/* Input a string in Unicode * * Returns str_len of string */ int rdp_in_unistr(RDPCLIENT * This, STREAM s, wchar_t *string, int uni_len) { #ifdef HAVE_ICONV size_t ibl = uni_len, obl = uni_len; char *pin = (char *) s->p, *pout = string; static iconv_t iconv_h = (iconv_t) - 1; if (This->rdp.iconv_works) { if (iconv_h == (iconv_t) - 1) { if ((iconv_h = iconv_open(This->codepage, WINDOWS_CODEPAGE)) == (iconv_t) - 1) { warning("rdp_in_unistr: iconv_open[%s -> %s] fail %d\n", WINDOWS_CODEPAGE, This->codepage, (int) iconv_h); This->rdp.iconv_works = False; return rdp_in_unistr(This, s, string, uni_len); } } if (iconv(iconv_h, (ICONV_CONST char **) &pin, &ibl, &pout, &obl) == (size_t) - 1) { iconv_close(iconv_h); iconv_h = (iconv_t) - 1; warning("rdp_in_unistr: iconv fail, errno %d\n", errno); This->rdp.iconv_works = False; return rdp_in_unistr(This, s, string, uni_len); } /* we must update the location of the current STREAM for future reads of s->p */ s->p += uni_len; return pout - string; } else #endif // TODO { int i = 0; while (i < uni_len / 2) { in_uint8a(s, &string[i++], 1); in_uint8s(s, 1); } return i - 1; } }
/* Process redirect PDU from Session Directory */ static BOOL process_redirect_pdu(STREAM s /*, uint32 * ext_disc_reason */ ) { uint32 len; /* these 2 bytes are unknown, seem to be zeros */ in_uint8s(s, 2); /* read connection flags */ in_uint32_le(s, g_redirect_flags); /* read length of ip string */ in_uint32_le(s, len); /* read ip string */ rdp_in_unistr(s, g_redirect_server, len); /* read length of cookie string */ in_uint32_le(s, len); /* read cookie string (plain ASCII) */ in_uint8a(s, g_redirect_cookie, len); g_redirect_cookie[len] = 0; /* read length of username string */ in_uint32_le(s, len); /* read username string */ rdp_in_unistr(s, g_redirect_username, len); /* read length of domain string */ in_uint32_le(s, len); /* read domain string */ rdp_in_unistr(s, g_redirect_domain, len); /* read length of password string */ in_uint32_le(s, len); /* read password string */ rdp_in_unistr(s, g_redirect_password, len); g_redirect = True; return True; }
/* Input a string in Unicode * * Returns str_len of string */ void rdp_in_unistr(STREAM s, int in_len, char **string, uint32 * str_size) { /* Dynamic allocate of destination string if not provided */ *string = xmalloc(in_len * 2); *str_size = in_len * 2; #ifdef HAVE_ICONV size_t ibl = in_len, obl = *str_size - 1; char *pin = (char *) s->p, *pout = *string; static iconv_t iconv_h = (iconv_t) - 1; if (g_iconv_works) { if (iconv_h == (iconv_t) - 1) { if ((iconv_h = iconv_open(g_codepage, WINDOWS_CODEPAGE)) == (iconv_t) - 1) { warning("rdp_in_unistr: iconv_open[%s -> %s] fail %p\n", WINDOWS_CODEPAGE, g_codepage, iconv_h); g_iconv_works = False; return rdp_in_unistr(s, in_len, string, str_size); } } if (iconv(iconv_h, (ICONV_CONST char **) &pin, &ibl, &pout, &obl) == (size_t) - 1) { if (errno == E2BIG) { warning("server sent an unexpectedly long string, truncating\n"); } else { warning("rdp_in_unistr: iconv fail, errno %d\n", errno); free(*string); *string = NULL; *str_size = 0; } } /* we must update the location of the current STREAM for future reads of s->p */ s->p += in_len; *pout = 0; if (*string) *str_size = pout - *string; } else #endif { int i = 0; int rem = 0; uint32 len = in_len / 2; if (len > *str_size - 1) { warning("server sent an unexpectedly long string, truncating\n"); len = *str_size - 1; rem = in_len - 2 * len; } while (i < len) { in_uint8a(s, &string[i++], 1); in_uint8s(s, 1); } in_uint8s(s, rem); string[len] = 0; *str_size = len; } }
/* Process redirect PDU from Session Directory */ static RD_BOOL process_redirect_pdu(STREAM s, RD_BOOL enhanced_redirect /*, uint32 * ext_disc_reason */ ) { uint32 len; uint16 redirect_identifier; /* reset any previous redirection information */ g_redirect = True; free(g_redirect_server); free(g_redirect_username); free(g_redirect_domain); free(g_redirect_lb_info); free(g_redirect_cookie); g_redirect_server = NULL; g_redirect_username = NULL; g_redirect_domain = NULL; g_redirect_lb_info = NULL; g_redirect_cookie = NULL; /* these 2 bytes are unknown, seem to be zeros */ in_uint8s(s, 2); /* FIXME: Previous implementation only reads 4 bytes which has been working but todays spec says something different. Investigate and retest server redirection using WTS 2003 cluster. */ if (enhanced_redirect) { /* read identifier */ in_uint16_le(s, redirect_identifier); if (redirect_identifier != 0x0400) error("Protocol error in server redirection, unexpected data."); /* FIXME: skip total length */ in_uint8s(s, 2); /* read session_id */ in_uint32_le(s, g_redirect_session_id); } /* read connection flags */ in_uint32_le(s, g_redirect_flags); if (g_redirect_flags & PDU_REDIRECT_HAS_IP) { /* read length of ip string */ in_uint32_le(s, len); /* read ip string */ rdp_in_unistr(s, len, &g_redirect_server, &g_redirect_server_len); } if (g_redirect_flags & PDU_REDIRECT_HAS_LOAD_BALANCE_INFO) { /* read length of load balance info blob */ in_uint32_le(s, g_redirect_lb_info_len); /* reallocate a loadbalance info blob */ if (g_redirect_lb_info != NULL) free(g_redirect_lb_info); g_redirect_lb_info = xmalloc(g_redirect_lb_info_len); /* read load balance info blob */ in_uint8p(s, g_redirect_lb_info, g_redirect_lb_info_len); } if (g_redirect_flags & PDU_REDIRECT_HAS_USERNAME) { /* read length of username string */ in_uint32_le(s, len); /* read username string */ rdp_in_unistr(s, len, &g_redirect_username, &g_redirect_username_len); } if (g_redirect_flags & PDU_REDIRECT_HAS_DOMAIN) { /* read length of domain string */ in_uint32_le(s, len); /* read domain string */ rdp_in_unistr(s, len, &g_redirect_domain, &g_redirect_domain_len); } if (g_redirect_flags & PDU_REDIRECT_HAS_PASSWORD) { /* the information in this blob is either a password or a cookie that should be passed though as blob and not parsed as a unicode string */ /* read blob length */ in_uint32_le(s, g_redirect_cookie_len); /* reallocate cookie blob */ if (g_redirect_cookie != NULL) free(g_redirect_cookie); g_redirect_cookie = xmalloc(g_redirect_cookie_len); /* read cookie as is */ in_uint8p(s, g_redirect_cookie, g_redirect_cookie_len); } if (g_redirect_flags & PDU_REDIRECT_DONT_STORE_USERNAME) { warning("PDU_REDIRECT_DONT_STORE_USERNAME set\n"); } if (g_redirect_flags & PDU_REDIRECT_USE_SMARTCARD) { warning("PDU_REDIRECT_USE_SMARTCARD set\n"); } if (g_redirect_flags & PDU_REDIRECT_INFORMATIONAL) { /* By spec this is only for information and doesn't mean that an actual redirect should be performed. How it should be used is not mentioned. */ g_redirect = False; } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_FQDN) { in_uint32_le(s, len); /* Let target fqdn replace target ip address */ if (g_redirect_server) { free(g_redirect_server); g_redirect_server = NULL; } /* read fqdn string */ rdp_in_unistr(s, len, &g_redirect_server, &g_redirect_server_len); } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_NETBIOS) { warning("PDU_REDIRECT_HAS_TARGET_NETBIOS set\n"); } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_IP_ARRAY) { warning("PDU_REDIRECT_HAS_TARGET_IP_ARRAY set\n"); } return True; }
int APP_CC in_unistr(struct stream* s, char *string, int str_size, int in_len) { #ifdef HAVE_ICONV size_t ibl = in_len, obl = str_size - 1; char *pin = (char *) s->p, *pout = string; static iconv_t iconv_h = (iconv_t) - 1; if (g_iconv_works) { if (iconv_h == (iconv_t) - 1) { if ((iconv_h = iconv_open(g_codepage, WINDOWS_CODEPAGE)) == (iconv_t) - 1) { log_message(&log_conf, LOG_LEVEL_WARNING, "chansrv[rdp_in_unistr]: iconv_open[%s -> %s] fail %p", WINDOWS_CODEPAGE, g_codepage, iconv_h); g_iconv_works = False; return rdp_in_unistr(s, string, str_size, in_len); } } if (iconv(iconv_h, (ICONV_CONST char **) &pin, &ibl, &pout, &obl) == (size_t) - 1) { if (errno == E2BIG) { log_message(&log_conf, LOG_LEVEL_WARNING, "chansrv[rdp_in_unistr]: " "server sent an unexpectedly long string, truncating"); } else { iconv_close(iconv_h); iconv_h = (iconv_t) - 1; log_message(&log_conf, LOG_LEVEL_WARNING, "chansrv[rdp_in_unistr]: " "iconv fail, errno %d\n", errno); g_iconv_works = False; return rdp_in_unistr(s, string, str_size, in_len); } } /* we must update the location of the current STREAM for future reads of s->p */ s->p += in_len; *pout = 0; return pout - string; } else #endif { int i = 0; int len = in_len / 2; int rem = 0; if (len > str_size - 1) { log_message(&log_conf, LOG_LEVEL_WARNING, "chansrv[rdp_in_unistr]: " "server sent an unexpectedly long string, truncating"); len = str_size - 1; rem = in_len - 2 * len; } while (i < len) { in_uint8a(s, &string[i++], 1); in_uint8s(s, 1); } in_uint8s(s, rem); string[len] = 0; return len; } }
void printercache_process(STREAM s) { uint32 type, printer_length, driver_length, printer_unicode_length, blob_length; char device_name[9], printer[256], driver[256]; in_uint32_le(s, type); switch (type) { case 4: /* rename item */ in_uint8(s, printer_length); in_uint8s(s, 0x3); /* padding */ in_uint8(s, driver_length); in_uint8s(s, 0x3); /* padding */ /* NOTE - 'driver' doesn't contain driver, it contains the new printer name */ rdp_in_unistr(s, printer, sizeof(printer), printer_length); rdp_in_unistr(s, driver, sizeof(driver), driver_length); printercache_rename_blob(printer, driver); break; case 3: /* delete item */ in_uint8(s, printer_unicode_length); in_uint8s(s, 0x3); /* padding */ rdp_in_unistr(s, printer, sizeof(printer), printer_unicode_length); printercache_unlink_blob(printer); break; case 2: /* save printer data */ in_uint32_le(s, printer_unicode_length); in_uint32_le(s, blob_length); if (printer_unicode_length < 2 * 255) { rdp_in_unistr(s, printer, sizeof(printer), printer_unicode_length); printercache_save_blob(printer, s->p, blob_length); } break; case 1: /* save device data */ in_uint8a(s, device_name, 5); /* get LPTx/COMx name */ /* need to fetch this data so that we can get the length of the packet to store. */ in_uint8s(s, 0x2); /* ??? */ in_uint8s(s, 0x2) /* pad?? */ in_uint32_be(s, driver_length); in_uint32_be(s, printer_length); in_uint8s(s, 0x7) /* pad?? */ /* next is driver in unicode */ /* next is printer in unicode */ /* TODO: figure out how to use this information when reconnecting */ /* actually - all we need to store is the driver and printer */ /* and figure out what the first word is. */ /* rewind stream so that we can save this blob */ /* length is driver_length + printer_length + 19 */ /* rewind stream */ s->p = s->p - 19; printercache_save_blob(device_name, s->p, driver_length + printer_length + 19); break; default: unimpl("RDPDR Printer Cache Packet Type: %d\n", type); break; } }
static void rdpdr_process_irp(RDPCLIENT * This, STREAM s) { uint32 result = 0, length = 0, desired_access = 0, request, file, info_level, buffer_len, id, major, minor, device, offset, bytes_in, bytes_out, error_mode, share_mode, disposition, total_timeout, interval_timeout, flags_and_attributes = 0; char filename[PATH_MAX]; uint8 *buffer, *pst_buf; struct stream out; DEVICE_FNS *fns; BOOL rw_blocking = True; NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST; in_uint32_le(s, device); in_uint32_le(s, file); in_uint32_le(s, id); in_uint32_le(s, major); in_uint32_le(s, minor); buffer_len = 0; buffer = (uint8 *) xmalloc(1024); buffer[0] = 0; switch (This->rdpdr_device[device].device_type) { case DEVICE_TYPE_SERIAL: fns = &serial_fns; rw_blocking = False; break; case DEVICE_TYPE_PARALLEL: fns = ¶llel_fns; rw_blocking = False; break; case DEVICE_TYPE_PRINTER: fns = &printer_fns; break; case DEVICE_TYPE_DISK: fns = &disk_fns; rw_blocking = False; break; case DEVICE_TYPE_SCARD: default: error("IRP for bad device %ld\n", device); return; } switch (major) { case IRP_MJ_CREATE: in_uint32_be(s, desired_access); in_uint8s(s, 0x08); /* unknown */ in_uint32_le(s, error_mode); in_uint32_le(s, share_mode); in_uint32_le(s, disposition); in_uint32_le(s, flags_and_attributes); in_uint32_le(s, length); if (length && (length / 2) < 256) { rdp_in_unistr(This, s, filename, length); convert_to_unix_filename(filename); } else { filename[0] = 0; } if (!fns->create) { status = STATUS_NOT_SUPPORTED; break; } status = fns->create(This, device, desired_access, share_mode, disposition, flags_and_attributes, filename, &result); buffer_len = 1; break; case IRP_MJ_CLOSE: if (!fns->close) { status = STATUS_NOT_SUPPORTED; break; } status = fns->close(This, file); break; case IRP_MJ_READ: if (!fns->read) { status = STATUS_NOT_SUPPORTED; break; } in_uint32_le(s, length); in_uint32_le(s, offset); #if WITH_DEBUG_RDP5 DEBUG(("RDPDR IRP Read (length: %d, offset: %d)\n", length, offset)); #endif if (!rdpdr_handle_ok(This, device, file)) { status = STATUS_INVALID_HANDLE; break; } if (rw_blocking) /* Complete read immediately */ { buffer = (uint8 *) xrealloc((void *) buffer, length); if (!buffer) { status = STATUS_CANCELLED; break; } status = fns->read(This, file, buffer, length, offset, &result); buffer_len = result; break; } /* Add request to table */ pst_buf = (uint8 *) xmalloc(length); if (!pst_buf) { status = STATUS_CANCELLED; break; } serial_get_timeout(This, file, length, &total_timeout, &interval_timeout); if (add_async_iorequest (This, device, file, id, major, length, fns, total_timeout, interval_timeout, pst_buf, offset)) { status = STATUS_PENDING; break; } status = STATUS_CANCELLED; break; case IRP_MJ_WRITE: buffer_len = 1; if (!fns->write) { status = STATUS_NOT_SUPPORTED; break; } in_uint32_le(s, length); in_uint32_le(s, offset); in_uint8s(s, 0x18); #if WITH_DEBUG_RDP5 DEBUG(("RDPDR IRP Write (length: %d)\n", result)); #endif if (!rdpdr_handle_ok(This, device, file)) { status = STATUS_INVALID_HANDLE; break; } if (rw_blocking) /* Complete immediately */ { status = fns->write(This, file, s->p, length, offset, &result); break; } /* Add to table */ pst_buf = (uint8 *) xmalloc(length); if (!pst_buf) { status = STATUS_CANCELLED; break; } in_uint8a(s, pst_buf, length); if (add_async_iorequest (This, device, file, id, major, length, fns, 0, 0, pst_buf, offset)) { status = STATUS_PENDING; break; } status = STATUS_CANCELLED; break; case IRP_MJ_QUERY_INFORMATION: if (This->rdpdr_device[device].device_type != DEVICE_TYPE_DISK) { status = STATUS_INVALID_HANDLE; break; } in_uint32_le(s, info_level); out.data = out.p = buffer; out.size = sizeof(buffer); status = disk_query_information(This, file, info_level, &out); result = buffer_len = out.p - out.data; break; case IRP_MJ_SET_INFORMATION: if (This->rdpdr_device[device].device_type != DEVICE_TYPE_DISK) { status = STATUS_INVALID_HANDLE; break; } in_uint32_le(s, info_level); out.data = out.p = buffer; out.size = sizeof(buffer); status = disk_set_information(This, file, info_level, s, &out); result = buffer_len = out.p - out.data; break; case IRP_MJ_QUERY_VOLUME_INFORMATION: if (This->rdpdr_device[device].device_type != DEVICE_TYPE_DISK) { status = STATUS_INVALID_HANDLE; break; } in_uint32_le(s, info_level); out.data = out.p = buffer; out.size = sizeof(buffer); status = disk_query_volume_information(This, file, info_level, &out); result = buffer_len = out.p - out.data; break; case IRP_MJ_DIRECTORY_CONTROL: if (This->rdpdr_device[device].device_type != DEVICE_TYPE_DISK) { status = STATUS_INVALID_HANDLE; break; } switch (minor) { case IRP_MN_QUERY_DIRECTORY: in_uint32_le(s, info_level); in_uint8s(s, 1); in_uint32_le(s, length); in_uint8s(s, 0x17); if (length && length < 2 * 255) { rdp_in_unistr(This, s, filename, length); convert_to_unix_filename(filename); } else { filename[0] = 0; } out.data = out.p = buffer; out.size = sizeof(buffer); status = disk_query_directory(This, file, info_level, filename, &out); result = buffer_len = out.p - out.data; if (!buffer_len) buffer_len++; break; case IRP_MN_NOTIFY_CHANGE_DIRECTORY: /* JIF unimpl("IRP major=0x%x minor=0x%x: IRP_MN_NOTIFY_CHANGE_DIRECTORY\n", major, minor); */ in_uint32_le(s, info_level); /* notify mask */ This->notify_stamp = True; status = disk_create_notify(This, file, info_level); result = 0; if (status == STATUS_PENDING) add_async_iorequest(This, device, file, id, major, length, fns, 0, 0, NULL, 0); break; default: status = STATUS_INVALID_PARAMETER; /* JIF */ unimpl("IRP major=0x%x minor=0x%x\n", major, minor); } break; case IRP_MJ_DEVICE_CONTROL: if (!fns->device_control) { status = STATUS_NOT_SUPPORTED; break; } in_uint32_le(s, bytes_out); in_uint32_le(s, bytes_in); in_uint32_le(s, request); in_uint8s(s, 0x14); buffer = (uint8 *) xrealloc((void *) buffer, bytes_out + 0x14); if (!buffer) { status = STATUS_CANCELLED; break; } out.data = out.p = buffer; out.size = sizeof(buffer); status = fns->device_control(This, file, request, s, &out); result = buffer_len = out.p - out.data; /* Serial SERIAL_WAIT_ON_MASK */ if (status == STATUS_PENDING) { if (add_async_iorequest (This, device, file, id, major, length, fns, 0, 0, NULL, 0)) { status = STATUS_PENDING; break; } } break; case IRP_MJ_LOCK_CONTROL: if (This->rdpdr_device[device].device_type != DEVICE_TYPE_DISK) { status = STATUS_INVALID_HANDLE; break; } in_uint32_le(s, info_level); out.data = out.p = buffer; out.size = sizeof(buffer); /* FIXME: Perhaps consider actually *do* something here :-) */ status = STATUS_SUCCESS; result = buffer_len = out.p - out.data; break; default: unimpl("IRP major=0x%x minor=0x%x\n", major, minor); break; } if (status != STATUS_PENDING) { rdpdr_send_completion(This, device, id, status, result, buffer, buffer_len); } if (buffer) xfree(buffer); buffer = NULL; }
/* Process redirect PDU from Session Directory */ static RD_BOOL process_redirect_pdu(STREAM s /*, uint32 * ext_disc_reason */ ) { uint32 len; /* these 2 bytes are unknown, seem to be zeros */ in_uint8s(s, 2); /* read connection flags */ in_uint32_le(s, g_redirect_flags); if (g_redirect_flags & PDU_REDIRECT_HAS_IP) { /* read length of ip string */ in_uint32_le(s, len); /* read ip string */ rdp_in_unistr(s, g_redirect_server, sizeof(g_redirect_server), len); } if (g_redirect_flags & PDU_REDIRECT_HAS_COOKIE) { /* read length of cookie string */ in_uint32_le(s, len); /* read cookie string (plain ASCII) */ if (len > sizeof(g_redirect_cookie) - 1) { uint32 rem = len - (sizeof(g_redirect_cookie) - 1); len = sizeof(g_redirect_cookie) - 1; warning("Unexpectedly large redirection cookie\n"); in_uint8a(s, g_redirect_cookie, len); in_uint8s(s, rem); } else { in_uint8a(s, g_redirect_cookie, len); } g_redirect_cookie[len] = 0; } if (g_redirect_flags & PDU_REDIRECT_HAS_USERNAME) { /* read length of username string */ in_uint32_le(s, len); /* read username string */ g_redirect_username = (char *) xmalloc(len + 1); rdp_in_unistr(s, g_redirect_username, len + 1, len); } if (g_redirect_flags & PDU_REDIRECT_HAS_DOMAIN) { /* read length of domain string */ in_uint32_le(s, len); /* read domain string */ rdp_in_unistr(s, g_redirect_domain, sizeof(g_redirect_domain), len); } if (g_redirect_flags & PDU_REDIRECT_HAS_PASSWORD) { /* read length of password string */ in_uint32_le(s, len); /* read password string */ rdp_in_unistr(s, g_redirect_password, sizeof(g_redirect_password), len); } if (g_redirect_flags & PDU_REDIRECT_DONT_STORE_USERNAME) { warning("PDU_REDIRECT_DONT_STORE_USERNAME set\n"); } if (g_redirect_flags & PDU_REDIRECT_USE_SMARTCARD) { warning("PDU_REDIRECT_USE_SMARTCARD set\n"); } if (g_redirect_flags & PDU_REDIRECT_INFORMATIONAL) { warning("PDU_REDIRECT_INFORMATIONAL set\n"); } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_FQDN) { warning("PDU_REDIRECT_HAS_TARGET_FQDN set\n"); } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_NETBIOS) { warning("PDU_REDIRECT_HAS_TARGET_NETBIOS set\n"); } if (g_redirect_flags & PDU_REDIRECT_HAS_TARGET_IP_ARRAY) { warning("PDU_REDIRECT_HAS_TARGET_IP_ARRAY set\n"); } g_redirect = True; return True; }