From 3bb69ac4b83076e15d942f0d73fecfb49776e82c Mon Sep 17 00:00:00 2001 From: Karl Mikaelsson Date: Wed, 11 Oct 2017 10:55:25 +0200 Subject: [PATCH] Document sec_out_mcs_connect_initial_pdu Cross-referenced the PDU with the spec. I found and fixed a few inconsistencies while also adding comments identifying each data field. --- constants.h | 35 ++++++++++++++++++++++++++++ secure.c | 67 ++++++++++++++++++++++++++--------------------------- 2 files changed, 68 insertions(+), 34 deletions(-) diff --git a/constants.h b/constants.h index 6b1128d..85d2e0d 100644 --- a/constants.h +++ b/constants.h @@ -682,6 +682,41 @@ enum RDP_PDU_REDIRECT_FLAGS LB_TARGET_CERTIFICATE = 0x10000 }; +/* color depths, from [MS-RDPBCGR] 2.2.1.3.2 */ +#define RNS_UD_COLOR_4BPP 0xCA00 +#define RNS_UD_COLOR_8BPP 0xCA01 +#define RNS_UD_COLOR_16BPP_555 0xCA02 +#define RNS_UD_COLOR_16BPP_565 0xCA03 +#define RNS_UD_COLOR_24BPP 0xCA04 + +#define RNS_UD_SAS_DEL 0xAA03 + +/* version, [MS-RDPBCGR] 2.2.1.3.2 */ +#define RDP_40 0x00080001 /* RDP 4.0 clients */ +#define RDP_50 0x00080004 /* RDP 5.0, 5.1, 5.2, 6.0, 6.1, 7.0, 7.1, 8.0, and 8.1 clients */ +#define RDP_10_0 0x00080005 /* RDP 10.0 clients */ +#define RDP_10_1 0x00080006 /* RDP 10.1 clients */ +#define RDP_10_2 0x00080007 /* RDP 10.2 clients */ +#define RDP_10_3 0x00080008 /* RDP 10.3 clients */ + +/* supportedColorDepths, [MS-RDPBCGR] 2.2.1.3.2 */ +#define RNS_UD_24BPP_SUPPORT 0x0001 +#define RNS_UD_16BPP_SUPPORT 0x0002 +#define RNS_UD_15BPP_SUPPORT 0x0004 +#define RNS_UD_32BPP_SUPPORT 0x0008 + +/* earlyCapabilityFlags, [MS-RDPBCGR] 2.2.1.3.2 */ +#define RNS_UD_CS_SUPPORT_ERRINFO_PDU 0x0001 +#define RNS_UD_CS_WANT_32BPP_SESSION 0x0002 +#define RNS_UD_CS_SUPPORT_STATUSINFO_PDU 0x0004 +#define RNS_UD_CS_STRONG_ASYMMETRIC_KEYS 0x0008 +#define RNS_UD_CS_UNUSED 0x0010 +#define RNS_UD_CS_VALID_CONNECTION_TYPE 0x0020 +#define RNS_UD_CS_SUPPORT_MONITOR_LAYOUT_PDU 0x0040 +#define RNS_UD_CS_SUPPORT_NETCHAR_AUTODETECT 0x0080 +#define RNS_UD_CS_SUPPORT_DYNVC_GFX_PROTOCOL 0x0100 +#define RNS_UD_CS_SUPPORT_DYNAMIC_TIME_ZONE 0x0200 +#define RNS_UD_CS_SUPPORT_HEARTBEAT_PDU 0x0400 /* [MS-RDPBCGR] 2.2.7.1.1 */ #define OSMAJORTYPE_WINDOWS 0x0001 diff --git a/secure.c b/secure.c index 9ad1386..bacb235 100644 --- a/secure.c +++ b/secure.c @@ -391,16 +391,18 @@ sec_establish_key(void) static void sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol) { - int hostlen = 2 * strlen(g_hostname); int length = 162 + 76 + 12 + 4; unsigned int i; + uint32 rdpversion = RDP_40; + uint16 capflags = RNS_UD_CS_SUPPORT_ERRINFO_PDU; + uint16 colorsupport = RNS_UD_24BPP_SUPPORT | RNS_UD_16BPP_SUPPORT; + + if (g_rdp_version >= RDP_V5) + rdpversion = RDP_50; if (g_num_channels > 0) length += g_num_channels * 12 + 8; - if (hostlen > 30) - hostlen = 30; - /* Generic Conference Control (T.124) ConferenceCreateRequest */ out_uint16_be(s, 5); out_uint16_be(s, 0x14); @@ -419,36 +421,33 @@ sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol) out_uint16_be(s, ((length - 14) | 0x8000)); /* remaining length */ /* Client information */ - out_uint16_le(s, SEC_TAG_CLI_INFO); - out_uint16_le(s, 216); /* length */ - out_uint16_le(s, (g_rdp_version >= RDP_V5) ? 4 : 1); /* RDP version. 1 == RDP4, 4 >= RDP5 to RDP8 */ - out_uint16_le(s, 8); - out_uint16_le(s, g_width); - out_uint16_le(s, g_height); - out_uint16_le(s, 0xca01); - out_uint16_le(s, 0xaa03); - out_uint32_le(s, g_keylayout); - out_uint32_le(s, 2600); /* Client build. We are now 2600 compatible :-) */ + out_uint16_le(s, SEC_TAG_CLI_INFO); /* type */ + out_uint16_le(s, 216); /* length */ + out_uint32_le(s, rdpversion); /* version */ + out_uint16_le(s, g_width); /* desktopWidth */ + out_uint16_le(s, g_height); /* desktopHeight */ + out_uint16_le(s, RNS_UD_COLOR_8BPP); /* colorDepth */ + out_uint16_le(s, RNS_UD_SAS_DEL); /* SASSequence */ + out_uint32_le(s, g_keylayout); /* keyboardLayout */ + out_uint32_le(s, 2600); /* Client build. We are now 2600 compatible :-) */ /* Unicode name of client, padded to 32 bytes */ out_utf16s_padded(s, g_hostname, 32, 0x00); - /* See - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wceddk40/html/cxtsksupportingremotedesktopprotocol.asp */ - out_uint32_le(s, g_keyboard_type); - out_uint32_le(s, g_keyboard_subtype); - out_uint32_le(s, g_keyboard_functionkeys); - out_uint8s(s, 64); /* reserved? 4 + 12 doublewords */ - out_uint16_le(s, 0xca01); /* colour depth? */ - out_uint16_le(s, 1); - - out_uint32(s, 0); - out_uint8(s, g_server_depth); - out_uint16_le(s, 0x0700); - out_uint8(s, 0); - out_uint32_le(s, 1); - out_uint8s(s, 64); - out_uint32_le(s, selected_protocol); /* End of client info */ + out_uint32_le(s, g_keyboard_type); /* keyboardType */ + out_uint32_le(s, g_keyboard_subtype); /* keyboardSubtype */ + out_uint32_le(s, g_keyboard_functionkeys); /* keyboardFunctionKey */ + out_uint8s(s, 64); /* imeFileName */ + out_uint16_le(s, RNS_UD_COLOR_8BPP); /* postBeta2ColorDepth (overrides colorDepth) */ + out_uint16_le(s, 1); /* clientProductId (should be 1) */ + out_uint32_le(s, 0); /* serialNumber (should be 0) */ + out_uint16_le(s, g_server_depth); /* highColorDepth (overrides postBeta2ColorDepth) */ + out_uint16_le(s, colorsupport); /* supportedColorDepths */ + out_uint16_le(s, capflags); /* earlyCapabilityFlags */ + out_uint8s(s, 64); /* clientDigProductId */ + out_uint8(s, 0); /* connectionType */ + out_uint8(s, 0); /* pad */ + out_uint32_le(s, selected_protocol); /* serverSelectedProtocol */ /* Write a Client Cluster Data (TS_UD_CS_CLUSTER) */ uint32 cluster_flags = 0; @@ -465,10 +464,10 @@ sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol) out_uint32(s, g_redirect_session_id); /* Client encryption settings */ - out_uint16_le(s, SEC_TAG_CLI_CRYPT); - out_uint16_le(s, 12); /* length */ - out_uint32_le(s, g_encryption ? 0x3 : 0); /* encryption supported, 128-bit supported */ - out_uint32(s, 0); /* Unknown */ + out_uint16_le(s, SEC_TAG_CLI_CRYPT); /* type */ + out_uint16_le(s, 12); /* length */ + out_uint32_le(s, g_encryption ? 0x3 : 0); /* encryptionMethods */ + out_uint32(s, 0); /* extEncryptionMethods */ logger(Protocol, Debug, "sec_out_mcs_data(), g_num_channels is %d", g_num_channels); if (g_num_channels > 0)