fix(dgw): checkout injection before connecting upstream

Missing Kerberos krb_kdc must fail closed without dialing the target.

Issue: DGW-1900

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: irvingoujAtDevolution

devolutions-gateway/src/generic_client.rs

@@ -131,6 +131,31 @@ where
                     MappingStatus::Absent => false,
                 };
 
+                // Checkout before dialing so missing Kerberos material cannot open an upstream socket.
+                let credential_injection = if inject {
+                    let kerberos_enabled = crate::credential_injection::kerberos_injection_opt_in(
+                        conf.debug.enable_unstable,
+                        conf.debug.kerberos_credential_injection,
+                    );
+                    Some(
+                        CredentialInjection::checkout(
+                            &provisioning,
+                            &synthetic_kdc_registry,
+                            claims.jti,
+                            token,
+                            kerberos_enabled,
+                        )
+                        .with_context(|| {
+                            format!(
+                                "credential-injection material for {} is missing or expired; re-provision to retry",
+                                claims.jti
+                            )
+                        })?,
+                    )
+                } else {
+                    None
+                };
+
                 let ConnectedUpstream {
                     leg: mut server_stream,
                     server_addr,
@@ -159,25 +184,7 @@ where
 
                 let disconnect_interest = DisconnectInterest::from_reconnection_policy(claims.jet_reuse);
 
-                if inject {
-                    let kerberos_enabled = crate::credential_injection::kerberos_injection_opt_in(
-                        conf.debug.enable_unstable,
-                        conf.debug.kerberos_credential_injection,
-                    );
-                    let credential_injection = CredentialInjection::checkout(
-                        &provisioning,
-                        &synthetic_kdc_registry,
-                        claims.jti,
-                        token,
-                        kerberos_enabled,
-                    )
-                    .with_context(|| {
-                        format!(
-                            "credential-injection material for {} is missing or expired; re-provision to retry",
-                            claims.jti
-                        )
-                    })?;
-
+                if let Some(credential_injection) = credential_injection {
                     info!(
                         jti = %credential_injection.jti(),
                         kerberos = credential_injection.uses_kerberos(),

devolutions-gateway/src/rd_clean_path.rs

@@ -471,16 +471,6 @@ async fn handle_with_credential_injection(
         .clone()
         .context("missing token in RDCleanPath PDU")?;
 
-    let ConnectedRdpServer {
-        tls_stream: server_stream,
-        server_addr,
-        selected_target: destination,
-        x224_rsp,
-    } = connect_rdp_server(&claims, cleanpath_pdu, agent_tunnel_handle.as_ref())
-        .await
-        .context("RDCleanPath connection failed")?;
-    let x224_rsp = x224_rsp.context("RDCleanPath credential injection requires X.224")?;
-
     let kerberos_enabled = crate::credential_injection::kerberos_injection_opt_in(
         conf.debug.enable_unstable,
         conf.debug.kerberos_credential_injection,
@@ -491,7 +481,18 @@ async fn handle_with_credential_injection(
         claims.jti,
         &token,
         kerberos_enabled,
-    )?;
+    )
+    .context("checkout credential-injection material before connecting upstream")?;
+
+    let ConnectedRdpServer {
+        tls_stream: server_stream,
+        server_addr,
+        selected_target: destination,
+        x224_rsp,
+    } = connect_rdp_server(&claims, cleanpath_pdu, agent_tunnel_handle.as_ref())
+        .await
+        .context("RDCleanPath connection failed")?;
+    let x224_rsp = x224_rsp.context("RDCleanPath credential injection requires X.224")?;
 
     let gateway_cert_chain_handle = tokio::spawn(crate::tls::get_cert_chain_for_acceptor_cached(
         gateway_hostname,