feat(rdp): RD Gateway transport (experimental)

RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.

IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).

This commit is contained in:

Andy Dixon

2026-10-12 18:26:45 +01:00

parent 2fa56e0723

commit ae2b07db4b

20 changed files with 2820 additions and 7 deletions

									
										rust/fuzz/Cargo.toml
									
		+1
		
												View File
												
				@@ -20,6 +20,7 @@ members = ["."]

				picky = { path = "../vendor/picky" }

				sspi = { path = "../vendor/sspi" }

				ironrdp-session = { path = "../vendor/ironrdp-session" }

				ironrdp-mstsgu = { path = "../vendor/ironrdp-mstsgu" }

				[profile.release]

				debug = 1