Add make_signature and verify_signature to Sspi trait.

src/credssp/mod.rs

@@ -953,6 +953,36 @@ impl Sspi for SspiContext {
             self.change_password_impl(&mut yield_point, change_password).await
         }))
     }
+
+    fn make_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus> {
+        match self {
+            SspiContext::Ntlm(ntlm) => ntlm.make_signature(flags, message, sequence_number),
+            SspiContext::Kerberos(kerberos) => kerberos.make_signature(flags, message, sequence_number),
+            SspiContext::Negotiate(negotiate) => negotiate.make_signature(flags, message, sequence_number),
+            SspiContext::Pku2u(pku2u) => pku2u.make_signature(flags, message, sequence_number),
+            #[cfg(feature = "tsssp")]
+            SspiContext::CredSsp(credssp) => credssp.make_signature(flags, message, sequence_number),
+        }
+    }
+
+    fn verify_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<crate::SignatureFlags> {
+        match self {
+            SspiContext::Ntlm(ntlm) => ntlm.verify_signature(flags, message, sequence_number),
+            SspiContext::Kerberos(kerberos) => kerberos.verify_signature(flags, message, sequence_number),
+            SspiContext::Negotiate(negotiate) => negotiate.verify_signature(flags, message, sequence_number),
+            SspiContext::Pku2u(pku2u) => pku2u.verify_signature(flags, message, sequence_number),
+            #[cfg(feature = "tsssp")]
+            SspiContext::CredSsp(credssp) => credssp.verify_signature(flags, message, sequence_number),
+        }
+    }
 }
 
 impl SspiEx for SspiContext {

src/kerberos/mod.rs

@@ -441,6 +441,22 @@ impl Sspi for Kerberos {
             self.change_password(&mut yield_point, change_password).await
         }))
     }
+
+    fn make_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus> {
+        todo!()
+    }
+
+    fn verify_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<crate::SignatureFlags> {
+        todo!()
+    }
 }
 
 impl SspiImpl for Kerberos {

src/lib.rs

@@ -602,6 +602,19 @@ where
         sequence_number: u32,
     ) -> Result<SecurityStatus>;
 
+    /// TODO
+    fn make_signature(&mut self,
+        flags: SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus>;
+
+    fn verify_signature(&mut self,
+        flags: SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SignatureFlags>;
+
     /// Decrypts a message. Some packages do not encrypt and decrypt messages but rather perform and check an integrity hash.
     ///
     /// # Parameters
@@ -1066,6 +1079,13 @@ bitflags! {
     }
 }
 
+bitflags! {
+    /// TODO
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+    pub struct SignatureFlags: u32 {
+    }
+}
+
 bitflags! {
     /// Indicate requests for the context. Not all packages can support all requirements. Bit flags can be combined by using bitwise-OR operations.
     ///

src/negotiate.rs

@@ -374,6 +374,22 @@ impl Sspi for Negotiate {
             self.change_password(&mut yield_point, change_password).await
         }))
     }
+
+    fn make_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus> {
+        todo!()
+    }
+
+    fn verify_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<crate::SignatureFlags> {
+        todo!()
+    }
 }
 
 impl SspiImpl for Negotiate {

src/ntlm/mod.rs

@@ -21,8 +21,8 @@ use crate::{
     ClientRequestFlags, ClientResponseFlags, ContextNames, ContextSizes, CredentialUse, DecryptionFlags,
     EncryptionFlags, Error, ErrorKind, FilledAcceptSecurityContext, FilledAcquireCredentialsHandle,
     FilledInitializeSecurityContext, InitializeSecurityContextResult, OwnedSecurityBuffer, PackageCapabilities,
-    PackageInfo, SecurityBuffer, SecurityBufferType, SecurityPackageType, SecurityStatus, ServerResponseFlags, Sspi,
-    SspiEx, SspiImpl, PACKAGE_ID_NONE,
+    PackageInfo, SecurityBuffer, SecurityBufferType, SecurityPackageType, SecurityStatus, ServerResponseFlags,
+    SignatureFlags, Sspi, SspiEx, SspiImpl, PACKAGE_ID_NONE,
 };
 
 pub const PKG_NAME: &str = "NTLM";
@@ -368,6 +368,50 @@ impl Ntlm {
             expiry: None,
         })
     }
+
+    fn compute_checksum(
+        &mut self,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+        digest: &[u8; 16],
+    ) -> crate::Result<SecurityStatus> {
+        let checksum = self
+            .send_sealing_key
+            .as_mut()
+            .unwrap()
+            .process(&digest[0..SIGNATURE_CHECKSUM_SIZE]);
+
+        let signature_buffer = SecurityBuffer::find_buffer_mut(message, SecurityBufferType::Token)?;
+        if signature_buffer.buf_len() < SIGNATURE_SIZE {
+            return Err(Error::new(ErrorKind::BufferTooSmall, "The Token buffer is too small"));
+        }
+        let signature = compute_signature(&checksum, sequence_number);
+        signature_buffer.write_data(signature.as_slice())?;
+
+        Ok(SecurityStatus::Ok)
+    }
+
+    fn check_signature(
+        &mut self,
+        sequence_number: u32,
+        digest: &[u8; 16],
+        signature: &[u8],
+    ) -> crate::Result<()> {
+        let checksum = self
+            .recv_sealing_key
+            .as_mut()
+            .unwrap()
+            .process(&digest[0..SIGNATURE_CHECKSUM_SIZE]);
+        let expected_signature = compute_signature(&checksum, sequence_number);
+
+        if signature != expected_signature.as_ref() {
+            return Err(Error::new(
+                ErrorKind::MessageAltered,
+                "Signature verification failed, something nasty is going on!",
+            ));
+        }
+        Ok(())
+    }
 }
 
 impl Sspi for Ntlm {
@@ -398,18 +442,7 @@ impl Sspi for Ntlm {
         }
         data.write_data(&encrypted_data)?;
 
-        let checksum = self
-            .send_sealing_key
-            .as_mut()
-            .unwrap()
-            .process(&digest[0..SIGNATURE_CHECKSUM_SIZE]);
-
-        let signature_buffer = SecurityBuffer::find_buffer_mut(message, SecurityBufferType::Token)?;
-        if signature_buffer.buf_len() < SIGNATURE_SIZE {
-            return Err(Error::new(ErrorKind::BufferTooSmall, "The Token buffer is too small"));
-        }
-        let signature = compute_signature(&checksum, sequence_number);
-        signature_buffer.write_data(signature.as_slice())?;
+        self.compute_checksum(message, sequence_number, &digest)?;
 
         Ok(SecurityStatus::Ok)
     }
@@ -437,19 +470,7 @@ impl Sspi for Ntlm {
         save_decrypted_data(&decrypted, message)?;
 
         let digest = compute_digest(&self.recv_signing_key, sequence_number, &decrypted)?;
-        let checksum = self
-            .recv_sealing_key
-            .as_mut()
-            .unwrap()
-            .process(&digest[0..SIGNATURE_CHECKSUM_SIZE]);
-        let expected_signature = compute_signature(&checksum, sequence_number);
-
-        if signature != expected_signature.as_ref() {
-            return Err(Error::new(
-                ErrorKind::MessageAltered,
-                "Signature verification failed, something nasty is going on!",
-            ));
-        }
+        self.check_signature(sequence_number, &digest, signature)?;
 
         Ok(DecryptionFlags::empty())
     }
@@ -503,6 +524,47 @@ impl Sspi for Ntlm {
             "NTLM does not support change pasword",
         ))
     }
+
+    fn make_signature(
+        &mut self,
+        _flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus> {
+        if self.recv_sealing_key.is_none() {
+            self.complete_auth_token(&mut [])?;
+        }
+
+        SecurityBuffer::find_buffer(message, SecurityBufferType::Token)?; // check if exists
+
+        let data = SecurityBuffer::find_buffer_mut(message, SecurityBufferType::Data)?;
+        let digest = compute_digest(&self.send_signing_key, sequence_number, data.data())?;
+
+        self.compute_checksum(message, sequence_number, &digest)?;
+
+        Ok(SecurityStatus::Ok)
+    }
+
+    fn verify_signature(
+        &mut self,
+        _flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SignatureFlags> {
+        if self.recv_sealing_key.is_none() {
+            self.complete_auth_token(&mut [])?;
+        }
+
+        SecurityBuffer::find_buffer(message, SecurityBufferType::Token)?; // check if exists
+
+        let data = SecurityBuffer::find_buffer(message, SecurityBufferType::Data)?;
+        let digest = compute_digest(&self.recv_signing_key, sequence_number, data.data())?;
+
+        let signature = SecurityBuffer::find_buffer(message, SecurityBufferType::Token)?;
+        self.check_signature(sequence_number, &digest, signature.data())?;
+
+        Ok(SignatureFlags::empty())
+    }
 }
 
 impl SspiEx for Ntlm {

src/pku2u/mod.rs

@@ -339,6 +339,22 @@ impl Sspi for Pku2u {
             "Pku2u does not support change pasword",
         ))
     }
+
+    fn make_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<SecurityStatus> {
+        todo!()
+    }
+
+    fn verify_signature(&mut self,
+        flags: crate::SignatureFlags,
+        message: &mut [SecurityBuffer],
+        sequence_number: u32,
+    ) -> crate::Result<crate::SignatureFlags> {
+        todo!()
+    }
 }
 
 impl SspiImpl for Pku2u {