Skip to content

v0.23.9

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 00:14
· 35 commits to main since this release
v0.23.9
e4538b8

What's Changed

Fixed

  • RDP now connects to KRdp / NLA-less Linux hosts that reject the embedded client's CredSSP (#366) — a KRdp 6.6.x server built on FreeRDP 3.32.x advertises HYBRID_EX ("Ext") security it cannot actually complete: the embedded IronRDP client lets the server pick HYBRID_EX, the server's NTLM/SAM path fails internally, and the client sees STATUS_LOGON_FAILURE (0xc000006d) even with correct credentials — byte-for-byte identical to a wrong password, which is why #366 was reported as "invalid username or password". This is a server-side regression (FreeRDP issue #13567; KRdp fixed it in 6.7.90). Remmina reaches the same server because it negotiates plain TLS, which never offers HYBRID_EX — confirmed live, with /sec:tls the FreeRDP negotiation drops to nego_enable_ext: FALSE. RustConn now does the same: on that rejection it hands the session once to external FreeRDP with the security layer pinned to TLS (/sec:tls), matching Remmina. The decision is a pure, unit-tested warrants_tls_only_fallback in rustconn-core::rdp_client::failure — it fires only for the ambiguous InvalidToken/logon-failure shape (never for account-state statuses TLS cannot fix) and only once, so if the TLS-only path is rejected too the real error surfaces with actionable advice (update KRdp to 6.7.90+, set ExtSecurity=0, or pin FreeRDP 3.31.0) instead of looping. Two further tweaks were needed for KRdp, both bisected live against a real server: the explicit colour depth is dropped (an explicit /bpp:32 made KRdp answer the capabilities exchange with PDU_TYPE_DEACTIVATE_ALL; None lets FreeRDP negotiate it), and the external window opens resizable with content scaling (/smart-sizing + a 1280×800 start size) instead of the fixed monitor-sized /size:100%. (rustconn-core/src/rdp_client/failure.rs, rustconn/src/embedded_rdp/connection.rs)
  • An RDP tab no longer hangs on "Starting RDP…" / "running in external window" after the external client closes (#366) — two bugs kept the tab stuck once the external FreeRDP window ended: notify_ironrdp_state changed the state but never repainted the placeholder (so the Cairo surface kept the previous label), and the external-exit watchdog both stopped polling after 30s and stood down silently on a post-window exit instead of moving the GUI to Disconnected. The placeholder now repaints on every state change, the watchdog polls for the whole session (not a 30s cap) and transitions to Disconnected on exit, and it also detects a session that dropped without the client process exiting (the SDL client against KRdp logs Network disconnect / CONNECT_CANCELLED but stays alive) and frees the tab then too. (rustconn/src/embedded_rdp/connection.rs)
  • The embedded Wayland FreeRDP fallback now honours the security layer and NLA switches — the embedded wlfreerdp3 subsurface path built its argument vector by hand and omitted /sec entirely, so it always ran FreeRDP's own default (Negotiate → NLA) regardless of the connection's Security layer or Disable NLA settings. It now emits /sec:<layer> and /sec:nla:off exactly as the external launcher's push_security_args does, so a user who pins TLS or disables NLA on a server where FreeRDP's TLS is compatible is actually honoured on the embedded path. (rustconn/src/embedded_rdp/thread.rs)
  • The deprecated wlfreerdp client is now tried last in a Wayland session, after XWayland — upstream FreeRDP deprecated wlfreerdp in favour of the SDL3 client (issue #340), and it SIGSEGVs in freerdp_disconnect against KDE KRdp (seen while diagnosing #366). The external-launch order in a Wayland session is now sdl-freerdp3 > sdl-freerdp > xfreerdp3 > xfreerdp > wlfreerdp3 > wlfreerdp, so when the preferred SDL3 client is not installed a working XWayland client is chosen over the crashing wlfreerdp. Installing sdl-freerdp3 remains the best option. (rustconn-core/src/protocol/detection.rs)

Dependencies

  • Updated: serde_json 1.0.151 → 1.0.152, proptest 1.11.0 → 1.12.0, bit-set 0.8.0 → 0.11.1, bit-vec 0.8.0 → 0.10.1, rand_xorshift 0.4.0 → 0.5.0. All semver-compatible patch/minor bumps (serde_json plus the proptest dev-dependency family); no security advisories affected (cargo deny check advisories clean). CLI download versions all current (TigerVNC pinned at 1.16.2); the RustCrypto release-candidate family and the out-of-range majors (zip 8→9, x509-cert 0.2→0.3) remain held back, pinned transitively by the sspi/picky-krb stack exactly as in 0.23.1–0.23.8; picky-krb 0.12.5 stays held at 0.12.4 for the same reason (its GssApiMessageError variant breaks the pinned sspi 0.21.3). The Flatpak/Flathub manifests are in sync (GNOME runtime 51, FreeRDP 3.32.1, cJSON 1.7.19, OpenH264 2.6.0).

Installation

Flatpak (Recommended)

flatpak install flathub io.github.totoshko88.RustConn

Snap

sudo snap install rustconn

Debian/Ubuntu (.deb from this release)

sudo dpkg -i rustconn_0.23.9_amd64.deb
sudo apt-get install -f  # Install dependencies if needed

Fedora (.rpm from this release)

sudo dnf install rustconn-0.23.9-1.fc44.x86_64.rpm

AppImage

chmod +x RustConn-0.23.9-x86_64.AppImage
./RustConn-0.23.9-x86_64.AppImage

macOS (Homebrew)

brew tap totoshko88/rustconn
brew install rustconn
open $(brew --prefix)/opt/rustconn/RustConn.app

All dependencies (GTK4, libadwaita, VTE, Adwaita icons) are installed automatically.
Requires macOS 13 (Ventura) or later.

OBS Repositories

Packages available at: https://build.opensuse.org/package/show/home:totoshko88:rustconn/rustconn

# Debian 13 (Trixie)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Debian_13/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 24.04 LTS (Noble)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_24.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Ubuntu 26.04 LTS (Resolute)
echo 'deb http://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/ /' \
  | sudo tee /etc/apt/sources.list.d/rustconn.list
curl -fsSL https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/xUbuntu_26.04/Release.key \
  | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/rustconn.gpg > /dev/null
sudo apt update && sudo apt install rustconn

# Fedora 44
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_44/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# Fedora 43
sudo dnf config-manager addrepo --from-repofile=https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/Fedora_43/home:totoshko88:rustconn.repo
sudo dnf install rustconn

# openSUSE Tumbleweed
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Tumbleweed/ rustconn
sudo zypper ref && sudo zypper in rustconn

# openSUSE Leap 16.0
sudo zypper ar https://download.opensuse.org/repositories/home:/totoshko88:/rustconn/openSUSE_Leap_16.0/ rustconn
sudo zypper ref && sudo zypper in rustconn

Arch Linux (AUR)

yay -S rustconn

FreeBSD (Ports)

pkg install rustconn

Full installation guide: https://github.com/totoshko88/RustConn/blob/main/docs/INSTALL.md

Verifying your download

Every binary on this release (deb, rpm, AppImage, Flatpak) is covered two ways.

Plain checksums — download SHA256SUMS alongside the asset, then:

sha256sum -c SHA256SUMS

Signed build provenance (SLSA, via Sigstore) — proves the file was built by this
workflow from this commit:

gh attestation verify RustConn-0.23.9-x86_64.AppImage --repo totoshko88/RustConn

(The snap is signed by the Snap Store; the macOS build is delivered via the Homebrew tap.)

Assets 10
Loading