Andy Dixon
50c0104d57
clients::rdp connects over any caller-dialled TCP stream (direct, proxy or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM), optionally falling back to TLS-only logon for servers without NLA such as xrdp (credentials are passed so they log straight in). The server certificate is pinned through a caller check on its SHA256 fingerprint before any credentials are sent. The desktop decodes into the VNC client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse operations), Display Control resizes and the deactivation-reactivation sequence run on the session thread. IronRDP's releases need three vendored patches (vendor/README.md): picky and sspi with their RustCrypto release-candidate pins relaxed so they share russh's stable versions (their own suites, 402 tests, pass against them), and ironrdp-session with two unreleased upstream bitmap fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops render sheared. Verified live against xrdp (scottyhardy/docker-remote-desktop): logon, full desktop rendering, keyboard and mouse input.
Vendored crates
Patched copies used through [patch.crates-io] in rust/Cargo.toml. Remove each once an
IronRDP release includes the fix it carries.
| Crate | Upstream | Change |
|---|---|---|
picky |
7.0.0-rc.25 (crates.io) | =x.y.z-rc.N RustCrypto pins relaxed to ^x.y.z-rc.N (so the stable releases russh uses satisfy them); one unused import removed. |
sspi |
0.21.3 (crates.io) | Same pin relaxation. |
ironrdp-session |
0.11.0 (crates.io) | Upstream fixes not yet released: #1486 "preserve bitmap source stride" (commit 80bb81b344, applied as-is) and the RDP6 orientation flip from #1524 (8f1737a287). Without them xrdp desktops render sheared and upside-down tile by tile. |
Why: IronRDP pins picky = "=7.0.0-rc.25", which pins curve25519-dalek = "=5.0.0-rc.1" and
other release candidates; russh needs the stable curve25519-dalek 5, and Cargo can't build two
semver-compatible versions of one crate. With the pins relaxed both resolve to the stable
releases, and the picky and sspi unit suites (402 tests) pass against them.
The ironrdp-session fixes are verified by the live test in core/src/clients/rdp.rs
(NEXUS_RDP_TEST="host port user password"), run against xrdp; the published crate ships no
unit tests.