perf(connector): add capture-backed replay

[Benoît Cortier (CBenoit)]

Drive the no-NLA capture through the production connector and an ActiveStage so connection and session work can be measured independently per capture.

Verify immutable capture counters, protocol output sequencing, and semantic output before timing. The strict contract validates captured Save Session Info events, reconnect-cookie position and logon ID, termination reasons, and the deterministic bitmap update; reconnect credential bytes are never recorded. Strict licensing verification retains the stable PlatformId and normalizes only ClientRandom and EncryptedPreMasterSecret. Timed executions retain fresh-state framing and session validation without hashing output payloads.

Model TLS completion as an external boundary and retain opaque static-channel payload semantics as an explicit exclusion.

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[github-actions]

Bench-crate-only addition that drives the production ClientConnector through the pinned no-nla-accepted capture and an ActiveStage, with strict counters, PDU-sequence, and semantic-fingerprint preflight outside the timed path. The design is sound, well documented, and confined to ironrdp-bench; no correctness defect was found. One open question remains: the pinned graphics_updates=0 contract is unreconciled with the same capture's passive corpus entry recording 78 updates, plausibly explained by the documented EGFX/opaque-static-channel exclusions and the synthesized client configuration but not stated. The rest are low-severity maintainability items: duplicated outbound decode walks, prepare(id) hardcoding the capture, duplicated cache-path logic, a redundant capture re-hash/read, a cloned error type, a dead non-TLS branch, a double-enforced constant counter, and the strict contract missing from the documented CI regression entry point.

[Copilot]

🔵 Needs a closer look

The immutable PDU contract rejects the expected license request, and strict verification omits important session outputs.

Review details

Suppressed comments (2)

crates/ironrdp-bench/src/connector_replay.rs:61

• The contract leaves no slot for the license request that this workload is designed to produce. outbound_frames + active_response_frames is 46, while the 12-entry prefix plus 34 session frames also consumes all 46 entries; inspect_send_data classifies the generated request as ClientNewLicenseRequest, so every verify() and replay() fails sequence validation. Include that PDU after ClientInfo and reduce the remaining session-frame count to 33.

    session_data_frames: 34,

crates/ironrdp-bench/src/connector_replay.rs:875

• Strict verification silently ignores every semantic ActiveStageOutput except response frames; graphics regions/pixels, termination, deactivation, save-session state, pointer events, and other outputs never affect the fingerprint or contract. Consequently the advertised semantic preflight can pass even if the session terminates or the deterministic bitmap renders incorrect data. In the strict path, fingerprint or explicitly validate every expected output variant (including the exact deterministic region/framebuffer), and reject unsupported state-changing outputs.

    for output in outputs {
        if let ActiveStageOutput::ResponseFrame(frame) = output {
            response_frames += validate_outbound_frames(

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

PR 1947 adds a capture-backed connector replay benchmark that drives the production ClientConnector to Connected, builds an ActiveStage, and validates an immutable counter, outbound-PDU, semantic-output, and fingerprint contract outside timing. Verification is fail-closed: passive preflight, TLS-only negotiation checks, CredSSP/multitransport guards, normalized-credential assertions, and license-secret exclusion all check out against connector/session sources. No correctness defects found; the code-compressor's five valid low-severity maintenance candidates (an unreachable empty check, contract/measurement field mirroring, duplicated capture-path resolution, first_frame reimplementing framed_stream, and a twice-decoded outbound chain) are accepted as-is.

[github-actions]

This pull request may overlap with #1944.

Both PRs define capture-replay benchmark workloads in ironrdp-bench with strict preflight verification outside Criterion timing, identifiable workload IDs, a standalone single-execution measurement binary, and xtask README guidance, touching the same files: benches/capture_replay.rs, src/bin/capture_replay_bench.rs, src/replay.rs, and xtask/README.md.

This notice is advisory only. Automated review continues as usual, and how these pull requests relate is for maintainers and authors to decide.

Note

LLM-assisted content (no human feedback).