Commit Graph

110 Commits

Author SHA1 Message Date
akallabeth
fde4867574 Fix #6399: Call ConvertFromUnicode with length -1.
The input string has ensured NULL termination, so let the function
determine the correct length.
2020-07-31 09:14:38 +02:00
akallabeth
a4e95f8e65 Reformatted to satisfy clang-format 2020-05-20 15:32:50 +02:00
akallabeth
d57143f19e Renamed variable to avoid MSVC define collission 2020-05-20 15:10:08 +02:00
akallabeth
a71c96d86f Fixed extended info packet alignment. 2020-05-20 15:10:07 +02:00
akallabeth
e3fdf4b588 Fixed rdp_read_info_packet unaligned access and size checks 2020-05-20 15:10:07 +02:00
akallabeth
1d21585fa4 Fixed unaligned access 2020-05-20 15:10:07 +02:00
akallabeth
57ad88fd82 Rewritten rdp_recv_logon_info_v2 to remove unaligned access 2020-05-20 15:10:07 +02:00
akallabeth
c3c1f76da5 Rewritten check to satisfy BehaviouralSanitizer 2020-05-20 15:10:07 +02:00
Armin Novak
c7187928e9 Fix tpkt header length checks for encrypted packets
If securityFlag SEC_ENCRYPT is set, remove the encryption headers from
the TPKT header length on comparison.
2020-03-10 12:20:50 +01:00
Armin Novak
171e73d797 Fixed compiler warnings in info.c 2020-03-02 11:40:35 +01:00
Armin Novak
318cb3dd47 Added tpkt header length plausibility checks. 2020-03-02 11:40:35 +01:00
Martin Fleisz
7ae8a158a0
Merge pull request #5707 from akallabeth/kbd_codepage
Added KeyboardCodePage option
2020-02-25 14:50:51 +01:00
Kobi Mizrachi
8c8e5e4239 server: proxy: show indicative log on bind failure. 2020-01-27 07:57:45 +01:00
Mati Shabtay
9045f1b343 info.c: Set hidef Remote App flag on info packet read 2019-12-12 11:10:44 +01:00
Martin Fleisz
71feb974ac
Merge pull request #5739 from akallabeth/improve_function_hiding
Improve function hiding
2019-12-02 11:31:35 +01:00
Armin Novak
7c243da6e1 Remove symbols exported by accident. 2019-12-02 10:57:31 +01:00
David Fort
22f954970a primitives: use host pointers for openCL
Using host pointers may skip the need for copying buffers.
2019-11-29 11:59:09 +01:00
Armin Novak
9e7c24668b Fixed broken length calculation in rdp_write_extended_info_packet 2019-11-11 09:30:16 +01:00
Armin Novak
da87247d61 Added KeyboardCodePage option
Thanks to @byteboon for the hint.
2019-11-07 19:57:07 +01:00
Armin Novak
fc4bb71205 Added cast and checks for info packet. 2019-11-07 10:55:27 +01:00
Armin Novak
72ca88f49c Reformatted to new style 2019-11-07 10:53:54 +01:00
asapelkin
82eadad4a4 Fix some static analizer warnings 2019-10-22 15:39:54 +02:00
Armin Novak
2cc714a57d Updated RAILS implementation
* Implement new messages and callbacks
* Announce most recent channel features
* Added settings to configure flags to announce
2019-05-08 17:25:15 +02:00
Armin Novak
d7ca2db62e Fixed doulbe semicolon in C files. 2019-05-08 12:58:01 +02:00
Armin Novak
f51a9bafcc Fixed sign-compare warnings 2019-04-05 09:13:24 +02:00
Jiajun Wang
fd27451768 Fixed TS_INFO_PACKET (#5275)
Those fields exclude the length of the mandatory null terminator:
* cbDomain
* cbUserName
* cbPassword
* cbAlternateShell
* cbWorkingDir
2019-02-22 17:31:42 +01:00
David Fort
53c74beadc rdp: add a callback for ServerStatusInfo 2019-01-29 10:33:06 +01:00
Armin Novak
138eb13fea Updated RDP_VERSION definitions. 2018-11-14 10:14:48 +01:00
David Fort
1a50a48332 fix uninitialised variable
Otherwise we can run in troubles when sending logon_info_v2 packets
2018-11-01 11:07:36 +01:00
Armin Novak
991f051a63 Fixed stream release for transport_write 2018-10-17 14:55:55 +02:00
Armin Novak
cf319001f9 Fixed out of bound access. 2018-09-05 16:34:49 +02:00
Armin Novak
0de43c8b85 Added /smartcard-logon option to set flag. (Stripped version of #4837 by @informatimago) 2018-09-04 15:50:03 +02:00
Ondrej Holy
23c3c188c9 core/info: Silence false positive warnings from covscan
Change the code a bit to silence false positive warnings from covscan.

pass_freed_arg: Passing freed pointer "wString" as an argument to "Stream_Write".
pass_freed_arg: Passing freed pointer "wString" as an argument to "Stream_Write".
2018-08-22 14:34:02 +02:00
Ondrej Holy
4a7bb18428 core/info: Fix leak found by covscan
leaked_storage: Variable "wString" going out of scope leaks the storage it points to.
2018-08-22 14:34:02 +02:00
Armin Novak
5b961e9c75 Fixed /pth: Consistently treat the hash offset to password length. 2018-05-03 17:51:11 +02:00
Jukka-Pekka Virtanen
ad1425e145 Using PasswordIsSmartcardPin option when sending TS_INFO_PACKET 2017-09-23 14:28:17 +02:00
Armin Novak
8292b4558f Fix TALOS issues
Fix the following issues identified by the CISCO TALOS project:
 * TALOS-2017-0336 CVE-2017-2834
 * TALOS-2017-0337 CVE-2017-2834
 * TALOS-2017-0338 CVE-2017-2836
 * TALOS-2017-0339 CVE-2017-2837
 * TALOS-2017-0340 CVE-2017-2838
 * TALOS-2017-0341 CVE-2017-2839
2017-07-20 09:28:47 +02:00
Armin Novak
d119745d97 String representation of logon_error_info 2017-03-02 18:09:51 +01:00
David Fort
67607ce916 Take in account and set the LogonNotify flag
This flag was not read in the server case and was always sent in the
case of a client.
2017-03-02 00:29:48 +01:00
Norbert Federa
f71b6b46e8 fix string format specifiers
- fixed invalid, missing or additional arguments
- removed all type casts from arguments
- added missing (void*) typecasts for %p arguments
- use inttypes defines where appropriate
2016-12-16 13:48:43 +01:00
Armin Novak
a1b2325c1d Ensure securityFlags are always initialized. 2016-12-02 12:04:53 +01:00
Norbert Federa
c6e6b44143 countless WLog/printf format specifier fixes 2016-11-25 17:06:25 +01:00
Norbert Federa
53bd98883e winpr/crypt api changes and memory leak fixes
- winpr_HMAC_New() now just returnes the opaque WINPR_HMAC_CTX* pointer
  which has to be passed to winpr_HMAC_Init() for (re)initialization
  and since winpr_HMAC_Final() no more frees the context you always have to
  use the new function winpr_HMAC_Free() once winpr_HMAC_New() has succeded

- winpr_Digest_New() now just returns the opaque WINPR_DIGEST_CTX* pointer
  which has to be passed to winpr_Digest_Init() for (re)initialization
  and since winpr_Digest_Final() no more frees the context you always have to
  use the new function winpr_Digest_Free() once winpr_Digest_New() has succeded
2016-11-24 18:27:29 +01:00
Norbert Federa
7befab856c Support for OpenSSL 1.1.0 2016-11-24 17:50:09 +01:00
Norbert Federa
ae9460f02f protocol violation: rdp_read_extended_info_packet
The clientTimeZone and all subsequent fields in the Extended Info Packet
(MS RDPBCGR 2.2.1.11.1.1.1) are optional but were not handled as such.
2016-06-27 10:56:40 +02:00
Norbert Federa
9f148e6712 core: allow TS Gateway protocol violation
According to [MS-RDPBCGR 2.2.1.11.1.1.1] the TS_EXTENDED_INFO_PACKET
structure's cbClientAddress field must include the _mandatory_ NULL
terminator of the clientAddress field in its byte count.
However, connections proxied via Microsoft's TS Gateway set the
cbClientDir value to 0.
2016-04-19 14:09:58 +02:00
Norbert Federa
4ae77b8273 core: allow ms android client protocol violation
According to [MS-RDPBCGR 2.2.1.11.1.1.1] the TS_EXTENDED_INFO_PACKET
structure's cbClientDir field must include the _mandatory_ NULL
terminator of the ClientDir field.
However, since version 8.1.31.44, the Microsoft Remote Desktop Client
for Android sets cbClientDir to 0.
2016-04-11 10:50:27 +02:00
Norbert Federa
de4adeff0e fix logon info processing
since there have been reports that certain windows versions send
zero values in the cbDomain field of the Logon Info Version 2
(TS_LOGON_INFO_VERSION_2) struct we allow zero values for cbUserName
and cbDomain in rdp_recv_logon_info_v1 and rdp_recv_logon_info_v2.
2016-03-04 00:45:26 +01:00
Norbert Federa
ef4b29e5b3 ConvertFromUnicode fixes and misc hardening
- Added missing ConvertFromUnicode checks
- If ConvertToUnicode allocates memory, guarantee the null termination
  similar to ConvertFromUnicode's implementation
- Fixed some TestUnicodeConversion.c CTest return values
- Added some CTests for ConvertFromUnicode and ConvertToUnicode
- Misc code and protocol hardening fixes in the surrounding code regions
  that have been touched
2016-03-03 16:56:19 +01:00
David FORT
f5ce5e72dd Fix parsing of saveSessionInfo PDU
This should fix the case when no username is sent (issue #3186).
2016-03-03 11:45:12 +01:00