ai-remote 0.1.0

package/src/protocols/rdp/gcc.ts

@@ -0,0 +1,162 @@
+// GCC user data: what the client says about itself in the MCS connect request,
+// and what the host answers with (MS-RDPBCGR 2.2.1.3 / 2.2.1.4).
+
+import { Reader, Writer, concatBytes } from './buffer';
+import { parseServerCertificate } from './cert';
+
+const CS_CORE = 0xc001;
+const CS_SECURITY = 0xc002;
+const CS_NET = 0xc003;
+const CS_CLUSTER = 0xc004;
+
+const SC_CORE = 0x0c01;
+const SC_SECURITY = 0x0c02;
+const SC_NET = 0x0c03;
+
+/** RDP 5.0 and later. Anything newer would oblige us to speak newer PDUs. */
+export const RDP_VERSION_5_PLUS = 0x00080004;
+
+const COLOR_16BPP = 0xca03;
+const RNS_UD_SAS_DEL = 0xaa03;
+const SUPPORT_ERRINFO_PDU = 0x0001;
+
+export const ENCRYPTION_LEVEL = {
+  NONE: 0,
+  LOW: 1,
+  CLIENT_COMPATIBLE: 2,
+  HIGH: 3,
+  FIPS: 4,
+};
+
+function userDataBlock(type: number, body: Uint8Array) {
+  const writer = new Writer(body.length + 4);
+  writer.u16le(type).u16le(body.length + 4).raw(body);
+  return writer.take();
+}
+
+/**
+ * TS_UD_CS_CORE. The desktop size asked for here is a request: the host answers
+ * with the size it actually chose in its Demand Active PDU.
+ */
+function clientCoreData({ width, height, clientName, keyboardLayout, selectedProtocol }) {
+  const writer = new Writer(256);
+
+  writer.u32le(RDP_VERSION_5_PLUS);
+  writer.u16le(width);
+  writer.u16le(height);
+  writer.u16le(COLOR_16BPP);
+  writer.u16le(RNS_UD_SAS_DEL);
+  writer.u32le(keyboardLayout);
+  writer.u32le(2600);                    // clientBuild
+  writer.utf16le(clientName, 32);        // clientName, 15 chars + NUL
+  writer.u32le(4);                       // keyboardType: IBM enhanced
+  writer.u32le(0);                       // keyboardSubType
+  writer.u32le(12);                      // keyboardFunctionKey
+  writer.zeros(64);                      // imeFileName
+  writer.u16le(COLOR_16BPP);             // postBeta2ColorDepth
+  writer.u16le(1);                       // clientProductId
+  writer.u32le(0);                       // serialNumber
+  writer.u16le(16);                      // highColorDepth
+  writer.u16le(0x0007);                  // supportedColorDepths: 15/16/24
+  writer.u16le(SUPPORT_ERRINFO_PDU);     // earlyCapabilityFlags
+  writer.zeros(64);                      // clientDigProductId
+  writer.u8(0);                          // connectionType: unknown
+  writer.u8(0);                          // pad
+  writer.u32le(selectedProtocol);        // serverSelectedProtocol
+
+  return userDataBlock(CS_CORE, writer.take());
+}
+
+/** TS_UD_CS_SEC. FIPS is deliberately absent -- this client does not do it. */
+function clientSecurityData(encryptionMethods: number) {
+  const writer = new Writer(8);
+  writer.u32le(encryptionMethods);
+  writer.u32le(0); // extEncryptionMethods, French locale only
+  return userDataBlock(CS_SECURITY, writer.take());
+}
+
+/** TS_UD_CS_CLUSTER, needed so the host reports redirection instead of hanging. */
+function clientClusterData() {
+  const writer = new Writer(8);
+  writer.u32le(0x0000000d); // REDIRECTION_SUPPORTED | redirection version 4
+  writer.u32le(0);          // RedirectedSessionID
+  return userDataBlock(CS_CLUSTER, writer.take());
+}
+
+function clientNetworkData(channels) {
+  if (channels.length === 0) return new Uint8Array(0);
+
+  const writer = new Writer(4 + channels.length * 12);
+  writer.u32le(channels.length);
+  for (const channel of channels) {
+    const name = new Uint8Array(8);
+    for (let i = 0; i < Math.min(7, channel.name.length); i++) name[i] = channel.name.charCodeAt(i);
+    writer.raw(name);
+    writer.u32le(channel.options >>> 0);
+  }
+  return userDataBlock(CS_NET, writer.take());
+}
+
+export function clientData(options) {
+  return concatBytes(
+    clientCoreData(options),
+    clientClusterData(),
+    clientSecurityData(options.encryptionMethods),
+    clientNetworkData(options.channels || [])
+  );
+}
+
+/**
+ * Walk the host's answer. Only the security and network blocks carry anything
+ * the client must act on; the core block is kept for logging.
+ */
+export function parseServerData(blocks) {
+  const reader = new Reader(blocks);
+  const result = {
+    version: null,
+    encryptionMethod: 0,
+    encryptionLevel: ENCRYPTION_LEVEL.NONE,
+    serverRandom: null,
+    publicKey: null,
+    ioChannelId: 1003,
+    channelIds: [],
+  };
+
+  while (reader.remaining >= 4) {
+    const type = reader.u16le();
+    const length = reader.u16le();
+    if (length < 4 || length - 4 > reader.remaining) break;
+    const body = new Reader(reader.raw(length - 4));
+
+    if (type === SC_CORE) {
+      result.version = body.remaining >= 4 ? body.u32le() : null;
+      continue;
+    }
+
+    if (type === SC_NET) {
+      result.ioChannelId = body.u16le();
+      const channelCount = body.u16le();
+      for (let i = 0; i < channelCount && body.remaining >= 2; i++) {
+        result.channelIds.push(body.u16le());
+      }
+      continue;
+    }
+
+    if (type === SC_SECURITY) {
+      result.encryptionMethod = body.u32le();
+      result.encryptionLevel = body.u32le();
+
+      // With TLS in play the host reports no RDP-level encryption and stops.
+      if (result.encryptionMethod === 0 && result.encryptionLevel === 0) continue;
+      if (body.remaining < 8) continue;
+
+      const serverRandomLength = body.u32le();
+      const serverCertLength = body.u32le();
+      result.serverRandom = body.raw(serverRandomLength).slice();
+      result.publicKey = parseServerCertificate(body.raw(serverCertLength));
+      continue;
+    }
+  }
+
+  return result;
+}

package/src/protocols/rdp/keymap.ts

@@ -0,0 +1,68 @@
+// KeyboardEvent.code -> PC/AT set 1 scancode, which is what RDP carries.
+// Keys marked extended need KBDFLAGS_EXTENDED so the host tells, for example,
+// the numeric keypad Enter from the main one.
+
+const SCANCODES = {
+  Escape: 0x01,
+  Digit1: 0x02, Digit2: 0x03, Digit3: 0x04, Digit4: 0x05, Digit5: 0x06,
+  Digit6: 0x07, Digit7: 0x08, Digit8: 0x09, Digit9: 0x0a, Digit0: 0x0b,
+  Minus: 0x0c, Equal: 0x0d, Backspace: 0x0e, Tab: 0x0f,
+  KeyQ: 0x10, KeyW: 0x11, KeyE: 0x12, KeyR: 0x13, KeyT: 0x14,
+  KeyY: 0x15, KeyU: 0x16, KeyI: 0x17, KeyO: 0x18, KeyP: 0x19,
+  BracketLeft: 0x1a, BracketRight: 0x1b, Enter: 0x1c, ControlLeft: 0x1d,
+  KeyA: 0x1e, KeyS: 0x1f, KeyD: 0x20, KeyF: 0x21, KeyG: 0x22,
+  KeyH: 0x23, KeyJ: 0x24, KeyK: 0x25, KeyL: 0x26,
+  Semicolon: 0x27, Quote: 0x28, Backquote: 0x29, ShiftLeft: 0x2a, Backslash: 0x2b,
+  KeyZ: 0x2c, KeyX: 0x2d, KeyC: 0x2e, KeyV: 0x2f, KeyB: 0x30,
+  KeyN: 0x31, KeyM: 0x32, Comma: 0x33, Period: 0x34, Slash: 0x35,
+  ShiftRight: 0x36, NumpadMultiply: 0x37, AltLeft: 0x38, Space: 0x39, CapsLock: 0x3a,
+  F1: 0x3b, F2: 0x3c, F3: 0x3d, F4: 0x3e, F5: 0x3f,
+  F6: 0x40, F7: 0x41, F8: 0x42, F9: 0x43, F10: 0x44,
+  NumLock: 0x45, ScrollLock: 0x46,
+  Numpad7: 0x47, Numpad8: 0x48, Numpad9: 0x49, NumpadSubtract: 0x4a,
+  Numpad4: 0x4b, Numpad5: 0x4c, Numpad6: 0x4d, NumpadAdd: 0x4e,
+  Numpad1: 0x4f, Numpad2: 0x50, Numpad3: 0x51, Numpad0: 0x52, NumpadDecimal: 0x53,
+  IntlBackslash: 0x56, F11: 0x57, F12: 0x58,
+  IntlRo: 0x73, IntlYen: 0x7d,
+};
+
+const EXTENDED_SCANCODES = {
+  NumpadEnter: 0x1c,
+  ControlRight: 0x1d,
+  NumpadDivide: 0x35,
+  PrintScreen: 0x37,
+  AltRight: 0x38,
+  Home: 0x47,
+  ArrowUp: 0x48,
+  PageUp: 0x49,
+  ArrowLeft: 0x4b,
+  ArrowRight: 0x4d,
+  End: 0x4f,
+  ArrowDown: 0x50,
+  PageDown: 0x51,
+  Insert: 0x52,
+  Delete: 0x53,
+  MetaLeft: 0x5b,
+  MetaRight: 0x5c,
+  ContextMenu: 0x5d,
+};
+
+/** Returns { scancode, extended } or null when the key has no RDP equivalent. */
+export function lookupScancode(code: string) {
+  if (Object.prototype.hasOwnProperty.call(SCANCODES, code)) {
+    return { scancode: SCANCODES[code], extended: false };
+  }
+  if (Object.prototype.hasOwnProperty.call(EXTENDED_SCANCODES, code)) {
+    return { scancode: EXTENDED_SCANCODES[code], extended: true };
+  }
+  return null;
+}
+
+export const CTRL_ALT_DEL = [
+  { code: 'ControlLeft', pressed: true },
+  { code: 'AltLeft', pressed: true },
+  { code: 'Delete', pressed: true },
+  { code: 'Delete', pressed: false },
+  { code: 'AltLeft', pressed: false },
+  { code: 'ControlLeft', pressed: false },
+];

package/src/protocols/rdp/mcs.ts

@@ -0,0 +1,283 @@
+// MCS (T.125) connect sequence and domain PDUs, with the BER and PER encoding
+// rules they need. MS-RDPBCGR 2.2.1.3 - 2.2.1.8.
+
+import { Reader, Writer, concatBytes } from './buffer';
+import { dataFrame, dataPayload } from './x224';
+
+export const MCS_BASE_CHANNEL_ID = 1001;
+export const MCS_GLOBAL_CHANNEL_ID = 1003;
+
+const DOMAIN_MCSPDU = {
+  ERECT_DOMAIN_REQUEST: 1,
+  DISCONNECT_PROVIDER_ULTIMATUM: 8,
+  ATTACH_USER_REQUEST: 10,
+  ATTACH_USER_CONFIRM: 11,
+  CHANNEL_JOIN_REQUEST: 14,
+  CHANNEL_JOIN_CONFIRM: 15,
+  SEND_DATA_REQUEST: 25,
+  SEND_DATA_INDICATION: 26,
+};
+
+const DISCONNECT_REASONS = {
+  0: 'The host closed the RDP session (domain disconnected).',
+  1: 'The host closed the RDP session (provider initiated).',
+  2: 'The host closed the RDP session (token purged).',
+  3: 'The host closed the RDP session (user requested).',
+  4: 'The host closed the RDP session (channel purged).',
+};
+
+// --- BER --------------------------------------------------------------------
+
+function berLength(length: number) {
+  if (length > 0xff) return new Uint8Array([0x82, (length >> 8) & 0xff, length & 0xff]);
+  if (length > 0x7f) return new Uint8Array([0x81, length]);
+  return new Uint8Array([length]);
+}
+
+function berTlv(tag: number, content: Uint8Array) {
+  return concatBytes(new Uint8Array(tag), berLength(content.length), content);
+}
+
+function berInteger(value: number) {
+  let body;
+  if (value < 0x80) body = new Uint8Array([value]);
+  else if (value < 0x8000) body = new Uint8Array([value >> 8, value & 0xff]);
+  else if (value < 0x800000) body = new Uint8Array([value >> 16, (value >> 8) & 0xff, value & 0xff]);
+  else body = new Uint8Array([value >>> 24, (value >> 16) & 0xff, (value >> 8) & 0xff, value & 0xff]);
+  return berTlv([0x02], body);
+}
+
+const berOctetString = (bytes: Uint8Array) => berTlv([0x04], bytes);
+const berBoolean = (value: number) => berTlv([0x01], new Uint8Array([value ? 0xff : 0x00]));
+
+/** DomainParameters ::= SEQUENCE of eight INTEGERs (T.125). */
+function berDomainParameters(values: readonly number[]) {
+  return berTlv([0x30], concatBytes(...values.map(berInteger)));
+}
+
+// --- PER --------------------------------------------------------------------
+
+function perLength(writer: Writer, length: number) {
+  if (length > 0x7f) writer.u16be(0x8000 | length);
+  else writer.u8(length);
+  return writer;
+}
+
+function perReadLength(reader: Reader) {
+  const first = reader.u8();
+  return first & 0x80 ? ((first & 0x7f) << 8) | reader.u8() : first;
+}
+
+// --- GCC Conference Create Request (T.124) ----------------------------------
+
+const T124_OBJECT_IDENTIFIER = new Uint8Array([0x05, 0x00, 0x14, 0x7c, 0x00, 0x01]);
+const H221_CLIENT_KEY = new Uint8Array([0x44, 0x75, 0x63, 0x61]); // "Duca"
+const H221_SERVER_KEY = new Uint8Array([0x4d, 0x63, 0x44, 0x6e]); // "McDn"
+
+function gccConferenceCreateRequest(clientData: Uint8Array) {
+  const writer = new Writer(clientData.length + 32);
+
+  writer.u8(0);                       // ConnectData::t124Identifier, choice 0
+  writer.raw(T124_OBJECT_IDENTIFIER); // ITU-T T.124 object identifier
+  perLength(writer, clientData.length + 14);
+
+  writer.u8(0);      // ConnectGCCPDU: conferenceCreateRequest
+  writer.u8(0x08);   // ConferenceCreateRequest::conferenceName present
+  writer.u8(0x00);   // numeric string length (min 1)
+  writer.u8(0x10);   // conference name "1"
+  writer.u8(0x00);   // padding
+  writer.u8(0x01);   // one set of UserData
+  writer.u8(0xc0);   // UserData::value present, valueless choice
+  writer.u8(0x00);   // h221NonStandard length (fixed 4)
+  writer.raw(H221_CLIENT_KEY);
+  perLength(writer, clientData.length);
+  writer.raw(clientData);
+
+  return writer.take();
+}
+
+/**
+ * Pull the server data blocks out of a GCC Conference Create Response.
+ *
+ * The response is PER-encoded with several variable-length fields in front of
+ * the payload; locating the server's H.221 key is both shorter and sturdier
+ * than replaying every one of those fields.
+ */
+function gccServerDataBlocks(userData: Uint8Array) {
+  for (let i = 0; i + 4 <= userData.length; i++) {
+    if (
+      userData[i] === H221_SERVER_KEY[0] &&
+      userData[i + 1] === H221_SERVER_KEY[1] &&
+      userData[i + 2] === H221_SERVER_KEY[2] &&
+      userData[i + 3] === H221_SERVER_KEY[3]
+    ) {
+      const reader = new Reader(userData, i + 4);
+      const length = perReadLength(reader);
+      const blocks = reader.rest();
+      return blocks.subarray(0, Math.min(length, blocks.length));
+    }
+  }
+  throw new Error('RDP: the host response contained no GCC server data');
+}
+
+// --- Connect Initial / Response ---------------------------------------------
+
+const DOMAIN_TARGET = [34, 2, 0, 1, 0, 1, 0xffff, 2];
+const DOMAIN_MINIMUM = [1, 1, 1, 1, 0, 1, 0x420, 2];
+const DOMAIN_MAXIMUM = [0xffff, 0xfc17, 0xffff, 1, 0, 1, 0xffff, 2];
+
+export function connectInitial(clientData: Uint8Array) {
+  const userData = gccConferenceCreateRequest(clientData);
+  const content = concatBytes(
+    berOctetString(new Uint8Array([0x01])), // callingDomainSelector
+    berOctetString(new Uint8Array([0x01])), // calledDomainSelector
+    berBoolean(true),                       // upwardFlag
+    berDomainParameters(DOMAIN_TARGET),
+    berDomainParameters(DOMAIN_MINIMUM),
+    berDomainParameters(DOMAIN_MAXIMUM),
+    berOctetString(userData)
+  );
+
+  // [APPLICATION 101] IMPLICIT SEQUENCE
+  return dataFrame(berTlv([0x7f, 0x65], content));
+}
+
+/** Walk one BER TLV at the reader's position. */
+function readBerTlv(reader: Reader) {
+  let tag = reader.u8();
+  if ((tag & 0x1f) === 0x1f) tag = (tag << 8) | reader.u8();
+
+  let length = reader.u8();
+  if (length & 0x80) {
+    const byteCount = length & 0x7f;
+    length = 0;
+    for (let i = 0; i < byteCount; i++) length = (length << 8) | reader.u8();
+  }
+
+  return { tag, value: reader.raw(length) };
+}
+
+export function parseConnectResponse(frame: Uint8Array) {
+  const reader = new Reader(dataPayload(frame));
+  const outer = readBerTlv(reader);
+  if (outer.tag !== 0x7f66) {
+    throw new Error(`RDP: expected an MCS connect response, got BER tag 0x${outer.tag.toString(16)}`);
+  }
+
+  const inner = new Reader(outer.value);
+  const result = readBerTlv(inner);           // result ENUMERATED
+  readBerTlv(inner);                          // calledConnectId
+  readBerTlv(inner);                          // domainParameters
+  const userData = readBerTlv(inner);          // userData OCTET STRING
+
+  if (result.value[0] !== 0) {
+    throw new Error(`RDP: the host rejected the MCS connection (result ${result.value[0]})`);
+  }
+
+  return gccServerDataBlocks(userData.value);
+}
+
+// --- Domain PDUs ------------------------------------------------------------
+
+const domainHeader = (pdu: Uint8Array) => pdu << 2;
+
+export function erectDomainRequest() {
+  const writer = new Writer(8);
+  writer.u8(domainHeader(DOMAIN_MCSPDU.ERECT_DOMAIN_REQUEST));
+  writer.u8(1).u8(0); // subHeight: PER integer 0
+  writer.u8(1).u8(0); // subInterval: PER integer 0
+  return dataFrame(writer.take());
+}
+
+export function attachUserRequest() {
+  return dataFrame(new Uint8Array([domainHeader(DOMAIN_MCSPDU.ATTACH_USER_REQUEST)]));
+}
+
+export function parseAttachUserConfirm(frame: Uint8Array) {
+  const reader = new Reader(dataPayload(frame));
+  const header = reader.u8();
+  if (header >> 2 !== DOMAIN_MCSPDU.ATTACH_USER_CONFIRM) {
+    throw new Error(`RDP: expected an MCS attach-user confirm, got PDU ${header >> 2}`);
+  }
+
+  const result = reader.u8();
+  if (result !== 0) throw new Error(`RDP: the host refused to attach a user (result ${result})`);
+
+  // The initiator is only present when the header's low bit says so.
+  const userId = header & 0x02 ? reader.u16be() + MCS_BASE_CHANNEL_ID : MCS_BASE_CHANNEL_ID;
+  return { userId };
+}
+
+export function channelJoinRequest(userId: number, channelId: number) {
+  const writer = new Writer(8);
+  writer.u8(domainHeader(DOMAIN_MCSPDU.CHANNEL_JOIN_REQUEST));
+  writer.u16be(userId - MCS_BASE_CHANNEL_ID);
+  writer.u16be(channelId);
+  return dataFrame(writer.take());
+}
+
+export function parseChannelJoinConfirm(frame: Uint8Array) {
+  const reader = new Reader(dataPayload(frame));
+  const header = reader.u8();
+  if (header >> 2 !== DOMAIN_MCSPDU.CHANNEL_JOIN_CONFIRM) {
+    throw new Error(`RDP: expected an MCS channel-join confirm, got PDU ${header >> 2}`);
+  }
+
+  const result = reader.u8();
+  reader.u16be(); // initiator
+  const requested = reader.u16be();
+  if (result !== 0) {
+    throw new Error(`RDP: the host refused to join channel ${requested} (result ${result})`);
+  }
+
+  // The confirmed channel id is normally echoed after the requested one.
+  const channelId = reader.remaining >= 2 ? reader.u16be() : requested;
+  return { channelId: channelId || requested };
+}
+
+export function sendDataRequest(userId: number, channelId: number, payload: Uint8Array) {
+  const writer = new Writer(payload.length + 16);
+  writer.u8(domainHeader(DOMAIN_MCSPDU.SEND_DATA_REQUEST));
+  writer.u16be(userId - MCS_BASE_CHANNEL_ID);
+  writer.u16be(channelId);
+  writer.u8(0x70); // dataPriority high, segmentation begin + end
+  perLength(writer, payload.length);
+  writer.raw(payload);
+  return dataFrame(writer.take());
+}
+
+/**
+ * Classify an inbound X.224 data frame. Everything the server sends after the
+ * connect sequence arrives as a send-data indication on some channel.
+ */
+export function parseDomainPdu(frame: Uint8Array) {
+  const reader = new Reader(dataPayload(frame));
+  const header = reader.u8();
+  const type = header >> 2;
+
+  if (type === DOMAIN_MCSPDU.SEND_DATA_INDICATION) {
+    reader.u16be(); // initiator
+    const channelId = reader.u16be();
+    reader.u8();    // flags
+    const length = perReadLength(reader);
+    const payload = reader.rest();
+    return {
+      type: 'send-data',
+      channelId,
+      payload: payload.subarray(0, Math.min(length, payload.length)),
+    };
+  }
+
+  if (type === DOMAIN_MCSPDU.DISCONNECT_PROVIDER_ULTIMATUM) {
+    // The reason straddles a byte boundary: one bit from the header, one from
+    // the byte that follows (MS-RDPBCGR 2.2.2.3).
+    const reason = ((header & 0x01) << 1) | (reader.remaining > 0 ? reader.u8() >> 7 : 0);
+    return {
+      type: 'disconnect',
+      reason,
+      message: DISCONNECT_REASONS[reason] || `The host closed the RDP session (reason ${reason}).`,
+    };
+  }
+
+  return { type: 'other', mcsPduType: type };
+}