gsadmin/rustguac
1
0
Fork 0
mirror of https://github.com/sol1/rustguac.git synced 2026-09-11 01:55:38 +00:00
Code Issues Packages Projects Releases Wiki Activity
160 Commits 4 Branches 63 Tags
v1.0.0
Commit Graph

160 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dave Kempe 33ea733c16 Fix Docker FreeRDP plugin discovery (#87) 
Find and copy libguac-common-svc-client from wherever make install
placed it, then copy (not symlink) into the system FreeRDP plugin dir.
v1.0.0 		2026-03-29 07:56:13 +11:00
Dave Kempe 63909484c0 Remove RPM build from release pipeline (FreeRDP 3 only) 2026-03-28 22:44:45 +11:00
Dave Kempe fc1e2552aa Fix formatting (cargo fmt) 2026-03-28 22:38:40 +11:00
Dave Kempe 2c7feb697c Add documentation index to overview page 2026-03-28 22:35:23 +11:00
Dave Kempe 32e353ba49 Add deployment guide for production planning and setup 2026-03-28 22:33:58 +11:00
Dave Kempe 8e9edce3a0 Security hardening: 8 fixes from audit 
- Recording name: reject on canonicalization failure (not accept)
- Protocol parser: 1MB buffer limit prevents OOM from rogue guacd
- UTF-8 validation: reject invalid bytes instead of silent replacement
- Login scripts: remove credential env vars (stdin-only)
- Chromium profiles: 0700 permissions on temp directories
- Share tokens: constant-time comparison (subtle::ConstantTimeEq)
- WebSocket: drop binary messages instead of forwarding to guacd
- Login scripts API: require operator+ role
 2026-03-28 22:28:30 +11:00
Dave Kempe 211ff9e99a WebSocket ticket auth: keep API keys out of WS URLs 
API key users now exchange their key for a single-use 30-second
ticket via POST /api/ws-ticket before connecting. The ticket is
passed as ?ticket= in the WebSocket URL instead of the raw API key.

Prevents API key exposure in reverse proxy logs, browser history,
and Referer headers. Legacy ?key= still works as fallback.
 2026-03-28 22:22:05 +11:00
Dave Kempe 6269f51bf2 Hash OIDC session tokens in database (security hardening) 
Session tokens stored as SHA-256 hashes instead of plaintext.
Migration drops old auth_sessions table on upgrade.
Same pattern as admin API key storage.
 2026-03-28 22:13:19 +11:00
Dave Kempe ea75470c97 Fix patches for upstream guacamole-server HEAD 
Patches 003 and 004 regenerated against current upstream:
- 003: upstream already added config.h to disp.c and input.c, removed
  those hunks. NULL guards and remaining config.h additions preserved.
- 004: upstream added path_lock field to display layer, adjusted context.
 2026-03-28 22:04:11 +11:00
Dave Kempe 799cdefd57 v1.0.0: H.264 passthrough, per-entry toggle, Docker fix 
H.264 passthrough for RDP via guac_display worker integration:
- Raw H.264 NAL units from xrdp x264 pass through to browser
  WebCodecs VideoDecoder, bypassing server-side decode/re-encode
- Frame queue preserves all H.264 frames across deferred flushes
- Per-entry toggle in address book (enable_h264 field)
- Keyframe gate ensures decoder initializes correctly
- Per-connection callback (no static global concurrency bug)
- Queue capped at 120 frames to prevent unbounded growth

guacd patch (004-h264-display-worker):
- display-priv.h: h264 frame queue on guac_display_layer
- display-plan.c: flush h264 queue during plan_apply, skip IMG ops
- display-layer.c: set_h264 API with queue append and cap
- rdpgfx.c: SurfaceCommand wrapper saves NAL before GDI handler
- settings.c/h: enable-h264 connection parameter, conditional GfxH264

Other changes:
- Docker: fix FreeRDP plugin path for drive/audio channels (#87)
- contrib/setup-xrdp-gfx.sh: full xrdp x264 rebuild from Debian sid
- docs/rdp-video-performance.md: H.264 passthrough documentation
- Address book UI: H.264 checkbox with dependency descriptions
 2026-03-28 21:52:28 +11:00
Dave Kempe b013678e42 H.264 passthrough: guacd patch + WebCodecs browser decoder 
Phase 1-3 of H.264 passthrough for premium RDP video performance.

guacamole-server patch (patches/004-h264-passthrough.patch):
- Enable GfxH264 and GfxAVC444 in FreeRDP settings when GFX is on
- Intercept AVC420/AVC444 SurfaceCommand before GDI decode
- Extract raw H.264 NAL units and send as new "h264" instruction
- Keyframe detection via Annex B start code + NAL type parsing
- Original GDI decode path still runs as fallback

Browser-side (static/guac/):
- H264Decoder.js: WebCodecs VideoDecoder, hardware-accelerated decode
- Client.js: "h264" instruction handler, base64→ArrayBuffer→decode
- Feature detection: falls back gracefully if WebCodecs unavailable

rustguac:
- Advertise video/h264 in guacd handshake
 2026-03-28 13:02:06 +11:00
Dave Kempe b2892e404f v0.9.2: Dependency updates 
- sha2 0.11.0-rc.5 → 0.11.0 (stable release)
- rusqlite 0.38.0 → 0.39.0 (bundled SQLite 3.51.3)
- clap 4.5.60 → 4.6.0
- toml 1.0.4 → 1.1.0
- libc 0.2.182 → 0.2.183
- pulldown-cmark 0.13.1 → 0.13.3
- tracing-subscriber 0.3.22 → 0.3.23
- uuid 1.22.0 → 1.23.0
v0.9.2 		2026-03-28 12:27:42 +11:00
Dave Kempe 580436807f Merge pull request #86 from sol1/dependabot/cargo/uuid-1.23.0 
deps: bump uuid from 1.22.0 to 1.23.0
 2026-03-28 12:12:40 +11:00
Dave Kempe 9ff97477b4 Merge pull request #85 from sol1/dependabot/cargo/tracing-subscriber-0.3.23 
deps: bump tracing-subscriber from 0.3.22 to 0.3.23
 2026-03-28 12:12:38 +11:00
Dave Kempe 97b7be7e0a Merge pull request #84 from sol1/dependabot/cargo/pulldown-cmark-0.13.3 
deps: bump pulldown-cmark from 0.13.1 to 0.13.3
 2026-03-28 12:12:36 +11:00
Dave Kempe 9cf1cda2ed Merge pull request #83 from sol1/dependabot/cargo/libc-0.2.183 
deps: bump libc from 0.2.182 to 0.2.183
 2026-03-28 12:12:33 +11:00
Dave Kempe 81ba50fd5d Merge pull request #82 from sol1/dependabot/cargo/toml-1.1.0spec-1.1.0 
deps: bump toml from 1.0.4+spec-1.1.0 to 1.1.0+spec-1.1.0
 2026-03-28 12:12:31 +11:00
Dave Kempe 1bdca18864 Merge pull request #81 from sol1/dependabot/cargo/clap-4.6.0 
deps: bump clap from 4.5.60 to 4.6.0
 2026-03-28 12:12:28 +11:00
Dave Kempe bb3e62701a Merge pull request #80 from sol1/dependabot/cargo/rusqlite-0.39.0 
deps: bump rusqlite from 0.38.0 to 0.39.0
 2026-03-28 12:12:25 +11:00
Dave Kempe 1a99abd108 Merge pull request #79 from sol1/dependabot/cargo/sha2-0.11.0 
deps: bump sha2 from 0.11.0-rc.5 to 0.11.0
 2026-03-28 12:12:23 +11:00
dependabot[bot] 0c7e3694fb deps: bump uuid from 1.22.0 to 1.23.0 
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.22.0 to 1.23.0.
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.22.0...v1.23.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:48 +00:00
dependabot[bot] 9f7bc4cbf6 deps: bump tracing-subscriber from 0.3.22 to 0.3.23 
Bumps [tracing-subscriber](https://github.com/tokio-rs/tracing) from 0.3.22 to 0.3.23.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.22...tracing-subscriber-0.3.23)

---
updated-dependencies:
- dependency-name: tracing-subscriber
  dependency-version: 0.3.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:36 +00:00
dependabot[bot] 173677049d deps: bump pulldown-cmark from 0.13.1 to 0.13.3 
Bumps [pulldown-cmark](https://github.com/raphlinus/pulldown-cmark) from 0.13.1 to 0.13.3.
- [Release notes](https://github.com/raphlinus/pulldown-cmark/releases)
- [Commits](https://github.com/raphlinus/pulldown-cmark/compare/v0.13.1...v0.13.3)

---
updated-dependencies:
- dependency-name: pulldown-cmark
  dependency-version: 0.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:28 +00:00
dependabot[bot] d859e13b4f deps: bump libc from 0.2.182 to 0.2.183 
Bumps [libc](https://github.com/rust-lang/libc) from 0.2.182 to 0.2.183.
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.183/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/libc/compare/0.2.182...0.2.183)

---
updated-dependencies:
- dependency-name: libc
  dependency-version: 0.2.183
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:19 +00:00
dependabot[bot] 56ee83ef30 deps: bump toml from 1.0.4+spec-1.1.0 to 1.1.0+spec-1.1.0 
Bumps [toml](https://github.com/toml-rs/toml) from 1.0.4+spec-1.1.0 to 1.1.0+spec-1.1.0.
- [Commits](https://github.com/toml-rs/toml/compare/toml-v1.0.4...toml-v1.1.0)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.0+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:11 +00:00
dependabot[bot] a24a3642de deps: bump clap from 4.5.60 to 4.6.0 
Bumps [clap](https://github.com/clap-rs/clap) from 4.5.60 to 4.6.0.
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.60...clap_complete-v4.6.0)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:18:01 +00:00
dependabot[bot] 7f69cb11bc deps: bump rusqlite from 0.38.0 to 0.39.0 
Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.38.0 to 0.39.0.
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](https://github.com/rusqlite/rusqlite/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: rusqlite
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:17:50 +00:00
dependabot[bot] a4ce652713 deps: bump sha2 from 0.11.0-rc.5 to 0.11.0 
Bumps [sha2](https://github.com/RustCrypto/hashes) from 0.11.0-rc.5 to 0.11.0.
- [Commits](https://github.com/RustCrypto/hashes/compare/sha2-v0.11.0-rc.5...sha2-v0.11.0)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 09:17:40 +00:00
Dave Kempe 07ebb33702 v0.9.1: Onboarding wizard, security updates, packaging fix 
- Onboarding wizard for new users (was missing from v0.8.1-v0.9.0)
- Settings menu label visibility improvement
- EnvironmentFile=-/opt/rustguac/env in systemd service
- russh 0.57→0.58.1 (drops vulnerable libcrux-sha3)
- aws-lc-sys 0.38→0.39 (RUSTSEC-2026-0044, 0048)
- rustls-webpki 0.103.9→0.103.10 (RUSTSEC-2026-0049)
- Removed RUSTSEC-2026-0074 ignore (no longer needed)
v0.9.1 		2026-03-27 10:32:47 +11:00
Dave Kempe d2dbfe3b2e Add Windows RDP performance tuning script (contrib) v0.9.0 2026-03-24 20:52:51 +11:00
Dave Kempe 6489bab9a9 CI: ignore RUSTSEC-2026-0074 (libcrux-sha3 via russh, no update available) 2026-03-24 20:49:23 +11:00
Dave Kempe 566336aadb CI: ignore yanked crate warnings in audit (digest 0.11.1 via russh) 2026-03-24 20:38:49 +11:00
Dave Kempe 3bf1762d87 v0.9.0: RDP audio, GFX pipeline, video performance 
Audio:
- RDP audio output now works through guacamole. Advertise audio/L16
  and audio/L8 mimetypes in the guacd handshake, and explicitly set
  disable-audio=false. Fixed mimetype mismatch that silently prevented
  guacd from creating audio streams.
- Browser AudioContext auto-resumed on user interaction (click/keydown)
  to comply with autoplay policy.

Video performance:
- Per-entry GFX pipeline toggle (enable_gfx) — enables RemoteFX codec
- Per-entry desktop composition toggle (enable_desktop_composition)
- Per-entry force lossless toggle (force_lossless) — PNG-only mode
- WebSocket proxy buffer increased from 8KB to 64KB
- Video Performance section in address book UI for RDP entries

Documentation:
- RDP Video Performance guide with Windows server tuning (AVC444,
  60fps, GPU encoding) and Linux xrdp setup (Debian 13)
- contrib/setup-xrdp-gfx.sh — automated GFX/H.264 setup for xrdp
- contrib/setup-xrdp-audio.sh — automated PulseAudio module build
 2026-03-24 20:25:05 +11:00
Dave Kempe 7acbb302fa v0.8.5: Reports, session history, enriched recordings 
Session history:
- New session_history SQLite table tracks all sessions with user,
  entry, folder, hostname, duration, and recording file
- Automatic cleanup via session_history_retention_days config (default 90)
- 8 new unit tests for session history DB functions

Reports page (poweruser+ only):
- Summary cards: total sessions, hours, unique users, active now
- Sortable/filterable session history table with pagination
- Top Connections and Top Users leaderboards
- CSV export for session history with filters

Enriched recordings:
- Recording .meta sidecars now include user, folder, entry name, session type
- Recordings API returns enriched metadata from .meta files
- Recordings page shows User, Entry, Folder columns

Other:
- Reports nav link on all pages, hidden for operator/viewer roles
- Reports documentation in docs/reports.md
- Onboarding wizard for new users (role-scoped, dismissable)
- Settings menu label visibility improvement
- Fixed stale credential variable test (hyphen support)
v0.8.5 		2026-03-22 20:36:26 +11:00
Dave Kempe e07af6fdb1 Fix rustls-webpki in fuzz/Cargo.lock (RUSTSEC-2026-0049) v0.8.1 2026-03-22 09:42:15 +11:00
Dave Kempe a729ce0900 v0.8.1: Security fixes, dependency updates, onboarding wizard 
Security:
- aws-lc-sys 0.38.0 → 0.39.0 (RUSTSEC-2026-0044, RUSTSEC-2026-0048)
- rustls-webpki 0.103.9 → 0.103.10 (RUSTSEC-2026-0049)
- Fixed fuzz/Cargo.lock with same aws-lc-sys update

Dependencies:
- rusqlite 0.38.0 → 0.39.0 (bundled SQLite 3.51.3)
- russh 0.57.1 → 0.58.0 (21% throughput improvement)
- clap 4.5.60 → 4.6.0
- toml 1.0.4 → 1.0.7
- tracing-subscriber 0.3.22 → 0.3.23
- libc 0.2.182 → 0.2.183

Features:
- Onboarding wizard for new users (role-scoped, dismissable)
- Settings menu label (was just a cog icon)
- Clipboard diagnostic logging in WebSocket proxy
 2026-03-21 16:58:10 +11:00
Dave Kempe edacc94c5a Fix security audit: update aws-lc-sys, rustls-webpki 
- aws-lc-sys 0.38.0 → 0.39.0 (fixes RUSTSEC-2026-0044, RUSTSEC-2026-0048)
- rustls-webpki 0.103.9 → 0.103.10 (fixes RUSTSEC-2026-0049)
- aws-lc-rs 1.16.1 → 1.16.2
 2026-03-21 15:34:38 +11:00
Dave Kempe f8cc1d0e96 Merge pull request #77 from sol1/dependabot/cargo/rusqlite-0.39.0 
deps: bump rusqlite from 0.38.0 to 0.39.0
 2026-03-21 15:30:47 +11:00
Dave Kempe 90794facdb Merge pull request #68 from sol1/dependabot/cargo/clap-4.6.0 
deps: bump clap from 4.5.60 to 4.6.0
 2026-03-21 14:51:34 +11:00
Dave Kempe fb21e8c9de Merge pull request #74 from sol1/dependabot/cargo/russh-0.58.0 
deps: bump russh from 0.57.1 to 0.58.0
 2026-03-21 14:51:32 +11:00
Dave Kempe e54c59d7bb Merge pull request #70 from sol1/dependabot/cargo/libc-0.2.183 
Patch bump, CI passes.
 2026-03-21 14:25:10 +11:00
Dave Kempe d1ac77caca Merge pull request #75 from sol1/dependabot/cargo/tracing-subscriber-0.3.23 
Patch bump, CI passes.
 2026-03-21 14:25:07 +11:00
Dave Kempe 44d3d7a0e9 Merge pull request #76 from sol1/dependabot/cargo/toml-1.0.7spec-1.1.0 
Patch bump, CI passes.
 2026-03-21 14:25:05 +11:00
Dave Kempe 74f67d0ed9 Add scale testing harness and results 
Bench suite: k6 load tests, Python Guacamole protocol client,
Vault population scripts, server metrics collector, xrdp target setup.

Results from 100 concurrent RDP session test on 16 GB server:
- rustguac: 45 MB RSS, 9 threads — not the bottleneck
- guacd/FreeRDP: 15.8 GB RSS (~158 MB/session) — primary bottleneck
- Zero errors, p95 session create 98ms, p95 WS connect 63ms
- Address book: 982 entries loads in 2.4s (sequential Vault reads)
 2026-03-21 12:38:03 +11:00
Dave Kempe 35f7dd519c Fix Docker config copy command in docs (#73) 
Add --entrypoint cat to override the container's default entrypoint
which starts guacd/rustguac instead of running the cat command.
 2026-03-21 07:52:57 +11:00
dependabot[bot] 7185c31d80 deps: bump rusqlite from 0.38.0 to 0.39.0 
Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.38.0 to 0.39.0.
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](https://github.com/rusqlite/rusqlite/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: rusqlite
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-20 09:17:18 +00:00
dependabot[bot] bc220b935d deps: bump toml from 1.0.4+spec-1.1.0 to 1.0.7+spec-1.1.0 
Bumps [toml](https://github.com/toml-rs/toml) from 1.0.4+spec-1.1.0 to 1.0.7+spec-1.1.0.
- [Commits](https://github.com/toml-rs/toml/compare/toml-v1.0.4...toml-v1.0.7)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.0.7+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-20 09:17:06 +00:00
dependabot[bot] 1d57611151 deps: bump tracing-subscriber from 0.3.22 to 0.3.23 
Bumps [tracing-subscriber](https://github.com/tokio-rs/tracing) from 0.3.22 to 0.3.23.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.22...tracing-subscriber-0.3.23)

---
updated-dependencies:
- dependency-name: tracing-subscriber
  dependency-version: 0.3.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-20 09:16:57 +00:00
dependabot[bot] 954bf745a5 deps: bump russh from 0.57.1 to 0.58.0 
Bumps [russh](https://github.com/warp-tech/russh) from 0.57.1 to 0.58.0.
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](https://github.com/warp-tech/russh/compare/v0.57.1...v0.58.0)

---
updated-dependencies:
- dependency-name: russh
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-20 09:16:46 +00:00
dependabot[bot] 49649179db deps: bump libc from 0.2.182 to 0.2.183 
Bumps [libc](https://github.com/rust-lang/libc) from 0.2.182 to 0.2.183.
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.183/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/libc/compare/0.2.182...0.2.183)

---
updated-dependencies:
- dependency-name: libc
  dependency-version: 0.2.183
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-13 09:20:23 +00:00