Re: [rdesktop-devel] RDPPROXY issue with rdp 5.2

[Jeroen M. <je...@ol...>]

Hi Matthias,

You can use the mstsc client that came with Windows XP RTM with rdpproxy. It does smart card redirection too.

The difference between scard redirection and the rest of the redirection protocols is that the rest is based on redirection at the device driver interface level (IRP's). Smart card redirection however, is a client/server protocol, communicating with the smart card resource manager at the client.

I've seen the following smart card requests (encoded as device control irps):

5: SCardEstablishContext
6: SCardReleaseContext
8: SCardListReaderGroups
10: SCardListReadersA
11: SCardListReadersW
38: SCardLocateCardsA
39: SCardLocateCardsW
40: SCardGetStatusChangeA
41: SCardGetStatusChangeW
42: SCardCancel
43: SCardConnect
46: SCardDisconnect
50: SCardStatus
52: SCardTransmit
53: SCardControl
54: SCardGetAttrib
56: SCardAccessStartedEvent

The parameters for the functions are NDR encoded (like in DCE/RPC). To handle this properly we should have serialization (marshalling) code for rdesktop. But that's not trivial.

So I guess 2 things need to be done:

1) Build NDR serialization routines.
2) Reverse engineer the IDL that MS used for Smart Card Redirection by looking at the wiresniffs.

The rest is probably not that difficult.

Jeroen


On Tue, Feb 08, 2005 at 03:40:22PM +0100, Matthias Winkler wrote:
> Hi,
> 
> I try to reverse engineere the smartcard-rpd-channel of
> the rpd protocoll. Therefore I'd like to use "rdpproxy"
> to grap the communication between a rdp-server and
> rdp-client:
> 
> Windows 2003 <=====> RDP PROXY <=====> Windows 2003
> RDP-Client                              RDP-Server
> 
> 
> 
> When I use rdesktop over rdpproxy then I'm able to connect to
> my Windows 2003 Server.
> BUT when I use an rdp Windows 2003 rdp-Client the connection
> fails.
> rdpproxy says (connectin reset by peer): 
> 
>   ...
>   0f0 52 1c 2f 53 a5 93 69 ba 62 42 ac 99 4f ff 36 48 R./S..i.bB..O.6H
>   0100 d3 d6 f4 4d ea 6b 6c cc 94 af 16 50 3c 74 44 d0 ...M.kl....P<tD.
>   0110 0c c9 75 d4 e7 a3 89 e9 33 2c 12 ee 33 f1 de 45 ..u.....3,..3..E
>   0120 da 44 06 a8 ed f3 96 a2 ce 07 02 1f 06 f8 01 c8 .D..............
>   0130 41 64 57 6f 40 2c af e1 ff d6 b6 5f e3 95 29 7b AdWo@,....._..){
>   0140 dd f3 2d 19 fb 8f 1d 29 84 87 57 07 bc 73 0c 76 ..-....)..W..s.v
>   0150 58 06 a8 ea ff 0b 19 68 d1 4c a9 1d 1a b0 2f    X......h.L..../
>   #20, #9 from Server, type TPKT, l: 48, read 48 bytes
>   Can't decrypt, haven't seen client random!
>   0000 03 00 00 30 02 f0 80 68 00 01 03 eb 30 22 08 00 ...0...h....0"..
>   0010 10 00 e4 4c 69 58 43 d5 8b 91 8f e4 de c4 d1 3c ...LiXC........<
>   0020 b7 5b de ff b2 e8 90 91 9d e6 9b 6f 92 f8 09 d6 .[.........o....
>   server recv: Connection reset by peer 
> 
> 
> the eventlog of my windows 2003 server says:
> "Die RDP-Protokollkomponente "DATA ENCRYPTION" hat einen Fehler im
> Protokollablauf festgestellt und die Clientverbindung getrennt"
> what means: 
> ~"The RDP-Protocoll Part "DATA ENCRYPTION" has recognized an error in the
> protocol flow and has disconncted the client"
> 
> Then I compiled the rdpproxy-source to use the 
> "stolen" rdp-server-key (via lsadump2.exe). 
> I could start the new rdpproxy-binary but when 
> I connect the client to the proxy then rdpproxy 
> crashes with "segemntation fault".
> 
> 	
> So, now my questions:
> 
> 1) Any Idea what might be wrong?
> 
> 
> 2) Will rdpproxy work with the actual 
> rdp 5.2-protocol (w2k3) at all?
> 
> 
> 3) When not, is there a way to adapt it 
> using the acutal rdesktop sources?
> 
> 
> 4) Might rdp 5.2 use client-authentication 
> with certificates (just a guess)?
> 
> 
> 5) Why crashes the rdpproxy with the "stolen" 
> rdp-server-key (via lsadump2.exe)
> 
> 
> 6) Can anyone recommend me a "working" 
> rdpproxy-setup with rdp 5.2(e.g. with 2000/XP???) 
> 
>  
> 
> -- 
> DSL Komplett von GMX +++ Superg?nstig und stressfrei einsteigen!
> AKTION "Kein Einrichtungspreis" nutzen: http://www.gmx.net/de/go/dsl
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> rdesktop-devel mailing list
> rde...@li...
> https://lists.sourceforge.net/lists/listinfo/rdesktop-devel