libfreerdp-core/rdp.c

   1 /**
   2  * FreeRDP: A Remote Desktop Protocol Client
   3  * RDP Core
   4  *
   5  * Copyright 2011 Marc-Andre Moreau <marcandre.moreau@gmail.com>
   6  *
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *     http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  */
  19
  20 #include "rdp.h"
  21
  22 #include "info.h"
  23 #include "per.h"
  24 #include "redirection.h"
  25
  26 static const char* const DATA_PDU_TYPE_STRINGS[] =
  27 {
  28                 "", "", /* 0x00 - 0x01 */
  29                 "Update", /* 0x02 */
  30                 "", "", "", "", "", "", "", "", /* 0x03 - 0x0A */
  31                 "", "", "", "", "", "", "", "", "", /* 0x0B - 0x13 */
  32                 "Control", /* 0x14 */
  33                 "", "", "", "", "", "", /* 0x15 - 0x1A */
  34                 "Pointer", /* 0x1B */
  35                 "Input", /* 0x1C */
  36                 "", "", /* 0x1D - 0x1E */
  37                 "Synchronize", /* 0x1F */
  38                 "", /* 0x20 */
  39                 "Refresh Rect", /* 0x21 */
  40                 "Play Sound", /* 0x22 */
  41                 "Suppress Output", /* 0x23 */
  42                 "Shutdown Request", /* 0x24 */
  43                 "Shutdown Denied", /* 0x25 */
  44                 "Save Session Info", /* 0x26 */
  45                 "Font List", /* 0x27 */
  46                 "Font Map", /* 0x28 */
  47                 "Set Keyboard Indicators", /* 0x29 */
  48                 "", /* 0x2A */
  49                 "Bitmap Cache Persistent List", /* 0x2B */
  50                 "Bitmap Cache Error", /* 0x2C */
  51                 "Set Keyboard IME Status", /* 0x2D */
  52                 "Offscreen Cache Error", /* 0x2E */
  53                 "Set Error Info", /* 0x2F */
  54                 "Draw Nine Grid Error", /* 0x30 */
  55                 "Draw GDI+ Error", /* 0x31 */
  56                 "ARC Status", /* 0x32 */
  57                 "", "", "", /* 0x33 - 0x35 */
  58                 "Status Info", /* 0x36 */
  59                 "Monitor Layout" /* 0x37 */
  60                 "", "", "", /* 0x38 - 0x40 */
  61                 "", "", "", "", "", "" /* 0x41 - 0x46 */
  62 };
  63
  64 /**
  65  * Read RDP Security Header.\n
  66  * @msdn{cc240579}
  67  * @param s stream
  68  * @param flags security flags
  69  */
  70
  71 void rdp_read_security_header(STREAM* s, uint16* flags)
  72 {
  73         /* Basic Security Header */
  74         stream_read_uint16(s, *flags); /* flags */
  75         stream_seek(s, 2); /* flagsHi (unused) */
  76 }
  77
  78 /**
  79  * Write RDP Security Header.\n
  80  * @msdn{cc240579}
  81  * @param s stream
  82  * @param flags security flags
  83  */
  84
  85 void rdp_write_security_header(STREAM* s, uint16 flags)
  86 {
  87         /* Basic Security Header */
  88         stream_write_uint16(s, flags); /* flags */
  89         stream_write_uint16(s, 0); /* flagsHi (unused) */
  90 }
  91
  92 boolean rdp_read_share_control_header(STREAM* s, uint16* length, uint16* type, uint16* channel_id)
  93 {
  94         /* Share Control Header */
  95         stream_read_uint16(s, *length); /* totalLength */
  96
  97         if (*length - 2 > stream_get_left(s))
  98                 return false;
  99
 100         stream_read_uint16(s, *type); /* pduType */
 101         *type &= 0x0F; /* type is in the 4 least significant bits */
 102
 103         if (*length > 4)
 104                 stream_read_uint16(s, *channel_id); /* pduSource */
 105         else /* Windows XP can send such short DEACTIVATE_ALL PDUs. */
 106                 *channel_id = 0;
 107
 108         return true;
 109 }
 110
 111 void rdp_write_share_control_header(STREAM* s, uint16 length, uint16 type, uint16 channel_id)
 112 {
 113         length -= RDP_PACKET_HEADER_MAX_LENGTH;
 114
 115         /* Share Control Header */
 116         stream_write_uint16(s, length); /* totalLength */
 117         stream_write_uint16(s, type | 0x10); /* pduType */
 118         stream_write_uint16(s, channel_id); /* pduSource */
 119 }
 120
 121 boolean rdp_read_share_data_header(STREAM* s, uint16* length, uint8* type, uint32* share_id,
 122                                         uint8 *compressed_type, uint16 *compressed_len)
 123 {
 124         if (stream_get_left(s) < 12)
 125                 return false;
 126
 127         /* Share Data Header */
 128         stream_read_uint32(s, *share_id); /* shareId (4 bytes) */
 129         stream_seek_uint8(s); /* pad1 (1 byte) */
 130         stream_seek_uint8(s); /* streamId (1 byte) */
 131         stream_read_uint16(s, *length); /* uncompressedLength (2 bytes) */
 132         stream_read_uint8(s, *type); /* pduType2, Data PDU Type (1 byte) */
 133
 134         if (*type & 0x80)
 135         {
 136                 stream_read_uint8(s, *compressed_type); /* compressedType (1 byte) */
 137                 stream_read_uint16(s, *compressed_len); /* compressedLength (2 bytes) */
 138         }
 139         else
 140         {
 141                 stream_seek(s, 3);
 142                 *compressed_type = 0;
 143                 *compressed_len = 0;
 144         }
 145
 146         return true;
 147 }
 148
 149 void rdp_write_share_data_header(STREAM* s, uint16 length, uint8 type, uint32 share_id)
 150 {
 151         length -= RDP_PACKET_HEADER_MAX_LENGTH;
 152         length -= RDP_SHARE_CONTROL_HEADER_LENGTH;
 153         length -= RDP_SHARE_DATA_HEADER_LENGTH;
 154
 155         /* Share Data Header */
 156         stream_write_uint32(s, share_id); /* shareId (4 bytes) */
 157         stream_write_uint8(s, 0); /* pad1 (1 byte) */
 158         stream_write_uint8(s, STREAM_LOW); /* streamId (1 byte) */
 159         stream_write_uint16(s, length); /* uncompressedLength (2 bytes) */
 160         stream_write_uint8(s, type); /* pduType2, Data PDU Type (1 byte) */
 161         stream_write_uint8(s, 0); /* compressedType (1 byte) */
 162         stream_write_uint16(s, 0); /* compressedLength (2 bytes) */
 163 }
 164
 165 static int rdp_security_stream_init(rdpRdp* rdp, STREAM* s)
 166 {
 167         if (rdp->do_crypt)
 168         {
 169                 stream_seek(s, 12);
 170                 if (rdp->settings->encryption_method == ENCRYPTION_METHOD_FIPS)
 171                         stream_seek(s, 4);
 172                 rdp->sec_flags |= SEC_ENCRYPT;
 173                 if (rdp->do_secure_checksum)
 174                         rdp->sec_flags |= SEC_SECURE_CHECKSUM;
 175         }
 176         else if (rdp->sec_flags != 0)
 177         {
 178                 stream_seek(s, 4);
 179         }
 180         return 0;
 181 }
 182
 183 /**
 184  * Initialize an RDP packet stream.\n
 185  * @param rdp rdp module
 186  * @return
 187  */
 188
 189 STREAM* rdp_send_stream_init(rdpRdp* rdp)
 190 {
 191         STREAM* s;
 192
 193         s = transport_send_stream_init(rdp->transport, 2048);
 194         stream_seek(s, RDP_PACKET_HEADER_MAX_LENGTH);
 195         rdp_security_stream_init(rdp, s);
 196
 197         return s;
 198 }
 199
 200 STREAM* rdp_pdu_init(rdpRdp* rdp)
 201 {
 202         STREAM* s;
 203         s = transport_send_stream_init(rdp->transport, 2048);
 204         stream_seek(s, RDP_PACKET_HEADER_MAX_LENGTH);
 205         rdp_security_stream_init(rdp, s);
 206         stream_seek(s, RDP_SHARE_CONTROL_HEADER_LENGTH);
 207         return s;
 208 }
 209
 210 STREAM* rdp_data_pdu_init(rdpRdp* rdp)
 211 {
 212         STREAM* s;
 213         s = transport_send_stream_init(rdp->transport, 2048);
 214         stream_seek(s, RDP_PACKET_HEADER_MAX_LENGTH);
 215         rdp_security_stream_init(rdp, s);
 216         stream_seek(s, RDP_SHARE_CONTROL_HEADER_LENGTH);
 217         stream_seek(s, RDP_SHARE_DATA_HEADER_LENGTH);
 218         return s;
 219 }
 220
 221 /**
 222  * Read an RDP packet header.\n
 223  * @param rdp rdp module
 224  * @param s stream
 225  * @param length RDP packet length
 226  * @param channel_id channel id
 227  */
 228
 229 boolean rdp_read_header(rdpRdp* rdp, STREAM* s, uint16* length, uint16* channel_id)
 230 {
 231         uint16 initiator;
 232         enum DomainMCSPDU MCSPDU;
 233
 234         MCSPDU = (rdp->settings->server_mode) ? DomainMCSPDU_SendDataRequest : DomainMCSPDU_SendDataIndication;
 235         mcs_read_domain_mcspdu_header(s, &MCSPDU, length);
 236
 237         if (*length - 8 > stream_get_left(s))
 238                 return false;
 239
 240         if (MCSPDU == DomainMCSPDU_DisconnectProviderUltimatum)
 241         {
 242                 uint8 reason;
 243
 244                 (void) per_read_enumerated(s, &reason, 0);
 245
 246                 rdp->disconnect = true;
 247
 248                 return true;
 249         }
 250
 251         per_read_integer16(s, &initiator, MCS_BASE_CHANNEL_ID); /* initiator (UserId) */
 252         per_read_integer16(s, channel_id, 0); /* channelId */
 253         stream_seek(s, 1); /* dataPriority + Segmentation (0x70) */
 254         per_read_length(s, length); /* userData (OCTET_STRING) */
 255
 256         if (*length > stream_get_left(s))
 257                 return false;
 258
 259         return true;
 260 }
 261
 262 /**
 263  * Write an RDP packet header.\n
 264  * @param rdp rdp module
 265  * @param s stream
 266  * @param length RDP packet length
 267  * @param channel_id channel id
 268  */
 269
 270 void rdp_write_header(rdpRdp* rdp, STREAM* s, uint16 length, uint16 channel_id)
 271 {
 272         int body_length;
 273         enum DomainMCSPDU MCSPDU;
 274
 275         MCSPDU = (rdp->settings->server_mode) ? DomainMCSPDU_SendDataIndication : DomainMCSPDU_SendDataRequest;
 276
 277         if ((rdp->sec_flags & SEC_ENCRYPT) && (rdp->settings->encryption_method == ENCRYPTION_METHOD_FIPS))
 278         {
 279                 int pad;
 280
 281                 body_length = length - RDP_PACKET_HEADER_MAX_LENGTH - 16;
 282                 pad = 8 - (body_length % 8);
 283                 if (pad != 8)
 284                         length += pad;
 285         }
 286
 287         mcs_write_domain_mcspdu_header(s, MCSPDU, length, 0);
 288         per_write_integer16(s, rdp->mcs->user_id, MCS_BASE_CHANNEL_ID); /* initiator */
 289         per_write_integer16(s, channel_id, 0); /* channelId */
 290         stream_write_uint8(s, 0x70); /* dataPriority + segmentation */
 291         /*
 292          * We always encode length in two bytes, eventhough we could use
 293          * only one byte if length <= 0x7F. It is just easier that way,
 294          * because we can leave room for fixed-length header, store all
 295          * the data first and then store the header.
 296          */
 297         length = (length - RDP_PACKET_HEADER_MAX_LENGTH) | 0x8000;
 298         stream_write_uint16_be(s, length); /* userData (OCTET_STRING) */
 299 }
 300
 301 static uint32 rdp_security_stream_out(rdpRdp* rdp, STREAM* s, int length)
 302 {
 303         uint8* data;
 304         uint32 sec_flags;
 305         uint32 pad = 0;
 306
 307         sec_flags = rdp->sec_flags;
 308
 309         if (sec_flags != 0)
 310         {
 311                 rdp_write_security_header(s, sec_flags);
 312
 313                 if (sec_flags & SEC_ENCRYPT)
 314                 {
 315                         if (rdp->settings->encryption_method == ENCRYPTION_METHOD_FIPS)
 316                         {
 317                                 data = s->p + 12;
 318
 319                                 length = length - (data - s->data);
 320                                 stream_write_uint16(s, 0x10); /* length */
 321                                 stream_write_uint8(s, 0x1); /* TSFIPS_VERSION 1*/
 322
 323                                 /* handle padding */
 324                                 pad = 8 - (length % 8);
 325
 326                                 if (pad == 8)
 327                                         pad = 0;
 328                                 if (pad)
 329                                         memset(data+length, 0, pad);
 330
 331                                 stream_write_uint8(s, pad);
 332
 333                                 security_hmac_signature(data, length, s->p, rdp);
 334                                 stream_seek(s, 8);
 335                                 security_fips_encrypt(data, length + pad, rdp);
 336                         }
 337                         else
 338                         {
 339                                 data = s->p + 8;
 340                                 length = length - (data - s->data);
 341                                 if (sec_flags & SEC_SECURE_CHECKSUM)
 342                                         security_salted_mac_signature(rdp, data, length, true, s->p);
 343                                 else
 344                                         security_mac_signature(rdp, data, length, s->p);
 345                                 stream_seek(s, 8);
 346                                 security_encrypt(s->p, length, rdp);
 347                         }
 348                 }
 349
 350                 rdp->sec_flags = 0;
 351         }
 352
 353         return pad;
 354 }
 355
 356 static uint32 rdp_get_sec_bytes(rdpRdp* rdp)
 357 {
 358         uint32 sec_bytes;
 359
 360         if (rdp->sec_flags & SEC_ENCRYPT)
 361         {
 362                 sec_bytes = 12;
 363
 364                 if (rdp->settings->encryption_method == ENCRYPTION_METHOD_FIPS)
 365                         sec_bytes += 4;
 366         }
 367         else if (rdp->sec_flags != 0)
 368         {
 369                 sec_bytes = 4;
 370         }
 371         else
 372         {
 373                 sec_bytes = 0;
 374         }
 375
 376         return sec_bytes;
 377 }
 378
 379 /**
 380  * Send an RDP packet.\n
 381  * @param rdp RDP module
 382  * @param s stream
 383  * @param channel_id channel id
 384  */
 385
 386 boolean rdp_send(rdpRdp* rdp, STREAM* s, uint16 channel_id)
 387 {
 388         uint16 length;
 389         uint32 sec_bytes;
 390         uint8* sec_hold;
 391
 392         length = stream_get_length(s);
 393         stream_set_pos(s, 0);
 394
 395         rdp_write_header(rdp, s, length, channel_id);
 396
 397         sec_bytes = rdp_get_sec_bytes(rdp);
 398         sec_hold = s->p;
 399         stream_seek(s, sec_bytes);
 400
 401         s->p = sec_hold;
 402         length += rdp_security_stream_out(rdp, s, length);
 403
 404         stream_set_pos(s, length);
 405         if (transport_write(rdp->transport, s) < 0)
 406                 return false;
 407
 408         return true;
 409 }
 410
 411 boolean rdp_send_pdu(rdpRdp* rdp, STREAM* s, uint16 type, uint16 channel_id)
 412 {
 413         uint16 length;
 414         uint32 sec_bytes;
 415         uint8* sec_hold;
 416
 417         length = stream_get_length(s);
 418         stream_set_pos(s, 0);
 419
 420         rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID);
 421
 422         sec_bytes = rdp_get_sec_bytes(rdp);
 423         sec_hold = s->p;
 424         stream_seek(s, sec_bytes);
 425
 426         rdp_write_share_control_header(s, length - sec_bytes, type, channel_id);
 427
 428         s->p = sec_hold;
 429         length += rdp_security_stream_out(rdp, s, length);
 430
 431         stream_set_pos(s, length);
 432         if (transport_write(rdp->transport, s) < 0)
 433                 return false;
 434
 435         return true;
 436 }
 437
 438 boolean rdp_send_data_pdu(rdpRdp* rdp, STREAM* s, uint8 type, uint16 channel_id)
 439 {
 440         uint16 length;
 441         uint32 sec_bytes;
 442         uint8* sec_hold;
 443
 444         length = stream_get_length(s);
 445         stream_set_pos(s, 0);
 446
 447         rdp_write_header(rdp, s, length, MCS_GLOBAL_CHANNEL_ID);
 448
 449         sec_bytes = rdp_get_sec_bytes(rdp);
 450         sec_hold = s->p;
 451         stream_seek(s, sec_bytes);
 452
 453         rdp_write_share_control_header(s, length - sec_bytes, PDU_TYPE_DATA, channel_id);
 454         rdp_write_share_data_header(s, length - sec_bytes, type, rdp->settings->share_id);
 455
 456         s->p = sec_hold;
 457         length += rdp_security_stream_out(rdp, s, length);
 458
 459         stream_set_pos(s, length);
 460         if (transport_write(rdp->transport, s) < 0)
 461                 return false;
 462
 463         return true;
 464 }
 465
 466 void rdp_recv_set_error_info_data_pdu(rdpRdp* rdp, STREAM* s)
 467 {
 468         stream_read_uint32(s, rdp->errorInfo); /* errorInfo (4 bytes) */
 469
 470         if (rdp->errorInfo != ERRINFO_SUCCESS)
 471                 rdp_print_errinfo(rdp->errorInfo);
 472 }
 473
 474 void rdp_recv_data_pdu(rdpRdp* rdp, STREAM* s)
 475 {
 476         uint8 type;
 477         uint16 length;
 478         uint32 share_id;
 479         uint8 compressed_type;
 480         uint16 compressed_len;
 481
 482         rdp_read_share_data_header(s, &length, &type, &share_id, &compressed_type, &compressed_len);
 483
 484 #ifdef WITH_DEBUG_RDP
 485         if (type != DATA_PDU_TYPE_UPDATE)
 486                 printf("recv %s Data PDU (0x%02X), length:%d\n", DATA_PDU_TYPE_STRINGS[type], type, length);
 487 #endif
 488
 489         switch (type)
 490         {
 491                 case DATA_PDU_TYPE_UPDATE:
 492                         update_recv(rdp->update, s);
 493                         break;
 494
 495                 case DATA_PDU_TYPE_CONTROL:
 496                         rdp_recv_server_control_pdu(rdp, s);
 497                         break;
 498
 499                 case DATA_PDU_TYPE_POINTER:
 500                         update_recv_pointer(rdp->update, s);
 501                         break;
 502
 503                 case DATA_PDU_TYPE_INPUT:
 504                         break;
 505
 506                 case DATA_PDU_TYPE_SYNCHRONIZE:
 507                         rdp_recv_synchronize_pdu(rdp, s);
 508                         break;
 509
 510                 case DATA_PDU_TYPE_REFRESH_RECT:
 511                         break;
 512
 513                 case DATA_PDU_TYPE_PLAY_SOUND:
 514                         update_recv_play_sound(rdp->update, s);
 515                         break;
 516
 517                 case DATA_PDU_TYPE_SUPPRESS_OUTPUT:
 518                         break;
 519
 520                 case DATA_PDU_TYPE_SHUTDOWN_REQUEST:
 521                         break;
 522
 523                 case DATA_PDU_TYPE_SHUTDOWN_DENIED:
 524                         break;
 525
 526                 case DATA_PDU_TYPE_SAVE_SESSION_INFO:
 527                         rdp_recv_save_session_info(rdp, s);
 528                         break;
 529
 530                 case DATA_PDU_TYPE_FONT_LIST:
 531                         break;
 532
 533                 case DATA_PDU_TYPE_FONT_MAP:
 534                         rdp_recv_font_map_pdu(rdp, s);
 535                         break;
 536
 537                 case DATA_PDU_TYPE_SET_KEYBOARD_INDICATORS:
 538                         break;
 539
 540                 case DATA_PDU_TYPE_BITMAP_CACHE_PERSISTENT_LIST:
 541                         break;
 542
 543                 case DATA_PDU_TYPE_BITMAP_CACHE_ERROR:
 544                         break;
 545
 546                 case DATA_PDU_TYPE_SET_KEYBOARD_IME_STATUS:
 547                         break;
 548
 549                 case DATA_PDU_TYPE_OFFSCREEN_CACHE_ERROR:
 550                         break;
 551
 552                 case DATA_PDU_TYPE_SET_ERROR_INFO:
 553                         rdp_recv_set_error_info_data_pdu(rdp, s);
 554                         break;
 555
 556                 case DATA_PDU_TYPE_DRAW_NINEGRID_ERROR:
 557                         break;
 558
 559                 case DATA_PDU_TYPE_DRAW_GDIPLUS_ERROR:
 560                         break;
 561
 562                 case DATA_PDU_TYPE_ARC_STATUS:
 563                         break;
 564
 565                 case DATA_PDU_TYPE_STATUS_INFO:
 566                         break;
 567
 568                 case DATA_PDU_TYPE_MONITOR_LAYOUT:
 569                         break;
 570
 571                 default:
 572                         break;
 573         }
 574 }
 575
 576 boolean rdp_recv_out_of_sequence_pdu(rdpRdp* rdp, STREAM* s)
 577 {
 578         uint16 type;
 579         uint16 length;
 580         uint16 channelId;
 581
 582         rdp_read_share_control_header(s, &length, &type, &channelId);
 583
 584         if (type == PDU_TYPE_DATA)
 585         {
 586                 rdp_recv_data_pdu(rdp, s);
 587                 return true;
 588         }
 589         else if (type == PDU_TYPE_SERVER_REDIRECTION)
 590         {
 591                 rdp_recv_enhanced_security_redirection_packet(rdp, s);
 592                 return true;
 593         }
 594         else
 595         {
 596                 return false;
 597         }
 598 }
 599
 600 /**
 601  * Decrypt an RDP packet.\n
 602  * @param rdp RDP module
 603  * @param s stream
 604  * @param length int
 605  */
 606
 607 boolean rdp_decrypt(rdpRdp* rdp, STREAM* s, int length, uint16 securityFlags)
 608 {
 609         uint8 cmac[8], wmac[8];
 610
 611         if (rdp->settings->encryption_method == ENCRYPTION_METHOD_FIPS)
 612         {
 613                 uint16 len;
 614                 uint8 version, pad;
 615                 uint8 *sig;
 616
 617                 stream_read_uint16(s, len); /* 0x10 */
 618                 stream_read_uint8(s, version); /* 0x1 */
 619                 stream_read_uint8(s, pad);
 620
 621                 sig = s->p;
 622                 stream_seek(s, 8);      /* signature */
 623
 624                 length -= 12;
 625
 626                 if (!security_fips_decrypt(s->p, length, rdp))
 627                 {
 628                         printf("FATAL: cannot decrypt\n");
 629                         return false; /* TODO */
 630                 }
 631
 632                 if (!security_fips_check_signature(s->p, length - pad, sig, rdp))
 633                 {
 634                         printf("FATAL: invalid packet signature\n");
 635                         return false; /* TODO */
 636                 }
 637
 638                 /* is this what needs adjusting? */
 639                 s->size -= pad;
 640                 return true;
 641         }
 642
 643         stream_read(s, wmac, sizeof(wmac));
 644         length -= sizeof(wmac);
 645         security_decrypt(s->p, length, rdp);
 646         if (securityFlags & SEC_SECURE_CHECKSUM)
 647                 security_salted_mac_signature(rdp, s->p, length, false, cmac);
 648         else
 649                 security_mac_signature(rdp, s->p, length, cmac);
 650         if (memcmp(wmac, cmac, sizeof(wmac)) != 0)
 651         {
 652                 printf("WARNING: invalid packet signature\n");
 653                 /*
 654                  * Because Standard RDP Security is totally broken,
 655                  * and cannot protect against MITM, don't treat signature
 656                  * verification failure as critical. This at least enables
 657                  * us to work with broken RDP clients and servers that
 658                  * generate invalid signatures.
 659                  */
 660                 //return false;
 661         }
 662         return true;
 663 }
 664
 665 /**
 666  * Process an RDP packet.\n
 667  * @param rdp RDP module
 668  * @param s stream
 669  */
 670
 671 static boolean rdp_recv_tpkt_pdu(rdpRdp* rdp, STREAM* s)
 672 {
 673         uint16 length;
 674         uint16 pduType;
 675         uint16 pduLength;
 676         uint16 pduSource;
 677         uint16 channelId;
 678         uint16 securityFlags;
 679
 680         if (!rdp_read_header(rdp, s, &length, &channelId))
 681         {
 682                 printf("Incorrect RDP header.\n");
 683                 return false;
 684         }
 685
 686         if (rdp->settings->encryption)
 687         {
 688                 rdp_read_security_header(s, &securityFlags);
 689                 if (securityFlags & (SEC_ENCRYPT|SEC_REDIRECTION_PKT))
 690                 {
 691                         if (!rdp_decrypt(rdp, s, length - 4, securityFlags))
 692                         {
 693                                 printf("rdp_decrypt failed\n");
 694                                 return false;
 695                         }
 696                 }
 697                 if (securityFlags & SEC_REDIRECTION_PKT)
 698                 {
 699                         /*
 700                          * [MS-RDPBCGR] 2.2.13.2.1
 701                          *  - no share control header, nor the 2 byte pad
 702                          */
 703                         s->p -= 2;
 704                         rdp_recv_enhanced_security_redirection_packet(rdp, s);
 705                         return true;
 706                 }
 707         }
 708
 709         if (channelId != MCS_GLOBAL_CHANNEL_ID)
 710         {
 711                 freerdp_channel_process(rdp->instance, s, channelId);
 712         }
 713         else
 714         {
 715                 rdp_read_share_control_header(s, &pduLength, &pduType, &pduSource);
 716
 717                 rdp->settings->pdu_source = pduSource;
 718
 719                 switch (pduType)
 720                 {
 721                         case PDU_TYPE_DATA:
 722                                 rdp_recv_data_pdu(rdp, s);
 723                                 break;
 724
 725                         case PDU_TYPE_DEACTIVATE_ALL:
 726                                 if (!rdp_recv_deactivate_all(rdp, s))
 727                                         return false;
 728                                 break;
 729
 730                         case PDU_TYPE_SERVER_REDIRECTION:
 731                                 rdp_recv_enhanced_security_redirection_packet(rdp, s);
 732                                 break;
 733
 734                         default:
 735                                 printf("incorrect PDU type: 0x%04X\n", pduType);
 736                                 break;
 737                 }
 738         }
 739
 740         return true;
 741 }
 742
 743 static boolean rdp_recv_fastpath_pdu(rdpRdp* rdp, STREAM* s)
 744 {
 745         uint16 length;
 746         rdpFastPath* fastpath;
 747
 748         fastpath = rdp->fastpath;
 749         length = fastpath_read_header_rdp(fastpath, s);
 750
 751         if (length == 0 || length > stream_get_left(s))
 752         {
 753                 printf("incorrect FastPath PDU header length %d\n", length);
 754                 return false;
 755         }
 756
 757         if (fastpath->encryptionFlags & FASTPATH_OUTPUT_ENCRYPTED)
 758         {
 759                 rdp_decrypt(rdp, s, length, (fastpath->encryptionFlags & FASTPATH_OUTPUT_SECURE_CHECKSUM) ? SEC_SECURE_CHECKSUM : 0);
 760         }
 761
 762         return fastpath_recv_updates(rdp->fastpath, s);
 763 }
 764
 765 static boolean rdp_recv_pdu(rdpRdp* rdp, STREAM* s)
 766 {
 767         if (tpkt_verify_header(s))
 768                 return rdp_recv_tpkt_pdu(rdp, s);
 769         else
 770                 return rdp_recv_fastpath_pdu(rdp, s);
 771 }
 772
 773 /**
 774  * Receive an RDP packet.\n
 775  * @param rdp RDP module
 776  */
 777
 778 void rdp_recv(rdpRdp* rdp)
 779 {
 780         STREAM* s;
 781
 782         s = transport_recv_stream_init(rdp->transport, 4096);
 783         transport_read(rdp->transport, s);
 784
 785         rdp_recv_pdu(rdp, s);
 786 }
 787
 788 static boolean rdp_recv_callback(rdpTransport* transport, STREAM* s, void* extra)
 789 {
 790         rdpRdp* rdp = (rdpRdp*) extra;
 791
 792         switch (rdp->state)
 793         {
 794                 case CONNECTION_STATE_NEGO:
 795                         if (!rdp_client_connect_mcs_connect_response(rdp, s))
 796                                 return false;
 797                         break;
 798
 799                 case CONNECTION_STATE_MCS_ATTACH_USER:
 800                         if (!rdp_client_connect_mcs_attach_user_confirm(rdp, s))
 801                                 return false;
 802                         break;
 803
 804                 case CONNECTION_STATE_MCS_CHANNEL_JOIN:
 805                         if (!rdp_client_connect_mcs_channel_join_confirm(rdp, s))
 806                                 return false;
 807                         break;
 808
 809                 case CONNECTION_STATE_LICENSE:
 810                         if (!rdp_client_connect_license(rdp, s))
 811                                 return false;
 812                         break;
 813
 814                 case CONNECTION_STATE_CAPABILITY:
 815                         if (!rdp_client_connect_demand_active(rdp, s))
 816                         {
 817                                 printf("rdp_client_connect_demand_active failed\n");
 818                                 return false;
 819                         }
 820                         break;
 821
 822                 case CONNECTION_STATE_FINALIZATION:
 823                         if (!rdp_recv_pdu(rdp, s))
 824                                 return false;
 825                         if (rdp->finalize_sc_pdus == FINALIZE_SC_COMPLETE)
 826                                 rdp->state = CONNECTION_STATE_ACTIVE;
 827                         break;
 828
 829                 case CONNECTION_STATE_ACTIVE:
 830                         if (!rdp_recv_pdu(rdp, s))
 831                                 return false;
 832                         break;
 833
 834                 default:
 835                         printf("Invalid state %d\n", rdp->state);
 836                         return false;
 837         }
 838
 839         return true;
 840 }
 841
 842 int rdp_send_channel_data(rdpRdp* rdp, int channel_id, uint8* data, int size)
 843 {
 844         return freerdp_channel_send(rdp, channel_id, data, size);
 845 }
 846
 847 /**
 848  * Set non-blocking mode information.
 849  * @param rdp RDP module
 850  * @param blocking blocking mode
 851  */
 852 void rdp_set_blocking_mode(rdpRdp* rdp, boolean blocking)
 853 {
 854         rdp->transport->recv_callback = rdp_recv_callback;
 855         rdp->transport->recv_extra = rdp;
 856         transport_set_blocking_mode(rdp->transport, blocking);
 857 }
 858
 859 int rdp_check_fds(rdpRdp* rdp)
 860 {
 861         return transport_check_fds(rdp->transport);
 862 }
 863
 864 /**
 865  * Instantiate new RDP module.
 866  * @return new RDP module
 867  */
 868
 869 rdpRdp* rdp_new(freerdp* instance)
 870 {
 871         rdpRdp* rdp;
 872
 873         rdp = (rdpRdp*) xzalloc(sizeof(rdpRdp));
 874
 875         if (rdp != NULL)
 876         {
 877                 rdp->instance = instance;
 878                 rdp->settings = settings_new((void*) instance);
 879                 if (instance != NULL)
 880                         instance->settings = rdp->settings;
 881                 rdp->extension = extension_new(instance);
 882                 rdp->transport = transport_new(rdp->settings);
 883                 rdp->license = license_new(rdp);
 884                 rdp->input = input_new(rdp);
 885                 rdp->update = update_new(rdp);
 886                 rdp->fastpath = fastpath_new(rdp);
 887                 rdp->nego = nego_new(rdp->transport);
 888                 rdp->mcs = mcs_new(rdp->transport);
 889                 rdp->redirection = redirection_new();
 890                 rdp->mppc = mppc_new(rdp);
 891         }
 892
 893         return rdp;
 894 }
 895
 896 /**
 897  * Free RDP module.
 898  * @param rdp RDP module to be freed
 899  */
 900
 901 void rdp_free(rdpRdp* rdp)
 902 {
 903         if (rdp != NULL)
 904         {
 905                 extension_free(rdp->extension);
 906                 settings_free(rdp->settings);
 907                 transport_free(rdp->transport);
 908                 license_free(rdp->license);
 909                 input_free(rdp->input);
 910                 update_free(rdp->update);
 911                 fastpath_free(rdp->fastpath);
 912                 nego_free(rdp->nego);
 913                 mcs_free(rdp->mcs);
 914                 redirection_free(rdp->redirection);
 915                 mppc_free(rdp);
 916                 xfree(rdp);
 917         }
 918 }
 919