Andy Dixon
ae2b07db4b
RDP profiles can go through a Remote Desktop Gateway (MS-TSGU over an
HTTPS WebSocket) with its own username and password, stored like other
credentials (rdp-gateway-password). The gateway stream is bridged to a
loopback socket so the blocking RDP client uses it like any transport.
IronRDP's gateway crate (0.0.1) is vendored with fixes: it used
ironrdp-tls, which accepts any certificate, before sending Basic
credentials — the gateway is now verified against the web PKI; its
asserts on gateway-supplied lengths are errors instead of panics; and
the server port is passed through. Checked against a self-signed
openssl s_server: the connection is refused ('invalid peer certificate')
before any request or credential is sent. Not tested against a real
gateway; Basic-auth gateways only (no NTLM).
1.6 KiB
1.6 KiB
Vendored crates
Patched copies used through [patch.crates-io] in rust/Cargo.toml. Remove each once an
IronRDP release includes the fix it carries.
| Crate | Upstream | Change |
|---|---|---|
picky |
7.0.0-rc.25 (crates.io) | =x.y.z-rc.N RustCrypto pins relaxed to ^x.y.z-rc.N (so the stable releases russh uses satisfy them); one unused import removed. |
sspi |
0.21.3 (crates.io) | Same pin relaxation. |
ironrdp-mstsgu |
0.0.1 (crates.io) | RD Gateway client. Upstream connects with ironrdp-tls, which accepts any certificate, and then sends Basic credentials; the patch verifies the gateway against the web PKI (rustls/ring + webpki-roots). Its assert!s and unchecked length subtractions on gateway packets become errors, and the RDP server's port is passed through instead of a fixed 3389. |
ironrdp-session |
0.11.0 (crates.io) | Upstream fixes not yet released: #1486 "preserve bitmap source stride" (commit 80bb81b344, applied as-is) and the RDP6 orientation flip from #1524 (8f1737a287). Without them xrdp desktops render sheared and upside-down tile by tile. |
Why: IronRDP pins picky = "=7.0.0-rc.25", which pins curve25519-dalek = "=5.0.0-rc.1" and
other release candidates; russh needs the stable curve25519-dalek 5, and Cargo can't build two
semver-compatible versions of one crate. With the pins relaxed both resolve to the stable
releases, and the picky and sspi unit suites (402 tests) pass against them.
The ironrdp-session fixes are verified by the live test in core/src/clients/rdp.rs
(NEXUS_RDP_TEST="host port user password"), run against xrdp; the published crate ships no
unit tests.