Mike Swanson
87c6e17d4a
Store the per-machine cak_ with BOTH layers Mike locked: DPAPI-machine encryption (CryptProtectData with CRYPTPROTECT_LOCAL_MACHINE — a copied blob is inert off the box) inside a SYSTEM/Administrators-only ACL'd file at %ProgramData%\GuruConnect\credentials\agent.cak. The directory + file ACL is hardened via icacls (/inheritance:r + grant to the well-known SIDs *S-1-5-18 and *S-1-5-32-544, locale-independent) — auditable, with far less unsafe FFI than building a registry-key security descriptor by hand. Co-locates with the existing %ProgramData%\GuruConnect config/seed dir. Provides store_cak / load_cak / clear_cak. store_cak writes atomically (temp file + rename in the locked dir). load_cak treats a present-but- undecryptable blob as a hard error (tamper / cross-machine copy) rather than silently re-enrolling over it. The plaintext is never logged; the transient plaintext copy is scrubbed after encryption. DPAPI output blobs are LocalFree'd. Enables the Win32_Security_Cryptography windows feature. Round-trip unit tests cover encrypt/decrypt recovery across lengths and that a tampered blob fails to decrypt (DPAPI authenticates its blobs). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
124 lines
2.6 KiB
TOML
124 lines
2.6 KiB
TOML
[package]
|
|
name = "guruconnect"
|
|
version = "0.3.0"
|
|
edition = "2021"
|
|
authors = ["AZ Computer Guru"]
|
|
description = "GuruConnect Remote Desktop - Agent and Viewer"
|
|
|
|
[dependencies]
|
|
# CLI
|
|
clap = { version = "4", features = ["derive"] }
|
|
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full", "sync", "time", "rt-multi-thread", "macros"] }
|
|
|
|
# WebSocket
|
|
tokio-tungstenite = { version = "0.24", features = ["native-tls"] }
|
|
futures-util = "0.3"
|
|
|
|
# Windowing (for viewer)
|
|
winit = { version = "0.30", features = ["rwh_06"] }
|
|
softbuffer = "0.4"
|
|
raw-window-handle = "0.6"
|
|
|
|
# Compression
|
|
zstd = "0.13"
|
|
|
|
# Protocol (protobuf)
|
|
prost = "0.13"
|
|
prost-types = "0.13"
|
|
bytes = "1"
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Logging
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# Error handling
|
|
anyhow = "1"
|
|
thiserror = "1"
|
|
|
|
# Configuration
|
|
toml = "0.8"
|
|
|
|
# Crypto
|
|
ring = "0.17"
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
|
|
# HTTP client for updates
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
|
|
|
|
# UUID
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
|
|
# Time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
# Hostname
|
|
hostname = "0.4"
|
|
|
|
# URL encoding
|
|
urlencoding = "2"
|
|
|
|
# System tray (Windows)
|
|
tray-icon = "0.19"
|
|
muda = "0.15" # Menu for tray icon
|
|
|
|
# Image handling for tray icon
|
|
image = { version = "0.25", default-features = false, features = ["png"] }
|
|
|
|
# URL parsing
|
|
url = "2"
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
# Windows APIs for screen capture, input, and shell operations
|
|
windows = { version = "0.58", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_Graphics_Dxgi",
|
|
"Win32_Graphics_Dxgi_Common",
|
|
"Win32_Graphics_Direct3D",
|
|
"Win32_Graphics_Direct3D11",
|
|
"Win32_UI_Input_KeyboardAndMouse",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
"Win32_UI_Shell",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Threading",
|
|
"Win32_System_Registry",
|
|
"Win32_System_Console",
|
|
"Win32_System_Environment",
|
|
"Win32_Security",
|
|
"Win32_Security_Cryptography",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_Pipes",
|
|
"Win32_System_SystemServices",
|
|
"Win32_System_IO",
|
|
"Win32_System_Com",
|
|
"Win32_System_Com_StructuredStorage",
|
|
"Win32_System_Ole",
|
|
"Win32_System_Variant",
|
|
"Win32_Media_MediaFoundation",
|
|
"Win32_Media_KernelStreaming",
|
|
"Win32_Media_DirectShow",
|
|
]}
|
|
|
|
# Windows service support
|
|
windows-service = "0.7"
|
|
|
|
[build-dependencies]
|
|
prost-build = "0.13"
|
|
winres = "0.1"
|
|
chrono = "0.4"
|
|
|
|
[[bin]]
|
|
name = "guruconnect"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "guruconnect-sas-service"
|
|
path = "src/bin/sas_service.rs"
|