--- sourceforge.net/trunk/rdesktop/secure.c	2003/10/09 04:21:19	482
+++ sourceforge.net/trunk/rdesktop/secure.c	2004/04/26 13:48:39	677
@@ -412,7 +412,8 @@
 	if (hostlen > 30)
 		hostlen = 30;
 
-	out_uint16_be(s, 5);	/* unknown */
+	/* Generic Conference Control (T.124) ConferenceCreateRequest */
+	out_uint16_be(s, 5);
 	out_uint16_be(s, 0x14);
 	out_uint8(s, 0x7c);
 	out_uint16_be(s, 1);
@@ -425,7 +426,7 @@
 	out_uint16_le(s, 0xc001);
 	out_uint8(s, 0);
 
-	out_uint32_le(s, 0x61637544);	/* "Duca" ?! */
+	out_uint32_le(s, 0x61637544);	/* OEM ID: "Duca", as in Ducati. */
 	out_uint16_be(s, ((length - 14) | 0x8000));	/* remaining length */
 
 	/* Client information */
@@ -448,22 +449,7 @@
 	out_uint32(s, 0);
 	out_uint32_le(s, 12);
 	out_uint8s(s, 64);	/* reserved? 4 + 12 doublewords */
-
-	switch (g_server_bpp)
-	{
-		case 8:
-			out_uint16_le(s, 0xca01);
-			break;
-		case 15:
-			out_uint16_le(s, 0xca02);
-			break;
-		case 16:
-			out_uint16_le(s, 0xca03);
-			break;
-		case 24:
-			out_uint16_le(s, 0xca04);
-			break;
-	}
+	out_uint16_le(s, 0xca01);	/* colour depth? */
 	out_uint16_le(s, 1);
 
 	out_uint32(s, 0);
@@ -625,8 +611,38 @@
 	}
 	else
 	{
+		uint32 certcount;
+
 		DEBUG_RDP5(("We're going for the RDP5-style encryption\n"));
-		in_uint8s(s, 4);	/* Number of certificates */
+		in_uint32_le(s, certcount);	/* Number of certificates */
+
+		if (certcount < 2)
+		{
+			error("Server didn't send enough X509 certificates\n");
+			return False;
+		}
+
+		for (; certcount > 2; certcount--)
+		{		/* ignore all the certificates between the root and the signing CA */
+			uint32 ignorelen;
+			X509 *ignorecert;
+
+			DEBUG_RDP5(("Ignored certs left: %d\n", certcount));
+
+			in_uint32_le(s, ignorelen);
+			DEBUG_RDP5(("Ignored Certificate length is %d\n", ignorelen));
+			ignorecert = d2i_X509(NULL, &(s->p), ignorelen);
+
+			if (ignorecert == NULL)
+			{	/* XXX: error out? */
+				DEBUG_RDP5(("got a bad cert: this will probably screw up the rest of the communication\n"));
+			}
+
+#ifdef WITH_DEBUG_RDP5
+			DEBUG_RDP5(("cert #%d (ignored):\n", certcount));
+			X509_print_fp(stdout, ignorecert);
+#endif
+		}
 
 		/* Do da funky X.509 stuffy 
 
@@ -700,7 +716,7 @@
 
 	DEBUG(("Generating client random\n"));
 	/* Generate a client random, and hence determine encryption keys */
-	// This is what the MS client do:
+	/* This is what the MS client do: */
 	memset(inr, 0, SEC_RANDOM_SIZE);
 	/*  *ARIGL!* Plaintext attack, anyone?
 	   I tried doing:
@@ -740,7 +756,10 @@
 	in_uint16_le(s, g_server_rdp_version);
 	DEBUG_RDP5(("Server RDP version is %d\n", g_server_rdp_version));
 	if (1 == g_server_rdp_version)
+	{
 		g_use_rdp5 = 0;
+		g_server_bpp = 8;
+	}
 }
 
 
@@ -752,7 +771,7 @@
 	uint8 *next_tag;
 	uint8 len;
 
-	in_uint8s(s, 21);	/* header (T.124 stuff, probably) */
+	in_uint8s(s, 21);	/* header (T.124 ConferenceCreateResponse) */
 	in_uint8(s, len);
 	if (len & 0x80)
 		in_uint8(s, len);
@@ -844,7 +863,7 @@
 	if (!mcs_connect(server, &mcs_data, username))
 		return False;
 
-	//      sec_process_mcs_data(&mcs_data);
+	/*      sec_process_mcs_data(&mcs_data); */
 	if (g_encryption)
 		sec_establish_key();
 	xfree(mcs_data.data);