This update includes some internal re-organization that drops some
dependencies and prunes the overall dependency tree.
Also take this opportunity to start referencing the version by semver
intead of commit SHA. In the past, the commits we need weren't always
available in releases, and we've been using SHA ever since.
* Point to latest commit of IronRDP and fix all of the breaking changes:
- Update SSPI dependency to get around some build failures in dependencies (namely AES package referencing some modules in Cipher which seem to no longer be re-exported)
- Construct fast_path:ProcessorBuilder with new fields 'share_id' and 'bulk_decompressor'.
- Fix renamed NetworkClient trait and modernized async signature (https://rustc-dev-guide.rust-lang.org/return-position-impl-trait-in-trait.html)
- Easy fixes breaking changes (new config fields and updated types)
- Handle new 'ProcessorOutput' types
- Fix breaking changes from ironrdp_tls::upgrade signature change
- Fix 'intersects()' not longer available on ironrdp_rdpdr::pdu::efs::CreateDisposition
- Cliprdr requires a mutable ref
- Fix FastPathProcessor construction
- A transitive dependency needs '[email protected]' with 'wasm_js' feature so we'll just update our direct dependency requirement to the same
- Fix error returned when attempting to get the 'DisplayControlClient' from the svc_processor. The code was refactored to lazily initialize the client upon receiving server capabilities for the dynamic channel. We can no longer expect it to be available right away.
- Fix references to 'ironrdp_pdu::input::InputEventError' and 'ironrdp_pdu::rdp::RdpError' which are no longer exported.
* Make use of 'ironrdp_tls::extract_tls_server_public_key' for retrieving the server's public key from the TLS connection.
* Remove dead code.
* bump getrandom to 0.4.2
* Ensure that resize requests are persisted if the display DVC is not yet ready.
This library makes the IronRDP fast path decoder available to Go code
via CGo. There are three build options:
1. A standalone library (for use by tsh), enabled with the rust_rdp_decoder
build tag.
2. All functionality included in the existing RDP client library,
enabled with the desktop_access_rdp build tag.
3. A no-op implementation which avoids any Rust dependencies.
The decoder also respects the RDPCLIENT_SKIP_BUILD=1 flag from the makefile,
under the assumption that if you don't have Rust tooling and don't want
to build the RDP client that you also don't want the decoder.
* * Update to latest commit of IronRDP.
* resolve conflicting 'getrandom' dependencies.
* Add necessary RUSTFLAG env var to ironrdp-wasm compilation. Needed by 'getrandom' dependency to enable its wasm_js feature.
* Configure client to use remotefx codec.
* Bump rust toolchain version to 1.86.0.
* Unset existing rustup overrides before building rdpclient or ironrdp wasm module.
* Fix lint warnings after Rust toolchain upgrade.
* Simplify BitmapFrame rendering and fix some rendering glitches that were revealed after updating IronRDP
* fix typo
* Try to determine the active Rust toolchain and print a helpful warning if it does not match the version defined in our toolchain file.
* Move `teleport/ironrdp` to `shared/libs/ironrdp`
* Do not import `teleport/lib/AuthenticatedWebSocket` in `TdpClient`
* Do not import other `teleport` stuff in `TdpClient`
* Move `teleport/lib/tdp` to `shared/libs/tdp`
* Move `teleport/components/TdpClientCanvas` to `shared/components/CanvasRenderer`
* Move `teleport/DesktopSession` to `shared/components/DesktopSession`
* Bring back `teleport/DesktopSession`
* Improve old artifacts cleaning
* Fix path in README.md
* initial
* full flow
* e
* cleanup
* cleanup, deps
* fix non-ad
* update IronRDP/sspi, remove domain
* rework url parsing
* lint
* cleanup
* Update lib/srv/desktop/rdp/rdpclient/client_common.go
Co-authored-by: Zac Bergquist <[email protected]>
* cleanup
* cleanup
* cleanup
* cleanup
* update sspi to 0.13
* disable credssp in FIPS builds
* update IronRDP
* propagate KDCAddr from config file
* Allow tokio-rustls license
* clippy
* Fix public key data in FIPS mode, enable CredSSP in FIPS
* Update lib/srv/desktop/rdp/rdpclient/src/ssl.rs
Co-authored-by: Zac Bergquist <[email protected]>
* simplify network client
* Minor improvements
- Better error display for IronRDP errors with poor Display impls
- Check key length before truncating to avoid a panic
- Improve godocs
* Make NLA opt in via TELEPORT_ENABLE_RDP_NLA=yes
* Suppress sspi-rs logs
sspi-rs currently logs everything at info level, which clutters
the Teleport logs. Set its log level to warn until upstream's
logging is less chatty.
* try disabling credssp first
* use missing computer name in case of IP address
* always enable credssp when opted-in
* fmt
* Update lib/srv/desktop/rdp/rdpclient/src/client.rs
Co-authored-by: Zac Bergquist <[email protected]>
* review comments
* review comments
* use teleport.dev/computer_name
* e
---------
Co-authored-by: Zac Bergquist <[email protected]>
* Resize
* ???
* ???
* Fixes to compile
* Updates to latest IronRDP with dvc fix, cleans up some of the debug code
* Hooks up resize listener on the client and sends changes as ClientScreenSpecs to the backend. Currently just gets logged in the WDS
* Handles the new DeactivateAll ProcessorOutput
* hooks up client_write_screen_resize
* Renames tdp Connection Initialized to Connection Activated
This message is now used both after the connection is first established
and after the connection executes a Deactivation-Reactivation Sequence.
This fits snugly in to our existing message flow and ensures that the fast
path processor is updated appropriately whenever a Deactivation-Reactivation
Sequence is executed due to a resize event.
* Switch monitor orientation based on width/height
* remove superfluous canvas size sync
* Updates to the most up-to-date hash for IronRDP (not merged to master). Screen resize works in this commit, though its still the case that if you do so before the channel is announced by the rdp server, it will end the session
* Updates to the most recent hash for IronRDP feat/dynamic-resize
* Adds a mechanism to withhold sending resize requests to the RDP server until we're alerted by a new callback mechanism of the DisplayControlClient that the server has sent us its capabilities. This prevents an error where we send a resize before this event, which results either in an RDP error (if the channel is not opened) or a dropped event (if the server has not sent its capabilities yet).
* Refactoring after update to the tip of https://github.com/Devolutions/IronRDP/pull/424
* Adds windowOnResize to story
* adds Determine Toolchain Versions and cache paths and Print versions steps to os-compatibility-test.yaml
* fixes debug log formatting
* Updates to local IronRDP and later IronRDP api
* updates to IronRDP latest rev on https://github.com/Devolutions/IronRDP/pull/430
* reverting mistaken changes
* throttle -> debounce and naming changes
* js renamings
* updates to IronRDP master
---------
Co-authored-by: Przemko Robakowski <[email protected]>
* Updates commit-hash to IronRDP fix/resilient-blobtype HEAD
* Updates commit-hash to IronRDP fix/resilient-blobtype HEAD
* Updates to latest IronRDP hash. Note that this hash is of a still-open PR (https://github.com/Devolutions/IronRDP/pull/436) and thus the IronRDP hash should be frozen until those changes are merged and the hash updated to IronRDP latest master
* Current hash corresponds to IronRDP branch (should be changed before merging).
* Updates ScardBackend message handling code to account for ascii variants
* Return a timeout when we receive a non-infinite timeout status change call
Includes minor refactor to clean up the code a bit.
* updates to latest IronRDP master hash
* Updates RUST_VERSION and IronRDP rev to latest, adds RUST_MIN_STACK to fix ARM builds
* Adds asn1-rs, asn1-rs-derive, asn1-rs-impl, and der-parser to the allow-dependencies-licenses. This is required because their crates do not currently have valid SPDX licenses, see https://github.com/gravitational/teleport/actions/runs/8453649354/job/23156810330?pr=39895
* Adds the extended keycode where appropriate and updates to the latest IronRDP master commit hash.
* cleaning up disconnect result
* Pipes disconnect messages through to the client.
This required a change to the state management for DesktopSession. State
is still quite complex to get right here, but this is a step in the right
direction.
* Updates desktopPlaybackHandle to the new authenticated websocket paradigm as it was forgotten in https://github.com/gravitational/teleport/pull/37520
* prettier formatting
* adding clarifying comments
* Further refactoring to make DesktopSession's state machine more comprehensible
* Remove unnecessary items from dependency lists
* adds ironrdp client and has it connect, alongside rdp-rs
* Integrates IronRDP client into the TDP png-response system. Instead of sending back chunks of the screen, its sends the full screen every time, and this is my running hypothesis for the current sticking point: a "Maximum call stack size exceeded" from the tdp client in the react app
* Changes arrayBufferToBase64 to use reduce, which fixes the "Maximum call stack size exceeded" bug
* removes convert_bgra_to_rgba which isn't needed with the bitmaps being produced by IronRDP
* Adds support for updating only a specific image region
* removes mistaken read_rdp_output_inner call from connect_rdp_inner
* Adds support for mouse input. I believe this code has race conditions for client.write_frame though this requires more research.
* Patches things up with the new IronRDP structure
Requires some modifications to IronRDP, see the corresponding commit hash
for IronRDP in lib/srv/desktop/rdp/rdpclient/Cargo.toml.
Started getting call stack overflows when manual testing again, but I'm
going to ignore those for now and focus on the version of this architecture
that passes the remoteFX encoded messages over TDP.
* Adds RemoteFX Frame to the backend
* Proof of concept for integrating a wasm module into the frontend
Building the wasm module still needs to be done manually, this was
just to get to a point where tools are configured and it can be successfully
called in both dev and prod modes.
Required that I comment out "default-src 'self'" in the CSP, this will
need to be figured out later.
We're also using a package called vite-plugin-wasm-pack whereas ironrdp
uses vite-plugin-wasm. I'm not sure why, I'm going to look into this and
swap out to vite-plugin-wasm if possible.
* Swaps out vite-plugin-wasm-pack for vite-plugin-wasm and adds build-wasm script to the teleport package.json.
vite-plugin-wasm-pack looks relatively unmaintained in comparison
to vite-plugin-wasm-pack.
build-wasm script is needed to build the wasm binary before calling vite [build]
* Adds backend structure for RPC PoC
Untested as of yet and it isn't pretty, but this more or less imitates the
RPC approach we have for directory sharing.
* hack solution which calls everything 'static. THIS IS VERY UNSAFE, WE SHOULD DO SOMETHING ELSE
* Gets the full display working end to end
with a particular commit of IronRDP. Unfortunately this commit is now
well out of date, and IronRDP had some bugs that were preventing RemoteFX
frames from being sent back.
* Full display working end to end with the updated IronRDP
* updates init_wasm_log to enable logging in the console
* updates hardcoded io_channel_id and user_channel_id
* Uses specific IronRDP sub-crates (i.e. ironrdp-session, ironrdp-tokio, etc.) rather than relying on whatever is re-exported from the ironrdp sub-crate itself
* Gets FastPathFrameResponse up to speed and the PoC is now working
* deletes all the rpc stuff which it turns out we don't need
* more cleanup including consolidating the FastPathFrame message between wasm and js, adding some comments
* Updates the documentation string for top level Client in lib.rs
* Removes hardcoded rdp server address, screen size, and username
* Swaps to online IronRDP repo
* Updates the TDP RFD with new messages
renaming them to be precise.
* remove hardcoded ip
* creates asRustBackedSlice
* removing some old todos
* Add cleanup for wasm-pack build artifacts to make clean
* Fix wasm in production builds (#27428)
* Converts the default Content-Security-Policy representation to a map
which makes it easier to programmatically add-to/overwrite the defaults
for special cases.
Also adds tests for the various custom CSPs.
* Alphabetize CSP directives for ease of testing/debugging in the future
* makes maps more easily composable
* removes commented code, and topLevelAwait() which was causing production builds to break
* Adds 'wasm-unsafe-eval' to the script-src section of the Content-Security-Policy
when a desktop session's url is detected.
The app already enforces no caching via the Cache-Control, Pragma, and
Expires headers (SetNoCacheHeaders), which means that any time the app
is requested in a new tab, the browser will always request a new index.html
which can be sent back with a new Content-Security-Policy header.
Since the only way to get to a desktop session is to either
click a link in the app which opens a new tab, or to open a new tab and
navigate to the url manually (this differs from most components, which can
be navigated to without a page reload using React Router), we can reliably
check each index.html request for a characteristic desktop session url path,
and only include the 'wasm-unsafe-eval' directive when strictly necessary
(in the spirit of the principle of least privilege).
* Removes vite-plugin-top-level-await from package.json
* moves regex to global so that it only need be compiled once
* CR fixes
updates Cargo.lock
removes commented feature flag
removes -framework SystemConfiguration
fixes makefile comment
* unsafe.SliceData
* fixes phrasing
* changes to docstring
* changes handle_tdp_fast_path_response to handle_tdp_rdp_response_pdu
so that its name is in line with its definition in RFD 0037 and
adds a more descriptive docstring.
* small fixes to comments
* preallocate RDPFastPathPDU Encode buffer
* updating comments
* Adds a detailed discussion of the Go/Rust Interface to the README (#29762)
* Aligns the codebase with the Go/Rust interface principles in the README (#29764)
* Move client functionality into Client (#29765)
* Adds the RDP Channel IDs TDP message (#27514)
* Refactoring `rdpclient` (#29766)
* Ironrdp recording playback (#28228)
* httplib.SetIndexContentSecurityPolicyWithWasm for recordings as well as desktop sessions so that the ironrdp wasm client can be used for recording playback
* Adds desktopplayback path to websocket proxy definitions so that it can be used with the dev server
* adds tdp.TypeRDPFastPathPDU as a tdp message to be recorded
* With this commit, recordings can be played back with the FastPathProcessor
Refactors tdp Client and subclass PlayerClient
such that now the classes are always constructed the same way,
and the internal representation of the screen size (the FastPathProcessor)
is either:
1. Created upon the call to Client.connect(spec) when spec is !undefined.
This is the case when the Client is being used for a desktop session.
2. Created when a client screen spec is received from the server. This is
the case when PlayerClient is being used for playback.
* Switches from sending the width/height via ur parameter string
to sending it via the client screen spec tdp message.
* changes tdpCli* to client* and adds a canvas* to the canvas related functions
* Static tokio (#30066)
* Beginnings of RdpdrBackend integration (#32814)
* Adds handling for the EstablishContextCall (#32971)
* Adds support for `ListReadersCall` and `ListReadersReturn` (#33004)
* Adds support for `GetStatusChangeCall`/`GetStatusChangeReturn` (#33056)
* Adds support for ConnectCall and ConnectReturn (#33136)
* Better error handling (#32925)
This change removes couple of unwrap that could cause panics on the Rust side and prevents panics from invalid cgo handle on the Go side.
It also sends error message from IronRDP to UI and cleans up a little final sequence of closing various goroutines in case of error or sessions end.
* Adds support for `HCardAndDispositionCall` with `ScardIoCtlCode::BeginTransaction` (#33192)
* `TransmitCall` and `TransmitReturn` (#33282)
* `StatusCall` and `StatusReturn` (#33284)
* `ReleaseContext` and refactor `handle_scard_call` (#33434)
* IronRDP clipboard sharing (#33335)
This change adds clipboard sharing to our IronRDP migration using ironrdp_cliprdr crate with out TDP-based backend (reused from rdp-rs times)
* Adds EndTransaction, Disconnect, Cancel, and IsValidContext (#33612)
* Adds support for `GetDeviceTypeId` (#33613)
* Adds support for `ReadCacheW` (#33618)
* `WriteCacheW` (#33620)
* Smartcard Login (#33712)
* `GetReaderIcon` (#33779)
* Update to IronRDP latest commit
* Removes a bunch of old deprecated code (including `rdp-rs`) (#33786)
* Pipes in `SharedDirectoryAnnounce` (#33911)
* Use tokio-boring for TLS upgrade (#33900)
This change switches TLS upgrade in our new RDP approach to tokio-boring in FIPS-compliant builds.
It also adds runtime check for FIPS mode.
Tested locally in custom Docker image.
* Update sspi (#34558)
* Break up rdpdr.rs, add support for the first directory sharing pdus (#34009)
* Adds support for `SharedDirectoryCreateRequest` and `SharedDirectoryCreateResponse`. (#34011)
* `SharedDirectoryDeleteRequest` and `SharedDirectoryDeleteResponse` (#34051)
* remove leftover code
* Server drive query information request (#34082)
* Rdp client refactor (#34122)
* Add handling for `DeviceCloseRequest` (#34139)
* Updates to `IronRDP` latest (#34744)
* Updates to IronRDP latest with a slightly different API
* remove defunct comment
* `ServerDriveQueryDirectoryRequest` and `SharedDirectoryListRequest/Response` (#34746)
* `ServerDriveQueryVolumeInformationRequest` and `ClientDriveQueryVolumeInformationResponse` (#34871)
* `DeviceControlRequest` (#34898)
* `Read` (#34914)
* `Write` (#34919)
* `SetInformation` (#35092)
* `LockControl` (#35146)
* Stack pr feedback and other cleanup (#35306)
* Adds desktop access websocket pattern to vite config
* Updates IronRDP to latest, removes manual context strings in favor of automatically generated (by this latest IronRDP commit) (#35392)
* Small line fixes, comment removal, changing license to AGPL
* Update Go/Rust interface section of README (#35590)
* Ironrdp manual docs (#35455)
* Remove unnecessary whitespace
* Refactor navigation paths in Active Directory documentation for clarity
Replaced textual descriptions with formatted paths using `>` symbols for better readability.
Having been subject to going through many such tutorials myself, I find this to be a more
user-friendly way of presenting the information. It's very common to need to go back and
forth between the documentation and the group policy manager, and having these paths in a
format that can catch the eye quickly is a big help. This also appears to be common practice
e.g.
- https://softwarekeep.com/help-center/how-to-enable-remote-desktop-on-windows
- https://www.helpwire.app/blog/remote-desktop-group-policy/
* Add instructions for enabling RemoteFX
* Add an optional step to the end of each GPO update subsection
This lets us point users to subsections individually without worrying
about reminding them that they need to run a `gpupdate /force` each
time (because its already right there in the subsection).
* lowercase "open"
* Updates configuration script to enable RemoteFX (#35461)
* Restructure Cargo workspace (#35591)
* Update `IronRDP` to latest, fix key log leak (#35707)
Updates IronRDP to latest with the changes necessary to keep up with the changes in https://github.com/Devolutions/IronRDP/pull/328. We select the `"rustls"` feature explicitly now, this is in line with our implicit choice of it as [the default](https://github.com/Devolutions/IronRDP/pull/325/files#diff-1f64036f3e460819b2b1e954803b7f266feca0e2787ca0614ae1253323944f59L19) before these latest changes.
Also creates a custom debug for `ScardBackend` so as to not leak `key_der` in the logs.
* Don't leak pin in the logs
* Updates CI to fix broken checks and builds caused by WASM introduction (#35401)
* removes SystemConfiguration framework (not sure why it was there).
* Updates cspell
* fixes TestSetRedirectPageContentSecurityPolicy
* Updates e ref to a currently-draft-PR ref.
* Fix per session mfa (#35902)
* Updating e-ref to tip of `master`
* dependency-review: Ignore cargo dependencies with invalid license specifications
* Updates OSS build-macos.yaml to support wasm-pack
---------
Co-authored-by: Przemko Robakowski <[email protected]>
Co-authored-by: Mike Jensen <[email protected]>
This code was unmaintained, created issues with our build system,
and didn't actually match the behavior of Teleport's RBAC engine.
We will revisit this functionality in the future when we investigate
"acess policies as code."
The workspace includes both parts of the project that use Rust.
(The roletester and RDP client).
This has several advantages:
- Rust Analyzer will work on the codebase as a whole, so we get
nice development features without needing to open the Rust
projects separately
- Dependencies are resolved at the project level, ensuring that
role tester and RDP client use the same version of common
dependencies.
Zac Bergquist