fix(ntlm): preserve RC4 sealing state across mechListMIC

[Marc-André Moreau (mamoreau-devolutions)]

CredSSP can wrap pubKeyAuth after the initiator sends its mechListMIC but before it verifies the acceptor's MIC. Resetting both NTLM RC4 handles during verification loses the advanced send state and breaks the next wrapped message.

Snapshot and restore only the sealing handle used for each MIC, including when verification fails. Remove the obsolete reset helper and add regression coverage for both directions, the CredSSP ordering, and invalid signatures. Sequence numbers remain unchanged.

Tests: cargo test -p sspi --lib ntlm::test:: --quiet (36 passed); cargo test -p sspi --features network_client,__test-data --test sspi ntlm --quiet (14 passed); cargo check -p sspi --quiet; cargo fmt --all --check.

Fixes: #752

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the protocol requirement and includes focused regression coverage for the reported failure modes.

Review effort: Balanced
Findings: None

What changed in this PR

Preserves NTLM RC4 sealing state across SPNEGO mechListMIC operations, fixing subsequent CredSSP message wrapping.

Changes:

• Snapshot and restore only the MIC-related RC4 handle.
• Remove obsolete role-based cipher resets.
• Add regression coverage for ordering, direction, and invalid signatures.

File	Description
src/​ntlm/​mod.rs	Implements targeted sealing-state preservation.
src/​ntlm/​test.rs	Adds RC4 state regression tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jordan Borean (jborean93)]

Thanks for the changes, I can confirm that the changes here fix the underlying problem I was having.