GUACAMOLE-2210: Fetch Chrome major version at runtime from Google VersionHistory API for AAD User-Agent string.

Author: aleitner

src/protocols/rdp/aad.c

@@ -63,12 +63,31 @@
 #define GUAC_AAD_HTTP_TIMEOUT_SECONDS 30
 
 /**
- * User-Agent string sent with all HTTP requests to Microsoft login endpoints.
- * A browser-like UA is required to avoid "unsupported browser" responses.
+ * Format string for the User-Agent sent with HTTP requests to Microsoft login
+ * endpoints. A browser-like UA is required to avoid "unsupported browser"
+ * responses. The %s placeholder is replaced with the Chrome major version,
+ * which is fetched at runtime from Google's VersionHistory API.
  */
-#define GUAC_AAD_USER_AGENT \
+#define GUAC_AAD_USER_AGENT_FORMAT \
     "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 " \
-    "(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+    "(KHTML, like Gecko) Chrome/%s.0.0.0 Safari/537.36"
+
+/**
+ * Default Chrome major version used if the runtime version fetch fails.
+ */
+#define GUAC_AAD_DEFAULT_CHROME_VERSION "146"
+
+/**
+ * URL for Google's VersionHistory API to retrieve the latest stable Chrome
+ * version for Linux.
+ */
+#define GUAC_AAD_CHROME_VERSION_URL \
+    "https://versionhistory.googleapis.com/v1/chrome/platforms/linux/channels/stable/versions"
+
+/**
+ * Timeout in seconds for the Chrome version fetch request.
+ */
+#define GUAC_AAD_VERSION_FETCH_TIMEOUT 5
 
 /**
  * HTTP response structure for AAD requests.
@@ -87,6 +106,104 @@ typedef struct guac_rdp_aad_response {
 
 } guac_rdp_aad_response;
 
+/**
+ * Maximum length of a Chrome major version string (e.g. "130").
+ */
+#define GUAC_AAD_VERSION_BUFFER_SIZE 16
+
+/**
+ * Callback for the Chrome version fetch request. Writes response data into
+ * a simple buffer.
+ */
+static size_t guac_rdp_aad_version_write_callback(void* contents, size_t size,
+        size_t nmemb, void* userp) {
+
+    size_t total_size = size * nmemb;
+    guac_rdp_aad_response* response = (guac_rdp_aad_response*) userp;
+
+    if (response->size + total_size > GUAC_AAD_LOGIN_PAGE_MAX_SIZE)
+        return 0;
+
+    memcpy(response->data + response->size, contents, total_size);
+    response->size += total_size;
+    response->data[response->size] = '\0';
+
+    return total_size;
+}
+
+/**
+ * Fetches the latest stable Chrome major version from Google's VersionHistory
+ * API and returns a User-Agent string using that version. Falls back to
+ * GUAC_AAD_DEFAULT_CHROME_VERSION if the fetch fails.
+ *
+ * @param client
+ *     The guac_client for logging.
+ *
+ * @return
+ *     A newly allocated User-Agent string. The caller must free this with
+ *     guac_mem_free().
+ */
+static char* guac_rdp_aad_get_user_agent(guac_client* client) {
+
+    const char* version = GUAC_AAD_DEFAULT_CHROME_VERSION;
+    char version_buf[GUAC_AAD_VERSION_BUFFER_SIZE];
+
+    CURL* curl = curl_easy_init();
+    if (curl != NULL) {
+
+        guac_rdp_aad_response response = { .data = NULL, .size = 0 };
+        response.data = guac_mem_alloc(GUAC_AAD_LOGIN_PAGE_MAX_SIZE + 1);
+
+        if (response.data != NULL) {
+
+            response.data[0] = '\0';
+
+            curl_easy_setopt(curl, CURLOPT_URL,
+                    GUAC_AAD_CHROME_VERSION_URL);
+            curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
+                    guac_rdp_aad_version_write_callback);
+            curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
+            curl_easy_setopt(curl, CURLOPT_TIMEOUT,
+                    (long) GUAC_AAD_VERSION_FETCH_TIMEOUT);
+
+            CURLcode res = curl_easy_perform(curl);
+
+            if (res == CURLE_OK && response.data != NULL) {
+
+                /* Extract the major version from the first "version"
+                 * value in the JSON response (e.g. "146.0.7680.177").
+                 * The API returns versions sorted newest-first. */
+                int major = 0;
+                const char* ver_key = strstr(response.data, "\"version\":");
+                if (ver_key != NULL)
+                    ver_key = strchr(ver_key + strlen("\"version\":"), '"');
+                if (ver_key != NULL
+                        && sscanf(ver_key, "\"%d.", &major) == 1
+                        && major > 0) {
+                    snprintf(version_buf, sizeof(version_buf), "%d", major);
+                    version = version_buf;
+                }
+            }
+
+            guac_mem_free(response.data);
+        }
+
+        curl_easy_cleanup(curl);
+    }
+
+    guac_client_log(client, GUAC_LOG_DEBUG,
+            "AAD: Using Chrome major version %s for User-Agent", version);
+
+    /* Build the full User-Agent string */
+    size_t ua_len = strlen(GUAC_AAD_USER_AGENT_FORMAT) + strlen(version) + 1;
+    char* user_agent = guac_mem_alloc(ua_len);
+    if (user_agent == NULL)
+        return NULL;
+
+    snprintf(user_agent, ua_len, GUAC_AAD_USER_AGENT_FORMAT, version);
+    return user_agent;
+}
+
 /**
  * Callback function for libcurl to write received HTTP data into a
  * guac_rdp_aad_response buffer.
@@ -504,13 +621,17 @@ static char* guac_rdp_aad_extract_auth_code(guac_client* client,
  * @param auth_code
  *     The authorization code obtained from the login redirect.
  *
+ * @param user_agent
+ *     The User-Agent string to use for HTTP requests.
+ *
  * @return
  *     A newly allocated string containing the access token, or NULL if
  *     the exchange failed. The caller must free the returned string with
  *     guac_mem_free().
  */
 static char* guac_rdp_aad_exchange_code_for_token(guac_client* client,
-        guac_rdp_aad_params* params, const char* auth_code) {
+        guac_rdp_aad_params* params, const char* auth_code,
+        const char* user_agent) {
 
     CURL* curl = NULL;
     char* token = NULL;
@@ -584,7 +705,7 @@ static char* guac_rdp_aad_exchange_code_for_token(guac_client* client,
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
             guac_rdp_aad_write_callback);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, response);
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, GUAC_AAD_USER_AGENT);
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, user_agent);
     curl_easy_setopt(curl, CURLOPT_TIMEOUT,
             (long) GUAC_AAD_HTTP_TIMEOUT_SECONDS);
 
@@ -761,13 +882,17 @@ static void guac_rdp_aad_get_credential_type(guac_client* client,
  * @param params
  *     The AAD authentication parameters including username and password.
  *
+ * @param user_agent
+ *     The User-Agent string to use for HTTP requests.
+ *
  * @return
  *     A newly allocated string containing the authorization code, or NULL
  *     if login failed. The caller must free the returned string with
  *     guac_mem_free().
  */
 static char* guac_rdp_aad_automated_login(guac_client* client,
-        const char* auth_url, guac_rdp_aad_params* params) {
+        const char* auth_url, guac_rdp_aad_params* params,
+        const char* user_agent) {
 
     char* auth_code = NULL;
     CURL* curl = NULL;
@@ -785,7 +910,7 @@ static char* guac_rdp_aad_automated_login(guac_client* client,
     }
 
     curl_easy_setopt(curl, CURLOPT_COOKIEFILE, "");
-    curl_easy_setopt(curl, CURLOPT_USERAGENT, GUAC_AAD_USER_AGENT);
+    curl_easy_setopt(curl, CURLOPT_USERAGENT, user_agent);
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
     curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 10L);
     curl_easy_setopt(curl, CURLOPT_TIMEOUT,
@@ -1047,24 +1172,35 @@ char* guac_rdp_aad_get_token_authcode(guac_client* client,
         return NULL;
     }
 
+    /* Fetch User-Agent string once for the entire auth flow */
+    char* user_agent = guac_rdp_aad_get_user_agent(client);
+    if (user_agent == NULL) {
+        guac_client_log(client, GUAC_LOG_ERROR,
+                "AAD: Failed to allocate User-Agent string");
+        return NULL;
+    }
+
     /* Step 2: Automated login to get the authorization code */
     guac_client_log(client, GUAC_LOG_INFO,
             "AAD: Starting automated authorization code flow "
             "for user: %s", params->username);
 
-    char* auth_code = guac_rdp_aad_automated_login(client, auth_url, params);
+    char* auth_code = guac_rdp_aad_automated_login(client, auth_url, params,
+            user_agent);
 
     if (auth_code == NULL) {
         guac_client_log(client, GUAC_LOG_ERROR,
                 "AAD: Failed to obtain authorization code");
+        guac_mem_free(user_agent);
         return NULL;
     }
 
     /* Step 3: Exchange the code for an access token */
     char* token = guac_rdp_aad_exchange_code_for_token(client, params,
-            auth_code);
+            auth_code, user_agent);
 
     guac_mem_free(auth_code);
+    guac_mem_free(user_agent);
 
     return token;
 }