feat(dgw): route KDC traffic through agent tunnel (DGW-384)#1781
Open
irvingouj@Devolutions (irvingoujAtDevolution) wants to merge 1 commit into
Open
feat(dgw): route KDC traffic through agent tunnel (DGW-384)#1781irvingouj@Devolutions (irvingoujAtDevolution) wants to merge 1 commit into
irvingouj@Devolutions (irvingoujAtDevolution) wants to merge 1 commit into
Conversation
Let maintainers know that an action is required on their side
|
When an agent advertises the KDC's subnet or DNS domain, route Kerberos traffic through the QUIC tunnel just like every other proxy path. This closes the last gap left after the transparent routing PR (#1741): - `/jet/KdcProxy` HTTP endpoint — `send_krb_message` now consults the routing pipeline before falling back to direct TCP. The HTTP handler has no parent association, so it mints a fresh session_id purely for agent-side log correlation. - RDP CredSSP/NLA — `rdp_proxy.rs::send_network_request` previously hard-coded `None` for the agent handle. Plumb `agent_tunnel_handle` and `session_id` from `RdpProxy` down through `perform_credssp_with_*` → `resolve_*_generator` → `send_network_request`. The same change reaches the credential-injection clean path (`rd_clean_path.rs`). `session_id` here is `session_info.id` / `claims.jet_aid` so the agent log ties KDC sub-traffic to its parent RDP session. Stack: based on #1741. Picks up `agent_tunnel::routing::try_route`. `send_krb_message` signature gains `(agent_tunnel_handle, session_id)` in that order — required `Uuid`, no `Option<>` — so the call site is honest about which UUID it's logging. The UDP scheme guard (KDC over UDP keeps going direct because the agent protocol only carries TCP) and the 64 KiB `MAX_KDC_REPLY_MESSAGE_LEN` DoS cap (and the matching generic `read_kdc_reply_message`) come along since they live in the same file and serve the same end.
irvingouj@Devolutions (irvingoujAtDevolution)
force-pushed
the
feat/DGW-384-kdc-agent-tunnel
branch
from
839b656 to
f390d98
Compare
irvingouj@Devolutions (irvingoujAtDevolution)
marked this pull request as ready for review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes DGW-384.
Routes KDC traffic through the agent tunnel for the two remaining paths after #1741:
/jet/KdcProxyendpointrdp_proxy.rs::send_network_request)send_krb_messagegains(agent_tunnel_handle, session_id: Uuid). RDP callers passclaims.jet_aidso agent-side logs correlate KDC sub-traffic with the parent RDP session; the HTTP handler mints a fresh UUID since its token has no parent association.Depends on #1741 — must merge first (uses
agent_tunnel::routing::try_route).