Document sec_out_mcs_connect_initial_pdu

Cross-referenced the PDU with the spec. I found and fixed a few
inconsistencies while also adding comments identifying each data
field.

2 files changed, 68 insertions, 34 deletions

diff --git a/constants.h b/constants.h
index 6b1128d..85d2e0d 100644
--- a/constants.h
+++ b/constants.h
@@ -682,6 +682,41 @@ enum RDP_PDU_REDIRECT_FLAGS
 	LB_TARGET_CERTIFICATE = 0x10000
 };
 
+/* color depths, from [MS-RDPBCGR] 2.2.1.3.2 */
+#define RNS_UD_COLOR_4BPP	0xCA00
+#define RNS_UD_COLOR_8BPP	0xCA01
+#define RNS_UD_COLOR_16BPP_555	0xCA02
+#define RNS_UD_COLOR_16BPP_565	0xCA03
+#define RNS_UD_COLOR_24BPP	0xCA04
+
+#define RNS_UD_SAS_DEL		0xAA03
+
+/* version, [MS-RDPBCGR] 2.2.1.3.2 */
+#define RDP_40		0x00080001	/* RDP 4.0 clients */
+#define RDP_50		0x00080004	/* RDP 5.0, 5.1, 5.2, 6.0, 6.1, 7.0, 7.1, 8.0, and 8.1 clients */
+#define RDP_10_0	0x00080005	/* RDP 10.0 clients */
+#define RDP_10_1	0x00080006	/* RDP 10.1 clients */
+#define RDP_10_2	0x00080007	/* RDP 10.2 clients */
+#define RDP_10_3	0x00080008	/* RDP 10.3 clients */
+
+/* supportedColorDepths, [MS-RDPBCGR] 2.2.1.3.2 */
+#define RNS_UD_24BPP_SUPPORT	0x0001
+#define RNS_UD_16BPP_SUPPORT	0x0002
+#define RNS_UD_15BPP_SUPPORT	0x0004
+#define RNS_UD_32BPP_SUPPORT	0x0008
+
+/* earlyCapabilityFlags, [MS-RDPBCGR] 2.2.1.3.2 */
+#define RNS_UD_CS_SUPPORT_ERRINFO_PDU		0x0001
+#define RNS_UD_CS_WANT_32BPP_SESSION		0x0002
+#define RNS_UD_CS_SUPPORT_STATUSINFO_PDU	0x0004
+#define RNS_UD_CS_STRONG_ASYMMETRIC_KEYS	0x0008
+#define RNS_UD_CS_UNUSED			0x0010
+#define RNS_UD_CS_VALID_CONNECTION_TYPE		0x0020
+#define RNS_UD_CS_SUPPORT_MONITOR_LAYOUT_PDU	0x0040
+#define RNS_UD_CS_SUPPORT_NETCHAR_AUTODETECT	0x0080
+#define RNS_UD_CS_SUPPORT_DYNVC_GFX_PROTOCOL	0x0100
+#define RNS_UD_CS_SUPPORT_DYNAMIC_TIME_ZONE	0x0200
+#define RNS_UD_CS_SUPPORT_HEARTBEAT_PDU		0x0400
 
 /* [MS-RDPBCGR] 2.2.7.1.1 */
 #define OSMAJORTYPE_WINDOWS	0x0001
diff --git a/secure.c b/secure.c
index 9ad1386..bacb235 100644
--- a/secure.c
+++ b/secure.c
@@ -391,16 +391,18 @@ sec_establish_key(void)
 static void
 sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol)
 {
-	int hostlen = 2 * strlen(g_hostname);
 	int length = 162 + 76 + 12 + 4;
 	unsigned int i;
+	uint32 rdpversion = RDP_40;
+	uint16 capflags = RNS_UD_CS_SUPPORT_ERRINFO_PDU;
+	uint16 colorsupport = RNS_UD_24BPP_SUPPORT | RNS_UD_16BPP_SUPPORT;
+
+	if (g_rdp_version >= RDP_V5)
+		rdpversion = RDP_50;
 
 	if (g_num_channels > 0)
 		length += g_num_channels * 12 + 8;
 
-	if (hostlen > 30)
-		hostlen = 30;
-
 	/* Generic Conference Control (T.124) ConferenceCreateRequest */
 	out_uint16_be(s, 5);
 	out_uint16_be(s, 0x14);
@@ -419,36 +421,33 @@ sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol)
 	out_uint16_be(s, ((length - 14) | 0x8000));	/* remaining length */
 
 	/* Client information */
-	out_uint16_le(s, SEC_TAG_CLI_INFO);
-	out_uint16_le(s, 216);	/* length */
-	out_uint16_le(s, (g_rdp_version >= RDP_V5) ? 4 : 1);	/* RDP version. 1 == RDP4, 4 >= RDP5 to RDP8 */
-	out_uint16_le(s, 8);
-	out_uint16_le(s, g_width);
-	out_uint16_le(s, g_height);
-	out_uint16_le(s, 0xca01);
-	out_uint16_le(s, 0xaa03);
-	out_uint32_le(s, g_keylayout);
-	out_uint32_le(s, 2600);	/* Client build. We are now 2600 compatible :-) */
+	out_uint16_le(s, SEC_TAG_CLI_INFO);	/* type */
+	out_uint16_le(s, 216);			/* length */
+	out_uint32_le(s, rdpversion);           /* version */
+	out_uint16_le(s, g_width);		/* desktopWidth */
+	out_uint16_le(s, g_height);		/* desktopHeight */
+	out_uint16_le(s, RNS_UD_COLOR_8BPP);	/* colorDepth */
+	out_uint16_le(s, RNS_UD_SAS_DEL);	/* SASSequence */
+	out_uint32_le(s, g_keylayout);		/* keyboardLayout */
+	out_uint32_le(s, 2600);			/* Client build. We are now 2600 compatible :-) */
 
 	/* Unicode name of client, padded to 32 bytes */
 	out_utf16s_padded(s, g_hostname, 32, 0x00);
 
-	/* See
-	   http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wceddk40/html/cxtsksupportingremotedesktopprotocol.asp */
-	out_uint32_le(s, g_keyboard_type);
-	out_uint32_le(s, g_keyboard_subtype);
-	out_uint32_le(s, g_keyboard_functionkeys);
-	out_uint8s(s, 64);	/* reserved? 4 + 12 doublewords */
-	out_uint16_le(s, 0xca01);	/* colour depth? */
-	out_uint16_le(s, 1);
-
-	out_uint32(s, 0);
-	out_uint8(s, g_server_depth);
-	out_uint16_le(s, 0x0700);
-	out_uint8(s, 0);
-	out_uint32_le(s, 1);
-	out_uint8s(s, 64);
-	out_uint32_le(s, selected_protocol);	/* End of client info */
+	out_uint32_le(s, g_keyboard_type);	/* keyboardType */
+	out_uint32_le(s, g_keyboard_subtype);	/* keyboardSubtype */
+	out_uint32_le(s, g_keyboard_functionkeys); /* keyboardFunctionKey */
+	out_uint8s(s, 64);			/* imeFileName */
+	out_uint16_le(s, RNS_UD_COLOR_8BPP);	/* postBeta2ColorDepth (overrides colorDepth) */
+	out_uint16_le(s, 1);			/* clientProductId (should be 1) */
+	out_uint32_le(s, 0);			/* serialNumber (should be 0) */
+	out_uint16_le(s, g_server_depth);	/* highColorDepth (overrides postBeta2ColorDepth) */
+	out_uint16_le(s, colorsupport);		/* supportedColorDepths */
+	out_uint16_le(s, capflags);		/* earlyCapabilityFlags */
+	out_uint8s(s, 64);			/* clientDigProductId */
+	out_uint8(s, 0);			/* connectionType */
+	out_uint8(s, 0);			/* pad */
+	out_uint32_le(s, selected_protocol);	/* serverSelectedProtocol */
 
 	/* Write a Client Cluster Data (TS_UD_CS_CLUSTER) */
 	uint32 cluster_flags = 0;
@@ -465,10 +464,10 @@ sec_out_mcs_connect_initial_pdu(STREAM s, uint32 selected_protocol)
 	out_uint32(s, g_redirect_session_id);
 
 	/* Client encryption settings */
-	out_uint16_le(s, SEC_TAG_CLI_CRYPT);
-	out_uint16_le(s, 12);	/* length */
-	out_uint32_le(s, g_encryption ? 0x3 : 0);	/* encryption supported, 128-bit supported */
-	out_uint32(s, 0);	/* Unknown */
+	out_uint16_le(s, SEC_TAG_CLI_CRYPT);		/* type */
+	out_uint16_le(s, 12);				/* length */
+	out_uint32_le(s, g_encryption ? 0x3 : 0);	/* encryptionMethods */
+	out_uint32(s, 0);				/* extEncryptionMethods */
 
 	logger(Protocol, Debug, "sec_out_mcs_data(), g_num_channels is %d", g_num_channels);
 	if (g_num_channels > 0)