feat(core): RDP client on IronRDP

clients::rdp connects over any caller-dialled TCP stream (direct, proxy
or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM),
optionally falling back to TLS-only logon for servers without NLA such
as xrdp (credentials are passed so they log straight in). The server
certificate is pinned through a caller check on its SHA256 fingerprint
before any credentials are sent. The desktop decodes into the VNC
client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse
operations), Display Control resizes and the deactivation-reactivation
sequence run on the session thread.

IronRDP's releases need three vendored patches (vendor/README.md):
picky and sspi with their RustCrypto release-candidate pins relaxed so
they share russh's stable versions (their own suites, 402 tests, pass
against them), and ironrdp-session with two unreleased upstream bitmap
fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops
render sheared.

Verified live against xrdp (scottyhardy/docker-remote-desktop): logon,
full desktop rendering, keyboard and mouse input.
This commit is contained in:
Andy Dixon
2026-10-12 10:50:24 +01:00
parent 6a4d7381d9
commit 50c0104d57
227 changed files with 66687 additions and 20 deletions
@@ -0,0 +1,39 @@
using System.Text.Json;
using System.Text.Json.Serialization;
namespace AADJoin.Messages
{
public class JoinDeviceResponse
{
public class Cert
{
[JsonInclude]
public string Thumbprint { get; set; }
[JsonInclude]
public string RawBody { get; set; }
}
public class Usr
{
[JsonInclude]
public string Upn { get; set; }
}
public class MembershipChgs
{
[JsonInclude]
public string LocalSID { get; set; }
[JsonInclude]
public string[] AddSIDs { get; set; }
}
public Cert Certificate { get; set; }
public Usr User { get; set; }
public MembershipChgs[] MembershipChanges { get; set; }
public static JoinDeviceResponse FromString(string data)
{
return JsonSerializer.Deserialize<JoinDeviceResponse>(data);
}
}
}