feat(core): RDP client on IronRDP

clients::rdp connects over any caller-dialled TCP stream (direct, proxy or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM), optionally falling back to TLS-only logon for servers without NLA such as xrdp (credentials are passed so they log straight in). The server certificate is pinned through a caller check on its SHA256 fingerprint before any credentials are sent. The desktop decodes into the VNC client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse operations), Display Control resizes and the deactivation-reactivation sequence run on the session thread. IronRDP's releases need three vendored patches (vendor/README.md): picky and sspi with their RustCrypto release-candidate pins relaxed so they share russh's stable versions (their own suites, 402 tests, pass against them), and ironrdp-session with two unreleased upstream bitmap fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops render sheared. Verified live against xrdp (scottyhardy/docker-remote-desktop): logon, full desktop rendering, keyboard and mouse input.
2026-10-12 10:50:24 +01:00
parent 6a4d7381d9
commit 50c0104d57
227 changed files with 66687 additions and 20 deletions
@@ -0,0 +1,55 @@
+use picky_krb::constants::key_usages::{ACCEPTOR_SEAL, INITIATOR_SEAL};
+use picky_krb::crypto::CipherSuite;
+use picky_krb::crypto::aes::AesSize;
+
+use crate::Secret;
+
+#[derive(Debug, Clone)]
+pub struct EncryptionParams {
+    pub encryption_type: Option<CipherSuite>,
+    pub session_key: Option<Secret<Vec<u8>>>,
+    pub sub_session_key: Option<Secret<Vec<u8>>>,
+    pub sspi_encrypt_key_usage: i32,
+    pub sspi_decrypt_key_usage: i32,
+    /// EC field of the Kerberos Wrap token.
+    ///
+    /// Related documentation:
+    /// * [RFC 4121: EC Field](https://www.rfc-editor.org/rfc/rfc4121#section-4.2.3).
+    /// * [3.4.5.4.1 Kerberos Binding of GSS_WrapEx()](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/e94b3acd-8415-4d0d-9786-749d0c39d550).
+    ///
+    /// This value is different during RDP and RPC authentication.
+    /// We negotiate it during the authentication process.
+    pub ec: u16,
+}
+
+impl EncryptionParams {
+    pub fn default_for_client() -> Self {
+        Self {
+            encryption_type: None,
+            session_key: None,
+            sub_session_key: None,
+            sspi_encrypt_key_usage: INITIATOR_SEAL,
+            sspi_decrypt_key_usage: ACCEPTOR_SEAL,
+            ec: 0,
+        }
+    }
+
+    pub fn default_for_server() -> Self {
+        Self {
+            encryption_type: None,
+            session_key: None,
+            sub_session_key: None,
+            sspi_encrypt_key_usage: ACCEPTOR_SEAL,
+            sspi_decrypt_key_usage: INITIATOR_SEAL,
+            ec: 0,
+        }
+    }
+
+    pub fn aes_size(&self) -> Option<AesSize> {
+        self.encryption_type.as_ref().and_then(|e_type| match e_type {
+            CipherSuite::Aes256CtsHmacSha196 => Some(AesSize::Aes256),
+            CipherSuite::Aes128CtsHmacSha196 => Some(AesSize::Aes128),
+            CipherSuite::Des3CbcSha1Kd => None,
+        })
+    }
+}