Re: Testers for load balancing code wanted

My workplace is using "Windows Server 2008 R2 Enterprise" RDP load balancing.
I checked out r1555 from svn, and it has the same problem 1.6.0 has for me,
random crashes when recieving a redirect.

It looks like the expected redirect packet does not match what I actually get.
I added debugging to rdesktop.c to print out the redirect variables.

$ ./rdesktop $RDPCLUSTER
Autoselected keyboard map en-us
WARNING: Remote desktop does not support colour depth 24; falling back to 16
WARNING: server sent an unexpectedly long string, truncating
WARNING: server sent an unexpectedly long string, truncating
redirect domain = [random chineese characters], user = DATA, pass = , server = 192.168.128.34
Segmentation fault

"DATA" is the first four characters of my company's domain.

Next step, I modified rdp.c to dump the buffer one byte at a time, inside
[]'s.  I've taken the code comments and placed them next to the buffers.  In
the case of expecting a string, I've converted it to ascii inside a "".  I
added my own comments as //

[173][100]      /* these 2 bytes are unknown, seem to be zeros */

[13][0][0][0]   /* read connection flags */

[30][0][0][0]   /* read length of ip string */

[49][0][57][0][50][0][46][0][49][0][54][0][56][0][46][0][49][0][50][0][56][0][46][0][51][0][52][0][0][0]
/* read ip string */
"192.168.128.34\0"  // this is correct

[10][0][0][0] /* read length of cookie string */

[97][0][98][0][111][0][98][0][0][0] /* read cookie string (plain ASCII) */
"abob\0" // this is my username

[28][0][0][0] /* read length of username string */

[68][0][65][0][84][0][65][0][80][0][73][0][80][0][69][0][45][0][67][0][79][0][82][0][80][0][0][0]
/* read username string */
"[skipped to leave out of archives]" // this is the company's domain name

[144][15][32][0] /* read length of domain string */
// uh oh, that's way too big.

[0][0][0][0][199] /* read domain string */
// end of buffer

/* read length of password string */
// segfault somewhere around here

Attached is a patch to work around this.  With this patch, I'm able to connect
and login (without this patch, it's random chance if I can login or not).
What's not right about the patch is it's not backwards compatible.  Maybe the
first two bytes could be used to detect the two formats?  Also, I don't know
what the last 9 bytes signify.

------------------------------------------------------------------------------
Throughout its 18-year history, RSA Conference consistently attracts the
world's best and brightest in the field, creating opportunities for Conference
attendees to learn about information security's most important issues through
interactions with peers, luminaries and emerging and established companies.
http://p.sf.net/sfu/rsaconf-dev2dev

_______________________________________________
rdesktop-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/rdesktop-devel

Index: rdp.c
===================================================================
--- rdp.c	(revision 1555)
+++ rdp.c	(working copy)
@@ -1486,25 +1486,6 @@
 	/* read ip string */
 	rdp_in_unistr(s, g_redirect_server, sizeof(g_redirect_server), len);
 
-	/* read length of cookie string */
-	in_uint32_le(s, len);
-
-	/* read cookie string (plain ASCII) */
-	if (len > sizeof(g_redirect_cookie) - 1)
-	{
-		uint32 rem = len - (sizeof(g_redirect_cookie) - 1);
-		len = sizeof(g_redirect_cookie) - 1;
-
-		warning("Unexpectedly large redirection cookie\n");
-		in_uint8a(s, g_redirect_cookie, len);
-		in_uint8s(s, rem);
-	}
-	else
-	{
-		in_uint8a(s, g_redirect_cookie, len);
-	}
-	g_redirect_cookie[len] = 0;
-
 	/* read length of username string */
 	in_uint32_le(s, len);
 
@@ -1518,12 +1499,6 @@
 	/* read domain string */
 	rdp_in_unistr(s, g_redirect_domain, sizeof(g_redirect_domain), len);
 
-	/* read length of password string */
-	in_uint32_le(s, len);
-
-	/* read password string */
-	rdp_in_unistr(s, g_redirect_password, sizeof(g_redirect_password), len);
-
 	g_redirect = True;
 
 	return True;