feat(dgw): route KDC traffic through agent tunnel by irvingoujAtDevolution · Pull Request #1781 · Devolutions/devolutions-gateway

irvingouj@Devolutions (irvingoujAtDevolution) · 2026-05-12T18:08:43Z

Routes KDC traffic through the agent tunnel for the two remaining paths after #1741:

HTTP /jet/KdcProxy endpoint
RDP CredSSP/NLA (rdp_proxy.rs::send_network_request)

send_krb_message gains (agent_tunnel_handle, session_id: Uuid). RDP callers pass claims.jet_aid so agent-side logs correlate KDC sub-traffic with the parent RDP session; the HTTP handler mints a fresh UUID since its token has no parent association.

Depends on #1741 — must merge first (uses agent_tunnel::routing::try_route).

github-actions · 2026-05-12T18:09:01Z

Let maintainers know that an action is required on their side

Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)
Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release
Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)
Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

Benoît Cortier (CBenoit) · 2026-05-20T17:57:24Z

+    // a parent association — so we mint a fresh session_id purely for log/agent
+    // correlation. The RDP CredSSP/NLA caller (rdp_proxy.rs::send_network_request)
+    // passes `claims.jet_aid` instead so KDC sub-traffic correlates with its RDP session.
+    let session_id = Uuid::new_v4();


We could consider using the jti of the KDC token, so there is a more persistent correlation, even though it’s not directly the associated session ID.

Benoît Cortier (CBenoit)

LGTM

Copilot

Pull request overview

This PR extends Devolutions Gateway’s “transparent agent tunnel routing” to cover the remaining Kerberos/KDC traffic paths (HTTP /jet/KdcProxy and the CredSSP/NLA Kerberos sub-flow), so KDC requests can traverse the agent QUIC tunnel when appropriate and logs can correlate sub-traffic with a session ID.

Changes:

Plumbs an optional agent_tunnel_handle + session_id: Uuid through the CredSSP/NLA flow in rdp_proxy.rs (and callers) so CredSSP Kerberos network requests can use send_krb_message with tunnel routing.
Updates the HTTP KDC proxy handler to pass the tunnel handle and mint a session_id for correlation.
Adds a bounded-length read for TCP-framed KDC replies and integrates the agent-tunnel routing pipeline into send_krb_message.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`devolutions-gateway/src/rdp_proxy.rs`	Plumbs agent-tunnel handle + session correlation into CredSSP network requests.
`devolutions-gateway/src/rd_clean_path.rs`	Passes tunnel handle + session ID into CredSSP helpers during clean-path credential injection.
`devolutions-gateway/src/generic_client.rs`	Passes the agent-tunnel handle into `RdpProxy` so CredSSP can route KDC traffic.
`devolutions-gateway/src/api/kdc_proxy.rs`	Routes KDC traffic via agent tunnel (when possible), adds session correlation, and caps TCP reply allocation.
`crates/agent-tunnel/src/routing.rs`	Updates module docs to include KDC proxy/CredSSP usage.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    if let Some((mut stream, _agent)) =
+        agent_tunnel::routing::try_route(tunnel_handle, None, &route_target, session_id, kdc_target)
+            .await
+            .map_err(|e| HttpError::bad_gateway().build(format!("KDC routing through agent tunnel failed: {e:#}")))?


+    reader.read_exact(&mut buf[4..]).await?;
    Ok(buf)
 }



Benoît Cortier (CBenoit) · 2026-05-20T18:27:42Z

Make sure to rework the squash commit body, and add the ticket in a footer Issue: DGW-384 when you merge

When an agent advertises the KDC's subnet or DNS domain, route Kerberos traffic through the QUIC tunnel just like every other proxy path. This closes the last gap left after the transparent routing PR (#1741). Two paths now use the same routing pipeline as connection forwarding: - `/jet/KdcProxy` HTTP endpoint — `send_krb_message` consults the routing pipeline before falling back to direct TCP. - RDP CredSSP/NLA — `rdp_proxy.rs::send_network_request` previously hard-coded `None` for the agent handle. Plumb `agent_tunnel_handle`, `session_id`, and `explicit_agent_id` from `RdpProxy` down through `perform_credssp_as_*` -> `resolve_*_generator` -> `send_network_request`. The same change reaches the credential-injection clean path (`rd_clean_path.rs`). Session correlation: - RDP CredSSP callers pass the parent association's `jet_aid` so KDC sub-traffic ties back to its parent RDP session in agent-side logs. - The HTTP `/jet/KdcProxy` handler passes the KDC token's own `jti` (the most persistent identifier available without a parent association). `KdcToken` now carries `jti` alongside the claims for this purpose. Explicit-agent routing (matches every other proxy path): - `send_krb_message` takes `explicit_agent_id: Option<Uuid>` and forwards it to `agent_tunnel::routing::try_route`. When the parent association pins `jet_agent_id`, the KDC sub-traffic is routed via that agent or fails -- never silently falls back to a different agent or to direct connect. The HTTP handler passes `None`. Hardening (came along since they live in the same file): - 64 KiB `MAX_KDC_REPLY_MESSAGE_LEN` DoS cap on the announced TCP-framed KDC reply length, with overflow-safe length math. - UDP scheme guard: KDC over UDP keeps going direct because the agent tunnel only carries TCP today. Drive-by: `crates/agent-tunnel/src/listener.rs` move-after-move on `ca_manager` introduced by #1775 -- fixed with `Arc::clone` to keep master building on `--no-default-features` configurations. Stack: based on #1741. Picks up `agent_tunnel::routing::try_route`. Issue: DGW-384

irvingouj@Devolutions (irvingoujAtDevolution) force-pushed the feat/DGW-384-kdc-agent-tunnel branch from 839b656 to f390d98 Compare May 13, 2026 16:06

irvingouj@Devolutions (irvingoujAtDevolution) marked this pull request as ready for review May 13, 2026 16:06

irvingouj@Devolutions (irvingoujAtDevolution) requested a review from Benoît Cortier (CBenoit) May 19, 2026 14:44

irvingouj@Devolutions (irvingoujAtDevolution) force-pushed the feat/DGW-384-kdc-agent-tunnel branch 2 times, most recently from 32eb2dc to 92c095c Compare May 19, 2026 19:04

Benoît Cortier (CBenoit) requested a review from Copilot May 20, 2026 17:56

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) May 20, 2026 17:57 View session

Benoît Cortier (CBenoit) reviewed May 20, 2026

View reviewed changes

Benoît Cortier (CBenoit) approved these changes May 20, 2026

View reviewed changes

Copilot AI reviewed May 20, 2026

View reviewed changes

Benoît Cortier (CBenoit) changed the title ~~feat(dgw): route KDC traffic through agent tunnel (DGW-384)~~ feat(dgw): route KDC traffic through agent tunnel May 20, 2026

irvingouj@Devolutions (irvingoujAtDevolution) force-pushed the feat/DGW-384-kdc-agent-tunnel branch 2 times, most recently from 0139388 to 4e2e02f Compare May 21, 2026 15:28

irvingouj@Devolutions (irvingoujAtDevolution) force-pushed the feat/DGW-384-kdc-agent-tunnel branch from 4e2e02f to b7f2473 Compare May 21, 2026 15:56

irvingouj@Devolutions (irvingoujAtDevolution) enabled auto-merge (squash) May 21, 2026 16:04

irvingouj@Devolutions (irvingoujAtDevolution) merged commit 6e80f71 into master May 21, 2026
42 checks passed

irvingouj@Devolutions (irvingoujAtDevolution) deleted the feat/DGW-384-kdc-agent-tunnel branch May 21, 2026 16:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(dgw): route KDC traffic through agent tunnel#1781

feat(dgw): route KDC traffic through agent tunnel#1781
irvingouj@Devolutions (irvingoujAtDevolution) merged 1 commit into
masterfrom
feat/DGW-384-kdc-agent-tunnel

irvingouj@Devolutions (irvingoujAtDevolution) commented May 12, 2026 •

edited by atlassian Bot

Loading

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

Benoît Cortier (CBenoit) May 20, 2026

Uh oh!

Benoît Cortier (CBenoit) left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

irvingouj@Devolutions (irvingoujAtDevolution) commented May 12, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 12, 2026

Let maintainers know that an action is required on their side

Uh oh!

Benoît Cortier (CBenoit) May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Benoît Cortier (CBenoit) left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

irvingouj@Devolutions (irvingoujAtDevolution) commented May 12, 2026 •

edited by atlassian Bot

Loading