mirror of
https://github.com/bunny-lab-io/Borealis.git
synced 2026-02-04 08:40:32 -07:00
Initial RDP Implementation
This commit is contained in:
@@ -33,6 +33,7 @@ from ..auth import DevModeManager
|
||||
from .enrollment import routes as enrollment_routes
|
||||
from .tokens import routes as token_routes
|
||||
from .devices.tunnel import register_tunnel
|
||||
from .devices.rdp import register_rdp
|
||||
|
||||
from ...server import EngineContext
|
||||
from .access_management.login import register_auth
|
||||
@@ -291,6 +292,7 @@ def _register_devices(app: Flask, adapters: EngineServiceAdapters) -> None:
|
||||
register_admin_endpoints(app, adapters)
|
||||
device_routes.register_agents(app, adapters)
|
||||
register_tunnel(app, adapters)
|
||||
register_rdp(app, adapters)
|
||||
|
||||
def _register_filters(app: Flask, adapters: EngineServiceAdapters) -> None:
|
||||
filters_management.register_filters(app, adapters)
|
||||
|
||||
195
Data/Engine/services/API/devices/rdp.py
Normal file
195
Data/Engine/services/API/devices/rdp.py
Normal file
@@ -0,0 +1,195 @@
|
||||
# ======================================================
|
||||
# Data\Engine\services\API\devices\rdp.py
|
||||
# Description: RDP session bootstrap for Guacamole WebSocket tunnels.
|
||||
#
|
||||
# API Endpoints (if applicable):
|
||||
# - POST /api/rdp/session (Token Authenticated) - Issues a one-time Guacamole tunnel token for RDP.
|
||||
# ======================================================
|
||||
|
||||
"""RDP session bootstrap endpoints for the Borealis Engine."""
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
from typing import Any, Dict, Optional, Tuple
|
||||
from urllib.parse import urlsplit
|
||||
|
||||
from flask import Blueprint, jsonify, request, session
|
||||
from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
|
||||
|
||||
from ...RemoteDesktop.guacamole_proxy import GUAC_WS_PATH, ensure_guacamole_proxy
|
||||
from .tunnel import _get_tunnel_service
|
||||
|
||||
if False: # pragma: no cover - hint for type checkers
|
||||
from .. import EngineServiceAdapters
|
||||
|
||||
|
||||
def _current_user(app) -> Optional[Dict[str, str]]:
|
||||
username = session.get("username")
|
||||
role = session.get("role") or "User"
|
||||
if username:
|
||||
return {"username": username, "role": role}
|
||||
|
||||
token = None
|
||||
auth_header = request.headers.get("Authorization") or ""
|
||||
if auth_header.lower().startswith("bearer "):
|
||||
token = auth_header.split(" ", 1)[1].strip()
|
||||
if not token:
|
||||
token = request.cookies.get("borealis_auth")
|
||||
if not token:
|
||||
return None
|
||||
|
||||
try:
|
||||
serializer = URLSafeTimedSerializer(app.secret_key or "borealis-dev-secret", salt="borealis-auth")
|
||||
token_ttl = int(os.environ.get("BOREALIS_TOKEN_TTL_SECONDS", 60 * 60 * 24 * 30))
|
||||
data = serializer.loads(token, max_age=token_ttl)
|
||||
username = data.get("u")
|
||||
role = data.get("r") or "User"
|
||||
if username:
|
||||
return {"username": username, "role": role}
|
||||
except (BadSignature, SignatureExpired, Exception):
|
||||
return None
|
||||
return None
|
||||
|
||||
|
||||
def _require_login(app) -> Optional[Tuple[Dict[str, Any], int]]:
|
||||
user = _current_user(app)
|
||||
if not user:
|
||||
return {"error": "unauthorized"}, 401
|
||||
return None
|
||||
|
||||
|
||||
def _normalize_text(value: Any) -> str:
|
||||
if value is None:
|
||||
return ""
|
||||
try:
|
||||
return str(value).strip()
|
||||
except Exception:
|
||||
return ""
|
||||
|
||||
|
||||
def _infer_endpoint_host(req) -> str:
|
||||
forwarded = (req.headers.get("X-Forwarded-Host") or req.headers.get("X-Original-Host") or "").strip()
|
||||
host = forwarded.split(",")[0].strip() if forwarded else (req.host or "").strip()
|
||||
if not host:
|
||||
return ""
|
||||
try:
|
||||
parsed = urlsplit(f"//{host}")
|
||||
if parsed.hostname:
|
||||
return parsed.hostname
|
||||
except Exception:
|
||||
return host
|
||||
return host
|
||||
|
||||
|
||||
def _is_secure(req) -> bool:
|
||||
if req.is_secure:
|
||||
return True
|
||||
forwarded = (req.headers.get("X-Forwarded-Proto") or "").split(",")[0].strip().lower()
|
||||
return forwarded == "https"
|
||||
|
||||
|
||||
def register_rdp(app, adapters: "EngineServiceAdapters") -> None:
|
||||
blueprint = Blueprint("rdp", __name__)
|
||||
logger = adapters.context.logger.getChild("rdp.api")
|
||||
service_log = adapters.service_log
|
||||
|
||||
def _service_log_event(message: str, *, level: str = "INFO") -> None:
|
||||
if not callable(service_log):
|
||||
return
|
||||
try:
|
||||
service_log("RDP", message, level=level)
|
||||
except Exception:
|
||||
logger.debug("rdp service log write failed", exc_info=True)
|
||||
|
||||
def _request_remote() -> str:
|
||||
forwarded = (request.headers.get("X-Forwarded-For") or "").strip()
|
||||
if forwarded:
|
||||
return forwarded.split(",")[0].strip()
|
||||
return (request.remote_addr or "").strip()
|
||||
|
||||
@blueprint.route("/api/rdp/session", methods=["POST"])
|
||||
def rdp_session():
|
||||
requirement = _require_login(app)
|
||||
if requirement:
|
||||
payload, status = requirement
|
||||
return jsonify(payload), status
|
||||
|
||||
user = _current_user(app) or {}
|
||||
operator_id = user.get("username") or None
|
||||
|
||||
body = request.get_json(silent=True) or {}
|
||||
agent_id = _normalize_text(body.get("agent_id"))
|
||||
protocol = _normalize_text(body.get("protocol") or "rdp").lower()
|
||||
username = _normalize_text(body.get("username"))
|
||||
password = str(body.get("password") or "")
|
||||
|
||||
if not agent_id:
|
||||
return jsonify({"error": "agent_id_required"}), 400
|
||||
if protocol != "rdp":
|
||||
return jsonify({"error": "unsupported_protocol"}), 400
|
||||
|
||||
tunnel_service = _get_tunnel_service(adapters)
|
||||
session_payload = tunnel_service.session_payload(agent_id, include_token=False)
|
||||
if not session_payload:
|
||||
return jsonify({"error": "tunnel_down"}), 409
|
||||
|
||||
allowed_ports = session_payload.get("allowed_ports") or []
|
||||
if 3389 not in allowed_ports:
|
||||
return jsonify({"error": "rdp_not_allowed"}), 403
|
||||
|
||||
virtual_ip = _normalize_text(session_payload.get("virtual_ip"))
|
||||
host = virtual_ip.split("/")[0] if virtual_ip else ""
|
||||
if not host:
|
||||
return jsonify({"error": "virtual_ip_missing"}), 500
|
||||
|
||||
registry = ensure_guacamole_proxy(adapters.context, logger=logger)
|
||||
if registry is None:
|
||||
return jsonify({"error": "rdp_proxy_unavailable"}), 503
|
||||
|
||||
_service_log_event(
|
||||
"rdp_session_request agent_id={0} operator={1} protocol={2} remote={3}".format(
|
||||
agent_id,
|
||||
operator_id or "-",
|
||||
protocol,
|
||||
_request_remote() or "-",
|
||||
)
|
||||
)
|
||||
|
||||
rdp_session = registry.create(
|
||||
agent_id=agent_id,
|
||||
host=host,
|
||||
port=3389,
|
||||
username=username,
|
||||
password=password,
|
||||
protocol=protocol,
|
||||
operator_id=operator_id,
|
||||
ignore_cert=True,
|
||||
)
|
||||
|
||||
ws_scheme = "wss" if _is_secure(request) else "ws"
|
||||
ws_host = _infer_endpoint_host(request)
|
||||
ws_port = int(getattr(adapters.context, "rdp_ws_port", 4823))
|
||||
ws_url = f"{ws_scheme}://{ws_host}:{ws_port}{GUAC_WS_PATH}"
|
||||
|
||||
_service_log_event(
|
||||
"rdp_session_ready agent_id={0} token={1} expires_at={2}".format(
|
||||
agent_id,
|
||||
rdp_session.token[:8],
|
||||
int(rdp_session.expires_at),
|
||||
)
|
||||
)
|
||||
|
||||
return (
|
||||
jsonify(
|
||||
{
|
||||
"token": rdp_session.token,
|
||||
"ws_url": ws_url,
|
||||
"expires_at": int(rdp_session.expires_at),
|
||||
"virtual_ip": host,
|
||||
"tunnel_id": session_payload.get("tunnel_id"),
|
||||
}
|
||||
),
|
||||
200,
|
||||
)
|
||||
|
||||
app.register_blueprint(blueprint)
|
||||
9
Data/Engine/services/RemoteDesktop/__init__.py
Normal file
9
Data/Engine/services/RemoteDesktop/__init__.py
Normal file
@@ -0,0 +1,9 @@
|
||||
# ======================================================
|
||||
# Data\Engine\services\RemoteDesktop\__init__.py
|
||||
# Description: Remote desktop services (Guacamole proxy + session management).
|
||||
#
|
||||
# API Endpoints (if applicable): None
|
||||
# ======================================================
|
||||
|
||||
"""Remote desktop service helpers for the Borealis Engine runtime."""
|
||||
|
||||
369
Data/Engine/services/RemoteDesktop/guacamole_proxy.py
Normal file
369
Data/Engine/services/RemoteDesktop/guacamole_proxy.py
Normal file
@@ -0,0 +1,369 @@
|
||||
# ======================================================
|
||||
# Data\Engine\services\RemoteDesktop\guacamole_proxy.py
|
||||
# Description: Guacamole tunnel proxy (WebSocket -> guacd) for RDP sessions.
|
||||
#
|
||||
# API Endpoints (if applicable): None
|
||||
# ======================================================
|
||||
|
||||
"""Guacamole WebSocket proxy that bridges browser tunnels to guacd."""
|
||||
from __future__ import annotations
|
||||
|
||||
import asyncio
|
||||
import logging
|
||||
import ssl
|
||||
import threading
|
||||
import time
|
||||
import uuid
|
||||
from dataclasses import dataclass
|
||||
from typing import Any, Dict, Optional, Tuple
|
||||
from urllib.parse import parse_qs, urlsplit
|
||||
|
||||
import websockets
|
||||
|
||||
GUAC_WS_PATH = "/guacamole"
|
||||
_MAX_MESSAGE_SIZE = 100_000_000
|
||||
|
||||
|
||||
@dataclass
|
||||
class RdpSession:
|
||||
token: str
|
||||
agent_id: str
|
||||
host: str
|
||||
port: int
|
||||
protocol: str
|
||||
username: str
|
||||
password: str
|
||||
ignore_cert: bool
|
||||
created_at: float
|
||||
expires_at: float
|
||||
operator_id: Optional[str] = None
|
||||
domain: Optional[str] = None
|
||||
security: Optional[str] = None
|
||||
|
||||
|
||||
class RdpSessionRegistry:
|
||||
def __init__(self, ttl_seconds: int, logger: logging.Logger) -> None:
|
||||
self.ttl_seconds = max(30, int(ttl_seconds))
|
||||
self.logger = logger
|
||||
self._lock = threading.Lock()
|
||||
self._sessions: Dict[str, RdpSession] = {}
|
||||
|
||||
def _cleanup(self, now: Optional[float] = None) -> None:
|
||||
current = now if now is not None else time.time()
|
||||
expired = [token for token, session in self._sessions.items() if session.expires_at <= current]
|
||||
for token in expired:
|
||||
self._sessions.pop(token, None)
|
||||
|
||||
def create(
|
||||
self,
|
||||
*,
|
||||
agent_id: str,
|
||||
host: str,
|
||||
port: int,
|
||||
username: str,
|
||||
password: str,
|
||||
protocol: str = "rdp",
|
||||
ignore_cert: bool = True,
|
||||
operator_id: Optional[str] = None,
|
||||
domain: Optional[str] = None,
|
||||
security: Optional[str] = None,
|
||||
) -> RdpSession:
|
||||
token = uuid.uuid4().hex
|
||||
now = time.time()
|
||||
expires_at = now + self.ttl_seconds
|
||||
session = RdpSession(
|
||||
token=token,
|
||||
agent_id=agent_id,
|
||||
host=host,
|
||||
port=port,
|
||||
protocol=protocol,
|
||||
username=username,
|
||||
password=password,
|
||||
ignore_cert=ignore_cert,
|
||||
created_at=now,
|
||||
expires_at=expires_at,
|
||||
operator_id=operator_id,
|
||||
domain=domain,
|
||||
security=security,
|
||||
)
|
||||
with self._lock:
|
||||
self._cleanup(now)
|
||||
self._sessions[token] = session
|
||||
return session
|
||||
|
||||
def consume(self, token: str) -> Optional[RdpSession]:
|
||||
if not token:
|
||||
return None
|
||||
with self._lock:
|
||||
self._cleanup()
|
||||
session = self._sessions.pop(token, None)
|
||||
return session
|
||||
|
||||
|
||||
class GuacamoleProxyServer:
|
||||
def __init__(
|
||||
self,
|
||||
*,
|
||||
host: str,
|
||||
port: int,
|
||||
guacd_host: str,
|
||||
guacd_port: int,
|
||||
registry: RdpSessionRegistry,
|
||||
logger: logging.Logger,
|
||||
ssl_context: Optional[ssl.SSLContext] = None,
|
||||
) -> None:
|
||||
self.host = host
|
||||
self.port = port
|
||||
self.guacd_host = guacd_host
|
||||
self.guacd_port = guacd_port
|
||||
self.registry = registry
|
||||
self.logger = logger
|
||||
self.ssl_context = ssl_context
|
||||
self._thread: Optional[threading.Thread] = None
|
||||
self._ready = threading.Event()
|
||||
self._failed = threading.Event()
|
||||
|
||||
def ensure_started(self, timeout: float = 3.0) -> bool:
|
||||
if self._thread and self._thread.is_alive():
|
||||
return not self._failed.is_set()
|
||||
self._failed.clear()
|
||||
self._ready.clear()
|
||||
self._thread = threading.Thread(target=self._run, daemon=True)
|
||||
self._thread.start()
|
||||
self._ready.wait(timeout)
|
||||
return not self._failed.is_set()
|
||||
|
||||
def _run(self) -> None:
|
||||
try:
|
||||
asyncio.run(self._serve())
|
||||
except Exception as exc:
|
||||
self._failed.set()
|
||||
self.logger.error("Guacamole proxy server failed: %s", exc)
|
||||
self._ready.set()
|
||||
|
||||
async def _serve(self) -> None:
|
||||
self.logger.info(
|
||||
"Starting Guacamole proxy on %s:%s (guacd %s:%s)",
|
||||
self.host,
|
||||
self.port,
|
||||
self.guacd_host,
|
||||
self.guacd_port,
|
||||
)
|
||||
try:
|
||||
server = await websockets.serve(
|
||||
self._handle_client,
|
||||
self.host,
|
||||
self.port,
|
||||
ssl=self.ssl_context,
|
||||
max_size=_MAX_MESSAGE_SIZE,
|
||||
ping_interval=20,
|
||||
ping_timeout=20,
|
||||
)
|
||||
except Exception:
|
||||
self._failed.set()
|
||||
self._ready.set()
|
||||
raise
|
||||
self._ready.set()
|
||||
await server.wait_closed()
|
||||
|
||||
async def _handle_client(self, websocket, path: str) -> None:
|
||||
parsed = urlsplit(path)
|
||||
if parsed.path != GUAC_WS_PATH:
|
||||
await websocket.close(code=1008, reason="invalid_path")
|
||||
return
|
||||
query = parse_qs(parsed.query or "")
|
||||
token = (query.get("token") or [""])[0]
|
||||
session = self.registry.consume(token)
|
||||
if not session:
|
||||
await websocket.close(code=1008, reason="invalid_session")
|
||||
return
|
||||
|
||||
logger = self.logger.getChild("session")
|
||||
logger.info("Guacamole session start agent_id=%s protocol=%s", session.agent_id, session.protocol)
|
||||
|
||||
try:
|
||||
reader, writer = await asyncio.open_connection(self.guacd_host, self.guacd_port)
|
||||
except Exception as exc:
|
||||
logger.warning("guacd connect failed: %s", exc)
|
||||
await websocket.close(code=1011, reason="guacd_unavailable")
|
||||
return
|
||||
|
||||
try:
|
||||
await self._perform_handshake(reader, writer, session)
|
||||
except Exception as exc:
|
||||
logger.warning("guacd handshake failed: %s", exc)
|
||||
try:
|
||||
writer.close()
|
||||
await writer.wait_closed()
|
||||
except Exception:
|
||||
pass
|
||||
await websocket.close(code=1011, reason="handshake_failed")
|
||||
return
|
||||
|
||||
async def _ws_to_guacd() -> None:
|
||||
try:
|
||||
async for message in websocket:
|
||||
if message is None:
|
||||
break
|
||||
if isinstance(message, str):
|
||||
data = message.encode("utf-8")
|
||||
else:
|
||||
data = bytes(message)
|
||||
writer.write(data)
|
||||
await writer.drain()
|
||||
finally:
|
||||
try:
|
||||
writer.close()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
async def _guacd_to_ws() -> None:
|
||||
try:
|
||||
while True:
|
||||
data = await reader.read(8192)
|
||||
if not data:
|
||||
break
|
||||
await websocket.send(data.decode("utf-8", errors="ignore"))
|
||||
finally:
|
||||
try:
|
||||
await websocket.close()
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
await asyncio.wait(
|
||||
[asyncio.create_task(_ws_to_guacd()), asyncio.create_task(_guacd_to_ws())],
|
||||
return_when=asyncio.FIRST_COMPLETED,
|
||||
)
|
||||
|
||||
logger.info("Guacamole session ended agent_id=%s", session.agent_id)
|
||||
|
||||
async def _perform_handshake(self, reader, writer, session: RdpSession) -> None:
|
||||
writer.write(_encode_instruction("select", session.protocol))
|
||||
await writer.drain()
|
||||
|
||||
buffer = b""
|
||||
args = None
|
||||
deadline = time.time() + 8
|
||||
|
||||
while time.time() < deadline:
|
||||
parts, buffer = await _read_instruction(reader, buffer)
|
||||
if not parts:
|
||||
continue
|
||||
op = parts[0]
|
||||
if op == "args":
|
||||
args = parts[1:]
|
||||
break
|
||||
if op == "error":
|
||||
raise RuntimeError("guacd_error:" + " ".join(parts[1:]))
|
||||
if not args:
|
||||
raise RuntimeError("guacd_args_timeout")
|
||||
|
||||
params = {
|
||||
"hostname": session.host,
|
||||
"port": str(session.port),
|
||||
"username": session.username or "",
|
||||
"password": session.password or "",
|
||||
}
|
||||
if session.domain:
|
||||
params["domain"] = session.domain
|
||||
if session.security:
|
||||
params["security"] = session.security
|
||||
if session.ignore_cert:
|
||||
params["ignore-cert"] = "true"
|
||||
|
||||
values = [params.get(name, "") for name in args]
|
||||
writer.write(_encode_instruction("connect", *values))
|
||||
await writer.drain()
|
||||
|
||||
|
||||
def _encode_instruction(*elements: str) -> bytes:
|
||||
parts = []
|
||||
for element in elements:
|
||||
text = "" if element is None else str(element)
|
||||
parts.append(f"{len(text)}.{text}".encode("utf-8"))
|
||||
return b",".join(parts) + b";"
|
||||
|
||||
|
||||
def _parse_instruction(raw: bytes) -> Tuple[str, ...]:
|
||||
parts = []
|
||||
idx = 0
|
||||
length = len(raw)
|
||||
while idx < length:
|
||||
dot = raw.find(b".", idx)
|
||||
if dot < 0:
|
||||
break
|
||||
try:
|
||||
element_len = int(raw[idx:dot].decode("ascii") or "0")
|
||||
except Exception:
|
||||
break
|
||||
start = dot + 1
|
||||
end = start + element_len
|
||||
if end > length:
|
||||
break
|
||||
parts.append(raw[start:end].decode("utf-8", errors="ignore"))
|
||||
idx = end
|
||||
if idx < length and raw[idx:idx + 1] == b",":
|
||||
idx += 1
|
||||
return tuple(parts)
|
||||
|
||||
|
||||
async def _read_instruction(reader, buffer: bytes) -> Tuple[Tuple[str, ...], bytes]:
|
||||
while b";" not in buffer:
|
||||
chunk = await reader.read(4096)
|
||||
if not chunk:
|
||||
break
|
||||
buffer += chunk
|
||||
if b";" not in buffer:
|
||||
return tuple(), buffer
|
||||
instruction, remainder = buffer.split(b";", 1)
|
||||
if not instruction:
|
||||
return tuple(), remainder
|
||||
return _parse_instruction(instruction), remainder
|
||||
|
||||
|
||||
def _build_ssl_context(cert_path: Optional[str], key_path: Optional[str]) -> Optional[ssl.SSLContext]:
|
||||
if not cert_path or not key_path:
|
||||
return None
|
||||
try:
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
||||
context.load_cert_chain(certfile=cert_path, keyfile=key_path)
|
||||
return context
|
||||
except Exception:
|
||||
return None
|
||||
|
||||
|
||||
def ensure_guacamole_proxy(context: Any, *, logger: Optional[logging.Logger] = None) -> Optional[RdpSessionRegistry]:
|
||||
if logger is None:
|
||||
logger = context.logger if hasattr(context, "logger") else logging.getLogger("borealis.engine.rdp")
|
||||
|
||||
registry = getattr(context, "rdp_registry", None)
|
||||
if registry is None:
|
||||
ttl = int(getattr(context, "rdp_session_ttl_seconds", 120))
|
||||
registry = RdpSessionRegistry(ttl_seconds=ttl, logger=logger)
|
||||
setattr(context, "rdp_registry", registry)
|
||||
|
||||
proxy = getattr(context, "rdp_proxy", None)
|
||||
if proxy is None:
|
||||
cert_path = getattr(context, "tls_bundle_path", None) or getattr(context, "tls_cert_path", None)
|
||||
ssl_context = _build_ssl_context(
|
||||
cert_path,
|
||||
getattr(context, "tls_key_path", None),
|
||||
)
|
||||
proxy = GuacamoleProxyServer(
|
||||
host=str(getattr(context, "rdp_ws_host", "0.0.0.0")),
|
||||
port=int(getattr(context, "rdp_ws_port", 4823)),
|
||||
guacd_host=str(getattr(context, "guacd_host", "127.0.0.1")),
|
||||
guacd_port=int(getattr(context, "guacd_port", 4822)),
|
||||
registry=registry,
|
||||
logger=logger.getChild("guacamole_proxy"),
|
||||
ssl_context=ssl_context,
|
||||
)
|
||||
setattr(context, "rdp_proxy", proxy)
|
||||
|
||||
if not proxy.ensure_started():
|
||||
logger.error("Guacamole proxy failed to start; RDP sessions unavailable.")
|
||||
return None
|
||||
return registry
|
||||
|
||||
|
||||
__all__ = ["GUAC_WS_PATH", "RdpSessionRegistry", "GuacamoleProxyServer", "ensure_guacamole_proxy"]
|
||||
Reference in New Issue
Block a user