[client] Force TLS1.2 for RDP with Win11/Server2025 for CredSSP compatibility #4617
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds TLS version selection logic for RDP connections to ensure compatibility with CredSSP (Network Level Authentication) on Windows 11 and Server 2025. The change detects whether NLA/CredSSP is required by analyzing X.224 protocol responses and forces TLS 1.2 when CredSSP is detected, as CredSSP is incompatible with TLS 1.3.
- Added X.224 response parsing to detect CredSSP requirements
- Modified TLS configuration to force TLS 1.2 when CredSSP is detected
- Removed unused plain connection setup code
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| client/wasm/internal/rdp/rdcleanpath_handlers.go | Added CredSSP detection logic and removed unused plain connection method |
| client/wasm/internal/rdp/cert_validation.go | Modified TLS configuration to conditionally use TLS 1.2 for CredSSP compatibility |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
|
* upstream/main: (135 commits) [signal] Fix HTTP/WebSocket proxy not using custom certificates (netbirdio#4644) [client] Fix active profile name in debug bundle (netbirdio#4689) [management] Add peer disapproval reason (netbirdio#4468) [misc] Update tag name extraction in install.sh (netbirdio#4677) [client] Clean up match domain reg entries between config changes (netbirdio#4676) [client] Delete TURNConfig section from script (netbirdio#4639) [client] Security upgrade alpine from 3.22.0 to 3.22.2 netbirdio#4618 [client] Fix status showing P2P without connection (netbirdio#4661) [client] Support BROWSER env for login (netbirdio#4654) [client] Remove rule squashing (netbirdio#4653) Handle the case when the service has already been down and the status recorder is not available (netbirdio#4652) [client] Set default wg port for new profiles (netbirdio#4651) [client] Add bind activity listener to bypass udp sockets (netbirdio#4646) [client] Fix missing flag values in profiles (netbirdio#4650) [management] feat: Basic PocketID IDP integration (netbirdio#4529) [client] Force TLS1.2 for RDP with Win11/Server2025 for CredSSP compatibility (netbirdio#4617) [misc] Add service definition for netbird-signal (netbirdio#4620) [management] pass temporary flag to validator (netbirdio#4599) [client] Explicitly disable DNSOverTLS for systemd-resolved (netbirdio#4579) [management] sync all other peers on peer add/remove (netbirdio#4614) ...
Describe your changes
Issue ticket number and link
Stack
Checklist
Documentation
Select exactly one:
Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:
netbirdio/docs#447