ai-remote 0.1.0

package/src/protocols/rdp/cert.ts

@@ -0,0 +1,190 @@
+// Server public key extraction for the RDP Standard Security layer.
+//
+// A host either hands out a "proprietary" certificate -- little more than a
+// wrapper around an RSA public key -- or an X.509 chain whose leaf holds the
+// key (MS-RDPBCGR 2.2.1.4.3.1). Either way the client random is encrypted with
+// that key, so all we need out of it is a modulus and an exponent.
+//
+// Note the proprietary certificate is signed with a private key Microsoft
+// published, so it authenticates nothing: RDP Standard Security gives
+// confidentiality on the wire, not proof of the host's identity.
+
+import { Reader } from './buffer';
+
+const CERT_PROPRIETARY = 1;
+const CERT_X509 = 2;
+const RSA1_MAGIC = 0x31415352;
+const BB_RSA_KEY_BLOB = 0x0006;
+
+const OID_RSA_ENCRYPTION = [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01];
+
+// --- DER --------------------------------------------------------------------
+
+function derRead(bytes: Uint8Array, offset: number) {
+  let cursor = offset;
+  const tag = bytes[cursor++];
+
+  let length = bytes[cursor++];
+  if (length & 0x80) {
+    const byteCount = length & 0x7f;
+    length = 0;
+    for (let i = 0; i < byteCount; i++) length = (length << 8) | bytes[cursor++];
+  }
+
+  return {
+    tag,
+    contentStart: cursor,
+    contentEnd: cursor + length,
+    next: cursor + length,
+    content: bytes.subarray(cursor, cursor + length),
+  };
+}
+
+function derChildren(bytes: Uint8Array) {
+  const children = [];
+  let offset = 0;
+  while (offset < bytes.length) {
+    const node = derRead(bytes, offset);
+    children.push(node);
+    if (node.next <= offset) break;
+    offset = node.next;
+  }
+  return children;
+}
+
+function containsOid(bytes: Uint8Array, oid: string) {
+  outer: for (let i = 0; i + oid.length <= bytes.length; i++) {
+    for (let j = 0; j < oid.length; j++) {
+      if (bytes[i + j] !== oid[j]) continue outer;
+    }
+    return true;
+  }
+  return false;
+}
+
+/** Big-endian DER integer -> little-endian bytes with the sign byte removed. */
+function derIntegerToLe(content: Uint8Array) {
+  let start = 0;
+  while (start < content.length - 1 && content[start] === 0x00) start++;
+  return content.subarray(start).slice().reverse();
+}
+
+/**
+ * Find SubjectPublicKeyInfo in an X.509 certificate and return the RSA key.
+ * The structure is walked rather than indexed by position: optional fields in
+ * TBSCertificate make fixed offsets wrong for many real certificates.
+ */
+function rsaKeyFromX509(der: Uint8Array) {
+  const certificate = derRead(der, 0);
+  const tbsCertificate = derRead(der, certificate.contentStart);
+
+  for (const child of derChildren(tbsCertificate.content)) {
+    if (child.tag !== 0x30) continue;
+
+    const parts = derChildren(child.content);
+    if (parts.length < 2) continue;
+    if (parts[0].tag !== 0x30 || !containsOid(parts[0].content, OID_RSA_ENCRYPTION)) continue;
+    if (parts[1].tag !== 0x03) continue;
+
+    // BIT STRING content starts with an "unused bits" count.
+    const publicKey = derRead(parts[1].content.subarray(1), 0);
+    const [modulus, exponent] = derChildren(publicKey.content);
+    if (!modulus || !exponent) break;
+
+    return {
+      modulus: derIntegerToLe(modulus.content),
+      exponent: derIntegerToLe(exponent.content),
+      source: 'x509',
+    };
+  }
+
+  throw new Error('RDP: no RSA public key found in the host X.509 certificate');
+}
+
+function rsaKeyFromProprietary(reader: Reader) {
+  reader.u32le(); // dwSigAlgId
+  reader.u32le(); // dwKeyAlgId
+
+  const publicKeyBlobType = reader.u16le();
+  const publicKeyBlobLength = reader.u16le();
+  if (publicKeyBlobType !== BB_RSA_KEY_BLOB) {
+    throw new Error(`RDP: unsupported public key blob type 0x${publicKeyBlobType.toString(16)}`);
+  }
+
+  const blob = new Reader(reader.raw(publicKeyBlobLength));
+  if (blob.u32le() !== RSA1_MAGIC) {
+    throw new Error('RDP: the host RSA public key blob is not in RSA1 format');
+  }
+
+  const keyLength = blob.u32le();
+  blob.u32le(); // bitlen
+  blob.u32le(); // datalen
+  const exponent = blob.raw(4).slice();
+
+  // The blob reserves 8 trailing bytes of padding after the modulus.
+  if (keyLength < 9) throw new Error('RDP: the host RSA modulus is too short');
+  const modulus = blob.raw(keyLength - 8).slice();
+
+  return { modulus, exponent, source: 'proprietary' };
+}
+
+/**
+ * Pull the RSA public key out of a DER X.509 certificate, for the TLS layer.
+ *
+ * CredSSP needs the exact bytes of the certificate's subjectPublicKey BIT
+ * STRING contents -- the DER RSAPublicKey -- because that is what both ends
+ * hash to bind the authentication to this TLS channel (MS-CSSP 3.1.5).
+ */
+export function parseX509PublicKey(der: Uint8Array) {
+  const certificate = derRead(der, 0);
+  const tbsCertificate = derRead(der, certificate.contentStart);
+
+  for (const child of derChildren(tbsCertificate.content)) {
+    if (child.tag !== 0x30) continue;
+
+    const parts = derChildren(child.content);
+    if (parts.length < 2) continue;
+    if (parts[0].tag !== 0x30 || !containsOid(parts[0].content, OID_RSA_ENCRYPTION)) continue;
+    if (parts[1].tag !== 0x03) continue;
+
+    const subjectPublicKey = parts[1].content.subarray(1); // drop the unused-bit count
+    const publicKey = derRead(subjectPublicKey, 0);
+    const [modulus, exponent] = derChildren(publicKey.content);
+    if (!modulus || !exponent) break;
+
+    const stripLeadingZero = (bytes: Uint8Array) => {
+      let start = 0;
+      while (start < bytes.length - 1 && bytes[start] === 0x00) start++;
+      return bytes.subarray(start);
+    };
+
+    return {
+      modulus: stripLeadingZero(modulus.content),
+      exponent: stripLeadingZero(exponent.content),
+      subjectPublicKey,
+    };
+  }
+
+  throw new Error('TLS: no RSA public key found in the host certificate');
+}
+
+/** Parse a server certificate blob into an RSA public key. */
+export function parseServerCertificate(certificateBytes: Uint8Array) {
+  const reader = new Reader(certificateBytes);
+  const version = reader.u32le() & 0x7fffffff;
+
+  if (version === CERT_PROPRIETARY) return rsaKeyFromProprietary(reader);
+
+  if (version === CERT_X509) {
+    const certificateCount = reader.u32le();
+    let leaf = null;
+    for (let i = 0; i < certificateCount; i++) {
+      const length = reader.u32le();
+      leaf = reader.raw(length);
+    }
+    if (!leaf) throw new Error('RDP: the host sent an empty X.509 certificate chain');
+    return rsaKeyFromX509(leaf);
+  }
+
+  throw new Error(`RDP: unsupported server certificate version ${version}`);
+}