out_uint16_be(s, value);
}
+static void
+ber_out_uint8(STREAM s, uint8 value)
+{
+ ber_out_header(s, BER_TAG_INTEGER, 1);
+ out_uint8(s, value);
+}
+
+static void
+ber_in_integer(STREAM s, int *value)
+{
+ int length;
+ ber_parse_header(s, BER_TAG_INTEGER, &length);
+ in_uint16_be(s, *value);
+}
+
/* Output a DOMAIN_PARAMS structure (ASN.1 BER) */
static void
mcs_out_domain_params(STREAM s, int max_channels, int max_users, int max_tokens, int max_pdusize)
{
- ber_out_header(s, MCS_TAG_DOMAIN_PARAMS, 32);
- ber_out_integer(s, max_channels);
- ber_out_integer(s, max_users);
- ber_out_integer(s, max_tokens);
- ber_out_integer(s, 1); /* num_priorities */
- ber_out_integer(s, 0); /* min_throughput */
- ber_out_integer(s, 1); /* max_height */
- ber_out_integer(s, max_pdusize);
- ber_out_integer(s, 2); /* ver_protocol */
+ ber_out_header(s, MCS_TAG_DOMAIN_PARAMS, 26);
+ ber_out_uint8(s, 34); // max_channels
+ ber_out_uint8(s, 3); // max_users
+ ber_out_uint8(s, 0); // max_tokens
+ ber_out_uint8(s, 1); // num_priorities
+ ber_out_uint8(s, 0); // min_throughput
+ ber_out_uint8(s, 1); // max_height
+ ber_out_header(s, BER_TAG_INTEGER, 3); // pdu size
+ out_uint8(s, 0x00);
+ out_uint8(s, 0xff);
+ out_uint8(s, 0xf8);
+ ber_out_uint8(s, 2); // ver_protocol
}
/* Parse a DOMAIN_PARAMS structure (ASN.1 BER) */
mcs_parse_domain_params(STREAM s)
{
int length;
+ int max_channels, max_users, max_tokens, max_pdusize;
+ int num_priorities, min_throughput, max_height;
+ int ver_protocol;
ber_parse_header(s, MCS_TAG_DOMAIN_PARAMS, &length);
- in_uint8s(s, length);
-
+ printf("MCS_TAG_DOMAIN_PARAMS, len %u (expected 32)\n", length);
+ if (length == 32) {
+ ber_in_integer(s, &max_channels);
+ ber_in_integer(s, &max_users);
+ ber_in_integer(s, &max_tokens);
+ ber_in_integer(s, &num_priorities);
+ ber_in_integer(s, &min_throughput);
+ ber_in_integer(s, &max_height);
+ ber_in_integer(s, &max_pdusize);
+ ber_in_integer(s, &ver_protocol);
+
+ printf("max_channels=%u\n", max_channels);
+ printf("max_users=%u\n", max_users);
+ printf("max_tokens=%u\n", max_tokens);
+ printf("num_priorities=%u\n", num_priorities);
+ printf("min_throughput=%u\n", min_throughput);
+ printf("max_pdusize=%u\n", max_pdusize);
+ printf("ver_protocol=%u\n", ver_protocol);
+ } else {
+ hexdump(s->p, length);
+ in_uint8s(s, length);
+ }
+
return s_check(s);
}
-/* Send an MCS_CONNECT_INITIAL message (ASN.1 BER) */
-static void
-mcs_send_connect_initial(STREAM mcs_data)
-{
- int datalen = mcs_data->end - mcs_data->data;
- int length = 9 + 3 * 34 + 4 + datalen;
- STREAM s;
-
- s = iso_init(length + 5);
-
- ber_out_header(s, MCS_CONNECT_INITIAL, length);
- ber_out_header(s, BER_TAG_OCTET_STRING, 1); /* calling domain */
- out_uint8(s, 1);
- ber_out_header(s, BER_TAG_OCTET_STRING, 1); /* called domain */
- out_uint8(s, 1);
-
- ber_out_header(s, BER_TAG_BOOLEAN, 1);
- out_uint8(s, 0xff); /* upward flag */
-
- mcs_out_domain_params(s, 34, 2, 0, 0xffff); /* target params */
- mcs_out_domain_params(s, 1, 1, 1, 0x420); /* min params */
- mcs_out_domain_params(s, 0xffff, 0xfc17, 0xffff, 0xffff); /* max params */
-
- ber_out_header(s, BER_TAG_OCTET_STRING, datalen);
- out_uint8p(s, mcs_data->data, datalen);
-
- s_mark_end(s);
- iso_send(s);
-}
-
/* Expect a MCS_CONNECT_RESPONSE message (ASN.1 BER) */
BOOL
mcs_recv_connect_initial()
return s_check_end(s);
}
+void
+mcs_send_connect_response()
+{
+ STREAM s;
+ int i;
+
+ s = iso_init(97);
+ printf("INITLEN: %u\n", s->p - s->iso_hdr);
+
+ ber_out_header(s, MCS_CONNECT_RESPONSE, 94);
+ ber_out_header(s, BER_TAG_RESULT, 1);
+ out_uint8(s, 0);
+
+ ber_out_header(s, BER_TAG_INTEGER, 1);
+ out_uint8(s, 0); // connect id
+
+ mcs_out_domain_params(s, 34, 2, 0, 0xffff); // dumdidum?
+
+ ber_out_header(s, BER_TAG_OCTET_STRING, 58);
+
+ // some unknown header of sorts
+ out_uint8(s, 0x00);
+ out_uint8(s, 0x05);
+ out_uint8(s, 0x00);
+ out_uint8(s, 0x14);
+ out_uint8(s, 0x7c);
+ out_uint8(s, 0x00);
+ out_uint8(s, 0x01);
+ out_uint8(s, 0x2a);
+ out_uint8(s, 0x14);
+ out_uint8(s, 0x76);
+ out_uint8(s, 0x0a);
+ out_uint8(s, 0x01);
+ out_uint8(s, 0x01);
+ out_uint8(s, 0x00);
+ out_uint8(s, 0x01);
+ out_uint8(s, 0xc0);
+ out_uint8(s, 0x00);
+ out_uint8(s, 0x4d);
+ out_uint8(s, 0x63);
+ out_uint8(s, 0x44);
+ out_uint8(s, 0x6e);
+
+ out_uint8(s, 36); // one byte length
+
+ // server info -- we claim to support RDP5
+ out_uint16_le(s, SEC_TAG_SRV_INFO);
+ out_uint16_le(s, 8); // length
+ out_uint16_le(s, 4); // version
+ out_uint16_le(s, 8); // unknown
+
+ // channel info -- open a few channels
+ out_uint16_le(s, SEC_TAG_SRV_CHANNELS);
+ out_uint16_le(s, 16); // length
+ out_uint16_le(s, 1003);
+ out_uint16_le(s, 3);
+ out_uint16_le(s, 1004);
+ out_uint16_le(s, 1005);
+ out_uint16_le(s, 1006);
+ out_uint16_le(s, 0);
+
+ // crypto info
+ out_uint16_le(s, SEC_TAG_SRV_CRYPT);
+ out_uint16_le(s, 12); // length
+ out_uint32_le(s, 1); // 40-bit
+ out_uint32_le(s, 0); // no encryption
+
+ s_mark_end(s);
+ printf("LEN: %u\n", s->p - s->iso_hdr);
+ iso_send(s);
+
+}
+
/* Send an EDrq message (ASN.1 PER) */
static void
mcs_send_edrq(void)
iso_send(s);
}
-/* Expect a AUcf message (ASN.1 PER) */
-static BOOL
-mcs_recv_aucf(uint16 * mcs_userid)
+/* Send a AUcf message (ASN.1 PER) */
+static void
+mcs_send_aucf(uint16 mcs_userid)
{
- uint8 opcode, result;
STREAM s;
- s = iso_recv();
- if (s == NULL)
- return False;
-
- in_uint8(s, opcode);
- if ((opcode >> 2) != MCS_AUCF)
- {
- error("expected AUcf, got %d\n", opcode);
- return False;
- }
-
- in_uint8(s, result);
- if (result != 0)
- {
- error("AUrq: %d\n", result);
- return False;
- }
-
- if (opcode & 2)
- in_uint16_be(s, *mcs_userid);
+ s = iso_init(5);
- return s_check_end(s);
+ out_uint8(s, (MCS_AUCF << 2) | 2); // | 2 = send user ID
+ out_uint8(s, 0); // success
+ out_uint16_be(s, 6);
+
+ s_mark_end(s);
+ iso_send(s);
}
/* Send a CJrq message (ASN.1 PER) */
}
/* Expect a CJcf message (ASN.1 PER) */
-static BOOL
-mcs_recv_cjcf(void)
+static void
+mcs_send_cjcf(uint16 userid, uint16 chanid)
{
- uint8 opcode, result;
STREAM s;
- s = iso_recv();
- if (s == NULL)
- return False;
-
- in_uint8(s, opcode);
- if ((opcode >> 2) != MCS_CJCF)
- {
- error("expected CJcf, got %d\n", opcode);
- return False;
- }
+ s = iso_init(8);
- in_uint8(s, result);
- if (result != 0)
- {
- error("CJrq: %d\n", result);
- return False;
- }
-
- in_uint8s(s, 4); /* mcs_userid, req_chanid */
- if (opcode & 2)
- in_uint8s(s, 2); /* join_chanid */
+ out_uint8(s, (MCS_CJCF << 2) | 2);
+ out_uint8(s, 0); // success
+ out_uint16_be(s, 6);
+ out_uint16_be(s, chanid);
+ out_uint16_be(s, chanid);
- return s_check_end(s);
+ s_mark_end(s);
+ iso_send(s);
}
/* Initialise an MCS transport data packet */
length = s->end - s->p - 8;
length |= 0x8000;
- out_uint8(s, (MCS_SDRQ << 2));
+ out_uint8(s, (MCS_SDIN << 2));
out_uint16_be(s, g_mcs_userid);
out_uint16_be(s, channel);
out_uint8(s, 0x70); /* flags */
STREAM
mcs_recv(uint16 * channel)
{
- uint8 opcode, appid, length;
+ uint8 opcode, appid, length, userid;
STREAM s;
s = iso_recv();
in_uint8(s, opcode);
appid = opcode >> 2;
- if (appid != MCS_SDIN)
- {
- if (appid != MCS_DPUM)
- {
- error("expected data, got %d\n", opcode);
- }
+
+ switch (appid) {
+ case MCS_SDRQ:
+ in_uint8s(s, 2); /* userid */
+ in_uint16_be(s, *channel);
+ in_uint8s(s, 1); /* flags */
+ in_uint8(s, length);
+ if (length & 0x80)
+ in_uint8s(s, 1); /* second byte of length */
+
+ return s;
+ case MCS_DPUM:
+ printf("Received DPUM (?)\n");
+ return NULL;
+ case MCS_EDRQ:
+ // Erect Domain (ignore)
+ printf("Received EDrq\n");
+ return NULL;
+ case MCS_AURQ:
+ // Attach User Request, respond with AUcf (Attach User Confirm)
+ printf("Received AUrq, sending AUcf\n");
+ mcs_send_aucf(0);
+ return NULL;
+ case MCS_CJRQ:
+ // Channel Join Request, respond with CJcf (Channel Join Confirm);
+ in_uint16_be(s, userid);
+ in_uint16_be(s, *channel);
+ printf("Received CJrq for channel %hu, sending CJcf\n", *channel);
+ mcs_send_cjcf(userid, *channel);
+ return NULL;
+ default:
+ error("expected data, got %d\n", opcode);
return NULL;
}
- in_uint8s(s, 2); /* userid */
- in_uint16_be(s, *channel);
- in_uint8s(s, 1); /* flags */
- in_uint8(s, length);
- if (length & 0x80)
- in_uint8s(s, 1); /* second byte of length */
-
- return s;
}
/* Disconnect from the MCS layer */