/*

 * FreeRDP: A Remote Desktop Protocol Implementation

 * RDP Licensing

 *

 * Copyright 2011-2013 Marc-Andre Moreau <marcandre.moreau@gmail.com>

 * Copyright 2014 Norbert Federa <norbert.federa@thincast.com>

 * Copyright 2018 David Fort <contact@hardening-consulting.com>

 * Copyright 2022,2023 Armin Novak <armin.novak@thincast.com>

 * Copyright 2022,2023 Thincast Technologies GmbH

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include <freerdp/config.h>

#include "settings.h"

#include <freerdp/license.h>

#include <winpr/crt.h>

#include <winpr/assert.h>

#include <winpr/crypto.h>

#include <winpr/shell.h>

#include <winpr/path.h>

#include <winpr/file.h>

#include <freerdp/log.h>

#include <freerdp/crypto/certificate.h>

#include "license.h"

#include "../crypto/crypto.h"

#include "../crypto/certificate.h"

#define LICENSE_TAG FREERDP_TAG("core.license")

// #define LICENSE_NULL_CLIENT_RANDOM 1

// #define LICENSE_NULL_PREMASTER_SECRET 1

// #define WITH_LICENSE_DECRYPT_CHALLENGE_RESPONSE

#define PLATFORM_CHALLENGE_RESPONSE_VERSION 0x0100

/** @brief Licensing Packet Types */

enum LicenseRequestType

{

  LICENSE_REQUEST = 0x01,

  PLATFORM_CHALLENGE = 0x02,

  NEW_LICENSE = 0x03,

  UPGRADE_LICENSE = 0x04,

  LICENSE_INFO = 0x12,

  NEW_LICENSE_REQUEST = 0x13,

  PLATFORM_CHALLENGE_RESPONSE = 0x15,

  ERROR_ALERT = 0xFF

};

/*

#define LICENSE_PKT_CS_MASK \

    (LICENSE_INFO | NEW_LICENSE_REQUEST | PLATFORM_CHALLENGE_RESPONSE | ERROR_ALERT)

#define LICENSE_PKT_SC_MASK \

    (LICENSE_REQUEST | PLATFORM_CHALLENGE | NEW_LICENSE | UPGRADE_LICENSE | ERROR_ALERT)

#define LICENSE_PKT_MASK (LICENSE_PKT_CS_MASK | LICENSE_PKT_SC_MASK)

*/

#define LICENSE_PREAMBLE_LENGTH 4

/* Cryptographic Lengths */

#define SERVER_RANDOM_LENGTH 32

#define MASTER_SECRET_LENGTH 48

#define PREMASTER_SECRET_LENGTH 48

#define SESSION_KEY_BLOB_LENGTH 48

#define MAC_SALT_KEY_LENGTH 16

#define LICENSING_ENCRYPTION_KEY_LENGTH 16

#define HWID_PLATFORM_ID_LENGTH 4

// #define HWID_UNIQUE_DATA_LENGTH 16

#define HWID_LENGTH 20

// #define LICENSING_PADDING_SIZE 8

/* Preamble Flags */

// #define PREAMBLE_VERSION_2_0 0x02

#define PREAMBLE_VERSION_3_0 0x03

// #define LicenseProtocolVersionMask 0x0F

#define EXTENDED_ERROR_MSG_SUPPORTED 0x80

/** @brief binary Blob Types */

enum

{

  BB_ANY_BLOB = 0x0000,

  BB_DATA_BLOB = 0x0001,

  BB_RANDOM_BLOB = 0x0002,

  BB_CERTIFICATE_BLOB = 0x0003,

  BB_ERROR_BLOB = 0x0004,

  BB_ENCRYPTED_DATA_BLOB = 0x0009,

  BB_KEY_EXCHG_ALG_BLOB = 0x000D,

  BB_SCOPE_BLOB = 0x000E,

  BB_CLIENT_USER_NAME_BLOB = 0x000F,

  BB_CLIENT_MACHINE_NAME_BLOB = 0x0010

};

/* License Key Exchange Algorithms */

#define KEY_EXCHANGE_ALG_RSA 0x00000001

/** @brief license Error Codes

 */

enum

{

  ERR_INVALID_SERVER_CERTIFICATE = 0x00000001,

  ERR_NO_LICENSE = 0x00000002,

  ERR_INVALID_MAC = 0x00000003,

  ERR_INVALID_SCOPE = 0x00000004,

  ERR_NO_LICENSE_SERVER = 0x00000006,

  STATUS_VALID_CLIENT = 0x00000007,

  ERR_INVALID_CLIENT = 0x00000008,

  ERR_INVALID_PRODUCT_ID = 0x0000000B,

  ERR_INVALID_MESSAGE_LENGTH = 0x0000000C

};

/** @brief state Transition Codes

 */

enum

{

  ST_TOTAL_ABORT = 0x00000001,

  ST_NO_TRANSITION = 0x00000002,

  ST_RESET_PHASE_TO_START = 0x00000003,

  ST_RESEND_LAST_MESSAGE = 0x00000004

};

/** @brief Platform Challenge Types

 */

enum

{

  WIN32_PLATFORM_CHALLENGE_TYPE = 0x0100,

  WIN16_PLATFORM_CHALLENGE_TYPE = 0x0200,

  WINCE_PLATFORM_CHALLENGE_TYPE = 0x0300,

  OTHER_PLATFORM_CHALLENGE_TYPE = 0xFF00

};

/** @brief License Detail Levels

 */

enum

{

  LICENSE_DETAIL_SIMPLE = 0x0001,

  LICENSE_DETAIL_MODERATE = 0x0002,

  LICENSE_DETAIL_DETAIL = 0x0003

};

/*

 * PlatformId:

 *

 * The most significant byte of the PlatformId field contains the operating system version of the

 * client. The second most significant byte of the PlatformId field identifies the ISV that provided

 * the client image. The remaining two bytes in the PlatformId field are used by the ISV to identify

 * the build number of the operating system.

 *

 * 0x04010000:

 *

 * CLIENT_OS_ID_WINNT_POST_52 (0x04000000)

 * CLIENT_IMAGE_ID_MICROSOFT  (0x00010000)

 */

enum

{

  CLIENT_OS_ID_WINNT_351 = 0x01000000,

  CLIENT_OS_ID_WINNT_40 = 0x02000000,

  CLIENT_OS_ID_WINNT_50 = 0x03000000,

  CLIENT_OS_ID_WINNT_POST_52 = 0x04000000,

  CLIENT_IMAGE_ID_MICROSOFT = 0x00010000,

  CLIENT_IMAGE_ID_CITRIX = 0x00020000,

};

struct rdp_license

{

  LICENSE_STATE state;

  LICENSE_TYPE type;

  rdpRdp* rdp;

  rdpCertificate* certificate;

  BYTE HardwareId[HWID_LENGTH];

  BYTE ClientRandom[CLIENT_RANDOM_LENGTH];

  BYTE ServerRandom[SERVER_RANDOM_LENGTH];

  BYTE MasterSecret[MASTER_SECRET_LENGTH];

  BYTE PremasterSecret[PREMASTER_SECRET_LENGTH];

  BYTE SessionKeyBlob[SESSION_KEY_BLOB_LENGTH];

  BYTE MacSaltKey[MAC_SALT_KEY_LENGTH];

  BYTE LicensingEncryptionKey[LICENSING_ENCRYPTION_KEY_LENGTH];

  LICENSE_PRODUCT_INFO* ProductInfo;

  LICENSE_BLOB* ErrorInfo;

  LICENSE_BLOB* LicenseInfo; /* Client -> Server */

  LICENSE_BLOB* KeyExchangeList;

  LICENSE_BLOB* ServerCertificate;

  LICENSE_BLOB* ClientUserName;

  LICENSE_BLOB* ClientMachineName;

  LICENSE_BLOB* PlatformChallenge;

  LICENSE_BLOB* PlatformChallengeResponse;

  LICENSE_BLOB* EncryptedPremasterSecret;

  LICENSE_BLOB* EncryptedPlatformChallenge;

  LICENSE_BLOB* EncryptedPlatformChallengeResponse;

  LICENSE_BLOB* EncryptedHardwareId;

  LICENSE_BLOB* EncryptedLicenseInfo;

  BYTE MACData[LICENSING_ENCRYPTION_KEY_LENGTH];

  SCOPE_LIST* ScopeList;

  UINT32 PacketHeaderLength;

  UINT32 PreferredKeyExchangeAlg;

  UINT32 PlatformId;

  UINT16 ClientType;

  UINT16 LicenseDetailLevel;

  BOOL update;

  wLog* log;

};

static BOOL license_send_error_alert(rdpLicense* license, UINT32 dwErrorCode,

                                     UINT32 dwStateTransition, const LICENSE_BLOB* info);

static BOOL license_set_state(rdpLicense* license, LICENSE_STATE state);

static const char* license_get_state_string(LICENSE_STATE state);

static const char* license_preferred_key_exchange_alg_string(UINT32 alg, char* buffer, size_t size)

{

  const char* name = NULL;

  switch (alg)

  {

    case KEY_EXCHANGE_ALG_RSA:

      name = "KEY_EXCHANGE_ALG_RSA";

      break;

    default:

      name = "KEY_EXCHANGE_ALG_UNKNOWN";

      break;

  }

  (void)_snprintf(buffer, size, "%s [0x%08" PRIx32 "]", name, alg);

  return buffer;

}

static const char* license_request_type_string(UINT32 type)

{

  switch (type)

  {

    case LICENSE_REQUEST:

      return "LICENSE_REQUEST";

    case PLATFORM_CHALLENGE:

      return "PLATFORM_CHALLENGE";

    case NEW_LICENSE:

      return "NEW_LICENSE";

    case UPGRADE_LICENSE:

      return "UPGRADE_LICENSE";

    case LICENSE_INFO:

      return "LICENSE_INFO";

    case NEW_LICENSE_REQUEST:

      return "NEW_LICENSE_REQUEST";

    case PLATFORM_CHALLENGE_RESPONSE:

      return "PLATFORM_CHALLENGE_RESPONSE";

    case ERROR_ALERT:

      return "ERROR_ALERT";

    default:

      return "LICENSE_REQUEST_TYPE_UNKNOWN";

  }

}

static const char* licencse_blob_type_string(UINT16 type)

{

  switch (type)

  {

    case BB_ANY_BLOB:

      return "BB_ANY_BLOB";

    case BB_DATA_BLOB:

      return "BB_DATA_BLOB";

    case BB_RANDOM_BLOB:

      return "BB_RANDOM_BLOB";

    case BB_CERTIFICATE_BLOB:

      return "BB_CERTIFICATE_BLOB";

    case BB_ERROR_BLOB:

      return "BB_ERROR_BLOB";

    case BB_ENCRYPTED_DATA_BLOB:

      return "BB_ENCRYPTED_DATA_BLOB";

    case BB_KEY_EXCHG_ALG_BLOB:

      return "BB_KEY_EXCHG_ALG_BLOB";

    case BB_SCOPE_BLOB:

      return "BB_SCOPE_BLOB";

    case BB_CLIENT_USER_NAME_BLOB:

      return "BB_CLIENT_USER_NAME_BLOB";

    case BB_CLIENT_MACHINE_NAME_BLOB:

      return "BB_CLIENT_MACHINE_NAME_BLOB";

    default:

      return "BB_UNKNOWN";

  }

}

static wStream* license_send_stream_init(rdpLicense* license, UINT16* sec_flags);

static void license_generate_randoms(rdpLicense* license);

static BOOL license_generate_keys(rdpLicense* license);

static BOOL license_generate_hwid(rdpLicense* license);

static BOOL license_encrypt_premaster_secret(rdpLicense* license);

static LICENSE_PRODUCT_INFO* license_new_product_info(void);

static void license_free_product_info(LICENSE_PRODUCT_INFO* productInfo);

static BOOL license_read_product_info(wLog* log, wStream* s, LICENSE_PRODUCT_INFO* productInfo);

static LICENSE_BLOB* license_new_binary_blob(UINT16 type);

static void license_free_binary_blob(LICENSE_BLOB* blob);

static BOOL license_read_binary_blob_data(wLog* log, LICENSE_BLOB* blob, UINT16 type,

                                          const void* data, size_t length);

static BOOL license_read_binary_blob(wLog* log, wStream* s, LICENSE_BLOB* blob);

static BOOL license_write_binary_blob(wStream* s, const LICENSE_BLOB* blob);

static SCOPE_LIST* license_new_scope_list(void);

static BOOL license_scope_list_resize(SCOPE_LIST* scopeList, UINT32 count);

static void license_free_scope_list(SCOPE_LIST* scopeList);

static BOOL license_read_scope_list(wLog* log, wStream* s, SCOPE_LIST* scopeList);

static BOOL license_write_scope_list(wLog* log, wStream* s, const SCOPE_LIST* scopeList);

static BOOL license_read_license_request_packet(rdpLicense* license, wStream* s);

static BOOL license_write_license_request_packet(const rdpLicense* license, wStream* s);

static BOOL license_read_platform_challenge_packet(rdpLicense* license, wStream* s);

static BOOL license_send_platform_challenge_packet(rdpLicense* license);

static BOOL license_read_new_or_upgrade_license_packet(rdpLicense* license, wStream* s);

static BOOL license_read_error_alert_packet(rdpLicense* license, wStream* s);

static BOOL license_write_new_license_request_packet(const rdpLicense* license, wStream* s);

static BOOL license_read_new_license_request_packet(rdpLicense* license, wStream* s);

static BOOL license_answer_license_request(rdpLicense* license);

static BOOL license_send_platform_challenge_response(rdpLicense* license);

static BOOL license_read_platform_challenge_response(rdpLicense* license);

static BOOL license_read_client_platform_challenge_response(rdpLicense* license, wStream* s);

static BOOL license_write_client_platform_challenge_response(rdpLicense* license, wStream* s);

static BOOL license_write_server_upgrade_license(const rdpLicense* license, wStream* s);

static BOOL license_send_license_info(rdpLicense* license, const LICENSE_BLOB* calBlob,

                                      const BYTE* signature, size_t signature_length);

static BOOL license_read_license_info(rdpLicense* license, wStream* s);

static state_run_t license_client_recv(rdpLicense* license, wStream* s);

static state_run_t license_server_recv(rdpLicense* license, wStream* s);

#define PLATFORMID (CLIENT_OS_ID_WINNT_POST_52 | CLIENT_IMAGE_ID_MICROSOFT)

#ifdef WITH_DEBUG_LICENSE

static const char* error_codes[] = { "ERR_UNKNOWN",

                                   "ERR_INVALID_SERVER_CERTIFICATE",

                                   "ERR_NO_LICENSE",

                                   "ERR_INVALID_MAC",

                                   "ERR_INVALID_SCOPE",

                                   "ERR_UNKNOWN",

                                   "ERR_NO_LICENSE_SERVER",

                                   "STATUS_VALID_CLIENT",

                                   "ERR_INVALID_CLIENT",

                                   "ERR_UNKNOWN",

                                   "ERR_UNKNOWN",

                                   "ERR_INVALID_PRODUCT_ID",

                                   "ERR_INVALID_MESSAGE_LENGTH" };

static const char* state_transitions[] = { "ST_UNKNOWN", "ST_TOTAL_ABORT", "ST_NO_TRANSITION",

                                         "ST_RESET_PHASE_TO_START", "ST_RESEND_LAST_MESSAGE" };

static void license_print_product_info(wLog* log, const LICENSE_PRODUCT_INFO* productInfo)

{

  char* CompanyName = NULL;

  char* ProductId = NULL;

  WINPR_ASSERT(productInfo);

  WINPR_ASSERT(productInfo->pbCompanyName);

  WINPR_ASSERT(productInfo->pbProductId);

  CompanyName = ConvertWCharNToUtf8Alloc((const WCHAR*)productInfo->pbCompanyName,

                                         productInfo->cbCompanyName / sizeof(WCHAR), NULL);

  ProductId = ConvertWCharNToUtf8Alloc((const WCHAR*)productInfo->pbProductId,

                                       productInfo->cbProductId / sizeof(WCHAR), NULL);

  WLog_Print(log, WLOG_INFO, "ProductInfo:");

  WLog_Print(log, WLOG_INFO, "\tdwVersion: 0x%08" PRIX32 "", productInfo->dwVersion);

  WLog_Print(log, WLOG_INFO, "\tCompanyName: %s", CompanyName);

  WLog_Print(log, WLOG_INFO, "\tProductId: %s", ProductId);

  free(CompanyName);

  free(ProductId);

}

static void license_print_scope_list(wLog* log, const SCOPE_LIST* scopeList)

{

  WINPR_ASSERT(scopeList);

  WLog_Print(log, WLOG_INFO, "ScopeList (%" PRIu32 "):", scopeList->count);

  for (UINT32 index = 0; index < scopeList->count; index++)

  {

    const LICENSE_BLOB* scope = NULL;

    WINPR_ASSERT(scopeList->array);

    scope = scopeList->array[index];

    WINPR_ASSERT(scope);

    WLog_Print(log, WLOG_INFO, "\t%s", (const char*)scope->data);

  }

}

#endif

static const char licenseStore[] = "licenses";

static BOOL license_ensure_state(rdpLicense* license, LICENSE_STATE state, UINT32 msg)

{

  const LICENSE_STATE cstate = license_get_state(license);

  WINPR_ASSERT(license);

  if (cstate != state)

  {

    const char* scstate = license_get_state_string(cstate);

    const char* sstate = license_get_state_string(state);

    const char* where = license_request_type_string(msg);

    WLog_Print(license->log, WLOG_WARN,

               "Received [%s], but found invalid licensing state %s, expected %s", where,

               scstate, sstate);

    return FALSE;

  }

  return TRUE;

}

state_run_t license_recv(rdpLicense* license, wStream* s)

{

  WINPR_ASSERT(license);

  WINPR_ASSERT(license->rdp);

  WINPR_ASSERT(license->rdp->settings);

  if (freerdp_settings_get_bool(license->rdp->settings, FreeRDP_ServerMode))

    return license_server_recv(license, s);

  else

    return license_client_recv(license, s);

}

static BOOL license_check_stream_length(wLog* log, wStream* s, SSIZE_T expect, const char* where)

{

  const size_t remain = Stream_GetRemainingLength(s);

  WINPR_ASSERT(where);

  if (expect < 0)

  {

    WLog_Print(log, WLOG_WARN, "invalid %s, expected value %" PRIdz " invalid", where, expect);

    return FALSE;

  }

  if (remain < (size_t)expect)

  {

    WLog_Print(log, WLOG_WARN, "short %s, expected %" PRIdz " bytes, got %" PRIuz, where,

               expect, remain);

    return FALSE;

  }

  return TRUE;

}

static BOOL license_check_stream_capacity(wLog* log, wStream* s, size_t expect, const char* where)

{

  WINPR_ASSERT(where);

  if (!Stream_CheckAndLogRequiredCapacityWLogEx(log, WLOG_WARN, s, expect, 1,

                                                "%s(%s:%" PRIuz ") %s", __func__, __FILE__,

                                                (size_t)__LINE__, where))

    return FALSE;

  return TRUE;

}

static BOOL computeCalHash(wLog* log, const char* hostname, char* hashStr, size_t len)

{

  WINPR_DIGEST_CTX* sha1 = NULL;

  BOOL ret = FALSE;

  BYTE hash[20] = { 0 };

  WINPR_ASSERT(hostname);

  WINPR_ASSERT(hashStr);

  if (len < 2 * sizeof(hash) + 1)

    return FALSE;

  if (!(sha1 = winpr_Digest_New()))

    goto out;

  if (!winpr_Digest_Init(sha1, WINPR_MD_SHA1))

    goto out;

  if (!winpr_Digest_Update(sha1, (const BYTE*)hostname, strlen(hostname)))

    goto out;

  if (!winpr_Digest_Final(sha1, hash, sizeof(hash)))

    goto out;

  for (size_t i = 0; i < sizeof(hash); i++, hashStr += 2)

    (void)sprintf_s(hashStr, 3, "%.2x", hash[i]);

  ret = TRUE;

out:

  if (!ret)

    WLog_Print(log, WLOG_ERROR, "failed to generate SHA1 of hostname '%s'", hostname);

  winpr_Digest_Free(sha1);

  return ret;

}

static BOOL saveCal(wLog* log, const rdpSettings* settings, const BYTE* data, size_t length,

                    const char* hostname)

{

  char hash[41] = { 0 };

  FILE* fp = NULL;

  char* licenseStorePath = NULL;

  char filename[MAX_PATH] = { 0 };

  char filenameNew[MAX_PATH] = { 0 };

  char* filepath = NULL;

  char* filepathNew = NULL;

  size_t written = 0;

  BOOL ret = FALSE;

  const char* path = freerdp_settings_get_string(settings, FreeRDP_ConfigPath);

  WINPR_ASSERT(path);

  WINPR_ASSERT(data || (length == 0));

  WINPR_ASSERT(hostname);

  if (!winpr_PathFileExists(path))

  {

    if (!winpr_PathMakePath(path, 0))

    {

      WLog_Print(log, WLOG_ERROR, "error creating directory '%s'", path);

      goto out;

    }

    WLog_Print(log, WLOG_INFO, "creating directory %s", path);

  }

  if (!(licenseStorePath = GetCombinedPath(path, licenseStore)))

  {

    WLog_Print(log, WLOG_ERROR, "Failed to get license store path from '%s' + '%s'", path,

               licenseStore);

    goto out;

  }

  if (!winpr_PathFileExists(licenseStorePath))

  {

    if (!winpr_PathMakePath(licenseStorePath, 0))

    {

      WLog_Print(log, WLOG_ERROR, "error creating directory '%s'", licenseStorePath);

      goto out;

    }

    WLog_Print(log, WLOG_INFO, "creating directory %s", licenseStorePath);

  }

  if (!computeCalHash(log, hostname, hash, sizeof(hash)))

    goto out;

  (void)sprintf_s(filename, sizeof(filename) - 1, "%s.cal", hash);

  (void)sprintf_s(filenameNew, sizeof(filenameNew) - 1, "%s.cal.new", hash);

  if (!(filepath = GetCombinedPath(licenseStorePath, filename)))

  {

    WLog_Print(log, WLOG_ERROR, "Failed to get license file path from '%s' + '%s'", path,

               filename);

    goto out;

  }

  if (!(filepathNew = GetCombinedPath(licenseStorePath, filenameNew)))

  {

    WLog_Print(log, WLOG_ERROR, "Failed to get license new file path from '%s' + '%s'", path,

               filenameNew);

    goto out;

  }

  fp = winpr_fopen(filepathNew, "wb");

  if (!fp)

  {

    WLog_Print(log, WLOG_ERROR, "Failed to open license file '%s'", filepathNew);

    goto out;

  }

  written = fwrite(data, length, 1, fp);

  (void)fclose(fp);

  if (written != 1)

  {

    WLog_Print(log, WLOG_ERROR, "Failed to write to license file '%s'", filepathNew);

    winpr_DeleteFile(filepathNew);

    goto out;

  }

  ret = winpr_MoveFileEx(filepathNew, filepath, MOVEFILE_REPLACE_EXISTING);

  if (!ret)

    WLog_Print(log, WLOG_ERROR, "Failed to move license file '%s' to '%s'", filepathNew,

               filepath);

out:

  free(filepathNew);

  free(filepath);

  free(licenseStorePath);

  return ret;

}

static BYTE* loadCalFile(wLog* log, const rdpSettings* settings, const char* hostname,

                         size_t* dataLen)

{

  char* licenseStorePath = NULL;

  char* calPath = NULL;

  char calFilename[MAX_PATH] = { 0 };

  char hash[41] = { 0 };

  INT64 length = 0;

  size_t status = 0;

  FILE* fp = NULL;

  BYTE* ret = NULL;

  WINPR_ASSERT(settings);

  WINPR_ASSERT(hostname);

  WINPR_ASSERT(dataLen);

  if (!computeCalHash(log, hostname, hash, sizeof(hash)))

  {

    WLog_Print(log, WLOG_ERROR, "loadCalFile: unable to compute hostname hash");

    return NULL;

  }

  (void)sprintf_s(calFilename, sizeof(calFilename) - 1, "%s.cal", hash);

  if (!(licenseStorePath = GetCombinedPath(

            freerdp_settings_get_string(settings, FreeRDP_ConfigPath), licenseStore)))

    return NULL;

  if (!(calPath = GetCombinedPath(licenseStorePath, calFilename)))

    goto error_path;

  fp = winpr_fopen(calPath, "rb");

  if (!fp)

    goto error_open;

  if (_fseeki64(fp, 0, SEEK_END) != 0)

    goto error_malloc;

  length = _ftelli64(fp);

  if (_fseeki64(fp, 0, SEEK_SET) != 0)

    goto error_malloc;

  if (length < 0)

    goto error_malloc;

  ret = (BYTE*)malloc((size_t)length);

  if (!ret)

    goto error_malloc;

  status = fread(ret, (size_t)length, 1, fp);

  if (status == 0)

    goto error_read;

  *dataLen = (size_t)length;

  (void)fclose(fp);

  free(calPath);

  free(licenseStorePath);

  return ret;

error_read:

  free(ret);

error_malloc:

  fclose(fp);

error_open:

  free(calPath);

error_path:

  free(licenseStorePath);

  return NULL;

}

/**

 * Read a licensing preamble.

 * msdn{cc240480}

 * @param s stream

 * @param bMsgType license message type

 * @param flags message flags

 * @param wMsgSize message size

 * @return if the operation completed successfully

 */

static BOOL license_read_preamble(wLog* log, wStream* s, BYTE* bMsgType, BYTE* flags,

                                  UINT16* wMsgSize)

{

  WINPR_ASSERT(bMsgType);

  WINPR_ASSERT(flags);

  WINPR_ASSERT(wMsgSize);

  /* preamble (4 bytes) */

  if (!license_check_stream_length(log, s, 4, "license preamble"))

    return FALSE;

  Stream_Read_UINT8(s, *bMsgType);  /* bMsgType (1 byte) */

  Stream_Read_UINT8(s, *flags);     /* flags (1 byte) */

  Stream_Read_UINT16(s, *wMsgSize); /* wMsgSize (2 bytes) */

  return license_check_stream_length(log, s, *wMsgSize - 4ll, "license preamble::wMsgSize");

}

/**

 * Write a licensing preamble.

 * msdn{cc240480}

 * @param s stream

 * @param bMsgType license message type

 * @param flags message flags

 * @param wMsgSize message size

 * @return if the operation completed successfully

 */

static BOOL license_write_preamble(wStream* s, BYTE bMsgType, BYTE flags, UINT16 wMsgSize)

{

  if (!Stream_EnsureRemainingCapacity(s, 4))

    return FALSE;

  /* preamble (4 bytes) */

  Stream_Write_UINT8(s, bMsgType);  /* bMsgType (1 byte) */

  Stream_Write_UINT8(s, flags);     /* flags (1 byte) */

  Stream_Write_UINT16(s, wMsgSize); /* wMsgSize (2 bytes) */

  return TRUE;

}

/**

 * @brief Initialize a license packet stream.

 *

 * @param license license module

 *

 * @return stream or NULL

 */

wStream* license_send_stream_init(rdpLicense* license, UINT16* sec_flags)

{

  WINPR_ASSERT(license);

  WINPR_ASSERT(license->rdp);

  WINPR_ASSERT(sec_flags);

  const BOOL do_crypt = license->rdp->do_crypt;

  *sec_flags = SEC_LICENSE_PKT;

  /*

   * Encryption of licensing packets is optional even if the rdp security

   * layer is used. If the peer has not indicated that it is capable of

   * processing encrypted licensing packets (rdp->do_crypt_license) we turn

   * off encryption (via rdp->do_crypt) before initializing the rdp stream

   * and re-enable it afterwards.

   */

  if (do_crypt)

  {

    *sec_flags |= SEC_LICENSE_ENCRYPT_CS;

    license->rdp->do_crypt = license->rdp->do_crypt_license;

  }

  wStream* s = rdp_send_stream_init(license->rdp, sec_flags);

  if (!s)

    return NULL;

  license->rdp->do_crypt = do_crypt;

  license->PacketHeaderLength = (UINT16)Stream_GetPosition(s);

  if (!Stream_SafeSeek(s, LICENSE_PREAMBLE_LENGTH))

    goto fail;

  return s;

fail:

  Stream_Release(s);

  return NULL;

}

/**

 * Send an RDP licensing packet.

 * msdn{cc240479}

 * @param license license module

 * @param s stream

 */

static BOOL license_send(rdpLicense* license, wStream* s, BYTE type, UINT16 sec_flags)

{

  WINPR_ASSERT(license);

  WINPR_ASSERT(license->rdp);

  rdpRdp* rdp = license->rdp;

  WINPR_ASSERT(rdp->settings);

  DEBUG_LICENSE("Sending %s Packet", license_request_type_string(type));

  const size_t length = Stream_GetPosition(s);

  WINPR_ASSERT(length >= license->PacketHeaderLength);

  WINPR_ASSERT(length <= UINT16_MAX + license->PacketHeaderLength);

  const UINT16 wMsgSize = (UINT16)(length - license->PacketHeaderLength);

  Stream_SetPosition(s, license->PacketHeaderLength);

  BYTE flags = PREAMBLE_VERSION_3_0;

  /**

   * Using EXTENDED_ERROR_MSG_SUPPORTED here would cause mstsc to crash when

   * running in server mode! This flag seems to be incorrectly documented.

   */

  if (!rdp->settings->ServerMode)

    flags |= EXTENDED_ERROR_MSG_SUPPORTED;

  if (!license_write_preamble(s, type, flags, wMsgSize))

  {

    Stream_Release(s);

    return FALSE;

  }

#ifdef WITH_DEBUG_LICENSE

  WLog_Print(license->log, WLOG_DEBUG, "Sending %s Packet, length %" PRIu16 "",

             license_request_type_string(type), wMsgSize);

  winpr_HexLogDump(license->log, WLOG_DEBUG, Stream_PointerAs(s, char) - LICENSE_PREAMBLE_LENGTH,

                   wMsgSize);

#endif

  Stream_SetPosition(s, length);

  const BOOL ret = rdp_send(rdp, s, MCS_GLOBAL_CHANNEL_ID, sec_flags);

  return ret;

}

BOOL license_write_server_upgrade_license(const rdpLicense* license, wStream* s)

{

  WINPR_ASSERT(license);

  if (!license_write_binary_blob(s, license->EncryptedLicenseInfo))

    return FALSE;

  if (!license_check_stream_capacity(license->log, s, sizeof(license->MACData),

                                     "SERVER_UPGRADE_LICENSE::MACData"))

    return FALSE;

  Stream_Write(s, license->MACData, sizeof(license->MACData));

  return TRUE;

}

static BOOL license_server_send_new_or_upgrade_license(rdpLicense* license, BOOL upgrade)

{

  UINT16 sec_flags = 0;

  wStream* s = license_send_stream_init(license, &sec_flags);

  const BYTE type = upgrade ? UPGRADE_LICENSE : NEW_LICENSE;

  if (!s)

    return FALSE;

  if (!license_write_server_upgrade_license(license, s))

    goto fail;

  return license_send(license, s, type, sec_flags);

fail:

  Stream_Release(s);

  return FALSE;

}

/**

 * Receive an RDP licensing packet.

 * msdn{cc240479}

 * @param license license module

 * @param s stream

 * @return if the operation completed successfully

 */

static state_run_t license_client_recv_int(rdpLicense* license, wStream* s)

{

  BYTE flags = 0;

  BYTE bMsgType = 0;

  UINT16 wMsgSize = 0;

  const size_t length = Stream_GetRemainingLength(s);

  WINPR_ASSERT(license);

  if (!license_read_preamble(license->log, s, &bMsgType, &flags,

                             &wMsgSize)) /* preamble (4 bytes) */

    return STATE_RUN_FAILED;

  DEBUG_LICENSE("Receiving %s Packet", license_request_type_string(bMsgType));

  switch (bMsgType)

  {

    case LICENSE_REQUEST:

      /* Client does not require configuration, so skip this state */

      if (license_get_state(license) == LICENSE_STATE_INITIAL)

        license_set_state(license, LICENSE_STATE_CONFIGURED);

      if (!license_ensure_state(license, LICENSE_STATE_CONFIGURED, bMsgType))

        return STATE_RUN_FAILED;

      if (!license_read_license_request_packet(license, s))

        return STATE_RUN_FAILED;

      if (!license_answer_license_request(license))

        return STATE_RUN_FAILED;

      license_set_state(license, LICENSE_STATE_NEW_REQUEST);

      break;

    case PLATFORM_CHALLENGE:

      if (!license_ensure_state(license, LICENSE_STATE_NEW_REQUEST, bMsgType))

        return STATE_RUN_FAILED;

      if (!license_read_platform_challenge_packet(license, s))

        return STATE_RUN_FAILED;

      if (!license_send_platform_challenge_response(license))

        return STATE_RUN_FAILED;

      license_set_state(license, LICENSE_STATE_PLATFORM_CHALLENGE_RESPONSE);

      break;

    case NEW_LICENSE:

    case UPGRADE_LICENSE:

      if (!license_ensure_state(license, LICENSE_STATE_PLATFORM_CHALLENGE_RESPONSE, bMsgType))

        return STATE_RUN_FAILED;

      if (!license_read_new_or_upgrade_license_packet(license, s))

        return STATE_RUN_FAILED;

      break;

    case ERROR_ALERT:

      if (!license_read_error_alert_packet(license, s))

        return STATE_RUN_FAILED;

      break;

    default:

      WLog_Print(license->log, WLOG_ERROR, "invalid bMsgType:%" PRIu8 "", bMsgType);

      return STATE_RUN_FAILED;

  }

  if (!tpkt_ensure_stream_consumed(license->log, s, length))

    return STATE_RUN_FAILED;

  return STATE_RUN_SUCCESS;

}

state_run_t license_client_recv(rdpLicense* license, wStream* s)

{

  state_run_t rc = license_client_recv_int(license, s);

  if (state_run_failed(rc))

  {

    freerdp_set_last_error(license->rdp->context, ERROR_CTX_LICENSE_CLIENT_INVALID);

  }

  return rc;

}

state_run_t license_server_recv(rdpLicense* license, wStream* s)

{

  state_run_t rc = STATE_RUN_FAILED;

  BYTE flags = 0;

  BYTE bMsgType = 0;

  UINT16 wMsgSize = 0;

  const size_t length = Stream_GetRemainingLength(s);

  WINPR_ASSERT(license);

  if (!license_read_preamble(license->log, s, &bMsgType, &flags,

                             &wMsgSize)) /* preamble (4 bytes) */

    goto fail;

  DEBUG_LICENSE("Receiving %s Packet", license_request_type_string(bMsgType));