Replace NW RFC SDK with https://github.com/randomstr1ng/saprfclib

[kloris]

Test if https://github.com/randomstr1ng/saprfclib can make the now used NW RFC SDK redundant and then replace NW RFC SDK with https://github.com/randomstr1ng/saprfclib.

Test all use cases

[kloris]

Some work done, but found many bugs that were reported to the saprfclib repo owner. Once feed we can continue testing

[kloris]

Shipped via adapter pattern — the C SDK stays as the default so nothing regresses for existing users; --pure-rfc opts in to the zero-native-dependency saprfclib backend.

What landed

• modules/protocols/sap_rfc_pure.py — adapter that wraps saprfclib with the exact same public interface as sap_rfc_ctypes.RFCConnection (open / close / call / call_raw / _make_type_desc / _make_func_desc / ping / ping_verbose / get_attributes / is_open), including translation of saprfclib.SapRfcError → SAPMAP's own ABAPApplicationError / CommunicationError / LogonError / RFCError. Every call site in SAPMAP works unchanged.
• --pure-rfc CLI flag in sapmap.py toggles sapmap_rfc.set_pure_rfc(True); _get_rfc_backend() picks the requested backend, auto-falls-back to the other one if the primary can't load. Startup line prints which resolved ([*] RFC backend: saprfclib (pure-Python, no C SDK)).
• requirements.txt — saprfclib ; python_version >= "3.12" (older Pythons stay on the C SDK unchanged).
• README — new Pure-Python RFC Backend section covering when to use it, backend selection order, install path incl. PEP-668 escape (pip3 install --upgrade --break-system-packages saprfclib), and known gaps.

What was tested end-to-end against S/4HANA 2023 (kernel 793) + NetWeaver 7.42

Discovery · vulnerability checks (GW / MS / CVE-2020-6207 / CVE-2022-22536 / CVE-2025-31324) · connection test · BAPI_USER_GET_DETAIL · RFC_READ_TABLE (T000, USR02, DBCON, TMSMCONF, OA2C_CLIENT) · RFC_ABAP_INSTALL_AND_RUN + /SAPDS/ variant · SXPG_STEP_XPG_START · SecStore decryption (SSFS via SXPG) · RSECTAB read via ABAP INSTALL_AND_RUN · DBCON via ABAP SELECT fallback · TMS discovery · SM59 RFC destination test + ping + logon · propagation · lateral movement via cert-auth destinations · Linux LPE (Copy Fail → uid=0) · full password-hash dump via HDB CLI (72 users, BCODE + PASSCODE + PWDSALTEDHASH) · USREXTID read · business-impact assessment (10 scenarios).

saprfclib upstream fixes surfaced during integration

Julian (the saprfclib author) turned around every issue we filed:

• #7 RFCPING parse failure on kernel 793
• #8 connect() rejected the lang kwarg
• #9 TABLE params misclassified as RFCTYPE_STRUCTURE — encode/decode crash
• #10 TABLE params carried rfctype=STRUCTURE in auto-fetched FunctionDesc
• #11 _encode_structure raised KeyError for partial row dicts
• #12 _call_bootstrap only fetched type_desc when rfctype==STRUCTURE
• #24 Connection.call() refused unknown kwargs (pyrfc/C-SDK silently drop them)

All six of #7-#12 are closed, workarounds in sap_rfc_pure.py for them removed (commit 0f554cd). Two thin workarounds remain for #24 and the 64 KB frame-footer overflow (uint16 → uint32); both are single-line try / except blocks around self._conn.call() and go away as soon as the upstream fixes land.

Closing this ticket.