 342                         nego->state = NEGO_STATE_NLA;
 343                 else if (nego->enabled_protocols[PROTOCOL_TLS])
 344                         nego->state = NEGO_STATE_TLS;
 345                 else if (nego->enabled_protocols[PROTOCOL_RDP])
 346                         nego->state = NEGO_STATE_RDP;
 347                 else
 348                         nego->state = NEGO_STATE_FAIL;
 349         }
 350 }
 351
 352 /**
 353  * Attempt negotiating NLA + TLS security.
 354  * @param nego
 355  */
 356
 357 void nego_attempt_nla(rdpNego* nego)
 358 {
 359         nego->requested_protocols = PROTOCOL_NLA | PROTOCOL_TLS;
 360
 361         DEBUG_NEGO("Attempting NLA security");
 362
 363         if (!nego_transport_connect(nego))
 364         {
 365                 nego->state = NEGO_STATE_FAIL;
 366                 return;
 367         }
 368
 369         if (!nego_send_negotiation_request(nego))
 370         {
 371                 nego->state = NEGO_STATE_FAIL;
 372                 return;
 373         }
 374
 375         if (!nego_recv_response(nego))
 376         {
 377                 nego->state = NEGO_STATE_FAIL;
 378                 return;
 379         }
 380
 381         DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
 382
 383         if (nego->state != NEGO_STATE_FINAL)
 384         {
 385                 nego_transport_disconnect(nego);
 386
 387                 if (nego->enabled_protocols[PROTOCOL_TLS])
 388                         nego->state = NEGO_STATE_TLS;
 389                 else if (nego->enabled_protocols[PROTOCOL_RDP])
 390                         nego->state = NEGO_STATE_RDP;
 391                 else
 392                         nego->state = NEGO_STATE_FAIL;
 393         }
 394 }
 395
 396 /**
 397  * Attempt negotiating TLS security.
 398  * @param nego
 399  */
 400
 401 void nego_attempt_tls(rdpNego* nego)
 402 {
 403         nego->requested_protocols = PROTOCOL_TLS;
 404
 405         DEBUG_NEGO("Attempting TLS security");
 406
 407         if (!nego_transport_connect(nego))
 408         {
 409                 nego->state = NEGO_STATE_FAIL;
 410                 return;
 411         }
 412
 413         if (!nego_send_negotiation_request(nego))
 414         {
 415                 nego->state = NEGO_STATE_FAIL;
 416                 return;
 417         }
 418
 419         if (!nego_recv_response(nego))
 420         {
 421                 nego->state = NEGO_STATE_FAIL;
 422                 return;
 423         }
 424
 425         if (nego->state != NEGO_STATE_FINAL)
 426         {
 427                 nego_transport_disconnect(nego);
 428
 429                 if (nego->enabled_protocols[PROTOCOL_RDP])
 430                         nego->state = NEGO_STATE_RDP;
 431                 else
 432                         nego->state = NEGO_STATE_FAIL;
 433         }
 434 }
 435
 436 /**
 437  * Attempt negotiating standard RDP security.
 438  * @param nego
 439  */
 440
 441 void nego_attempt_rdp(rdpNego* nego)
 442 {
 443         nego->requested_protocols = PROTOCOL_RDP;
 444
 445         DEBUG_NEGO("Attempting RDP security");
 446
 447         if (!nego_transport_connect(nego))
 448         {
 449                 nego->state = NEGO_STATE_FAIL;
 450                 return;
 451         }
 452
 453         if (!nego_send_negotiation_request(nego))
 454         {
 455                 nego->state = NEGO_STATE_FAIL;
 456                 return;
 457         }
 458
 459         if (!nego_recv_response(nego))
 460         {
 461                 nego->state = NEGO_STATE_FAIL;
 462                 return;
 463         }
 464 }
 465
 466 /**
 467  * Wait to receive a negotiation response
 468  * @param nego
 469  */
 470
 471 BOOL nego_recv_response(rdpNego* nego)
 472 {
 473         int status;
 474         wStream* s;
 475
 476         s = Stream_New(NULL, 1024);
 477
 478         status = transport_read(nego->transport, s);
 479
 480         if (status < 0)
 481         {
 482                 Stream_Free(s, TRUE);
 483                 return FALSE;
 484         }
 485
 486         status = nego_recv(nego->transport, s, nego);
 487
 488         Stream_Free(s, TRUE);
 489         if (status < 0)
 490                 return FALSE;
 491
 492         return TRUE;
 493 }
 494
 495 /**
 496  * Receive protocol security negotiation message.\n
 497  * @msdn{cc240501}
 498  * @param transport transport
 499  * @param s stream
 500  * @param extra nego pointer
 501  */
 502
 503 int nego_recv(rdpTransport* transport, wStream* s, void* extra)
 504 {
 505         BYTE li;
 506         BYTE type;
 507         UINT16 length;
 508         rdpNego* nego = (rdpNego*) extra;
 509
 510         length = tpkt_read_header(s);
 511
 512         if (length == 0)
 513                 return -1;
 514
 515         if (!tpdu_read_connection_confirm(s, &li))
 516                 return -1;
 517
 518         if (li > 6)
 519         {
 520                 /* rdpNegData (optional) */
 521
 522                 Stream_Read_UINT8(s, type); /* Type */
 523
 524                 switch (type)
 525                 {
 526                         case TYPE_RDP_NEG_RSP:
 527                                 nego_process_negotiation_response(nego, s);
 528
 529                                 DEBUG_NEGO("selected_protocol: %d", nego->selected_protocol);
 530
 531                                 /* enhanced security selected ? */
 532
 533                                 if (nego->selected_protocol)
 534                                 {
 535                                         if ((nego->selected_protocol == PROTOCOL_NLA) &&
 536                                                 (!nego->enabled_protocols[PROTOCOL_NLA]))
 537                                         {
 538                                                 nego->state = NEGO_STATE_FAIL;
 539                                         }
 540                                         if ((nego->selected_protocol == PROTOCOL_TLS) &&
 541                                                 (!nego->enabled_protocols[PROTOCOL_TLS]))
 542                                         {
 543                                                 nego->state = NEGO_STATE_FAIL;
 544                                         }
 545                                 }
 546                                 else if (!nego->enabled_protocols[PROTOCOL_RDP])
 547                                 {
 548                                         nego->state = NEGO_STATE_FAIL;
 549                                 }
 550                                 break;
 551
 552                         case TYPE_RDP_NEG_FAILURE:
 553                                 nego_process_negotiation_failure(nego, s);
 554                                 break;
 555                 }
 556         }
 557         else if (li == 6)
 558         {
 559                 DEBUG_NEGO("no rdpNegData");
 560
 561                 if (!nego->enabled_protocols[PROTOCOL_RDP])
 562                         nego->state = NEGO_STATE_FAIL;
 563                 else
 564                         nego->state = NEGO_STATE_FINAL;
 565         }
 566         else
 567         {
 568                 fprintf(stderr, "invalid negotiation response\n");
 569                 nego->state = NEGO_STATE_FAIL;
 570         }
 571
 572         return 0;
 573 }
 574
 575 /**
 576  * Read protocol security negotiation request message.\n
 577  * @param nego
 578  * @param s stream
 579  */
 580
 581 BOOL nego_read_request(rdpNego* nego, wStream* s)
 582 {
 583         BYTE li;
 584         BYTE c;
 585         BYTE type;
 586
 587         tpkt_read_header(s);
 588
 589         if (!tpdu_read_connection_request(s, &li))
 590                 return FALSE;
 591
 592         if (li != Stream_GetRemainingLength(s) + 6)
 593         {
 594                 fprintf(stderr, "Incorrect TPDU length indicator.\n");
 595                 return FALSE;
 596         }
 597
 598         if (Stream_GetRemainingLength(s) > 8)
 599         {
 600                 /* Optional routingToken or cookie, ending with CR+LF */
 601                 while (Stream_GetRemainingLength(s) > 0)
 602                 {
 603                         Stream_Read_UINT8(s, c);
 604
 605                         if (c != '\x0D')
 606                                 continue;
 607
 608                         Stream_Peek_UINT8(s, c);
 609
 610                         if (c != '\x0A')
 611                                 continue;
 612
 613                         Stream_Seek_UINT8(s);
 614                         break;
 615                 }
 616         }
 617
 618         if (Stream_GetRemainingLength(s) >= 8)
 619         {
 620                 /* rdpNegData (optional) */
 621
 622                 Stream_Read_UINT8(s, type); /* Type */
 623
 624                 if (type != TYPE_RDP_NEG_REQ)
 625                 {
 626                         fprintf(stderr, "Incorrect negotiation request type %d\n", type);
 627                         return FALSE;
 628                 }
 629
 630                 nego_process_negotiation_request(nego, s);
 631         }
 632
 633         return TRUE;
 634 }
 635
 636 /**
 637  * Send protocol security negotiation message.
 638  * @param nego
 639  */
 640
 641 void nego_send(rdpNego* nego)
 642 {
 643         if (nego->state == NEGO_STATE_EXT)
 644                 nego_attempt_ext(nego);
 645         else if (nego->state == NEGO_STATE_NLA)
 646                 nego_attempt_nla(nego);
 647         else if (nego->state == NEGO_STATE_TLS)
 648                 nego_attempt_tls(nego);
 649         else if (nego->state == NEGO_STATE_RDP)
 650                 nego_attempt_rdp(nego);
 651         else
 652                 DEBUG_NEGO("invalid negotiation state for sending");
 653 }
 654
 655 /**
 656  * Send RDP Negotiation Request (RDP_NEG_REQ).\n
 657  * @msdn{cc240500}\n
 658  * @msdn{cc240470}
 659  * @param nego
 660  */
 661
 662 BOOL nego_send_negotiation_request(rdpNego* nego)
 663 {
 664         wStream* s;
 665         int length;
 666         int bm, em;
 667         int cookie_length;
 668
 669         s = Stream_New(NULL, 512);
 670
 671         length = TPDU_CONNECTION_REQUEST_LENGTH;
 672         bm = Stream_GetPosition(s);
 673         Stream_Seek(s, length);
 674
 675         if (nego->RoutingToken)
 676         {
 677                 Stream_Write(s, nego->RoutingToken, nego->RoutingTokenLength);
 678                 Stream_Write_UINT8(s, 0x0D); /* CR */
 679                 Stream_Write_UINT8(s, 0x0A); /* LF */
 680                 length += nego->RoutingTokenLength + 2;
 681         }
 682         else if (nego->cookie)
 683         {
 684                 cookie_length = strlen(nego->cookie);
 685
 686                 if (cookie_length > (int) nego->cookie_max_length)
 687                         cookie_length = nego->cookie_max_length;
 688
 689                 Stream_Write(s, "Cookie: mstshash=", 17);
 690                 Stream_Write(s, (BYTE*) nego->cookie, cookie_length);
 691                 Stream_Write_UINT8(s, 0x0D); /* CR */
 692                 Stream_Write_UINT8(s, 0x0A); /* LF */
 693                 length += cookie_length + 19;
 694         }
 695
 696         DEBUG_NEGO("requested_protocols: %d", nego->requested_protocols);
 697
 698         if ((nego->requested_protocols > PROTOCOL_RDP) || (nego->sendNegoData))
 699         {
 700                 /* RDP_NEG_DATA must be present for TLS and NLA */
 701                 Stream_Write_UINT8(s, TYPE_RDP_NEG_REQ);
 702                 Stream_Write_UINT8(s, 0); /* flags, must be set to zero */
 703                 Stream_Write_UINT16(s, 8); /* RDP_NEG_DATA length (8) */
 704                 Stream_Write_UINT32(s, nego->requested_protocols); /* requestedProtocols */
 705                 length += 8;
 706         }
 707
 708         em = Stream_GetPosition(s);
 709         Stream_SetPosition(s, bm);
 710         tpkt_write_header(s, length);
 711         tpdu_write_connection_request(s, length - 5);
 712         Stream_SetPosition(s, em);
 713
 714         Stream_SealLength(s);
 715
 716         if (transport_write(nego->transport, s) < 0)
 717         {
 718                 Stream_Free(s, TRUE);
 719                 return FALSE;
 720         }
 721
 722         Stream_Free(s, TRUE);
 723
 724         return TRUE;
 725 }
 726
 727 /**
 728  * Process Negotiation Request from Connection Request message.
 729  * @param nego
 730  * @param s
 731  */
 732
 733 void nego_process_negotiation_request(rdpNego* nego, wStream* s)
 734 {
 735         BYTE flags;
 736         UINT16 length;
 737
 738         DEBUG_NEGO("RDP_NEG_REQ");
 739
 740         Stream_Read_UINT8(s, flags);
 741         Stream_Read_UINT16(s, length);
 742         Stream_Read_UINT32(s, nego->requested_protocols);
 743
 744         DEBUG_NEGO("requested_protocols: %d", nego->requested_protocols);
 745
 746         nego->state = NEGO_STATE_FINAL;
 747 }
 748
 749 /**
 750  * Process Negotiation Response from Connection Confirm message.
 751  * @param nego
 752  * @param s
 753  */
 754
 755 void nego_process_negotiation_response(rdpNego* nego, wStream* s)
 756 {
 757         UINT16 length;
 758
 759         DEBUG_NEGO("RDP_NEG_RSP");
 760
 761         if (Stream_GetRemainingLength(s) < 7)
 762         {
 763                 DEBUG_NEGO("RDP_INVALID_NEG_RSP");
 764                 nego->state = NEGO_STATE_FAIL;
 765                 return;
 766         }
 767
 768         Stream_Read_UINT8(s, nego->flags);
 769         Stream_Read_UINT16(s, length);
 770         Stream_Read_UINT32(s, nego->selected_protocol);
 771
 772         nego->state = NEGO_STATE_FINAL;
 773 }
 774
 775 /**
 776  * Process Negotiation Failure from Connection Confirm message.
 777  * @param nego
 778  * @param s
 779  */
 780
 781 void nego_process_negotiation_failure(rdpNego* nego, wStream* s)
 782 {
 783         BYTE flags;
 784         UINT16 length;
 785         UINT32 failureCode;
 786
 787         DEBUG_NEGO("RDP_NEG_FAILURE");
 788
 789         Stream_Read_UINT8(s, flags);
 790         Stream_Read_UINT16(s, length);
 791         Stream_Read_UINT32(s, failureCode);
 792
 793         switch (failureCode)
 794         {
 795                 case SSL_REQUIRED_BY_SERVER:
 796                         DEBUG_NEGO("Error: SSL_REQUIRED_BY_SERVER");
 797                         break;
 798
 799                 case SSL_NOT_ALLOWED_BY_SERVER:
 800                         DEBUG_NEGO("Error: SSL_NOT_ALLOWED_BY_SERVER");
 801                         nego->sendNegoData = TRUE;
 802                         break;
 803
 804                 case SSL_CERT_NOT_ON_SERVER:
 805                         DEBUG_NEGO("Error: SSL_CERT_NOT_ON_SERVER");
 806                         nego->sendNegoData = TRUE;
 807                         break;
 808
 809                 case INCONSISTENT_FLAGS:
 810                         DEBUG_NEGO("Error: INCONSISTENT_FLAGS");
 811                         break;
 812
 813                 case HYBRID_REQUIRED_BY_SERVER:
 814                         DEBUG_NEGO("Error: HYBRID_REQUIRED_BY_SERVER");
 815                         break;
 816
 817                 default:
 818                         DEBUG_NEGO("Error: Unknown protocol security error %d", failureCode);
 819                         break;
 820         }
 821
 822         nego->state = NEGO_STATE_FAIL;
 823 }
 824
 825 /**
 826  * Send RDP Negotiation Response (RDP_NEG_RSP).\n
 827  * @param nego
 828  */
 829
 830 BOOL nego_send_negotiation_response(rdpNego* nego)
 831 {
 832         int length;
 833         int bm, em;
 834         BOOL status;
 835         wStream* s;
 836         rdpSettings* settings;
 837
 838         status = TRUE;
 839         settings = nego->transport->settings;
 840
 841         s = Stream_New(NULL, 512);
 842
 843         length = TPDU_CONNECTION_CONFIRM_LENGTH;
 844         bm = Stream_GetPosition(s);
 845         Stream_Seek(s, length);
 846
 847         if (nego->selected_protocol > PROTOCOL_RDP)
 848         {
 849                 /* RDP_NEG_DATA must be present for TLS and NLA */
 850                 Stream_Write_UINT8(s, TYPE_RDP_NEG_RSP);
 851                 Stream_Write_UINT8(s, EXTENDED_CLIENT_DATA_SUPPORTED); /* flags */
 852                 Stream_Write_UINT16(s, 8); /* RDP_NEG_DATA length (8) */
 853                 Stream_Write_UINT32(s, nego->selected_protocol); /* selectedProtocol */
 854                 length += 8;
 855         }
 856         else if (!settings->RdpSecurity)
 857         {
 858                 Stream_Write_UINT8(s, TYPE_RDP_NEG_FAILURE);
 859                 Stream_Write_UINT8(s, 0); /* flags */
 860                 Stream_Write_UINT16(s, 8); /* RDP_NEG_DATA length (8) */
 861                 /*
 862                  * TODO: Check for other possibilities,
 863                  *       like SSL_NOT_ALLOWED_BY_SERVER.
 864                  */
 865                 fprintf(stderr, "nego_send_negotiation_response: client supports only Standard RDP Security\n");
 866                 Stream_Write_UINT32(s, SSL_REQUIRED_BY_SERVER);
 867                 length += 8;
 868                 status = FALSE;
 869         }
 870
 871         em = Stream_GetPosition(s);
 872         Stream_SetPosition(s, bm);
 873         tpkt_write_header(s, length);
 874         tpdu_write_connection_confirm(s, length - 5);
 875         Stream_SetPosition(s, em);
 876
 877         Stream_SealLength(s);
 878
 879         if (transport_write(nego->transport, s) < 0)
 880         {
 881                 Stream_Free(s, TRUE);
 882                 return FALSE;
 883         }
 884
 885         Stream_Free(s, TRUE);
 886
 887         if (status)
 888         {
 889                 /* update settings with negotiated protocol security */
 890                 settings->RequestedProtocols = nego->requested_protocols;
 891                 settings->SelectedProtocol = nego->selected_protocol;
 892
 893                 if (settings->SelectedProtocol == PROTOCOL_RDP)
 894                 {
 895                         settings->TlsSecurity = FALSE;
 896                         settings->NlaSecurity = FALSE;
 897                         settings->RdpSecurity = TRUE;
 898
 899                         if (!settings->LocalConnection)
 900                         {
 901                                 settings->DisableEncryption = TRUE;
 902                                 settings->EncryptionMethods = ENCRYPTION_METHOD_40BIT | ENCRYPTION_METHOD_128BIT | ENCRYPTION_METHOD_FIPS;
 903                                 settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
 904                         }
 905
 906                         if (settings->DisableEncryption && settings->RdpServerRsaKey == NULL && settings->RdpKeyFile == NULL)
 907                                 return FALSE;
 908                 }
 909                 else if (settings->SelectedProtocol == PROTOCOL_TLS)
 910                 {
 911                         settings->TlsSecurity = TRUE;
 912                         settings->NlaSecurity = FALSE;
 913                         settings->RdpSecurity = FALSE;
 914                         settings->DisableEncryption = FALSE;
 915                         settings->EncryptionMethods = ENCRYPTION_METHOD_NONE;
 916                         settings->EncryptionLevel = ENCRYPTION_LEVEL_NONE;
 917                 }
 918                 else if (settings->SelectedProtocol == PROTOCOL_NLA)
 919                 {
 920                         settings->TlsSecurity = TRUE;
 921                         settings->NlaSecurity = TRUE;
 922                         settings->RdpSecurity = FALSE;
 923                         settings->DisableEncryption = FALSE;
 924                         settings->EncryptionMethods = ENCRYPTION_METHOD_NONE;
 925                         settings->EncryptionLevel = ENCRYPTION_LEVEL_NONE;
 926                 }
 927         }
 928
 929         return status;
 930 }
 931
 932 /**
 933  * Initialize NEGO state machine.
 934  * @param nego
 935  */
 936
 937 void nego_init(rdpNego* nego)
 938 {
 939         nego->state = NEGO_STATE_INITIAL;
 940         nego->requested_protocols = PROTOCOL_RDP;
 941         nego->transport->ReceiveCallback = nego_recv;
 942         nego->transport->ReceiveExtra = (void*) nego;
 943         nego->cookie_max_length = DEFAULT_COOKIE_MAX_LENGTH;
 944         nego->sendNegoData = FALSE;
 945         nego->flags = 0;
 946 }
 947
 948 /**
 949  * Create a new NEGO state machine instance.
 950  * @param transport
 951  * @return
 952  */
 953
 954 rdpNego* nego_new(struct rdp_transport * transport)
 955 {
 956         rdpNego* nego = (rdpNego*) malloc(sizeof(rdpNego));
 957
 958         if (nego != NULL)
 959         {
 960                 ZeroMemory(nego, sizeof(rdpNego));
 961                 nego->transport = transport;
 962                 nego_init(nego);
 963         }
 964
 965         return nego;
 966 }
 967
 968 /**
 969  * Free NEGO state machine.
 970  * @param nego
 971  */
 972
 973 void nego_free(rdpNego* nego)
 974 {
 975         free(nego->cookie);
 976         free(nego);
 977 }
 978
 979 /**
 980  * Set target hostname and port.
 981  * @param nego
 982  * @param hostname
 983  * @param port
 984  */
 985
 986 void nego_set_target(rdpNego* nego, char* hostname, int port)
 987 {
 988         nego->hostname = hostname;
 989         nego->port = port;
 990 }
 991
 992 /**
 993  * Enable security layer negotiation.
 994  * @param nego pointer to the negotiation structure
 995  * @param enable_rdp whether to enable security layer negotiation (TRUE for enabled, FALSE for disabled)
 996  */
 997
 998 void nego_set_negotiation_enabled(rdpNego* nego, BOOL NegotiateSecurityLayer)
 999 {
1000         DEBUG_NEGO("Enabling security layer negotiation: %s", NegotiateSecurityLayer ? "TRUE" : "FALSE");
1001         nego->NegotiateSecurityLayer = NegotiateSecurityLayer;
1002 }
1003
1004 /**
1005  * Enable RDP security protocol.
1006  * @param nego pointer to the negotiation structure
1007  * @param enable_rdp whether to enable normal RDP protocol (TRUE for enabled, FALSE for disabled)
1008  */
1009
1010 void nego_enable_rdp(rdpNego* nego, BOOL enable_rdp)
1011 {
1012         DEBUG_NEGO("Enabling RDP security: %s", enable_rdp ? "TRUE" : "FALSE");
1013         nego->enabled_protocols[PROTOCOL_RDP] = enable_rdp;
1014 }
1015
1016 /**
1017  * Enable TLS security protocol.
1018  * @param nego pointer to the negotiation structure
1019  * @param enable_tls whether to enable TLS + RDP protocol (TRUE for enabled, FALSE for disabled)
1020  */
1021 void nego_enable_tls(rdpNego* nego, BOOL enable_tls)
1022 {
1023         DEBUG_NEGO("Enabling TLS security: %s", enable_tls ? "TRUE" : "FALSE");
1024         nego->enabled_protocols[PROTOCOL_TLS] = enable_tls;
1025 }
1026
1027
1028 /**
1029  * Enable NLA security protocol.
1030  * @param nego pointer to the negotiation structure
1031  * @param enable_nla whether to enable network level authentication protocol (TRUE for enabled, FALSE for disabled)
1032  */
1033
1034 void nego_enable_nla(rdpNego* nego, BOOL enable_nla)
1035 {
1036         DEBUG_NEGO("Enabling NLA security: %s", enable_nla ? "TRUE" : "FALSE");
1037         nego->enabled_protocols[PROTOCOL_NLA] = enable_nla;
1038 }
1039
1040 /**
1041  * Enable NLA extended security protocol.
1042  * @param nego pointer to the negotiation structure
1043  * @param enable_ext whether to enable network level authentication extended protocol (TRUE for enabled, FALSE for disabled)
1044  */
1045
1046 void nego_enable_ext(rdpNego* nego, BOOL enable_ext)
1047 {
1048         DEBUG_NEGO("Enabling NLA extended security: %s", enable_ext ? "TRUE" : "FALSE");
1049         nego->enabled_protocols[PROTOCOL_EXT] = enable_ext;
1050 }
1051
1052 /**
1053  * Set routing token.
1054  * @param nego
1055  * @param RoutingToken
1056  * @param RoutingTokenLength
1057  */
1058
1059 void nego_set_routing_token(rdpNego* nego, BYTE* RoutingToken, DWORD RoutingTokenLength)
1060 {
1061         nego->RoutingToken = RoutingToken;
1062         nego->RoutingTokenLength = RoutingTokenLength;
1063 }
1064
1065 /**
1066  * Set cookie.
1067  * @param nego
1068  * @param cookie
1069  */
1070
1071 void nego_set_cookie(rdpNego* nego, char* cookie)
1072 {
1073         if (nego->cookie)
1074                 free(nego->cookie);
1075
1076         nego->cookie = _strdup(cookie);
1077 }
1078
1079 /**
1080  * Set cookie maximum length
1081  * @param nego
1082  * @param cookie_max_length
1083  */
1084
1085 void nego_set_cookie_max_length(rdpNego* nego, UINT32 cookie_max_length)
1086 {
1087         nego->cookie_max_length = cookie_max_length;
1088 }
1089
1090 /**
1091  * Enable / disable preconnection PDU.
1092  * @param nego
1093  * @param send_pcpdu
1094  */
1095
1096 void nego_set_send_preconnection_pdu(rdpNego* nego, BOOL send_pcpdu)
1097 {
1098         nego->send_preconnection_pdu = send_pcpdu;
1099 }
1100
1101 /**
1102  * Set preconnection id.
1103  * @param nego
1104  * @param id
1105  */
1106
1107 void nego_set_preconnection_id(rdpNego* nego, UINT32 id)
1108 {
1109         nego->preconnection_id = id;
1110 }
1111
1112 /**
1113  * Set preconnection blob.
1114  * @param nego
1115  * @param blob
1116  */
1117
1118 void nego_set_preconnection_blob(rdpNego* nego, char* blob)
1119 {
1120         nego->preconnection_blob = blob;
1121 }