--- sourceforge.net/trunk/rdesktop/rdp.c 2000/07/05 07:44:21 6 +++ sourceforge.net/trunk/rdesktop/rdp.c 2005/03/19 15:30:14 866 @@ -1,1155 +1,1326 @@ -/* +/* -*- c-basic-offset: 8 -*- rdesktop: A Remote Desktop Protocol client. Protocol services - RDP layer - Copyright (C) Matthew Chapman 1999-2000 - + Copyright (C) Matthew Chapman 1999-2005 + This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. - + This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - + You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ -#include "includes.h" - -/* Establish a connection up to the RDP layer */ -HCONN rdp_connect(char *server) -{ - HCONN conn; - RDP_ACTIVE_PDU active; - uint8 type; - - if ((conn = mcs_connect(server)) == NULL) - return NULL; - - rdp_establish_key(conn); - mcs_recv(conn, False); /* Server's licensing certificate */ - rdp_send_cert(conn); - mcs_recv(conn, False); - - if (!rdp_recv_pdu(conn, &type) || (type != RDP_PDU_DEMAND_ACTIVE)) - { - fprintf(stderr, "RDP error, expected Demand Active\n"); - mcs_disconnect(conn); - return NULL; - } - - rdp_io_active_pdu(&conn->in, &active, RDP_PDU_DEMAND_ACTIVE); - rdp_send_confirm_active(conn); - rdp_send_synchronize(conn); - rdp_send_control(conn, RDP_CTL_COOPERATE); - rdp_send_control(conn, RDP_CTL_REQUEST_CONTROL); - rdp_recv_pdu(conn, &type); // RDP_PDU_SYNCHRONIZE - rdp_recv_pdu(conn, &type); // RDP_CTL_COOPERATE - rdp_recv_pdu(conn, &type); // RDP_CTL_GRANT_CONTROL - rdp_send_input(conn); - rdp_send_fonts(conn, 1); - rdp_send_fonts(conn, 2); - rdp_recv_pdu(conn, &type); // RDP_PDU_UNKNOWN 0x28 - - return conn; -} - -void rdp_main_loop(HCONN conn) -{ - RDP_DATA_HEADER hdr; - RDP_UPDATE_PDU update; - RDP_ORDER_STATE os; - uint8 type; - - memset(&os, 0, sizeof(os)); - - while (rdp_recv_pdu(conn, &type)) - { - if (type != RDP_PDU_DATA) - continue; - - rdp_io_data_header(&conn->in, &hdr); - - switch (hdr.data_pdu_type) +#include +#include +#include +#include "rdesktop.h" + +#ifdef HAVE_ICONV +#ifdef HAVE_ICONV_H +#include +#endif + +#ifndef ICONV_CONST +#define ICONV_CONST "" +#endif +#endif + +extern uint16 g_mcs_userid; +extern char g_username[64]; +extern char g_codepage[16]; +extern BOOL g_bitmap_compression; +extern BOOL g_orders; +extern BOOL g_encryption; +extern BOOL g_desktop_save; +extern BOOL g_polygon_ellipse_orders; +extern BOOL g_use_rdp5; +extern uint16 g_server_rdp_version; +extern uint32 g_rdp5_performanceflags; +extern int g_server_bpp; +extern int g_width; +extern int g_height; +extern BOOL g_bitmap_cache; +extern BOOL g_bitmap_cache_persist_enable; + +uint8 *g_next_packet; +uint32 g_rdp_shareid; + +extern RDPCOMP g_mppc_dict; + +#if WITH_DEBUG +static uint32 g_packetno; +#endif + +#ifdef HAVE_ICONV +static BOOL g_iconv_works = True; +#endif + +/* Receive an RDP packet */ +static STREAM +rdp_recv(uint8 * type) +{ + static STREAM rdp_s; + uint16 length, pdu_type; + uint8 rdpver; + + if ((rdp_s == NULL) || (g_next_packet >= rdp_s->end)) + { + rdp_s = sec_recv(&rdpver); + if (rdp_s == NULL) + return NULL; + if (rdpver == 0xff) { - case RDP_DATA_PDU_UPDATE: - rdp_io_update_pdu(&conn->in, &update); - if (update.update_type == RDP_UPDATE_ORDERS) - { - fprintf(stderr, "Received orders\n"); - process_orders(conn, &os); - } - break; + g_next_packet = rdp_s->end; + *type = 0; + return rdp_s; + } + else if (rdpver != 3) + { + /* rdp5_process should move g_next_packet ok */ + rdp5_process(rdp_s); + *type = 0; + return rdp_s; } - } -} - -void prs_io_coord(STREAM s, uint16 *coord, BOOL delta) -{ - uint8 change; - if (delta) - { - prs_io_uint8(s, &change); - *coord += change; + g_next_packet = rdp_s->p; } else { - lsb_io_uint16(s, coord); + rdp_s->p = g_next_packet; } -} -void process_opaque_rect(HCONN conn, RDP_ORDER_STATE *os, BOOL delta) -{ - uint8 present; - prs_io_uint8(&conn->in, &present); - - if (present & 1) - prs_io_coord(&conn->in, &os->opaque_rect.x, delta); + in_uint16_le(rdp_s, length); + /* 32k packets are really 8, keepalive fix */ + if (length == 0x8000) + { + g_next_packet += 8; + *type = 0; + return rdp_s; + } + in_uint16_le(rdp_s, pdu_type); + in_uint8s(rdp_s, 2); /* userid */ + *type = pdu_type & 0xf; - if (present & 2) - prs_io_coord(&conn->in, &os->opaque_rect.y, delta); +#if WITH_DEBUG + DEBUG(("RDP packet #%d, (type %x)\n", ++g_packetno, *type)); + hexdump(g_next_packet, length); +#endif /* */ - if (present & 4) - prs_io_coord(&conn->in, &os->opaque_rect.cx, delta); + g_next_packet += length; + return rdp_s; +} - if (present & 8) - prs_io_coord(&conn->in, &os->opaque_rect.cy, delta); +/* Initialise an RDP data packet */ +static STREAM +rdp_init_data(int maxlen) +{ + STREAM s; - if (present & 16) - prs_io_uint8(&conn->in, &os->opaque_rect.colour); + s = sec_init(g_encryption ? SEC_ENCRYPT : 0, maxlen + 18); + s_push_layer(s, rdp_hdr, 18); - fprintf(stderr, "Opaque rectangle at %d, %d\n", os->opaque_rect.x, os->opaque_rect.y); + return s; } -void process_bmpcache(HCONN conn) +/* Send an RDP data packet */ +static void +rdp_send_data(STREAM s, uint8 data_pdu_type) { + uint16 length; - RDP_BITMAP_HEADER rbh; - char *bmpdata; - HBITMAP bmp; - static int x = 0; - - rdp_io_bitmap_header(&conn->in, &rbh); - fprintf(stderr, "Decompressing bitmap %d x %d, final size %d\n", rbh.width, rbh.height, rbh.final_size); + s_pop_layer(s, rdp_hdr); + length = s->end - s->p; - bmpdata = malloc(rbh.width * rbh.height); - bitmap_decompress(conn->in.data - + conn->in.offset, rbh.size, - bmpdata, rbh.width); - conn->in.offset += rbh.size; + out_uint16_le(s, length); + out_uint16_le(s, (RDP_PDU_DATA | 0x10)); + out_uint16_le(s, (g_mcs_userid + 1001)); - bmp = ui_create_bitmap(conn->wnd, rbh.width, rbh.height, bmpdata); - ui_paint_bitmap(conn->wnd, bmp, x, 0); - ui_destroy_bitmap(bmp); + out_uint32_le(s, g_rdp_shareid); + out_uint8(s, 0); /* pad */ + out_uint8(s, 1); /* streamid */ + out_uint16_le(s, (length - 14)); + out_uint8(s, data_pdu_type); + out_uint8(s, 0); /* compress_type */ + out_uint16(s, 0); /* compress_len */ - x += rbh.width; + sec_send(s, g_encryption ? SEC_ENCRYPT : 0); } -void process_orders(HCONN conn, RDP_ORDER_STATE *os) +/* Output a string in Unicode */ +void +rdp_out_unistr(STREAM s, char *string, int len) { - uint16 num_orders; - int processed = 0; - BOOL res = True; - // unsigned char *p; +#ifdef HAVE_ICONV + size_t ibl = strlen(string), obl = len + 2; + static iconv_t iconv_h = (iconv_t) - 1; + char *pin = string, *pout = (char *)s->p; - lsb_io_uint16(&conn->in, &num_orders); + memset(pout, 0, len + 4); - conn->in.offset += 2; - // p = &conn->in.data[conn->in.offset]; + if (g_iconv_works) + { + if (iconv_h == (iconv_t) - 1) + { + size_t i = 1, o = 4; + if ((iconv_h = iconv_open(WINDOWS_CODEPAGE, g_codepage)) == (iconv_t) - 1) + { + warning("rdp_out_unistr: iconv_open[%s -> %s] fail %d\n", + g_codepage, WINDOWS_CODEPAGE, (int) iconv_h); - // fprintf(stderr, "%02X %02X %02X %02X\n", p[0], p[1], p[2], p[3]); + g_iconv_works = False; + rdp_out_unistr(s, string, len); + return; + } + if (iconv(iconv_h, (ICONV_CONST char **) &pin, &i, &pout, &o) == + (size_t) - 1) + { + iconv_close(iconv_h); + iconv_h = (iconv_t) - 1; + warning("rdp_out_unistr: iconv(1) fail, errno %d\n", errno); - while ((processed < num_orders) && res) - { - uint8 order_flags; + g_iconv_works = False; + rdp_out_unistr(s, string, len); + return; + } + pin = string; + pout = (char *) s->p; + } - prs_io_uint8(&conn->in, &order_flags); + if (iconv(iconv_h, (ICONV_CONST char **) &pin, &ibl, &pout, &obl) == (size_t) - 1) + { + iconv_close(iconv_h); + iconv_h = (iconv_t) - 1; + warning("rdp_out_unistr: iconv(2) fail, errno %d\n", errno); - if (!(order_flags & RDP_ORDER_STANDARD)) + g_iconv_works = False; + rdp_out_unistr(s, string, len); return; + } + + s->p += len + 2; - if (order_flags & RDP_ORDER_SECONDARY) + } + else +#endif + { + int i = 0, j = 0; + + len += 2; + + while (i < len) { - RDP_SECONDARY_ORDER rso; + s->p[i++] = string[j++]; + s->p[i++] = 0; + } + + s->p += len; + } +} + +/* Input a string in Unicode + * + * Returns str_len of string + */ +int +rdp_in_unistr(STREAM s, char *string, int uni_len) +{ +#ifdef HAVE_ICONV + size_t ibl = uni_len, obl = uni_len; + char *pin = (char *)s->p, *pout = string; + static iconv_t iconv_h = (iconv_t) - 1; - rdp_io_secondary_order(&conn->in, &rso); - switch (rso.type) + if (g_iconv_works) + { + if (iconv_h == (iconv_t) - 1) + { + if ((iconv_h = iconv_open(g_codepage, WINDOWS_CODEPAGE)) == (iconv_t) - 1) { - case RDP_ORDER_BMPCACHE: - process_bmpcache(conn); - break; - default: - fprintf(stderr, "Unknown secondary order %d\n", - rso.type); - return; + warning("rdp_in_unistr: iconv_open[%s -> %s] fail %d\n", + WINDOWS_CODEPAGE, g_codepage, (int) iconv_h); + + g_iconv_works = False; + return rdp_in_unistr(s, string, uni_len); } + } + if (iconv(iconv_h, (ICONV_CONST char **) &pin, &ibl, &pout, &obl) == (size_t) - 1) + { + iconv_close(iconv_h); + iconv_h = (iconv_t) - 1; + warning("rdp_in_unistr: iconv fail, errno %d\n", errno); + g_iconv_works = False; + return rdp_in_unistr(s, string, uni_len); } + return pout - string; + } + else +#endif + { + int i = 0; - if (order_flags & RDP_ORDER_CHANGE) - prs_io_uint8(&conn->in, &os->order_type); - - switch (os->order_type) + while (i < uni_len / 2) { - case RDP_ORDER_OPAQUE_RECT: - process_opaque_rect(conn, os, order_flags & RDP_ORDER_DELTA); - break; - default: - fprintf(stderr, "Unknown order %d\n", os->order_type); - return; + in_uint8a(s, &string[i++], 1); + in_uint8s(s, 1); } - processed++; + return i - 1; } } -/* Work this out later. This is useless anyway when encryption is off. */ -uint8 precanned_key_packet[] = { - 0x48,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x33,0x00,0x00,0x00,0x00,0x00, - 0x00,0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x6c,0x86, - 0xf7,0x99,0xef,0x60,0xc4,0x49,0x52,0xd0,0xd8,0xea,0xb5,0x4f,0x58,0x19, - 0x52,0x2a,0x93,0x83,0x57,0x4f,0x4e,0x04,0xde,0x96,0x51,0xab,0x13,0x20, - 0xd8,0xe5,0x00,0x00,0x00,0x00,0x00,0x00 -}; -/* Create an RC4 key and transfer it to the server */ -void rdp_establish_key(HCONN conn) -{ - mcs_init_data(conn); - memcpy(conn->out.data + conn->out.offset, precanned_key_packet, - sizeof(precanned_key_packet)); - conn->out.offset += sizeof(precanned_key_packet); - MARK_END(conn->out); - mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True); -} - -/* Horrible horrible certificate stuff. Work out later. */ -uint8 precanned_cert_packet[] = { -0x80,0x00,0x00,0x00,0x12,0x02,0xb4,0x04,0x01,0x00,0x00, -0x00,0x00,0x00,0x01,0x02,0x9d,0xa3,0x7a,0x93,0x34,0x7b,0x28,0x37,0x24,0xa0,0x1f, -0x61,0x26,0xfd,0x96,0x3a,0x92,0x83,0xf3,0xe9,0x6a,0x2e,0x81,0x7c,0x2c,0xe4,0x72,// -0x01,0x18,0xe9,0xa1,0x0f,0x00,0x00,0x48,0x00,0x84,0x23,0x90,0xe6,0xd3,0xf8,0x20, -0xdb,0xa8,0x1b,0xb2,0xd0,0x78,0x2c,0x35,0xde,0xe3,0x0e,0x63,0x40,0xca,0xac,0x71, -0xc9,0x17,0x49,0x05,0x25,0xeb,0x9b,0xd0,0xa6,0x5c,0x90,0x3e,0x9d,0x4b,0x27,0x01, -0x79,0x1c,0x22,0xfb,0x3c,0x2c,0xb9,0x9f,0xf5,0x21,0xf3,0xee,0xd5,0x4d,0x47,0x1c, -0x85,0xbe,0x83,0x93,0xe8,0xed,0x8c,0x5c,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -0x00,0x01,0x00,0x10,0x04,0x30,0x82,0x04,0x0c,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7, -0x0d,0x01,0x07,0x02,0xa0,0x82,0x03,0xfd,0x30,0x82,0x03,0xf9,0x02,0x01,0x01,0x31, -0x00,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x07,0x01,0xa0,0x82, -0x03,0xe1,0x30,0x82,0x01,0x77,0x30,0x82,0x01,0x25,0xa0,0x03,0x02,0x01,0x02,0x02, -0x08,0x01,0xbf,0x06,0x84,0x9d,0xdb,0x2d,0xe0,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48, -0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x30,0x38,0x31,0x36,0x30,0x11,0x06,0x03, -0x55,0x04,0x03,0x1e,0x0a,0x00,0x4e,0x00,0x54,0x00,0x54,0x00,0x53,0x00,0x45,0x30, -0x21,0x06,0x03,0x55,0x04,0x07,0x1e,0x1a,0x00,0x4d,0x00,0x69,0x00,0x63,0x00,0x72, -0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x6f, -0x00,0x6d,0x30,0x1e,0x17,0x0d,0x39,0x39,0x30,0x39,0x32,0x34,0x31,0x32,0x30,0x32, -0x30,0x34,0x5a,0x17,0x0d,0x34,0x39,0x30,0x39,0x32,0x34,0x31,0x32,0x30,0x32,0x30, -0x34,0x5a,0x30,0x38,0x31,0x36,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x1e,0x0a,0x00, -0x4e,0x00,0x54,0x00,0x54,0x00,0x53,0x00,0x45,0x30,0x21,0x06,0x03,0x55,0x04,0x07, -0x1e,0x1a,0x00,0x4d,0x00,0x69,0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f, -0x00,0x66,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x6f,0x00,0x6d,0x30,0x5c,0x30,0x0d, -0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01,0x05,0x00,0x03,0x4b,0x00, -0x30,0x48,0x02,0x41,0x00,0x91,0xb2,0x16,0x1c,0xae,0x4f,0x7f,0x7c,0xaf,0x57,0x2b, -0x23,0x4c,0x0c,0x25,0x3c,0x4f,0x66,0x9d,0x25,0xc3,0x4f,0x29,0xee,0x8b,0xda,0x4e, -0x95,0xe7,0x3b,0xaa,0xc0,0xa7,0xba,0xaf,0x99,0x8c,0x47,0x24,0x8b,0x09,0x77,0xbc, -0x2c,0xf4,0xe7,0x1a,0x07,0x58,0x7b,0x11,0x37,0x2a,0xa8,0x90,0xc3,0x50,0x92,0x80, -0x15,0xc5,0xda,0x51,0x8b,0x02,0x03,0x01,0x00,0x01,0xa3,0x13,0x30,0x11,0x30,0x0f, -0x06,0x03,0x55,0x1d,0x13,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x00,0x30, -0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x03,0x41,0x00,0x14,0x04,0x67, -0x28,0xc8,0xd3,0x1f,0x13,0x14,0x2e,0x2c,0x93,0x09,0x25,0xbb,0xbe,0x86,0x6a,0xd3, -0x47,0x6f,0x44,0x16,0x7b,0x94,0x8c,0xb2,0xa2,0xd5,0xf7,0x4f,0xb1,0x8f,0x7f,0xde, -0x0b,0x88,0x34,0x4a,0x1d,0xdc,0xa1,0xfd,0x26,0xbd,0x43,0xbb,0x38,0xf1,0x87,0x34, -0xbb,0xe9,0x3b,0xfa,0x7f,0x1e,0xff,0xe1,0x10,0x7e,0xee,0x6e,0xd8,0x30,0x82,0x02, -0x62,0x30,0x82,0x02,0x10,0xa0,0x03,0x02,0x01,0x02,0x02,0x05,0x01,0x00,0x00,0x00, -0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00,0x30,0x38,0x31,0x36, -0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x1e,0x0a,0x00,0x4e,0x00,0x54,0x00,0x54,0x00, -0x53,0x00,0x45,0x30,0x21,0x06,0x03,0x55,0x04,0x07,0x1e,0x1a,0x00,0x4d,0x00,0x69, -0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x2e, -0x00,0x63,0x00,0x6f,0x00,0x6d,0x30,0x1e,0x17,0x0d,0x39,0x39,0x30,0x39,0x32,0x34, -0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x17,0x0d,0x34,0x39,0x30,0x39,0x32,0x34,0x30, -0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x79,0x31,0x77,0x30,0x17,0x06,0x03,0x55,0x04, -0x03,0x1e,0x10,0x00,0x52,0x00,0x45,0x00,0x53,0x00,0x37,0x00,0x2d,0x00,0x4e,0x00, -0x45,0x00,0x57,0x30,0x17,0x06,0x03,0x55,0x04,0x07,0x1e,0x10,0x00,0x7a,0x00,0x32, -0x00,0x32,0x00,0x33,0x00,0x32,0x00,0x32,0x00,0x30,0x00,0x33,0x30,0x43,0x06,0x03, -0x55,0x04,0x05,0x1e,0x3c,0x00,0x31,0x00,0x42,0x00,0x63,0x00,0x4b,0x00,0x65,0x00, -0x57,0x00,0x50,0x00,0x6c,0x00,0x37,0x00,0x58,0x00,0x47,0x00,0x61,0x00,0x73,0x00, -0x38,0x00,0x4a,0x00,0x79,0x00,0x50,0x00,0x34,0x00,0x30,0x00,0x7a,0x00,0x49,0x00, -0x6d,0x00,0x6e,0x00,0x6f,0x00,0x51,0x00,0x5a,0x00,0x59,0x00,0x3d,0x00,0x0d,0x00, -0x0a,0x30,0x5c,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,0x01,0x01, -0x05,0x00,0x03,0x4b,0x00,0x30,0x48,0x02,0x41,0x00,0x91,0xb2,0x16,0x1c,0xae,0x4f, -0x7f,0x7c,0xaf,0x57,0x2b,0x23,0x4c,0x0c,0x25,0x3c,0x4f,0x66,0x9d,0x25,0xc3,0x4f, -0x29,0xee,0x8b,0xda,0x4e,0x95,0xe7,0x3b,0xaa,0xc0,0xa7,0xba,0xaf,0x99,0x8c,0x47, -0x24,0x8b,0x09,0x77,0xbc,0x2c,0xf4,0xe7,0x1a,0x07,0x58,0x7b,0x11,0x37,0x2a,0xa8, -0x90,0xc3,0x50,0x92,0x80,0x15,0xc5,0xda,0x51,0x8b,0x02,0x03,0x01,0x00,0x01,0xa3, -0x81,0xc3,0x30,0x81,0xc0,0x30,0x14,0x06,0x09,0x2b,0x06,0x01,0x04,0x01,0x82,0x37, -0x12,0x04,0x01,0x01,0xff,0x04,0x04,0x01,0x00,0x01,0x00,0x30,0x3c,0x06,0x09,0x2b, -0x06,0x01,0x04,0x01,0x82,0x37,0x12,0x02,0x01,0x01,0xff,0x04,0x2c,0x4d,0x00,0x69, -0x00,0x63,0x00,0x72,0x00,0x6f,0x00,0x73,0x00,0x6f,0x00,0x66,0x00,0x74,0x00,0x20, -0x00,0x43,0x00,0x6f,0x00,0x72,0x00,0x70,0x00,0x6f,0x00,0x72,0x00,0x61,0x00,0x74, -0x00,0x69,0x00,0x6f,0x00,0x6e,0x00,0x00,0x00,0x30,0x4c,0x06,0x09,0x2b,0x06,0x01, -0x04,0x01,0x82,0x37,0x12,0x05,0x01,0x01,0xff,0x04,0x3c,0x00,0x10,0x00,0x00,0x01, -0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x09,0x04,0x00,0x00,0x18,0x00,0x18,0x00,0x30, -0x00,0x01,0x00,0x32,0x00,0x33,0x00,0x36,0x00,0x2d,0x00,0x34,0x00,0x2e,0x00,0x30, -0x00,0x30,0x00,0x2d,0x00,0x45,0x00,0x58,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x1c,0x06,0x03,0x55,0x1d,0x23,0x01,0x01, -0xff,0x04,0x12,0x30,0x10,0xa1,0x07,0x81,0x05,0x4e,0x54,0x54,0x53,0x45,0x82,0x05, -0x01,0x00,0x00,0x00,0x01,0x30,0x09,0x06,0x05,0x2b,0x0e,0x03,0x02,0x1d,0x05,0x00, -0x03,0x41,0x00,0x7b,0x1d,0xfd,0x24,0xea,0xf2,0xe8,0x17,0xdd,0x88,0x7e,0xfd,0xee, -0x28,0x61,0x7a,0x02,0xc3,0x73,0xcf,0x32,0x0f,0x7c,0x66,0x87,0x31,0xa7,0xbe,0x1b, -0x31,0xe2,0x20,0xa5,0x76,0x91,0x68,0x97,0x53,0x9e,0x80,0xcd,0x2b,0xd0,0x8e,0x8b, -0x7f,0x89,0x1b,0x62,0xa8,0xf8,0xee,0x5e,0x56,0xbd,0x9c,0x6b,0x80,0x06,0x54,0xd3, -0xf0,0xbf,0xb2,0x31,0x00,0x01,0x00,0x14,0x00,0xc7,0x32,0xf2,0x5b,0x98,0x0e,0x04, -0x49,0xa0,0x27,0x7e,0xf5,0xf6,0x0f,0xda,0x08,0x1d,0xe9,0x79,0xd1,0x31,0xc6,0x50, -0x90,0x4a,0xd3,0x1f,0x1d,0xf0,0x65,0x0d,0xb6,0x1f,0xaf,0xc9,0x1d -}; +/* Parse a logon info packet */ +static void +rdp_send_logon_info(uint32 flags, char *domain, char *user, + char *password, char *program, char *directory) +{ + char *ipaddr = tcp_get_address(); + int len_domain = 2 * strlen(domain); + int len_user = 2 * strlen(user); + int len_password = 2 * strlen(password); + int len_program = 2 * strlen(program); + int len_directory = 2 * strlen(directory); + int len_ip = 2 * strlen(ipaddr); + int len_dll = 2 * strlen("C:\\WINNT\\System32\\mstscax.dll"); + int packetlen = 0; + uint32 sec_flags = g_encryption ? (SEC_LOGON_INFO | SEC_ENCRYPT) : SEC_LOGON_INFO; + STREAM s; + time_t t = time(NULL); + time_t tzone; + +#if 0 + /* enable rdp compression */ + /* some problems still exist with rdp5 */ + flags |= RDP_COMPRESSION; +#endif + + if (!g_use_rdp5 || 1 == g_server_rdp_version) + { + DEBUG_RDP5(("Sending RDP4-style Logon packet\n")); + + s = sec_init(sec_flags, 18 + len_domain + len_user + len_password + + len_program + len_directory + 10); + + out_uint32(s, 0); + out_uint32_le(s, flags); + out_uint16_le(s, len_domain); + out_uint16_le(s, len_user); + out_uint16_le(s, len_password); + out_uint16_le(s, len_program); + out_uint16_le(s, len_directory); + rdp_out_unistr(s, domain, len_domain); + rdp_out_unistr(s, user, len_user); + rdp_out_unistr(s, password, len_password); + rdp_out_unistr(s, program, len_program); + rdp_out_unistr(s, directory, len_directory); + } + else + { -/* Send license certificate and related data to the server */ -void rdp_send_cert(HCONN conn) -{ - mcs_init_data(conn); - prs_io_uint8s(&conn->out, precanned_cert_packet, sizeof(precanned_cert_packet)); - MARK_END(conn->out); - mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True); -} + flags |= RDP_LOGON_BLOB; + DEBUG_RDP5(("Sending RDP5-style Logon packet\n")); + packetlen = 4 + /* Unknown uint32 */ + 4 + /* flags */ + 2 + /* len_domain */ + 2 + /* len_user */ + (flags & RDP_LOGON_AUTO ? 2 : 0) + /* len_password */ + (flags & RDP_LOGON_BLOB ? 2 : 0) + /* Length of BLOB */ + 2 + /* len_program */ + 2 + /* len_directory */ + (0 < len_domain ? len_domain : 2) + /* domain */ + len_user + (flags & RDP_LOGON_AUTO ? len_password : 0) + 0 + /* We have no 512 byte BLOB. Perhaps we must? */ + (flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO) ? 2 : 0) + /* After the BLOB is a unknown int16. If there is a BLOB, that is. */ + (0 < len_program ? len_program : 2) + (0 < len_directory ? len_directory : 2) + 2 + /* Unknown (2) */ + 2 + /* Client ip length */ + len_ip + /* Client ip */ + 2 + /* DLL string length */ + len_dll + /* DLL string */ + 2 + /* Unknown */ + 2 + /* Unknown */ + 64 + /* Time zone #0 */ + 2 + /* Unknown */ + 64 + /* Time zone #1 */ + 32; /* Unknown */ + + s = sec_init(sec_flags, packetlen); + DEBUG_RDP5(("Called sec_init with packetlen %d\n", packetlen)); + + out_uint32(s, 0); /* Unknown */ + out_uint32_le(s, flags); + out_uint16_le(s, len_domain); + out_uint16_le(s, len_user); + if (flags & RDP_LOGON_AUTO) + { + out_uint16_le(s, len_password); -/* Initialise RDP transport packet */ -void rdp_init(HCONN conn) -{ - mcs_init_data(conn); - PUSH_LAYER(conn->out, rdp_offset, 6); -} + } + if (flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO)) + { + out_uint16_le(s, 0); + } + out_uint16_le(s, len_program); + out_uint16_le(s, len_directory); + if (0 < len_domain) + rdp_out_unistr(s, domain, len_domain); + else + out_uint16_le(s, 0); + rdp_out_unistr(s, user, len_user); + if (flags & RDP_LOGON_AUTO) + { + rdp_out_unistr(s, password, len_password); + } + if (flags & RDP_LOGON_BLOB && !(flags & RDP_LOGON_AUTO)) + { + out_uint16_le(s, 0); + } + if (0 < len_program) + { + rdp_out_unistr(s, program, len_program); -/* Transmit RDP transport packet */ -void rdp_send(HCONN conn, uint16 pdu_type) -{ - RDP_HEADER hdr; - int length; + } + else + { + out_uint16_le(s, 0); + } + if (0 < len_directory) + { + rdp_out_unistr(s, directory, len_directory); + } + else + { + out_uint16_le(s, 0); + } + out_uint16_le(s, 2); + out_uint16_le(s, len_ip + 2); /* Length of client ip */ + rdp_out_unistr(s, ipaddr, len_ip); + out_uint16_le(s, len_dll + 2); + rdp_out_unistr(s, "C:\\WINNT\\System32\\mstscax.dll", len_dll); - POP_LAYER(conn->out, rdp_offset); - length = conn->out.end - conn->out.offset; - rdp_make_header(&hdr, length, pdu_type, conn->mcs_userid); - rdp_io_header(&conn->out, &hdr); - mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True); -} + tzone = (mktime(gmtime(&t)) - mktime(localtime(&t))) / 60; + out_uint32_le(s, tzone); -/* Initialise RDP transport data packet */ -void rdp_init_data(HCONN conn) -{ - mcs_init_data(conn); - PUSH_LAYER(conn->out, rdp_offset, 18); -} + rdp_out_unistr(s, "GTB, normaltid", 2 * strlen("GTB, normaltid")); + out_uint8s(s, 62 - 2 * strlen("GTB, normaltid")); -/* Transmit RDP transport data packet */ -void rdp_send_data(HCONN conn, uint16 data_pdu_type) -{ - RDP_HEADER hdr; - RDP_DATA_HEADER datahdr; - int length = conn->out.end - conn->out.offset; + out_uint32_le(s, 0x0a0000); + out_uint32_le(s, 0x050000); + out_uint32_le(s, 3); + out_uint32_le(s, 0); + out_uint32_le(s, 0); - POP_LAYER(conn->out, rdp_offset); - length = conn->out.end - conn->out.offset; - rdp_make_header(&hdr, length, RDP_PDU_DATA, conn->mcs_userid); - rdp_io_header(&conn->out, &hdr); - rdp_make_data_header(&datahdr, 0x103ea, length, data_pdu_type); - rdp_io_data_header(&conn->out, &datahdr); - mcs_send_data(conn, MCS_GLOBAL_CHANNEL, True); -} + rdp_out_unistr(s, "GTB, sommartid", 2 * strlen("GTB, sommartid")); + out_uint8s(s, 62 - 2 * strlen("GTB, sommartid")); -void rdp_send_confirm_active(HCONN conn) -{ - RDP_ACTIVE_PDU active; + out_uint32_le(s, 0x30000); + out_uint32_le(s, 0x050000); + out_uint32_le(s, 2); + out_uint32(s, 0); + out_uint32_le(s, 0xffffffc4); + out_uint32_le(s, 0xfffffffe); + out_uint32_le(s, g_rdp5_performanceflags); + out_uint32(s, 0); - rdp_init(conn); - rdp_make_active_pdu(&active, 0x103ea, conn->mcs_userid); - rdp_io_active_pdu(&conn->out, &active, RDP_PDU_CONFIRM_ACTIVE); - MARK_END(conn->out); - rdp_send(conn, RDP_PDU_CONFIRM_ACTIVE); + + } + s_mark_end(s); + sec_send(s, sec_flags); } -void rdp_send_synchronize(HCONN conn) +/* Send a control PDU */ +static void +rdp_send_control(uint16 action) { - RDP_SYNCHRONIZE_PDU sync; + STREAM s; - rdp_init_data(conn); - rdp_make_synchronize_pdu(&sync, 1002); - rdp_io_synchronize_pdu(&conn->out, &sync); - MARK_END(conn->out); - rdp_send_data(conn, RDP_DATA_PDU_SYNCHRONIZE); -} + s = rdp_init_data(8); -void rdp_send_control(HCONN conn, uint16 action) -{ - RDP_CONTROL_PDU control; + out_uint16_le(s, action); + out_uint16(s, 0); /* userid */ + out_uint32(s, 0); /* control id */ - rdp_init_data(conn); - rdp_make_control_pdu(&control, action); - rdp_io_control_pdu(&conn->out, &control); - MARK_END(conn->out); - rdp_send_data(conn, RDP_DATA_PDU_CONTROL); + s_mark_end(s); + rdp_send_data(s, RDP_DATA_PDU_CONTROL); } -void rdp_send_fonts(HCONN conn, uint16 seqno) +/* Send a synchronisation PDU */ +static void +rdp_send_synchronise(void) { - RDP_FONT_PDU fonts; + STREAM s; + + s = rdp_init_data(4); - rdp_init_data(conn); - rdp_make_font_pdu(&fonts, seqno); - rdp_io_font_pdu(&conn->out, &fonts); - MARK_END(conn->out); - rdp_send_data(conn, RDP_DATA_PDU_FONT2); + out_uint16_le(s, 1); /* type */ + out_uint16_le(s, 1002); + + s_mark_end(s); + rdp_send_data(s, RDP_DATA_PDU_SYNCHRONISE); } -void rdp_send_input(HCONN conn) +/* Send a single input event */ +void +rdp_send_input(uint32 time, uint16 message_type, uint16 device_flags, uint16 param1, uint16 param2) { - RDP_INPUT_PDU input; + STREAM s; + + s = rdp_init_data(16); + + out_uint16_le(s, 1); /* number of events */ + out_uint16(s, 0); /* pad */ - rdp_init_data(conn); - rdp_make_input_pdu(&input); - rdp_io_input_pdu(&conn->out, &input); - MARK_END(conn->out); - rdp_send_data(conn, RDP_DATA_PDU_INPUT); + out_uint32_le(s, time); + out_uint16_le(s, message_type); + out_uint16_le(s, device_flags); + out_uint16_le(s, param1); + out_uint16_le(s, param2); + + s_mark_end(s); + rdp_send_data(s, RDP_DATA_PDU_INPUT); } -BOOL rdp_recv_pdu(HCONN conn, uint8 *type) +/* Inform the server on the contents of the persistent bitmap cache */ +static void +rdp_enum_bmpcache2(void) { - RDP_HEADER hdr; + STREAM s; + HASH_KEY keylist[BMPCACHE2_NUM_PSTCELLS]; + uint32 num_keys, offset, count, flags; - if (!mcs_recv(conn, False) || !rdp_io_header(&conn->in, &hdr)) - return False; + offset = 0; + num_keys = pstcache_enumerate(2, keylist); - *type = hdr.pdu_type & 0xf; - return True; + while (offset < num_keys) + { + count = MIN(num_keys - offset, 169); + + s = rdp_init_data(24 + count * sizeof(HASH_KEY)); + + flags = 0; + if (offset == 0) + flags |= PDU_FLAG_FIRST; + if (num_keys - offset <= 169) + flags |= PDU_FLAG_LAST; + + /* header */ + out_uint32_le(s, 0); + out_uint16_le(s, count); + out_uint16_le(s, 0); + out_uint16_le(s, 0); + out_uint16_le(s, 0); + out_uint16_le(s, 0); + out_uint16_le(s, num_keys); + out_uint32_le(s, 0); + out_uint32_le(s, flags); + + /* list */ + out_uint8a(s, keylist[offset], count * sizeof(HASH_KEY)); + + s_mark_end(s); + rdp_send_data(s, 0x2b); + + offset += 169; + } } -/* Disconnect from the RDP layer */ -void rdp_disconnect(HCONN conn) +/* Send an (empty) font information PDU */ +static void +rdp_send_fonts(uint16 seq) { - mcs_disconnect(conn); + STREAM s; + + s = rdp_init_data(8); + + out_uint16(s, 0); /* number of fonts */ + out_uint16_le(s, 0); /* pad? */ + out_uint16_le(s, seq); /* unknown */ + out_uint16_le(s, 0x32); /* entry size */ + + s_mark_end(s); + rdp_send_data(s, RDP_DATA_PDU_FONT2); } -void rdp_make_header(RDP_HEADER *hdr, uint16 length, uint16 pdu_type, - uint16 userid) +/* Output general capability set */ +static void +rdp_out_general_caps(STREAM s) { - hdr->length = length; - hdr->pdu_type = pdu_type | 0x10; /* Version 1 */ - hdr->userid = userid + 1001; + out_uint16_le(s, RDP_CAPSET_GENERAL); + out_uint16_le(s, RDP_CAPLEN_GENERAL); + + out_uint16_le(s, 1); /* OS major type */ + out_uint16_le(s, 3); /* OS minor type */ + out_uint16_le(s, 0x200); /* Protocol version */ + out_uint16(s, 0); /* Pad */ + out_uint16(s, 0); /* Compression types */ + out_uint16_le(s, g_use_rdp5 ? 0x40d : 0); + /* Pad, according to T.128. 0x40d seems to + trigger + the server to start sending RDP5 packets. + However, the value is 0x1d04 with W2KTSK and + NT4MS. Hmm.. Anyway, thankyou, Microsoft, + for sending such information in a padding + field.. */ + out_uint16(s, 0); /* Update capability */ + out_uint16(s, 0); /* Remote unshare capability */ + out_uint16(s, 0); /* Compression level */ + out_uint16(s, 0); /* Pad */ } -void rdp_make_data_header(RDP_DATA_HEADER *hdr, uint32 shareid, - uint16 length, uint16 data_pdu_type) +/* Output bitmap capability set */ +static void +rdp_out_bitmap_caps(STREAM s) { - hdr->shareid = shareid; - hdr->pad = 0; - hdr->streamid = 1; - hdr->length = length - 14; - hdr->data_pdu_type = data_pdu_type; - hdr->compress_type = 0; - hdr->compress_len = 0; + out_uint16_le(s, RDP_CAPSET_BITMAP); + out_uint16_le(s, RDP_CAPLEN_BITMAP); + + out_uint16_le(s, g_server_bpp); /* Preferred BPP */ + out_uint16_le(s, 1); /* Receive 1 BPP */ + out_uint16_le(s, 1); /* Receive 4 BPP */ + out_uint16_le(s, 1); /* Receive 8 BPP */ + out_uint16_le(s, 800); /* Desktop width */ + out_uint16_le(s, 600); /* Desktop height */ + out_uint16(s, 0); /* Pad */ + out_uint16(s, 1); /* Allow resize */ + out_uint16_le(s, g_bitmap_compression ? 1 : 0); /* Support compression */ + out_uint16(s, 0); /* Unknown */ + out_uint16_le(s, 1); /* Unknown */ + out_uint16(s, 0); /* Pad */ } -void rdp_make_general_caps(RDP_GENERAL_CAPS *caps) +/* Output order capability set */ +static void +rdp_out_order_caps(STREAM s) { - caps->os_major_type = 1; - caps->os_minor_type = 3; - caps->ver_protocol = 0x200; + uint8 order_caps[32]; + + memset(order_caps, 0, 32); + order_caps[0] = 1; /* dest blt */ + order_caps[1] = 1; /* pat blt */ + order_caps[2] = 1; /* screen blt */ + order_caps[3] = (g_bitmap_cache ? 1 : 0); /* memblt */ + order_caps[4] = 0; /* triblt */ + order_caps[8] = 1; /* line */ + order_caps[9] = 1; /* line */ + order_caps[10] = 1; /* rect */ + order_caps[11] = (g_desktop_save ? 1 : 0); /* desksave */ + order_caps[13] = 1; /* memblt */ + order_caps[14] = 1; /* triblt */ + order_caps[20] = (g_polygon_ellipse_orders ? 1 : 0); /* polygon */ + order_caps[21] = (g_polygon_ellipse_orders ? 1 : 0); /* polygon2 */ + order_caps[22] = 1; /* polyline */ + order_caps[25] = (g_polygon_ellipse_orders ? 1 : 0); /* ellipse */ + order_caps[26] = (g_polygon_ellipse_orders ? 1 : 0); /* ellipse2 */ + order_caps[27] = 1; /* text2 */ + out_uint16_le(s, RDP_CAPSET_ORDER); + out_uint16_le(s, RDP_CAPLEN_ORDER); + + out_uint8s(s, 20); /* Terminal desc, pad */ + out_uint16_le(s, 1); /* Cache X granularity */ + out_uint16_le(s, 20); /* Cache Y granularity */ + out_uint16(s, 0); /* Pad */ + out_uint16_le(s, 1); /* Max order level */ + out_uint16_le(s, 0x147); /* Number of fonts */ + out_uint16_le(s, 0x2a); /* Capability flags */ + out_uint8p(s, order_caps, 32); /* Orders supported */ + out_uint16_le(s, 0x6a1); /* Text capability flags */ + out_uint8s(s, 6); /* Pad */ + out_uint32_le(s, g_desktop_save == False ? 0 : 0x38400); /* Desktop cache size */ + out_uint32(s, 0); /* Unknown */ + out_uint32_le(s, 0x4e4); /* Unknown */ } -void rdp_make_bitmap_caps(RDP_BITMAP_CAPS *caps) +/* Output bitmap cache capability set */ +static void +rdp_out_bmpcache_caps(STREAM s) { - caps->preferred_bpp = 8; - caps->receive1bpp = 1; - caps->receive4bpp = 1; - caps->receive8bpp = 1; - caps->width = 640; - caps->height = 480; - caps->compression = 1; - caps->unknown2 = 1; + int Bpp; + out_uint16_le(s, RDP_CAPSET_BMPCACHE); + out_uint16_le(s, RDP_CAPLEN_BMPCACHE); + + Bpp = (g_server_bpp + 7) / 8; + out_uint8s(s, 24); /* unused */ + out_uint16_le(s, 0x258); /* entries */ + out_uint16_le(s, 0x100 * Bpp); /* max cell size */ + out_uint16_le(s, 0x12c); /* entries */ + out_uint16_le(s, 0x400 * Bpp); /* max cell size */ + out_uint16_le(s, 0x106); /* entries */ + out_uint16_le(s, 0x1000 * Bpp); /* max cell size */ } -void rdp_make_order_caps(RDP_ORDER_CAPS *caps) +/* Output bitmap cache v2 capability set */ +static void +rdp_out_bmpcache2_caps(STREAM s) { - caps->xgranularity = 1; - caps->ygranularity = 20; - caps->max_order_level = 1; - caps->num_fonts = 0x147; - caps->cap_flags = 0x2A; + out_uint16_le(s, RDP_CAPSET_BMPCACHE2); + out_uint16_le(s, RDP_CAPLEN_BMPCACHE2); -// caps->cap_flags = ORDER_CAP_NEGOTIATE | ORDER_CAP_NOSUPPORT; + out_uint16_le(s, g_bitmap_cache_persist_enable ? 2 : 0); /* version */ - caps->support[0] = caps->support[1] = caps->support[2] - = caps->support[3] = caps->support[4] = caps->support[5] - = caps->support[6] = caps->support[8] = caps->support[11] - = caps->support[12] = caps->support[22] = caps->support[28] - = caps->support[29] = caps->support[30] = 1; - caps->text_cap_flags = 0x6A1; - caps->desk_save_size = 0x38400; - caps->unknown2 = 0x4E4; -} + out_uint16_le(s, 0x0300); /* flags? number of caches? */ -void rdp_make_bmpcache_caps(RDP_BMPCACHE_CAPS *caps) -{ - caps->caches[0].entries = 0x258; - caps->caches[0].max_cell_size = 0x100; - caps->caches[1].entries = 0x12c; - caps->caches[1].max_cell_size = 0x400; - caps->caches[2].entries = 0x106; - caps->caches[2].max_cell_size = 0x1000; + out_uint32_le(s, BMPCACHE2_C0_CELLS); + out_uint32_le(s, BMPCACHE2_C1_CELLS); + if (pstcache_init(2)) + { + out_uint32_le(s, BMPCACHE2_NUM_PSTCELLS | BMPCACHE2_FLAG_PERSIST); + } + else + { + out_uint32_le(s, BMPCACHE2_C2_CELLS); + } + out_uint8s(s, 20); /* other bitmap caches not used */ } -void rdp_make_control_caps(RDP_CONTROL_CAPS *caps) +/* Output control capability set */ +static void +rdp_out_control_caps(STREAM s) { - caps->control_interest = 2; - caps->detach_interest = 2; + out_uint16_le(s, RDP_CAPSET_CONTROL); + out_uint16_le(s, RDP_CAPLEN_CONTROL); + + out_uint16(s, 0); /* Control capabilities */ + out_uint16(s, 0); /* Remote detach */ + out_uint16_le(s, 2); /* Control interest */ + out_uint16_le(s, 2); /* Detach interest */ } -void rdp_make_activate_caps(RDP_ACTIVATE_CAPS *caps) +/* Output activation capability set */ +static void +rdp_out_activate_caps(STREAM s) { + out_uint16_le(s, RDP_CAPSET_ACTIVATE); + out_uint16_le(s, RDP_CAPLEN_ACTIVATE); + + out_uint16(s, 0); /* Help key */ + out_uint16(s, 0); /* Help index key */ + out_uint16(s, 0); /* Extended help key */ + out_uint16(s, 0); /* Window activate */ } -void rdp_make_pointer_caps(RDP_POINTER_CAPS *caps) +/* Output pointer capability set */ +static void +rdp_out_pointer_caps(STREAM s) { - caps->colour_pointer = 0; - caps->cache_size = 20; + out_uint16_le(s, RDP_CAPSET_POINTER); + out_uint16_le(s, RDP_CAPLEN_POINTER); + + out_uint16(s, 0); /* Colour pointer */ + out_uint16_le(s, 20); /* Cache size */ } -void rdp_make_share_caps(RDP_SHARE_CAPS *caps, uint16 userid) +/* Output share capability set */ +static void +rdp_out_share_caps(STREAM s) { + out_uint16_le(s, RDP_CAPSET_SHARE); + out_uint16_le(s, RDP_CAPLEN_SHARE); + + out_uint16(s, 0); /* userid */ + out_uint16(s, 0); /* pad */ } -void rdp_make_colcache_caps(RDP_COLCACHE_CAPS *caps) +/* Output colour cache capability set */ +static void +rdp_out_colcache_caps(STREAM s) { - caps->cache_size = 6; + out_uint16_le(s, RDP_CAPSET_COLCACHE); + out_uint16_le(s, RDP_CAPLEN_COLCACHE); + + out_uint16_le(s, 6); /* cache size */ + out_uint16(s, 0); /* pad */ } -void rdp_make_active_pdu(RDP_ACTIVE_PDU *pdu, uint32 shareid, uint16 userid) -{ - memset(pdu, 0, sizeof(*pdu)); - pdu->shareid = shareid; - pdu->userid = 1002; - pdu->source_len = sizeof(RDP_SOURCE); - memcpy(pdu->source, RDP_SOURCE, sizeof(RDP_SOURCE)); +static uint8 caps_0x0d[] = { + 0x01, 0x00, 0x00, 0x00, 0x09, 0x04, 0x00, 0x00, + 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00 +}; - pdu->caps_len = RDP_CAPLEN_GENERAL + RDP_CAPLEN_BITMAP + RDP_CAPLEN_ORDER - + RDP_CAPLEN_BMPCACHE + RDP_CAPLEN_COLCACHE + RDP_CAPLEN_ACTIVATE - + RDP_CAPLEN_CONTROL + RDP_CAPLEN_POINTER + RDP_CAPLEN_SHARE - + RDP_CAPLEN_UNKNOWN; - pdu->num_caps = 0xD; +static uint8 caps_0x0c[] = { 0x01, 0x00, 0x00, 0x00 }; - rdp_make_general_caps (&pdu->general_caps ); - rdp_make_bitmap_caps (&pdu->bitmap_caps ); - rdp_make_order_caps (&pdu->order_caps ); - rdp_make_bmpcache_caps(&pdu->bmpcache_caps); - rdp_make_control_caps (&pdu->control_caps ); - rdp_make_activate_caps(&pdu->activate_caps); - rdp_make_pointer_caps (&pdu->pointer_caps ); - rdp_make_share_caps (&pdu->share_caps, userid); - rdp_make_colcache_caps(&pdu->colcache_caps); -} +static uint8 caps_0x0e[] = { 0x01, 0x00, 0x00, 0x00 }; -void rdp_make_control_pdu(RDP_CONTROL_PDU *pdu, uint16 action) -{ - pdu->action = action; - pdu->userid = 0; - pdu->controlid = 0; -} +static uint8 caps_0x10[] = { + 0xFE, 0x00, 0x04, 0x00, 0xFE, 0x00, 0x04, 0x00, + 0xFE, 0x00, 0x08, 0x00, 0xFE, 0x00, 0x08, 0x00, + 0xFE, 0x00, 0x10, 0x00, 0xFE, 0x00, 0x20, 0x00, + 0xFE, 0x00, 0x40, 0x00, 0xFE, 0x00, 0x80, 0x00, + 0xFE, 0x00, 0x00, 0x01, 0x40, 0x00, 0x00, 0x08, + 0x00, 0x01, 0x00, 0x01, 0x02, 0x00, 0x00, 0x00 +}; -void rdp_make_synchronize_pdu(RDP_SYNCHRONIZE_PDU *pdu, uint16 userid) +/* Output unknown capability sets */ +static void +rdp_out_unknown_caps(STREAM s, uint16 id, uint16 length, uint8 * caps) { - pdu->type = 1; - pdu->userid = userid; -} + out_uint16_le(s, id); + out_uint16_le(s, length); -void rdp_make_font_pdu(RDP_FONT_PDU *pdu, uint16 seqno) -{ - pdu->num_fonts = 0; - pdu->unknown1 = 0x3e; - pdu->unknown2 = seqno; - pdu->entry_size = RDP_FONT_INFO_SIZE; + out_uint8p(s, caps, length - 4); } -void rdp_make_input_pdu(RDP_INPUT_PDU *pdu) +#define RDP5_FLAG 0x0030 +/* Send a confirm active PDU */ +static void +rdp_send_confirm_active(void) { - uint32 now = time(NULL); + STREAM s; + uint32 sec_flags = g_encryption ? (RDP5_FLAG | SEC_ENCRYPT) : RDP5_FLAG; + uint16 caplen = + RDP_CAPLEN_GENERAL + RDP_CAPLEN_BITMAP + RDP_CAPLEN_ORDER + + RDP_CAPLEN_BMPCACHE + RDP_CAPLEN_COLCACHE + + RDP_CAPLEN_ACTIVATE + RDP_CAPLEN_CONTROL + + RDP_CAPLEN_POINTER + RDP_CAPLEN_SHARE + + 0x58 + 0x08 + 0x08 + 0x34 /* unknown caps */ + + 4 /* w2k fix, why? */ ; - pdu->num_events = 3; - pdu->pad = 0; + s = sec_init(sec_flags, 6 + 14 + caplen + sizeof(RDP_SOURCE)); - pdu->event[0].event_time = now; - pdu->event[0].message_type = RDP_INPUT_SYNCHRONIZE; - pdu->event[0].device_flags = 0; - pdu->event[0].mouse_x = 0; - pdu->event[0].mouse_y = 0; + out_uint16_le(s, 2 + 14 + caplen + sizeof(RDP_SOURCE)); + out_uint16_le(s, (RDP_PDU_CONFIRM_ACTIVE | 0x10)); /* Version 1 */ + out_uint16_le(s, (g_mcs_userid + 1001)); - pdu->event[1].event_time = now; - pdu->event[1].message_type = RDP_INPUT_UNKNOWN; - pdu->event[1].device_flags = 0x8000; - pdu->event[1].mouse_x = 15; - pdu->event[1].mouse_y = 0; + out_uint32_le(s, g_rdp_shareid); + out_uint16_le(s, 0x3ea); /* userid */ + out_uint16_le(s, sizeof(RDP_SOURCE)); + out_uint16_le(s, caplen); - pdu->event[2].event_time = now; - pdu->event[2].message_type = RDP_INPUT_MOUSE; - pdu->event[2].device_flags = MOUSE_FLAG_MOVE; - pdu->event[2].mouse_x = 425; - pdu->event[2].mouse_y = 493; -} + out_uint8p(s, RDP_SOURCE, sizeof(RDP_SOURCE)); + out_uint16_le(s, 0xd); /* num_caps */ + out_uint8s(s, 2); /* pad */ -BOOL rdp_io_header(STREAM s, RDP_HEADER *hdr) -{ - BOOL res = True; + rdp_out_general_caps(s); + rdp_out_bitmap_caps(s); + rdp_out_order_caps(s); + g_use_rdp5 ? rdp_out_bmpcache2_caps(s) : rdp_out_bmpcache_caps(s); + rdp_out_colcache_caps(s); + rdp_out_activate_caps(s); + rdp_out_control_caps(s); + rdp_out_pointer_caps(s); + rdp_out_share_caps(s); - res = res ? lsb_io_uint16(s, &hdr->length ) : False; - res = res ? lsb_io_uint16(s, &hdr->pdu_type) : False; - res = res ? lsb_io_uint16(s, &hdr->userid ) : False; + rdp_out_unknown_caps(s, 0x0d, 0x58, caps_0x0d); /* international? */ + rdp_out_unknown_caps(s, 0x0c, 0x08, caps_0x0c); + rdp_out_unknown_caps(s, 0x0e, 0x08, caps_0x0e); + rdp_out_unknown_caps(s, 0x10, 0x34, caps_0x10); /* glyph cache? */ - return res; + s_mark_end(s); + sec_send(s, sec_flags); } -BOOL rdp_io_data_header(STREAM s, RDP_DATA_HEADER *hdr) +/* Process a general capability set */ +static void +rdp_process_general_caps(STREAM s) { - BOOL res = True; + uint16 pad2octetsB; /* rdp5 flags? */ - res = res ? lsb_io_uint32(s, &hdr->shareid ) : False; - res = res ? prs_io_uint8 (s, &hdr->pad ) : False; - res = res ? prs_io_uint8 (s, &hdr->streamid ) : False; - res = res ? lsb_io_uint16(s, &hdr->length ) : False; - res = res ? prs_io_uint8 (s, &hdr->data_pdu_type) : False; - res = res ? prs_io_uint8 (s, &hdr->compress_type) : False; - res = res ? lsb_io_uint16(s, &hdr->compress_len ) : False; + in_uint8s(s, 10); + in_uint16_le(s, pad2octetsB); - return res; + if (!pad2octetsB) + g_use_rdp5 = False; } -BOOL rdp_io_general_caps(STREAM s, RDP_GENERAL_CAPS *caps) +/* Process a bitmap capability set */ +static void +rdp_process_bitmap_caps(STREAM s) { - uint16 length = RDP_CAPLEN_GENERAL; - uint16 pkt_length = length; - BOOL res; + uint16 width, height, bpp; - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) - { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } + in_uint16_le(s, bpp); + in_uint8s(s, 6); - res = res ? lsb_io_uint16(s, &caps->os_major_type ) : False; - res = res ? lsb_io_uint16(s, &caps->os_minor_type ) : False; - res = res ? lsb_io_uint16(s, &caps->ver_protocol ) : False; - res = res ? lsb_io_uint16(s, &caps->pad1 ) : False; - res = res ? lsb_io_uint16(s, &caps->compress_types) : False; - res = res ? lsb_io_uint16(s, &caps->pad2 ) : False; - res = res ? lsb_io_uint16(s, &caps->cap_update ) : False; - res = res ? lsb_io_uint16(s, &caps->remote_unshare) : False; - res = res ? lsb_io_uint16(s, &caps->compress_level) : False; - res = res ? lsb_io_uint16(s, &caps->pad3 ) : False; - - return res; -} - -BOOL rdp_io_bitmap_caps(STREAM s, RDP_BITMAP_CAPS *caps) -{ - uint16 length = RDP_CAPLEN_BITMAP; - uint16 pkt_length = length; - BOOL res; + in_uint16_le(s, width); + in_uint16_le(s, height); - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + DEBUG(("setting desktop size and bpp to: %dx%dx%d\n", width, height, bpp)); + + /* + * The server may limit bpp and change the size of the desktop (for + * example when shadowing another session). + */ + if (g_server_bpp != bpp) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; + warning("colour depth changed from %d to %d\n", g_server_bpp, bpp); + g_server_bpp = bpp; } - - res = res ? lsb_io_uint16(s, &caps->preferred_bpp) : False; - res = res ? lsb_io_uint16(s, &caps->receive1bpp ) : False; - res = res ? lsb_io_uint16(s, &caps->receive4bpp ) : False; - res = res ? lsb_io_uint16(s, &caps->receive8bpp ) : False; - res = res ? lsb_io_uint16(s, &caps->width ) : False; - res = res ? lsb_io_uint16(s, &caps->height ) : False; - res = res ? lsb_io_uint16(s, &caps->pad1 ) : False; - res = res ? lsb_io_uint16(s, &caps->allow_resize ) : False; - res = res ? lsb_io_uint16(s, &caps->compression ) : False; - res = res ? lsb_io_uint16(s, &caps->unknown1 ) : False; - res = res ? lsb_io_uint16(s, &caps->unknown2 ) : False; - res = res ? lsb_io_uint16(s, &caps->pad2 ) : False; - - return res; -} - -BOOL rdp_io_order_caps(STREAM s, RDP_ORDER_CAPS *caps) -{ - uint16 length = RDP_CAPLEN_ORDER; - uint16 pkt_length = length; - BOOL res; - - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + if (g_width != width || g_height != height) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; + warning("screen size changed from %dx%d to %dx%d\n", g_width, g_height, + width, height); + g_width = width; + g_height = height; + ui_resize_window(); } - - res = res ? prs_io_uint8s(s, caps->terminal_desc, 16) : False; - res = res ? lsb_io_uint32(s, &caps->pad1 ) : False; - res = res ? lsb_io_uint16(s, &caps->xgranularity ) : False; - res = res ? lsb_io_uint16(s, &caps->ygranularity ) : False; - res = res ? lsb_io_uint16(s, &caps->pad2 ) : False; - res = res ? lsb_io_uint16(s, &caps->max_order_level ) : False; - res = res ? lsb_io_uint16(s, &caps->num_fonts ) : False; - res = res ? lsb_io_uint16(s, &caps->cap_flags ) : False; - res = res ? prs_io_uint8s(s, caps->support , 32) : False; - res = res ? lsb_io_uint16(s, &caps->text_cap_flags ) : False; - res = res ? lsb_io_uint16(s, &caps->pad3 ) : False; - res = res ? lsb_io_uint32(s, &caps->pad4 ) : False; - res = res ? lsb_io_uint32(s, &caps->desk_save_size ) : False; - res = res ? lsb_io_uint32(s, &caps->unknown1 ) : False; - res = res ? lsb_io_uint32(s, &caps->unknown2 ) : False; - - return res; } -BOOL rdp_io_bmpcache_info(STREAM s, RDP_BMPCACHE_INFO *info) +/* Process server capabilities */ +void +rdp_process_server_caps(STREAM s, uint16 length) { - if (!lsb_io_uint16(s, &info->entries )) - return False; + int n; + uint8 *next, *start; + uint16 ncapsets, capset_type, capset_length; - if (!lsb_io_uint16(s, &info->max_cell_size)) - return False; + start = s->p; - return True; -} + in_uint16_le(s, ncapsets); + in_uint8s(s, 2); /* pad */ -BOOL rdp_io_bmpcache_caps(STREAM s, RDP_BMPCACHE_CAPS *caps) -{ - uint16 length = RDP_CAPLEN_BMPCACHE; - uint16 pkt_length = length; - BOOL res; - int i; - - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + for (n = 0; n < ncapsets; n++) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } + if (s->p > start + length) + return; + + in_uint16_le(s, capset_type); + in_uint16_le(s, capset_length); - for (i = 0; i < 6; i++) - res = res ? lsb_io_uint32(s, &caps->unused[i]) : False; + next = s->p + capset_length - 4; - for (i = 0; i < 3; i++) - res = res ? rdp_io_bmpcache_info(s, &caps->caches[i]) : False; + switch (capset_type) + { + case RDP_CAPSET_GENERAL: + rdp_process_general_caps(s); + break; - return res; + case RDP_CAPSET_BITMAP: + rdp_process_bitmap_caps(s); + break; + } + + s->p = next; + } } -BOOL rdp_io_control_caps(STREAM s, RDP_CONTROL_CAPS *caps) +/* Respond to a demand active PDU */ +static void +process_demand_active(STREAM s) { - uint16 length = RDP_CAPLEN_CONTROL; - uint16 pkt_length = length; - BOOL res; + uint8 type; + uint16 len_src_descriptor, len_combined_caps; + + in_uint32_le(s, g_rdp_shareid); + in_uint16_le(s, len_src_descriptor); + in_uint16_le(s, len_combined_caps); + in_uint8s(s, len_src_descriptor); + + DEBUG(("DEMAND_ACTIVE(id=0x%x)\n", g_rdp_shareid)); + rdp_process_server_caps(s, len_combined_caps); + + rdp_send_confirm_active(); + rdp_send_synchronise(); + rdp_send_control(RDP_CTL_COOPERATE); + rdp_send_control(RDP_CTL_REQUEST_CONTROL); + rdp_recv(&type); /* RDP_PDU_SYNCHRONIZE */ + rdp_recv(&type); /* RDP_CTL_COOPERATE */ + rdp_recv(&type); /* RDP_CTL_GRANT_CONTROL */ + rdp_send_input(0, RDP_INPUT_SYNCHRONIZE, 0, ui_get_numlock_state(read_keyboard_state()), 0); - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + if (g_use_rdp5) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; + rdp_enum_bmpcache2(); + rdp_send_fonts(3); + } + else + { + rdp_send_fonts(1); + rdp_send_fonts(2); } - res = res ? lsb_io_uint16(s, &caps->control_caps ) : False; - res = res ? lsb_io_uint16(s, &caps->remote_detach ) : False; - res = res ? lsb_io_uint16(s, &caps->control_interest) : False; - res = res ? lsb_io_uint16(s, &caps->detach_interest ) : False; - - return res; + rdp_recv(&type); /* RDP_PDU_UNKNOWN 0x28 (Fonts?) */ + reset_order_state(); } -BOOL rdp_io_activate_caps(STREAM s, RDP_ACTIVATE_CAPS *caps) +/* Process a colour pointer PDU */ +void +process_colour_pointer_pdu(STREAM s) { - uint16 length = RDP_CAPLEN_ACTIVATE; - uint16 pkt_length = length; - BOOL res; + uint16 x, y, width, height, cache_idx, masklen, datalen; + uint8 *mask, *data; + HCURSOR cursor; - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) - { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } + in_uint16_le(s, cache_idx); + in_uint16_le(s, x); + in_uint16_le(s, y); + in_uint16_le(s, width); + in_uint16_le(s, height); + in_uint16_le(s, masklen); + in_uint16_le(s, datalen); + in_uint8p(s, data, datalen); + in_uint8p(s, mask, masklen); + cursor = ui_create_cursor(x, y, width, height, mask, data); + ui_set_cursor(cursor); + cache_put_cursor(cache_idx, cursor); +} - res = res ? lsb_io_uint16(s, &caps->help_key ) : False; - res = res ? lsb_io_uint16(s, &caps->help_index_key ) : False; - res = res ? lsb_io_uint16(s, &caps->help_extended_key) : False; - res = res ? lsb_io_uint16(s, &caps->window_activate ) : False; +/* Process a cached pointer PDU */ +void +process_cached_pointer_pdu(STREAM s) +{ + uint16 cache_idx; - return res; + in_uint16_le(s, cache_idx); + ui_set_cursor(cache_get_cursor(cache_idx)); } -BOOL rdp_io_pointer_caps(STREAM s, RDP_POINTER_CAPS *caps) +/* Process a system pointer PDU */ +void +process_system_pointer_pdu(STREAM s) { - uint16 length = RDP_CAPLEN_POINTER; - uint16 pkt_length = length; - BOOL res; + uint16 system_pointer_type; - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + in_uint16(s, system_pointer_type); + switch (system_pointer_type) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } - - res = res ? lsb_io_uint16(s, &caps->colour_pointer) : False; - res = res ? lsb_io_uint16(s, &caps->cache_size ) : False; + case RDP_NULL_POINTER: + ui_set_null_cursor(); + break; - return res; + default: + unimpl("System pointer message 0x%x\n", system_pointer_type); + } } -BOOL rdp_io_share_caps(STREAM s, RDP_SHARE_CAPS *caps) +/* Process a pointer PDU */ +static void +process_pointer_pdu(STREAM s) { - uint16 length = RDP_CAPLEN_SHARE; - uint16 pkt_length = length; - BOOL res; + uint16 message_type; + uint16 x, y; + + in_uint16_le(s, message_type); + in_uint8s(s, 2); /* pad */ - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) + switch (message_type) { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } + case RDP_POINTER_MOVE: + in_uint16_le(s, x); + in_uint16_le(s, y); + if (s_check(s)) + ui_move_pointer(x, y); + break; - res = res ? lsb_io_uint16(s, &caps->userid) : False; - res = res ? lsb_io_uint16(s, &caps->pad ) : False; + case RDP_POINTER_COLOR: + process_colour_pointer_pdu(s); + break; + + case RDP_POINTER_CACHED: + process_cached_pointer_pdu(s); + break; + + case RDP_POINTER_SYSTEM: + process_system_pointer_pdu(s); + break; - return res; + default: + unimpl("Pointer message 0x%x\n", message_type); + } } -BOOL rdp_io_colcache_caps(STREAM s, RDP_COLCACHE_CAPS *caps) +/* Process bitmap updates */ +void +process_bitmap_updates(STREAM s) { - uint16 length = RDP_CAPLEN_COLCACHE; - uint16 pkt_length = length; - BOOL res; + uint16 num_updates; + uint16 left, top, right, bottom, width, height; + uint16 cx, cy, bpp, Bpp, compress, bufsize, size; + uint8 *data, *bmpdata; + int i; - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) - { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } + in_uint16_le(s, num_updates); - res = res ? lsb_io_uint16(s, &caps->cache_size) : False; - res = res ? lsb_io_uint16(s, &caps->pad ) : False; + for (i = 0; i < num_updates; i++) + { + in_uint16_le(s, left); + in_uint16_le(s, top); + in_uint16_le(s, right); + in_uint16_le(s, bottom); + in_uint16_le(s, width); + in_uint16_le(s, height); + in_uint16_le(s, bpp); + Bpp = (bpp + 7) / 8; + in_uint16_le(s, compress); + in_uint16_le(s, bufsize); - return res; -} + cx = right - left + 1; + cy = bottom - top + 1; -uint8 canned_caps[] = { -0x01,0x00,0x00,0x00,0x09,0x04,0x00,0x00,0x04, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0C,0x00,0x08,0x00,0x01, -0x00,0x00,0x00,0x0E,0x00,0x08,0x00,0x01,0x00,0x00,0x00,0x10,0x00,0x34,0x00,0xFE, -0x00,0x04,0x00,0xFE,0x00,0x04,0x00,0xFE,0x00,0x08,0x00,0xFE,0x00,0x08,0x00,0xFE, -0x00,0x10,0x00,0xFE,0x00,0x20,0x00,0xFE,0x00,0x40,0x00,0xFE,0x00,0x80,0x00,0xFE, -0x00,0x00,0x01,0x40,0x00,0x00,0x08,0x00,0x01,0x00,0x01,0x02,0x00,0x00,0x00 -}; + DEBUG(("BITMAP_UPDATE(l=%d,t=%d,r=%d,b=%d,w=%d,h=%d,Bpp=%d,cmp=%d)\n", + left, top, right, bottom, width, height, Bpp, compress)); -BOOL rdp_io_unknown_caps(STREAM s, void *caps) -{ - uint16 length = 0x58; - uint16 pkt_length = length; - BOOL res; + if (!compress) + { + int y; + bmpdata = (uint8 *) xmalloc(width * height * Bpp); + for (y = 0; y < height; y++) + { + in_uint8a(s, &bmpdata[(height - y - 1) * (width * Bpp)], + width * Bpp); + } + ui_paint_bitmap(left, top, cx, cy, width, height, bmpdata); + xfree(bmpdata); + continue; + } - res = lsb_io_uint16(s, &pkt_length); - if (pkt_length != length) - { - fprintf(stderr, "Unrecognised capabilities size\n"); - return False; - } - res = res ? prs_io_uint8s(s, canned_caps, RDP_CAPLEN_UNKNOWN-4) : False; + if (compress & 0x400) + { + size = bufsize; + } + else + { + in_uint8s(s, 2); /* pad */ + in_uint16_le(s, size); + in_uint8s(s, 4); /* line_size, final_size */ + } + in_uint8p(s, data, size); + bmpdata = (uint8 *) xmalloc(width * height * Bpp); + if (bitmap_decompress(bmpdata, width, height, data, size, Bpp)) + { + ui_paint_bitmap(left, top, cx, cy, width, height, bmpdata); + } + else + { + DEBUG_RDP5(("Failed to decompress data\n")); + } - return res; + xfree(bmpdata); + } } -BOOL rdp_io_active_pdu(STREAM s, RDP_ACTIVE_PDU *pdu, int pdutype) +/* Process a palette update */ +void +process_palette(STREAM s) { - uint16 capset; - uint16 length; - BOOL res; + COLOURENTRY *entry; + COLOURMAP map; + HCOLOURMAP hmap; int i; - res = lsb_io_uint32(s, &pdu->shareid); + in_uint8s(s, 2); /* pad */ + in_uint16_le(s, map.ncolours); + in_uint8s(s, 2); /* pad */ - if (pdutype == RDP_PDU_CONFIRM_ACTIVE) - res = res ? lsb_io_uint16(s, &pdu->userid ) : False; + map.colours = (COLOURENTRY *) xmalloc(sizeof(COLOURENTRY) * map.ncolours); - res = res ? lsb_io_uint16(s, &pdu->source_len) : False; - res = res ? lsb_io_uint16(s, &pdu->caps_len ) : False; + DEBUG(("PALETTE(c=%d)\n", map.ncolours)); - if (pdu->source_len > 48) + for (i = 0; i < map.ncolours; i++) { - fprintf(stderr, "RDP source descriptor too long\n"); - return False; + entry = &map.colours[i]; + in_uint8(s, entry->red); + in_uint8(s, entry->green); + in_uint8(s, entry->blue); } - res = res ? prs_io_uint8s(s, pdu->source, pdu->source_len) : False; - res = res ? lsb_io_uint16(s, &pdu->num_caps ) : False; - res = res ? lsb_io_uint16(s, &pdu->pad ) : False; - - if (s->marshall) - { - capset = RDP_CAPSET_GENERAL; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_general_caps(s, &pdu->general_caps) : False; - - capset = RDP_CAPSET_BITMAP; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_bitmap_caps (s, &pdu->bitmap_caps ) : False; - - capset = RDP_CAPSET_ORDER; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_order_caps (s, &pdu->order_caps ) : False; - - capset = RDP_CAPSET_BMPCACHE; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_bmpcache_caps(s, &pdu->bmpcache_caps) : False; - - capset = RDP_CAPSET_COLCACHE; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_colcache_caps(s, &pdu->colcache_caps) : False; - - capset = RDP_CAPSET_ACTIVATE; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_activate_caps(s, &pdu->activate_caps) : False; - - capset = RDP_CAPSET_CONTROL; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_control_caps(s, &pdu->control_caps) : False; - - capset = RDP_CAPSET_POINTER; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_pointer_caps(s, &pdu->pointer_caps) : False; - - capset = RDP_CAPSET_SHARE; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_share_caps (s, &pdu->share_caps ) : False; - - capset = RDP_CAPSET_UNKNOWN; - res = res ? lsb_io_uint16(s, &capset) : False; - res = res ? rdp_io_unknown_caps(s, NULL) : False; - } - else - { - for (i = 0; i < pdu->num_caps; i++) - { - if (!res) - return False; + hmap = ui_create_colourmap(&map); + ui_set_colourmap(hmap); - if (!lsb_io_uint16(s, &capset)) - return False; + xfree(map.colours); +} - switch (capset) - { - case RDP_CAPSET_GENERAL: - res = rdp_io_general_caps (s, &pdu->general_caps ); - break; - case RDP_CAPSET_BITMAP: - res = rdp_io_bitmap_caps (s, &pdu->bitmap_caps ); - break; - case RDP_CAPSET_ORDER: - res = rdp_io_order_caps (s, &pdu->order_caps ); - break; - case RDP_CAPSET_BMPCACHE: - res = rdp_io_bmpcache_caps(s, &pdu->bmpcache_caps); - break; - case RDP_CAPSET_CONTROL: - res = rdp_io_control_caps (s, &pdu->control_caps ); - break; - case RDP_CAPSET_ACTIVATE: - res = rdp_io_activate_caps(s, &pdu->activate_caps); - break; - case RDP_CAPSET_POINTER: - res = rdp_io_pointer_caps (s, &pdu->pointer_caps ); - break; - case RDP_CAPSET_SHARE: - res = rdp_io_share_caps (s, &pdu->share_caps ); - break; - case RDP_CAPSET_COLCACHE: - res = rdp_io_colcache_caps(s, &pdu->colcache_caps); - break; - default: - fprintf(stderr, "Warning: Unrecognised capset %x\n", - capset); +/* Process an update PDU */ +static void +process_update_pdu(STREAM s) +{ + uint16 update_type, count; - if (!lsb_io_uint16(s, &length)) - return False; + in_uint16_le(s, update_type); - s->offset += (length - 4); - } - } - } + ui_begin_update(); + switch (update_type) + { + case RDP_UPDATE_ORDERS: + in_uint8s(s, 2); /* pad */ + in_uint16_le(s, count); + in_uint8s(s, 2); /* pad */ + process_orders(s, count); + break; - return res; -} + case RDP_UPDATE_BITMAP: + process_bitmap_updates(s); + break; -BOOL rdp_io_control_pdu(STREAM s, RDP_CONTROL_PDU *pdu) -{ - BOOL res = True; + case RDP_UPDATE_PALETTE: + process_palette(s); + break; - res = res ? lsb_io_uint16(s, &pdu->action ) : False; - res = res ? lsb_io_uint16(s, &pdu->userid ) : False; - res = res ? lsb_io_uint32(s, &pdu->controlid) : False; + case RDP_UPDATE_SYNCHRONIZE: + break; - return res; + default: + unimpl("update %d\n", update_type); + } + ui_end_update(); } -BOOL rdp_io_synchronize_pdu(STREAM s, RDP_SYNCHRONIZE_PDU *pdu) +/* Process a disconnect PDU */ +void +process_disconnect_pdu(STREAM s, uint32 * ext_disc_reason) { - BOOL res = True; - - res = res ? lsb_io_uint16(s, &pdu->type ) : False; - res = res ? lsb_io_uint16(s, &pdu->userid) : False; + in_uint32_le(s, *ext_disc_reason); - return res; + DEBUG(("Received disconnect PDU\n")); } -BOOL rdp_io_input_event(STREAM s, RDP_INPUT_EVENT *evt) +/* Process data PDU */ +static BOOL +process_data_pdu(STREAM s, uint32 * ext_disc_reason) { - BOOL res = True; + uint8 data_pdu_type; + uint8 ctype; + uint16 clen; + uint32 len; - res = res ? lsb_io_uint32(s, &evt->event_time) : False; - res = res ? lsb_io_uint16(s, &evt->message_type) : False; + uint32 roff, rlen; - if (!res) - return False; + struct stream *ns = &(g_mppc_dict.ns); + + in_uint8s(s, 6); /* shareid, pad, streamid */ + in_uint16(s, len); + in_uint8(s, data_pdu_type); + in_uint8(s, ctype); + in_uint16(s, clen); + clen -= 18; - switch (evt->message_type) + if (ctype & RDP_MPPC_COMPRESSED) { - case RDP_INPUT_CODEPOINT: - case RDP_INPUT_VIRTKEY: - res = res ? lsb_io_uint16(s, &evt->device_flags) : False; - res = res ? lsb_io_uint16(s, &evt->kbd_keycode ) : False; - break; - case RDP_INPUT_SYNCHRONIZE: - case RDP_INPUT_UNKNOWN: - case RDP_INPUT_MOUSE: - res = res ? lsb_io_uint16(s, &evt->device_flags) : False; - res = res ? lsb_io_uint16(s, &evt->mouse_x ) : False; - res = res ? lsb_io_uint16(s, &evt->mouse_y ) : False; - break; - default: - fprintf(stderr, "Unknown input type %d\n", evt->message_type); - return False; - } + if (len > RDP_MPPC_DICT_SIZE) + error("error decompressed packet size exceeds max\n"); + if (mppc_expand(s->p, clen, ctype, &roff, &rlen) == -1) + error("error while decompressing packet\n"); - return res; -} + /* len -= 18; */ -BOOL rdp_io_input_pdu(STREAM s, RDP_INPUT_PDU *pdu) -{ - BOOL res = True; - int i; + /* allocate memory and copy the uncompressed data into the temporary stream */ + ns->data = (uint8 *) xrealloc(ns->data, rlen); - res = res ? lsb_io_uint16(s, &pdu->num_events) : False; - res = res ? lsb_io_uint16(s, &pdu->pad ) : False; + memcpy((ns->data), (unsigned char *) (g_mppc_dict.hist + roff), rlen); - if (pdu->num_events > RDP_MAX_EVENTS) - { - fprintf(stderr, "Too many events in one PDU\n"); - return False; - } + ns->size = rlen; + ns->end = (ns->data + ns->size); + ns->p = ns->data; + ns->rdp_hdr = ns->p; - for (i = 0; i < pdu->num_events; i++) - { - res = res ? rdp_io_input_event(s, &pdu->event[i]) : False; + s = ns; } - return res; -} + switch (data_pdu_type) + { + case RDP_DATA_PDU_UPDATE: + process_update_pdu(s); + break; -BOOL rdp_io_font_info(STREAM s, RDP_FONT_INFO *font) -{ - BOOL res = True; + case RDP_DATA_PDU_CONTROL: + DEBUG(("Received Control PDU\n")); + break; - res = res ? prs_io_uint8s(s, font->name, 32 ) : False; - res = res ? lsb_io_uint16(s, &font->flags ) : False; - res = res ? lsb_io_uint16(s, &font->width ) : False; - res = res ? lsb_io_uint16(s, &font->height ) : False; - res = res ? lsb_io_uint16(s, &font->xaspect ) : False; - res = res ? lsb_io_uint16(s, &font->yaspect ) : False; - res = res ? lsb_io_uint32(s, &font->signature) : False; - res = res ? lsb_io_uint16(s, &font->codepage ) : False; - res = res ? lsb_io_uint16(s, &font->ascent ) : False; + case RDP_DATA_PDU_SYNCHRONISE: + DEBUG(("Received Sync PDU\n")); + break; - return res; -} + case RDP_DATA_PDU_POINTER: + process_pointer_pdu(s); + break; -BOOL rdp_io_font_pdu(STREAM s, RDP_FONT_PDU *pdu) -{ - BOOL res = True; - int i; + case RDP_DATA_PDU_BELL: + ui_bell(); + break; - res = res ? lsb_io_uint16(s, &pdu->num_fonts ) : False; - res = res ? lsb_io_uint16(s, &pdu->unknown1 ) : False; - res = res ? lsb_io_uint16(s, &pdu->unknown2 ) : False; - res = res ? lsb_io_uint16(s, &pdu->entry_size) : False; + case RDP_DATA_PDU_LOGON: + DEBUG(("Received Logon PDU\n")); + /* User logged on */ + break; - if (pdu->num_fonts > RDP_MAX_FONTS) - { - fprintf(stderr, "Too many fonts in one PDU\n"); - return False; - } + case RDP_DATA_PDU_DISCONNECT: + process_disconnect_pdu(s, ext_disc_reason); + return True; - for (i = 0; i < pdu->num_fonts; i++) - { - res = res ? rdp_io_font_info(s, &pdu->font[i]) : False; + default: + unimpl("data PDU %d\n", data_pdu_type); } - - return res; + return False; } -BOOL rdp_io_update_pdu(STREAM s, RDP_UPDATE_PDU *pdu) +/* Process incoming packets */ +/* nevers gets out of here till app is done */ +void +rdp_main_loop(BOOL * deactivated, uint32 * ext_disc_reason) { - BOOL res = True; - - res = res ? lsb_io_uint16(s, &pdu->update_type) : False; - res = res ? lsb_io_uint16(s, &pdu->pad ) : False; - - return res; + while (rdp_loop(deactivated, ext_disc_reason)) + ; } -BOOL rdp_io_secondary_order(STREAM s, RDP_SECONDARY_ORDER *rso) +/* used in uiports and rdp_main_loop, processes the rdp packets waiting */ +BOOL +rdp_loop(BOOL * deactivated, uint32 * ext_disc_reason) { - BOOL res = True; - - res = res ? lsb_io_uint16(s, &rso->length) : False; - res = res ? lsb_io_uint16(s, &rso->flags ) : False; - res = res ? prs_io_uint8 (s, &rso->type ) : False; - - return res; + uint8 type; + BOOL disc = False; /* True when a disconnect PDU was received */ + BOOL cont = True; + STREAM s; + + while (cont) + { + s = rdp_recv(&type); + if (s == NULL) + return False; + switch (type) + { + case RDP_PDU_DEMAND_ACTIVE: + process_demand_active(s); + *deactivated = False; + break; + case RDP_PDU_DEACTIVATE: + DEBUG(("RDP_PDU_DEACTIVATE\n")); + *deactivated = True; + break; + case RDP_PDU_DATA: + disc = process_data_pdu(s, ext_disc_reason); + break; + case 0: + break; + default: + unimpl("PDU %d\n", type); + } + if (disc) + return False; + cont = g_next_packet < s->end; + } + return True; } -BOOL rdp_io_bitmap_header(STREAM s, RDP_BITMAP_HEADER *rdh) +/* Establish a connection up to the RDP layer */ +BOOL +rdp_connect(char *server, uint32 flags, char *domain, char *password, + char *command, char *directory) { - BOOL res = True; + if (!sec_connect(server, g_username)) + return False; - res = res ? prs_io_uint8 (s, &rdh->cache_id ) : False; - res = res ? prs_io_uint8 (s, &rdh->pad1 ) : False; - res = res ? prs_io_uint8 (s, &rdh->width ) : False; - res = res ? prs_io_uint8 (s, &rdh->height ) : False; - res = res ? prs_io_uint8 (s, &rdh->bpp ) : False; - res = res ? lsb_io_uint16(s, &rdh->bufsize ) : False; - res = res ? lsb_io_uint16(s, &rdh->cache_idx ) : False; - res = res ? lsb_io_uint16(s, &rdh->pad2 ) : False; - res = res ? lsb_io_uint16(s, &rdh->size ) : False; - res = res ? lsb_io_uint16(s, &rdh->row_size ) : False; - res = res ? lsb_io_uint16(s, &rdh->final_size) : False; + rdp_send_logon_info(flags, domain, g_username, password, command, directory); + return True; +} - return res; +/* Disconnect from the RDP layer */ +void +rdp_disconnect(void) +{ + sec_disconnect(); }