--- sourceforge.net/trunk/rdesktop/secure.c	2000/08/15 10:23:24	10
+++ sourceforge.net/trunk/rdesktop/secure.c	2001/06/20 13:54:48	28
@@ -28,6 +28,8 @@
 extern int width;
 extern int height;
 extern int keylayout;
+extern BOOL use_encryption;
+extern BOOL licence_issued;
 
 static int rc4_key_len;
 static RC4_KEY rc4_decrypt_key;
@@ -45,7 +47,8 @@
  * a client and server salt) and a global salt value used for padding.
  * Both SHA1 and MD5 algorithms are used.
  */
-void sec_hash_48(uint8 *out, uint8 *in, uint8 *salt1, uint8 *salt2, uint8 salt)
+void
+sec_hash_48(uint8 *out, uint8 *in, uint8 *salt1, uint8 *salt2, uint8 salt)
 {
 	uint8 shasig[20];
 	uint8 pad[4];
@@ -55,10 +58,10 @@
 
 	for (i = 0; i < 3; i++)
 	{
-		memset(pad, salt+i, i+1);
+		memset(pad, salt + i, i + 1);
 
 		SHA1_Init(&sha);
-		SHA1_Update(&sha, pad, i+1);
+		SHA1_Update(&sha, pad, i + 1);
 		SHA1_Update(&sha, in, 48);
 		SHA1_Update(&sha, salt1, 32);
 		SHA1_Update(&sha, salt2, 32);
@@ -67,7 +70,7 @@
 		MD5_Init(&md5);
 		MD5_Update(&md5, in, 48);
 		MD5_Update(&md5, shasig, 20);
-		MD5_Final(&out[i*16], &md5);
+		MD5_Final(&out[i * 16], &md5);
 	}
 }
 
@@ -75,7 +78,8 @@
  * Weaker 16-byte transformation, also using two 32-byte salts, but
  * only using a single round of MD5.
  */
-void sec_hash_16(uint8 *out, uint8 *in, uint8 *salt1, uint8 *salt2)
+void
+sec_hash_16(uint8 *out, uint8 *in, uint8 *salt1, uint8 *salt2)
 {
 	MD5_CTX md5;
 
@@ -87,7 +91,8 @@
 }
 
 /* Reduce key entropy from 64 to 40 bits */
-static void sec_make_40bit(uint8 *key)
+static void
+sec_make_40bit(uint8 *key)
 {
 	key[0] = 0xd1;
 	key[1] = 0x26;
@@ -95,27 +100,29 @@
 }
 
 /* Generate a session key and RC4 keys, given client and server randoms */
-static void sec_generate_keys(uint8 *client_key, uint8 *server_key,
-			      int rc4_key_size)
+static void
+sec_generate_keys(uint8 *client_key, uint8 *server_key, int rc4_key_size)
 {
 	uint8 session_key[48];
 	uint8 temp_hash[48];
 	uint8 input[48];
 
 	/* Construct input data to hash */
-	memcpy(input,    client_key, 24);
-	memcpy(input+24, server_key, 24);
+	memcpy(input, client_key, 24);
+	memcpy(input + 24, server_key, 24);
 
 	/* Generate session key - two rounds of sec_hash_48 */
-	sec_hash_48(temp_hash,   input,     client_key, server_key, 65);
+	sec_hash_48(temp_hash, input, client_key, server_key, 65);
 	sec_hash_48(session_key, temp_hash, client_key, server_key, 88);
 
 	/* Store first 8 bytes of session key, for generating signatures */
 	memcpy(sec_sign_key, session_key, 8);
 
 	/* Generate RC4 keys */
-	sec_hash_16(sec_decrypt_key, &session_key[16], client_key, server_key);
-	sec_hash_16(sec_encrypt_key, &session_key[32], client_key, server_key);
+	sec_hash_16(sec_decrypt_key, &session_key[16], client_key,
+		    server_key);
+	sec_hash_16(sec_encrypt_key, &session_key[32], client_key,
+		    server_key);
 
 	if (rc4_key_size == 1)
 	{
@@ -140,20 +147,23 @@
 	RC4_set_key(&rc4_encrypt_key, rc4_key_len, sec_encrypt_key);
 }
 
-static uint8 pad_54[40] =
-{
-	54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,
-	54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54,54
+static uint8 pad_54[40] = {
+	54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54,
+	54, 54, 54,
+	54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54, 54,
+	54, 54, 54
 };
 
-static uint8 pad_92[48] =
-{
-	92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,
-	92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92
+static uint8 pad_92[48] = {
+	92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92,
+	92, 92, 92, 92, 92, 92, 92,
+	92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92, 92,
+	92, 92, 92, 92, 92, 92, 92
 };
 
 /* Output a uint32 into a buffer (little-endian) */
-void buf_out_uint32(uint8 *buffer, uint32 value)
+void
+buf_out_uint32(uint8 *buffer, uint32 value)
 {
 	buffer[0] = (value) & 0xff;
 	buffer[1] = (value >> 8) & 0xff;
@@ -162,8 +172,9 @@
 }
 
 /* Generate a signature hash, using a combination of SHA1 and MD5 */
-void sec_sign(uint8 *signature, uint8 *session_key, int length,
-		uint8 *data, int datalen)
+void
+sec_sign(uint8 *signature, uint8 *session_key, int length,
+	 uint8 *data, int datalen)
 {
 	uint8 shasig[20];
 	uint8 md5sig[16];
@@ -171,7 +182,7 @@
 	SHA_CTX sha;
 	MD5_CTX md5;
 
-	buf_out_uint32(lenhdr, datalen); 
+	buf_out_uint32(lenhdr, datalen);
 
 	SHA1_Init(&sha);
 	SHA1_Update(&sha, session_key, length);
@@ -190,7 +201,8 @@
 }
 
 /* Update an encryption key - similar to the signing process */
-static void sec_update(uint8 *key, uint8 *update_key)
+static void
+sec_update(uint8 *key, uint8 *update_key)
 {
 	uint8 shasig[20];
 	SHA_CTX sha;
@@ -217,7 +229,8 @@
 }
 
 /* Encrypt data using RC4 */
-static void sec_encrypt(uint8 *data, int length)
+static void
+sec_encrypt(uint8 *data, int length)
 {
 	static int use_count;
 
@@ -233,7 +246,8 @@
 }
 
 /* Decrypt data using RC4 */
-static void sec_decrypt(uint8 *data, int length)
+static void
+sec_decrypt(uint8 *data, int length)
 {
 	static int use_count;
 
@@ -249,19 +263,21 @@
 }
 
 /* Read in a NUMBER from a buffer */
-static void sec_read_number(NUMBER *num, uint8 *buffer, int len)
+static void
+sec_read_number(NUMBER * num, uint8 *buffer, int len)
 {
 	INT *data = num->n_part;
 	int i, j;
 
 	for (i = 0, j = 0; j < len; i++, j += 2)
-		data[i] = buffer[j] | (buffer[j+1] << 8);
+		data[i] = buffer[j] | (buffer[j + 1] << 8);
 
-	num->n_len = i; 
-} 
+	num->n_len = i;
+}
 
 /* Write a NUMBER to a buffer */
-static void sec_write_number(NUMBER *num, uint8 *buffer, int len)
+static void
+sec_write_number(NUMBER * num, uint8 *buffer, int len)
 {
 	INT *data = num->n_part;
 	int i, j;
@@ -269,13 +285,14 @@
 	for (i = 0, j = 0; j < len; i++, j += 2)
 	{
 		buffer[j] = data[i] & 0xff;
-		buffer[j+1] = data[i] >> 8;
+		buffer[j + 1] = data[i] >> 8;
 	}
 }
 
 /* Perform an RSA public key encryption operation */
-static void sec_rsa_encrypt(uint8 *out, uint8 *in, int len,
-			    uint8 *modulus, uint8 *exponent)
+static void
+sec_rsa_encrypt(uint8 *out, uint8 *in, int len,
+		uint8 *modulus, uint8 *exponent)
 {
 	NUMBER data, key;
 
@@ -291,25 +308,31 @@
 }
 
 /* Initialise secure transport packet */
-STREAM sec_init(uint32 flags, int maxlen)
+STREAM
+sec_init(uint32 flags, int maxlen)
 {
 	int hdrlen;
 	STREAM s;
 
-	hdrlen = (flags & SEC_ENCRYPT) ? 12 : 4;
-        s = mcs_init(maxlen + hdrlen);
+	if (!licence_issued)
+		hdrlen = (flags & SEC_ENCRYPT) ? 12 : 4;
+	else
+		hdrlen = (flags & SEC_ENCRYPT) ? 12 : 0;
+	s = mcs_init(maxlen + hdrlen);
 	s_push_layer(s, sec_hdr, hdrlen);
 
 	return s;
 }
 
 /* Transmit secure transport packet */
-void sec_send(STREAM s, uint32 flags)
+void
+sec_send(STREAM s, uint32 flags)
 {
 	int datalen;
 
 	s_pop_layer(s, sec_hdr);
-	out_uint32_le(s, flags);
+	if (!licence_issued || (flags & SEC_ENCRYPT))
+		out_uint32_le(s, flags);
 
 	if (flags & SEC_ENCRYPT)
 	{
@@ -318,18 +341,19 @@
 
 #if RDP_DEBUG
 		DEBUG("Sending encrypted packet:\n");
-		hexdump(s->p+8, datalen);
+		hexdump(s->p + 8, datalen);
 #endif
 
-		sec_sign(s->p, sec_sign_key, 8, s->p+8, datalen);
-		sec_encrypt(s->p+8, datalen);
+		sec_sign(s->p, sec_sign_key, 8, s->p + 8, datalen);
+		sec_encrypt(s->p + 8, datalen);
 	}
 
 	mcs_send(s);
 }
 
 /* Transfer the client random to the server */
-static void sec_establish_key()
+static void
+sec_establish_key()
 {
 	uint32 length = SEC_MODULUS_SIZE + SEC_PADDING_SIZE;
 	uint32 flags = SEC_CLIENT_RANDOM;
@@ -346,7 +370,8 @@
 }
 
 /* Output connect initial data blob */
-static void sec_out_mcs_data(STREAM s)
+static void
+sec_out_mcs_data(STREAM s)
 {
 	int hostlen = 2 * strlen(hostname);
 
@@ -355,7 +380,7 @@
 	out_uint8(s, 0x7c);
 	out_uint16_be(s, 1);
 
-	out_uint16_be(s, (158 | 0x8000)); /* remaining length */
+	out_uint16_be(s, (158 | 0x8000));	/* remaining length */
 
 	out_uint16_be(s, 8);	/* length? */
 	out_uint16_be(s, 16);
@@ -363,8 +388,8 @@
 	out_uint16_le(s, 0xc001);
 	out_uint8(s, 0);
 
-	out_uint32_le(s, 0x61637544); /* "Duca" ?! */
-	out_uint16_be(s, (144 | 0x8000)); /* remaining length */
+	out_uint32_le(s, 0x61637544);	/* "Duca" ?! */
+	out_uint16_be(s, (144 | 0x8000));	/* remaining length */
 
 	/* Client information */
 	out_uint16_le(s, SEC_TAG_CLI_INFO);
@@ -376,16 +401,16 @@
 	out_uint16_le(s, 0xca01);
 	out_uint16_le(s, 0xaa03);
 	out_uint32_le(s, keylayout);
-	out_uint32_le(s, 419);   /* client build? we are 419 compatible :-) */
+	out_uint32_le(s, 419);	/* client build? we are 419 compatible :-) */
 
 	/* Unicode name of client, padded to 32 bytes */
 	rdp_out_unistr(s, hostname, hostlen);
-	out_uint8s(s, 30-hostlen);
+	out_uint8s(s, 30 - hostlen);
 
 	out_uint32_le(s, 4);
 	out_uint32(s, 0);
 	out_uint32_le(s, 12);
-	out_uint8s(s, 64); /* reserved? 4 + 12 doublewords */
+	out_uint8s(s, 64);	/* reserved? 4 + 12 doublewords */
 
 	out_uint16(s, 0xca01);
 	out_uint16(s, 0);
@@ -393,12 +418,13 @@
 	/* Client encryption settings */
 	out_uint16_le(s, SEC_TAG_CLI_CRYPT);
 	out_uint16(s, 8);	/* length */
-	out_uint32_le(s, 1);	/* encryption enabled */
+	out_uint32_le(s, use_encryption ? 1 : 0);	/* encryption enabled */
 	s_mark_end(s);
 }
 
 /* Parse a public key structure */
-static BOOL sec_parse_public_key(STREAM s, uint8 **modulus, uint8 **exponent)
+static BOOL
+sec_parse_public_key(STREAM s, uint8 **modulus, uint8 **exponent)
 {
 	uint32 magic, modulus_len;
 
@@ -416,7 +442,7 @@
 		return False;
 	}
 
-	in_uint8s(s, 8); /* modulus_bits, unknown */
+	in_uint8s(s, 8);	/* modulus_bits, unknown */
 	in_uint8p(s, *exponent, SEC_EXPONENT_SIZE);
 	in_uint8p(s, *modulus, SEC_MODULUS_SIZE);
 	in_uint8s(s, SEC_PADDING_SIZE);
@@ -425,15 +451,16 @@
 }
 
 /* Parse a crypto information structure */
-static BOOL sec_parse_crypt_info(STREAM s, uint32 *rc4_key_size,
-		uint8 **server_random, uint8 **modulus, uint8 **exponent)
+static BOOL
+sec_parse_crypt_info(STREAM s, uint32 *rc4_key_size,
+		     uint8 **server_random, uint8 **modulus, uint8 **exponent)
 {
 	uint32 crypt_level, random_len, rsa_info_len;
 	uint16 tag, length;
 	uint8 *next_tag, *end;
 
-	in_uint32_le(s, *rc4_key_size); /* 1 = 40-bit, 2 = 128-bit */
-	in_uint32_le(s, crypt_level);  /* 1 = low, 2 = medium, 3 = high */
+	in_uint32_le(s, *rc4_key_size);	/* 1 = 40-bit, 2 = 128-bit */
+	in_uint32_le(s, crypt_level);	/* 1 = low, 2 = medium, 3 = high */
 	in_uint32_le(s, random_len);
 	in_uint32_le(s, rsa_info_len);
 
@@ -450,7 +477,7 @@
 	if (end > s->end)
 		return False;
 
-	in_uint8s(s, 12); /* unknown */
+	in_uint8s(s, 12);	/* unknown */
 
 	while (s->p < end)
 	{
@@ -462,7 +489,8 @@
 		switch (tag)
 		{
 			case SEC_TAG_PUBKEY:
-				if (!sec_parse_public_key(s, modulus, exponent))
+				if (!sec_parse_public_key
+				    (s, modulus, exponent))
 					return False;
 
 				break;
@@ -483,30 +511,32 @@
 }
 
 /* Process crypto information blob */
-static void sec_process_crypt_info(STREAM s)
+static void
+sec_process_crypt_info(STREAM s)
 {
 	uint8 *server_random, *modulus, *exponent;
 	uint8 client_random[SEC_RANDOM_SIZE];
 	uint32 rc4_key_size;
 
 	if (!sec_parse_crypt_info(s, &rc4_key_size, &server_random,
-					&modulus, &exponent))
+				  &modulus, &exponent))
 		return;
 
 	/* Generate a client random, and hence determine encryption keys */
 	generate_random(client_random);
 	sec_rsa_encrypt(sec_crypted_random, client_random,
-				SEC_RANDOM_SIZE, modulus, exponent);
+			SEC_RANDOM_SIZE, modulus, exponent);
 	sec_generate_keys(client_random, server_random, rc4_key_size);
 }
 
 /* Process connect response data blob */
-static void sec_process_mcs_data(STREAM s)
+static void
+sec_process_mcs_data(STREAM s)
 {
 	uint16 tag, length;
 	uint8 *next_tag;
 
-	in_uint8s(s, 23); /* header */
+	in_uint8s(s, 23);	/* header */
 
 	while (s->p < s->end)
 	{
@@ -537,25 +567,29 @@
 }
 
 /* Receive secure transport packet */
-STREAM sec_recv()
+STREAM
+sec_recv()
 {
 	uint32 sec_flags;
 	STREAM s;
 
 	while ((s = mcs_recv()) != NULL)
 	{
-		in_uint32_le(s, sec_flags);
-
-		if (sec_flags & SEC_LICENCE_NEG)
+		if (use_encryption || !licence_issued)
 		{
-			licence_process(s);
-			continue;
-		}
+			in_uint32_le(s, sec_flags);
 
-		if (sec_flags & SEC_ENCRYPT)
-		{
-			in_uint8s(s, 8); /* signature */
-			sec_decrypt(s->p, s->end - s->p);
+			if (sec_flags & SEC_LICENCE_NEG)
+			{
+				licence_process(s);
+				continue;
+			}
+
+			if (sec_flags & SEC_ENCRYPT)
+			{
+				in_uint8s(s, 8);	/* signature */
+				sec_decrypt(s->p, s->end - s->p);
+			}
 		}
 
 		return s;
@@ -565,7 +599,8 @@
 }
 
 /* Establish a secure connection */
-BOOL sec_connect(char *server)
+BOOL
+sec_connect(char *server)
 {
 	struct stream mcs_data;
 
@@ -578,12 +613,14 @@
 		return False;
 
 	sec_process_mcs_data(&mcs_data);
-	sec_establish_key();
+	if (use_encryption)
+		sec_establish_key();
 	return True;
 }
 
 /* Disconnect a connection */
-void sec_disconnect()
+void
+sec_disconnect()
 {
 	mcs_disconnect();
 }