uLab
/
xrdp-proprietary
mirror of https://mirror.git.trinitydesktop.org/gitea/uLab/xrdp-proprietary
0
0
Fork 0
Code Issues Releases Wiki Activity

adding rdesktop files

Browse Source
ulab-original
jsorg71 19 years ago
parent e0cc29d381
commit d490be59e3
6 changed files with 2322 additions and 0 deletions
Show Stats Download Patch File Download Diff File

231
uirdesktop/iso.c
Unescape View File

@ -0,0 +1,231 @@
/* -*- c-basic-offset: 8 -*-
rdesktop: A Remote Desktop Protocol client.
Protocol services - ISO layer
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "rdesktop.h"
/* Send a self-contained ISO PDU */
static void
iso_send_msg(uint8 code)
{
STREAM s;
s = tcp_init(11);
out_uint8(s, 3); /* version */
out_uint8(s, 0); /* reserved */
out_uint16_be(s, 11); /* length */
out_uint8(s, 6); /* hdrlen */
out_uint8(s, code);
out_uint16(s, 0); /* dst_ref */
out_uint16(s, 0); /* src_ref */
out_uint8(s, 0); /* class */
s_mark_end(s);
tcp_send(s);
}
static void
iso_send_connection_request(char *username)
{
STREAM s;
int length = 30 + strlen(username);
s = tcp_init(length);
out_uint8(s, 3); /* version */
out_uint8(s, 0); /* reserved */
out_uint16_be(s, length); /* length */
out_uint8(s, length - 5); /* hdrlen */
out_uint8(s, ISO_PDU_CR);
out_uint16(s, 0); /* dst_ref */
out_uint16(s, 0); /* src_ref */
out_uint8(s, 0); /* class */
out_uint8p(s, "Cookie: mstshash=", strlen("Cookie: mstshash="));
out_uint8p(s, username, strlen(username));
out_uint8(s, 0x0d); /* Unknown */
out_uint8(s, 0x0a); /* Unknown */
s_mark_end(s);
tcp_send(s);
}
/* Receive a message on the ISO layer, return code */
static STREAM
iso_recv_msg(uint8 * code, uint8 * rdpver)
{
STREAM s;
uint16 length;
uint8 version;
s = tcp_recv(NULL, 4);
if (s == NULL)
return NULL;
in_uint8(s, version);
if (rdpver != NULL)
*rdpver = version;
if (version == 3)
{
in_uint8s(s, 1); /* pad */
in_uint16_be(s, length);
}
else
{
in_uint8(s, length);
if (length & 0x80)
{
length &= ~0x80;
next_be(s, length);
}
}
s = tcp_recv(s, length - 4);
if (s == NULL)
return NULL;
if (version != 3)
return s;
in_uint8s(s, 1); /* hdrlen */
in_uint8(s, *code);
if (*code == ISO_PDU_DT)
{
in_uint8s(s, 1); /* eot */
return s;
}
in_uint8s(s, 5); /* dst_ref, src_ref, class */
return s;
}
/* Initialise ISO transport data packet */
STREAM
iso_init(int length)
{
STREAM s;
s = tcp_init(length + 7);
s_push_layer(s, iso_hdr, 7);
return s;
}
/* Send an ISO data PDU */
void
iso_send(STREAM s)
{
uint16 length;
s_pop_layer(s, iso_hdr);
length = s->end - s->p;
out_uint8(s, 3); /* version */
out_uint8(s, 0); /* reserved */
out_uint16_be(s, length);
out_uint8(s, 2); /* hdrlen */
out_uint8(s, ISO_PDU_DT); /* code */
out_uint8(s, 0x80); /* eot */
tcp_send(s);
}
/* Receive ISO transport data packet */
STREAM
iso_recv(uint8 * rdpver)
{
STREAM s;
uint8 code = 0;
s = iso_recv_msg(&code, rdpver);
if (s == NULL)
return NULL;
if (rdpver != NULL)
if (*rdpver != 3)
return s;
if (code != ISO_PDU_DT)
{
error("expected DT, got 0x%x\n", code);
return NULL;
}
return s;
}
/* Establish a connection up to the ISO layer */
BOOL
iso_connect(char *server, char *username)
{
uint8 code = 0;
if (!tcp_connect(server))
return False;
iso_send_connection_request(username);
if (iso_recv_msg(&code, NULL) == NULL)
return False;
if (code != ISO_PDU_CC)
{
error("expected CC, got 0x%x\n", code);
tcp_disconnect();
return False;
}
return True;
}
/* Establish a reconnection up to the ISO layer */
BOOL
iso_reconnect(char *server)
{
uint8 code = 0;
if (!tcp_connect(server))
return False;
iso_send_msg(ISO_PDU_CR);
if (iso_recv_msg(&code, NULL) == NULL)
return False;
if (code != ISO_PDU_CC)
{
error("expected CC, got 0x%x\n", code);
tcp_disconnect();
return False;
}
return True;
}
/* Disconnect from the ISO layer */
void
iso_disconnect(void)
{
iso_send_msg(ISO_PDU_DR);
tcp_disconnect();
}
/* reset the state to support reconnecting */
void
iso_reset_state(void)
{
tcp_reset_state();
}

469
uirdesktop/mcs.c
Unescape View File

@ -0,0 +1,469 @@
/* -*- c-basic-offset: 8 -*-
rdesktop: A Remote Desktop Protocol client.
Protocol services - Multipoint Communications Service
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "rdesktop.h"
uint16 g_mcs_userid;
extern VCHANNEL g_channels[];
extern unsigned int g_num_channels;
/* Parse an ASN.1 BER header */
static BOOL
ber_parse_header(STREAM s, int tagval, int *length)
{
int tag, len;
if (tagval > 0xff)
{
in_uint16_be(s, tag);
}
else
{
in_uint8(s, tag)}
if (tag != tagval)
{
error("expected tag %d, got %d\n", tagval, tag);
return False;
}
in_uint8(s, len);
if (len & 0x80)
{
len &= ~0x80;
*length = 0;
while (len--)
next_be(s, *length);
}
else
*length = len;
return s_check(s);
}
/* Output an ASN.1 BER header */
static void
ber_out_header(STREAM s, int tagval, int length)
{
if (tagval > 0xff)
{
out_uint16_be(s, tagval);
}
else
{
out_uint8(s, tagval);
}
if (length >= 0x80)
{
out_uint8(s, 0x82);
out_uint16_be(s, length);
}
else
out_uint8(s, length);
}
/* Output an ASN.1 BER integer */
static void
ber_out_integer(STREAM s, int value)
{
ber_out_header(s, BER_TAG_INTEGER, 2);
out_uint16_be(s, value);
}
/* Output a DOMAIN_PARAMS structure (ASN.1 BER) */
static void
mcs_out_domain_params(STREAM s, int max_channels, int max_users, int max_tokens, int max_pdusize)
{
ber_out_header(s, MCS_TAG_DOMAIN_PARAMS, 32);
ber_out_integer(s, max_channels);
ber_out_integer(s, max_users);
ber_out_integer(s, max_tokens);
ber_out_integer(s, 1); /* num_priorities */
ber_out_integer(s, 0); /* min_throughput */
ber_out_integer(s, 1); /* max_height */
ber_out_integer(s, max_pdusize);
ber_out_integer(s, 2); /* ver_protocol */
}
/* Parse a DOMAIN_PARAMS structure (ASN.1 BER) */
static BOOL
mcs_parse_domain_params(STREAM s)
{
int length;
ber_parse_header(s, MCS_TAG_DOMAIN_PARAMS, &length);
in_uint8s(s, length);
return s_check(s);
}
/* Send an MCS_CONNECT_INITIAL message (ASN.1 BER) */
static void
mcs_send_connect_initial(STREAM mcs_data)
{
int datalen = mcs_data->end - mcs_data->data;
int length = 9 + 3 * 34 + 4 + datalen;
STREAM s;
s = iso_init(length + 5);
ber_out_header(s, MCS_CONNECT_INITIAL, length);
ber_out_header(s, BER_TAG_OCTET_STRING, 1); /* calling domain */
out_uint8(s, 1);
ber_out_header(s, BER_TAG_OCTET_STRING, 1); /* called domain */
out_uint8(s, 1);
ber_out_header(s, BER_TAG_BOOLEAN, 1);
out_uint8(s, 0xff); /* upward flag */
mcs_out_domain_params(s, 34, 2, 0, 0xffff); /* target params */
mcs_out_domain_params(s, 1, 1, 1, 0x420); /* min params */
mcs_out_domain_params(s, 0xffff, 0xfc17, 0xffff, 0xffff); /* max params */
ber_out_header(s, BER_TAG_OCTET_STRING, datalen);
out_uint8p(s, mcs_data->data, datalen);
s_mark_end(s);
iso_send(s);
}
/* Expect a MCS_CONNECT_RESPONSE message (ASN.1 BER) */
static BOOL
mcs_recv_connect_response(STREAM mcs_data)
{
uint8 result;
int length;
STREAM s;
s = iso_recv(NULL);
if (s == NULL)
return False;
ber_parse_header(s, MCS_CONNECT_RESPONSE, &length);
ber_parse_header(s, BER_TAG_RESULT, &length);
in_uint8(s, result);
if (result != 0)
{
error("MCS connect: %d\n", result);
return False;
}
ber_parse_header(s, BER_TAG_INTEGER, &length);
in_uint8s(s, length); /* connect id */
mcs_parse_domain_params(s);
ber_parse_header(s, BER_TAG_OCTET_STRING, &length);
sec_process_mcs_data(s);
/*
if (length > mcs_data->size)
{
error("MCS data length %d, expected %d\n", length,
mcs_data->size);
length = mcs_data->size;
}
in_uint8a(s, mcs_data->data, length);
mcs_data->p = mcs_data->data;
mcs_data->end = mcs_data->data + length;
*/
return s_check_end(s);
}
/* Send an EDrq message (ASN.1 PER) */
static void
mcs_send_edrq(void)
{
STREAM s;
s = iso_init(5);
out_uint8(s, (MCS_EDRQ << 2));
out_uint16_be(s, 1); /* height */
out_uint16_be(s, 1); /* interval */
s_mark_end(s);
iso_send(s);
}
/* Send an AUrq message (ASN.1 PER) */
static void
mcs_send_aurq(void)
{
STREAM s;
s = iso_init(1);
out_uint8(s, (MCS_AURQ << 2));
s_mark_end(s);
iso_send(s);
}
/* Expect a AUcf message (ASN.1 PER) */
static BOOL
mcs_recv_aucf(uint16 * mcs_userid)
{
uint8 opcode, result;
STREAM s;
s = iso_recv(NULL);
if (s == NULL)
return False;
in_uint8(s, opcode);
if ((opcode >> 2) != MCS_AUCF)
{
error("expected AUcf, got %d\n", opcode);
return False;
}
in_uint8(s, result);
if (result != 0)
{
error("AUrq: %d\n", result);
return False;
}
if (opcode & 2)
in_uint16_be(s, *mcs_userid);
return s_check_end(s);
}
/* Send a CJrq message (ASN.1 PER) */
static void
mcs_send_cjrq(uint16 chanid)
{
STREAM s;
DEBUG_RDP5(("Sending CJRQ for channel #%d\n", chanid));
s = iso_init(5);
out_uint8(s, (MCS_CJRQ << 2));
out_uint16_be(s, g_mcs_userid);
out_uint16_be(s, chanid);
s_mark_end(s);
iso_send(s);
}
/* Expect a CJcf message (ASN.1 PER) */
static BOOL
mcs_recv_cjcf(void)
{
uint8 opcode, result;
STREAM s;
s = iso_recv(NULL);
if (s == NULL)
return False;
in_uint8(s, opcode);
if ((opcode >> 2) != MCS_CJCF)
{
error("expected CJcf, got %d\n", opcode);
return False;
}
in_uint8(s, result);
if (result != 0)
{
error("CJrq: %d\n", result);
return False;
}
in_uint8s(s, 4); /* mcs_userid, req_chanid */
if (opcode & 2)
in_uint8s(s, 2); /* join_chanid */
return s_check_end(s);
}
/* Initialise an MCS transport data packet */
STREAM
mcs_init(int length)
{
STREAM s;
s = iso_init(length + 8);
s_push_layer(s, mcs_hdr, 8);
return s;
}
/* Send an MCS transport data packet to a specific channel */
void
mcs_send_to_channel(STREAM s, uint16 channel)
{
uint16 length;
s_pop_layer(s, mcs_hdr);
length = s->end - s->p - 8;
length |= 0x8000;
out_uint8(s, (MCS_SDRQ << 2));
out_uint16_be(s, g_mcs_userid);
out_uint16_be(s, channel);
out_uint8(s, 0x70); /* flags */
out_uint16_be(s, length);
iso_send(s);
}
/* Send an MCS transport data packet to the global channel */
void
mcs_send(STREAM s)
{
mcs_send_to_channel(s, MCS_GLOBAL_CHANNEL);
}
/* Receive an MCS transport data packet */
STREAM
mcs_recv(uint16 * channel, uint8 * rdpver)
{
uint8 opcode, appid, length;
STREAM s;
s = iso_recv(rdpver);
if (s == NULL)
return NULL;
if (rdpver != NULL)
if (*rdpver != 3)
return s;
in_uint8(s, opcode);
appid = opcode >> 2;
if (appid != MCS_SDIN)
{
if (appid != MCS_DPUM)
{
error("expected data, got %d\n", opcode);
}
return NULL;
}
in_uint8s(s, 2); /* userid */
in_uint16_be(s, *channel);
in_uint8s(s, 1); /* flags */
in_uint8(s, length);
if (length & 0x80)
in_uint8s(s, 1); /* second byte of length */
return s;
}
/* Establish a connection up to the MCS layer */
BOOL
mcs_connect(char *server, STREAM mcs_data, char *username)
{
unsigned int i;
if (!iso_connect(server, username))
return False;
mcs_send_connect_initial(mcs_data);
if (!mcs_recv_connect_response(mcs_data))
goto error;
mcs_send_edrq();
mcs_send_aurq();
if (!mcs_recv_aucf(&g_mcs_userid))
goto error;
mcs_send_cjrq(g_mcs_userid + MCS_USERCHANNEL_BASE);
if (!mcs_recv_cjcf())
goto error;
mcs_send_cjrq(MCS_GLOBAL_CHANNEL);
if (!mcs_recv_cjcf())
goto error;
for (i = 0; i < g_num_channels; i++)
{
mcs_send_cjrq(g_channels[i].mcs_id);
if (!mcs_recv_cjcf())
goto error;
}
return True;
error:
iso_disconnect();
return False;
}
/* Establish a connection up to the MCS layer */
BOOL
mcs_reconnect(char *server, STREAM mcs_data)
{
unsigned int i;
if (!iso_reconnect(server))
return False;
mcs_send_connect_initial(mcs_data);
if (!mcs_recv_connect_response(mcs_data))
goto error;
mcs_send_edrq();
mcs_send_aurq();
if (!mcs_recv_aucf(&g_mcs_userid))
goto error;
mcs_send_cjrq(g_mcs_userid + MCS_USERCHANNEL_BASE);
if (!mcs_recv_cjcf())
goto error;
mcs_send_cjrq(MCS_GLOBAL_CHANNEL);
if (!mcs_recv_cjcf())
goto error;
for (i = 0; i < g_num_channels; i++)
{
mcs_send_cjrq(g_channels[i].mcs_id);
if (!mcs_recv_cjcf())
goto error;
}
return True;
error:
iso_disconnect();
return False;
}
/* Disconnect from the MCS layer */
void
mcs_disconnect(void)
{
iso_disconnect();
}
/* reset the state of the mcs layer */
void
mcs_reset_state(void)
{
g_mcs_userid = 0;
iso_reset_state();
}

95
uirdesktop/parse.h
Unescape View File

@ -0,0 +1,95 @@
/*
rdesktop: A Remote Desktop Protocol client.
Parsing primitives
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
/* Parser state */
typedef struct stream
{
unsigned char *p;
unsigned char *end;
unsigned char *data;
unsigned int size;
/* Offsets of various headers */
unsigned char *iso_hdr;
unsigned char *mcs_hdr;
unsigned char *sec_hdr;
unsigned char *rdp_hdr;
unsigned char *channel_hdr;
}
*STREAM;
#define s_push_layer(s,h,n) { (s)->h = (s)->p; (s)->p += n; }
#define s_pop_layer(s,h) (s)->p = (s)->h;
#define s_mark_end(s) (s)->end = (s)->p;
#define s_check(s) ((s)->p <= (s)->end)
#define s_check_rem(s,n) ((s)->p + n <= (s)->end)
#define s_check_end(s) ((s)->p == (s)->end)
#if defined(L_ENDIAN) && !defined(NEED_ALIGN)
#define in_uint16_le(s,v) { v = *(uint16 *)((s)->p); (s)->p += 2; }
#define in_uint32_le(s,v) { v = *(uint32 *)((s)->p); (s)->p += 4; }
#define out_uint16_le(s,v) { *(uint16 *)((s)->p) = v; (s)->p += 2; }
#define out_uint32_le(s,v) { *(uint32 *)((s)->p) = v; (s)->p += 4; }
#else
#define in_uint16_le(s,v) { v = *((s)->p++); v += *((s)->p++) << 8; }
#define in_uint32_le(s,v) { in_uint16_le(s,v) \
v += *((s)->p++) << 16; v += *((s)->p++) << 24; }
#define out_uint16_le(s,v) { *((s)->p++) = (v) & 0xff; *((s)->p++) = ((v) >> 8) & 0xff; }
#define out_uint32_le(s,v) { out_uint16_le(s, (v) & 0xffff); out_uint16_le(s, ((v) >> 16) & 0xffff); }
#endif
#if defined(B_ENDIAN) && !defined(NEED_ALIGN)
#define in_uint16_be(s,v) { v = *(uint16 *)((s)->p); (s)->p += 2; }
#define in_uint32_be(s,v) { v = *(uint32 *)((s)->p); (s)->p += 4; }
#define out_uint16_be(s,v) { *(uint16 *)((s)->p) = v; (s)->p += 2; }
#define out_uint32_be(s,v) { *(uint32 *)((s)->p) = v; (s)->p += 4; }
#define B_ENDIAN_PREFERRED
#define in_uint16(s,v) in_uint16_be(s,v)
#define in_uint32(s,v) in_uint32_be(s,v)
#define out_uint16(s,v) out_uint16_be(s,v)
#define out_uint32(s,v) out_uint32_be(s,v)
#else
#define in_uint16_be(s,v) { v = *((s)->p++); next_be(s,v); }
#define in_uint32_be(s,v) { in_uint16_be(s,v); next_be(s,v); next_be(s,v); }
#define out_uint16_be(s,v) { *((s)->p++) = ((v) >> 8) & 0xff; *((s)->p++) = (v) & 0xff; }
#define out_uint32_be(s,v) { out_uint16_be(s, ((v) >> 16) & 0xffff); out_uint16_be(s, (v) & 0xffff); }
#endif
#ifndef B_ENDIAN_PREFERRED
#define in_uint16(s,v) in_uint16_le(s,v)
#define in_uint32(s,v) in_uint32_le(s,v)
#define out_uint16(s,v) out_uint16_le(s,v)
#define out_uint32(s,v) out_uint32_le(s,v)
#endif
#define in_uint8(s,v) v = *((s)->p++);
#define in_uint8p(s,v,n) { v = (s)->p; (s)->p += n; }
#define in_uint8a(s,v,n) { memcpy(v,(s)->p,n); (s)->p += n; }
#define in_uint8s(s,n) (s)->p += n;
#define out_uint8(s,v) *((s)->p++) = v;
#define out_uint8p(s,v,n) { memcpy((s)->p,v,n); (s)->p += n; }
#define out_uint8a(s,v,n) out_uint8p(s,v,n);
#define out_uint8s(s,n) { memset((s)->p,0,n); (s)->p += n; }
#define next_be(s,v) v = ((v) << 8) + *((s)->p++);

981
uirdesktop/secure.c
Unescape View File

@ -0,0 +1,981 @@
/* -*- c-basic-offset: 8 -*-
rdesktop: A Remote Desktop Protocol client.
Protocol services - RDP encryption and licensing
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "rdesktop.h"
#include <openssl/rc4.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#include <openssl/bn.h>
#include <openssl/x509v3.h>
extern char g_hostname[16];
extern int g_width;
extern int g_height;
extern unsigned int g_keylayout;
extern int g_keyboard_type;
extern int g_keyboard_subtype;
extern int g_keyboard_functionkeys;
extern BOOL g_encryption;
extern BOOL g_licence_issued;
extern BOOL g_use_rdp5;
extern BOOL g_console_session;
extern int g_server_depth;
extern uint16 mcs_userid;
extern VCHANNEL g_channels[];
extern unsigned int g_num_channels;
static int rc4_key_len;
static RC4_KEY rc4_decrypt_key;
static RC4_KEY rc4_encrypt_key;
static RSA *server_public_key;
static uint32 server_public_key_len;
static uint8 sec_sign_key[16];
static uint8 sec_decrypt_key[16];
static uint8 sec_encrypt_key[16];
static uint8 sec_decrypt_update_key[16];
static uint8 sec_encrypt_update_key[16];
static uint8 sec_crypted_random[SEC_MAX_MODULUS_SIZE];
uint16 g_server_rdp_version = 0;
/* These values must be available to reset state - Session Directory */
static int sec_encrypt_use_count = 0;
static int sec_decrypt_use_count = 0;
/*
* I believe this is based on SSLv3 with the following differences:
* MAC algorithm (5.2.3.1) uses only 32-bit length in place of seq_num/type/length fields
* MAC algorithm uses SHA1 and MD5 for the two hash functions instead of one or other
* key_block algorithm (6.2.2) uses 'X', 'YY', 'ZZZ' instead of 'A', 'BB', 'CCC'
* key_block partitioning is different (16 bytes each: MAC secret, decrypt key, encrypt key)
* encryption/decryption keys updated every 4096 packets
* See http://wp.netscape.com/eng/ssl3/draft302.txt
*/
/*
* 48-byte transformation used to generate master secret (6.1) and key material (6.2.2).
* Both SHA1 and MD5 algorithms are used.
*/
void
sec_hash_48(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2, uint8 salt)
{
uint8 shasig[20];
uint8 pad[4];
SHA_CTX sha;
MD5_CTX md5;
int i;
for (i = 0; i < 3; i++)
{
memset(pad, salt + i, i + 1);
SHA1_Init(&sha);
SHA1_Update(&sha, pad, i + 1);
SHA1_Update(&sha, in, 48);
SHA1_Update(&sha, salt1, 32);
SHA1_Update(&sha, salt2, 32);
SHA1_Final(shasig, &sha);
MD5_Init(&md5);
MD5_Update(&md5, in, 48);
MD5_Update(&md5, shasig, 20);
MD5_Final(&out[i * 16], &md5);
}
}
/*
* 16-byte transformation used to generate export keys (6.2.2).
*/
void
sec_hash_16(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2)
{
MD5_CTX md5;
MD5_Init(&md5);
MD5_Update(&md5, in, 16);
MD5_Update(&md5, salt1, 32);
MD5_Update(&md5, salt2, 32);
MD5_Final(out, &md5);
}
/* Reduce key entropy from 64 to 40 bits */
static void
sec_make_40bit(uint8 * key)
{
key[0] = 0xd1;
key[1] = 0x26;
key[2] = 0x9e;
}
/* Generate encryption keys given client and server randoms */
static void
sec_generate_keys(uint8 * client_random, uint8 * server_random, int rc4_key_size)
{
uint8 pre_master_secret[48];
uint8 master_secret[48];
uint8 key_block[48];
/* Construct pre-master secret */
memcpy(pre_master_secret, client_random, 24);
memcpy(pre_master_secret + 24, server_random, 24);
/* Generate master secret and then key material */
sec_hash_48(master_secret, pre_master_secret, client_random, server_random, 'A');
sec_hash_48(key_block, master_secret, client_random, server_random, 'X');
/* First 16 bytes of key material is MAC secret */
memcpy(sec_sign_key, key_block, 16);
/* Generate export keys from next two blocks of 16 bytes */
sec_hash_16(sec_decrypt_key, &key_block[16], client_random, server_random);
sec_hash_16(sec_encrypt_key, &key_block[32], client_random, server_random);
if (rc4_key_size == 1)
{
DEBUG(("40-bit encryption enabled\n"));
sec_make_40bit(sec_sign_key);
sec_make_40bit(sec_decrypt_key);
sec_make_40bit(sec_encrypt_key);
rc4_key_len = 8;
}
else
{
DEBUG(("rc_4_key_size == %d, 128-bit encryption enabled\n", rc4_key_size));
rc4_key_len = 16;
}
/* Save initial RC4 keys as update keys */
memcpy(sec_decrypt_update_key, sec_decrypt_key, 16);
memcpy(sec_encrypt_update_key, sec_encrypt_key, 16);
/* Initialise RC4 state arrays */
RC4_set_key(&rc4_decrypt_key, rc4_key_len, sec_decrypt_key);
RC4_set_key(&rc4_encrypt_key, rc4_key_len, sec_encrypt_key);
}
static uint8 pad_54[40] = {
54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54,
54, 54, 54,
54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54,
54, 54, 54
};
static uint8 pad_92[48] = {
92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92,
92, 92, 92, 92, 92, 92, 92,
92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92,
92, 92, 92, 92, 92, 92, 92
};
/* Output a uint32 into a buffer (little-endian) */
void
buf_out_uint32(uint8 * buffer, uint32 value)
{
buffer[0] = (value) & 0xff;
buffer[1] = (value >> 8) & 0xff;
buffer[2] = (value >> 16) & 0xff;
buffer[3] = (value >> 24) & 0xff;
}
/* Generate a MAC hash (5.2.3.1), using a combination of SHA1 and MD5 */
void
sec_sign(uint8 * signature, int siglen, uint8 * session_key, int keylen, uint8 * data, int datalen)
{
uint8 shasig[20];
uint8 md5sig[16];
uint8 lenhdr[4];
SHA_CTX sha;
MD5_CTX md5;
buf_out_uint32(lenhdr, datalen);
SHA1_Init(&sha);
SHA1_Update(&sha, session_key, keylen);
SHA1_Update(&sha, pad_54, 40);
SHA1_Update(&sha, lenhdr, 4);
SHA1_Update(&sha, data, datalen);
SHA1_Final(shasig, &sha);
MD5_Init(&md5);
MD5_Update(&md5, session_key, keylen);
MD5_Update(&md5, pad_92, 48);
MD5_Update(&md5, shasig, 20);
MD5_Final(md5sig, &md5);
memcpy(signature, md5sig, siglen);
}
/* Update an encryption key */
static void
sec_update(uint8 * key, uint8 * update_key)
{
uint8 shasig[20];
SHA_CTX sha;
MD5_CTX md5;
RC4_KEY update;
SHA1_Init(&sha);
SHA1_Update(&sha, update_key, rc4_key_len);
SHA1_Update(&sha, pad_54, 40);
SHA1_Update(&sha, key, rc4_key_len);
SHA1_Final(shasig, &sha);
MD5_Init(&md5);
MD5_Update(&md5, update_key, rc4_key_len);
MD5_Update(&md5, pad_92, 48);
MD5_Update(&md5, shasig, 20);
MD5_Final(key, &md5);
RC4_set_key(&update, rc4_key_len, key);
RC4(&update, rc4_key_len, key, key);
if (rc4_key_len == 8)
sec_make_40bit(key);
}
/* Encrypt data using RC4 */
static void
sec_encrypt(uint8 * data, int length)
{
if (sec_encrypt_use_count == 4096)
{
sec_update(sec_encrypt_key, sec_encrypt_update_key);
RC4_set_key(&rc4_encrypt_key, rc4_key_len, sec_encrypt_key);
sec_encrypt_use_count = 0;
}
RC4(&rc4_encrypt_key, length, data, data);
sec_encrypt_use_count++;
}
/* Decrypt data using RC4 */
void
sec_decrypt(uint8 * data, int length)
{
if (sec_decrypt_use_count == 4096)
{
sec_update(sec_decrypt_key, sec_decrypt_update_key);
RC4_set_key(&rc4_decrypt_key, rc4_key_len, sec_decrypt_key);
sec_decrypt_use_count = 0;
}
RC4(&rc4_decrypt_key, length, data, data);
sec_decrypt_use_count++;
}
static void
reverse(uint8 * p, int len)
{
int i, j;
uint8 temp;
for (i = 0, j = len - 1; i < j; i++, j--)
{
temp = p[i];
p[i] = p[j];
p[j] = temp;
}
}
/* Perform an RSA public key encryption operation */
static void
sec_rsa_encrypt(uint8 * out, uint8 * in, int len, uint32 modulus_size, uint8 * modulus, uint8 * exponent)
{
BN_CTX *ctx;
BIGNUM mod, exp, x, y;
uint8 inr[SEC_MAX_MODULUS_SIZE];
int outlen;
reverse(modulus, modulus_size);
reverse(exponent, SEC_EXPONENT_SIZE);
memcpy(inr, in, len);
reverse(inr, len);
ctx = BN_CTX_new();
BN_init(&mod);
BN_init(&exp);
BN_init(&x);
BN_init(&y);
BN_bin2bn(modulus, modulus_size, &mod);
BN_bin2bn(exponent, SEC_EXPONENT_SIZE, &exp);
BN_bin2bn(inr, len, &x);
BN_mod_exp(&y, &x, &exp, &mod, ctx);
outlen = BN_bn2bin(&y, out);
reverse(out, outlen);
if (outlen < modulus_size)
memset(out + outlen, 0, modulus_size - outlen);
BN_free(&y);
BN_clear_free(&x);
BN_free(&exp);
BN_free(&mod);
BN_CTX_free(ctx);
}
/* Initialise secure transport packet */
STREAM
sec_init(uint32 flags, int maxlen)
{
int hdrlen;
STREAM s;
if (!g_licence_issued)
hdrlen = (flags & SEC_ENCRYPT) ? 12 : 4;
else
hdrlen = (flags & SEC_ENCRYPT) ? 12 : 0;
s = mcs_init(maxlen + hdrlen);
s_push_layer(s, sec_hdr, hdrlen);
return s;
}
/* Transmit secure transport packet over specified channel */
void
sec_send_to_channel(STREAM s, uint32 flags, uint16 channel)
{
int datalen;
s_pop_layer(s, sec_hdr);
if (!g_licence_issued || (flags & SEC_ENCRYPT))
out_uint32_le(s, flags);
if (flags & SEC_ENCRYPT)
{
flags &= ~SEC_ENCRYPT;
datalen = s->end - s->p - 8;
#if WITH_DEBUG
DEBUG(("Sending encrypted packet:\n"));
hexdump(s->p + 8, datalen);
#endif
sec_sign(s->p, 8, sec_sign_key, rc4_key_len, s->p + 8, datalen);
sec_encrypt(s->p + 8, datalen);
}
mcs_send_to_channel(s, channel);
}
/* Transmit secure transport packet */
void
sec_send(STREAM s, uint32 flags)
{
sec_send_to_channel(s, flags, MCS_GLOBAL_CHANNEL);
}
/* Transfer the client random to the server */
static void
sec_establish_key(void)
{
uint32 length = server_public_key_len + SEC_PADDING_SIZE;
uint32 flags = SEC_CLIENT_RANDOM;
STREAM s;
s = sec_init(flags, length+4);
out_uint32_le(s, length);
out_uint8p(s, sec_crypted_random, server_public_key_len);
out_uint8s(s, SEC_PADDING_SIZE);
s_mark_end(s);
sec_send(s, flags);
}
/* Output connect initial data blob */
static void
sec_out_mcs_data(STREAM s)
{
int hostlen = 2 * strlen(g_hostname);
int length = 158 + 76 + 12 + 4;
unsigned int i;
if (g_num_channels > 0)
length += g_num_channels * 12 + 8;
if (hostlen > 30)
hostlen = 30;
/* Generic Conference Control (T.124) ConferenceCreateRequest */
out_uint16_be(s, 5);
out_uint16_be(s, 0x14);
out_uint8(s, 0x7c);
out_uint16_be(s, 1);
out_uint16_be(s, (length | 0x8000)); /* remaining length */
out_uint16_be(s, 8); /* length? */
out_uint16_be(s, 16);
out_uint8(s, 0);
out_uint16_le(s, 0xc001);
out_uint8(s, 0);
out_uint32_le(s, 0x61637544); /* OEM ID: "Duca", as in Ducati. */
out_uint16_be(s, ((length - 14) | 0x8000)); /* remaining length */
/* Client information */
out_uint16_le(s, SEC_TAG_CLI_INFO);
out_uint16_le(s, 212); /* length */
out_uint16_le(s, g_use_rdp5 ? 4 : 1); /* RDP version. 1 == RDP4, 4 == RDP5. */
out_uint16_le(s, 8);
out_uint16_le(s, g_width);
out_uint16_le(s, g_height);
out_uint16_le(s, 0xca01);
out_uint16_le(s, 0xaa03);
out_uint32_le(s, g_keylayout);
out_uint32_le(s, 2600); /* Client build. We are now 2600 compatible :-) */
/* Unicode name of client, padded to 32 bytes */
rdp_out_unistr(s, g_hostname, hostlen);
out_uint8s(s, 30 - hostlen);
/* See
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wceddk40/html/cxtsksupportingremotedesktopprotocol.asp */
out_uint32_le(s, g_keyboard_type);
out_uint32_le(s, g_keyboard_subtype);
out_uint32_le(s, g_keyboard_functionkeys);
out_uint8s(s, 64); /* reserved? 4 + 12 doublewords */
out_uint16_le(s, 0xca01); /* colour depth? */
out_uint16_le(s, 1);
out_uint32(s, 0);
out_uint8(s, g_server_depth);
out_uint16_le(s, 0x0700);
out_uint8(s, 0);
out_uint32_le(s, 1);
out_uint8s(s, 64); /* End of client info */
out_uint16_le(s, SEC_TAG_CLI_4);
out_uint16_le(s, 12);
out_uint32_le(s, g_console_session ? 0xb : 9);
out_uint32(s, 0);
/* Client encryption settings */
out_uint16_le(s, SEC_TAG_CLI_CRYPT);
out_uint16_le(s, 12); /* length */
out_uint32_le(s, g_encryption ? 0x3 : 0); /* encryption supported, 128-bit supported */
out_uint32(s, 0); /* Unknown */
DEBUG_RDP5(("g_num_channels is %d\n", g_num_channels));
if (g_num_channels > 0)
{
out_uint16_le(s, SEC_TAG_CLI_CHANNELS);
out_uint16_le(s, g_num_channels * 12 + 8); /* length */
out_uint32_le(s, g_num_channels); /* number of virtual channels */
for (i = 0; i < g_num_channels; i++)
{
DEBUG_RDP5(("Requesting channel %s\n", g_channels[i].name));
out_uint8a(s, g_channels[i].name, 8);
out_uint32_be(s, g_channels[i].flags);
}
}
s_mark_end(s);
}
/* Parse a public key structure */
static BOOL
sec_parse_public_key(STREAM s, uint8 ** modulus, uint8 ** exponent)
{
uint32 magic, modulus_len;
in_uint32_le(s, magic);
if (magic != SEC_RSA_MAGIC)
{
error("RSA magic 0x%x\n", magic);
return False;
}
in_uint32_le(s, modulus_len);
modulus_len -= SEC_PADDING_SIZE;
if ((modulus_len < 64) || (modulus_len > SEC_MAX_MODULUS_SIZE))
{
error("Bad server public key size (%u bits)\n", modulus_len*8);
return False;
}
in_uint8s(s, 8); /* modulus_bits, unknown */
in_uint8p(s, *exponent, SEC_EXPONENT_SIZE);
in_uint8p(s, *modulus, modulus_len);
in_uint8s(s, SEC_PADDING_SIZE);
server_public_key_len = modulus_len;
return s_check(s);
}
static BOOL
sec_parse_x509_key(X509 * cert)
{
EVP_PKEY *epk = NULL;
/* By some reason, Microsoft sets the OID of the Public RSA key to
the oid for "MD5 with RSA Encryption" instead of "RSA Encryption"
Kudos to Richard Levitte for the following (. intiutive .)
lines of code that resets the OID and let's us extract the key. */
if (OBJ_obj2nid(cert->cert_info->key->algor->algorithm) == NID_md5WithRSAEncryption)
{
DEBUG_RDP5(("Re-setting algorithm type to RSA in server certificate\n"));
ASN1_OBJECT_free(cert->cert_info->key->algor->algorithm);
cert->cert_info->key->algor->algorithm = OBJ_nid2obj(NID_rsaEncryption);
}
epk = X509_get_pubkey(cert);
if (NULL == epk)
{
error("Failed to extract public key from certificate\n");
return False;
}
server_public_key = RSAPublicKey_dup((RSA *) epk->pkey.ptr);
EVP_PKEY_free(epk);
server_public_key_len = RSA_size(server_public_key);
if ((server_public_key_len < 64) || (server_public_key_len > SEC_MAX_MODULUS_SIZE))
{
error("Bad server public key size (%u bits)\n", server_public_key_len*8);
return False;
}
return True;
}
/* Parse a crypto information structure */
static BOOL
sec_parse_crypt_info(STREAM s, uint32 * rc4_key_size,
uint8 ** server_random, uint8 ** modulus, uint8 ** exponent)
{
uint32 crypt_level, random_len, rsa_info_len;
uint32 cacert_len, cert_len, flags;
X509 *cacert, *server_cert;
uint16 tag, length;
uint8 *next_tag, *end;
in_uint32_le(s, *rc4_key_size); /* 1 = 40-bit, 2 = 128-bit */
in_uint32_le(s, crypt_level); /* 1 = low, 2 = medium, 3 = high */
if (crypt_level == 0) /* no encryption */
return False;
in_uint32_le(s, random_len);
in_uint32_le(s, rsa_info_len);
if (random_len != SEC_RANDOM_SIZE)
{
error("random len %d, expected %d\n", random_len, SEC_RANDOM_SIZE);
return False;
}
in_uint8p(s, *server_random, random_len);
/* RSA info */
end = s->p + rsa_info_len;
if (end > s->end)
return False;
in_uint32_le(s, flags); /* 1 = RDP4-style, 0x80000002 = X.509 */
if (flags & 1)
{
DEBUG_RDP5(("We're going for the RDP4-style encryption\n"));
in_uint8s(s, 8); /* unknown */
while (s->p < end)
{
in_uint16_le(s, tag);
in_uint16_le(s, length);
next_tag = s->p + length;
switch (tag)
{
case SEC_TAG_PUBKEY:
if (!sec_parse_public_key(s, modulus, exponent))
return False;
DEBUG_RDP5(("Got Public key, RDP4-style\n"));
break;
case SEC_TAG_KEYSIG:
/* Is this a Microsoft key that we just got? */
/* Care factor: zero! */
/* Actually, it would probably be a good idea to check if the public key is signed with this key, and then store this
key as a known key of the hostname. This would prevent some MITM-attacks. */
break;
default:
unimpl("crypt tag 0x%x\n", tag);
}
s->p = next_tag;
}
}
else
{
uint32 certcount;
DEBUG_RDP5(("We're going for the RDP5-style encryption\n"));
in_uint32_le(s, certcount); /* Number of certificates */
if (certcount < 2)
{
error("Server didn't send enough X509 certificates\n");
return False;
}
for (; certcount > 2; certcount--)
{ /* ignore all the certificates between the root and the signing CA */
uint32 ignorelen;
X509 *ignorecert;
DEBUG_RDP5(("Ignored certs left: %d\n", certcount));
in_uint32_le(s, ignorelen);
DEBUG_RDP5(("Ignored Certificate length is %d\n", ignorelen));
ignorecert = d2i_X509(NULL, &(s->p), ignorelen);
if (ignorecert == NULL)
{ /* XXX: error out? */
DEBUG_RDP5(("got a bad cert: this will probably screw up the rest of the communication\n"));
}
#ifdef WITH_DEBUG_RDP5
DEBUG_RDP5(("cert #%d (ignored):\n", certcount));
X509_print_fp(stdout, ignorecert);
#endif
}
/* Do da funky X.509 stuffy
"How did I find out about this? I looked up and saw a
bright light and when I came to I had a scar on my forehead
and knew about X.500"
- Peter Gutman in a early version of
http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt
*/
in_uint32_le(s, cacert_len);
DEBUG_RDP5(("CA Certificate length is %d\n", cacert_len));
cacert = d2i_X509(NULL, &(s->p), cacert_len);
/* Note: We don't need to move s->p here - d2i_X509 is
"kind" enough to do it for us */
if (NULL == cacert)
{
error("Couldn't load CA Certificate from server\n");
return False;
}
/* Currently, we don't use the CA Certificate.
FIXME:
*) Verify the server certificate (server_cert) with the
CA certificate.
*) Store the CA Certificate with the hostname of the
server we are connecting to as key, and compare it
when we connect the next time, in order to prevent
MITM-attacks.
*/
X509_free(cacert);
in_uint32_le(s, cert_len);
DEBUG_RDP5(("Certificate length is %d\n", cert_len));
server_cert = d2i_X509(NULL, &(s->p), cert_len);
if (NULL == server_cert)
{
error("Couldn't load Certificate from server\n");
return False;
}
in_uint8s(s, 16); /* Padding */
/* Note: Verifying the server certificate must be done here,
before sec_parse_public_key since we'll have to apply
serious violence to the key after this */
if (!sec_parse_x509_key(server_cert))
{
DEBUG_RDP5(("Didn't parse X509 correctly\n"));
X509_free(server_cert);
return False;
}
X509_free(server_cert);
return True; /* There's some garbage here we don't care about */
}
return s_check_end(s);
}
/* Process crypto information blob */
static void
sec_process_crypt_info(STREAM s)
{
uint8 *server_random, *modulus, *exponent;
uint8 client_random[SEC_RANDOM_SIZE];
uint32 rc4_key_size;
if (!sec_parse_crypt_info(s, &rc4_key_size, &server_random, &modulus, &exponent))
{
DEBUG(("Failed to parse crypt info\n"));
return;
}
DEBUG(("Generating client random\n"));
generate_random(client_random);
if (NULL != server_public_key)
{ /* Which means we should use
RDP5-style encryption */
uint8 inr[SEC_MAX_MODULUS_SIZE];
uint32 padding_len = server_public_key_len - SEC_RANDOM_SIZE;
/* This is what the MS client do: */
memset(inr, 0, padding_len);
/* *ARIGL!* Plaintext attack, anyone?
I tried doing:
generate_random(inr);
..but that generates connection errors now and then (yes,
"now and then". Something like 0 to 3 attempts needed before a
successful connection. Nice. Not!
*/
memcpy(inr + padding_len, client_random, SEC_RANDOM_SIZE);
reverse(inr + padding_len, SEC_RANDOM_SIZE);
RSA_public_encrypt(server_public_key_len,
inr, sec_crypted_random, server_public_key, RSA_NO_PADDING);
reverse(sec_crypted_random, server_public_key_len);
RSA_free(server_public_key);
server_public_key = NULL;
}
else
{ /* RDP4-style encryption */
sec_rsa_encrypt(sec_crypted_random,
client_random, SEC_RANDOM_SIZE, server_public_key_len, modulus, exponent);
}
sec_generate_keys(client_random, server_random, rc4_key_size);
}
/* Process SRV_INFO, find RDP version supported by server */
static void
sec_process_srv_info(STREAM s)
{
in_uint16_le(s, g_server_rdp_version);
DEBUG_RDP5(("Server RDP version is %d\n", g_server_rdp_version));
if (1 == g_server_rdp_version)
{
g_use_rdp5 = 0;
g_server_depth = 8;
}
}
/* Process connect response data blob */
void
sec_process_mcs_data(STREAM s)
{
uint16 tag, length;
uint8 *next_tag;
uint8 len;
in_uint8s(s, 21); /* header (T.124 ConferenceCreateResponse) */
in_uint8(s, len);
if (len & 0x80)
in_uint8(s, len);
while (s->p < s->end)
{
in_uint16_le(s, tag);
in_uint16_le(s, length);
if (length <= 4)
return;
next_tag = s->p + length - 4;
switch (tag)
{
case SEC_TAG_SRV_INFO:
sec_process_srv_info(s);
break;
case SEC_TAG_SRV_CRYPT:
sec_process_crypt_info(s);
break;
case SEC_TAG_SRV_CHANNELS:
/* FIXME: We should parse this information and
use it to map RDP5 channels to MCS
channels */
break;
default:
unimpl("response tag 0x%x\n", tag);
}
s->p = next_tag;
}
}
/* Receive secure transport packet */
STREAM
sec_recv(uint8 * rdpver)
{
uint32 sec_flags;
uint16 channel;
STREAM s;
while ((s = mcs_recv(&channel, rdpver)) != NULL)
{
if (rdpver != NULL)
{
if (*rdpver != 3)
{
if (*rdpver & 0x80)
{
in_uint8s(s, 8); /* signature */
sec_decrypt(s->p, s->end - s->p);
}
return s;
}
}
if (g_encryption || !g_licence_issued)
{
in_uint32_le(s, sec_flags);
if (sec_flags & SEC_ENCRYPT)
{
in_uint8s(s, 8); /* signature */
sec_decrypt(s->p, s->end - s->p);
}
if (sec_flags & SEC_LICENCE_NEG)
{
licence_process(s);
continue;
}
if (sec_flags & 0x0400) /* SEC_REDIRECT_ENCRYPT */
{
uint8 swapbyte;
in_uint8s(s, 8); /* signature */
sec_decrypt(s->p, s->end - s->p);
/* Check for a redirect packet, starts with 00 04 */
if (s->p[0] == 0 && s->p[1] == 4)
{
/* for some reason the PDU and the length seem to be swapped.
This isn't good, but we're going to do a byte for byte
swap. So the first foure value appear as: 00 04 XX YY,
where XX YY is the little endian length. We're going to
use 04 00 as the PDU type, so after our swap this will look
like: XX YY 04 00 */
swapbyte = s->p[0];
s->p[0] = s->p[2];
s->p[2] = swapbyte;
swapbyte = s->p[1];
s->p[1] = s->p[3];
s->p[3] = swapbyte;
swapbyte = s->p[2];
s->p[2] = s->p[3];
s->p[3] = swapbyte;
}
#ifdef WITH_DEBUG
/* warning! this debug statement will show passwords in the clear! */
hexdump(s->p, s->end - s->p);
#endif
}
}
if (channel != MCS_GLOBAL_CHANNEL)
{
channel_process(s, channel);
*rdpver = 0xff;
return s;
}
return s;
}
return NULL;
}
/* Establish a secure connection */
BOOL
sec_connect(char *server, char *username)
{
struct stream mcs_data;
/* We exchange some RDP data during the MCS-Connect */
mcs_data.size = 512;
mcs_data.p = mcs_data.data = (uint8 *) xmalloc(mcs_data.size);
sec_out_mcs_data(&mcs_data);
if (!mcs_connect(server, &mcs_data, username))
return False;
/* sec_process_mcs_data(&mcs_data); */
if (g_encryption)
sec_establish_key();
xfree(mcs_data.data);
return True;
}
/* Establish a secure connection */
BOOL
sec_reconnect(char *server)
{
struct stream mcs_data;
/* We exchange some RDP data during the MCS-Connect */
mcs_data.size = 512;
mcs_data.p = mcs_data.data = (uint8 *) xmalloc(mcs_data.size);
sec_out_mcs_data(&mcs_data);
if (!mcs_reconnect(server, &mcs_data))
return False;
/* sec_process_mcs_data(&mcs_data); */
if (g_encryption)
sec_establish_key();
xfree(mcs_data.data);
return True;
}
/* Disconnect a connection */
void
sec_disconnect(void)
{
mcs_disconnect();
}
/* reset the state of the sec layer */
void
sec_reset_state(void)
{
g_server_rdp_version = 0;
sec_encrypt_use_count = 0;
sec_decrypt_use_count = 0;
mcs_reset_state();
}

278
uirdesktop/tcp.c
Unescape View File

@ -0,0 +1,278 @@
/* -*- c-basic-offset: 8 -*-
rdesktop: A Remote Desktop Protocol client.
Protocol services - TCP layer
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include <unistd.h> /* select read write close */
#include <sys/socket.h> /* socket connect setsockopt */
#include <sys/time.h> /* timeval */
#include <netdb.h> /* gethostbyname */
#include <netinet/in.h> /* sockaddr_in */
#include <netinet/tcp.h> /* TCP_NODELAY */
#include <arpa/inet.h> /* inet_addr */
#include <errno.h> /* errno */
#include "rdesktop.h"
#ifndef INADDR_NONE
#define INADDR_NONE ((unsigned long) -1)
#endif
static int sock;
static struct stream in;
static struct stream out;
int g_tcp_port_rdp = TCP_PORT_RDP;
/* Initialise TCP transport data packet */
STREAM
tcp_init(uint32 maxlen)
{
if (maxlen > out.size)
{
out.data = (uint8 *) xrealloc(out.data, maxlen);
out.size = maxlen;
}
out.p = out.data;
out.end = out.data + out.size;
return &out;
}
/* Send TCP transport data packet */
void
tcp_send(STREAM s)
{
int length = s->end - s->data;
int sent, total = 0;
while (total < length)
{
sent = send(sock, s->data + total, length - total, 0);
if (sent <= 0)
{
error("send: %s\n", strerror(errno));
return;
}
total += sent;
}
}
/* Receive a message on the TCP layer */
STREAM
tcp_recv(STREAM s, uint32 length)
{
unsigned int new_length, end_offset, p_offset;
int rcvd = 0;
if (s == NULL)
{
/* read into "new" stream */
if (length > in.size)
{
in.data = (uint8 *) xrealloc(in.data, length);
in.size = length;
}
in.end = in.p = in.data;
s = &in;
}
else
{
/* append to existing stream */
new_length = (s->end - s->data) + length;
if (new_length > s->size)
{
p_offset = s->p - s->data;
end_offset = s->end - s->data;
s->data = (uint8 *) xrealloc(s->data, new_length);
s->size = new_length;
s->p = s->data + p_offset;
s->end = s->data + end_offset;
}
}
while (length > 0)
{
if (!ui_select(sock))
/* User quit */
return NULL;
rcvd = recv(sock, s->end, length, 0);
if (rcvd < 0)
{
error("recv: %s\n", strerror(errno));
return NULL;
}
else if (rcvd == 0)
{
error("Connection closed\n");
return NULL;
}
s->end += rcvd;
length -= rcvd;
}
return s;
}
/* Establish a connection on the TCP layer */
BOOL
tcp_connect(char *server)
{
int true_value = 1;
#ifdef IPv6
int n;
struct addrinfo hints, *res, *ressave;
char tcp_port_rdp_s[10];
snprintf(tcp_port_rdp_s, 10, "%d", g_tcp_port_rdp);
memset(&hints, 0, sizeof(struct addrinfo));
hints.ai_family = AF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
if ((n = getaddrinfo(server, tcp_port_rdp_s, &hints, &res)))
{
error("getaddrinfo: %s\n", gai_strerror(n));
return False;
}
ressave = res;
sock = -1;
while (res)
{
sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
if (!(sock < 0))
{
if (connect(sock, res->ai_addr, res->ai_addrlen) == 0)
break;
close(sock);
sock = -1;
}
res = res->ai_next;
}
freeaddrinfo(ressave);
if (sock == -1)
{
error("%s: unable to connect\n", server);
return False;
}
#else /* no IPv6 support */
struct hostent *nslookup;
struct sockaddr_in servaddr;
if ((nslookup = gethostbyname(server)) != NULL)
{
memcpy(&servaddr.sin_addr, nslookup->h_addr, sizeof(servaddr.sin_addr));
}
else if ((servaddr.sin_addr.s_addr = inet_addr(server)) == INADDR_NONE)
{
error("%s: unable to resolve host\n", server);
return False;
}
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
{
error("socket: %s\n", strerror(errno));
return False;
}
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(g_tcp_port_rdp);
if (connect(sock, (struct sockaddr *) &servaddr, sizeof(struct sockaddr)) < 0)
{
error("connect: %s\n", strerror(errno));
close(sock);
return False;
}
#endif /* IPv6 */
setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (void *) &true_value, sizeof(true_value));
in.size = 4096;
in.data = (uint8 *) xmalloc(in.size);
out.size = 4096;
out.data = (uint8 *) xmalloc(out.size);
return True;
}
/* Disconnect on the TCP layer */
void
tcp_disconnect(void)
{
close(sock);
}
char *
tcp_get_address()
{
static char ipaddr[32];
struct sockaddr_in sockaddr;
socklen_t len = sizeof(sockaddr);
if (getsockname(sock, (struct sockaddr *) &sockaddr, &len) == 0)
{
unsigned char *ip = (unsigned char *) &sockaddr.sin_addr;
sprintf(ipaddr, "%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]);
}
else
strcpy(ipaddr, "127.0.0.1");
return ipaddr;
}
/* reset the state of the tcp layer */
/* Support for Session Directory */
void
tcp_reset_state(void)
{
sock = -1; /* reset socket */
/* Clear the incoming stream */
if (in.data != NULL)
xfree(in.data);
in.p = NULL;
in.end = NULL;
in.data = NULL;
in.size = 0;
in.iso_hdr = NULL;
in.mcs_hdr = NULL;
in.sec_hdr = NULL;
in.rdp_hdr = NULL;
in.channel_hdr = NULL;
/* Clear the outgoing stream */
if (out.data != NULL)
xfree(out.data);
out.p = NULL;
out.end = NULL;
out.data = NULL;
out.size = 0;
out.iso_hdr = NULL;
out.mcs_hdr = NULL;
out.sec_hdr = NULL;
out.rdp_hdr = NULL;
out.channel_hdr = NULL;
}

268
uirdesktop/types.h
Unescape View File

@ -0,0 +1,268 @@
/*
rdesktop: A Remote Desktop Protocol client.
Common data types
Copyright (C) Matthew Chapman 1999-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
typedef int BOOL;
#ifndef True
#define True (1)
#define False (0)
#endif
typedef unsigned char uint8;
typedef signed char sint8;
typedef unsigned short uint16;
typedef signed short sint16;
typedef unsigned int uint32;
typedef signed int sint32;
typedef void *HBITMAP;
typedef void *HGLYPH;
typedef void *HCOLOURMAP;
typedef void *HCURSOR;
typedef struct _POINT
{
sint16 x, y;
}
POINT;
typedef struct _COLOURENTRY
{
uint8 red;
uint8 green;
uint8 blue;
}
COLOURENTRY;
typedef struct _COLOURMAP
{
uint16 ncolours;
COLOURENTRY *colours;
}
COLOURMAP;
typedef struct _BOUNDS
{
sint16 left;
sint16 top;
sint16 right;
sint16 bottom;
}
BOUNDS;
typedef struct _PEN
{
uint8 style;
uint8 width;
uint32 colour;
}
PEN;
typedef struct _BRUSH
{
uint8 xorigin;
uint8 yorigin;
uint8 style;
uint8 pattern[8];
}
BRUSH;
typedef struct _FONTGLYPH
{
sint16 offset;
sint16 baseline;
uint16 width;
uint16 height;
HBITMAP pixmap;
}
FONTGLYPH;
typedef struct _DATABLOB
{
void *data;
int size;
}
DATABLOB;
typedef struct _key_translation
{
/* For normal scancode translations */
uint8 scancode;
uint16 modifiers;
/* For sequences. If keysym is nonzero, the fields above are not used. */
uint32 seq_keysym; /* Really KeySym */
struct _key_translation *next;
}
key_translation;
typedef struct _VCHANNEL
{
uint16 mcs_id;
char name[8];
uint32 flags;
struct stream in;
void (*process) (STREAM);
}
VCHANNEL;
/* PSTCACHE */
typedef uint8 HASH_KEY[8];
/* Header for an entry in the persistent bitmap cache file */
typedef struct _PSTCACHE_CELLHEADER
{
HASH_KEY key;
uint8 width, height;
uint16 length;
uint32 stamp;
}
CELLHEADER;
#define MAX_CBSIZE 256
/* RDPSND */
typedef struct
{
uint16 wFormatTag;
uint16 nChannels;
uint32 nSamplesPerSec;
uint32 nAvgBytesPerSec;
uint16 nBlockAlign;
uint16 wBitsPerSample;
uint16 cbSize;
uint8 cb[MAX_CBSIZE];
} WAVEFORMATEX;
typedef struct _RDPCOMP
{
uint32 roff;
uint8 hist[RDP_MPPC_DICT_SIZE];
struct stream ns;
}
RDPCOMP;
/* RDPDR */
typedef uint32 NTSTATUS;
typedef uint32 NTHANDLE;
typedef struct _DEVICE_FNS
{
NTSTATUS(*create) (uint32 device, uint32 desired_access, uint32 share_mode,
uint32 create_disposition, uint32 flags_and_attributes, char *filename,
NTHANDLE * handle);
NTSTATUS(*close) (NTHANDLE handle);
NTSTATUS(*read) (NTHANDLE handle, uint8 * data, uint32 length, uint32 offset,
uint32 * result);
NTSTATUS(*write) (NTHANDLE handle, uint8 * data, uint32 length, uint32 offset,
uint32 * result);
NTSTATUS(*device_control) (NTHANDLE handle, uint32 request, STREAM in, STREAM out);
}
DEVICE_FNS;
typedef struct rdpdr_device_info
{
uint32 device_type;
NTHANDLE handle;
char name[8];
char *local_path;
void *pdevice_data;
}
RDPDR_DEVICE;
typedef struct rdpdr_serial_device_info
{
int dtr;
int rts;
uint32 control, xonoff, onlimit, offlimit;
uint32 baud_rate,
queue_in_size,
queue_out_size,
wait_mask,
read_interval_timeout,
read_total_timeout_multiplier,
read_total_timeout_constant,
write_total_timeout_multiplier, write_total_timeout_constant, posix_wait_mask;
uint8 stop_bits, parity, word_length;
uint8 chars[6];
struct termios *ptermios, *pold_termios;
int event_txempty, event_cts, event_dsr, event_rlsd, event_pending;
}
SERIAL_DEVICE;
typedef struct rdpdr_parallel_device_info
{
char *driver, *printer;
uint32 queue_in_size,
queue_out_size,
wait_mask,
read_interval_timeout,
read_total_timeout_multiplier,
read_total_timeout_constant,
write_total_timeout_multiplier,
write_total_timeout_constant, posix_wait_mask, bloblen;
uint8 *blob;
}
PARALLEL_DEVICE;
typedef struct rdpdr_printer_info
{
FILE *printer_fp;
char *driver, *printer;
uint32 bloblen;
uint8 *blob;
BOOL default_printer;
}
PRINTER;
typedef struct notify_data
{
time_t modify_time;
time_t status_time;
time_t total_time;
unsigned int num_entries;
}
NOTIFY;
#ifndef PATH_MAX
#define PATH_MAX 256
#endif
typedef struct fileinfo
{
uint32 device_id, flags_and_attributes, accessmask;
char path[PATH_MAX];
DIR *pdir;
struct dirent *pdirent;
char pattern[PATH_MAX];
BOOL delete_on_close;
NOTIFY notify;
uint32 info_class;
}
FILEINFO;
typedef BOOL(*str_handle_lines_t) (const char *line, void *data);
Write Preview
Loading…
Cancel
Save