--- sourceforge.net/trunk/rdesktop/secure.c	2003/07/01 09:31:25	432
+++ sourceforge.net/trunk/rdesktop/secure.c	2004/03/17 14:11:08	638
@@ -34,13 +34,14 @@
 #endif
 
 extern char hostname[16];
-extern int width;
-extern int height;
+extern int g_width;
+extern int g_height;
 extern int keylayout;
-extern BOOL encryption;
+extern BOOL g_encryption;
 extern BOOL g_licence_issued;
-extern BOOL use_rdp5;
-extern int server_bpp;
+extern BOOL g_use_rdp5;
+extern BOOL g_console_session;
+extern int g_server_bpp;
 extern uint16 mcs_userid;
 extern VCHANNEL g_channels[];
 extern unsigned int g_num_channels;
@@ -57,7 +58,7 @@
 static uint8 sec_encrypt_update_key[16];
 static uint8 sec_crypted_random[SEC_MODULUS_SIZE];
 
-uint16 server_rdp_version = 0;
+uint16 g_server_rdp_version = 0;
 
 /*
  * General purpose 48-byte transformation, using two 32-byte salts (generally,
@@ -406,7 +407,7 @@
 	unsigned int i;
 
 	if (g_num_channels > 0)
-		length += g_num_channels*12 + 8;
+		length += g_num_channels * 12 + 8;
 
 	if (hostlen > 30)
 		hostlen = 30;
@@ -424,16 +425,16 @@
 	out_uint16_le(s, 0xc001);
 	out_uint8(s, 0);
 
-	out_uint32_le(s, 0x61637544);	/* "Duca" ?! */
+	out_uint32_le(s, 0x61637544);	/* "Duca", as in Ducati. */
 	out_uint16_be(s, ((length - 14) | 0x8000));	/* remaining length */
 
 	/* Client information */
 	out_uint16_le(s, SEC_TAG_CLI_INFO);
 	out_uint16_le(s, 212);	/* length */
-	out_uint16_le(s, use_rdp5 ? 4 : 1);	/* RDP version. 1 == RDP4, 4 == RDP5. */
+	out_uint16_le(s, g_use_rdp5 ? 4 : 1);	/* RDP version. 1 == RDP4, 4 == RDP5. */
 	out_uint16_le(s, 8);
-	out_uint16_le(s, width);
-	out_uint16_le(s, height);
+	out_uint16_le(s, g_width);
+	out_uint16_le(s, g_height);
 	out_uint16_le(s, 0xca01);
 	out_uint16_le(s, 0xaa03);
 	out_uint32_le(s, keylayout);
@@ -448,7 +449,7 @@
 	out_uint32_le(s, 12);
 	out_uint8s(s, 64);	/* reserved? 4 + 12 doublewords */
 
-	switch (server_bpp)
+	switch (g_server_bpp)
 	{
 		case 8:
 			out_uint16_le(s, 0xca01);
@@ -466,7 +467,7 @@
 	out_uint16_le(s, 1);
 
 	out_uint32(s, 0);
-	out_uint8(s, server_bpp);
+	out_uint8(s, g_server_bpp);
 	out_uint16_le(s, 0x0700);
 	out_uint8(s, 0);
 	out_uint32_le(s, 1);
@@ -474,13 +475,13 @@
 
 	out_uint16_le(s, SEC_TAG_CLI_4);
 	out_uint16_le(s, 12);
-	out_uint32_le(s, 9);
+	out_uint32_le(s, g_console_session ? 0xb : 9);
 	out_uint32(s, 0);
 
 	/* Client encryption settings */
 	out_uint16_le(s, SEC_TAG_CLI_CRYPT);
 	out_uint16_le(s, 12);	/* length */
-	out_uint32_le(s, encryption ? 0x3 : 0);	/* encryption supported, 128-bit supported */
+	out_uint32_le(s, g_encryption ? 0x3 : 0);	/* encryption supported, 128-bit supported */
 	out_uint32(s, 0);	/* Unknown */
 
 	DEBUG_RDP5(("g_num_channels is %d\n", g_num_channels));
@@ -624,8 +625,38 @@
 	}
 	else
 	{
+		uint32 certcount;
+
 		DEBUG_RDP5(("We're going for the RDP5-style encryption\n"));
-		in_uint8s(s, 4);	/* Number of certificates */
+		in_uint32_le(s, certcount);	/* Number of certificates */
+
+		if (certcount < 2)
+		{
+			error("Server didn't send enough X509 certificates\n");
+			return False;
+		}
+
+		for (; certcount > 2; certcount--)
+		{		/* ignore all the certificates between the root and the signing CA */
+			uint32 ignorelen;
+			X509 *ignorecert;
+
+			DEBUG_RDP5(("Ignored certs left: %d\n", certcount));
+
+			in_uint32_le(s, ignorelen);
+			DEBUG_RDP5(("Ignored Certificate length is %d\n", ignorelen));
+			ignorecert = d2i_X509(NULL, &(s->p), ignorelen);
+
+			if (ignorecert == NULL)
+			{	/* XXX: error out? */
+				DEBUG_RDP5(("got a bad cert: this will probably screw up the rest of the communication\n"));
+			}
+
+#ifdef WITH_DEBUG_RDP5
+			DEBUG_RDP5(("cert #%d (ignored):\n", certcount));
+			X509_print_fp(stdout, ignorecert);
+#endif
+		}
 
 		/* Do da funky X.509 stuffy 
 
@@ -699,7 +730,7 @@
 
 	DEBUG(("Generating client random\n"));
 	/* Generate a client random, and hence determine encryption keys */
-	// This is what the MS client do:
+	/* This is what the MS client do: */
 	memset(inr, 0, SEC_RANDOM_SIZE);
 	/*  *ARIGL!* Plaintext attack, anyone?
 	   I tried doing:
@@ -736,10 +767,10 @@
 static void
 sec_process_srv_info(STREAM s)
 {
-	in_uint16_le(s, server_rdp_version);
-	DEBUG_RDP5(("Server RDP version is %d\n", server_rdp_version));
-	if (1 == server_rdp_version)
-		use_rdp5 = 0;
+	in_uint16_le(s, g_server_rdp_version);
+	DEBUG_RDP5(("Server RDP version is %d\n", g_server_rdp_version));
+	if (1 == g_server_rdp_version)
+		g_use_rdp5 = 0;
 }
 
 
@@ -779,7 +810,7 @@
 			case SEC_TAG_SRV_CHANNELS:
 				/* FIXME: We should parse this information and
 				   use it to map RDP5 channels to MCS 
-				   channels */ 
+				   channels */
 				break;
 
 			default:
@@ -800,7 +831,7 @@
 
 	while ((s = mcs_recv(&channel)) != NULL)
 	{
-		if (encryption || !g_licence_issued)
+		if (g_encryption || !g_licence_issued)
 		{
 			in_uint32_le(s, sec_flags);
 
@@ -843,8 +874,8 @@
 	if (!mcs_connect(server, &mcs_data, username))
 		return False;
 
-	//      sec_process_mcs_data(&mcs_data);
-	if (encryption)
+	/*      sec_process_mcs_data(&mcs_data); */
+	if (g_encryption)
 		sec_establish_key();
 	xfree(mcs_data.data);
 	return True;