feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

rust/core/src/clients/rdp.rs

@@ -467,6 +467,34 @@ fn copy_rect(image: &DecodedImage, fb: &mut Framebuffer, left: u16, top: u16, ri
     fb.dirty = true;
 }
 
+/// A transport through an RD Gateway (MS-TSGU over HTTPS WebSocket, Basic authentication). The
+/// gateway's certificate is verified against the web PKI. The async gateway stream is bridged to
+/// a loopback socket so the blocking RDP client can use it like any other connection.
+pub fn gateway_dial(endpoint: String, user: String, password: zeroize::Zeroizing<String>, server: String, port: u16) -> Dial {
+    Arc::new(move || {
+        let endpoint = if endpoint.contains(':') { endpoint.clone() } else { format!("{endpoint}:443") };
+        let target = ironrdp_mstsgu::GwConnectTarget {
+            gw_endpoint: endpoint,
+            gw_user: user.clone(),
+            gw_pass: password.to_string(),
+            server: server.clone(),
+            server_port: port,
+        };
+        let (gw, _) = super::rt()
+            .block_on(ironrdp_mstsgu::GwClient::connect(&target, "Nexus Terminal"))
+            .map_err(|e| format!("RD Gateway {}: {}", target.gw_endpoint, error_chain(&e)))?;
+        let (client, server_end) = super::ssh::loopback_pair()?;
+        server_end.set_nonblocking(true)?;
+        super::rt().spawn(async move {
+            if let Ok(mut local) = tokio::net::TcpStream::from_std(server_end) {
+                let mut gw = gw;
+                let _ = tokio::io::copy_bidirectional(&mut local, &mut gw).await;
+            }
+        });
+        Ok(client)
+    })
+}
+
 /// `SHA256:<unpadded base64>` of the certificate, the format SSH host keys use.
 pub fn fingerprint(cert_der: &[u8]) -> String {
     use base64::Engine;
@@ -544,10 +572,14 @@ impl connector::sspi::network_client::NetworkClient for NoNetwork {
     }
 }
 
-/// Connector errors carry their cause in a chain; surface the useful part.
+/// IronRDP errors carry their cause in a chain; surface the useful part.
 fn describe(e: &connector::ConnectorError) -> String {
+    error_chain(e)
+}
+
+fn error_chain(e: &dyn std::error::Error) -> String {
     let mut s = e.to_string();
-    let mut src = std::error::Error::source(e);
+    let mut src = e.source();
     while let Some(c) = src {
         s = format!("{s}: {c}");
         src = c.source();

rust/core/src/models.rs

@@ -418,6 +418,10 @@ pub struct RdpConfig {
     /// Trust policy for the server's TLS certificate (pinned like an SSH host key).
     #[serde(deserialize_with = "lenient")]
     pub host_key_policy: HostKeyPolicy,
+    /// RD Gateway (`host` or `host:port`, HTTPS); empty connects without one. Basic auth only.
+    pub gateway_host: String,
+    pub gateway_username: String,
+    pub gateway_secret_mode: SecretMode,
     /// "none", "socks5" or "http"; the password is a stored secret.
     pub proxy_type: String,
     pub proxy_host: String,

rust/core/src/secrets.rs

@@ -34,12 +34,13 @@ pub enum SecretKind {
     RdpPassword,
     RdpSshPassword,
     RdpSshPassphrase,
+    RdpGatewayPassword,
 }
 
 impl SecretKind {
     /// Every kind, so deleting a profile can purge them all from the keychain. A new variant
     /// must be added here as well as to `as_str`.
-    pub const ALL: [SecretKind; 15] = [
+    pub const ALL: [SecretKind; 16] = [
         Self::Password,
         Self::Passphrase,
         Self::Totp,
@@ -55,6 +56,7 @@ impl SecretKind {
         Self::RdpPassword,
         Self::RdpSshPassword,
         Self::RdpSshPassphrase,
+        Self::RdpGatewayPassword,
     ];
 
     /// The storage name, shared with the Go app.
@@ -75,6 +77,7 @@ impl SecretKind {
             Self::RdpPassword => "rdp-password",
             Self::RdpSshPassword => "rdp-ssh-password",
             Self::RdpSshPassphrase => "rdp-ssh-passphrase",
+            Self::RdpGatewayPassword => "rdp-gateway-password",
         }
     }
 

rust/core/src/sessions/protocols.rs

@@ -315,12 +315,17 @@ impl Manager {
     ) -> Result<Arc<clients::rdp::Client>> {
         let timeout = Duration::from_secs(p.connect_timeout.max(1) as u64);
         let host = p.host.clone();
-        let dial: clients::rdp::Dial = match tunnel {
-            Some(t) => {
+        let gateway = (!rc.gateway_host.trim().is_empty()).then(|| rc.gateway_host.trim().to_string());
+        let dial: clients::rdp::Dial = match (tunnel, gateway) {
+            (_, Some(gw)) => {
+                let pw = self.secret_fn(id, &p.id, SecretKind::RdpGatewayPassword, rc.gateway_secret_mode, prompt.clone())()?;
+                clients::rdp::gateway_dial(gw, rc.gateway_username.clone(), pw, host.clone(), port)
+            }
+            (Some(t), None) => {
                 let h = host.clone();
                 Arc::new(move || t.open_tunnel(&h, port))
             }
-            None => {
+            (None, None) => {
                 let proxy = clients::proxy::Proxy {
                     kind: rc.proxy_type.clone(),
                     host: rc.proxy_host.clone(),

rust/core/src/validation.rs

@@ -334,6 +334,16 @@ pub fn validate_rdp_config(cfg: &RdpConfig) -> Result<(), ValidationErrors> {
         }
         t => errs.add("rdp.proxyType", format!("unsupported proxy type {t:?}")),
     }
+    if !cfg.gateway_host.trim().is_empty() {
+        let host = cfg.gateway_host.trim().rsplit_once(':').filter(|(_, p)| p.parse::<u16>().is_ok()).map_or(cfg.gateway_host.trim(), |(h, _)| h);
+        errs.check("rdp.gatewayHost", validate_host(host));
+        if cfg.gateway_username.trim().is_empty() {
+            errs.add("rdp.gatewayUsername", "the gateway needs a username");
+        }
+        if cfg.ssh_tunnel || !matches!(cfg.proxy_type.as_str(), "" | "none") {
+            errs.add("rdp.gatewayHost", "use a gateway, a proxy or an SSH tunnel — only one");
+        }
+    }
     let share = cfg.shared_folder.trim();
     if !share.is_empty() && !std::path::Path::new(share).is_dir() {
         errs.add("rdp.sharedFolder", "the shared folder must be an existing folder");