test(dgw): cover RDP credential injection end to end

.github/workflows/ci.yml

@@ -358,6 +358,22 @@ jobs:
           sudo apt-get update
           sudo apt-get -o Acquire::Retries=3 install libsystemd-dev
 
+      ## Required by the RDCleanPath credential-injection tests in the testsuite.
+      ## Keep the version in sync with IRONRDP_AGENT_VERSION in testsuite/src/ironrdp_agent.rs.
+      - name: Cache ironrdp-agent
+        id: cache-ironrdp-agent
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/ironrdp-agent
+            ~/.cargo/bin/ironrdp-agent.exe
+          key: ironrdp-agent-0.1.0-${{ runner.os }}
+
+      - name: Install ironrdp-agent
+        if: ${{ steps.cache-ironrdp-agent.outputs.cache-hit != 'true' }}
+        shell: pwsh
+        run: cargo install ironrdp-agent --version 0.1.0 --locked
+
       - name: Tests
         run: ./ci/tlk.ps1 test -Platform ${{ matrix.os }} -Architecture ${{ matrix.arch }} -CargoProfile 'dev'
         shell: pwsh

crates/credential-injection-mock/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "credential-injection-mock"
+version = "0.0.0"
+authors = ["Devolutions Inc. <infos@devolutions.net>"]
+edition = "2024"
+description = "Fake RDP peers and KDC for the Gateway credential-injection tests"
+publish = false
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = "1"
+ironrdp-connector = "0.10"
+ironrdp-core = { version = "0.2", features = ["std"] }
+ironrdp-pdu = { version = "0.9", features = ["std"] }
+ironrdp-tokio = "0.10"
+kdc = "0.1"
+picky-asn1-der = "0.5"
+picky-krb = "0.12"
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "time", "net", "io-util"] }
+tokio-rustls = { version = "0.26", features = ["ring"] }
+x509-cert = { version = "0.3", default-features = false, features = ["std"] }

crates/credential-injection-mock/INTENT.md

@@ -0,0 +1,8 @@
+This binary is the mock RDP client, RDP server and KDC that the credential-injection tests in `testsuite` run against Gateway.
+It is a separate program so that `testsuite` does not depend on the RDP and Kerberos crates.
+It holds the client side too, because ironrdp-agent's direct TCP connection sends no preconnection blob, and the Gateway TCP listener requires one.
+
+## Shared libraries
+
+The mock uses the same CredSSP library (sspi) and the same `kdc` crate as Gateway, so a bug shared by both sides passes the tests.
+This is accepted: the tests check Gateway's credential injection, not whether these libraries follow the protocol.