ai-remote 0.4.0 → 0.4.2

package/src/protocols/rdp/caps.ts

@@ -1,304 +0,0 @@
-// Capability exchange (MS-RDPBCGR 2.2.7).
-//
-// This client deliberately advertises no drawing-order support and no bitmap
-// cache, which makes the host fall back to plain bitmap updates for the whole
-// screen. That is the one output path a from-scratch client can implement
-// correctly, and it is what keeps the rest of this module small.
-
-import { Reader, Writer, concatBytes } from './buffer';
-
-export const CAPSET = {
-  GENERAL: 1,
-  BITMAP: 2,
-  ORDER: 3,
-  BITMAPCACHE: 4,
-  CONTROL: 5,
-  ACTIVATION: 7,
-  POINTER: 8,
-  SHARE: 9,
-  COLORCACHE: 10,
-  SOUND: 12,
-  INPUT: 13,
-  FONT: 14,
-  BRUSH: 15,
-  GLYPHCACHE: 16,
-  OFFSCREENCACHE: 17,
-  VIRTUALCHANNEL: 20,
-  RAIL: 23,
-  WINDOW: 24,
-  MULTIFRAGMENTUPDATE: 26,
-  LARGE_POINTER: 27,
-  SURFACE_COMMANDS: 28,
-  BITMAP_CODECS: 29,
-};
-
-const INPUT_FLAG_SCANCODES = 0x0001;
-const INPUT_FLAG_MOUSEX = 0x0004;
-const INPUT_FLAG_UNICODE = 0x0010;
-
-const FASTPATH_OUTPUT_SUPPORTED = 0x0001;
-const LONG_CREDENTIALS_SUPPORTED = 0x0004;
-const NEGOTIATE_ORDER_SUPPORT = 0x0002;
-const ZERO_BOUNDS_DELTA_SUPPORT = 0x0008;
-
-function capabilitySet(type: number, body: Uint8Array) {
-  const writer = new Writer(body.length + 4);
-  writer.u16le(type).u16le(body.length + 4).raw(body);
-  return writer.take();
-}
-
-function generalCapability() {
-  const writer = new Writer(24);
-  writer.u16le(1);                            // osMajorType: Windows
-  writer.u16le(3);                            // osMinorType: Windows NT
-  writer.u16le(0x0200);                       // protocolVersion
-  writer.u16le(0);                            // pad
-  writer.u16le(0);                            // generalCompressionTypes
-  // Fast-path output has to be advertised. Windows 8 and later send graphics
-  // only on the fast path, so a client that asks for the slow path alone gets a
-  // clean session that never paints anything.
-  writer.u16le(FASTPATH_OUTPUT_SUPPORTED | LONG_CREDENTIALS_SUPPORTED); // extraFlags
-  writer.u16le(0);                            // updateCapabilityFlag
-  writer.u16le(0);                            // remoteUnshareFlag
-  writer.u16le(0);                            // generalCompressionLevel
-  // Both are declarations that the client may SEND these PDUs. The initial
-  // full-screen paint depends on it: a host that thinks the client cannot ask
-  // for a refresh has no reason to honour the request.
-  writer.u8(1);                               // refreshRectSupport
-  writer.u8(1);                               // suppressOutputSupport
-  return capabilitySet(CAPSET.GENERAL, writer.take());
-}
-
-function bitmapCapability(width: number, height: number) {
-  const writer = new Writer(28);
-  writer.u16le(16);      // preferredBitsPerPixel
-  writer.u16le(1);       // receive1BitPerPixel
-  writer.u16le(1);       // receive4BitsPerPixel
-  writer.u16le(1);       // receive8BitsPerPixel
-  writer.u16le(width);
-  writer.u16le(height);
-  writer.u16le(0);       // pad
-  writer.u16le(1);       // desktopResizeFlag
-  writer.u16le(1);       // bitmapCompressionFlag
-  writer.u8(0);          // highColorFlags
-  writer.u8(0);          // drawingFlags
-  writer.u16le(1);       // multipleRectangleSupport
-  writer.u16le(0);       // pad
-  return capabilitySet(CAPSET.BITMAP, writer.take());
-}
-
-function orderCapability() {
-  const writer = new Writer(88);
-  writer.zeros(16);                                             // terminalDescriptor
-  writer.u32le(0);                                              // pad
-  writer.u16le(1);                                              // desktopSaveXGranularity
-  writer.u16le(20);                                             // desktopSaveYGranularity
-  writer.u16le(0);                                              // pad
-  writer.u16le(1);                                              // maximumOrderLevel
-  writer.u16le(0);                                              // numberFonts
-  writer.u16le(NEGOTIATE_ORDER_SUPPORT | ZERO_BOUNDS_DELTA_SUPPORT);
-  writer.zeros(32);                                             // orderSupport: none
-  writer.u16le(0);                                              // textFlags
-  writer.u16le(0);                                              // orderSupportExFlags
-  writer.u32le(0);                                              // pad
-  writer.u32le(230400);                                         // desktopSaveSize
-  writer.u16le(0);                                              // pad
-  writer.u16le(0);                                              // pad
-  writer.u16le(0);                                              // textANSICodePage
-  writer.u16le(0);                                              // pad
-  return capabilitySet(CAPSET.ORDER, writer.take());
-}
-
-/** Zero entries in every cache: the host must send bitmaps, never cache hits. */
-function bitmapCacheCapability() {
-  const writer = new Writer(40);
-  writer.zeros(24); // pad1..pad6
-  writer.u16le(0).u16le(0);
-  writer.u16le(0).u16le(0);
-  writer.u16le(0).u16le(0);
-  return capabilitySet(CAPSET.BITMAPCACHE, writer.take());
-}
-
-function controlCapability() {
-  const writer = new Writer(12);
-  writer.u16le(0);  // controlFlags
-  writer.u16le(0);  // remoteDetachFlag
-  writer.u16le(2);  // controlInterest: never
-  writer.u16le(2);  // detachInterest: never
-  return capabilitySet(CAPSET.CONTROL, writer.take());
-}
-
-function activationCapability() {
-  const writer = new Writer(12);
-  writer.u16le(0).u16le(0).u16le(0).u16le(0);
-  return capabilitySet(CAPSET.ACTIVATION, writer.take());
-}
-
-function pointerCapability() {
-  const writer = new Writer(10);
-  writer.u16le(1);   // colorPointerFlag
-  writer.u16le(20);  // colorPointerCacheSize
-  writer.u16le(20);  // pointerCacheSize
-  return capabilitySet(CAPSET.POINTER, writer.take());
-}
-
-function shareCapability() {
-  const writer = new Writer(8);
-  writer.u16le(0).u16le(0);
-  return capabilitySet(CAPSET.SHARE, writer.take());
-}
-
-function colorCacheCapability() {
-  const writer = new Writer(8);
-  writer.u16le(6).u16le(0);
-  return capabilitySet(CAPSET.COLORCACHE, writer.take());
-}
-
-function soundCapability() {
-  const writer = new Writer(8);
-  writer.u16le(0).u16le(0);
-  return capabilitySet(CAPSET.SOUND, writer.take());
-}
-
-function inputCapability(keyboardLayout: number) {
-  const writer = new Writer(88);
-  writer.u16le(INPUT_FLAG_SCANCODES | INPUT_FLAG_MOUSEX | INPUT_FLAG_UNICODE);
-  writer.u16le(0);                 // pad
-  writer.u32le(keyboardLayout);
-  writer.u32le(4);                 // keyboardType: IBM enhanced
-  writer.u32le(0);                 // keyboardSubType
-  writer.u32le(12);                // keyboardFunctionKey
-  writer.zeros(64);                // imeFileName
-  return capabilitySet(CAPSET.INPUT, writer.take());
-}
-
-function fontCapability() {
-  const writer = new Writer(8);
-  writer.u16le(1).u16le(0);
-  return capabilitySet(CAPSET.FONT, writer.take());
-}
-
-function brushCapability() {
-  const writer = new Writer(8);
-  writer.u32le(0); // BRUSH_DEFAULT
-  return capabilitySet(CAPSET.BRUSH, writer.take());
-}
-
-function glyphCacheCapability() {
-  const writer = new Writer(52);
-  for (let i = 0; i < 10; i++) writer.u16le(0).u16le(0); // GlyphCache entries
-  writer.u32le(0);  // FragCache
-  writer.u16le(0);  // GLYPH_SUPPORT_NONE
-  writer.u16le(0);  // pad
-  return capabilitySet(CAPSET.GLYPHCACHE, writer.take());
-}
-
-function offscreenCacheCapability() {
-  const writer = new Writer(12);
-  writer.u32le(0);  // offscreenSupportLevel: none
-  writer.u16le(0);  // offscreenCacheSize
-  writer.u16le(0);  // offscreenCacheEntries
-  return capabilitySet(CAPSET.OFFSCREENCACHE, writer.take());
-}
-
-function remoteProgramsCapability() {
-  const writer = new Writer(4);
-  writer.u32le(0x00000001); // TS_RAIL_LEVEL_SUPPORTED
-  return capabilitySet(CAPSET.RAIL, writer.take());
-}
-
-function windowListCapability(iconCaches = 0, iconCacheEntries = 0) {
-  const writer = new Writer(7);
-  writer.u32le(0x00000001); // TS_WINDOW_LEVEL_SUPPORTED
-  writer.u8(iconCaches);
-  writer.u16le(iconCacheEntries);
-  return capabilitySet(CAPSET.WINDOW, writer.take());
-}
-
-export function buildClientCapabilities({ width, height, keyboardLayout, remoteApp = false, remoteAppCaps = null }) {
-  const sets = [
-    generalCapability(),
-    bitmapCapability(width, height),
-    orderCapability(),
-    bitmapCacheCapability(),
-    colorCacheCapability(),
-    activationCapability(),
-    controlCapability(),
-    pointerCapability(),
-    shareCapability(),
-    inputCapability(keyboardLayout),
-    brushCapability(),
-    glyphCacheCapability(),
-    soundCapability(),
-    fontCapability(),
-    offscreenCacheCapability(),
-  ];
-
-  if (remoteApp) {
-    sets.push(remoteProgramsCapability());
-    sets.push(windowListCapability(
-      remoteAppCaps?.numIconCaches || 0,
-      remoteAppCaps?.numIconCacheEntries || 0
-    ));
-  }
-
-  return { bytes: concatBytes(...sets), count: sets.length };
-}
-
-/**
- * Read the host's Demand Active capabilities. The desktop size it reports wins
- * over anything the client asked for.
- */
-export function parseServerCapabilities(bytes: Uint8Array) {
-  const reader = new Reader(bytes);
-  const numberCapabilities = reader.u16le();
-  reader.u16le(); // pad
-
-  const result = {
-    desktopWidth: 0,
-    desktopHeight: 0,
-    preferredBitsPerPixel: 16,
-    refreshRectSupport: false,
-    railSupportLevel: 0,
-    windowSupportLevel: 0,
-    numIconCaches: 0,
-    numIconCacheEntries: 0,
-    types: [],
-  };
-
-  for (let i = 0; i < numberCapabilities && reader.remaining >= 4; i++) {
-    const type = reader.u16le();
-    const length = reader.u16le();
-    if (length < 4 || length - 4 > reader.remaining) break;
-    const body = new Reader(reader.raw(length - 4));
-    result.types.push(type);
-
-    if (type === CAPSET.BITMAP && body.remaining >= 20) {
-      result.preferredBitsPerPixel = body.u16le();
-      body.skip(6); // receive1/4/8BitsPerPixel
-      result.desktopWidth = body.u16le();
-      result.desktopHeight = body.u16le();
-      continue;
-    }
-
-    if (type === CAPSET.GENERAL && body.remaining >= 20) {
-      body.skip(18);
-      result.refreshRectSupport = body.u8() !== 0;
-      continue;
-    }
-
-    if (type === CAPSET.RAIL && body.remaining >= 4) {
-      result.railSupportLevel = body.u32le();
-      continue;
-    }
-
-    if (type === CAPSET.WINDOW && body.remaining >= 7) {
-      result.windowSupportLevel = body.u32le();
-      result.numIconCaches = body.u8();
-      result.numIconCacheEntries = body.u16le();
-      continue;
-    }
-  }
-
-  return result;
-}

package/src/protocols/rdp/cert.ts

@@ -1,190 +0,0 @@
-// Server public key extraction for the RDP Standard Security layer.
-//
-// A host either hands out a "proprietary" certificate -- little more than a
-// wrapper around an RSA public key -- or an X.509 chain whose leaf holds the
-// key (MS-RDPBCGR 2.2.1.4.3.1). Either way the client random is encrypted with
-// that key, so all we need out of it is a modulus and an exponent.
-//
-// Note the proprietary certificate is signed with a private key Microsoft
-// published, so it authenticates nothing: RDP Standard Security gives
-// confidentiality on the wire, not proof of the host's identity.
-
-import { Reader } from './buffer';
-
-const CERT_PROPRIETARY = 1;
-const CERT_X509 = 2;
-const RSA1_MAGIC = 0x31415352;
-const BB_RSA_KEY_BLOB = 0x0006;
-
-const OID_RSA_ENCRYPTION = [0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01];
-
-// --- DER --------------------------------------------------------------------
-
-function derRead(bytes: Uint8Array, offset: number) {
-  let cursor = offset;
-  const tag = bytes[cursor++];
-
-  let length = bytes[cursor++];
-  if (length & 0x80) {
-    const byteCount = length & 0x7f;
-    length = 0;
-    for (let i = 0; i < byteCount; i++) length = (length << 8) | bytes[cursor++];
-  }
-
-  return {
-    tag,
-    contentStart: cursor,
-    contentEnd: cursor + length,
-    next: cursor + length,
-    content: bytes.subarray(cursor, cursor + length),
-  };
-}
-
-function derChildren(bytes: Uint8Array) {
-  const children = [];
-  let offset = 0;
-  while (offset < bytes.length) {
-    const node = derRead(bytes, offset);
-    children.push(node);
-    if (node.next <= offset) break;
-    offset = node.next;
-  }
-  return children;
-}
-
-function containsOid(bytes: Uint8Array, oid: string) {
-  outer: for (let i = 0; i + oid.length <= bytes.length; i++) {
-    for (let j = 0; j < oid.length; j++) {
-      if (bytes[i + j] !== oid[j]) continue outer;
-    }
-    return true;
-  }
-  return false;
-}
-
-/** Big-endian DER integer -> little-endian bytes with the sign byte removed. */
-function derIntegerToLe(content: Uint8Array) {
-  let start = 0;
-  while (start < content.length - 1 && content[start] === 0x00) start++;
-  return content.subarray(start).slice().reverse();
-}
-
-/**
- * Find SubjectPublicKeyInfo in an X.509 certificate and return the RSA key.
- * The structure is walked rather than indexed by position: optional fields in
- * TBSCertificate make fixed offsets wrong for many real certificates.
- */
-function rsaKeyFromX509(der: Uint8Array) {
-  const certificate = derRead(der, 0);
-  const tbsCertificate = derRead(der, certificate.contentStart);
-
-  for (const child of derChildren(tbsCertificate.content)) {
-    if (child.tag !== 0x30) continue;
-
-    const parts = derChildren(child.content);
-    if (parts.length < 2) continue;
-    if (parts[0].tag !== 0x30 || !containsOid(parts[0].content, OID_RSA_ENCRYPTION)) continue;
-    if (parts[1].tag !== 0x03) continue;
-
-    // BIT STRING content starts with an "unused bits" count.
-    const publicKey = derRead(parts[1].content.subarray(1), 0);
-    const [modulus, exponent] = derChildren(publicKey.content);
-    if (!modulus || !exponent) break;
-
-    return {
-      modulus: derIntegerToLe(modulus.content),
-      exponent: derIntegerToLe(exponent.content),
-      source: 'x509',
-    };
-  }
-
-  throw new Error('RDP: no RSA public key found in the host X.509 certificate');
-}
-
-function rsaKeyFromProprietary(reader: Reader) {
-  reader.u32le(); // dwSigAlgId
-  reader.u32le(); // dwKeyAlgId
-
-  const publicKeyBlobType = reader.u16le();
-  const publicKeyBlobLength = reader.u16le();
-  if (publicKeyBlobType !== BB_RSA_KEY_BLOB) {
-    throw new Error(`RDP: unsupported public key blob type 0x${publicKeyBlobType.toString(16)}`);
-  }
-
-  const blob = new Reader(reader.raw(publicKeyBlobLength));
-  if (blob.u32le() !== RSA1_MAGIC) {
-    throw new Error('RDP: the host RSA public key blob is not in RSA1 format');
-  }
-
-  const keyLength = blob.u32le();
-  blob.u32le(); // bitlen
-  blob.u32le(); // datalen
-  const exponent = blob.raw(4).slice();
-
-  // The blob reserves 8 trailing bytes of padding after the modulus.
-  if (keyLength < 9) throw new Error('RDP: the host RSA modulus is too short');
-  const modulus = blob.raw(keyLength - 8).slice();
-
-  return { modulus, exponent, source: 'proprietary' };
-}
-
-/**
- * Pull the RSA public key out of a DER X.509 certificate, for the TLS layer.
- *
- * CredSSP needs the exact bytes of the certificate's subjectPublicKey BIT
- * STRING contents -- the DER RSAPublicKey -- because that is what both ends
- * hash to bind the authentication to this TLS channel (MS-CSSP 3.1.5).
- */
-export function parseX509PublicKey(der: Uint8Array) {
-  const certificate = derRead(der, 0);
-  const tbsCertificate = derRead(der, certificate.contentStart);
-
-  for (const child of derChildren(tbsCertificate.content)) {
-    if (child.tag !== 0x30) continue;
-
-    const parts = derChildren(child.content);
-    if (parts.length < 2) continue;
-    if (parts[0].tag !== 0x30 || !containsOid(parts[0].content, OID_RSA_ENCRYPTION)) continue;
-    if (parts[1].tag !== 0x03) continue;
-
-    const subjectPublicKey = parts[1].content.subarray(1); // drop the unused-bit count
-    const publicKey = derRead(subjectPublicKey, 0);
-    const [modulus, exponent] = derChildren(publicKey.content);
-    if (!modulus || !exponent) break;
-
-    const stripLeadingZero = (bytes: Uint8Array) => {
-      let start = 0;
-      while (start < bytes.length - 1 && bytes[start] === 0x00) start++;
-      return bytes.subarray(start);
-    };
-
-    return {
-      modulus: stripLeadingZero(modulus.content),
-      exponent: stripLeadingZero(exponent.content),
-      subjectPublicKey,
-    };
-  }
-
-  throw new Error('TLS: no RSA public key found in the host certificate');
-}
-
-/** Parse a server certificate blob into an RSA public key. */
-export function parseServerCertificate(certificateBytes: Uint8Array) {
-  const reader = new Reader(certificateBytes);
-  const version = reader.u32le() & 0x7fffffff;
-
-  if (version === CERT_PROPRIETARY) return rsaKeyFromProprietary(reader);
-
-  if (version === CERT_X509) {
-    const certificateCount = reader.u32le();
-    let leaf = null;
-    for (let i = 0; i < certificateCount; i++) {
-      const length = reader.u32le();
-      leaf = reader.raw(length);
-    }
-    if (!leaf) throw new Error('RDP: the host sent an empty X.509 certificate chain');
-    return rsaKeyFromX509(leaf);
-  }
-
-  throw new Error(`RDP: unsupported server certificate version ${version}`);
-}