test(dgw): cover credential injection reconnect hops

[irvingouj@Devolutions (irvingoujAtDevolution)]

Add process-level Gateway tests for DVLS-like preflight, TCP and RDCleanPath injection, NTLM and Kerberos CredSSP, fail-closed missing mappings, and missing krb_kdc without dialing the target.

RDCleanPath cases drive the public ironrdp-agent 0.1.0 CLI over ws://127.0.0.1/jet/rdp.

Issue: DVLS-14697

[irvingouj@Devolutions (irvingoujAtDevolution)]

Implementation notes:

• Tests live in testsuite/tests/cli/dgw/cred_injection.rs and start a real Gateway with disable_token_validation.
• DVLS-like /jet/preflight posts provision-credentials and, for Kerberos, provision-connection-options.krb_kdc.
• The client sends a PCB v2 blob (JWT in v2_payload) plus an X.224 Connection Request with Cookie: mstshash=client-cookie-user.
• The destination is a loopback TCP peer that records the rewritten mstshash cookie. CredSSP is not completed; sspi-rs / IronRDP are not run as a fake KDC or RDP server.
• First inject, jet_reuse reconnect (get not take), required-but-expired fail-closed, and unprovisioned ordinary forward are asserted from Gateway logs and the cookie.
• Kerberos overlapping reconnects must publish the synthetic KDC once for the same provisioning generation; a later provision publishes again.

Note

LLM-assisted content (no human feedback).

[Copilot]

Pull request overview

Adds process-level coverage for Gateway RDP credential injection.

Changes:

• Tests NTLM injection, reconnect attempts, expiration, and fail-closed routing.
• Adds mock KDC and CredSSP integration coverage.
• Extends test configuration and dependencies.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Cargo.lock	Locks new test dependencies.
testsuite/Cargo.toml	Adds Kerberos and IronRDP test dependencies.
testsuite/src/dgw_config.rs	Exposes Kerberos injection test configuration.
testsuite/tests/cli/dgw/mod.rs	Registers new test modules.
testsuite/tests/cli/dgw/cred_injection.rs	Adds credential injection lifecycle tests.
testsuite/tests/cli/dgw/cred_injection_kdc.rs	Adds mock KDC/CredSSP integration testing.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Benoît Cortier (CBenoit)]

Thank you, I really appreciate the e2e tests here.

Architecturally-wise, I think the "helpers" are getting big enough that it may warrant some of the code to be moved somewhere under the lib.rs of the testsuite crate. One example could be FakeRdpTarget. If the "TLS fixtures" are meant to be shared, then I think the library side could be the best place.

It’s already pretty close, but make things as self-contained as possible so it’s possible to use the INTENT.md / .intent.md convention for providing some human documentation about the most meaningful abstractions and important properties under test. I would appreciate such files before we merge this PR.