Andy Dixon
50c0104d57
clients::rdp connects over any caller-dialled TCP stream (direct, proxy or SSH tunnel), upgrades to TLS and logs on with NLA (CredSSP/NTLM), optionally falling back to TLS-only logon for servers without NLA such as xrdp (credentials are passed so they log straight in). The server certificate is pinned through a caller check on its SHA256 fingerprint before any credentials are sent. The desktop decodes into the VNC client's RGBA framebuffer; input (IronRDP's scancode/Unicode/mouse operations), Display Control resizes and the deactivation-reactivation sequence run on the session thread. IronRDP's releases need three vendored patches (vendor/README.md): picky and sspi with their RustCrypto release-candidate pins relaxed so they share russh's stable versions (their own suites, 402 tests, pass against them), and ironrdp-session with two unreleased upstream bitmap fixes (#1486 stride, #1524 RDP6 orientation) without which xrdp desktops render sheared. Verified live against xrdp (scottyhardy/docker-remote-desktop): logon, full desktop rendering, keyboard and mouse input.
56 lines
1.8 KiB
Rust
56 lines
1.8 KiB
Rust
use picky_krb::constants::key_usages::{ACCEPTOR_SEAL, INITIATOR_SEAL};
|
|
use picky_krb::crypto::CipherSuite;
|
|
use picky_krb::crypto::aes::AesSize;
|
|
|
|
use crate::Secret;
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct EncryptionParams {
|
|
pub encryption_type: Option<CipherSuite>,
|
|
pub session_key: Option<Secret<Vec<u8>>>,
|
|
pub sub_session_key: Option<Secret<Vec<u8>>>,
|
|
pub sspi_encrypt_key_usage: i32,
|
|
pub sspi_decrypt_key_usage: i32,
|
|
/// EC field of the Kerberos Wrap token.
|
|
///
|
|
/// Related documentation:
|
|
/// * [RFC 4121: EC Field](https://www.rfc-editor.org/rfc/rfc4121#section-4.2.3).
|
|
/// * [3.4.5.4.1 Kerberos Binding of GSS_WrapEx()](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/e94b3acd-8415-4d0d-9786-749d0c39d550).
|
|
///
|
|
/// This value is different during RDP and RPC authentication.
|
|
/// We negotiate it during the authentication process.
|
|
pub ec: u16,
|
|
}
|
|
|
|
impl EncryptionParams {
|
|
pub fn default_for_client() -> Self {
|
|
Self {
|
|
encryption_type: None,
|
|
session_key: None,
|
|
sub_session_key: None,
|
|
sspi_encrypt_key_usage: INITIATOR_SEAL,
|
|
sspi_decrypt_key_usage: ACCEPTOR_SEAL,
|
|
ec: 0,
|
|
}
|
|
}
|
|
|
|
pub fn default_for_server() -> Self {
|
|
Self {
|
|
encryption_type: None,
|
|
session_key: None,
|
|
sub_session_key: None,
|
|
sspi_encrypt_key_usage: ACCEPTOR_SEAL,
|
|
sspi_decrypt_key_usage: INITIATOR_SEAL,
|
|
ec: 0,
|
|
}
|
|
}
|
|
|
|
pub fn aes_size(&self) -> Option<AesSize> {
|
|
self.encryption_type.as_ref().and_then(|e_type| match e_type {
|
|
CipherSuite::Aes256CtsHmacSha196 => Some(AesSize::Aes256),
|
|
CipherSuite::Aes128CtsHmacSha196 => Some(AesSize::Aes128),
|
|
CipherSuite::Des3CbcSha1Kd => None,
|
|
})
|
|
}
|
|
}
|