Subject: bug#27939: FreeRDP CVE-2017-2834 CVE-2017-2835 CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839

From: Thomas Danckaert <[email-masked]>
Date: Wed, 16 Aug 2017 22:37:40 +0200 (CEST)

From: Marius Bakke <[email-masked]>
Subject: Re: bug#27939: FreeRDP CVE-2017-2834 CVE-2017-2835 
CVE-2017-2836 CVE-2017-2837 CVE-2017-2838 CVE-2017-2839
Date: Wed, 09 Aug 2017 23:34:27 +0200

>> The alternative is to downgrade to [email-masked], or to disable rdp
>> from vinagre.  When I first submitted these packages, I ran into
>> trouble trying to build [email-masked], but I don't remember exactly
>> what the problem was :).
>
> I doubt many users of Guix use RDP, disabling it in Vinagre until it
> supports the new version of FreeRDP sounds reasonable to me. 
> Otherwise
> we're effectively "forking" FreeRDP, just for Vinagre.
>
> That said, since we have the backported patch already, I'm fine with
> either approach. But we should decide soon so Vinagre works again. 
> :-)
>
> The patch looks good to my untrained eyes.

With some delay... here's a patch to revert freerdp to the tip of 
upstream branch 1.1 (which includes the CVE fixes, backported by the 
FreeRDP maintainers), and allow vinagre to build against that.  
Vinagre is the only Guix package which uses freerdp, so I think it's 
ok to just have freerdp branch 1.1 for now (1.1 is also the last 
“stable” branch).

If you agree, I'll push this patch, and close this bug.

cheers,

Thomas
>From 66512fdd6e143bcb5debe84da502b480902d1244 Mon Sep 17 00:00:00 2001
From: Thomas Danckaert <[email-masked]>
Date: Wed, 16 Aug 2017 21:49:17 +0200
Subject: [PATCH] gnu: freerdp: Revert to version 1.1.

* gnu/packages/rdesktop.scm (freerdp) [version, source]: Revert to upstream
  branch 1.1.  [inputs]: Use ffmpeg-2.8.
* gnu/packages/gnome.scm (vinagre): Add patches required to build against
  freerdp branch 1.1.
* gnu/packages/patches/vinagre-revert-1.patch,
  gnu/packages/patches/vinagre-revert-2.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
---
 gnu/local.mk                                |   2 +
 gnu/packages/gnome.scm                      |   3 +
 gnu/packages/patches/vinagre-revert-1.patch |  56 ++++
 gnu/packages/patches/vinagre-revert-2.patch | 448 ++++++++++++++++++++++++++++
 gnu/packages/rdesktop.scm                   |  16 +-
 5 files changed, 518 insertions(+), 7 deletions(-)
 create mode 100644 gnu/packages/patches/vinagre-revert-1.patch
 create mode 100644 gnu/packages/patches/vinagre-revert-2.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 2ab6901d8..172e92c0a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1082,6 +1082,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/util-linux-tests.patch			\
   %D%/packages/patches/upower-builddir.patch			\
   %D%/packages/patches/valgrind-enable-arm.patch		\
+  %D%/packages/patches/vinagre-revert-1.patch                   \
+  %D%/packages/patches/vinagre-revert-2.patch                   \
   %D%/packages/patches/virglrenderer-CVE-2017-6386.patch 	\
   %D%/packages/patches/vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch		\
   %D%/packages/patches/vorbis-tools-CVE-2014-9640.patch		\
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index b362ba5e2..dab450acb 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -2123,6 +2123,9 @@ selection and URL hints.")))
               (uri (string-append "mirror://gnome/sources/" name "/"
                                   (version-major+minor version) "/"
                                   name "-" version ".tar.xz"))
+              (patches ; We have to revert 2 commits to build against freerdp 1.1.
+               (search-patches "vinagre-revert-1.patch"
+                               "vinagre-revert-2.patch"))
               (sha256
                (base32
                 "10jya3jyrm18nbw3v410gbkc7677bqamax44pzgd3j15randn76d"))))
diff --git a/gnu/packages/patches/vinagre-revert-1.patch b/gnu/packages/patches/vinagre-revert-1.patch
new file mode 100644
index 000000000..5a983770b
--- /dev/null
+++ b/gnu/packages/patches/vinagre-revert-1.patch
@@ -0,0 +1,56 @@
+Patch taken from Debian: revert changes that prevent building against freerdp
+version 1.1 branch.
+
+From 8ebc0685b85e0d1f70eb00171f2e7712de3d44bd Mon Sep 17 00:00:00 2001
+From: Michael Biebl <[email-masked]>
+Date: Thu, 22 Sep 2016 01:15:55 +0200
+Subject: [PATCH 1/2] Revert "Improve FreeRDP authentication failure handling"
+
+This reverts commit d7b4f88943e8615d252d27e1efc58cb64a9e1821.
+---
+ plugins/rdp/vinagre-rdp-tab.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/plugins/rdp/vinagre-rdp-tab.c b/plugins/rdp/vinagre-rdp-tab.c
+index b731f9b..8572bc3 100644
+--- a/plugins/rdp/vinagre-rdp-tab.c
++++ b/plugins/rdp/vinagre-rdp-tab.c
+@@ -1195,8 +1195,8 @@ open_freerdp (VinagreRdpTab *rdp_tab)
+   VinagreTab           *tab = VINAGRE_TAB (rdp_tab);
+   GtkWindow            *window = GTK_WINDOW (vinagre_tab_get_window (tab));
+   gboolean              success = TRUE;
++  gboolean              authentication_error = FALSE;
+   gboolean              cancelled = FALSE;
+-  guint                 authentication_errors = 0;
+ 
+   priv->events = g_queue_new ();
+ 
+@@ -1205,12 +1205,14 @@ open_freerdp (VinagreRdpTab *rdp_tab)
+ 
+   do
+     {
++      authentication_error = FALSE;
++
+       /* Run FreeRDP session */
+       success = freerdp_connect (priv->freerdp_session);
+       if (!success)
+         {
+-          authentication_errors += freerdp_get_last_error (priv->freerdp_session->context) == 0x20009 ||
+-                                   freerdp_get_last_error (priv->freerdp_session->context) == 0x2000c;
++          authentication_error = freerdp_get_last_error (priv->freerdp_session->context) == 0x20009 ||
++                                 freerdp_get_last_error (priv->freerdp_session->context) == 0x2000c;
+ 
+           cancelled = freerdp_get_last_error (priv->freerdp_session->context) == 0x2000b;
+ 
+@@ -1218,7 +1220,7 @@ open_freerdp (VinagreRdpTab *rdp_tab)
+           init_freerdp (rdp_tab);
+         }
+     }
+-  while (!success && authentication_errors < 3);
++  while (!success && authentication_error);
+ 
+   if (!success)
+     {
+-- 
+2.9.3
+
diff --git a/gnu/packages/patches/vinagre-revert-2.patch b/gnu/packages/patches/vinagre-revert-2.patch
new file mode 100644
index 000000000..686ee203e
--- /dev/null
+++ b/gnu/packages/patches/vinagre-revert-2.patch
@@ -0,0 +1,448 @@
+Patch taken from Debian: revert changes that prevent building against freerdp
+version 1.1 branch.
+
+From bb1828b6b7eb29bb037bcc687cf10f916ddc7561 Mon Sep 17 00:00:00 2001
+From: Michael Biebl <[email-masked]>
+Date: Thu, 22 Sep 2016 01:18:16 +0200
+Subject: [PATCH 2/2] Revert "Store credentials for RDP"
+
+This reverts commit 60dea279a24c7f0e398b89a0a60d45e80087ed1d.
+---
+ plugins/rdp/vinagre-rdp-connection.c |  22 +---
+ plugins/rdp/vinagre-rdp-plugin.c     |  29 +----
+ plugins/rdp/vinagre-rdp-tab.c        | 231 +++++++++++++++++------------------
+ 3 files changed, 123 insertions(+), 159 deletions(-)
+
+diff --git a/plugins/rdp/vinagre-rdp-connection.c b/plugins/rdp/vinagre-rdp-connection.c
+index f0ff02b..c5f6ed1 100644
+--- a/plugins/rdp/vinagre-rdp-connection.c
++++ b/plugins/rdp/vinagre-rdp-connection.c
+@@ -127,25 +127,9 @@ rdp_parse_item (VinagreConnection *conn, xmlNode *root)
+ static void
+ rdp_parse_options_widget (VinagreConnection *conn, GtkWidget *widget)
+ {
+-  const gchar *text;
+-  GtkWidget   *u_entry, *d_entry, *spin_button, *scaling_button;
+-  gboolean     scaling;
+-  guint        width, height;
+-
+-  d_entry = g_object_get_data (G_OBJECT (widget), "domain_entry");
+-  if (!d_entry)
+-    {
+-      g_warning ("Wrong widget passed to rdp_parse_options_widget()");
+-      return;
+-    }
+-
+-  text = gtk_entry_get_text (GTK_ENTRY (d_entry));
+-  vinagre_cache_prefs_set_string  ("rdp-connection", "domain", text);
+-
+-  g_object_set (conn,
+-		"domain", text != NULL && *text != '\0' ? text : NULL,
+-		NULL);
+-
++  GtkWidget *u_entry, *spin_button, *scaling_button;
++  gboolean   scaling;
++  guint      width, height;
+ 
+   u_entry = g_object_get_data (G_OBJECT (widget), "username_entry");
+   if (!u_entry)
+diff --git a/plugins/rdp/vinagre-rdp-plugin.c b/plugins/rdp/vinagre-rdp-plugin.c
+index 4751102..f41da37 100644
+--- a/plugins/rdp/vinagre-rdp-plugin.c
++++ b/plugins/rdp/vinagre-rdp-plugin.c
+@@ -100,7 +100,7 @@ vinagre_rdp_plugin_init (VinagreRdpPlugin *plugin)
+ static GtkWidget *
+ impl_get_connect_widget (VinagreProtocol *plugin, VinagreConnection *conn)
+ {
+-  GtkWidget *grid, *label, *u_entry, *d_entry, *spin_button, *check;
++  GtkWidget *grid, *label, *u_entry, *spin_button, *check;
+   gchar     *str;
+   gint       width, height;
+ 
+@@ -146,29 +146,10 @@ impl_get_connect_widget (VinagreProtocol *plugin, VinagreConnection *conn)
+   g_free (str);
+ 
+ 
+-  label = gtk_label_new_with_mnemonic (_("_Domain:"));
+-  gtk_misc_set_alignment (GTK_MISC (label), 0.0, 0.5);
+-  gtk_grid_attach (GTK_GRID (grid), label, 0, 3, 1, 1);
+-  gtk_widget_set_margin_left (label, 12);
+-
+-  d_entry = gtk_entry_new ();
+-  /* Translators: This is the tooltip for the domain field in a RDP connection */
+-  gtk_widget_set_tooltip_text (d_entry, _("Optional."));
+-  g_object_set_data (G_OBJECT (grid), "domain_entry", d_entry);
+-  gtk_grid_attach (GTK_GRID (grid), d_entry, 1, 3, 1, 1);
+-  gtk_label_set_mnemonic_widget (GTK_LABEL (label), d_entry);
+-  str = g_strdup (VINAGRE_IS_CONNECTION (conn) ?
+-		  vinagre_connection_get_domain (conn) :
+-		  vinagre_cache_prefs_get_string  ("rdp-connection", "domain", ""));
+-  gtk_entry_set_text (GTK_ENTRY (d_entry), str);
+-  gtk_entry_set_activates_default (GTK_ENTRY (d_entry), TRUE);
+-  g_free (str);
+-
+-
+   /* Host width */
+   label = gtk_label_new_with_mnemonic (_("_Width:"));
+   gtk_misc_set_alignment (GTK_MISC (label), 0.0, 0.5);
+-  gtk_grid_attach (GTK_GRID (grid), label, 0, 4, 1, 1);
++  gtk_grid_attach (GTK_GRID (grid), label, 0, 3, 1, 1);
+   gtk_widget_set_margin_left (label, 12);
+ 
+   spin_button = gtk_spin_button_new_with_range (MIN_SIZE, MAX_SIZE, 1);
+@@ -176,7 +157,7 @@ impl_get_connect_widget (VinagreProtocol *plugin, VinagreConnection *conn)
+   gtk_widget_set_tooltip_text (spin_button, _("Set width of the remote desktop"));
+   gtk_spin_button_set_value (GTK_SPIN_BUTTON (spin_button), DEFAULT_WIDTH);
+   g_object_set_data (G_OBJECT (grid), "width_spin_button", spin_button);
+-  gtk_grid_attach (GTK_GRID (grid), spin_button, 1, 4, 1, 1);
++  gtk_grid_attach (GTK_GRID (grid), spin_button, 1, 3, 1, 1);
+   gtk_label_set_mnemonic_widget (GTK_LABEL (label), spin_button);
+   width = VINAGRE_IS_CONNECTION (conn) ?
+           vinagre_connection_get_width (conn) :
+@@ -188,7 +169,7 @@ impl_get_connect_widget (VinagreProtocol *plugin, VinagreConnection *conn)
+   /* Host height */
+   label = gtk_label_new_with_mnemonic (_("_Height:"));
+   gtk_misc_set_alignment (GTK_MISC (label), 0.0, 0.5);
+-  gtk_grid_attach (GTK_GRID (grid), label, 0, 5, 1, 1);
++  gtk_grid_attach (GTK_GRID (grid), label, 0, 4, 1, 1);
+   gtk_widget_set_margin_left (label, 12);
+ 
+   spin_button = gtk_spin_button_new_with_range (MIN_SIZE, MAX_SIZE, 1);
+@@ -196,7 +177,7 @@ impl_get_connect_widget (VinagreProtocol *plugin, VinagreConnection *conn)
+   gtk_widget_set_tooltip_text (spin_button, _("Set height of the remote desktop"));
+   gtk_spin_button_set_value (GTK_SPIN_BUTTON (spin_button), DEFAULT_HEIGHT);
+   g_object_set_data (G_OBJECT (grid), "height_spin_button", spin_button);
+-  gtk_grid_attach (GTK_GRID (grid), spin_button, 1, 5, 1, 1);
++  gtk_grid_attach (GTK_GRID (grid), spin_button, 1, 4, 1, 1);
+   gtk_label_set_mnemonic_widget (GTK_LABEL (label), spin_button);
+   height = VINAGRE_IS_CONNECTION (conn) ?
+            vinagre_connection_get_height (conn) :
+diff --git a/plugins/rdp/vinagre-rdp-tab.c b/plugins/rdp/vinagre-rdp-tab.c
+index 8572bc3..f3d9c08 100644
+--- a/plugins/rdp/vinagre-rdp-tab.c
++++ b/plugins/rdp/vinagre-rdp-tab.c
+@@ -70,8 +70,6 @@ struct _VinagreRdpTabPrivate
+   gboolean         scaling;
+   double           scale;
+   double           offset_x, offset_y;
+-
+-  guint            authentication_attempts;
+ };
+ 
+ G_DEFINE_TYPE (VinagreRdpTab, vinagre_rdp_tab, VINAGRE_TYPE_TAB)
+@@ -611,7 +609,6 @@ frdp_post_connect (freerdp *instance)
+                               0, 0,
+                               gdi->width, gdi->height);
+ 
+-  vinagre_tab_save_credentials_in_keyring (VINAGRE_TAB (rdp_tab));
+   vinagre_tab_add_recent_used (VINAGRE_TAB (rdp_tab));
+   vinagre_tab_set_state (VINAGRE_TAB (rdp_tab), VINAGRE_TAB_STATE_CONNECTED);
+ 
+@@ -862,76 +859,114 @@ frdp_mouse_moved (GtkWidget      *widget,
+   return TRUE;
+ }
+ 
++static void
++entry_text_changed_cb (GtkEntry   *entry,
++                       GtkBuilder *builder)
++{
++  const gchar *text;
++  GtkWidget   *widget;
++  gsize        username_length;
++  gsize        password_length;
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "username_entry"));
++  text = gtk_entry_get_text (GTK_ENTRY (widget));
++  username_length = strlen (text);
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "password_entry"));
++  text = gtk_entry_get_text (GTK_ENTRY (widget));
++  password_length = strlen (text);
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "ok_button"));
++  gtk_widget_set_sensitive (widget, password_length > 0 && username_length > 0);
++}
++
+ static gboolean
+ frdp_authenticate (freerdp  *instance,
+                    char    **username,
+                    char    **password,
+                    char    **domain)
+ {
+-  VinagreTab           *tab = VINAGRE_TAB (((frdpContext *) instance->context)->rdp_tab);
+-  VinagreRdpTab        *rdp_tab = VINAGRE_RDP_TAB (tab);
+-  VinagreRdpTabPrivate *priv = rdp_tab->priv;
+-  VinagreConnection    *conn = vinagre_tab_get_conn (tab);
+-  GtkWindow            *window = GTK_WINDOW (vinagre_tab_get_window (tab));
+-  gboolean              save_in_keyring = FALSE;
+-  gchar                *keyring_domain = NULL;
+-  gchar                *keyring_username = NULL;
+-  gchar                *keyring_password = NULL;
++  VinagreTab        *tab = VINAGRE_TAB (((frdpContext *) instance->context)->rdp_tab);
++  VinagreConnection *conn = vinagre_tab_get_conn (tab);
++  const gchar       *user_name;
++  const gchar       *domain_name;
++  GtkBuilder        *builder;
++  GtkWidget         *dialog;
++  GtkWidget         *widget;
++  GtkWidget         *username_entry;
++  GtkWidget         *password_entry;
++  GtkWidget         *domain_entry;
++  gboolean           save_credential_check_visible;
++  gboolean           domain_label_visible;
++  gboolean           domain_entry_visible;
++  gint               response;
+ 
+-  priv->authentication_attempts++;
++  builder = vinagre_utils_get_builder ();
+ 
+-  if (priv->authentication_attempts == 1)
+-    {
+-      vinagre_tab_find_credentials_in_keyring (tab, &keyring_domain, &keyring_username, &keyring_password);
+-      if (keyring_password != NULL && keyring_username != NULL)
+-        {
+-          *domain = keyring_domain;
+-          *username = keyring_username;
+-          *password = keyring_password;
++  dialog = GTK_WIDGET (gtk_builder_get_object (builder, "auth_required_dialog"));
++  gtk_window_set_modal ((GtkWindow *) dialog, TRUE);
++  gtk_window_set_transient_for ((GtkWindow *) dialog, GTK_WINDOW (vinagre_tab_get_window (tab)));
+ 
+-          return TRUE;
+-        }
+-      else
+-        {
+-          g_free (keyring_domain);
+-          g_free (keyring_username);
+-          g_free (keyring_password);
+-        }
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "host_label"));
++  gtk_label_set_text (GTK_LABEL (widget), vinagre_connection_get_host (conn));
++
++  username_entry = GTK_WIDGET (gtk_builder_get_object (builder, "username_entry"));
++  password_entry = GTK_WIDGET (gtk_builder_get_object (builder, "password_entry"));
++  domain_entry = GTK_WIDGET (gtk_builder_get_object (builder, "domain_entry"));
++
++  if (*username != NULL && *username[0] != '\0')
++    {
++      gtk_entry_set_text (GTK_ENTRY (username_entry), *username);
++      gtk_widget_grab_focus (password_entry);
+     }
+ 
+-  if (vinagre_utils_request_credential (window,
+-                                        "RDP",
+-                                        vinagre_connection_get_host (conn),
+-                                        vinagre_connection_get_domain (conn),
+-                                        vinagre_connection_get_username (conn),
+-                                        TRUE,
+-                                        TRUE,
+-                                        TRUE,
+-                                        20,
+-                                        domain,
+-                                        username,
+-                                        password,
+-                                        &save_in_keyring))
++  g_signal_connect (username_entry, "changed", G_CALLBACK (entry_text_changed_cb), builder);
++  g_signal_connect (password_entry, "changed", G_CALLBACK (entry_text_changed_cb), builder);
++
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "save_credential_check"));
++  save_credential_check_visible = gtk_widget_get_visible (widget);
++  gtk_widget_set_visible (widget, FALSE);
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "domain_label"));
++  domain_label_visible = gtk_widget_get_visible (widget);
++  gtk_widget_set_visible (widget, TRUE);
++
++  domain_entry_visible = gtk_widget_get_visible (domain_entry);
++  gtk_widget_set_visible (domain_entry, TRUE);
++
++
++  response = gtk_dialog_run (GTK_DIALOG (dialog));
++  gtk_widget_hide (dialog);
++
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "save_credential_check"));
++  gtk_widget_set_visible (widget, save_credential_check_visible);
++
++  widget = GTK_WIDGET (gtk_builder_get_object (builder, "domain_label"));
++  gtk_widget_set_visible (widget, domain_label_visible);
++
++  gtk_widget_set_visible (domain_entry, domain_entry_visible);
++
++
++  if (response == GTK_RESPONSE_OK)
+     {
+-      if (*domain && **domain != '\0')
+-        vinagre_connection_set_domain (conn, *domain);
++      domain_name = gtk_entry_get_text (GTK_ENTRY (domain_entry));
++      if (g_strcmp0 (*domain, domain_name) != 0)
++        *domain = g_strdup (domain_name);
+ 
+-      if (*username && **username != '\0')
+-        vinagre_connection_set_username (conn, *username);
++      user_name = gtk_entry_get_text (GTK_ENTRY (username_entry));
++      if (g_strcmp0 (*username, user_name) != 0)
++        *username = g_strdup (user_name);
+ 
+-      if (*password && **password != '\0')
+-        vinagre_connection_set_password (conn, *password);
++      *password = g_strdup (gtk_entry_get_text (GTK_ENTRY (password_entry)));
+ 
+-      vinagre_tab_set_save_credentials (tab, save_in_keyring);
++      return TRUE;
+     }
+   else
+     {
+-      vinagre_tab_remove_from_notebook (tab);
+-
+       return FALSE;
+     }
+-
+-  return TRUE;
+ }
+ 
+ static BOOL
+@@ -1028,25 +1063,30 @@ frdp_changed_certificate_verify (freerdp *instance,
+ #endif
+ 
+ static void
+-init_freerdp (VinagreRdpTab *rdp_tab)
++open_freerdp (VinagreRdpTab *rdp_tab)
+ {
+   VinagreRdpTabPrivate *priv = rdp_tab->priv;
+-  rdpSettings          *settings;
+   VinagreTab           *tab = VINAGRE_TAB (rdp_tab);
+   VinagreConnection    *conn = vinagre_tab_get_conn (tab);
+-  gboolean              scaling;
+-  gchar                *hostname;
+-  gint                  width, height;
+-  gint                  port;
++  rdpSettings          *settings;
++  GtkWindow            *window = GTK_WINDOW (vinagre_tab_get_window (tab));
++  gboolean              success = TRUE;
++  gboolean              fullscreen, scaling;
++  gchar                *hostname, *username;
++  gint                  port, width, height;
+ 
+   g_object_get (conn,
+                 "port", &port,
+                 "host", &hostname,
+                 "width", &width,
+                 "height", &height,
++                "fullscreen", &fullscreen,
+                 "scaling", &scaling,
++                "username", &username,
+                 NULL);
+ 
++  priv->events = g_queue_new ();
++
+   /* Setup FreeRDP session */
+   priv->freerdp_session = freerdp_new ();
+   priv->freerdp_session->PreConnect = frdp_pre_connect;
+@@ -1111,6 +1151,17 @@ init_freerdp (VinagreRdpTab *rdp_tab)
+   settings->port = port;
+ #endif
+ 
++  /* Set username */
++  username = g_strstrip (username);
++  if (username != NULL && username[0] != '\0')
++    {
++#if HAVE_FREERDP_1_1
++      settings->Username = g_strdup (username);
++#else
++      settings->username = g_strdup (username);
++#endif
++    }
++
+   /* Set keyboard layout */
+ #if HAVE_FREERDP_1_1
+   freerdp_keyboard_init (KBD_US);
+@@ -1120,24 +1171,6 @@ init_freerdp (VinagreRdpTab *rdp_tab)
+ 
+   /* Allow font smoothing by default */
+   settings->AllowFontSmoothing = TRUE;
+-}
+-
+-static void
+-init_display (VinagreRdpTab *rdp_tab)
+-{
+-  VinagreRdpTabPrivate *priv = rdp_tab->priv;
+-  VinagreTab           *tab = VINAGRE_TAB (rdp_tab);
+-  VinagreConnection    *conn = vinagre_tab_get_conn (tab);
+-  GtkWindow            *window = GTK_WINDOW (vinagre_tab_get_window (tab));
+-  gboolean              fullscreen, scaling;
+-  gint                  width, height;
+-
+-  g_object_get (conn,
+-                "width", &width,
+-                "height", &height,
+-                "fullscreen", &fullscreen,
+-                "scaling", &scaling,
+-                NULL);
+ 
+   /* Setup display for FreeRDP session */
+   priv->display = gtk_drawing_area_new ();
+@@ -1186,54 +1219,20 @@ init_display (VinagreRdpTab *rdp_tab)
+   priv->key_release_handler_id = g_signal_connect (GTK_WIDGET (tab), "key-release-event",
+                                                    G_CALLBACK (frdp_key_pressed),
+                                                    rdp_tab);
+-}
+-
+-static void
+-open_freerdp (VinagreRdpTab *rdp_tab)
+-{
+-  VinagreRdpTabPrivate *priv = rdp_tab->priv;
+-  VinagreTab           *tab = VINAGRE_TAB (rdp_tab);
+-  GtkWindow            *window = GTK_WINDOW (vinagre_tab_get_window (tab));
+-  gboolean              success = TRUE;
+-  gboolean              authentication_error = FALSE;
+-  gboolean              cancelled = FALSE;
+-
+-  priv->events = g_queue_new ();
+-
+-  init_freerdp (rdp_tab);
+-  init_display (rdp_tab);
+-
+-  do
+-    {
+-      authentication_error = FALSE;
+ 
+-      /* Run FreeRDP session */
+-      success = freerdp_connect (priv->freerdp_session);
+-      if (!success)
+-        {
+-          authentication_error = freerdp_get_last_error (priv->freerdp_session->context) == 0x20009 ||
+-                                 freerdp_get_last_error (priv->freerdp_session->context) == 0x2000c;
+-
+-          cancelled = freerdp_get_last_error (priv->freerdp_session->context) == 0x2000b;
+-
+-          freerdp_free (priv->freerdp_session);
+-          init_freerdp (rdp_tab);
+-        }
+-    }
+-  while (!success && authentication_error);
++  /* Run FreeRDP session */
++  success = freerdp_connect (priv->freerdp_session);
+ 
+   if (!success)
+     {
+       gtk_window_unfullscreen (window);
+-      if (!cancelled)
+-        vinagre_utils_show_error_dialog (_("Error connecting to host."),
+-                                         NULL,
+-                                         window);
++      vinagre_utils_show_error_dialog (_("Error connecting to host."),
++                                       NULL,
++                                       window);
+       g_idle_add ((GSourceFunc) idle_close, rdp_tab);
+     }
+   else
+     {
+-      priv->authentication_attempts = 0;
+       priv->update_id = g_idle_add ((GSourceFunc) update, rdp_tab);
+     }
+ }
+-- 
+2.9.3
+
diff --git a/gnu/packages/rdesktop.scm b/gnu/packages/rdesktop.scm
index 7946cde79..cf69cdaa2 100644
--- a/gnu/packages/rdesktop.scm
+++ b/gnu/packages/rdesktop.scm
@@ -72,14 +72,16 @@ to remotely control a user's Windows desktop.")
 (define-public freerdp
   (package
     (name "freerdp")
-    (version "2.0.0-rc0")
+    (version "1.1.0-beta")
     (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/FreeRDP/FreeRDP/archive/"
-                                  version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference
+                    ;; We need the 1.1 branch for RDP support in vinagre.
+                    (url "git://github.com/FreeRDP/FreeRDP.git")
+                    (commit "03ab68318966c3a22935a02838daaea7b7fbe96c")))
+              (file-name (git-file-name name version))
               (sha256
-               (base32 "0r36zwhl7fhmdng5pvl2a106gqbcqq184g2i2klz6ilna8pxjcml"))))
+               (base32 "07ish8rmvbk2zd99k91qybmmh5h4afly75l5kbvslhq1r6k8pbmp"))))
     (build-system cmake-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -98,7 +100,7 @@ to remotely control a user's Windows desktop.")
        ("libxml2" ,libxml2)
        ("libxslt" ,libxslt)
        ("cups" ,cups)
-       ("ffmpeg" ,ffmpeg)
+       ("ffmpeg" ,ffmpeg-2.8)
        ("pulseaudio" ,pulseaudio)
        ("alsa-lib" ,alsa-lib)
        ("gstreamer" ,gstreamer)
-- 
2.13.3