Skip to content

CHANGELOG.md

Latest commit

 

History

History
509 lines (281 loc) · 33.3 KB

CHANGELOG.md

File metadata and controls

509 lines (281 loc) · 33.3 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.23.1] - 2026-10-27

Security

  • Add IAKerb client authentication through a server proxy with KerberosConfig::new_with_iakerb, allowing logon without direct KDC access. (#751) (a738671298)

Features

  • [breaking] Add CredSspMode::RemoteGuard for Kerberos-only Remote Credential Guard logon using a direct KDC or KDC proxy; update exhaustive matches on CredSspMode. (#778) (9b664dd014)
  • Add sspi::rcg::RemoteGuardSession for one-time CredSSP context handoff, message protection, and redirected Kerberos operations; outbound Windows Kerberos authentication remains unverified. (#778) (9b664dd014)
  • Add opt-in redirected NTLMv2 authentication through enable_remote_guard_ntlm; it requires a fresh target logon and remains experimental. (#778) (9b664dd014)
  • Add SspiCredSsp::new_client_with_mode with the tsssp feature to select the CredSSP delegation mode explicitly. (#778) (9b664dd014)
  • Add CredentialsBuffers::extract_password to retrieve a password or smart-card PIN, returning an empty secret for keytab credentials. (#751) (a738671298)
  • [breaking] Rename KerberosConfig::new to KerberosConfig::new_with_kdc_url. (#751) (a738671298)
  • [breaking] Replace KerberosConfig::kdc_url with kdc_resolution; use KdcResolution::KdcUrl(url) for existing KDC configurations. (#751) (a738671298)
  • [breaking] Replace the top-level KerberosState::TgtExchange, Preauthentication, and ApExchange variants with Client and Server states and add Failed. (#751) (a738671298)
  • [breaking] Remove Copy from KerberosState; clone states explicitly where needed. (#751) (a738671298)
  • Update picky to =7.0.0-rc.27; consumers passing picky keys or certificates to sspi must use the matching version. (#751) (a738671298)

Bug Fixes

  • Accept a local-machine qualifier before an already-qualified username, such as .\AzureAD\user@example.com, including when the domain is supplied separately as .. (#767) (d87a57a704)
  • Accept Windows SPNEGO MIC tokens with sequence number zero on Kerberos clients while retaining checksum validation and acceptor sequence checks. (#772) (08d8622794)
  • Reuse the preauthentication salt when an AS-REP omits PA-ETYPE-INFO2, fixing password logons against MIT and Heimdal KDCs. (#768) (cf91195338)
  • Accept AS-REP encrypted parts tagged EncTGSRepPart as well as EncASRepPart for MIT KDC compatibility. (#768) (cf91195338)
  • Preserve explicitly empty salts and use the reply principal's default salt when PA-ETYPE-INFO2 omits the salt field. (#777) (e7ec8e45fd)
  • Reuse the negotiated preauthentication salt for password changes when the AS-REP omits its salt hint. (#777) (e7ec8e45fd)
  • Reuse the negotiated preauthentication salt when acquiring a password-backed user-to-user acceptor TGT. (#777) (e7ec8e45fd)
  • Accept both AS-REP encrypted-part tags in PKU2U session-key extraction. (#777) (e7ec8e45fd)
  • Require picky-krb 0.13.1 or later to fix PKU2U compilation with fresh dependency resolution. (#786) (f740f00451)
  • Make CredSspMode::CredentialLess send empty password credentials for all authentication sources, including smart cards and keytabs. (#778) (9b664dd014)
  • Forward SspiCredSsp credential acquisition and custom identity installation to the inner authentication provider. (#778) (9b664dd014)
  • Reject changes to the SspiCredSsp target name during authentication. (#778) (9b664dd014)

[0.23.0] - 2026-10-01

Features

  • [breaking] Upgrade winscard to 0.4, so the public From<winscard::Error> for sspi::Error conversion now uses the winscard 0.4 error type (#755) (37ebbb8dcd)

Bug Fixes

  • Encode the Kerberos KDC-REQ nonce as a minimal DER positive 32-bit integer, fixing intermittent KRB_AP_ERR_MODIFIED failures from Windows KDCs (#759) (c724a94076)
  • Accept AP-REP sequence numbers of any valid DER length, fixing intermittent mutual authentication failures against Windows acceptors (#759) (c724a94076)

[0.22.1] - 2026-09-29

Bug Fixes

  • Preserve the NTLM RC4 sealing state across MIC generation and verification (#753) (5b2b137e13)

    Generating or verifying a MIC no longer resets the NTLM RC4 sealing handles, so a message sealed right after a MIC keeps the correct state. CredSSP relies on this: it wraps pubKeyAuth after the initiator sends its mechListMIC but before it verifies the acceptor's MIC, and the previous reset dropped the advanced send state, corrupting the next wrapped message. Sequence numbers are unchanged.

  • Recover from KDC clock skew during the Kerberos AS exchange (#757) (24c9c52352)

    When a KDC rejects encrypted AS pre-authentication with KRB_AP_ERR_SKEW, the client derives the KDC time offset from the error's stime/susec and retries once; a second skew error or any other error is returned as before. The offset is applied to password, keytab, and smart-card pre-authentication timestamps, and to subsequent TGS, AP, and password-change authenticators, so Kerberos logon succeeds when the local clock differs from the KDC's.

[0.22.0] - 2026-09-15

Features

  • Add PKU2U acceptor support with configurable additional credentials and trusted client and server certificates (#733) (03ee8d0128)

  • Expose Pku2uCredential and Pku2uPrivateKey for PKU2U authentication configuration (#733) (03ee8d0128)

Improvements

  • [breaking] Make credssp::ts_request::TsRequest::buffer_len() return Result<u16> (#721) (a9dfaec9b0)

  • [breaking] Change kerberos::MAX_SIGNATURE and kerberos::SECURITY_TRAILER to u8 (#721) (a9dfaec9b0)

Bug Fixes

  • Preserve peer sequence numbers during Kerberos AP-REP and MIC validation (#717) (6d177082ed)

  • Accept @ in down-level account names (#719) (4878c50503)

  • Map ClientRequestFlags::EXTENDED_ERROR and ClientRequestFlags::IDENTIFY to Kerberos GSS request flags (#736) (0fb18798dd)

  • Generate and validate Kerberos MICs using the negotiated AES key size (#737) (7a3de33074)

Build

  • [breaking] Raise the minimum supported Rust version to 1.93 (#715) (5f85f13a15)

[0.21.3] - 2026-07-16

Features

  • Add format-tagged Username::parts view (#709) (80492e4c61)

    Add UsernameParts, a format-tagged, borrowed view into a Username, and Username::parts() returning it. Each variant only exposes the fields that are meaningful for its user name format, so a UPN suffix can no longer be mistaken for a NetBIOS domain: the UserPrincipalName arm has a suffix (and the full upn) but no "domain" field, while DownLevelLogonName carries an Option<netbios_domain> that models accurately the no-separator case. Matching is exhaustive over the two Microsoft user name formats.

[0.21.2] - 2026-07-15

Bug Fixes

  • Classify UPN keytab principals as NT_ENTERPRISE (#475) (491cf36fea)

    The keytab credentials branch passed keytab.principal.account_name() to get_client_principal_name_type, which strips the @suffix of a UPN. Without the @, the principal was misclassified as NT_PRINCIPAL instead of NT_ENTERPRISE (MS-KILE 3.3.5.6.1).

  • Avoid panic on short SRV record RDATA on macOS (#706) (a4ab1bbf0c)

[0.21.1] - 2026-06-26

Features

  • Add support for SECPKG_ATTR_NAMES (#676) (be6315d475)

  • Add keytab client credentials and standards-compliant SASL/GSSAPI acceptor support (#681) (d95f249622)

    Extends the sspi Kerberos implementation to interoperate with standards-compliant SASL/GSSAPI (RFC 4752 / RFC 4121) peers by adding keytab-backed client credentials, supporting integrity-only (unsealed) GSS_Wrap tokens, and allowing acceptors to validate tickets for multiple configured service principals.

  • Support for Kerberos cross realm referral (#694) (797365417f)

Bug Fixes

Build

  • Advance RustCrypto pins to the current rc.18/rc.33/rc.10 cluster (#692) (095e3f341c)

  • Update RC and crypto dependencies to latest versions (#699) (c5922db0f4)

[0.21.0] - 2026-05-06

Bug Fixes

  • [breaking] Remove redundant PKCS#1 padding when signing hashes (#660) (9e8a108f02)

[0.20.1] - 2026-04-29

Build

[0.20.0] - 2026-04-27

Bug Fixes

  • [breaking] Remove legacy UTF-16 helpers (#648) (b8f21e1bf3)

  • Add KDC connect timeout to prevent 75s hang on unreachable KDC (#647) (abb9ffe16d)

[0.19.2] - 2026-03-26

Bug Fixes

  • Fall back to NTLM when the target SPN is an IP address (#637) (67dbac66cc)

[0.19.1] - 2026-03-23

Bug Fixes

  • Improve NTLM fallback (#627) (88bb31796c)

    Improved SPNEGO/Negotiate authentication resilience by introducing an explicit Kerberos-first attempt with a controlled fallback to NTLM for a defined set of Kerberos failure conditions (per the referenced FreeRDP behavior), and updates the Kerberos/SPNEGO token flow to support that behavior reliably.

  • Handle ISC_REQ_USE_DCE_STYLE and SECBUFFER_READONLY in EncryptMessage (#629) (93e962be78)

    Adjusts the NTLM SSPI implementation to better interoperate with RPC/FreeRDP over RD Gateway by (a) treating ISC_REQ_USE_DCE_STYLE as implying sealing/signing, and (b) allowing EncryptMessage to operate in sign-only mode when all SECBUFFER_DATA buffers are marked SECBUFFER_READONLY.

[0.19.0] - 2026-03-13

Features

  • [breaking] Introduce UTF-16 strings helpers and refactor auth identity types (#606) (1bfee5e545)

[0.18.9] - 2026-03-06

Features

  • Support multiple credential candidates (#611) (2ded76b767)

    Enable the CredSSP server-side NTLM flow to authenticate against a bounded set of concurrently-valid credential candidates for a single user, selecting the one the client proves knowledge of.

Bug Fixes

  • Include full error source chain in reqwest client build error (#621) (3ba4886776)

  • Remove NTLM password length heuristic (#619) (c607a229da)

    compute_ntlm_v2_hash treats passwords longer than 512 bytes as pre-computed NT hashes and tries to decode them with convert_password_hash. This silently breaks authentication for any plaintext password that exceeds that threshold (e.g. long JWT tokens).

[0.18.8] - 2026-02-26

Features

  • Improve domain->realm mapping in kerberos backend (#604) (50cff70f0e)

Bug Fixes

Build

  • Update dependencies

[0.18.7] - 2026-01-16

Features

  • NT Hash Authentication (#585) (21b45e16dc)

    Adds support for NT hash (pass-the-hash) authentication, allowing authentication using pre-computed NT hashes instead of plaintext passwords.

[0.18.6] - 2026-01-05

Bug Fixes

  • Accept variable-length MsvAvSingleHost AvPair (#580) (28f8d74b8c)

    Windows 11 Build 26200+ sends an 80-byte MsvAvSingleHost structure instead of the traditional 48 bytes. Per MS-NLMP specification, fields after MachineID MUST be ignored on receipt.

    This change:

    • Changes SingleHost from fixed [u8; 48] to Vec
    • Relaxes validation from == 48 to >= 48 bytes
    • Preserves full data for round-trip serialization

    Fixes RDP credential injection failures when clients use Windows 11 Build 26200 or later.

[0.18.5] - 2025-12-11

Bug Fixes

  • Don't use eprintln on unknown packages (#558) (df6181291c)

  • Use String::from_utf16_lossy over String::from_utf16 to avoid changing the meaning of some buffers in case of invalid UTF-16 input (#568) (a4889f5b1e)

Build

  • Update dependencies

[0.18.4] - 2025-11-18

Build

  • Exclude cryptoki for WASM (#545) (9e4a84a9ee)

    This fixes builds for the wasm32 target.

[0.18.3] - 2025-11-07

Features

  • Add NT_ENTERPRISE support in server-side Kerberos (#535) (40785e3123)

    This is needed when want to connect using FQDN instead of down-level logon name.

Revert

  • Implement Default for SmartCardType (#534) (7280f7a67b)

    It actually does not make sense to implement Default for SmartCardType. A user-provided PIN must be set.

    Release 0.18.2 was yanked.

Bug Fixes

  • TLS 1.3 support in TSSSP module (#536) (0605cf01f8)

    • Adds CipherSuite::TLS13_AES_256_GCM_SHA384 support.
    • Fixes TLS packet header validation: TLS 1.3 uses TLS 1.2 version in the packet header.

  • Pin leftover pre-release crypto crates (#538) (6fc91fa977)

    The patch version upgrade is not allowed to bring breaking changes, but this rule doesn't work for an rc version. So we should pin the rc versions, to not allow cargo update to a new rc automatically.

[0.18.2] - 2025-11-04 (Yanked)

Features

[0.18.1] - 2025-10-29

Build

[0.18.0] - 2025-10-14

Bug Fixes

  • DH client default parameters: remove leading zero (#514) (8114b570bc)

  • [breaking] Async network client returns !Send future (#513) (218ddf3e79)

Build

[0.17.0] - 2025-10-06

Features

Bug Fixes

  • [breaking] Move cert_utils from sspi crate to ffi (#507) (c9337c8f64)

  • [breaking] Fix lifetimes in initialize_security_context_impl (#495) (370951c1b0)

Build

  • Bump the windows crates

  • Bump the crypto dependencies (#489) (1ecba764ec)

[0.16.1] - 2025-08-19

Features

  • Add method to set the channel bindings for a session (#479) (0c0e225fe7)

    Setting and sending the CBs is described in Sec. 3.1.5.2.1 of the NTLM spec, admittedly in a slightly confusing way, which may seem to suggest that the bindings are somehow part of the CHALLENGE message, but they are not: knowledge of CBs is strictly local to the client, therefore the client should send them in AUTHENTICATE.

[0.16.0] - 2025-07-07

Features

  • Server-side Kerberos implementation (#440) (943a297edd)

Bug Fixes

  • Server-side Kerberos fixes (#457) (27ce28dad5)

  • Kerberos server MIC token generation and validation (#464) (12fbd706a8)

  • Kerberos server WRAP token generation and validation (#463) (4bbe4071c8)

[0.15.14] - 2025-07-01

Build

[0.15.13] - 2025-06-23

Build

  • Bump windows-sys from 0.59.0 to 0.60.2 in the windows group across 1 directory (#455) (5744c8b4b3)

[0.15.12] - 2025-06-20

Bug Fixes

  • Invalid Kerberos token DER encoding (#453) (0ec3e687dd)

    The default behavior of serializing a KrbMessage was accidentally changed.

[0.15.11] - 2025-06-11

Bug Fixes

  • Negotiate attempts KDC detection even when Kerberos is disabled (#447) (c56132c3f8)

[0.15.10] - 2025-06-10

Build

[0.15.9] - 2025-06-05

Build

  • Bump windows-registry from 0.4.0 to 0.5.2 in the windows group across 1 directory (#444) (9a349f7bdc)

[0.15.8] - 2025-06-05

Build

  • Migrate from winreg to windows-registry crate (#441) (8631235c8a)

[0.15.7] - 2025-05-29

Bug Fixes

  • Do not log at info-level return values (#438) (68d02e410d)

[0.15.6] - 2025-05-27

Bug Fixes

  • Lower info-level logs to debug-level (#436) (665cb1e1dc)

[0.15.5] - 2025-04-25

Features

  • Add query_context_session_key (#417) (862657a57c)

    This addition is an implementation for the SSP API QueryContextAttributesEx(SECPKG_ATTR_SESSION_KEY). It is required for protocols such as SMB, and adding it to the Sspi trait, enables access to it across all the SSP packages implemented.

    This adds the option for using Kerberos and Negotiate session keys.

[0.15.4] - 2025-03-24

Build

  • Update dependencies

[0.15.3] - 2025-03-12

Bug Fixes

  • Set correct seq number in MIC token (#390) (69f03c2933)

    Fixes Kerberos LDAP auth. The problem was in the invalid sequence number in MIC token.

  • NTLM RPC auth (#395) (34d896c9ce)

[0.15.2] - 2025-02-27

Features

  • Support SECBUFFER_READONLY_WITH_CHECKSUM flag (#357) (397fd9502d)

  • Add USE_DCE_STYLE flag support (#358) (0f78bccaea)

Bug Fixes

  • Kerberos authentication and encryption for RPC and RDP (#372) (442dfc1382)

[0.15.1] - 2025-02-04

Features

  • Add make_signature and verify_signature to Sspi trait (#343) (040188a34d)

Bug Fixes

  • Store session key when using server-side NTLM implementation (#354) (41d1ca7fed)