Fix header type for SSPI response message - #351
Open
staticlibs wants to merge 1 commit into
Open
Conversation
MattJackson
added a commit
to MattJackson/tiberius-ng
that referenced
this pull request
Aug 29, 2026
prisma#390, prisma#411) - header.rs: allow(dead_code) on PacketHeader::sspi (platform/feature-gated use) - connection.rs: drop needless reborrow in the zeroizing send path - row.rs: elide lifetime on get_column_data - rustfmt negative-numeric formatting from prisma#390
joelparkerhenderson
added a commit
to mssql-rust/mssql-rust
that referenced
this pull request
Aug 29, 2026
Mirrors prisma/tiberius#351. Per MS-TDS, the multi-step SSPI challenge-response continuation sent during Windows-integrated/NTLM or GSSAPI login is a distinct packet type (0x11, SSPI Message) from the initial LOGIN7 (0x10) -- a TDS-spec-conformant server can reject a continuation framed as another LOGIN7. Classic SQL Server tolerates both, which is presumably why this has gone unnoticed. Adds PacketHeader::sspi(id) and uses it at all three of this fork's SSPI-continuation send sites (upstream's PR only fixed one): winauth's AuthMethod::Integrated and AuthMethod::Windows on Windows, and GSSAPI's AuthMethod::Integrated on Unix. Gated the new constructor behind the same #[cfg] as its call sites so it isn't flagged unused when neither winauth nor integrated-auth-gssapi is active. Verified: cargo check across all 6 CI feature combinations plus --features=integrated-auth-gssapi,native-tls specifically, cargo clippy --all-targets, cargo fmt --check, and cargo test --lib (152 passing) all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0156Di1tRRLsJK8ctU1AmAJr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi! I am working on WiltonDB that implements TDS protocol compatible with MSSQL. I've noticed the following problem with Tiberius TDS client:
When Windows Integrated auth is used, Tiberius sends NTLM response message with
0x10(LOGIN7) header type. According to TDS spec,0x11(SSPI Message) header type must be used instead.MSSQL seems to accept either of these header types. I've implemented TDS SSPI login support in WiltonDB, it requires correct message type in NTLM response. Windows Integrated auth there is currently compatible with Microsoft clients for MSSQL, but not compatible with Tiberius. Thus I suggest this fix.