--- sourceforge.net/trunk/rdesktop/rdp.c	2000/07/05 07:44:21	6
+++ sourceforge.net/trunk/rdesktop/rdp.c	2004/04/16 11:36:29	658
@@ -1,1155 +1,1022 @@
-/*
+/* -*- c-basic-offset: 8 -*-
    rdesktop: A Remote Desktop Protocol client.
    Protocol services - RDP layer
-   Copyright (C) Matthew Chapman 1999-2000
-   
+   Copyright (C) Matthew Chapman 1999-2002
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-#include "includes.h"
+#include <time.h>
+#include "rdesktop.h"
 
-/* Establish a connection up to the RDP layer */
-HCONN rdp_connect(char *server)
-{
-	HCONN conn;
-	RDP_ACTIVE_PDU active;
-	uint8 type;
-
-	if ((conn = mcs_connect(server)) == NULL)
-		return NULL;
+extern uint16 g_mcs_userid;
+extern char g_username[16];
+extern BOOL g_bitmap_compression;
+extern BOOL g_orders;
+extern BOOL g_encryption;
+extern BOOL g_desktop_save;
+extern BOOL g_use_rdp5;
+extern uint16 g_server_rdp_version;
+extern uint32 g_rdp5_performanceflags;
+extern int g_server_bpp;
+
+uint8 *g_next_packet;
+uint32 g_rdp_shareid;
+
+#if WITH_DEBUG
+static uint32 g_packetno;
+#endif
+
+/* Receive an RDP packet */
+static STREAM
+rdp_recv(uint8 * type)
+{
+	static STREAM rdp_s;
+	uint16 length, pdu_type;
+
+	if ((rdp_s == NULL) || (g_next_packet >= rdp_s->end))
+	{
+		rdp_s = sec_recv();
+		if (rdp_s == NULL)
+			return NULL;
 
-	rdp_establish_key(conn);
-	mcs_recv(conn, False); /* Server's licensing certificate */
-	rdp_send_cert(conn);
-	mcs_recv(conn, False);
-
-	if (!rdp_recv_pdu(conn, &type) || (type != RDP_PDU_DEMAND_ACTIVE))
+		g_next_packet = rdp_s->p;
+	}
+	else
 	{
-		fprintf(stderr, "RDP error, expected Demand Active\n");
-		mcs_disconnect(conn);
-		return NULL;
+		rdp_s->p = g_next_packet;
 	}
 
-	rdp_io_active_pdu(&conn->in, &active, RDP_PDU_DEMAND_ACTIVE);
-	rdp_send_confirm_active(conn);
-	rdp_send_synchronize(conn);
-	rdp_send_control(conn, RDP_CTL_COOPERATE);
-	rdp_send_control(conn, RDP_CTL_REQUEST_CONTROL);
-	rdp_recv_pdu(conn, &type); // RDP_PDU_SYNCHRONIZE
-	rdp_recv_pdu(conn, &type); // RDP_CTL_COOPERATE
-	rdp_recv_pdu(conn, &type); // RDP_CTL_GRANT_CONTROL
-	rdp_send_input(conn);
-	rdp_send_fonts(conn, 1);
-	rdp_send_fonts(conn, 2);
-	rdp_recv_pdu(conn, &type); // RDP_PDU_UNKNOWN 0x28
-
-	return conn;
-}
-
-void rdp_main_loop(HCONN conn)
-{
-	RDP_DATA_HEADER hdr;
-	RDP_UPDATE_PDU update;
-	RDP_ORDER_STATE os;
-	uint8 type;
-
-	memset(&os, 0, sizeof(os));
-
-	while (rdp_recv_pdu(conn, &type))
+	in_uint16_le(rdp_s, length);
+	/* 32k packets are really 8, keepalive fix */
+	if (length == 0x8000)
 	{
-		if (type != RDP_PDU_DATA)
-			continue;
+		g_next_packet += 8;
+		*type = 0;
+		return rdp_s;
+	}
+	in_uint16_le(rdp_s, pdu_type);
+	in_uint8s(rdp_s, 2);	/* userid */
+	*type = pdu_type & 0xf;
 
-		rdp_io_data_header(&conn->in, &hdr);
+#if WITH_DEBUG
+	DEBUG(("RDP packet #%d, (type %x)\n", ++g_packetno, *type));
+	hexdump(g_next_packet, length);
+#endif /*  */
 
-		switch (hdr.data_pdu_type)
-		{
-		case RDP_DATA_PDU_UPDATE:
-			rdp_io_update_pdu(&conn->in, &update);
-			if (update.update_type == RDP_UPDATE_ORDERS)
-			{
-				fprintf(stderr, "Received orders\n");
-				process_orders(conn, &os);
-			}
-			break;
-		}
-	}
+	g_next_packet += length;
+	return rdp_s;
 }
 
-void prs_io_coord(STREAM s, uint16 *coord, BOOL delta)
+/* Initialise an RDP data packet */
+static STREAM
+rdp_init_data(int maxlen)
 {
-	uint8 change;
+	STREAM s;
 
-	if (delta)
-	{
-		prs_io_uint8(s, &change);
-		*coord += change;
-	}
-	else
-	{
-		lsb_io_uint16(s, coord);
-	}
+	s = sec_init(g_encryption ? SEC_ENCRYPT : 0, maxlen + 18);
+	s_push_layer(s, rdp_hdr, 18);
+
+	return s;
 }
 
-void process_opaque_rect(HCONN conn, RDP_ORDER_STATE *os, BOOL delta)
+/* Send an RDP data packet */
+static void
+rdp_send_data(STREAM s, uint8 data_pdu_type)
 {
-	uint8 present;
-	prs_io_uint8(&conn->in, &present);
-
-	if (present & 1)
-		prs_io_coord(&conn->in, &os->opaque_rect.x, delta);
-
-	if (present & 2)
-		prs_io_coord(&conn->in, &os->opaque_rect.y, delta);
+	uint16 length;
 
-	if (present & 4)
-		prs_io_coord(&conn->in, &os->opaque_rect.cx, delta);
+	s_pop_layer(s, rdp_hdr);
+	length = s->end - s->p;
 
-	if (present & 8)
-		prs_io_coord(&conn->in, &os->opaque_rect.cy, delta);
+	out_uint16_le(s, length);
+	out_uint16_le(s, (RDP_PDU_DATA | 0x10));
+	out_uint16_le(s, (g_mcs_userid + 1001));
 
-	if (present & 16)
-		prs_io_uint8(&conn->in, &os->opaque_rect.colour);
+	out_uint32_le(s, g_rdp_shareid);
+	out_uint8(s, 0);	/* pad */
+	out_uint8(s, 1);	/* streamid */
+	out_uint16_le(s, (length - 14));
+	out_uint8(s, data_pdu_type);
+	out_uint8(s, 0);	/* compress_type */
+	out_uint16(s, 0);	/* compress_len */
 
-	fprintf(stderr, "Opaque rectangle at %d, %d\n", os->opaque_rect.x, os->opaque_rect.y);
+	sec_send(s, g_encryption ? SEC_ENCRYPT : 0);
 }
 
-void process_bmpcache(HCONN conn)
+/* Output a string in Unicode */
+void
+rdp_out_unistr(STREAM s, char *string, int len)
 {
+	int i = 0, j = 0;
 
-	RDP_BITMAP_HEADER rbh;
-	char *bmpdata;
-	HBITMAP bmp;
-	static int x = 0;
-
-	rdp_io_bitmap_header(&conn->in, &rbh);
-	fprintf(stderr, "Decompressing bitmap %d x %d, final size %d\n", rbh.width, rbh.height, rbh.final_size);
+	len += 2;
 
-	bmpdata = malloc(rbh.width * rbh.height);
-	bitmap_decompress(conn->in.data
-			  + conn->in.offset, rbh.size,
-			  bmpdata, rbh.width);
-	conn->in.offset += rbh.size;
-
-	bmp = ui_create_bitmap(conn->wnd, rbh.width, rbh.height, bmpdata);
-	ui_paint_bitmap(conn->wnd, bmp, x, 0);
-	ui_destroy_bitmap(bmp);
+	while (i < len)
+	{
+		s->p[i++] = string[j++];
+		s->p[i++] = 0;
+	}
 
-	x += rbh.width;
+	s->p += len;
 }
 
-void process_orders(HCONN conn, RDP_ORDER_STATE *os)
+/* Input a string in Unicode
+ *
+ * Returns str_len of string
+ */
+int
+rdp_in_unistr(STREAM s, char *string, int uni_len)
 {
-	uint16 num_orders;
-	int processed = 0;
-	BOOL res = True;
-	//	unsigned char *p;
-
-	lsb_io_uint16(&conn->in, &num_orders);
+	int i = 0;
 
-	conn->in.offset += 2;
-	//	p = &conn->in.data[conn->in.offset];
+	while (i < uni_len / 2)
+	{
+		in_uint8a(s, &string[i++], 1);
+		in_uint8s(s, 1);
+	}
 
-	//	fprintf(stderr, "%02X %02X %02X %02X\n", p[0], p[1], p[2], p[3]);
+	return i - 1;
+}
 
-	while ((processed < num_orders) && res)
-	{
-		uint8 order_flags;
 
-		prs_io_uint8(&conn->in, &order_flags);
+/* Parse a logon info packet */
+static void
+rdp_send_logon_info(uint32 flags, char *domain, char *user,
+		    char *password, char *program, char *directory)
+{
+	char *ipaddr = tcp_get_address();
+	int len_domain = 2 * strlen(domain);
+	int len_user = 2 * strlen(user);
+	int len_password = 2 * strlen(password);
+	int len_program = 2 * strlen(program);
+	int len_directory = 2 * strlen(directory);
+	int len_ip = 2 * strlen(ipaddr);
+	int len_dll = 2 * strlen("C:\\WINNT\\System32\\mstscax.dll");
+	int packetlen = 0;
+	uint32 sec_flags = g_encryption ? (SEC_LOGON_INFO | SEC_ENCRYPT) : SEC_LOGON_INFO;
+	STREAM s;
+	time_t t = time(NULL);
+	time_t tzone;
 
-		if (!(order_flags & RDP_ORDER_STANDARD))
-			return;
+#if 0
+	// enable rdp compression
+	flags |= RDP_COMPRESSION;
+#endif
 
-		if (order_flags & RDP_ORDER_SECONDARY)
-		{
-			RDP_SECONDARY_ORDER rso;
+	if (!g_use_rdp5 || 1 == g_server_rdp_version)
+	{
+		DEBUG_RDP5(("Sending RDP4-style Logon packet\n"));
 
-			rdp_io_secondary_order(&conn->in, &rso);
-			switch (rso.type)
-			{
-			case RDP_ORDER_BMPCACHE:
-				process_bmpcache(conn);
-				break;
-			default:
-				fprintf(stderr, "Unknown secondary order %d\n",
-					rso.type);
-				return;
-			}
+		s = sec_init(sec_flags, 18 + len_domain + len_user + len_password
+			     + len_program + len_directory + 10);
 
+		out_uint32(s, 0);
+		out_uint32_le(s, flags);
+		out_uint16_le(s, len_domain);
+		out_uint16_le(s, len_user);
+		out_uint16_le(s, len_password);
+		out_uint16_le(s, len_program);
+		out_uint16_le(s, len_directory);
+		rdp_out_unistr(s, domain, len_domain);
+		rdp_out_unistr(s, user, len_user);
+		rdp_out_unistr(s, password, len_password);
+		rdp_out_unistr(s, program, len_program);
+		rdp_out_unistr(s, directory, len_directory);
+	}
+	else
+	{
+		flags |= RDP_LOGON_BLOB;
+		DEBUG_RDP5(("Sending RDP5-style Logon packet\n"));
+		packetlen = 4 +	/* Unknown uint32 */
+			4 +	/* flags */
+			2 +	/* len_domain */
+			2 +	/* len_user */
+			(flags & RDP_LOGON_AUTO ? 2 : 0) +	/* len_password */
+			(flags & RDP_LOGON_BLOB ? 2 : 0) +	/* Length of BLOB */
+			2 +	/* len_program */
+			2 +	/* len_directory */
+			(0 < len_domain ? len_domain : 2) +	/* domain */
+			len_user + (flags & RDP_LOGON_AUTO ? len_password : 0) + 0 +	/* We have no 512 byte BLOB. Perhaps we must? */
+			(flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO) ? 2 : 0) +	/* After the BLOB is a unknown int16. If there is a BLOB, that is. */
+			(0 < len_program ? len_program : 2) + (0 < len_directory ? len_directory : 2) + 2 +	/* Unknown (2) */
+			2 +	/* Client ip length */
+			len_ip +	/* Client ip */
+			2 +	/* DLL string length */
+			len_dll +	/* DLL string */
+			2 +	/* Unknown */
+			2 +	/* Unknown */
+			64 +	/* Time zone #0 */
+			2 +	/* Unknown */
+			64 +	/* Time zone #1 */
+			32;	/* Unknown */
+
+		s = sec_init(sec_flags, packetlen);
+		DEBUG_RDP5(("Called sec_init with packetlen %d\n", packetlen));
+
+		out_uint32(s, 0);	/* Unknown */
+		out_uint32_le(s, flags);
+		out_uint16_le(s, len_domain);
+		out_uint16_le(s, len_user);
+		if (flags & RDP_LOGON_AUTO)
+		{
+			out_uint16_le(s, len_password);
 
 		}
+		if (flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO))
+		{
+			out_uint16_le(s, 0);
+		}
+		out_uint16_le(s, len_program);
+		out_uint16_le(s, len_directory);
+		if (0 < len_domain)
+			rdp_out_unistr(s, domain, len_domain);
+		else
+			out_uint16_le(s, 0);
+		rdp_out_unistr(s, user, len_user);
+		if (flags & RDP_LOGON_AUTO)
+		{
+			rdp_out_unistr(s, password, len_password);
+		}
+		if (flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO))
+		{
+			out_uint16_le(s, 0);
+		}
+		if (0 < len_program)
+		{
+			rdp_out_unistr(s, program, len_program);
 
-		if (order_flags & RDP_ORDER_CHANGE)
-			prs_io_uint8(&conn->in, &os->order_type);
-
-		switch (os->order_type)
+		}
+		else
 		{
-		case RDP_ORDER_OPAQUE_RECT:
-			process_opaque_rect(conn, os, order_flags & RDP_ORDER_DELTA);
-			break;
-		default:
-			fprintf(stderr, "Unknown order %d\n", os->order_type);
-			return;
+			out_uint16_le(s, 0);
+		}
+		if (0 < len_directory)
+		{
+			rdp_out_unistr(s, directory, len_directory);
+		}
+		else
+		{
+			out_uint16_le(s, 0);
 		}
+		out_uint16_le(s, 2);
+		out_uint16_le(s, len_ip + 2);	/* Length of client ip */
+		rdp_out_unistr(s, ipaddr, len_ip);
+		out_uint16_le(s, len_dll + 2);
+		rdp_out_unistr(s, "C:\\WINNT\\System32\\mstscax.dll", len_dll);
 
-		processed++;
-	}
-}
+		tzone = (mktime(gmtime(&t)) - mktime(localtime(&t))) / 60;
+		out_uint32_le(s, tzone);
 
-/* Work this out later. This is useless anyway when encryption is off. */
-uint8 precanned_key_packet[] = {
-   0x48,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x33,0x00,0x00,0x00,0x00,0x00,
-   0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x6c,0x86, 
-   0xf7,0x99,0xef,0x60,0xc4,0x49,0x52,0xd0,0xd8,0xea,0xb5,0x4f,0x58,0x19,
-   0x52,0x2a,0x93,0x83,0x57,0x4f,0x4e,0x04,0xde,0x96,0x51,0xab,0x13,0x20,
-   0xd8,0xe5,0x00,0x00,0x00,0x00,0x00,0x00
-};
+		rdp_out_unistr(s, "GTB, normaltid", 2 * strlen("GTB, normaltid"));
+		out_uint8s(s, 62 - 2 * strlen("GTB, normaltid"));
 
-/* Create an RC4 key and transfer it to the server */
-void rdp_establish_key(HCONN conn)
-{
-	mcs_init_data(conn);
-	memcpy(conn->out.data + conn->out.offset, precanned_key_packet,
-	       sizeof(precanned_key_packet));
-	conn->out.offset += sizeof(precanned_key_packet);
-	MARK_END(conn->out);
-	mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True);
-}
-
-/* Horrible horrible certificate stuff. Work out later. */
-uint8 precanned_cert_packet[] = {
-0x80,0x00,0x00,0x00,0x12,0x02,0xb4,0x04,0x01,0x00,0x00,
-0x00,0x00,0x00,0x01,0x02,0x9d,0xa3,0x7a,0x93,0x34,0x7b,0x28,0x37,0x24,0xa0,0x1f,
-0x61,0x26,0xfd,0x96,0x3a,0x92,0x83,0xf3,0xe9,0x6a,0x2e,0x81,0x7c,0x2c,0xe4,0x72,//
-0x01,0x18,0xe9,0xa1,0x0f,0x00,0x00,0x48,0x00,0x84,0x23,0x90,0xe6,0xd3,0xf8,0x20,
-0xdb,0xa8,0x1b,0xb2,0xd0,0x78,0x2c,0x35,0xde,0xe3,0x0e,0x63,0x40,0xca,0xac,0x71,
-0xc9,0x17,0x49,0x05,0x25,0xeb,0x9b,0xd0,0xa6,0x5c,0x90,0x3e,0x9d,0x4b,0x27,0x01,
-0x79,0x1c,0x22,0xfb,0x3c,0x2c,0xb9,0x9f,0xf5,0x21,0xf3,0xee,0xd5,0x4d,0x47,0x1c,
-0x85,0xbe,0x83,0x93,0xe8,0xed,0x8c,0x5c,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-0x00,0x01,0x00,0x10,0x04,0x30,0x82,0x04,0x0c,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
-0x0d,0x01,0x07,0x02,0xa0,0x82,0x03,0xfd,0x30,0x82,0x03,0xf9,0x02,0x01,0x01,0x31,
-0x00,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x07,0x01,0xa0,0x82,
-0x03,0xe1,0x30,0x82,0x01,0x77,0x30,0x82,0x01,0x25,0xa0,0x03,0x02,0x01,0x02,0x02,
-0x08,0x01,0xbf,0x06,0x84,0x9d,0xdb,0x2d,0xe0,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,
-0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x30,0x38,0x31,0x36,0x30,0x11,0x06,0x03,
-0x55,0x04,0x03,0x1e,0x0a,0x00,0x4e,0x00,0x54,0x00,0x54,0x00,0x53,0x00,0x45,0x30,
-0x21,0x06,0x03,0x55,0x04,0x07,0x1e,0x1a,0x00,0x4d,0x00,0x69,0x00,0x63,0x00,0x72,
-0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x6f,
-0x00,0x6d,0x30,0x1e,0x17,0x0d,0x39,0x39,0x30,0x39,0x32,0x34,0x31,0x32,0x30,0x32,
-0x30,0x34,0x5a,0x17,0x0d,0x34,0x39,0x30,0x39,0x32,0x34,0x31,0x32,0x30,0x32,0x30,
-0x34,0x5a,0x30,0x38,0x31,0x36,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x1e,0x0a,0x00,
-0x4e,0x00,0x54,0x00,0x54,0x00,0x53,0x00,0x45,0x30,0x21,0x06,0x03,0x55,0x04,0x07,
-0x1e,0x1a,0x00,0x4d,0x00,0x69,0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f,
-0x00,0x66,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x6f,0x00,0x6d,0x30,0x5c,0x30,0x0d,
-0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x4b,0x00,
-0x30,0x48,0x02,0x41,0x00,0x91,0xb2,0x16,0x1c,0xae,0x4f,0x7f,0x7c,0xaf,0x57,0x2b,
-0x23,0x4c,0x0c,0x25,0x3c,0x4f,0x66,0x9d,0x25,0xc3,0x4f,0x29,0xee,0x8b,0xda,0x4e,
-0x95,0xe7,0x3b,0xaa,0xc0,0xa7,0xba,0xaf,0x99,0x8c,0x47,0x24,0x8b,0x09,0x77,0xbc,
-0x2c,0xf4,0xe7,0x1a,0x07,0x58,0x7b,0x11,0x37,0x2a,0xa8,0x90,0xc3,0x50,0x92,0x80,
-0x15,0xc5,0xda,0x51,0x8b,0x02,0x03,0x01,0x00,0x01,0xa3,0x13,0x30,0x11,0x30,0x0f,
-0x06,0x03,0x55,0x1d,0x13,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30,
-0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x41,0x00,0x14,0x04,0x67,
-0x28,0xc8,0xd3,0x1f,0x13,0x14,0x2e,0x2c,0x93,0x09,0x25,0xbb,0xbe,0x86,0x6a,0xd3,
-0x47,0x6f,0x44,0x16,0x7b,0x94,0x8c,0xb2,0xa2,0xd5,0xf7,0x4f,0xb1,0x8f,0x7f,0xde,
-0x0b,0x88,0x34,0x4a,0x1d,0xdc,0xa1,0xfd,0x26,0xbd,0x43,0xbb,0x38,0xf1,0x87,0x34,
-0xbb,0xe9,0x3b,0xfa,0x7f,0x1e,0xff,0xe1,0x10,0x7e,0xee,0x6e,0xd8,0x30,0x82,0x02,
-0x62,0x30,0x82,0x02,0x10,0xa0,0x03,0x02,0x01,0x02,0x02,0x05,0x01,0x00,0x00,0x00,
-0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x38,0x31,0x36,
-0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x1e,0x0a,0x00,0x4e,0x00,0x54,0x00,0x54,0x00,
-0x53,0x00,0x45,0x30,0x21,0x06,0x03,0x55,0x04,0x07,0x1e,0x1a,0x00,0x4d,0x00,0x69,
-0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x2e,
-0x00,0x63,0x00,0x6f,0x00,0x6d,0x30,0x1e,0x17,0x0d,0x39,0x39,0x30,0x39,0x32,0x34,
-0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x34,0x39,0x30,0x39,0x32,0x34,0x30,
-0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x79,0x31,0x77,0x30,0x17,0x06,0x03,0x55,0x04,
-0x03,0x1e,0x10,0x00,0x52,0x00,0x45,0x00,0x53,0x00,0x37,0x00,0x2d,0x00,0x4e,0x00,
-0x45,0x00,0x57,0x30,0x17,0x06,0x03,0x55,0x04,0x07,0x1e,0x10,0x00,0x7a,0x00,0x32,
-0x00,0x32,0x00,0x33,0x00,0x32,0x00,0x32,0x00,0x30,0x00,0x33,0x30,0x43,0x06,0x03,
-0x55,0x04,0x05,0x1e,0x3c,0x00,0x31,0x00,0x42,0x00,0x63,0x00,0x4b,0x00,0x65,0x00,
-0x57,0x00,0x50,0x00,0x6c,0x00,0x37,0x00,0x58,0x00,0x47,0x00,0x61,0x00,0x73,0x00,
-0x38,0x00,0x4a,0x00,0x79,0x00,0x50,0x00,0x34,0x00,0x30,0x00,0x7a,0x00,0x49,0x00,
-0x6d,0x00,0x6e,0x00,0x6f,0x00,0x51,0x00,0x5a,0x00,0x59,0x00,0x3d,0x00,0x0d,0x00,
-0x0a,0x30,0x5c,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,
-0x05,0x00,0x03,0x4b,0x00,0x30,0x48,0x02,0x41,0x00,0x91,0xb2,0x16,0x1c,0xae,0x4f,
-0x7f,0x7c,0xaf,0x57,0x2b,0x23,0x4c,0x0c,0x25,0x3c,0x4f,0x66,0x9d,0x25,0xc3,0x4f,
-0x29,0xee,0x8b,0xda,0x4e,0x95,0xe7,0x3b,0xaa,0xc0,0xa7,0xba,0xaf,0x99,0x8c,0x47,
-0x24,0x8b,0x09,0x77,0xbc,0x2c,0xf4,0xe7,0x1a,0x07,0x58,0x7b,0x11,0x37,0x2a,0xa8,
-0x90,0xc3,0x50,0x92,0x80,0x15,0xc5,0xda,0x51,0x8b,0x02,0x03,0x01,0x00,0x01,0xa3,
-0x81,0xc3,0x30,0x81,0xc0,0x30,0x14,0x06,0x09,0x2b,0x06,0x01,0x04,0x01,0x82,0x37,
-0x12,0x04,0x01,0x01,0xff,0x04,0x04,0x01,0x00,0x01,0x00,0x30,0x3c,0x06,0x09,0x2b,
-0x06,0x01,0x04,0x01,0x82,0x37,0x12,0x02,0x01,0x01,0xff,0x04,0x2c,0x4d,0x00,0x69,
-0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x20,
-0x00,0x43,0x00,0x6f,0x00,0x72,0x00,0x70,0x00,0x6f,0x00,0x72,0x00,0x61,0x00,0x74,
-0x00,0x69,0x00,0x6f,0x00,0x6e,0x00,0x00,0x00,0x30,0x4c,0x06,0x09,0x2b,0x06,0x01,
-0x04,0x01,0x82,0x37,0x12,0x05,0x01,0x01,0xff,0x04,0x3c,0x00,0x10,0x00,0x00,0x01,
-0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x09,0x04,0x00,0x00,0x18,0x00,0x18,0x00,0x30,
-0x00,0x01,0x00,0x32,0x00,0x33,0x00,0x36,0x00,0x2d,0x00,0x34,0x00,0x2e,0x00,0x30,
-0x00,0x30,0x00,0x2d,0x00,0x45,0x00,0x58,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x1c,0x06,0x03,0x55,0x1d,0x23,0x01,0x01,
-0xff,0x04,0x12,0x30,0x10,0xa1,0x07,0x81,0x05,0x4e,0x54,0x54,0x53,0x45,0x82,0x05,
-0x01,0x00,0x00,0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,
-0x03,0x41,0x00,0x7b,0x1d,0xfd,0x24,0xea,0xf2,0xe8,0x17,0xdd,0x88,0x7e,0xfd,0xee,
-0x28,0x61,0x7a,0x02,0xc3,0x73,0xcf,0x32,0x0f,0x7c,0x66,0x87,0x31,0xa7,0xbe,0x1b,
-0x31,0xe2,0x20,0xa5,0x76,0x91,0x68,0x97,0x53,0x9e,0x80,0xcd,0x2b,0xd0,0x8e,0x8b,
-0x7f,0x89,0x1b,0x62,0xa8,0xf8,0xee,0x5e,0x56,0xbd,0x9c,0x6b,0x80,0x06,0x54,0xd3,
-0xf0,0xbf,0xb2,0x31,0x00,0x01,0x00,0x14,0x00,0xc7,0x32,0xf2,0x5b,0x98,0x0e,0x04,
-0x49,0xa0,0x27,0x7e,0xf5,0xf6,0x0f,0xda,0x08,0x1d,0xe9,0x79,0xd1,0x31,0xc6,0x50,
-0x90,0x4a,0xd3,0x1f,0x1d,0xf0,0x65,0x0d,0xb6,0x1f,0xaf,0xc9,0x1d
-};
+		out_uint32_le(s, 0x0a0000);
+		out_uint32_le(s, 0x050000);
+		out_uint32_le(s, 3);
+		out_uint32_le(s, 0);
+		out_uint32_le(s, 0);
 
-/* Send license certificate and related data to the server */
-void rdp_send_cert(HCONN conn)
-{
-	mcs_init_data(conn);
-	prs_io_uint8s(&conn->out, precanned_cert_packet, sizeof(precanned_cert_packet));
-	MARK_END(conn->out);
-	mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True);
-}
+		rdp_out_unistr(s, "GTB, sommartid", 2 * strlen("GTB, sommartid"));
+		out_uint8s(s, 62 - 2 * strlen("GTB, sommartid"));
 
-/* Initialise RDP transport packet */
-void rdp_init(HCONN conn)
-{
-	mcs_init_data(conn);
-	PUSH_LAYER(conn->out, rdp_offset, 6);
-}
+		out_uint32_le(s, 0x30000);
+		out_uint32_le(s, 0x050000);
+		out_uint32_le(s, 2);
+		out_uint32(s, 0);
+		out_uint32_le(s, 0xffffffc4);
+		out_uint32_le(s, 0xfffffffe);
+		out_uint32_le(s, g_rdp5_performanceflags);
+		out_uint32(s, 0);
 
-/* Transmit RDP transport packet */
-void rdp_send(HCONN conn, uint16 pdu_type)
-{
-	RDP_HEADER hdr;
-	int length;
 
-	POP_LAYER(conn->out, rdp_offset);
-	length = conn->out.end - conn->out.offset;
-	rdp_make_header(&hdr, length, pdu_type, conn->mcs_userid);
-	rdp_io_header(&conn->out, &hdr);
-	mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True);
-}
-
-/* Initialise RDP transport data packet */
-void rdp_init_data(HCONN conn)
-{
-	mcs_init_data(conn);
-	PUSH_LAYER(conn->out, rdp_offset, 18);
+	}
+	s_mark_end(s);
+	sec_send(s, sec_flags);
 }
 
-/* Transmit RDP transport data packet */
-void rdp_send_data(HCONN conn, uint16 data_pdu_type)
+/* Send a control PDU */
+static void
+rdp_send_control(uint16 action)
 {
-	RDP_HEADER hdr;
-	RDP_DATA_HEADER datahdr;
-	int length = conn->out.end - conn->out.offset;
+	STREAM s;
 
-	POP_LAYER(conn->out, rdp_offset);
-	length = conn->out.end - conn->out.offset;
-	rdp_make_header(&hdr, length, RDP_PDU_DATA, conn->mcs_userid);
-	rdp_io_header(&conn->out, &hdr);
-	rdp_make_data_header(&datahdr, 0x103ea, length, data_pdu_type);
-	rdp_io_data_header(&conn->out, &datahdr);
-	mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True);
-}
+	s = rdp_init_data(8);
 
-void rdp_send_confirm_active(HCONN conn)
-{
-	RDP_ACTIVE_PDU active;
+	out_uint16_le(s, action);
+	out_uint16(s, 0);	/* userid */
+	out_uint32(s, 0);	/* control id */
 
-	rdp_init(conn);
-	rdp_make_active_pdu(&active, 0x103ea, conn->mcs_userid);
-	rdp_io_active_pdu(&conn->out, &active, RDP_PDU_CONFIRM_ACTIVE);
-	MARK_END(conn->out);
-	rdp_send(conn, RDP_PDU_CONFIRM_ACTIVE);
+	s_mark_end(s);
+	rdp_send_data(s, RDP_DATA_PDU_CONTROL);
 }
 
-void rdp_send_synchronize(HCONN conn)
+/* Send a synchronisation PDU */
+static void
+rdp_send_synchronise(void)
 {
-	RDP_SYNCHRONIZE_PDU sync;
+	STREAM s;
 
-	rdp_init_data(conn);
-	rdp_make_synchronize_pdu(&sync, 1002);
-	rdp_io_synchronize_pdu(&conn->out, &sync);
-	MARK_END(conn->out);
-	rdp_send_data(conn, RDP_DATA_PDU_SYNCHRONIZE);
-}
+	s = rdp_init_data(4);
 
-void rdp_send_control(HCONN conn, uint16 action)
-{
-	RDP_CONTROL_PDU control;
+	out_uint16_le(s, 1);	/* type */
+	out_uint16_le(s, 1002);
 
-	rdp_init_data(conn);
-	rdp_make_control_pdu(&control, action);
-	rdp_io_control_pdu(&conn->out, &control);
-	MARK_END(conn->out);
-	rdp_send_data(conn, RDP_DATA_PDU_CONTROL);
+	s_mark_end(s);
+	rdp_send_data(s, RDP_DATA_PDU_SYNCHRONISE);
 }
 
-void rdp_send_fonts(HCONN conn, uint16 seqno)
+/* Send a single input event */
+void
+rdp_send_input(uint32 time, uint16 message_type, uint16 device_flags, uint16 param1, uint16 param2)
 {
-	RDP_FONT_PDU fonts;
+	STREAM s;
 
-	rdp_init_data(conn);
-	rdp_make_font_pdu(&fonts, seqno);
-	rdp_io_font_pdu(&conn->out, &fonts);
-	MARK_END(conn->out);
-	rdp_send_data(conn, RDP_DATA_PDU_FONT2);
-}
+	s = rdp_init_data(16);
 
-void rdp_send_input(HCONN conn)
-{
-	RDP_INPUT_PDU input;
+	out_uint16_le(s, 1);	/* number of events */
+	out_uint16(s, 0);	/* pad */
 
-	rdp_init_data(conn);
-	rdp_make_input_pdu(&input);
-	rdp_io_input_pdu(&conn->out, &input);
-	MARK_END(conn->out);
-	rdp_send_data(conn, RDP_DATA_PDU_INPUT);
+	out_uint32_le(s, time);
+	out_uint16_le(s, message_type);
+	out_uint16_le(s, device_flags);
+	out_uint16_le(s, param1);
+	out_uint16_le(s, param2);
+
+	s_mark_end(s);
+	rdp_send_data(s, RDP_DATA_PDU_INPUT);
 }
 
-BOOL rdp_recv_pdu(HCONN conn, uint8 *type)
+/* Send an (empty) font information PDU */
+static void
+rdp_send_fonts(uint16 seq)
 {
-	RDP_HEADER hdr;
+	STREAM s;
 
-	if (!mcs_recv(conn, False) || !rdp_io_header(&conn->in, &hdr))
-		return False;
+	s = rdp_init_data(8);
 
-	*type = hdr.pdu_type & 0xf;
-	return True;
-}
+	out_uint16(s, 0);	/* number of fonts */
+	out_uint16_le(s, 0x3e);	/* unknown */
+	out_uint16_le(s, seq);	/* unknown */
+	out_uint16_le(s, 0x32);	/* entry size */
 
-/* Disconnect from the RDP layer */
-void rdp_disconnect(HCONN conn)
-{
-	mcs_disconnect(conn);
+	s_mark_end(s);
+	rdp_send_data(s, RDP_DATA_PDU_FONT2);
 }
 
-void rdp_make_header(RDP_HEADER *hdr, uint16 length, uint16 pdu_type,
-		     uint16 userid)
+/* Output general capability set */
+static void
+rdp_out_general_caps(STREAM s)
 {
-	hdr->length = length;
-	hdr->pdu_type = pdu_type | 0x10; /* Version 1 */
-	hdr->userid = userid + 1001;
-}
+	out_uint16_le(s, RDP_CAPSET_GENERAL);
+	out_uint16_le(s, RDP_CAPLEN_GENERAL);
 
-void rdp_make_data_header(RDP_DATA_HEADER *hdr, uint32 shareid,
-			  uint16 length, uint16 data_pdu_type)
-{
-	hdr->shareid = shareid;
-	hdr->pad = 0;
-	hdr->streamid = 1;
-	hdr->length = length - 14;
-	hdr->data_pdu_type = data_pdu_type;
-	hdr->compress_type = 0;
-	hdr->compress_len = 0;
+	out_uint16_le(s, 1);	/* OS major type */
+	out_uint16_le(s, 3);	/* OS minor type */
+	out_uint16_le(s, 0x200);	/* Protocol version */
+	out_uint16(s, 0);	/* Pad */
+	out_uint16(s, 0);	/* Compression types */
+	out_uint16_le(s, g_use_rdp5 ? 0x40d : 0);
+	/* Pad, according to T.128. 0x40d seems to 
+	   trigger
+	   the server to start sending RDP5 packets. 
+	   However, the value is 0x1d04 with W2KTSK and
+	   NT4MS. Hmm.. Anyway, thankyou, Microsoft,
+	   for sending such information in a padding 
+	   field.. */
+	out_uint16(s, 0);	/* Update capability */
+	out_uint16(s, 0);	/* Remote unshare capability */
+	out_uint16(s, 0);	/* Compression level */
+	out_uint16(s, 0);	/* Pad */
 }
 
-void rdp_make_general_caps(RDP_GENERAL_CAPS *caps)
+/* Output bitmap capability set */
+static void
+rdp_out_bitmap_caps(STREAM s)
 {
-	caps->os_major_type = 1;
-	caps->os_minor_type = 3;
-	caps->ver_protocol = 0x200;
-}
+	out_uint16_le(s, RDP_CAPSET_BITMAP);
+	out_uint16_le(s, RDP_CAPLEN_BITMAP);
 
-void rdp_make_bitmap_caps(RDP_BITMAP_CAPS *caps)
-{
-	caps->preferred_bpp = 8;
-	caps->receive1bpp = 1;
-	caps->receive4bpp = 1;
-	caps->receive8bpp = 1;
-	caps->width = 640;
-	caps->height = 480;
-	caps->compression = 1;
-	caps->unknown2 = 1;
+	out_uint16_le(s, g_server_bpp);	/* Preferred BPP */
+	out_uint16_le(s, 1);	/* Receive 1 BPP */
+	out_uint16_le(s, 1);	/* Receive 4 BPP */
+	out_uint16_le(s, 1);	/* Receive 8 BPP */
+	out_uint16_le(s, 800);	/* Desktop width */
+	out_uint16_le(s, 600);	/* Desktop height */
+	out_uint16(s, 0);	/* Pad */
+	out_uint16(s, 0);	/* Allow resize */
+	out_uint16_le(s, g_bitmap_compression ? 1 : 0);	/* Support compression */
+	out_uint16(s, 0);	/* Unknown */
+	out_uint16_le(s, 1);	/* Unknown */
+	out_uint16(s, 0);	/* Pad */
 }
 
-void rdp_make_order_caps(RDP_ORDER_CAPS *caps)
+/* Output order capability set */
+static void
+rdp_out_order_caps(STREAM s)
 {
-	caps->xgranularity = 1;
-	caps->ygranularity = 20;
-	caps->max_order_level = 1;
-	caps->num_fonts = 0x147;
-	caps->cap_flags = 0x2A;
-
-//	caps->cap_flags = ORDER_CAP_NEGOTIATE | ORDER_CAP_NOSUPPORT;
+	uint8 order_caps[32];
 
-	caps->support[0] = caps->support[1] = caps->support[2]
-		= caps->support[3] = caps->support[4] = caps->support[5]
-		= caps->support[6] = caps->support[8] = caps->support[11]
-		= caps->support[12] = caps->support[22] = caps->support[28]
-		= caps->support[29] = caps->support[30] = 1;
-	caps->text_cap_flags = 0x6A1;
-	caps->desk_save_size = 0x38400;
-	caps->unknown2 = 0x4E4;
-}
 
-void rdp_make_bmpcache_caps(RDP_BMPCACHE_CAPS *caps)
-{
-	caps->caches[0].entries = 0x258;
-	caps->caches[0].max_cell_size = 0x100;
-	caps->caches[1].entries = 0x12c;
-	caps->caches[1].max_cell_size = 0x400;
-	caps->caches[2].entries = 0x106;
-	caps->caches[2].max_cell_size = 0x1000;
-}
+	memset(order_caps, 0, 32);
+	order_caps[0] = 1;	/* dest blt */
+	order_caps[1] = 1;	/* pat blt */
+	order_caps[2] = 1;	/* screen blt */
+	order_caps[3] = 1;	/* required for memblt? */
+	order_caps[8] = 1;	/* line */
+	order_caps[9] = 1;	/* line */
+	order_caps[10] = 1;	/* rect */
+	order_caps[11] = (g_desktop_save == False ? 0 : 1);	/* desksave */
+	order_caps[13] = 1;	/* memblt */
+	order_caps[14] = 1;	/* triblt */
+	order_caps[22] = 1;	/* polyline */
+	order_caps[27] = 1;	/* text2 */
+	out_uint16_le(s, RDP_CAPSET_ORDER);
+	out_uint16_le(s, RDP_CAPLEN_ORDER);
 
-void rdp_make_control_caps(RDP_CONTROL_CAPS *caps)
-{
-	caps->control_interest = 2;
-	caps->detach_interest = 2;
+	out_uint8s(s, 20);	/* Terminal desc, pad */
+	out_uint16_le(s, 1);	/* Cache X granularity */
+	out_uint16_le(s, 20);	/* Cache Y granularity */
+	out_uint16(s, 0);	/* Pad */
+	out_uint16_le(s, 1);	/* Max order level */
+	out_uint16_le(s, 0x147);	/* Number of fonts */
+	out_uint16_le(s, 0x2a);	/* Capability flags */
+	out_uint8p(s, order_caps, 32);	/* Orders supported */
+	out_uint16_le(s, 0x6a1);	/* Text capability flags */
+	out_uint8s(s, 6);	/* Pad */
+	out_uint32_le(s, g_desktop_save == False ? 0 : 0x38400);	/* Desktop cache size */
+	out_uint32(s, 0);	/* Unknown */
+	out_uint32_le(s, 0x4e4);	/* Unknown */
 }
 
-void rdp_make_activate_caps(RDP_ACTIVATE_CAPS *caps)
+/* Output bitmap cache capability set */
+static void
+rdp_out_bmpcache_caps(STREAM s)
 {
-}
+	int Bpp;
+	out_uint16_le(s, RDP_CAPSET_BMPCACHE);
+	out_uint16_le(s, RDP_CAPLEN_BMPCACHE);
 
-void rdp_make_pointer_caps(RDP_POINTER_CAPS *caps)
-{
-	caps->colour_pointer = 0;
-	caps->cache_size = 20;
+	Bpp = (g_server_bpp + 7) / 8;
+	out_uint8s(s, 24);	/* unused */
+	out_uint16_le(s, 0x258);	/* entries */
+	out_uint16_le(s, 0x100 * Bpp);	/* max cell size */
+	out_uint16_le(s, 0x12c);	/* entries */
+	out_uint16_le(s, 0x400 * Bpp);	/* max cell size */
+	out_uint16_le(s, 0x106);	/* entries */
+	out_uint16_le(s, 0x1000 * Bpp);	/* max cell size */
 }
 
-void rdp_make_share_caps(RDP_SHARE_CAPS *caps, uint16 userid)
+/* Output control capability set */
+static void
+rdp_out_control_caps(STREAM s)
 {
-}
+	out_uint16_le(s, RDP_CAPSET_CONTROL);
+	out_uint16_le(s, RDP_CAPLEN_CONTROL);
 
-void rdp_make_colcache_caps(RDP_COLCACHE_CAPS *caps)
-{
-	caps->cache_size = 6;
+	out_uint16(s, 0);	/* Control capabilities */
+	out_uint16(s, 0);	/* Remote detach */
+	out_uint16_le(s, 2);	/* Control interest */
+	out_uint16_le(s, 2);	/* Detach interest */
 }
 
-void rdp_make_active_pdu(RDP_ACTIVE_PDU *pdu, uint32 shareid, uint16 userid)
+/* Output activation capability set */
+static void
+rdp_out_activate_caps(STREAM s)
 {
-	memset(pdu, 0, sizeof(*pdu));
-	pdu->shareid = shareid;
-	pdu->userid  = 1002;
-	pdu->source_len = sizeof(RDP_SOURCE);
-	memcpy(pdu->source, RDP_SOURCE, sizeof(RDP_SOURCE));
-
-	pdu->caps_len = RDP_CAPLEN_GENERAL + RDP_CAPLEN_BITMAP + RDP_CAPLEN_ORDER
-		+ RDP_CAPLEN_BMPCACHE + RDP_CAPLEN_COLCACHE + RDP_CAPLEN_ACTIVATE
-		+ RDP_CAPLEN_CONTROL + RDP_CAPLEN_POINTER + RDP_CAPLEN_SHARE
-		+ RDP_CAPLEN_UNKNOWN;
-	pdu->num_caps = 0xD;
+	out_uint16_le(s, RDP_CAPSET_ACTIVATE);
+	out_uint16_le(s, RDP_CAPLEN_ACTIVATE);
 
-	rdp_make_general_caps (&pdu->general_caps );
-	rdp_make_bitmap_caps  (&pdu->bitmap_caps  );
-	rdp_make_order_caps   (&pdu->order_caps   );
-	rdp_make_bmpcache_caps(&pdu->bmpcache_caps);
-	rdp_make_control_caps (&pdu->control_caps );
-	rdp_make_activate_caps(&pdu->activate_caps);
-	rdp_make_pointer_caps (&pdu->pointer_caps );
-	rdp_make_share_caps   (&pdu->share_caps, userid);
-	rdp_make_colcache_caps(&pdu->colcache_caps);
+	out_uint16(s, 0);	/* Help key */
+	out_uint16(s, 0);	/* Help index key */
+	out_uint16(s, 0);	/* Extended help key */
+	out_uint16(s, 0);	/* Window activate */
 }
 
-void rdp_make_control_pdu(RDP_CONTROL_PDU *pdu, uint16 action)
+/* Output pointer capability set */
+static void
+rdp_out_pointer_caps(STREAM s)
 {
-	pdu->action = action;
-	pdu->userid = 0;
-	pdu->controlid = 0;
-}
+	out_uint16_le(s, RDP_CAPSET_POINTER);
+	out_uint16_le(s, RDP_CAPLEN_POINTER);
 
-void rdp_make_synchronize_pdu(RDP_SYNCHRONIZE_PDU *pdu, uint16 userid)
-{
-	pdu->type = 1;
-	pdu->userid = userid;
+	out_uint16(s, 0);	/* Colour pointer */
+	out_uint16_le(s, 20);	/* Cache size */
 }
 
-void rdp_make_font_pdu(RDP_FONT_PDU *pdu, uint16 seqno)
+/* Output share capability set */
+static void
+rdp_out_share_caps(STREAM s)
 {
-	pdu->num_fonts = 0;
-	pdu->unknown1 = 0x3e;
-	pdu->unknown2 = seqno;
-	pdu->entry_size = RDP_FONT_INFO_SIZE;
-}
-
-void rdp_make_input_pdu(RDP_INPUT_PDU *pdu)
-{
-	uint32 now = time(NULL);
-
-	pdu->num_events = 3;
-	pdu->pad = 0;
-
-	pdu->event[0].event_time = now;
-	pdu->event[0].message_type = RDP_INPUT_SYNCHRONIZE;
-	pdu->event[0].device_flags = 0;
-	pdu->event[0].mouse_x = 0;
-	pdu->event[0].mouse_y = 0;
+	out_uint16_le(s, RDP_CAPSET_SHARE);
+	out_uint16_le(s, RDP_CAPLEN_SHARE);
 
-	pdu->event[1].event_time = now;
-	pdu->event[1].message_type = RDP_INPUT_UNKNOWN;
-	pdu->event[1].device_flags = 0x8000;
-	pdu->event[1].mouse_x = 15;
-	pdu->event[1].mouse_y = 0;
-
-	pdu->event[2].event_time = now;
-	pdu->event[2].message_type = RDP_INPUT_MOUSE;
-	pdu->event[2].device_flags = MOUSE_FLAG_MOVE;
-	pdu->event[2].mouse_x = 425;
-	pdu->event[2].mouse_y = 493;
+	out_uint16(s, 0);	/* userid */
+	out_uint16(s, 0);	/* pad */
 }
 
-BOOL rdp_io_header(STREAM s, RDP_HEADER *hdr)
+/* Output colour cache capability set */
+static void
+rdp_out_colcache_caps(STREAM s)
 {
-	BOOL res = True;
-
-	res = res ? lsb_io_uint16(s, &hdr->length  ) : False;
-	res = res ? lsb_io_uint16(s, &hdr->pdu_type) : False;
-	res = res ? lsb_io_uint16(s, &hdr->userid  ) : False;
+	out_uint16_le(s, RDP_CAPSET_COLCACHE);
+	out_uint16_le(s, RDP_CAPLEN_COLCACHE);
 
-	return res;
+	out_uint16_le(s, 6);	/* cache size */
+	out_uint16(s, 0);	/* pad */
 }
 
-BOOL rdp_io_data_header(STREAM s, RDP_DATA_HEADER *hdr)
-{
-	BOOL res = True;
-
-	res = res ? lsb_io_uint32(s, &hdr->shareid      ) : False;
-	res = res ? prs_io_uint8 (s, &hdr->pad          ) : False;
-	res = res ? prs_io_uint8 (s, &hdr->streamid     ) : False;
-	res = res ? lsb_io_uint16(s, &hdr->length       ) : False;
-	res = res ? prs_io_uint8 (s, &hdr->data_pdu_type) : False;
-	res = res ? prs_io_uint8 (s, &hdr->compress_type) : False;
-	res = res ? lsb_io_uint16(s, &hdr->compress_len ) : False;
-
-	return res;
-}
+static uint8 canned_caps[] = {
+	0x01, 0x00, 0x00, 0x00, 0x09, 0x04, 0x00, 0x00, 0x04,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x0C, 0x00, 0x08, 0x00, 0x01,
+	0x00, 0x00, 0x00, 0x0E, 0x00, 0x08, 0x00, 0x01, 0x00, 0x00, 0x00,
+	0x10, 0x00, 0x34, 0x00, 0xFE,
+	0x00, 0x04, 0x00, 0xFE, 0x00, 0x04, 0x00, 0xFE, 0x00, 0x08, 0x00,
+	0xFE, 0x00, 0x08, 0x00, 0xFE,
+	0x00, 0x10, 0x00, 0xFE, 0x00, 0x20, 0x00, 0xFE, 0x00, 0x40, 0x00,
+	0xFE, 0x00, 0x80, 0x00, 0xFE,
+	0x00, 0x00, 0x01, 0x40, 0x00, 0x00, 0x08, 0x00, 0x01, 0x00, 0x01,
+	0x02, 0x00, 0x00, 0x00
+};
 
-BOOL rdp_io_general_caps(STREAM s, RDP_GENERAL_CAPS *caps)
+/* Output unknown capability sets (number 13, 12, 14 and 16) */
+static void
+rdp_out_unknown_caps(STREAM s)
+{
+	out_uint16_le(s, RDP_CAPSET_UNKNOWN);
+	out_uint16_le(s, 0x58);
+
+	out_uint8p(s, canned_caps, RDP_CAPLEN_UNKNOWN - 4);
+}
+
+#define RDP5_FLAG 0x0030
+/* Send a confirm active PDU */
+static void
+rdp_send_confirm_active(void)
+{
+	STREAM s;
+	uint32 sec_flags = g_encryption ? (RDP5_FLAG | SEC_ENCRYPT) : RDP5_FLAG;
+	uint16 caplen =
+		RDP_CAPLEN_GENERAL + RDP_CAPLEN_BITMAP + RDP_CAPLEN_ORDER +
+		RDP_CAPLEN_BMPCACHE + RDP_CAPLEN_COLCACHE +
+		RDP_CAPLEN_ACTIVATE + RDP_CAPLEN_CONTROL +
+		RDP_CAPLEN_POINTER + RDP_CAPLEN_SHARE + RDP_CAPLEN_UNKNOWN + 4 /* w2k fix, why? */ ;
+
+	s = sec_init(sec_flags, 6 + 14 + caplen + sizeof(RDP_SOURCE));
+
+	out_uint16_le(s, 2 + 14 + caplen + sizeof(RDP_SOURCE));
+	out_uint16_le(s, (RDP_PDU_CONFIRM_ACTIVE | 0x10));	/* Version 1 */
+	out_uint16_le(s, (g_mcs_userid + 1001));
+
+	out_uint32_le(s, g_rdp_shareid);
+	out_uint16_le(s, 0x3ea);	/* userid */
+	out_uint16_le(s, sizeof(RDP_SOURCE));
+	out_uint16_le(s, caplen);
+
+	out_uint8p(s, RDP_SOURCE, sizeof(RDP_SOURCE));
+	out_uint16_le(s, 0xd);	/* num_caps */
+	out_uint8s(s, 2);	/* pad */
+
+	rdp_out_general_caps(s);
+	rdp_out_bitmap_caps(s);
+	rdp_out_order_caps(s);
+	rdp_out_bmpcache_caps(s);
+	rdp_out_colcache_caps(s);
+	rdp_out_activate_caps(s);
+	rdp_out_control_caps(s);
+	rdp_out_pointer_caps(s);
+	rdp_out_share_caps(s);
+	rdp_out_unknown_caps(s);
+
+	s_mark_end(s);
+	sec_send(s, sec_flags);
+}
+
+/* Respond to a demand active PDU */
+static void
+process_demand_active(STREAM s)
 {
-	uint16 length = RDP_CAPLEN_GENERAL;
-	uint16 pkt_length = length;
-	BOOL res;
-
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
-	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
-
-	res = res ? lsb_io_uint16(s, &caps->os_major_type ) : False;
-	res = res ? lsb_io_uint16(s, &caps->os_minor_type ) : False;
-	res = res ? lsb_io_uint16(s, &caps->ver_protocol  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad1          ) : False;
-	res = res ? lsb_io_uint16(s, &caps->compress_types) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad2          ) : False;
-	res = res ? lsb_io_uint16(s, &caps->cap_update    ) : False;
-	res = res ? lsb_io_uint16(s, &caps->remote_unshare) : False;
-	res = res ? lsb_io_uint16(s, &caps->compress_level) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad3          ) : False;
-
-	return res;
-}
-
-BOOL rdp_io_bitmap_caps(STREAM s, RDP_BITMAP_CAPS *caps)
-{
-	uint16 length = RDP_CAPLEN_BITMAP;
-	uint16 pkt_length = length;
-	BOOL res;
-
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
-	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
+	uint8 type;
+	uint16 i;
+	uint16 p_bpp;
 
-	res = res ? lsb_io_uint16(s, &caps->preferred_bpp) : False;
-	res = res ? lsb_io_uint16(s, &caps->receive1bpp  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->receive4bpp  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->receive8bpp  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->width        ) : False;
-	res = res ? lsb_io_uint16(s, &caps->height       ) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad1         ) : False;
-	res = res ? lsb_io_uint16(s, &caps->allow_resize ) : False;
-	res = res ? lsb_io_uint16(s, &caps->compression  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->unknown1     ) : False;
-	res = res ? lsb_io_uint16(s, &caps->unknown2     ) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad2         ) : False;
-
-	return res;
-}
-
-BOOL rdp_io_order_caps(STREAM s, RDP_ORDER_CAPS *caps)
-{
-	uint16 length = RDP_CAPLEN_ORDER;
-	uint16 pkt_length = length;
-	BOOL res;
+	in_uint32_le(s, g_rdp_shareid);
 
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
+	/* scan for prefered bpp */
+	while (s_check_rem(s, 6))
 	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
+		in_uint16_le(s, i);
+		if (i == RDP_CAPSET_BITMAP)
+		{
+			in_uint16_le(s, i);
+			if (i == RDP_CAPLEN_BITMAP)
+			{
+				in_uint16_le(s, p_bpp);
+				if (p_bpp == 8 || p_bpp == 15 || p_bpp == 16 || p_bpp == 24)
+				{
+					if (p_bpp < g_server_bpp)
+					{
+						warning("Server limited colour depth to %d bits\n",
+							p_bpp);
+						g_server_bpp = p_bpp;
+					}
+					break;
+				}
+			}
+		}
 	}
 
-	res = res ? prs_io_uint8s(s,  caps->terminal_desc, 16) : False;
-	res = res ? lsb_io_uint32(s, &caps->pad1             ) : False;
-	res = res ? lsb_io_uint16(s, &caps->xgranularity     ) : False;
-	res = res ? lsb_io_uint16(s, &caps->ygranularity     ) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad2             ) : False;
-	res = res ? lsb_io_uint16(s, &caps->max_order_level  ) : False;
-	res = res ? lsb_io_uint16(s, &caps->num_fonts        ) : False;
-	res = res ? lsb_io_uint16(s, &caps->cap_flags        ) : False;
-	res = res ? prs_io_uint8s(s,  caps->support      , 32) : False;
-	res = res ? lsb_io_uint16(s, &caps->text_cap_flags   ) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad3             ) : False;
-	res = res ? lsb_io_uint32(s, &caps->pad4             ) : False;
-	res = res ? lsb_io_uint32(s, &caps->desk_save_size   ) : False;
-	res = res ? lsb_io_uint32(s, &caps->unknown1         ) : False;
-	res = res ? lsb_io_uint32(s, &caps->unknown2         ) : False;
 
-	return res;
-}
+	DEBUG(("DEMAND_ACTIVE(id=0x%x)\n", g_rdp_shareid));
 
-BOOL rdp_io_bmpcache_info(STREAM s, RDP_BMPCACHE_INFO *info)
+	rdp_send_confirm_active();
+	rdp_send_synchronise();
+	rdp_send_control(RDP_CTL_COOPERATE);
+	rdp_send_control(RDP_CTL_REQUEST_CONTROL);
+	rdp_recv(&type);	/* RDP_PDU_SYNCHRONIZE */
+	rdp_recv(&type);	/* RDP_CTL_COOPERATE */
+	rdp_recv(&type);	/* RDP_CTL_GRANT_CONTROL */
+	rdp_send_input(0, RDP_INPUT_SYNCHRONIZE, 0, ui_get_numlock_state(read_keyboard_state()), 0);
+	rdp_send_fonts(1);
+	rdp_send_fonts(2);
+	rdp_recv(&type);	/* RDP_PDU_UNKNOWN 0x28 */
+	reset_order_state();
+}
+
+/* Process a colour pointer PDU */
+void
+process_colour_pointer_pdu(STREAM s)
+{
+	uint16 x, y, width, height, cache_idx, masklen, datalen;
+	uint8 *mask, *data;
+	HCURSOR cursor;
+
+	in_uint16_le(s, cache_idx);
+	in_uint16_le(s, x);
+	in_uint16_le(s, y);
+	in_uint16_le(s, width);
+	in_uint16_le(s, height);
+	in_uint16_le(s, masklen);
+	in_uint16_le(s, datalen);
+	in_uint8p(s, data, datalen);
+	in_uint8p(s, mask, masklen);
+	cursor = ui_create_cursor(x, y, width, height, mask, data);
+	ui_set_cursor(cursor);
+	cache_put_cursor(cache_idx, cursor);
+}
+
+/* Process a cached pointer PDU */
+void
+process_cached_pointer_pdu(STREAM s)
+{
+	uint16 cache_idx;
+
+	in_uint16_le(s, cache_idx);
+	ui_set_cursor(cache_get_cursor(cache_idx));
+}
+
+/* Process a system pointer PDU */
+void
+process_system_pointer_pdu(STREAM s)
 {
-	if (!lsb_io_uint16(s, &info->entries      ))
-		return False;
-
-	if (!lsb_io_uint16(s, &info->max_cell_size))
-		return False;
+	uint16 system_pointer_type;
 
-	return True;
-}
-
-BOOL rdp_io_bmpcache_caps(STREAM s, RDP_BMPCACHE_CAPS *caps)
-{
-	uint16 length = RDP_CAPLEN_BMPCACHE;
-	uint16 pkt_length = length;
-	BOOL res;
-	int i;
-
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
+	in_uint16(s, system_pointer_type);
+	switch (system_pointer_type)
 	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
-
-	for (i = 0; i < 6; i++)
-		res = res ? lsb_io_uint32(s, &caps->unused[i]) : False;
-
-	for (i = 0; i < 3; i++)
-		res = res ? rdp_io_bmpcache_info(s, &caps->caches[i]) : False;
+		case RDP_NULL_POINTER:
+			ui_set_null_cursor();
+			break;
 
-	return res;
+		default:
+			unimpl("System pointer message 0x%x\n", system_pointer_type);
+	}
 }
 
-BOOL rdp_io_control_caps(STREAM s, RDP_CONTROL_CAPS *caps)
+/* Process a pointer PDU */
+static void
+process_pointer_pdu(STREAM s)
 {
-	uint16 length = RDP_CAPLEN_CONTROL;
-	uint16 pkt_length = length;
-	BOOL res;
+	uint16 message_type;
+	uint16 x, y;
 
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
+	in_uint16_le(s, message_type);
+	in_uint8s(s, 2);	/* pad */
+
+	switch (message_type)
 	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
+		case RDP_POINTER_MOVE:
+			in_uint16_le(s, x);
+			in_uint16_le(s, y);
+			if (s_check(s))
+				ui_move_pointer(x, y);
+			break;
 
-	res = res ? lsb_io_uint16(s, &caps->control_caps    ) : False;
-	res = res ? lsb_io_uint16(s, &caps->remote_detach   ) : False;
-	res = res ? lsb_io_uint16(s, &caps->control_interest) : False;
-	res = res ? lsb_io_uint16(s, &caps->detach_interest ) : False;
+		case RDP_POINTER_COLOR:
+			process_colour_pointer_pdu(s);
+			break;
 
-	return res;
-}
+		case RDP_POINTER_CACHED:
+			process_cached_pointer_pdu(s);
+			break;
 
-BOOL rdp_io_activate_caps(STREAM s, RDP_ACTIVATE_CAPS *caps)
-{
-	uint16 length = RDP_CAPLEN_ACTIVATE;
-	uint16 pkt_length = length;
-	BOOL res;
+		case RDP_POINTER_SYSTEM:
+			process_system_pointer_pdu(s);
+			break;
 
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
-	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
+		default:
+			unimpl("Pointer message 0x%x\n", message_type);
 	}
-
-	res = res ? lsb_io_uint16(s, &caps->help_key         ) : False;
-	res = res ? lsb_io_uint16(s, &caps->help_index_key   ) : False;
-	res = res ? lsb_io_uint16(s, &caps->help_extended_key) : False;
-	res = res ? lsb_io_uint16(s, &caps->window_activate  ) : False;
-
-	return res;
 }
 
-BOOL rdp_io_pointer_caps(STREAM s, RDP_POINTER_CAPS *caps)
+/* Process bitmap updates */
+void
+process_bitmap_updates(STREAM s)
 {
-	uint16 length = RDP_CAPLEN_POINTER;
-	uint16 pkt_length = length;
-	BOOL res;
+	uint16 num_updates;
+	uint16 left, top, right, bottom, width, height;
+	uint16 cx, cy, bpp, Bpp, compress, bufsize, size;
+	uint8 *data, *bmpdata;
+	int i;
+
+	in_uint16_le(s, num_updates);
 
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
+	for (i = 0; i < num_updates; i++)
 	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
+		in_uint16_le(s, left);
+		in_uint16_le(s, top);
+		in_uint16_le(s, right);
+		in_uint16_le(s, bottom);
+		in_uint16_le(s, width);
+		in_uint16_le(s, height);
+		in_uint16_le(s, bpp);
+		Bpp = (bpp + 7) / 8;
+		in_uint16_le(s, compress);
+		in_uint16_le(s, bufsize);
 
-	res = res ? lsb_io_uint16(s, &caps->colour_pointer) : False;
-	res = res ? lsb_io_uint16(s, &caps->cache_size    ) : False;
+		cx = right - left + 1;
+		cy = bottom - top + 1;
 
-	return res;
-}
+		DEBUG(("BITMAP_UPDATE(l=%d,t=%d,r=%d,b=%d,w=%d,h=%d,Bpp=%d,cmp=%d)\n",
+		       left, top, right, bottom, width, height, Bpp, compress));
 
-BOOL rdp_io_share_caps(STREAM s, RDP_SHARE_CAPS *caps)
-{
-	uint16 length = RDP_CAPLEN_SHARE;
-	uint16 pkt_length = length;
-	BOOL res;
+		if (!compress)
+		{
+			int y;
+			bmpdata = (uint8 *) xmalloc(width * height * Bpp);
+			for (y = 0; y < height; y++)
+			{
+				in_uint8a(s, &bmpdata[(height - y - 1) * (width * Bpp)],
+					  width * Bpp);
+			}
+			ui_paint_bitmap(left, top, cx, cy, width, height, bmpdata);
+			xfree(bmpdata);
+			continue;
+		}
 
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
-	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
 
-	res = res ? lsb_io_uint16(s, &caps->userid) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad   ) : False;
+		if (compress & 0x400)
+		{
+			size = bufsize;
+		}
+		else
+		{
+			in_uint8s(s, 2);	/* pad */
+			in_uint16_le(s, size);
+			in_uint8s(s, 4);	/* line_size, final_size */
+		}
+		in_uint8p(s, data, size);
+		bmpdata = (uint8 *) xmalloc(width * height * Bpp);
+		if (bitmap_decompress(bmpdata, width, height, data, size, Bpp))
+		{
+			ui_paint_bitmap(left, top, cx, cy, width, height, bmpdata);
+		}
+		else
+		{
+			DEBUG_RDP5(("Failed to decompress data\n"));
+		}
 
-	return res;
+		xfree(bmpdata);
+	}
 }
 
-BOOL rdp_io_colcache_caps(STREAM s, RDP_COLCACHE_CAPS *caps)
+/* Process a palette update */
+void
+process_palette(STREAM s)
 {
-	uint16 length = RDP_CAPLEN_COLCACHE;
-	uint16 pkt_length = length;
-	BOOL res;
-
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
-	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
-	}
+	COLOURENTRY *entry;
+	COLOURMAP map;
+	HCOLOURMAP hmap;
+	int i;
 
-	res = res ? lsb_io_uint16(s, &caps->cache_size) : False;
-	res = res ? lsb_io_uint16(s, &caps->pad       ) : False;
+	in_uint8s(s, 2);	/* pad */
+	in_uint16_le(s, map.ncolours);
+	in_uint8s(s, 2);	/* pad */
 
-	return res;
-}
+	map.colours = (COLOURENTRY *) xmalloc(sizeof(COLOURENTRY) * map.ncolours);
 
-uint8 canned_caps[] = {
-0x01,0x00,0x00,0x00,0x09,0x04,0x00,0x00,0x04,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x08,0x00,0x01,
-0x00,0x00,0x00,0x0E,0x00,0x08,0x00,0x01,0x00,0x00,0x00,0x10,0x00,0x34,0x00,0xFE,
-0x00,0x04,0x00,0xFE,0x00,0x04,0x00,0xFE,0x00,0x08,0x00,0xFE,0x00,0x08,0x00,0xFE,
-0x00,0x10,0x00,0xFE,0x00,0x20,0x00,0xFE,0x00,0x40,0x00,0xFE,0x00,0x80,0x00,0xFE,
-0x00,0x00,0x01,0x40,0x00,0x00,0x08,0x00,0x01,0x00,0x01,0x02,0x00,0x00,0x00
-};
+	DEBUG(("PALETTE(c=%d)\n", map.ncolours));
 
-BOOL rdp_io_unknown_caps(STREAM s, void *caps)
-{
-	uint16 length = 0x58;
-	uint16 pkt_length = length;
-	BOOL res;
-
-	res = lsb_io_uint16(s, &pkt_length);
-	if (pkt_length != length)
+	for (i = 0; i < map.ncolours; i++)
 	{
-		fprintf(stderr, "Unrecognised capabilities size\n");
-		return False;
+		entry = &map.colours[i];
+		in_uint8(s, entry->red);
+		in_uint8(s, entry->green);
+		in_uint8(s, entry->blue);
 	}
 
-	res = res ? prs_io_uint8s(s, canned_caps, RDP_CAPLEN_UNKNOWN-4) : False;
+	hmap = ui_create_colourmap(&map);
+	ui_set_colourmap(hmap);
 
-	return res;
+	xfree(map.colours);
 }
 
-BOOL rdp_io_active_pdu(STREAM s, RDP_ACTIVE_PDU *pdu, int pdutype)
+/* Process an update PDU */
+static void
+process_update_pdu(STREAM s)
 {
-	uint16 capset;
-	uint16 length;
-	BOOL res;
-	int i;
-
-	res = lsb_io_uint32(s, &pdu->shareid);
+	uint16 update_type, count;
 
-	if (pdutype == RDP_PDU_CONFIRM_ACTIVE)
-		res = res ? lsb_io_uint16(s, &pdu->userid    ) : False;
+	in_uint16_le(s, update_type);
 
-	res = res ? lsb_io_uint16(s, &pdu->source_len) : False;
-	res = res ? lsb_io_uint16(s, &pdu->caps_len  ) : False;
-
-	if (pdu->source_len > 48)
+	switch (update_type)
 	{
-		fprintf(stderr, "RDP source descriptor too long\n");
-		return False;
-	}
-
-	res = res ? prs_io_uint8s(s,  pdu->source, pdu->source_len) : False;
-	res = res ? lsb_io_uint16(s, &pdu->num_caps  ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->pad       ) : False;
-
-	if (s->marshall)
-        {
-		capset = RDP_CAPSET_GENERAL;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_general_caps(s, &pdu->general_caps) : False;
-
-		capset = RDP_CAPSET_BITMAP;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_bitmap_caps (s, &pdu->bitmap_caps ) : False;
-
-		capset = RDP_CAPSET_ORDER;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_order_caps  (s, &pdu->order_caps  ) : False;
-
-		capset = RDP_CAPSET_BMPCACHE;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_bmpcache_caps(s, &pdu->bmpcache_caps) : False;
-
-		capset = RDP_CAPSET_COLCACHE;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_colcache_caps(s, &pdu->colcache_caps) : False;
-
-		capset = RDP_CAPSET_ACTIVATE;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_activate_caps(s, &pdu->activate_caps) : False;
-
-		capset = RDP_CAPSET_CONTROL;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_control_caps(s, &pdu->control_caps) : False;
-
-		capset = RDP_CAPSET_POINTER;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_pointer_caps(s, &pdu->pointer_caps) : False;
-
-		capset = RDP_CAPSET_SHARE;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_share_caps  (s, &pdu->share_caps  ) : False;
-
-		capset = RDP_CAPSET_UNKNOWN;
-		res = res ? lsb_io_uint16(s, &capset) : False;
-		res = res ? rdp_io_unknown_caps(s, NULL) : False;
-	}
-	else
-	{
-		for (i = 0; i < pdu->num_caps; i++)
-		{
-			if (!res)
-				return False;
+		case RDP_UPDATE_ORDERS:
+			in_uint8s(s, 2);	/* pad */
+			in_uint16_le(s, count);
+			in_uint8s(s, 2);	/* pad */
+			process_orders(s, count);
+			break;
 
-			if (!lsb_io_uint16(s, &capset))
-				return False;
+		case RDP_UPDATE_BITMAP:
+			process_bitmap_updates(s);
+			break;
 
-			switch (capset)
-			{
-			case RDP_CAPSET_GENERAL:
-				res = rdp_io_general_caps (s, &pdu->general_caps );
-				break;
-			case RDP_CAPSET_BITMAP:
-				res = rdp_io_bitmap_caps  (s, &pdu->bitmap_caps  );
-				break;
-			case RDP_CAPSET_ORDER:
-				res = rdp_io_order_caps   (s, &pdu->order_caps   );
-				break;
-			case RDP_CAPSET_BMPCACHE:
-				res = rdp_io_bmpcache_caps(s, &pdu->bmpcache_caps);
-				break;
-			case RDP_CAPSET_CONTROL:
-				res = rdp_io_control_caps (s, &pdu->control_caps );
-				break;
-			case RDP_CAPSET_ACTIVATE:
-				res = rdp_io_activate_caps(s, &pdu->activate_caps);
-				break;
-			case RDP_CAPSET_POINTER:
-				res = rdp_io_pointer_caps (s, &pdu->pointer_caps );
-				break;
-			case RDP_CAPSET_SHARE:
-				res = rdp_io_share_caps   (s, &pdu->share_caps   );
-				break;
-			case RDP_CAPSET_COLCACHE:
-				res = rdp_io_colcache_caps(s, &pdu->colcache_caps);
-				break;
-			default:
-				fprintf(stderr, "Warning: Unrecognised capset %x\n",
-					capset);
+		case RDP_UPDATE_PALETTE:
+			process_palette(s);
+			break;
 
-				if (!lsb_io_uint16(s, &length))
-					return False;
+		case RDP_UPDATE_SYNCHRONIZE:
+			break;
 
-				s->offset += (length - 4);
-			}
-		}
+		default:
+			unimpl("update %d\n", update_type);
 	}
 
-	return res;
 }
 
-BOOL rdp_io_control_pdu(STREAM s, RDP_CONTROL_PDU *pdu)
+/* Process data PDU */
+static void
+process_data_pdu(STREAM s)
 {
-	BOOL res = True;
+	uint8 data_pdu_type;
+	uint8 ctype;
+	uint16 clen;
+	int roff, rlen, len, ret;
+	static struct stream ns;
+	static signed char *dict = 0;
 
-	res = res ? lsb_io_uint16(s, &pdu->action   ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->userid   ) : False;
-	res = res ? lsb_io_uint32(s, &pdu->controlid) : False;
+	in_uint8s(s, 6);	/* shareid, pad, streamid */
+	in_uint16(s, len);
+	in_uint8(s, data_pdu_type);
+	in_uint8(s, ctype);
+	in_uint16(s, clen);
+	clen -= 18;
 
-	return res;
-}
-
-BOOL rdp_io_synchronize_pdu(STREAM s, RDP_SYNCHRONIZE_PDU *pdu)
-{
-	BOOL res = True;
+#if 0
+	if (ctype & 0x20)
+	{
+		if (!dict)
+		{
+			dict = (signed char *) malloc(8200 * sizeof(signed char));
+			dict = (signed char *) memset(dict, 0, 8200 * sizeof(signed char));
+		}
 
-	res = res ? lsb_io_uint16(s, &pdu->type  ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->userid) : False;
+		ret = decompress(s->p, clen, ctype, (signed char *) dict, &roff, &rlen);
 
-	return res;
-}
+		len -= 18;
 
-BOOL rdp_io_input_event(STREAM s, RDP_INPUT_EVENT *evt)
-{
-	BOOL res = True;
+		ns.data = xrealloc(ns.data, len);
 
-	res = res ? lsb_io_uint32(s, &evt->event_time)   : False;
-	res = res ? lsb_io_uint16(s, &evt->message_type) : False;
+		ns.data = (unsigned char *) memcpy(ns.data, (unsigned char *) (dict + roff), len);
 
-	if (!res)
-		return False;
+		ns.size = len;
+		ns.end = ns.data + ns.size;
+		ns.p = ns.data;
+		ns.rdp_hdr = ns.p;
 
-	switch (evt->message_type)
-	{
-	case RDP_INPUT_CODEPOINT:
-	case RDP_INPUT_VIRTKEY:
-		res = res ? lsb_io_uint16(s, &evt->device_flags) : False;
-		res = res ? lsb_io_uint16(s, &evt->kbd_keycode ) : False;
-		break;
-	case RDP_INPUT_SYNCHRONIZE:
-	case RDP_INPUT_UNKNOWN:
-	case RDP_INPUT_MOUSE:
-		res = res ? lsb_io_uint16(s, &evt->device_flags) : False;
-		res = res ? lsb_io_uint16(s, &evt->mouse_x     ) : False;
-		res = res ? lsb_io_uint16(s, &evt->mouse_y     ) : False;
-		break;
-	default:
-		fprintf(stderr, "Unknown input type %d\n", evt->message_type);
-		return False;
+		s = &ns;
 	}
+#endif
 
-	return res;
-}
-
-BOOL rdp_io_input_pdu(STREAM s, RDP_INPUT_PDU *pdu)
-{
-	BOOL res = True;
-	int i;
-
-	res = res ? lsb_io_uint16(s, &pdu->num_events) : False;
-	res = res ? lsb_io_uint16(s, &pdu->pad       ) : False;
-
-	if (pdu->num_events > RDP_MAX_EVENTS)
+	switch (data_pdu_type)
 	{
-		fprintf(stderr, "Too many events in one PDU\n");
-		return False;
-	}
+		case RDP_DATA_PDU_UPDATE:
+			process_update_pdu(s);
+			break;
 
-	for (i = 0; i < pdu->num_events; i++)
-	{
-		res = res ? rdp_io_input_event(s, &pdu->event[i]) : False;
-	}
+		case RDP_DATA_PDU_POINTER:
+			process_pointer_pdu(s);
+			break;
 
-	return res;
-}
+		case RDP_DATA_PDU_BELL:
+			ui_bell();
+			break;
 
-BOOL rdp_io_font_info(STREAM s, RDP_FONT_INFO *font)
-{
-	BOOL res = True;
+		case RDP_DATA_PDU_LOGON:
+			DEBUG(("Received Logon PDU\n"));
+			/* User logged on */
+			break;
 
-	res = res ? prs_io_uint8s(s,  font->name, 32 ) : False;
-	res = res ? lsb_io_uint16(s, &font->flags    ) : False;
-	res = res ? lsb_io_uint16(s, &font->width    ) : False;
-	res = res ? lsb_io_uint16(s, &font->height   ) : False;
-	res = res ? lsb_io_uint16(s, &font->xaspect  ) : False;
-	res = res ? lsb_io_uint16(s, &font->yaspect  ) : False;
-	res = res ? lsb_io_uint32(s, &font->signature) : False;
-	res = res ? lsb_io_uint16(s, &font->codepage ) : False;
-	res = res ? lsb_io_uint16(s, &font->ascent   ) : False;
+		case RDP_DATA_PDU_DISCONNECT:
+			/* Normally received when user logs out or disconnects from a
+			   console session on Windows XP and 2003 Server */
+			DEBUG(("Received disconnect PDU\n"));
+			break;
 
-	return res;
+		default:
+			unimpl("data PDU %d\n", data_pdu_type);
+	}
 }
 
-BOOL rdp_io_font_pdu(STREAM s, RDP_FONT_PDU *pdu)
+/* Process incoming packets */
+BOOL
+rdp_main_loop(void)
 {
-	BOOL res = True;
-	int i;
-
-	res = res ? lsb_io_uint16(s, &pdu->num_fonts ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->unknown1  ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->unknown2  ) : False;
-	res = res ? lsb_io_uint16(s, &pdu->entry_size) : False;
-
-	if (pdu->num_fonts > RDP_MAX_FONTS)
-	{
-		fprintf(stderr, "Too many fonts in one PDU\n");
-		return False;
-	}
+	uint8 type;
+	STREAM s;
 
-	for (i = 0; i < pdu->num_fonts; i++)
+	while ((s = rdp_recv(&type)) != NULL)
 	{
-		res = res ? rdp_io_font_info(s, &pdu->font[i]) : False;
-	}
+		switch (type)
+		{
+			case RDP_PDU_DEMAND_ACTIVE:
+				process_demand_active(s);
+				break;
 
-	return res;
-}
+			case RDP_PDU_DEACTIVATE:
+				DEBUG(("RDP_PDU_DEACTIVATE\n"));
+				/* We thought we could detect a clean
+				   shutdown of the session by this
+				   packet, but it seems Windows 2003
+				   is sending us one of these when we
+				   reconnect to a disconnected session
+				   return True; */
+				break;
 
-BOOL rdp_io_update_pdu(STREAM s, RDP_UPDATE_PDU *pdu)
-{
-	BOOL res = True;
+			case RDP_PDU_DATA:
+				process_data_pdu(s);
+				break;
 
-	res = res ? lsb_io_uint16(s, &pdu->update_type) : False;
-	res = res ? lsb_io_uint16(s, &pdu->pad        ) : False;
+			case 0:
+				break;
 
-	return res;
+			default:
+				unimpl("PDU %d\n", type);
+		}
+	}
+	return True;
+	/* We want to detect if we got a clean shutdown, but we
+	   can't. Se above.  
+	   return False;  */
 }
 
-BOOL rdp_io_secondary_order(STREAM s, RDP_SECONDARY_ORDER *rso)
+/* Establish a connection up to the RDP layer */
+BOOL
+rdp_connect(char *server, uint32 flags, char *domain, char *password,
+	    char *command, char *directory)
 {
-	BOOL res = True;
-
-	res = res ? lsb_io_uint16(s, &rso->length) : False;
-	res = res ? lsb_io_uint16(s, &rso->flags ) : False;
-	res = res ? prs_io_uint8 (s, &rso->type  ) : False;
+	if (!sec_connect(server, g_username))
+		return False;
 
-	return res;
+	rdp_send_logon_info(flags, domain, g_username, password, command, directory);
+	return True;
 }
 
-BOOL rdp_io_bitmap_header(STREAM s, RDP_BITMAP_HEADER *rdh)
+/* Disconnect from the RDP layer */
+void
+rdp_disconnect(void)
 {
-	BOOL res = True;
-
-	res = res ? prs_io_uint8 (s, &rdh->cache_id  ) : False;
-	res = res ? prs_io_uint8 (s, &rdh->pad1      ) : False;
-	res = res ? prs_io_uint8 (s, &rdh->width     ) : False;
-	res = res ? prs_io_uint8 (s, &rdh->height    ) : False;
-	res = res ? prs_io_uint8 (s, &rdh->bpp       ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->bufsize   ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->cache_idx ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->pad2      ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->size      ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->row_size  ) : False;
-	res = res ? lsb_io_uint16(s, &rdh->final_size) : False;
-
-	return res;
+	sec_disconnect();
 }