libfreerdp-core/nego.c

   1 /**
   2  * FreeRDP: A Remote Desktop Protocol Client
   3  * RDP Protocol Security Negotiation
   4  *
   5  * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
   6  *
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *     http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  */
  19
  20 #include <stdio.h>
  21 #include <string.h>
  22
  23 #include <freerdp/constants.h>
  24 #include <freerdp/utils/memory.h>
  25
  26 #include "tpkt.h"
  27
  28 #include "nego.h"
  29
  30 #include "transport.h"
  31
  32 static const char* const NEGO_STATE_STRINGS[] =
  33 {
  34         "NEGO_STATE_INITIAL",
  35         "NEGO_STATE_NLA",
  36         "NEGO_STATE_TLS",
  37         "NEGO_STATE_RDP",
  38         "NEGO_STATE_FAIL",
  39         "NEGO_STATE_FINAL"
  40 };
  41
  42 static const char PROTOCOL_SECURITY_STRINGS[3][4] =
  43 {
  44         "RDP",
  45         "TLS",
  46         "NLA"
  47 };
  48
  49 boolean nego_security_connect(rdpNego* nego);
  50
  51 /**
  52  * Negotiate protocol security and connect.
  53  * @param nego
  54  * @return
  55  */
  56
  57 boolean nego_connect(rdpNego* nego)
  58 {
  59         if (nego->state == NEGO_STATE_INITIAL)
  60         {
  61                 if (nego->enabled_protocols[PROTOCOL_NLA] > 0)
  62                         nego->state = NEGO_STATE_NLA;
  63                 else if (nego->enabled_protocols[PROTOCOL_TLS] > 0)
  64                         nego->state = NEGO_STATE_TLS;
  65                 else if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
  66                         nego->state = NEGO_STATE_RDP;
  67                 else
  68                 {
  69                         DEBUG_NEGO("No security protocol is enabled");
  70                         nego->state = NEGO_STATE_FAIL;
  71                 }
  72
  73                 if (!nego->security_layer_negotiation_enabled)
  74                 {
  75                         DEBUG_NEGO("Security Layer Negotiation is disabled");
  76                         nego->enabled_protocols[PROTOCOL_NLA] = 0;
  77                         nego->enabled_protocols[PROTOCOL_TLS] = 0;
  78                         nego->enabled_protocols[PROTOCOL_RDP] = 0;
  79                         if(nego->state == NEGO_STATE_NLA)
  80                                 nego->enabled_protocols[PROTOCOL_NLA] = 1;
  81                         else if (nego->state == NEGO_STATE_TLS)
  82                                 nego->enabled_protocols[PROTOCOL_TLS] = 1;
  83                         else if (nego->state == NEGO_STATE_RDP)
  84                                 nego->enabled_protocols[PROTOCOL_RDP] = 1;
  85                 }
  86
  87                 if(!nego_send_preconnection_pdu(nego))
  88                 {
  89                         DEBUG_NEGO("Failed to send preconnection information");
  90                         nego->state = NEGO_STATE_FINAL;
  91                         return false;
  92                 }
  93         }
  94
  95         do
  96         {
  97                 DEBUG_NEGO("state: %s", NEGO_STATE_STRINGS[nego->state]);
  98
  99                 nego_send(nego);
 100
 101                 if (nego->state == NEGO_STATE_FAIL)
 102                 {
 103                         DEBUG_NEGO("Protocol Security Negotiation Failure");
 104                         nego->state = NEGO_STATE_FINAL;
 105                         return false;
 106                 }
 107         }
 108         while (nego->state != NEGO_STATE_FINAL);
 109
 110         DEBUG_NEGO("Negotiated %s security", PROTOCOL_SECURITY_STRINGS[nego->selected_protocol]);
 111
 112         /* update settings with negotiated protocol security */
 113         nego->transport->settings->requested_protocols = nego->requested_protocols;
 114         nego->transport->settings->selected_protocol = nego->selected_protocol;
 115         nego->transport->settings->negotiationFlags = nego->flags;
 116
 117         if(nego->selected_protocol == PROTOCOL_RDP)
 118         {
 119                 nego->transport->settings->encryption = true;
 120                 nego->transport->settings->encryption_method = ENCRYPTION_METHOD_40BIT | ENCRYPTION_METHOD_128BIT | ENCRYPTION_METHOD_FIPS;
 121                 nego->transport->settings->encryption_level = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
 122         }
 123
 124         /* finally connect security layer (if not already done) */
 125         if(!nego_security_connect(nego))
 126         {
 127                 DEBUG_NEGO("Failed to connect with %s security", PROTOCOL_SECURITY_STRINGS[nego->selected_protocol]);
 128                 return false;
 129         }
 130
 131         return true;
 132 }
 133
 134 /* connect to selected security layer */
 135 boolean nego_security_connect(rdpNego* nego)
 136 {
 137         if(!nego->tcp_connected)
 138         {
 139                 nego->security_connected = false;
 140         }
 141         else if (!nego->security_connected)
 142         {
 143                 if (nego->enabled_protocols[PROTOCOL_NLA] > 0)
 144                         nego->security_connected = transport_connect_nla(nego->transport);
 145                 else if (nego->enabled_protocols[PROTOCOL_TLS] > 0)
 146                         nego->security_connected = transport_connect_tls(nego->transport);
 147                 else if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
 148                         nego->security_connected = transport_connect_rdp(nego->transport);
 149         }
 150         return nego->security_connected;
 151 }
 152
 153 /**
 154  * Connect TCP layer.
 155  * @param nego
 156  * @return
 157  */
 158
 159 boolean nego_tcp_connect(rdpNego* nego)
 160 {
 161         if (!nego->tcp_connected)
 162                 nego->tcp_connected = transport_connect(nego->transport, nego->hostname, nego->port);
 163         return nego->tcp_connected;
 164 }
 165
 166 /**
 167  * Connect TCP layer. For direct approach, connect security layer as well.
 168  * @param nego
 169  * @return
 170  */
 171
 172 boolean nego_transport_connect(rdpNego* nego)
 173 {
 174         nego_tcp_connect(nego);
 175
 176         if (nego->tcp_connected && !nego->security_layer_negotiation_enabled)
 177                 return nego_security_connect(nego);
 178
 179         return nego->tcp_connected;
 180 }
 181
 182 /**
 183  * Disconnect TCP layer.
 184  * @param nego
 185  * @return
 186  */
 187
 188 int nego_transport_disconnect(rdpNego* nego)
 189 {
 190         if (nego->tcp_connected)
 191                 transport_disconnect(nego->transport);
 192
 193         nego->tcp_connected = 0;
 194         nego->security_connected = 0;
 195         return 1;
 196 }
 197
 198 /**
 199  * Send preconnection information if enabled.
 200  * @param nego
 201  * @return
 202  */
 203
 204 boolean nego_send_preconnection_pdu(rdpNego* nego)
 205 {
 206         STREAM* s;
 207         uint32 cbSize;
 208         UNICONV* uniconv;
 209         uint16 cchPCB_times2 = 0;
 210         char* wszPCB = NULL;
 211
 212         if(!nego->send_preconnection_pdu)
 213                 return true;
 214
 215         DEBUG_NEGO("Sending preconnection PDU");
 216         if(!nego_tcp_connect(nego))
 217                 return false;
 218
 219         /* it's easier to always send the version 2 PDU, and it's just 2 bytes overhead */
 220         cbSize = PRECONNECTION_PDU_V2_MIN_SIZE;
 221         if(nego->preconnection_blob) {
 222                 uniconv = freerdp_uniconv_new();
 223                 wszPCB = freerdp_uniconv_out(uniconv, nego->preconnection_blob, &cchPCB_times2);
 224                 freerdp_uniconv_free(uniconv);
 225                 cchPCB_times2 += 2; /* zero-termination */
 226                 cbSize += cchPCB_times2;
 227         }
 228
 229         s = transport_send_stream_init(nego->transport, cbSize);
 230         stream_write_uint32(s, cbSize); /* cbSize */
 231         stream_write_uint32(s, 0); /* Flags */
 232         stream_write_uint32(s, PRECONNECTION_PDU_V2); /* Version */
 233         stream_write_uint32(s, nego->preconnection_id); /* Id */
 234         stream_write_uint16(s, cchPCB_times2 / 2); /* cchPCB */
 235         if(wszPCB)
 236         {
 237                 stream_write(s, wszPCB, cchPCB_times2); /* wszPCB */
 238                 xfree(wszPCB);
 239         }
 240
 241         if (transport_write(nego->transport, s) < 0)
 242                 return false;
 243
 244         return true;
 245 }
 246
 247 /**
 248  * Attempt negotiating NLA + TLS security.
 249  * @param nego
 250  */
 251
 252 void nego_attempt_nla(rdpNego* nego)
 253 {
 254         nego->requested_protocols = PROTOCOL_NLA | PROTOCOL_TLS;
 255
 256         DEBUG_NEGO("Attempting NLA security");
 257
 258         if (!nego_transport_connect(nego))
 259         {
 260                 nego->state = NEGO_STATE_FAIL;
 261                 return;
 262         }
 263
 264         if (!nego_send_negotiation_request(nego))
 265         {
 266                 nego->state = NEGO_STATE_FAIL;
 267                 return;
 268         }
 269
 270         if (!nego_recv_response(nego))
 271         {
 272                 nego->state = NEGO_STATE_FAIL;
 273                 return;
 274         }
 275
 276         if (nego->state != NEGO_STATE_FINAL)
 277         {
 278                 nego_transport_disconnect(nego);
 279
 280                 if (nego->enabled_protocols[PROTOCOL_TLS] > 0)
 281                         nego->state = NEGO_STATE_TLS;
 282                 else if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
 283                         nego->state = NEGO_STATE_RDP;
 284                 else
 285                         nego->state = NEGO_STATE_FAIL;
 286         }
 287 }
 288
 289 /**
 290  * Attempt negotiating TLS security.
 291  * @param nego
 292  */
 293
 294 void nego_attempt_tls(rdpNego* nego)
 295 {
 296         nego->requested_protocols = PROTOCOL_TLS;
 297
 298         DEBUG_NEGO("Attempting TLS security");
 299
 300         if (!nego_transport_connect(nego))
 301         {
 302                 nego->state = NEGO_STATE_FAIL;
 303                 return;
 304         }
 305
 306         if (!nego_send_negotiation_request(nego))
 307         {
 308                 nego->state = NEGO_STATE_FAIL;
 309                 return;
 310         }
 311
 312         if (!nego_recv_response(nego))
 313         {
 314                 nego->state = NEGO_STATE_FAIL;
 315                 return;
 316         }
 317
 318         if (nego->state != NEGO_STATE_FINAL)
 319         {
 320                 nego_transport_disconnect(nego);
 321
 322                 if (nego->enabled_protocols[PROTOCOL_RDP] > 0)
 323                         nego->state = NEGO_STATE_RDP;
 324                 else
 325                         nego->state = NEGO_STATE_FAIL;
 326         }
 327 }
 328
 329 /**
 330  * Attempt negotiating standard RDP security.
 331  * @param nego
 332  */
 333
 334 void nego_attempt_rdp(rdpNego* nego)
 335 {
 336         nego->requested_protocols = PROTOCOL_RDP;
 337
 338         DEBUG_NEGO("Attempting RDP security");
 339
 340         if (!nego_transport_connect(nego))
 341         {
 342                 nego->state = NEGO_STATE_FAIL;
 343                 return;
 344         }
 345
 346         if (!nego_send_negotiation_request(nego))
 347         {
 348                 nego->state = NEGO_STATE_FAIL;
 349                 return;
 350         }
 351
 352         if (!nego_recv_response(nego))
 353         {
 354                 nego->state = NEGO_STATE_FAIL;
 355                 return;
 356         }
 357 }
 358
 359 /**
 360  * Wait to receive a negotiation response
 361  * @param nego
 362  */
 363
 364 boolean nego_recv_response(rdpNego* nego)
 365 {
 366         STREAM* s = transport_recv_stream_init(nego->transport, 1024);
 367         if (transport_read(nego->transport, s) < 0)
 368                 return false;
 369         return nego_recv(nego->transport, s, nego);
 370 }
 371
 372 /**
 373  * Receive protocol security negotiation message.\n
 374  * @msdn{cc240501}
 375  * @param transport transport
 376  * @param s stream
 377  * @param extra nego pointer
 378  */
 379
 380 boolean nego_recv(rdpTransport* transport, STREAM* s, void* extra)
 381 {
 382         uint8 li;
 383         uint8 type;
 384         rdpNego* nego = (rdpNego*) extra;
 385
 386         if (tpkt_read_header(s) == 0)
 387                 return false;
 388
 389         li = tpdu_read_connection_confirm(s);
 390
 391         if (li > 6)
 392         {
 393                 /* rdpNegData (optional) */
 394
 395                 stream_read_uint8(s, type); /* Type */
 396
 397                 switch (type)
 398                 {
 399                         case TYPE_RDP_NEG_RSP:
 400                                 nego_process_negotiation_response(nego, s);
 401                                 break;
 402
 403                         case TYPE_RDP_NEG_FAILURE:
 404                                 nego_process_negotiation_failure(nego, s);
 405                                 break;
 406                 }
 407         }
 408         else
 409         {
 410                 nego->state = NEGO_STATE_FINAL;
 411         }
 412
 413         return true;
 414 }
 415
 416 /**
 417  * Read protocol security negotiation request message.\n
 418  * @param nego
 419  * @param s stream
 420  */
 421
 422 boolean nego_read_request(rdpNego* nego, STREAM* s)
 423 {
 424         uint8 li;
 425         uint8 c;
 426         uint8 type;
 427
 428         tpkt_read_header(s);
 429         li = tpdu_read_connection_request(s);
 430         if (li != stream_get_left(s) + 6)
 431         {
 432                 printf("Incorrect TPDU length indicator.\n");
 433                 return false;
 434         }
 435
 436         if (stream_get_left(s) > 8)
 437         {
 438                 /* Optional routingToken or cookie, ending with CR+LF */
 439                 while (stream_get_left(s) > 0)
 440                 {
 441                         stream_read_uint8(s, c);
 442                         if (c != '\x0D')
 443                                 continue;
 444                         stream_peek_uint8(s, c);
 445                         if (c != '\x0A')
 446                                 continue;
 447
 448                         stream_seek_uint8(s);
 449                         break;
 450                 }
 451         }
 452
 453         if (stream_get_left(s) >= 8)
 454         {
 455                 /* rdpNegData (optional) */
 456
 457                 stream_read_uint8(s, type); /* Type */
 458                 if (type != TYPE_RDP_NEG_REQ)
 459                 {
 460                         printf("Incorrect negotiation request type %d\n", type);
 461                         return false;
 462                 }
 463
 464                 nego_process_negotiation_request(nego, s);
 465         }
 466
 467         return true;
 468 }
 469
 470 /**
 471  * Send protocol security negotiation message.
 472  * @param nego
 473  */
 474
 475 void nego_send(rdpNego* nego)
 476 {
 477         if (nego->state == NEGO_STATE_NLA)
 478                 nego_attempt_nla(nego);
 479         else if (nego->state == NEGO_STATE_TLS)
 480                 nego_attempt_tls(nego);
 481         else if (nego->state == NEGO_STATE_RDP)
 482                 nego_attempt_rdp(nego);
 483         else
 484                 DEBUG_NEGO("invalid negotiation state for sending");
 485 }
 486
 487 /**
 488  * Send RDP Negotiation Request (RDP_NEG_REQ).\n
 489  * @msdn{cc240500}\n
 490  * @msdn{cc240470}
 491  * @param nego
 492  */
 493
 494 boolean nego_send_negotiation_request(rdpNego* nego)
 495 {
 496         STREAM* s;
 497         int length;
 498         uint8 *bm, *em;
 499
 500         s = transport_send_stream_init(nego->transport, 256);
 501         length = TPDU_CONNECTION_REQUEST_LENGTH;
 502         stream_get_mark(s, bm);
 503         stream_seek(s, length);
 504
 505         if (nego->routing_token != NULL)
 506         {
 507                 stream_write(s, nego->routing_token->data, nego->routing_token->length);
 508                 length += nego->routing_token->length;
 509         }
 510         else if (nego->cookie != NULL)
 511         {
 512                 int cookie_length = strlen(nego->cookie);
 513                 stream_write(s, "Cookie: mstshash=", 17);
 514                 stream_write(s, (uint8*)nego->cookie, cookie_length);
 515                 stream_write_uint8(s, 0x0D); /* CR */
 516                 stream_write_uint8(s, 0x0A); /* LF */
 517                 length += cookie_length + 19;
 518         }
 519
 520         if (nego->requested_protocols > PROTOCOL_RDP)
 521         {
 522                 /* RDP_NEG_DATA must be present for TLS and NLA */
 523                 stream_write_uint8(s, TYPE_RDP_NEG_REQ);
 524                 stream_write_uint8(s, 0); /* flags, must be set to zero */
 525                 stream_write_uint16(s, 8); /* RDP_NEG_DATA length (8) */
 526                 stream_write_uint32(s, nego->requested_protocols); /* requestedProtocols */
 527                 length += 8;
 528         }
 529
 530         stream_get_mark(s, em);
 531         stream_set_mark(s, bm);
 532         tpkt_write_header(s, length);
 533         tpdu_write_connection_request(s, length - 5);
 534         stream_set_mark(s, em);
 535
 536         if (transport_write(nego->transport, s) < 0)
 537                 return false;
 538
 539         return true;
 540 }
 541
 542 /**
 543  * Process Negotiation Request from Connection Request message.
 544  * @param nego
 545  * @param s
 546  */
 547
 548 void nego_process_negotiation_request(rdpNego* nego, STREAM* s)
 549 {
 550         uint8 flags;
 551         uint16 length;
 552
 553         DEBUG_NEGO("RDP_NEG_REQ");
 554
 555         stream_read_uint8(s, flags);
 556         stream_read_uint16(s, length);
 557         stream_read_uint32(s, nego->requested_protocols);
 558
 559         nego->state = NEGO_STATE_FINAL;
 560 }
 561
 562 /**
 563  * Process Negotiation Response from Connection Confirm message.
 564  * @param nego
 565  * @param s
 566  */
 567
 568 void nego_process_negotiation_response(rdpNego* nego, STREAM* s)
 569 {
 570         uint16 length;
 571
 572         DEBUG_NEGO("RDP_NEG_RSP");
 573
 574         stream_read_uint8(s, nego->flags);
 575         stream_read_uint16(s, length);
 576         stream_read_uint32(s, nego->selected_protocol);
 577
 578         nego->state = NEGO_STATE_FINAL;
 579 }
 580
 581 /**
 582  * Process Negotiation Failure from Connection Confirm message.
 583  * @param nego
 584  * @param s
 585  */
 586
 587 void nego_process_negotiation_failure(rdpNego* nego, STREAM* s)
 588 {
 589         uint8 flags;
 590         uint16 length;
 591         uint32 failureCode;
 592
 593         DEBUG_NEGO("RDP_NEG_FAILURE");
 594
 595         stream_read_uint8(s, flags);
 596         stream_read_uint16(s, length);
 597         stream_read_uint32(s, failureCode);
 598
 599         switch (failureCode)
 600         {
 601                 case SSL_REQUIRED_BY_SERVER:
 602                         DEBUG_NEGO("Error: SSL_REQUIRED_BY_SERVER");
 603                         break;
 604                 case SSL_NOT_ALLOWED_BY_SERVER:
 605                         DEBUG_NEGO("Error: SSL_NOT_ALLOWED_BY_SERVER");
 606                         break;
 607                 case SSL_CERT_NOT_ON_SERVER:
 608                         DEBUG_NEGO("Error: SSL_CERT_NOT_ON_SERVER");
 609                         break;
 610                 case INCONSISTENT_FLAGS:
 611                         DEBUG_NEGO("Error: INCONSISTENT_FLAGS");
 612                         break;
 613                 case HYBRID_REQUIRED_BY_SERVER:
 614                         DEBUG_NEGO("Error: HYBRID_REQUIRED_BY_SERVER");
 615                         break;
 616                 default:
 617                         DEBUG_NEGO("Error: Unknown protocol security error %d", failureCode);
 618                         break;
 619         }
 620
 621         nego->state = NEGO_STATE_FAIL;
 622 }
 623
 624 /**
 625  * Send RDP Negotiation Response (RDP_NEG_RSP).\n
 626  * @param nego
 627  */
 628
 629 boolean nego_send_negotiation_response(rdpNego* nego)
 630 {
 631         STREAM* s;
 632         rdpSettings* settings;
 633         int length;
 634         uint8 *bm, *em;
 635         boolean ret;
 636
 637         ret = true;
 638         settings = nego->transport->settings;
 639
 640         s = transport_send_stream_init(nego->transport, 256);
 641         length = TPDU_CONNECTION_CONFIRM_LENGTH;
 642         stream_get_mark(s, bm);
 643         stream_seek(s, length);
 644
 645         if (nego->selected_protocol > PROTOCOL_RDP)
 646         {
 647                 /* RDP_NEG_DATA must be present for TLS and NLA */
 648                 stream_write_uint8(s, TYPE_RDP_NEG_RSP);
 649                 stream_write_uint8(s, EXTENDED_CLIENT_DATA_SUPPORTED); /* flags */
 650                 stream_write_uint16(s, 8); /* RDP_NEG_DATA length (8) */
 651                 stream_write_uint32(s, nego->selected_protocol); /* selectedProtocol */
 652                 length += 8;
 653         }
 654         else if (!settings->rdp_security)
 655         {
 656                 stream_write_uint8(s, TYPE_RDP_NEG_FAILURE);
 657                 stream_write_uint8(s, 0); /* flags */
 658                 stream_write_uint16(s, 8); /* RDP_NEG_DATA length (8) */
 659                 /*
 660                  * TODO: Check for other possibilities,
 661                  *       like SSL_NOT_ALLOWED_BY_SERVER.
 662                  */
 663                 printf("nego_send_negotiation_response: client supports only Standard RDP Security\n");
 664                 stream_write_uint32(s, SSL_REQUIRED_BY_SERVER);
 665                 length += 8;
 666                 ret = false;
 667         }
 668
 669         stream_get_mark(s, em);
 670         stream_set_mark(s, bm);
 671         tpkt_write_header(s, length);
 672         tpdu_write_connection_confirm(s, length - 5);
 673         stream_set_mark(s, em);
 674
 675         if (transport_write(nego->transport, s) < 0)
 676                 return false;
 677
 678         if (ret)
 679         {
 680                 /* update settings with negotiated protocol security */
 681                 settings->requested_protocols = nego->requested_protocols;
 682                 settings->selected_protocol = nego->selected_protocol;
 683
 684                 if (settings->selected_protocol == PROTOCOL_RDP)
 685                 {
 686                         settings->tls_security = false;
 687                         settings->nla_security = false;
 688                         settings->rdp_security = true;
 689                         settings->encryption = true;
 690                         settings->encryption_method = ENCRYPTION_METHOD_40BIT | ENCRYPTION_METHOD_128BIT | ENCRYPTION_METHOD_FIPS;
 691                         settings->encryption_level = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
 692                 }
 693                 else if (settings->selected_protocol == PROTOCOL_TLS)
 694                 {
 695                         settings->tls_security = true;
 696                         settings->nla_security = false;
 697                         settings->rdp_security = false;
 698                         settings->encryption = false;
 699                         settings->encryption_method = ENCRYPTION_METHOD_NONE;
 700                         settings->encryption_level = ENCRYPTION_LEVEL_NONE;
 701                 }
 702                 else if (settings->selected_protocol == PROTOCOL_NLA)
 703                 {
 704                         settings->tls_security = true;
 705                         settings->nla_security = true;
 706                         settings->rdp_security = false;
 707                         settings->encryption = false;
 708                         settings->encryption_method = ENCRYPTION_METHOD_NONE;
 709                         settings->encryption_level = ENCRYPTION_LEVEL_NONE;
 710                 }
 711         }
 712
 713         return ret;
 714 }
 715
 716 /**
 717  * Initialize NEGO state machine.
 718  * @param nego
 719  */
 720
 721 void nego_init(rdpNego* nego)
 722 {
 723         nego->state = NEGO_STATE_INITIAL;
 724         nego->requested_protocols = PROTOCOL_RDP;
 725         nego->transport->recv_callback = nego_recv;
 726         nego->transport->recv_extra = (void*) nego;
 727         nego->flags = 0;
 728 }
 729
 730 /**
 731  * Create a new NEGO state machine instance.
 732  * @param transport
 733  * @return
 734  */
 735
 736 rdpNego* nego_new(struct rdp_transport * transport)
 737 {
 738         rdpNego* nego = (rdpNego*) xzalloc(sizeof(rdpNego));
 739
 740         if (nego != NULL)
 741         {
 742                 nego->transport = transport;
 743                 nego_init(nego);
 744         }
 745
 746         return nego;
 747 }
 748
 749 /**
 750  * Free NEGO state machine.
 751  * @param nego
 752  */
 753
 754 void nego_free(rdpNego* nego)
 755 {
 756         xfree(nego);
 757 }
 758
 759 /**
 760  * Set target hostname and port.
 761  * @param nego
 762  * @param hostname
 763  * @param port
 764  */
 765
 766 void nego_set_target(rdpNego* nego, char* hostname, int port)
 767 {
 768         nego->hostname = hostname;
 769         nego->port = port;
 770 }
 771
 772 /**
 773  * Enable security layer negotiation.
 774  * @param nego pointer to the negotiation structure
 775  * @param enable_rdp whether to enable security layer negotiation (true for enabled, false for disabled)
 776  */
 777
 778 void nego_set_negotiation_enabled(rdpNego* nego, boolean security_layer_negotiation_enabled)
 779 {
 780         DEBUG_NEGO("Enabling security layer negotiation: %s", security_layer_negotiation_enabled ? "true" : "false");
 781         nego->security_layer_negotiation_enabled = security_layer_negotiation_enabled;
 782 }
 783
 784 /**
 785  * Enable RDP security protocol.
 786  * @param nego pointer to the negotiation structure
 787  * @param enable_rdp whether to enable normal RDP protocol (true for enabled, false for disabled)
 788  */
 789
 790 void nego_enable_rdp(rdpNego* nego, boolean enable_rdp)
 791 {
 792         DEBUG_NEGO("Enabling RDP security: %s", enable_rdp ? "true" : "false");
 793         nego->enabled_protocols[PROTOCOL_RDP] = enable_rdp;
 794 }
 795
 796 /**
 797  * Enable TLS security protocol.
 798  * @param nego pointer to the negotiation structure
 799  * @param enable_tls whether to enable TLS + RDP protocol (true for enabled, false for disabled)
 800  */
 801 void nego_enable_tls(rdpNego* nego, boolean enable_tls)
 802 {
 803         DEBUG_NEGO("Enabling TLS security: %s", enable_tls ? "true" : "false");
 804         nego->enabled_protocols[PROTOCOL_TLS] = enable_tls;
 805 }
 806
 807
 808 /**
 809  * Enable NLA security protocol.
 810  * @param nego pointer to the negotiation structure
 811  * @param enable_nla whether to enable network level authentication protocol (true for enabled, false for disabled)
 812  */
 813
 814 void nego_enable_nla(rdpNego* nego, boolean enable_nla)
 815 {
 816         DEBUG_NEGO("Enabling NLA security: %s", enable_nla ? "true" : "false");
 817         nego->enabled_protocols[PROTOCOL_NLA] = enable_nla;
 818 }
 819
 820 /**
 821  * Set routing token.
 822  * @param nego
 823  * @param routing_token
 824  */
 825
 826 void nego_set_routing_token(rdpNego* nego, rdpBlob* routing_token)
 827 {
 828         nego->routing_token = routing_token;
 829 }
 830
 831 /**
 832  * Set cookie.
 833  * @param nego
 834  * @param cookie
 835  */
 836
 837 void nego_set_cookie(rdpNego* nego, char* cookie)
 838 {
 839         nego->cookie = cookie;
 840 }
 841
 842 /**
 843  * Enable / disable preconnection PDU.
 844  * @param nego
 845  * @param send_pcpdu
 846  */
 847
 848 void nego_set_send_preconnection_pdu(rdpNego* nego, boolean send_pcpdu)
 849 {
 850         nego->send_preconnection_pdu = send_pcpdu;
 851 }
 852
 853 /**
 854  * Set preconnection id.
 855  * @param nego
 856  * @param id
 857  */
 858
 859 void nego_set_preconnection_id(rdpNego* nego, uint32 id)
 860 {
 861         nego->preconnection_id = id;
 862 }
 863
 864 /**
 865  * Set preconnection blob.
 866  * @param nego
 867  * @param blob
 868  */
 869
 870 void nego_set_preconnection_blob(rdpNego* nego, char* blob)
 871 {
 872         nego->preconnection_blob = blob;
 873 }