在凭据提供程序中捕获RDP客户端IP

Question

我们有一个在windows server 2012上运行的自定义凭据提供程序，它在允许用户登录之前调用身份验证服务器的API。我们也在维护我们的凭证提供者的日志。

我们现在需要捕获并记录使用远程桌面连接登录服务器的用户的IP地址。是否可以从凭证提供者内部捕获IP地址？RDP客户端发送到服务器的序列化凭据包是否包含此信息？如果是，如何在凭据提供程序中访问它？

Answer 1

您必须获取远程桌面会话并读取信息：

int GetRDPClientIP(wstring& ip)
{
    if (DEVELOP_MODE) PrintLn(L"Call GetRDPClientIP func", __FILEW__, __FUNCTIONW__, __LINE__);
    WINSTATIONREMOTEADDRESS wsInfo;
    ULONG len;
    if (DEVELOP_MODE) PrintLn(L"Check remote desktop", __FILEW__, __FUNCTIONW__, __LINE__);
    if (WinStationQueryInformationW(0, LOGONID_CURRENT, WinStationRemoteAddress, &wsInfo, sizeof(wsInfo), &len))
    {
        if (DEVELOP_MODE) PrintLn(L"It is remote desktop (RDP)", __FILEW__, __FUNCTIONW__, __LINE__);
        ULONG cb;
        union {
            SOCKADDR sa;
            SOCKADDR_IN sa4;
            SOCKADDR_IN6 sa6;
        };
        switch (sa.sa_family = wsInfo.sin_family)
        {
        case AF_INET:
            if (DEVELOP_MODE) PrintLn(L"It is IPv4", __FILEW__, __FUNCTIONW__, __LINE__);
            sa4.sin_port = wsInfo.ipv4.sin_port;
            sa4.sin_addr.S_un.S_addr = wsInfo.ipv4.in_addr;
            RtlZeroMemory(sa4.sin_zero, sizeof(sa4.sin_zero));
            cb = sizeof(SOCKADDR_IN);
            break;
        case AF_INET6:
            if (DEVELOP_MODE) PrintLn(L"It is IPv6", __FILEW__, __FUNCTIONW__, __LINE__);
            sa6.sin6_port = wsInfo.ipv6.sin6_port;
            sa6.sin6_flowinfo = wsInfo.ipv6.sin6_flowinfo;
            memcpy(&sa6.sin6_addr, &wsInfo.ipv6.sin6_addr, sizeof(in6_addr));
            sa6.sin6_scope_id = wsInfo.ipv6.sin6_scope_id;
            cb = sizeof(SOCKADDR_IN6);
            break;
        default:
            if (DEVELOP_MODE) PrintLn(L"Error in IP version", __FILEW__, __FUNCTIONW__, __LINE__);
            return -1;
        }

        WSADATA wd;
        if (DEVELOP_MODE) PrintLn(L"Call WSAStartup", __FILEW__, __FUNCTIONW__, __LINE__);
        if (WSAStartup(WINSOCK_VERSION, &wd) == 0)
        {
            wchar_t AddressString[64];
            ULONG dwAddressStringLength = _countof(AddressString);

            if (WSAAddressToString(&sa, cb, 0, AddressString, &dwAddressStringLength) == 0)
            {
                if (DEVELOP_MODE) PrintLn((L"IP Address get successfully: " + wstring(AddressString, dwAddressStringLength)).c_str(), __FILEW__, __FUNCTIONW__, __LINE__);
                ip = wstring(AddressString, dwAddressStringLength);
                return 0;
            }
            else
            {
                if (DEVELOP_MODE) PrintLn((L"Error code WSAAddressToString: " + to_wstring(WSAGetLastError())).c_str(), __FILEW__, __FUNCTIONW__, __LINE__);
                return -1;
            }
        }
        else
        {
            if (DEVELOP_MODE) PrintLn((L"Error code WSAStartup: " + to_wstring(WSAGetLastError())).c_str(), __FILEW__, __FUNCTIONW__, __LINE__);
            return -1;
        }
    }

    if (DEVELOP_MODE) PrintLn(L"It is not remote desktop (RDP)", __FILEW__, __FUNCTIONW__, __LINE__);
    return 1;
}