IT-Nexus/agent-cs/Services/RtcService.cs

using System.Diagnostics;
using System.Net;
using System.Net.Sockets;
using System.Net.WebSockets;
using System.Text;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;

namespace ITNexusAgent.Services;

// WebSocket-Brücke: empfängt rdp_start vom Browser, spawnt Screen-Capture-Helper
// in der User-Session (via schtasks), leitet JPEG-Frames als rdp_frame weiter
public class RtcService
{
    private readonly string _serverUrl;
    private readonly string _agentKey;
    private readonly string _hostname;

    public RtcService(string serverUrl, string agentKey, string hostname)
    {
        _serverUrl = serverUrl;
        _agentKey = agentKey;
        _hostname = hostname;
    }

    public async Task RunAsync(CancellationToken ct)
    {
        while (!ct.IsCancellationRequested)
        {
            try { await ConnectAsync(ct); }
            catch (Exception ex) { AgentWorker.Log($"RDP: {ex.Message}"); }

            if (!ct.IsCancellationRequested)
                await Task.Delay(TimeSpan.FromSeconds(15), ct).ContinueWith(_ => { });
        }
    }

    private async Task ConnectAsync(CancellationToken ct)
    {
        var wsUrl = _serverUrl
            .Replace("https://", "wss://")
            .Replace("http://", "ws://")
            + $"/ws?type=rdp-agent&key={Uri.EscapeDataString(_agentKey)}&hostname={Uri.EscapeDataString(_hostname)}";

        using var ws = new ClientWebSocket();
        await ws.ConnectAsync(new Uri(wsUrl), ct);
        AgentWorker.Log("RDP: Bereit");

        CancellationTokenSource? captureCts = null;

        var buf = new byte[4096];
        while (ws.State == WebSocketState.Open && !ct.IsCancellationRequested)
        {
            WebSocketReceiveResult res;
            try { res = await ws.ReceiveAsync(new ArraySegment<byte>(buf), ct); }
            catch { break; }

            if (res.MessageType == WebSocketMessageType.Close) break;

            var raw = Encoding.UTF8.GetString(buf, 0, res.Count);
            JObject? obj;
            try { obj = JObject.Parse(raw); } catch { continue; }

            var type = obj["type"]?.ToString();

            if (type == "rdp_start" && captureCts == null)
            {
                var screenIdx = obj["screen"]?.ToObject<int>() ?? 0;
                captureCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
                _ = ConsentAndCaptureAsync(ws, screenIdx, captureCts.Token);
                AgentWorker.Log($"RDP: Consent angefordert (screen={screenIdx})");
            }
            else if (type == "rdp_stop" && captureCts != null)
            {
                captureCts.Cancel();
                captureCts = null;
                AgentWorker.Log("RDP: Screen-Capture gestoppt");
            }
        }

        captureCts?.Cancel();
        AgentWorker.Log("RDP: Getrennt");
    }

    private async Task ConsentAndCaptureAsync(ClientWebSocket ws, int screenIdx, CancellationToken ct)
    {
        var exePath = System.Diagnostics.Process.GetCurrentProcess().MainModule!.FileName;

        var consentListener = new TcpListener(IPAddress.Loopback, 0);
        consentListener.Start();
        var consentPort = ((IPEndPoint)consentListener.LocalEndpoint).Port;

        if (!SpawnConsentHelper(exePath, consentPort.ToString()))
        {
            consentListener.Stop();
            AgentWorker.Log("RDP: Consent-Helper fehlgeschlagen, starte ohne Consent");
            await CapturePipeLoopAsync(ws, screenIdx, ct);
            return;
        }

        bool accepted = false;
        try
        {
            using var timeoutCts = new CancellationTokenSource(TimeSpan.FromSeconds(35));
            using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeoutCts.Token);
            using var tcp = await consentListener.AcceptTcpClientAsync(linked.Token);
            var b = tcp.GetStream().ReadByte();
            accepted = b == 1;
        }
        catch { accepted = false; }
        finally { consentListener.Stop(); }

        if (!accepted)
        {
            AgentWorker.Log("RDP: User hat Zugriff abgelehnt");
            var denied = Encoding.UTF8.GetBytes("{\"type\":\"rdp_denied\"}");
            if (ws.State == WebSocketState.Open)
                await ws.SendAsync(new ArraySegment<byte>(denied), WebSocketMessageType.Text, true, CancellationToken.None);
            return;
        }

        AgentWorker.Log("RDP: User hat Zugriff erlaubt, starte Capture");
        await CapturePipeLoopAsync(ws, screenIdx, ct);
    }

    private static bool SpawnConsentHelper(string exePath, string portStr)
    {
        try
        {
            var fullUser = NotificationService.GetLoggedOnUser();
            if (string.IsNullOrEmpty(fullUser))
            {
                AgentWorker.Log("RDP: Kein eingeloggter User für Consent");
                return false;
            }

            var taskName = $"ITNexus-RDPConsent-{portStr}";
            Process.Start(new ProcessStartInfo("schtasks.exe", $"/delete /tn \"{taskName}\" /f")
            { CreateNoWindow = true })?.WaitForExit();

            var triggerTime = DateTime.Now.AddMinutes(60).ToString("HH:mm:ss");
            var ruArg = fullUser.StartsWith("AzureAD\\", StringComparison.OrdinalIgnoreCase)
                ? "/ru \"INTERACTIVE\""
                : $"/ru \"{fullUser}\"";

            var args = $"/create /tn \"{taskName}\" /tr \"\\\"{exePath}\\\" --rdp-consent {portStr}\" " +
                       $"/sc ONCE /st {triggerTime} {ruArg} /it /f";

            var p = Process.Start(new ProcessStartInfo("schtasks.exe", args)
            { CreateNoWindow = true, RedirectStandardError = true, UseShellExecute = false });
            p?.WaitForExit();

            if (p?.ExitCode != 0)
            {
                AgentWorker.Log($"RDP: schtasks consent fehlgeschlagen (ExitCode={p?.ExitCode})");
                return false;
            }

            Process.Start(new ProcessStartInfo("schtasks.exe", $"/run /tn \"{taskName}\"")
            { CreateNoWindow = true })?.WaitForExit();

            _ = Task.Run(async () =>
            {
                await Task.Delay(40000);
                Process.Start(new ProcessStartInfo("schtasks.exe", $"/delete /tn \"{taskName}\" /f")
                { CreateNoWindow = true })?.WaitForExit();
            });

            AgentWorker.Log($"RDP: Consent-Helper gestartet als '{fullUser}'");
            return true;
        }
        catch (Exception ex)
        {
            AgentWorker.Log($"RDP: SpawnConsentHelper Fehler: {ex.Message}");
            return false;
        }
    }

    private async Task CapturePipeLoopAsync(ClientWebSocket ws, int screenIdx, CancellationToken ct)
    {
        var exePath = System.Diagnostics.Process.GetCurrentProcess().MainModule!.FileName;

        // TCP Loopback: kein ACL-Problem zwischen SYSTEM-Service und User-Prozess
        var listener = new TcpListener(IPAddress.Loopback, 0);
        listener.Start();
        var port = ((IPEndPoint)listener.LocalEndpoint).Port;

        if (!SpawnCaptureHelper(exePath, port.ToString(), screenIdx))
        {
            listener.Stop();
            AgentWorker.Log("RDP: Helper-Start fehlgeschlagen");
            return;
        }

        TcpClient? tcp = null;
        try
        {
            using var connectCts = new CancellationTokenSource(TimeSpan.FromSeconds(15));
            using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct, connectCts.Token);
            tcp = await listener.AcceptTcpClientAsync(linked.Token);
        }
        catch
        {
            listener.Stop();
            AgentWorker.Log("RDP: Helper hat sich nicht verbunden");
            return;
        }
        finally { listener.Stop(); }

        AgentWorker.Log($"RDP: Helper verbunden (Port {port}), sende Frames...");

        using (tcp)
        {
            var stream = tcp.GetStream();
            var lenBuf = new byte[4];

            while (!ct.IsCancellationRequested && tcp.Connected && ws.State == WebSocketState.Open)
            {
                try
                {
                    var read = 0;
                    while (read < 4)
                    {
                        var n = await stream.ReadAsync(lenBuf.AsMemory(read, 4 - read), ct);
                        if (n == 0) goto done;
                        read += n;
                    }
                    var jpegLen = BitConverter.ToInt32(lenBuf);
                    if (jpegLen <= 0 || jpegLen > 5_000_000) continue;

                    var jpeg = new byte[jpegLen];
                    read = 0;
                    while (read < jpegLen)
                    {
                        var n = await stream.ReadAsync(jpeg.AsMemory(read, jpegLen - read), ct);
                        if (n == 0) goto done;
                        read += n;
                    }

                    var payload = Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(new
                    {
                        type = "rdp_frame",
                        data = Convert.ToBase64String(jpeg)
                    }));

                    if (ws.State == WebSocketState.Open)
                        await ws.SendAsync(new ArraySegment<byte>(payload), WebSocketMessageType.Text, true, CancellationToken.None);
                }
                catch (OperationCanceledException) { break; }
                catch (Exception ex) { AgentWorker.Log($"RDP: TCP-Fehler: {ex.Message}"); break; }
            }
        }

        done:
        AgentWorker.Log("RDP: Frame-Loop beendet");
    }

    private static bool SpawnCaptureHelper(string exePath, string portStr, int screenIdx = 0)
    {
        try
        {
            var fullUser = NotificationService.GetLoggedOnUser();
            if (string.IsNullOrEmpty(fullUser))
            {
                AgentWorker.Log("RDP: Kein eingeloggter User gefunden");
                return false;
            }

            var taskName = $"ITNexus-RDP-{portStr}";

            Process.Start(new ProcessStartInfo("schtasks.exe", $"/delete /tn \"{taskName}\" /f")
            { CreateNoWindow = true })?.WaitForExit();

            var triggerTime = DateTime.Now.AddMinutes(60).ToString("HH:mm:ss");
            var ruArg = fullUser.StartsWith("AzureAD\\", StringComparison.OrdinalIgnoreCase)
                ? "/ru \"INTERACTIVE\""
                : $"/ru \"{fullUser}\"";

            var args = $"/create /tn \"{taskName}\" /tr \"\\\"{exePath}\\\" --rdp-capture {portStr} {screenIdx}\" " +
                       $"/sc ONCE /st {triggerTime} {ruArg} /it /f";

            var p = Process.Start(new ProcessStartInfo("schtasks.exe", args)
            { CreateNoWindow = true, RedirectStandardError = true, UseShellExecute = false });
            p?.WaitForExit();

            if (p?.ExitCode != 0)
            {
                AgentWorker.Log($"RDP: schtasks create fehlgeschlagen (ExitCode={p?.ExitCode})");
                return false;
            }

            Process.Start(new ProcessStartInfo("schtasks.exe", $"/run /tn \"{taskName}\"")
            { CreateNoWindow = true })?.WaitForExit();

            // Aufräumen nach kurzer Zeit
            _ = Task.Run(async () =>
            {
                await Task.Delay(5000);
                Process.Start(new ProcessStartInfo("schtasks.exe", $"/delete /tn \"{taskName}\" /f")
                { CreateNoWindow = true })?.WaitForExit();
            });

            AgentWorker.Log($"RDP: Helper gestartet als '{fullUser}' (Task: {taskName})");
            return true;
        }
        catch (Exception ex)
        {
            AgentWorker.Log($"RDP: SpawnHelper Fehler: {ex.Message}");
            return false;
        }
    }
}