/**

 * FreeRDP: A Remote Desktop Protocol Implementation

 * Terminal Server Gateway (utils)

 *

 * Copyright 2021 Armin Novak <armin.novak@thincast.com>

 * Copyright 2021 Thincast Technologies GmbH

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include <freerdp/config.h>

#include "settings.h"

#include <winpr/assert.h>

#include <freerdp/freerdp.h>

#include <freerdp/channels/cliprdr.h>

#include <freerdp/channels/rdpdr.h>

#include <freerdp/log.h>

#define TAG FREERDP_TAG("core.gateway.utils")

#include "utils.h"

#if !defined(_WIN32)

#include <sys/stat.h>

#endif

#include "../core/rdp.h"

BOOL utils_str_copy(const char* value, char** dst)

{

  WINPR_ASSERT(dst);

  free(*dst);

  *dst = nullptr;

  if (!value)

    return TRUE;

  (*dst) = _strdup(value);

  return (*dst) != nullptr;

}

WINPR_ATTR_NODISCARD

static BOOL utils_copy_smartcard_settings(const rdpSettings* settings, rdpSettings* origSettings)

{

  /* update original settings with provided smart card settings */

  origSettings->SmartcardLogon = settings->SmartcardLogon;

  origSettings->PasswordIsSmartcardPin = settings->PasswordIsSmartcardPin;

  if (!utils_str_copy(settings->ReaderName, &origSettings->ReaderName))

    return FALSE;

  if (!utils_str_copy(settings->CspName, &origSettings->CspName))

    return FALSE;

  if (!utils_str_copy(settings->ContainerName, &origSettings->ContainerName))

    return FALSE;

  return TRUE;

}

WINPR_ATTR_NODISCARD

static BOOL utils_auth_skip(freerdp* instance, rdp_auth_reason reason, BOOL gateway)

{

  WINPR_ASSERT(instance);

  WINPR_ASSERT(instance->context);

  const char* password = freerdp_settings_get_string(

      instance->context->settings, gateway ? FreeRDP_GatewayPassword : FreeRDP_Password);

  const char* username = freerdp_settings_get_string(

      instance->context->settings, gateway ? FreeRDP_GatewayUsername : FreeRDP_Username);

  switch (reason)

  {

    case AUTH_TLS:

    case AUTH_RDP:

    case AUTH_SMARTCARD_PIN: /* in this case password is pin code */

    case AUTH_FIDO_PIN:

      if (username && password)

        return TRUE;

      break;

    default:

      break;

  }

  return FALSE;

}

auth_status utils_authenticate_gateway(freerdp* instance, rdp_auth_reason reason)

{

  rdpSettings* settings = nullptr;

  rdpSettings* origSettings = nullptr;

  BOOL prompt = FALSE;

  BOOL proceed = 0;

  WINPR_ASSERT(instance);

  WINPR_ASSERT(instance->context);

  WINPR_ASSERT(instance->context->settings);

  WINPR_ASSERT(instance->context->rdp);

  WINPR_ASSERT(instance->context->rdp->originalSettings);

  settings = instance->context->settings;

  origSettings = instance->context->rdp->originalSettings;

  if (freerdp_shall_disconnect_context(instance->context))

    return AUTH_FAILED;

  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayPassword)))

    prompt = TRUE;

  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_GatewayUsername)))

    prompt = TRUE;

  if (!prompt)

  {

    if (!utils_sync_credentials(settings, FALSE))

      return AUTH_FAILED;

    return AUTH_SKIP;

  }

  const BOOL skip = utils_auth_skip(instance, reason, TRUE);

  if (skip)

    return AUTH_SKIP;

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  WINPR_PRAGMA_DIAG_PUSH

  WINPR_PRAGMA_DIAG_IGNORED_DEPRECATED_DECL

#endif

#if defined(WITHOUT_FREERDP_3x_DEPRECATED)

  if (!instance->AuthenticateEx)

    return AUTH_NO_CREDENTIALS;

#else

  if (!instance->GatewayAuthenticate && !instance->AuthenticateEx)

    return AUTH_NO_CREDENTIALS;

  if (!instance->GatewayAuthenticate)

#endif

  {

    proceed =

        instance->AuthenticateEx(instance, &settings->GatewayUsername,

                                 &settings->GatewayPassword, &settings->GatewayDomain, reason);

    if (!proceed)

      return AUTH_CANCELLED;

  }

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  else

  {

    proceed =

        instance->GatewayAuthenticate(instance, &settings->GatewayUsername,

                                      &settings->GatewayPassword, &settings->GatewayDomain);

    if (!proceed)

      return AUTH_CANCELLED;

  }

#endif

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  WINPR_PRAGMA_DIAG_POP

#endif

  if (utils_str_is_empty(settings->GatewayUsername) ||

      utils_str_is_empty(settings->GatewayPassword))

    return AUTH_NO_CREDENTIALS;

  if (!utils_sync_credentials(settings, FALSE))

    return AUTH_FAILED;

  /* update original settings with provided user credentials */

  if (!utils_str_copy(settings->GatewayUsername, &origSettings->GatewayUsername))

    return AUTH_FAILED;

  if (!utils_str_copy(settings->GatewayDomain, &origSettings->GatewayDomain))

    return AUTH_FAILED;

  if (!utils_str_copy(settings->GatewayPassword, &origSettings->GatewayPassword))

    return AUTH_FAILED;

  if (!utils_sync_credentials(origSettings, FALSE))

    return AUTH_FAILED;

  if (!utils_copy_smartcard_settings(settings, origSettings))

    return AUTH_FAILED;

  return AUTH_SUCCESS;

}

auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL override)

{

  rdpSettings* settings = nullptr;

  rdpSettings* origSettings = nullptr;

  BOOL prompt = !override;

  BOOL proceed = 0;

  WINPR_ASSERT(instance);

  WINPR_ASSERT(instance->context);

  WINPR_ASSERT(instance->context->settings);

  WINPR_ASSERT(instance->context->rdp);

  WINPR_ASSERT(instance->context->rdp->originalSettings);

  settings = instance->context->settings;

  origSettings = instance->context->rdp->originalSettings;

  if (freerdp_shall_disconnect_context(instance->context))

    return AUTH_FAILED;

  if (settings->ConnectChildSession)

    return AUTH_NO_CREDENTIALS;

  /* Ask for auth data if no or an empty username was specified or no password was given */

  if (utils_str_is_empty(freerdp_settings_get_string(settings, FreeRDP_Username)) ||

      (settings->Password == nullptr && settings->RedirectionPassword == nullptr))

    prompt = TRUE;

  const BOOL skip = utils_auth_skip(instance, reason, FALSE);

  if (!prompt || skip)

    return AUTH_SKIP;

  switch (reason)

  {

    case AUTH_RDP:

    case AUTH_TLS:

      if (settings->SmartcardLogon)

      {

        if (!utils_str_is_empty(settings->Password))

        {

          WLog_INFO(TAG, "Authentication via smartcard");

          return AUTH_SUCCESS;

        }

        reason = AUTH_SMARTCARD_PIN;

      }

      break;

    case AUTH_NLA:

      if (settings->SmartcardLogon)

        reason = AUTH_SMARTCARD_PIN;

      break;

    case AUTH_RDSTLS:

    default:

      break;

  }

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  WINPR_PRAGMA_DIAG_PUSH

  WINPR_PRAGMA_DIAG_IGNORED_DEPRECATED_DECL

#endif

  /* If no callback is specified still continue connection */

#if defined(WITHOUT_FREERDP_3x_DEPRECATED)

  if (!instance->AuthenticateEx)

    return AUTH_NO_CREDENTIALS;

#else

  if (!instance->Authenticate && !instance->AuthenticateEx)

    return AUTH_NO_CREDENTIALS;

  if (!instance->Authenticate)

#endif

  {

    proceed = instance->AuthenticateEx(instance, &settings->Username, &settings->Password,

                                       &settings->Domain, reason);

    if (!proceed)

      return AUTH_CANCELLED;

  }

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  else

  {

    proceed = instance->Authenticate(instance, &settings->Username, &settings->Password,

                                     &settings->Domain);

    if (!proceed)

      return AUTH_NO_CREDENTIALS;

  }

#endif

#if !defined(WITHOUT_FREERDP_3x_DEPRECATED)

  WINPR_PRAGMA_DIAG_POP

#endif

  if (utils_str_is_empty(settings->Username) || utils_str_is_empty(settings->Password))

    return AUTH_NO_CREDENTIALS;

  if (!utils_sync_credentials(settings, TRUE))

    return AUTH_FAILED;

  /* update original settings with provided user credentials */

  if (!utils_str_copy(settings->Username, &origSettings->Username))

    return AUTH_FAILED;

  if (!utils_str_copy(settings->Domain, &origSettings->Domain))

    return AUTH_FAILED;

  if (!utils_str_copy(settings->Password, &origSettings->Password))

    return AUTH_FAILED;

  if (!utils_sync_credentials(origSettings, TRUE))

    return AUTH_FAILED;

  if (!utils_copy_smartcard_settings(settings, origSettings))

    return AUTH_FAILED;

  return AUTH_SUCCESS;

}

BOOL utils_sync_credentials(rdpSettings* settings, BOOL toGateway)

{

  WINPR_ASSERT(settings);

  if (!settings->GatewayUseSameCredentials)

    return TRUE;

  if (toGateway)

  {

    if (!utils_str_copy(settings->Username, &settings->GatewayUsername))

      return FALSE;

    if (!utils_str_copy(settings->Domain, &settings->GatewayDomain))

      return FALSE;

    if (!utils_str_copy(settings->Password, &settings->GatewayPassword))

      return FALSE;

  }

  else

  {

    if (!utils_str_copy(settings->GatewayUsername, &settings->Username))

      return FALSE;

    if (!utils_str_copy(settings->GatewayDomain, &settings->Domain))

      return FALSE;

    if (!utils_str_copy(settings->GatewayPassword, &settings->Password))

      return FALSE;

  }

  return TRUE;

}

BOOL utils_persist_credentials(rdpSettings* settings, const rdpSettings* current)

{

  if (!settings || !current)

    return FALSE;

  const SSIZE_T keys[] = { FreeRDP_GatewayUsername, FreeRDP_GatewayDomain,

                         FreeRDP_GatewayPassword, FreeRDP_Username,

                         FreeRDP_Domain,          FreeRDP_Password };

  for (size_t x = 0; x < ARRAYSIZE(keys); x++)

  {

    const SSIZE_T key = keys[x];

    if (!freerdp_settings_copy_item(settings, current, key))

    {

      WLog_ERR(TAG, "Failed to copy %s from current to backup settings",

               freerdp_settings_get_name_for_key(key));

      return FALSE;

    }

  }

  return TRUE;

}

BOOL utils_str_is_empty(const char* str)

{

  if (!str)

    return TRUE;

  if (*str == '\0')

    return TRUE;

  return FALSE;

}

BOOL utils_abort_connect(rdpRdp* rdp)

{

  if (!rdp)

    return FALSE;

  return SetEvent(rdp->abortEvent);

}

BOOL utils_reset_abort(rdpRdp* rdp)

{

  WINPR_ASSERT(rdp);

  return ResetEvent(rdp->abortEvent);

}

HANDLE utils_get_abort_event(rdpRdp* rdp)

{

  WINPR_ASSERT(rdp);

  return rdp->abortEvent;

}

BOOL utils_abort_event_is_set(const rdpRdp* rdp)

{

  DWORD status = 0;

  WINPR_ASSERT(rdp);

  status = WaitForSingleObject(rdp->abortEvent, 0);

  return status == WAIT_OBJECT_0;

}

const char* utils_is_vsock(const char* hostname)

{

  if (!hostname)

    return nullptr;

  const char vsock[8] = { 'v', 's', 'o', 'c', 'k', ':', '/', '/' };

  if (strncmp(hostname, vsock, sizeof(vsock)) == 0)

    return &hostname[sizeof(vsock)];

  return nullptr;

}

WINPR_ATTR_NODISCARD

static BOOL remove_rdpdr_type(rdpSettings* settings, UINT32 type)

{

  BOOL rc = TRUE;

  RDPDR_DEVICE* printer = nullptr;

  do

  {

    printer = freerdp_device_collection_find_type(settings, type);

    if (printer)

    {

      if (!freerdp_device_collection_del(settings, printer))

        rc = FALSE;

    }

    freerdp_device_free(printer);

  } while (printer);

  return rc;

}

WINPR_ATTR_NODISCARD

static BOOL disable_clipboard(rdpSettings* settings)

{

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectClipboard, FALSE))

    return FALSE;

  freerdp_static_channel_collection_del(settings, CLIPRDR_SVC_CHANNEL_NAME);

  return TRUE;

}

WINPR_ATTR_NODISCARD

static BOOL disable_drive(rdpSettings* settings)

{

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectDrives, FALSE))

    return FALSE;

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectHomeDrive, FALSE))

    return FALSE;

  return remove_rdpdr_type(settings, RDPDR_DTYP_FILESYSTEM);

}

WINPR_ATTR_NODISCARD

static BOOL disable_printers(rdpSettings* settings)

{

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectPrinters, FALSE))

    return FALSE;

  return remove_rdpdr_type(settings, RDPDR_DTYP_PRINT);

}

WINPR_ATTR_NODISCARD

static BOOL disable_port(rdpSettings* settings)

{

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectParallelPorts, FALSE))

    return FALSE;

  if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectSerialPorts, FALSE))

    return FALSE;

  if (!remove_rdpdr_type(settings, RDPDR_DTYP_SERIAL))

    return FALSE;

  return remove_rdpdr_type(settings, RDPDR_DTYP_PARALLEL);

}

WINPR_ATTR_NODISCARD

static BOOL disable_pnp(WINPR_ATTR_UNUSED rdpSettings* settings)

{

  // TODO(akallabeth): [MS-RDPEPNP] related stuff is disabled.

  return TRUE;

}

WINPR_ATTR_NODISCARD

static BOOL apply_gw_policy(rdpContext* context)

{

  WINPR_ASSERT(context);

  return utils_reload_channels(context);

}

BOOL utils_apply_gateway_policy(wLog* log, rdpContext* context, UINT32 flags, const char* module)

{

  WINPR_ASSERT(log);

  WINPR_ASSERT(context);

  rdpSettings* settings = context->settings;

  WINPR_ASSERT(settings);

  if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)

  {

    WLog_Print(log, WLOG_DEBUG, "[%s] policy allows all redirections", module);

  }

  else if (freerdp_settings_get_bool(settings, FreeRDP_GatewayIgnoreRedirectionPolicy))

  {

    char buffer[128] = WINPR_C_ARRAY_INIT;

    WLog_Print(log, WLOG_INFO, "[%s] policy ignored on user request %s", module,

               utils_redir_flags_to_string(flags, buffer, sizeof(buffer)));

  }

  else if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)

  {

    WLog_Print(log, WLOG_INFO, "[%s] policy denies all redirections", module);

    if (!disable_drive(settings))

      return FALSE;

    if (!disable_printers(settings))

      return FALSE;

    if (!disable_clipboard(settings))

      return FALSE;

    if (!disable_port(settings))

      return FALSE;

    if (!disable_pnp(settings))

      return FALSE;

    if (!apply_gw_policy(context))

      return FALSE;

  }

  else

  {

    if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)

    {

      WLog_Print(log, WLOG_INFO, "[%s] policy denies drive redirections", module);

      if (!disable_drive(settings))

        return FALSE;

    }

    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)

    {

      WLog_Print(log, WLOG_INFO, "[%s] policy denies printer redirections", module);

      if (!disable_printers(settings))

        return FALSE;

    }

    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)

    {

      WLog_Print(log, WLOG_INFO, "[%s] policy denies port redirections", module);

      if (!disable_port(settings))

        return FALSE;

    }

    if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)

    {

      WLog_Print(log, WLOG_INFO, "[%s] policy denies clipboard redirections", module);

      if (!disable_clipboard(settings))

        return FALSE;

    }

    if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)

    {

      WLog_Print(log, WLOG_INFO, "[%s] policy denies PNP redirections", module);

      if (!disable_pnp(settings))

        return FALSE;

    }

    if (flags != 0)

    {

      if (!apply_gw_policy(context))

        return FALSE;

    }

  }

  return TRUE;

}

char* utils_redir_flags_to_string(UINT32 flags, char* buffer, size_t size)

{

  winpr_str_append("{", buffer, size, "");

  if (flags & HTTP_TUNNEL_REDIR_ENABLE_ALL)

    winpr_str_append("ENABLE_ALL", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_ALL)

    winpr_str_append("DISABLE_ALL", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_DRIVE)

    winpr_str_append("DISABLE_DRIVE", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PRINTER)

    winpr_str_append("DISABLE_PRINTER", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PORT)

    winpr_str_append("DISABLE_PORT", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_CLIPBOARD)

    winpr_str_append("DISABLE_CLIPBOARD", buffer, size, "|");

  if (flags & HTTP_TUNNEL_REDIR_DISABLE_PNP)

    winpr_str_append("DISABLE_PNP", buffer, size, "|");

  char fbuffer[16] = WINPR_C_ARRAY_INIT;

  (void)_snprintf(fbuffer, sizeof(fbuffer), "[0x%08" PRIx32 "]", flags);

  winpr_str_append(fbuffer, buffer, size, " ");

  winpr_str_append("{", buffer, size, "}");

  return buffer;

}

BOOL utils_reload_channels(rdpContext* context)

{

  WINPR_ASSERT(context);

  if (context->channels)

  {

    freerdp_channels_disconnect(context->channels, context->instance);

    freerdp_channels_close(context->channels, context->instance);

    freerdp_channels_free(context->channels);

  }

  context->channels = freerdp_channels_new(context->instance);

  if (!context->channels)

    return FALSE;

  freerdp_channels_register_instance(context->channels, context->instance);

  BOOL rc = TRUE;

  IFCALLRET(context->instance->LoadChannels, rc, context->instance);

  if (rc)

    return freerdp_channels_pre_connect(context->channels, context->instance) == CHANNEL_RC_OK;

  return rc;

}

const char* guid2str(const GUID* guid, char* buffer, size_t len)

{

  if (!guid)

    return nullptr;

  RPC_CSTR strguid = nullptr;

  RPC_STATUS rpcStatus = UuidToStringA(guid, &strguid);

  if (rpcStatus != RPC_S_OK)

    return nullptr;

  (void)sprintf_s(buffer, len, "%s", strguid);

  RpcStringFreeA(&strguid);

  return buffer;

}

WINPR_ATTR_NODISCARD

static BOOL isValidIPv4(const char* ipAddress)

{

  struct sockaddr_in sa = WINPR_C_ARRAY_INIT;

  int result = inet_pton(AF_INET, ipAddress, &(sa.sin_addr));

  return result != 0;

}

WINPR_ATTR_NODISCARD

static BOOL isValidIPv6(const char* ipAddress)

{

  struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;

  int result = inet_pton(AF_INET6, ipAddress, &(sa.sin6_addr));

  return result != 0;

}

BOOL utils_is_valid_ip(const char* ipAddress)

{

  return isValidIPv4(ipAddress) || isValidIPv6(ipAddress);

}

BOOL utils_set_umask(void)

{

#if !defined(_WIN32)

  (void)umask(S_IRWXG | S_IRWXO);

#endif

  return TRUE;

}

BOOL utils_compare_ip_strings(const char* ipAddressA, size_t lenA, const char* ipAddressB,

                              size_t lenB)

{

  if (!ipAddressA || (lenA == 0))

    return FALSE;

  if (!ipAddressB || (lenB == 0))

    return FALSE;

  if (strnlen(ipAddressA, lenA + 1) > lenA)

    return FALSE;

  if (strnlen(ipAddressB, lenB + 1) > lenB)

    return FALSE;

  if (isValidIPv4(ipAddressA) && isValidIPv4(ipAddressB))

  {

    struct sockaddr_in sa = WINPR_C_ARRAY_INIT;

    struct sockaddr_in sb = WINPR_C_ARRAY_INIT;

    const int resultA = inet_pton(AF_INET, ipAddressA, &(sa.sin_addr));

    const int resultB = inet_pton(AF_INET, ipAddressB, &(sb.sin_addr));

    if ((resultA != resultB) || (resultA != 0))

      return FALSE;

    return memcmp(&sa, &sb, sizeof(sa)) == 0;

  }

  if (isValidIPv6(ipAddressA) && isValidIPv6(ipAddressB))

  {

    struct sockaddr_in6 sa = WINPR_C_ARRAY_INIT;

    struct sockaddr_in6 sb = WINPR_C_ARRAY_INIT;

    const int resultA = inet_pton(AF_INET6, ipAddressA, &(sa.sin6_addr));

    const int resultB = inet_pton(AF_INET6, ipAddressB, &(sb.sin6_addr));

    if ((resultA != resultB) || (resultA != 0))

      return FALSE;

    return memcmp(&sa, &sb, sizeof(sa)) == 0;

  }

  return FALSE;

}