Public bug reported:
After upgrading freerdp3 from 3.30.0+dfsg-0ubuntu0.26.04.2 to
3.32.1+dfsg-0ubuntu0.26.04.1 (resolute-security/updates), Microsoft
Windows App on macOS can no longer connect to gnome-remote-desktop
(Remote Login mode). The client hangs forever at "Securing connection
to remote PC" after entering correct credentials. Wrong credentials are
still rejected immediately, so authentication itself works.
Downgrading libfreerdp3-3, libfreerdp-server3-3 and libwinpr3-3 to
3.24.2+dfsg-1ubuntu1 (resolute release pocket) fixes the problem.
gnome-remote-desktop itself was not upgraded.
== Versions ==
Ubuntu: 26.04 (resolute), amd64
gnome-remote-desktop: <dpkg -l gnome-remote-desktop 的版本号>
libfreerdp-server3-3 / libfreerdp3-3 / libwinpr3-3:
- 3.30.0+dfsg-0ubuntu0.26.04.2: works (worked after fresh install, per apt
history)
- 3.32.1+dfsg-0ubuntu0.26.04.1: BROKEN
- 3.24.2+dfsg-1ubuntu1: works
Client: Microsoft Windows App <版本号> on macOS <版本号>
FreeRDP client (sdl-freerdp) on the same Mac connects fine with both
/sec:nla and /sec:ext against 3.32.1.
== Steps to reproduce ==
1. Ubuntu 26.04 with gnome-remote-desktop in Remote Login mode
(grdctl --system rdp enable), freerdp3 libs at 3.32.1.
2. Connect from Windows App on macOS, accept certificate, enter
correct credentials.
3. Client stays at "Securing connection to remote PC" until it times out.
== Analysis ==
Server debug log (WLOG_LEVEL=DEBUG) shows NLA (HYBRID_EX, Early User
Auth) completes successfully, then the server waits in
CONNECTION_STATE_MCS_CREATE_REQUEST and the client never sends the
MCS Connect Initial PDU:
rdp_server_accept_nego: Negotiated Security: RDSTLS:0 NLA:0 EXT:1 TLS:0 RDP:0
nla_set_early_user_auth: Early User Auth active: true
ntlm_change_state: change state from NTLM_STATE_AUTHENTICATE to
NTLM_STATE_FINAL
credssp_auth_authenticate: Authentication complete (output token size: 0
bytes)
nla_send: ----->> public key auth
nla_send_early_user_auth: ----->> sending AUTHZ_SUCCESS
nla_decode_ts_request: <<----- auth info
rdp_server_transition_to_state: CONNECTION_STATE_NEGO -->
CONNECTION_STATE_MCS_CREATE_REQUEST
... (~2 minutes later, client gives up)
transport_read_layer: BIO_read retries exceeded
rdp_send_deactivate_all: rdpMcs::userId == 0, skip sending
PDU_TYPE_DEACTIVATE_ALL
Note the ordering: the server sends the Early User Authorization Result
(AUTHZ_SUCCESS) *before* it receives the client's TSCredentials
("auth info"). Per MS-RDPBCGR (HYBRID_EX), the authorization result is
expected after the client has sent its credentials. The Microsoft client
appears to not handle this and keeps waiting.
tcpdump confirms there is no packet loss; both sides are idle with only
TCP keepalives after the client sends its 100-byte TSCredentials:
client > server length 473 (NTLM AUTHENTICATE)
server > client length 81 (pubKeyAuth)
server > client length 26 (AUTHZ result, 4 bytes in TLS 1.3 record)
client > server ack (all server data acknowledged)
client > server length 100 (TSCredentials)
server > client ack
... only zero-length keepalives in both directions afterwards
== Workaround ==
sudo apt install --allow-downgrades \
libfreerdp3-3=3.24.2+dfsg-1ubuntu1 \
libfreerdp-server3-3=3.24.2+dfsg-1ubuntu1 \
libwinpr3-3=3.24.2+dfsg-1ubuntu1
sudo apt-mark hold libfreerdp3-3 libfreerdp-server3-3 libwinpr3-3
sudo systemctl restart gnome-remote-desktop
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: libfreerdp-server3-3 3.24.2+dfsg-1ubuntu1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Oct 21 19:52:30 2026
InstallationDate: Installed on 2026-10-21 (0 days ago)
InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64
(20260826)
SourcePackage: freerdp3
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: freerdp3 (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171611
Title:
libfreerdp-server3-3 3.32.1 regression: Microsoft Windows App (macOS)
hangs at "Securing connection" with gnome-remote-desktop
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/freerdp3/+bug/2171611/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
