ruby_smb 1.0.0 → 1.1.0

data/spec/lib/ruby_smb/dcerpc/winreg/query_info_key_request_spec.rb

@@ -0,0 +1,39 @@
+RSpec.describe RubySMB::Dcerpc::Winreg::RpcHkey do
+  it 'is NdrContextHandle subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::Ndr::NdrContextHandle
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::Winreg::QueryInfoKeyRequest do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :hkey }
+  it { is_expected.to respond_to :lp_class }
+  it { is_expected.to respond_to :opnum }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#hkey' do
+    it 'is a RpcHkey structure' do
+      expect(packet.hkey).to be_a RubySMB::Dcerpc::Winreg::RpcHkey
+    end
+  end
+
+  describe '#lp_class' do
+    it 'is a RrpUnicodeString structure' do
+      expect(packet.lp_class).to be_a RubySMB::Dcerpc::RrpUnicodeString
+    end
+
+    it 'has an initial value of 0' do
+      expect(packet.lp_class).to eq(0)
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to REG_QUERY_INFO_KEY constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Winreg::REG_QUERY_INFO_KEY)
+    end
+  end
+end

data/spec/lib/ruby_smb/dcerpc/winreg/query_info_key_response_spec.rb

@@ -0,0 +1,113 @@
+RSpec.describe RubySMB::Dcerpc::Winreg::QueryInfoKeyResponse do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :lp_class }
+  it { is_expected.to respond_to :pad }
+  it { is_expected.to respond_to :lpc_sub_keys }
+  it { is_expected.to respond_to :lpc_max_sub_key_len }
+  it { is_expected.to respond_to :lpc_max_class_len }
+  it { is_expected.to respond_to :lpc_values }
+  it { is_expected.to respond_to :lpcb_max_value_name_len }
+  it { is_expected.to respond_to :lpcb_max_value_len }
+  it { is_expected.to respond_to :lpcb_security_descriptor }
+  it { is_expected.to respond_to :lpft_last_write_time }
+  it { is_expected.to respond_to :error_status }
+  it { is_expected.to respond_to :opnum }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#lp_class' do
+    it 'is a RrpUnicodeString structure' do
+      expect(packet.lp_class).to be_a RubySMB::Dcerpc::RrpUnicodeString
+    end
+
+    it 'has an initial value of 0' do
+      expect(packet.lp_class).to eq(0)
+    end
+  end
+
+  describe '#pad' do
+    it 'is a string' do
+      expect(packet.pad).to be_a BinData::String
+    end
+
+    it 'should keep #lpc_sub_keys 4-byte aligned' do
+      packet.lp_class = 'test'
+      expect(packet.lpc_sub_keys.abs_offset % 4).to eq 0
+    end
+  end
+
+  describe '#lpc_sub_keys' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpc_sub_keys).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpc_max_sub_key_len' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpc_max_sub_key_len).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpc_max_class_len' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpc_max_class_len).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpc_values' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpc_values).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpcb_max_value_name_len' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpcb_max_value_name_len).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpcb_max_value_len' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpcb_max_value_len).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpcb_security_descriptor' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.lpcb_security_descriptor).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#lpft_last_write_time' do
+    it 'is a FileTime structure' do
+      expect(packet.lpft_last_write_time).to be_a RubySMB::Field::FileTime
+    end
+  end
+
+  describe '#error_status' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.error_status).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to REG_QUERY_INFO_KEY constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Winreg::REG_QUERY_INFO_KEY)
+    end
+  end
+
+  describe '#pad_length' do
+    it 'returns 0 when #lpc_sub_keys is already 4-byte aligned' do
+      packet.lp_class = 'align'
+      expect(packet.pad_length).to eq 0
+    end
+
+    it 'returns 2 when #lpc_sub_keys is only 2-byte aligned' do
+      packet.lp_class = 'align' + 'A'
+      expect(packet.pad_length).to eq 2
+    end
+  end
+end

data/spec/lib/ruby_smb/dcerpc/winreg/query_value_request_spec.rb

@@ -0,0 +1,88 @@
+RSpec.describe RubySMB::Dcerpc::Winreg::RpcHkey do
+  it 'is NdrContextHandle subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::Ndr::NdrContextHandle
+  end
+end
+
+RSpec.describe RubySMB::Dcerpc::Winreg::QueryValueRequest do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :hkey }
+  it { is_expected.to respond_to :lp_value_name }
+  it { is_expected.to respond_to :pad }
+  it { is_expected.to respond_to :lp_type }
+  it { is_expected.to respond_to :lp_data }
+  it { is_expected.to respond_to :lpcb_data }
+  it { is_expected.to respond_to :lpcb_len }
+  it { is_expected.to respond_to :opnum }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#hkey' do
+    it 'is a RpcHkey structure' do
+      expect(packet.hkey).to be_a RubySMB::Dcerpc::Winreg::RpcHkey
+    end
+  end
+
+  describe '#lp_value_name' do
+    it 'is a RrpUnicodeString structure' do
+      expect(packet.lp_value_name).to be_a RubySMB::Dcerpc::RrpUnicodeString
+    end
+  end
+
+  describe '#pad' do
+    it 'is a string' do
+      expect(packet.pad).to be_a BinData::String
+    end
+
+    it 'should keep #lp_type 4-byte aligned' do
+      packet.lp_value_name = 'test'
+      expect(packet.lp_type.abs_offset % 4).to eq 0
+    end
+  end
+
+  describe '#lp_type' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lp_type).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#lp_data' do
+    it 'is a NdrLpByte structure' do
+      expect(packet.lp_data).to be_a RubySMB::Dcerpc::Ndr::NdrLpByte
+    end
+  end
+
+  describe '#lpcb_data' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lpcb_data).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#lpcb_len' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lpcb_len).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to REG_QUERY_VALUE constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Winreg::REG_QUERY_VALUE)
+    end
+  end
+
+  describe '#pad_length' do
+    it 'returns 0 when #lp_type is already 4-byte aligned' do
+      packet.lp_value_name = 'align'
+      expect(packet.pad_length).to eq 0
+    end
+
+    it 'returns 2 when #lp_type is only 2-byte aligned' do
+      packet.lp_value_name = 'align' + 'A'
+      expect(packet.pad_length).to eq 2
+    end
+  end
+end
+

data/spec/lib/ruby_smb/dcerpc/winreg/query_value_response_spec.rb

@@ -0,0 +1,150 @@
+RSpec.describe RubySMB::Dcerpc::Winreg::QueryValueResponse do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :lp_type }
+  it { is_expected.to respond_to :lp_data }
+  it { is_expected.to respond_to :pad }
+  it { is_expected.to respond_to :lpcb_data }
+  it { is_expected.to respond_to :lpcb_len }
+  it { is_expected.to respond_to :error_status }
+  it { is_expected.to respond_to :opnum }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#lp_type' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lp_type).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#lp_data' do
+    it 'is a NdrLpByte structure' do
+      expect(packet.lp_data).to be_a RubySMB::Dcerpc::Ndr::NdrLpByte
+    end
+  end
+
+  describe '#pad' do
+    it 'is a string' do
+      expect(packet.pad).to be_a BinData::String
+    end
+
+    it 'should keep #lpcb_data 4-byte aligned' do
+      packet.lp_data.bytes = 'spec_test'.bytes
+      expect(packet.lpcb_data.abs_offset % 4).to eq 0
+    end
+  end
+
+  describe '#lpcb_data' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lpcb_data).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#lpcb_len' do
+    it 'is a NdrLpDword structure' do
+      expect(packet.lpcb_len).to be_a RubySMB::Dcerpc::Ndr::NdrLpDword
+    end
+  end
+
+  describe '#error_status' do
+    it 'is a 32-bit unsigned integer' do
+      expect(packet.error_status).to be_a BinData::Uint32le
+    end
+  end
+
+  describe '#initialize_instance' do
+    it 'sets #opnum to REG_QUERY_VALUE constant' do
+      expect(packet.opnum).to eq(RubySMB::Dcerpc::Winreg::REG_QUERY_VALUE)
+    end
+  end
+
+  describe '#pad_length' do
+    it 'returns 0 when #lpcb_data is already 4-byte aligned' do
+      packet.lp_data.bytes = 'aligned.'.bytes
+      expect(packet.pad_length).to eq 0
+    end
+
+    it 'returns 2 when #lpcb_data is only 2-byte aligned' do
+      packet.lp_data.bytes = 'not aligned'.bytes
+      expect(packet.pad_length).to eq 1
+    end
+  end
+
+  describe '#data' do
+    context 'when #lp_type is 1 (unicode null-terminated string)' do
+      it 'returns the expected value' do
+        str = 'spec test string'.encode('utf-16le')
+        packet.lp_type = 1
+        packet.lp_data.bytes = str.bytes
+        expect(packet.data).to eq(str)
+      end
+    end
+
+    context 'when #lp_type is 2 (unicode null-terminated string with unexpanded references to environment variables)' do
+      it 'returns the expected value' do
+        str = '/%PATH%/foo'.encode('utf-16le')
+        packet.lp_type = 2
+        packet.lp_data.bytes = str.bytes
+        expect(packet.data).to eq(str)
+      end
+    end
+
+    context 'when #lp_type is 3 (binary data)' do
+      it 'returns the expected value' do
+        bytes = [0xFF, 0xEE, 0xDD, 0xCC].pack('C*')
+        packet.lp_type = 3
+        packet.lp_data.bytes = bytes.bytes
+        expect(packet.data).to eq(bytes)
+      end
+    end
+
+    context 'when #lp_type is 4 (a 32-bit number in little-endian format)' do
+      it 'returns the expected value' do
+        number = 12345
+        packet.lp_type = 4
+        packet.lp_data.bytes = [number].pack('V').bytes
+        expect(packet.data).to eq(number)
+      end
+    end
+
+    context 'when #lp_type is 5 (a 32-bit number in big-endian format)' do
+      it 'returns the expected value' do
+        number = 12345
+        packet.lp_type = 5
+        packet.lp_data.bytes = [number].pack('N').bytes
+        expect(packet.data).to eq(number)
+      end
+    end
+
+    context 'when #lp_type is 7 (a sequence of unicode null-terminated strings, terminated by an empty string)' do
+      it 'returns the expected value' do
+        str_array = ['String1', 'String2', 'String3', 'LastString'].map {|v| v.encode('utf-16le')}
+        null_byte = "\0".encode('utf-16le')
+        str = (str_array + [null_byte]).join(null_byte)
+        packet.lp_type = 7
+        packet.lp_data.bytes = str.bytes
+        expect(packet.data).to eq(str_array)
+      end
+    end
+
+    context 'when #lp_type is 11 (a 64-bit number in little-endian format)' do
+      it 'returns the expected value' do
+        number = 0x1234567812345678
+        packet.lp_type = 11
+        packet.lp_data.bytes = [number].pack('Q<').bytes
+        expect(packet.data).to eq(number)
+      end
+    end
+
+    context 'when #lp_type is an unknown value' do
+      it 'returns an empty string' do
+        str = 'test'
+        packet.lp_type = 6
+        packet.lp_data.bytes = str.bytes
+        expect(packet.data).to eq('')
+      end
+    end
+  end
+end

data/spec/lib/ruby_smb/dcerpc/winreg/regsam_spec.rb

@@ -0,0 +1,32 @@
+RSpec.describe RubySMB::Dcerpc::Winreg::Regsam do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :reserved }
+  it { is_expected.to respond_to :key_create_link }
+  it { is_expected.to respond_to :key_notify }
+  it { is_expected.to respond_to :key_enumerate_sub_keys }
+  it { is_expected.to respond_to :key_create_sub_key }
+  it { is_expected.to respond_to :key_set_value }
+  it { is_expected.to respond_to :key_query_value }
+  it { is_expected.to respond_to :reserved2 }
+  it { is_expected.to respond_to :key_wow64_32key }
+  it { is_expected.to respond_to :key_wow64_64key }
+  it { is_expected.to respond_to :reserved3 }
+  it { is_expected.to respond_to :synchronize }
+  it { is_expected.to respond_to :write_owner }
+  it { is_expected.to respond_to :write_dac }
+  it { is_expected.to respond_to :read_control }
+  it { is_expected.to respond_to :delete_access }
+  it { is_expected.to respond_to :generic_read }
+  it { is_expected.to respond_to :generic_write }
+  it { is_expected.to respond_to :generic_execute }
+  it { is_expected.to respond_to :generic_all }
+  it { is_expected.to respond_to :reserved4 }
+  it { is_expected.to respond_to :maximum }
+  it { is_expected.to respond_to :system_security }
+
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+end