--- sourceforge.net/trunk/rdesktop/secure.c	2003/06/12 09:25:13	421
+++ sourceforge.net/trunk/rdesktop/secure.c	2004/03/18 02:32:00	642
@@ -34,14 +34,17 @@
 #endif
 
 extern char hostname[16];
-extern int width;
-extern int height;
+extern int g_width;
+extern int g_height;
 extern int keylayout;
-extern BOOL encryption;
+extern BOOL g_encryption;
 extern BOOL g_licence_issued;
-extern BOOL use_rdp5;
-extern int server_bpp;
+extern BOOL g_use_rdp5;
+extern BOOL g_console_session;
+extern int g_server_bpp;
 extern uint16 mcs_userid;
+extern VCHANNEL g_channels[];
+extern unsigned int g_num_channels;
 
 static int rc4_key_len;
 static RC4_KEY rc4_decrypt_key;
@@ -55,7 +58,7 @@
 static uint8 sec_encrypt_update_key[16];
 static uint8 sec_crypted_random[SEC_MODULUS_SIZE];
 
-uint16 server_rdp_version = 0;
+uint16 g_server_rdp_version = 0;
 
 /*
  * General purpose 48-byte transformation, using two 32-byte salts (generally,
@@ -399,21 +402,18 @@
 static void
 sec_out_mcs_data(STREAM s)
 {
-	uint16 num_channels = get_num_channels();
 	int hostlen = 2 * strlen(hostname);
-	int length = 158 + 76 + 12 + 4 + (CHANNEL_TAGDATA_SIZE * num_channels);
-	uint16 i;
-	rdp5_channel *channel;
+	int length = 158 + 76 + 12 + 4;
+	unsigned int i;
 
-	if (0 < num_channels)
-	{
-		length += +4 + 4;
-	}
+	if (g_num_channels > 0)
+		length += g_num_channels * 12 + 8;
 
 	if (hostlen > 30)
 		hostlen = 30;
 
-	out_uint16_be(s, 5);	/* unknown */
+	/* Generic Conference Control (T.124) ConferenceCreateRequest */
+	out_uint16_be(s, 5);
 	out_uint16_be(s, 0x14);
 	out_uint8(s, 0x7c);
 	out_uint16_be(s, 1);
@@ -426,16 +426,16 @@
 	out_uint16_le(s, 0xc001);
 	out_uint8(s, 0);
 
-	out_uint32_le(s, 0x61637544);	/* "Duca" ?! */
+	out_uint32_le(s, 0x61637544);	/* OEM ID: "Duca", as in Ducati. */
 	out_uint16_be(s, ((length - 14) | 0x8000));	/* remaining length */
 
 	/* Client information */
 	out_uint16_le(s, SEC_TAG_CLI_INFO);
 	out_uint16_le(s, 212);	/* length */
-	out_uint16_le(s, use_rdp5 ? 4 : 1);	/* RDP version. 1 == RDP4, 4 == RDP5. */
+	out_uint16_le(s, g_use_rdp5 ? 4 : 1);	/* RDP version. 1 == RDP4, 4 == RDP5. */
 	out_uint16_le(s, 8);
-	out_uint16_le(s, width);
-	out_uint16_le(s, height);
+	out_uint16_le(s, g_width);
+	out_uint16_le(s, g_height);
 	out_uint16_le(s, 0xca01);
 	out_uint16_le(s, 0xaa03);
 	out_uint32_le(s, keylayout);
@@ -450,7 +450,7 @@
 	out_uint32_le(s, 12);
 	out_uint8s(s, 64);	/* reserved? 4 + 12 doublewords */
 
-	switch (server_bpp)
+	switch (g_server_bpp)
 	{
 		case 8:
 			out_uint16_le(s, 0xca01);
@@ -468,7 +468,7 @@
 	out_uint16_le(s, 1);
 
 	out_uint32(s, 0);
-	out_uint8(s, server_bpp);
+	out_uint8(s, g_server_bpp);
 	out_uint16_le(s, 0x0700);
 	out_uint8(s, 0);
 	out_uint32_le(s, 1);
@@ -476,27 +476,26 @@
 
 	out_uint16_le(s, SEC_TAG_CLI_4);
 	out_uint16_le(s, 12);
-	out_uint32_le(s, 9);
+	out_uint32_le(s, g_console_session ? 0xb : 9);
 	out_uint32(s, 0);
 
 	/* Client encryption settings */
 	out_uint16_le(s, SEC_TAG_CLI_CRYPT);
 	out_uint16_le(s, 12);	/* length */
-	out_uint32_le(s, encryption ? 0x3 : 0);	/* encryption supported, 128-bit supported */
+	out_uint32_le(s, g_encryption ? 0x3 : 0);	/* encryption supported, 128-bit supported */
 	out_uint32(s, 0);	/* Unknown */
 
-	DEBUG_RDP5(("num_channels is %d\n", num_channels));
-	if (0 < num_channels)
+	DEBUG_RDP5(("g_num_channels is %d\n", g_num_channels));
+	if (g_num_channels > 0)
 	{
 		out_uint16_le(s, SEC_TAG_CLI_CHANNELS);
-		out_uint16_le(s, num_channels * CHANNEL_TAGDATA_SIZE + 4 + 4);	/* length */
-		out_uint32_le(s, num_channels);	/* number of virtual channels */
-		for (i = 0; i < num_channels; i++)
+		out_uint16_le(s, g_num_channels * 12 + 8);	/* length */
+		out_uint32_le(s, g_num_channels);	/* number of virtual channels */
+		for (i = 0; i < g_num_channels; i++)
 		{
-			channel = find_channel_by_num(i);
-			DEBUG_RDP5(("Requesting channel %s\n", channel->name));
-			out_uint8p(s, channel->name, 8);
-			out_uint32_be(s, channel->channelflags);
+			DEBUG_RDP5(("Requesting channel %s\n", g_channels[i].name));
+			out_uint8a(s, g_channels[i].name, 8);
+			out_uint32_be(s, g_channels[i].flags);
 		}
 	}
 
@@ -627,8 +626,38 @@
 	}
 	else
 	{
+		uint32 certcount;
+
 		DEBUG_RDP5(("We're going for the RDP5-style encryption\n"));
-		in_uint8s(s, 4);	/* Number of certificates */
+		in_uint32_le(s, certcount);	/* Number of certificates */
+
+		if (certcount < 2)
+		{
+			error("Server didn't send enough X509 certificates\n");
+			return False;
+		}
+
+		for (; certcount > 2; certcount--)
+		{		/* ignore all the certificates between the root and the signing CA */
+			uint32 ignorelen;
+			X509 *ignorecert;
+
+			DEBUG_RDP5(("Ignored certs left: %d\n", certcount));
+
+			in_uint32_le(s, ignorelen);
+			DEBUG_RDP5(("Ignored Certificate length is %d\n", ignorelen));
+			ignorecert = d2i_X509(NULL, &(s->p), ignorelen);
+
+			if (ignorecert == NULL)
+			{	/* XXX: error out? */
+				DEBUG_RDP5(("got a bad cert: this will probably screw up the rest of the communication\n"));
+			}
+
+#ifdef WITH_DEBUG_RDP5
+			DEBUG_RDP5(("cert #%d (ignored):\n", certcount));
+			X509_print_fp(stdout, ignorecert);
+#endif
+		}
 
 		/* Do da funky X.509 stuffy 
 
@@ -702,7 +731,7 @@
 
 	DEBUG(("Generating client random\n"));
 	/* Generate a client random, and hence determine encryption keys */
-	// This is what the MS client do:
+	/* This is what the MS client do: */
 	memset(inr, 0, SEC_RANDOM_SIZE);
 	/*  *ARIGL!* Plaintext attack, anyone?
 	   I tried doing:
@@ -739,10 +768,10 @@
 static void
 sec_process_srv_info(STREAM s)
 {
-	in_uint16_le(s, server_rdp_version);
-	DEBUG_RDP5(("Server RDP version is %d\n", server_rdp_version));
-	if (1 == server_rdp_version)
-		use_rdp5 = 0;
+	in_uint16_le(s, g_server_rdp_version);
+	DEBUG_RDP5(("Server RDP version is %d\n", g_server_rdp_version));
+	if (1 == g_server_rdp_version)
+		g_use_rdp5 = 0;
 }
 
 
@@ -754,7 +783,7 @@
 	uint8 *next_tag;
 	uint8 len;
 
-	in_uint8s(s, 21);	/* header (T.124 stuff, probably) */
+	in_uint8s(s, 21);	/* header (T.124 ConferenceCreateResponse) */
 	in_uint8(s, len);
 	if (len & 0x80)
 		in_uint8(s, len);
@@ -775,16 +804,16 @@
 				sec_process_srv_info(s);
 				break;
 
-			case SEC_TAG_SRV_3:
-				/* FIXME: We should parse this information and
-				   use it to map RDP5 channels to MCS 
-				   channels */ 
-				break;
-
 			case SEC_TAG_SRV_CRYPT:
 				sec_process_crypt_info(s);
 				break;
 
+			case SEC_TAG_SRV_CHANNELS:
+				/* FIXME: We should parse this information and
+				   use it to map RDP5 channels to MCS 
+				   channels */
+				break;
+
 			default:
 				unimpl("response tag 0x%x\n", tag);
 		}
@@ -803,34 +832,30 @@
 
 	while ((s = mcs_recv(&channel)) != NULL)
 	{
-		if (encryption || !g_licence_issued)
+		if (g_encryption || !g_licence_issued)
 		{
 			in_uint32_le(s, sec_flags);
 
-			if (sec_flags & SEC_LICENCE_NEG)
-			{
-				if (sec_flags & SEC_ENCRYPT)
-				{
-					DEBUG_RDP5(("Encrypted license detected\n"));
-				}
-				licence_process(s);
-				continue;
-			}
-
 			if (sec_flags & SEC_ENCRYPT)
 			{
 				in_uint8s(s, 8);	/* signature */
 				sec_decrypt(s->p, s->end - s->p);
 			}
+
+			if (sec_flags & SEC_LICENCE_NEG)
+			{
+				licence_process(s);
+				continue;
+			}
 		}
 
-		if (MCS_GLOBAL_CHANNEL == channel)
+		if (channel != MCS_GLOBAL_CHANNEL)
 		{
-			return s;
+			channel_process(s, channel);
+			continue;
 		}
-		else
-			rdp5_process_channel(s, channel);
 
+		return s;
 	}
 
 	return NULL;
@@ -850,8 +875,8 @@
 	if (!mcs_connect(server, &mcs_data, username))
 		return False;
 
-	//      sec_process_mcs_data(&mcs_data);
-	if (encryption)
+	/*      sec_process_mcs_data(&mcs_data); */
+	if (g_encryption)
 		sec_establish_key();
 	xfree(mcs_data.data);
 	return True;