ruby_smb 2.0.12 → 3.0.2

data/spec/lib/ruby_smb/dcerpc/request_spec.rb

@@ -7,7 +7,9 @@ RSpec.describe RubySMB::Dcerpc::Request do
   it { is_expected.to respond_to :opnum }
   it { is_expected.to respond_to :object }
   it { is_expected.to respond_to :stub }
-  it { is_expected.to respond_to :auth_verifier }
+  it { is_expected.to respond_to :auth_pad }
+  it { is_expected.to respond_to :sec_trailer }
+  it { is_expected.to respond_to :auth_value }
 
   it 'is little endian' do
     expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
@@ -83,7 +85,7 @@ RSpec.describe RubySMB::Dcerpc::Request do
       end
 
       it 'selects the expected packet structure' do
-        expect(packet.stub).to eq(RubySMB::Dcerpc::Srvsvc::NetShareEnumAll.new(host: host))
+        expect(packet.stub).to eq(RubySMB::Dcerpc::Srvsvc::NetShareEnumAllRequest.new)
       end
     end
 
@@ -118,37 +120,100 @@ RSpec.describe RubySMB::Dcerpc::Request do
     end
   end
 
-  describe '#auth_verifier' do
+  describe '#auth_pad' do
     it 'should be a string' do
-      expect(packet.auth_verifier).to be_a BinData::String
+      expect(packet.auth_pad).to be_a BinData::String
     end
 
     it 'should not exist if the #auth_length PDU header field is 0' do
       packet.pdu_header.auth_length = 0
-      expect(packet.auth_verifier?).to be false
+      expect(packet.auth_pad?).to be false
     end
 
     it 'should exist only if the #auth_length PDU header field is greater than 0' do
       packet.pdu_header.auth_length = 10
-      expect(packet.auth_verifier?).to be true
+      expect(packet.auth_pad?).to be true
+    end
+
+    it 'makes sure #sec_trailer is 16-bytes aligned with the begining of the PDU body (stub)' do
+      packet.pdu_header.auth_length = 6
+      packet.stub = 'A' * rand(0xFF)
+      expect((packet.sec_trailer.abs_offset - packet.stub.abs_offset) % 16).to eq(0)
+    end
+  end
+
+  describe '#sec_trailer' do
+    it 'is a SecTrailer structre' do
+      expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.sec_trailer?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.sec_trailer?).to be true
+    end
+  end
+
+  describe '#auth_value' do
+    it 'should be a string' do
+      expect(packet.auth_value).to be_a BinData::String
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.auth_value?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.auth_value?).to be true
     end
 
     it 'reads #auth_length bytes' do
-      auth_verifier = '12345678'
+      auth_value = '12345678'
       packet.pdu_header.auth_length = 6
-      packet.auth_verifier.read(auth_verifier)
-      expect(packet.auth_verifier).to eq(auth_verifier[0,6])
+      packet.auth_value.read(auth_value)
+      expect(packet.auth_value).to eq(auth_value[0,6])
+    end
+  end
+
+  describe '#enable_encrypted_stub' do
+    it 'sets the stub type to BinData::String' do
+      # Set a new packet with a Winreg stub
+      packet = described_class.new(
+        { opnum: RubySMB::Dcerpc::Winreg::OPEN_HKPD },
+        { endpoint: 'Winreg' }
+      )
+      # Enabling encryption will switch the stub to a string
+      packet.enable_encrypted_stub
+      expect(packet.stub.send(:current_choice)).to be_a BinData::String
+    end
+  end
+
+  describe '#has_auth_verifier?' do
+    it 'returns true if PDU header #auth_length is greater than 0' do
+      packet.pdu_header.auth_length = 5
+      expect(packet.has_auth_verifier?).to be true
+    end
+
+    it 'returns false if PDU header #auth_length is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.has_auth_verifier?).to be false
     end
   end
 
   it 'reads its own binary representation and output the same packet' do
     packet = described_class.new(
       { :opnum => RubySMB::Dcerpc::Srvsvc::NET_SHARE_ENUM_ALL },
-      { :endpoint => 'Srvsvc', :host => '1.2.3.4' }
+      { :endpoint => 'Srvsvc' }
     )
     packet.pdu_header.pfc_flags.object_uuid = 1
     packet.object = '8a885d04-1ceb-11c9-9fe8-08002b104860'
-    packet.auth_verifier = '123456'
+    packet.auth_value = '123456'
     packet.pdu_header.auth_length = 6
     binary = packet.to_binary_s
     packet2 = described_class.new( { :endpoint => 'Srvsvc' } )

data/spec/lib/ruby_smb/dcerpc/response_spec.rb

@@ -6,7 +6,9 @@ RSpec.describe RubySMB::Dcerpc::Response do
   it { is_expected.to respond_to :p_cont_id }
   it { is_expected.to respond_to :cancel_count }
   it { is_expected.to respond_to :stub }
-  it { is_expected.to respond_to :auth_verifier }
+  it { is_expected.to respond_to :auth_pad }
+  it { is_expected.to respond_to :sec_trailer }
+  it { is_expected.to respond_to :auth_value }
 
   it 'is little endian' do
     expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
@@ -61,32 +63,120 @@ RSpec.describe RubySMB::Dcerpc::Response do
     end
   end
 
-  describe '#auth_verifier' do
+  describe '#auth_pad' do
     it 'should be a string' do
-      expect(packet.auth_verifier).to be_a BinData::String
+      expect(packet.auth_pad).to be_a BinData::String
     end
 
     it 'should not exist if the #auth_length PDU header field is 0' do
       packet.pdu_header.auth_length = 0
-      expect(packet.auth_verifier?).to be false
+      expect(packet.auth_pad?).to be false
     end
 
     it 'should exist only if the #auth_length PDU header field is greater than 0' do
       packet.pdu_header.auth_length = 10
-      expect(packet.auth_verifier?).to be true
+      expect(packet.auth_pad?).to be true
+    end
+
+    it 'makes sure #sec_trailer is 16-bytes aligned with the begining of the PDU body (stub)' do
+      packet.pdu_header.auth_length = 6
+      packet.stub = 'A' * rand(0xFF)
+      expect((packet.sec_trailer.abs_offset - packet.stub.abs_offset) % 16).to eq(0)
+    end
+  end
+
+  describe '#sec_trailer' do
+    it 'is a SecTrailer structre' do
+      expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.sec_trailer?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.sec_trailer?).to be true
+    end
+  end
+
+  describe '#auth_value' do
+    it 'should be a string' do
+      expect(packet.auth_value).to be_a BinData::String
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.auth_value?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.auth_value?).to be true
     end
 
     it 'reads #auth_length bytes' do
-      auth_verifier = '12345678'
+      auth_value = '12345678'
       packet.pdu_header.auth_length = 6
-      packet.auth_verifier.read(auth_verifier)
-      expect(packet.auth_verifier).to eq(auth_verifier[0,6])
+      packet.auth_value.read(auth_value)
+      expect(packet.auth_value).to eq(auth_value[0,6])
+    end
+  end
+
+  describe '#has_auth_verifier?' do
+    it 'returns true if PDU header #auth_length is greater than 0' do
+      packet.pdu_header.auth_length = 5
+      expect(packet.has_auth_verifier?).to be true
+    end
+
+    it 'returns false if PDU header #auth_length is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.has_auth_verifier?).to be false
+    end
+  end
+
+  describe '#stub_length' do
+    let(:stub_length) { rand(0xFF) }
+    before :example do
+      packet.stub = 'A' * stub_length
+    end
+
+    it 'returns the correct stub length' do
+      expect(packet.stub_length).to eq(stub_length)
+    end
+
+    context 'with auth verifier' do
+      it 'returns the correct stub length' do
+        auth_size = rand(0xFF)
+        packet.pdu_header.auth_length = auth_size
+        packet.auth_value = 'B' * auth_size
+        expect(packet.stub_length).to eq(stub_length + packet.auth_pad.num_bytes)
+      end
+    end
+  end
+
+  describe '#read' do
+    let(:response) { described_class.new }
+    let(:auth_size) { rand(0xFF) }
+    let(:stub_size) { rand(0xFF) }
+    before :example do
+      response.pdu_header.auth_length = auth_size
+      response.stub = 'A' * stub_size
+      response.auth_value = 'B' * auth_size
+      response.auth_pad = 'C' * response.auth_pad.size
+    end
+
+    it 'sets #stub and #auth_pad to the correct values' do
+      packet.read(response.to_binary_s)
+      expect(packet.stub).to eq(response.stub)
+      expect(packet.auth_pad).to eq(response.auth_pad)
     end
   end
 
   it 'reads its own binary representation and output the same packet' do
     packet.stub = 'ABCD'
-    packet.auth_verifier = '123456'
+    packet.auth_value = '123456'
     packet.pdu_header.auth_length = 6
     binary = packet.to_binary_s
     expect(described_class.read(binary)).to eq(packet)

data/spec/lib/ruby_smb/dcerpc/rpc_auth3_spec.rb

@@ -0,0 +1,75 @@
+RSpec.describe RubySMB::Dcerpc::RpcAuth3 do
+  subject(:packet) { described_class.new }
+
+  it { is_expected.to respond_to :pdu_header }
+  it { is_expected.to respond_to :pad }
+  it { is_expected.to respond_to :sec_trailer }
+  it { is_expected.to respond_to :auth_value }
+
+  it 'is little endian' do
+    expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
+  end
+
+  describe '#pdu_header' do
+    subject(:header) { packet.pdu_header }
+
+    it 'is a standard PDU Header' do
+      expect(header).to be_a RubySMB::Dcerpc::PDUHeader
+    end
+
+    it 'should have the #ptype field set to PTypes::BIND' do
+      expect(header.ptype).to eq RubySMB::Dcerpc::PTypes::RPC_AUTH3
+    end
+  end
+
+  describe '#sec_trailer' do
+    it 'should be SecTrailer structure' do
+      expect(packet.sec_trailer).to be_a RubySMB::Dcerpc::SecTrailer
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.sec_trailer?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.sec_trailer?).to be true
+    end
+  end
+
+  describe '#auth_value' do
+    it 'should be a string' do
+      expect(packet.auth_value).to be_a BinData::String
+    end
+
+    it 'should not exist if the #auth_length PDU header field is 0' do
+      packet.pdu_header.auth_length = 0
+      expect(packet.auth_value?).to be false
+    end
+
+    it 'should exist only if the #auth_length PDU header field is greater than 0' do
+      packet.pdu_header.auth_length = 10
+      expect(packet.auth_value?).to be true
+    end
+
+    it 'reads #auth_length bytes' do
+      auth_value = '12345678'
+      packet.pdu_header.auth_length = 6
+      packet.auth_value.read(auth_value)
+      expect(packet.auth_value).to eq(auth_value[0,6])
+    end
+  end
+
+  it 'reads its own binary representation and output the same packet' do
+    auth_size = rand(0xFF)
+    packet = described_class.new(
+      pdu_header: { auth_length: auth_size },
+      pad: rand(0xFFFFFFFF),
+      auth_value: 'A' * auth_size
+    )
+    binary = packet.to_binary_s
+    expect(described_class.read(binary)).to eq(packet)
+  end
+
+end

data/spec/lib/ruby_smb/dcerpc/rpc_security_attributes_spec.rb

@@ -9,21 +9,25 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityDescriptor do
     expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
   end
 
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
   describe '#lp_security_descriptor' do
-    it 'should be a NdrLpByteArray structure' do
-      expect(packet.lp_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrLpByteArray
+    it 'should be a NdrByteArrayPtr structure' do
+      expect(packet.lp_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrByteArrayPtr
     end
   end
 
   describe '#cb_in_security_descriptor' do
-    it 'should be a 32-bit unsigned integer' do
-      expect(packet.cb_in_security_descriptor).to be_a BinData::Uint32le
+    it 'should be a NdrUint32' do
+      expect(packet.cb_in_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
     end
   end
 
   describe '#cb_out_security_descriptor' do
-    it 'should be a 32-bit unsigned integer' do
-      expect(packet.cb_out_security_descriptor).to be_a BinData::Uint32le
+    it 'should be a NdrUint32' do
+      expect(packet.cb_out_security_descriptor).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
     end
   end
 
@@ -38,7 +42,7 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityDescriptor do
 
     context 'with a normal RpcSecurityAttributes structure' do
       it 'reads its own binary representation' do
-        packet.lp_security_descriptor = RubySMB::Dcerpc::Ndr::NdrLpByteArray.new([1, 2, 3])
+        packet.lp_security_descriptor = RubySMB::Dcerpc::Ndr::NdrByteArrayPtr.new([1, 2, 3])
         packet.cb_in_security_descriptor = 90
         packet.cb_out_security_descriptor = 33
         raw = packet.to_binary_s
@@ -60,9 +64,13 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
     expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
   end
 
+  it 'has :byte_align parameter set to the expected value' do
+    expect(described_class.default_parameters[:byte_align]).to eq(4)
+  end
+
   describe '#n_length' do
-    it 'should be a 32-bit unsigned integer' do
-      expect(packet.n_length).to be_a BinData::Uint32le
+    it 'should be a NdrUint32' do
+      expect(packet.n_length).to be_a RubySMB::Dcerpc::Ndr::NdrUint32
     end
   end
 
@@ -73,8 +81,8 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
   end
 
   describe '#b_inheritHandle' do
-    it 'should be a 8-bit unsigned integer' do
-      expect(packet.b_inheritHandle).to be_a BinData::Uint8
+    it 'should be a NdrUint8' do
+      expect(packet.b_inheritHandle).to be_a RubySMB::Dcerpc::Ndr::NdrUint8
     end
   end
 
@@ -104,32 +112,25 @@ RSpec.describe RubySMB::Dcerpc::RpcSecurityAttributes do
 end
 
 RSpec.describe RubySMB::Dcerpc::PrpcSecurityAttributes do
-  it 'is NdrPointer subclass' do
-    expect(described_class).to be < RubySMB::Dcerpc::Ndr::NdrPointer
+  it 'is a RpcSecurityAttributes subclass' do
+    expect(described_class).to be < RubySMB::Dcerpc::RpcSecurityAttributes
   end
 
   subject(:packet) { described_class.new }
 
-  it { is_expected.to respond_to :referent }
+  it { is_expected.to respond_to :ref_id }
 
   it 'is little endian' do
     expect(described_class.fields.instance_variable_get(:@hints)[:endian]).to eq :little
   end
 
-  describe '#referent' do
-    it 'should be a RpcSecurityAttributes structure' do
-      expect(packet.referent).to be_a RubySMB::Dcerpc::RpcSecurityAttributes
-    end
-
-    it 'exists if superclass #referent_id is not zero' do
-      packet.referent_id = 0xCCCC
-      expect(packet.referent?).to be true
-    end
+  it 'should be a RpcSecurityAttributes structure' do
+    expect(packet).to be_a RubySMB::Dcerpc::RpcSecurityAttributes
+  end
 
-    it 'does not exist if superclass #referent_id is zero' do
-      packet.referent_id = 0
-      expect(packet.referent?).to be false
-    end
+  it 'is :null if #ref_id is zero' do
+    packet.ref_id = 0
+    expect(packet).to eq(:null)
   end
 
   describe '#read' do
@@ -150,7 +151,7 @@ RSpec.describe RubySMB::Dcerpc::PrpcSecurityAttributes do
         struct.rpc_security_descriptor.cb_in_security_descriptor = 33
         struct.rpc_security_descriptor.cb_out_security_descriptor = 22
         struct.b_inheritHandle = 4
-        packet.set(struct)
+        packet.assign(struct)
         raw = packet.to_binary_s
         expect(described_class.read(raw)).to eq(packet)
         expect(described_class.read(raw).to_binary_s).to eq(raw)