TSSSP module

Cargo.toml

@@ -24,6 +24,8 @@ exclude = [
 default = []
 network_client = ["dep:reqwest", "dep:portpicker"]
 dns_resolver = ["dep:trust-dns-resolver"]
+# TSSSP should be used only on Windows as a native CREDSSP replacement
+tsssp = ["dep:rustls"]
 
 [dependencies]
 byteorder = "1.2.7"
@@ -55,6 +57,7 @@ trust-dns-resolver = { version = "0.21.2", optional = true }
 portpicker = { version = "0.1.1", optional = true }
 num-bigint-dig = "0.8.1"
 tracing = { version = "0.1.37" }
+rustls = { version = "0.20.7", features = ["dangerous_configuration"], optional = true }
 
 [target.'cfg(windows)'.dependencies]
 winreg = "0.10"

ffi/Cargo.toml

@@ -14,17 +14,20 @@ crate-type = ["cdylib"]
 
 [features]
 debug_mode = ["dep:tracing", "dep:tracing-subscriber"]
+tsssp = ["sspi/tsssp"]
 
 [dependencies]
 cfg-if = "0.1"
-sspi = { path = "..", features = ["network_client", "dns_resolver"] }
 libc = "0.2"
 num-traits = "0.2"
 whoami = "1.2.3"
+sspi = { path = "..", features = ["network_client", "dns_resolver"] }
 
 # For debugging only
 tracing = { version = "0.1.37", optional = true }
 tracing-subscriber = { version = "0.3.16", features = ["std", "fmt", "local-time", "env-filter"], optional = true }
 
 [target.'cfg(windows)'.dependencies]
 symbol-rename-macro = { path = "./symbol-rename-macro" }
+winapi = "0.3.9"
+windows-sys = { version = "0.42.0", features = ["Win32_Security_Authentication_Identity", "Win32_Security_Credentials", "Win32_Foundation"] }

ffi/src/common.rs

@@ -308,7 +308,6 @@ pub unsafe extern "system" fn DecryptMessage(
     catch_panic! {
         check_null!(ph_context);
         check_null!(p_message);
-        check_null!(pf_qop);
 
         let sspi_context = try_execute!(p_ctxt_handle_to_sspi_context(
             &mut ph_context,
@@ -329,7 +328,10 @@ pub unsafe extern "system" fn DecryptMessage(
             };
 
         copy_to_c_sec_buffer((*p_message).p_buffers, &message, false);
-        *pf_qop = decryption_flags.bits().try_into().unwrap();
+        // `pf_qop` can be null if this library is used as a CredSsp security package
+        if !pf_qop.is_null() {
+            *pf_qop = decryption_flags.bits().try_into().unwrap();
+        }
 
         try_execute!(result_status);
 

ffi/src/sec_buffer.rs

@@ -6,7 +6,7 @@ use libc::c_char;
 use libc::c_uint;
 #[cfg(target_os = "windows")]
 use libc::c_ulong;
-use num_traits::FromPrimitive;
+use num_traits::{FromPrimitive, ToPrimitive};
 use sspi::{SecurityBuffer, SecurityBufferType};
 
 #[cfg(target_os = "windows")]
@@ -18,6 +18,7 @@ pub struct SecBuffer {
 }
 
 #[cfg(not(target_os = "windows"))]
+#[derive(Debug)]
 #[repr(C)]
 pub struct SecBuffer {
     pub cb_buffer: c_uint,
@@ -66,7 +67,8 @@ pub(crate) unsafe fn copy_to_c_sec_buffer(to_buffers: PSecBuffer, from_buffers:
         let buffer = &from_buffers[i];
         let buffer_size = buffer.buffer.len();
         to_buffers[i].cb_buffer = buffer_size.try_into().unwrap();
-        if allocate {
+        to_buffers[i].buffer_type = buffer.buffer_type.to_u32().unwrap();
+        if allocate || to_buffers[i].pv_buffer.is_null() {
             let memory_layout = Layout::from_size_align_unchecked(buffer_size, 8);
             to_buffers[i].pv_buffer = alloc(memory_layout) as *mut c_char;
         }