ruby_smb 3.3.22 → 3.3.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ef6a12241de5bf3b7f37028f5dd927f1bc71249e37c77f2bb8d1575836bc9889
-  data.tar.gz: 624c0708b392f448c17d163b71ef821902d83d17f5f632d7416f6a691041bb79
+  metadata.gz: 2bda3450e062ff69f5c20600086e7c8686d539b44a339f560764c077c6a1a3cc
+  data.tar.gz: 3c2ec535d37e7880e4ba7d023ff8d381f33da0bb47c28424bc4f3828d13f9e2b
 SHA512:
-  metadata.gz: 5b518493f293005ce5b805221625a03cb937d7b2218029824f5cabb577f70cfdf8a1cd6ed6b08b6fc75a57c490200c20b469b8e347a3625d4e633f716d05929c
-  data.tar.gz: 92e4ce7a72b4d7c8b9f140df9bb94e8798810f9ec0491bff81c295e68b0ebc07b17bd1f0c72e38cc7f8a2fb86ae14b08065296d83969adfe99b22038a1c24f33
+  metadata.gz: e57991b0b74090c01a6b6568dce52828e16045255ea2a3debc0afac2fa2f5bbff85e7319b21c36377a5e8a49e327bad518ebf58792e0e3c5a3d338d953064b1a
+  data.tar.gz: cb6a8ef6b78ca308df71d89b8c290dcce2ffcc64f155f41be7a66060713aa2c3c990ee4aa8e95d7308f0467e8b58d98ed0891523451086932f5205a26e1df214

data/lib/ruby_smb/client.rb

@@ -350,7 +350,7 @@ module RubySMB
       @server_max_write_size = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_max_transact_size = RubySMB::SMB2::File::MAX_PACKET_SIZE
       @server_supports_multi_credit = false
-      @server_supports_nt_smbs = true
+      @server_supports_nt_smbs      = true
 
       # SMB 3.x options
       # this merely initializes the default value for session encryption, it may be changed as necessary when a
@@ -668,6 +668,14 @@ module RubySMB
 
     # Requests a NetBIOS Session Service using the provided name.
     #
+    # On refusal the raised {RubySMB::Error::NetBiosSessionService} carries the
+    # numeric NBSS `error_code`. A {RubySMB::Nbss::CALLED_NAME_NOT_PRESENT} rejection of
+    # the default `'*SMBSERVER'` name means the server (e.g. Windows 9x) wants
+    # its real name: resolve it with {RubySMB::Nbss::NodeStatus.file_server_name},
+    # reconnect (the server drops the connection after a negative response), and
+    # retry. Reconnecting is left to the caller so the new socket is routed the
+    # same way as the original (e.g. through a Metasploit pivot).
+    #
     # @param name [String] the NetBIOS name to request
     # @return [TrueClass] if session request is granted
     # @raise [RubySMB::Error::NetBiosSessionService] if session request is refused
@@ -679,8 +687,11 @@ module RubySMB
       begin
         session_header = RubySMB::Nbss::SessionHeader.read(raw_response)
         if session_header.session_packet_type == RubySMB::Nbss::NEGATIVE_SESSION_RESPONSE
-          negative_session_response =  RubySMB::Nbss::NegativeSessionResponse.read(raw_response)
-          raise RubySMB::Error::NetBiosSessionService, "Session Request failed: #{negative_session_response.error_msg}"
+          negative_session_response = RubySMB::Nbss::NegativeSessionResponse.read(raw_response)
+          raise RubySMB::Error::NetBiosSessionService.new(
+            "Session Request failed: #{negative_session_response.error_msg}",
+            error_code: negative_session_response.error_code.to_i
+          )
         end
       rescue IOError
         raise RubySMB::Error::InvalidPacket, 'Not a NBSS packet'

data/lib/ruby_smb/error.rb

@@ -11,7 +11,17 @@ module RubySMB
 
     # Raised when there is a problem with communication over NetBios Session Service
     # @see https://wiki.wireshark.org/NetBIOS/NBSS
-    class NetBiosSessionService < RubySMBError; end
+    class NetBiosSessionService < RubySMBError
+      # The numeric NBSS error code from a NEGATIVE_SESSION_RESPONSE, or nil
+      # if the error was raised outside that context.
+      # @return [Integer, nil]
+      attr_reader :error_code
+
+      def initialize(msg = nil, error_code: nil)
+        @error_code = error_code
+        super(msg)
+      end
+    end
 
     # Raised when trying to parse raw binary into a Packet and the data
     # is invalid.

data/lib/ruby_smb/gss/provider/kerberos.rb

@@ -0,0 +1,155 @@
+module RubySMB
+  module Gss
+    module Provider
+      #
+      # A GSS provider that advertises Kerberos and surfaces the mechanism token a client sends, without interpreting
+      # it.
+      #
+      # A Kerberos AP-REQ is encrypted to the service the client believes it is talking to, so a server that does not
+      # hold that service's key cannot read it. This provider therefore does not attempt to: it hands the token to a
+      # handler and lets that decide what to tell the client. That is enough for a server to observe or forward
+      # Kerberos authentication, and it keeps Kerberos message parsing out of this library entirely.
+      #
+      # Accepting Kerberos properly, by decrypting the ticket with a service key and validating the PAC, is a separate
+      # concern and is not implemented here.
+      #
+      # The token handed to the handler is the mechanism token exactly as the client sent it. For Kerberos that is a
+      # GSS-API InitialContextToken (RFC 2743 section 3.1), which wraps the mechanism OID and the token identifier
+      # around the Kerberos message:
+      #
+      #   60 82 0c 0e                 InitialContextToken
+      #     06 09 2a 86 48 ..         the mechanism OID
+      #     01 00                     the token id, here KRB_AP_REQ
+      #     6e 82 0b fd ..            the AP-REQ itself
+      #
+      # Note that the token id follows the OID rather than starting the token, and that the framing around it is not
+      # valid ASN.1, so OpenSSL::ASN1.decode will not parse it. {.token_id} reads it without decoding the payload.
+      #
+      # @example Capture the token a client sends
+      #   provider = RubySMB::Gss::Provider::Kerberos.new
+      #   provider.on_mech_token do |token, authenticator|
+      #     if RubySMB::Gss::Provider::Kerberos.token_id(token) == RubySMB::Gss::Provider::Kerberos::TOK_ID_KRB_AP_REQ
+      #       # forward or record the AP-REQ, then decide how to reply
+      #     end
+      #     # a handler must return a Result; there is no service key here to validate the ticket, so refuse it
+      #     RubySMB::Gss::Provider::Result.new(nil, WindowsError::NTStatus::STATUS_LOGON_FAILURE)
+      #   end
+      #
+      class Kerberos < Base
+        # The GSS token identifiers that may appear in a Kerberos mechanism token, per RFC 4121 section 4.1. They are
+        # provided so a handler can tell the messages apart without decoding the payload.
+        TOK_ID_KRB_AP_REQ = "\x01\x00".b.freeze
+        TOK_ID_KRB_AP_REP = "\x02\x00".b.freeze
+        TOK_ID_KRB_ERROR  = "\x03\x00".b.freeze
+
+        #
+        # Read the token identifier out of a GSS-API InitialContextToken, so a handler can tell an AP-REQ from an
+        # AP-REP or a KRB-ERROR. The identifier follows the mechanism OID rather than starting the token, and the
+        # framing is not valid ASN.1, so it is located by walking the lengths rather than by decoding.
+        #
+        # @param [String] token the mechanism token as received
+        # @return [String, nil] the two byte identifier, or nil if the token is not shaped as expected
+        def self.token_id(token)
+          return nil if token.nil? || token.bytesize < 4 || token.getbyte(0) != 0x60
+
+          length_byte = token.getbyte(1)
+          # a long form length says how many bytes carry the length, a short form is the length itself
+          offset = length_byte > 0x80 ? 2 + (length_byte & 0x7f) : 2
+          return nil if token.getbyte(offset) != 0x06 # the mechanism OID must follow
+
+          offset += 2 + token.getbyte(offset + 1)
+          token.byteslice(offset, 2)
+        end
+
+        # @param [Proc, nil] block an optional handler for received mechanism tokens, see {#on_mech_token}.
+        def initialize(&block)
+          @on_mech_token = block
+          @allow_anonymous = false
+          @allow_guests = false
+        end
+
+        def new_authenticator(server_client)
+          Authenticator.new(self, server_client)
+        end
+
+        def mech_types
+          # both are advertised because Microsoft clients may select either
+          [Gss::OID_KERBEROS_5, Gss::OID_MICROSOFT_KERBEROS_5]
+        end
+
+        #
+        # Set or invoke the handler called when a client sends a Kerberos mechanism token.
+        #
+        # The handler receives the opaque token and the authenticator that received it, and returns the {Result} to
+        # reply with. When no handler is set the authentication attempt is rejected, since this provider cannot
+        # validate a ticket on its own.
+        #
+        # @param [String] token the mechanism token, as sent by the client
+        # @param [Authenticator] authenticator the authenticator that received it
+        # @return [Result, nil]
+        def on_mech_token(token=nil, authenticator=nil, &block)
+          if block.nil?
+            return nil if @on_mech_token.nil?
+
+            @on_mech_token.call(token, authenticator)
+          else
+            @on_mech_token = block
+          end
+        end
+
+        class Authenticator < Authenticator::Base
+          def reset!
+            super
+            @mech_token = nil
+          end
+
+          # @return [String, nil] the most recent mechanism token received from the client.
+          attr_reader :mech_token
+
+          def process(request_buffer=nil)
+            if request_buffer.nil?
+              return Result.new(Gss.gss_neg_token_init(@provider.mech_types), WindowsError::NTStatus::STATUS_SUCCESS)
+            end
+
+            token = extract_mech_token(request_buffer)
+            if token.nil?
+              logger.warn('Received a Kerberos request carrying no mechanism token')
+              return
+            end
+
+            @mech_token = token
+            result = @provider.on_mech_token(token, self)
+            # a handler must return a Result: the session setup path calls nt_status on whatever comes back, so
+            # anything else (a missing handler, or a handler that returns e.g. a boolean) is refused here rather
+            # than handed on to crash the caller
+            return result if result.is_a?(Result)
+
+            Result.new(nil, WindowsError::NTStatus::STATUS_LOGON_FAILURE)
+          end
+
+          private
+
+          #
+          # Pull the mechanism token out of a SPNEGO NegTokenInit or NegTokenResp. The token is returned exactly as the
+          # client sent it, so a caller that forwards it elsewhere does not alter the ticket it contains.
+          #
+          # @param [String] request_buffer the SPNEGO token as received
+          # @return [String, nil]
+          def extract_mech_token(request_buffer)
+            # the identifier octet tells the two SPNEGO tokens apart: an InitialContextToken carrying a NegTokenInit is
+            # tagged [APPLICATION 0], a NegTokenResp continuing an exchange is tagged [CONTEXT 1]
+            case request_buffer.b.getbyte(0)
+            when 0x60
+              SpnegoNegTokenInit.parse(request_buffer).mech_token
+            when 0xa1
+              SpnegoNegTokenTarg.parse(request_buffer).response_token
+            end
+          rescue RASN1::ASN1Error => e
+            logger.error("Failed to parse the SPNEGO token (#{e.message})")
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/gss/provider/multi.rb

@@ -0,0 +1,129 @@
+module RubySMB
+  module Gss
+    module Provider
+      #
+      # A GSS provider that offers more than one authentication mechanism to the client and routes each request to
+      # whichever of its sub-providers understands the mechanism the client selected.
+      #
+      # SPNEGO exists so that a client and server can agree on a mechanism, but a server that only ever advertises one
+      # has nothing to negotiate. This provider advertises the mechanisms of every provider it holds, in the order they
+      # were given, so a client can pick the one it prefers.
+      #
+      # @example Offer Kerberos, falling back to NTLM
+      #   provider = RubySMB::Gss::Provider::Multi.new([kerberos_provider, ntlm_provider])
+      #   RubySMB::Server.new(gss_provider: provider)
+      #
+      class Multi < Base
+        #
+        # @param [Array<Provider::Base>] providers the providers to offer, in preference order (most preferred first).
+        def initialize(providers)
+          raise ArgumentError, 'at least one provider is required' if providers.nil? || providers.empty?
+
+          @providers = providers.dup.freeze
+        end
+
+        # @return [Array<Provider::Base>] the providers this instance will route between.
+        attr_reader :providers
+
+        def new_authenticator(server_client)
+          Authenticator.new(self, server_client)
+        end
+
+        #
+        # Every mechanism offered by every provider, in provider order, with duplicates removed so a mechanism supported
+        # by two providers is only advertised once.
+        #
+        # @return [Array<OpenSSL::ASN1::ObjectId>]
+        def mech_types
+          @providers.flat_map(&:mech_types).uniq(&:oid)
+        end
+
+        #
+        # The first provider that handles the specified mechanism, or nil if none do.
+        #
+        # @param [OpenSSL::ASN1::ObjectId] mech_type the mechanism selected by the client
+        # @return [Provider::Base, nil]
+        def provider_for(mech_type)
+          @providers.find { |provider| provider.supports_mech_type?(mech_type) }
+        end
+
+        def allow_anonymous
+          @providers.any?(&:allow_anonymous)
+        end
+
+        def allow_guests
+          @providers.any?(&:allow_guests)
+        end
+
+        class Authenticator < Authenticator::Base
+          def initialize(provider, server_client)
+            # built lazily, so a provider that is advertised but never selected is never instantiated
+            @authenticators = {}
+            @selected = nil
+            super
+          end
+
+          def reset!
+            super
+            @authenticators&.each_value(&:reset!)
+            @selected = nil
+          end
+
+          def process(request_buffer=nil)
+            # the advertisement, listing every mechanism the server is willing to accept
+            return Result.new(Gss.gss_neg_token_init(@provider.mech_types), WindowsError::NTStatus::STATUS_SUCCESS) if request_buffer.nil?
+
+            begin
+              gss_api = OpenSSL::ASN1.decode(request_buffer)
+            rescue OpenSSL::ASN1::ASN1Error => e
+              logger.error("Failed to parse the ASN1-encoded authentication request (#{e.message})")
+              return
+            end
+
+            if negotiation_init?(gss_api)
+              # a NegTokenInit names the mechanism the client chose, so this is where routing is decided
+              mech_type = Gss.asn1dig(gss_api, 1, 0, 0, 0, 0)
+              authenticator = authenticator_for(mech_type)
+              if authenticator.nil?
+                logger.warn("Client selected an unsupported GSS mechanism (#{mech_type&.oid || 'unknown'})")
+                return
+              end
+
+              @selected = authenticator
+            elsif @selected.nil?
+              # a NegTokenResp carries no mechanism OID, so it can only be interpreted as a continuation of a
+              # negotiation that has already selected one
+              logger.warn('Received a GSS continuation token before any mechanism was selected')
+              return
+            end
+
+            @selected.process(request_buffer)
+          end
+
+          # The session key belongs to whichever mechanism actually authenticated the client.
+          def session_key
+            @selected&.session_key
+          end
+
+          def session_key=(value)
+            @selected&.session_key = value
+          end
+
+          private
+
+          # Whether the token is a NegTokenInit, which is the only token that names a mechanism.
+          def negotiation_init?(gss_api)
+            gss_api&.tag == 0 && gss_api&.tag_class == :APPLICATION
+          end
+
+          def authenticator_for(mech_type)
+            provider = @provider.provider_for(mech_type)
+            return nil if provider.nil?
+
+            @authenticators[provider] ||= provider.new_authenticator(@server_client)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby_smb/gss/provider/ntlm.rb

@@ -26,26 +26,7 @@ module RubySMB
 
           def process(request_buffer=nil)
             if request_buffer.nil?
-              # this is only NTLMSSP (as opposed to SPNEGO + NTLMSSP)
-              buffer = OpenSSL::ASN1::ASN1Data.new([
-                Gss::OID_SPNEGO,
-                OpenSSL::ASN1::ASN1Data.new([
-                  OpenSSL::ASN1::Sequence.new([
-                    OpenSSL::ASN1::ASN1Data.new([
-                      OpenSSL::ASN1::Sequence.new([
-                        Gss::OID_NTLMSSP
-                      ])
-                    ], 0, :CONTEXT_SPECIFIC),
-                    OpenSSL::ASN1::ASN1Data.new([
-                      OpenSSL::ASN1::ASN1Data.new([
-                        OpenSSL::ASN1::ASN1Data.new([
-                          OpenSSL::ASN1::GeneralString.new('not_defined_in_RFC4178@please_ignore')
-                        ], 0, :CONTEXT_SPECIFIC)
-                      ], 16, :UNIVERSAL)
-                    ], 3, :CONTEXT_SPECIFIC)
-                  ])
-                ], 0, :CONTEXT_SPECIFIC)
-              ], 0, :APPLICATION).to_der
+              buffer = Gss.gss_neg_token_init(@provider.mech_types)
               return Result.new(buffer, WindowsError::NTStatus::STATUS_SUCCESS)
             end
 
@@ -85,7 +66,7 @@ module RubySMB
 
               @server_challenge = @provider.generate_server_challenge
               msg.challenge = @server_challenge.unpack1('Q<') # 64-bit unsigned, little endian (uint64_t)
-              target_info = Net::NTLM::TargetInfo.new('')
+              target_info = Net::NTLM::TargetInfo.new(nil)
               target_info.av_pairs.merge!({
                 Net::NTLM::TargetInfo::MSV_AV_NB_DOMAIN_NAME => @provider.netbios_domain.encode('UTF-16LE').b,
                 Net::NTLM::TargetInfo::MSV_AV_NB_COMPUTER_NAME => @provider.netbios_hostname.encode('UTF-16LE').b,
@@ -293,6 +274,10 @@ module RubySMB
           Authenticator.new(self, server_client)
         end
 
+        def mech_types
+          [Gss::OID_NTLMSSP]
+        end
+
         #
         # Lookup and return an account based on the username and optionally, the domain. If no domain is specified or
         # or it is the special value '.', the default domain will be used. The username and domain values are case

data/lib/ruby_smb/gss/provider.rb

@@ -26,6 +26,26 @@ module RubySMB
           raise NotImplementedError
         end
 
+        #
+        # The GSS mechanisms this provider can handle, in preference order. These are advertised to the client in the
+        # SPNEGO NegTokenInit, and are used to route an incoming token to the provider that understands it.
+        #
+        # @return [Array<OpenSSL::ASN1::ObjectId>]
+        def mech_types
+          raise NotImplementedError
+        end
+
+        #
+        # Whether this provider can handle a token for the specified mechanism.
+        #
+        # @param [OpenSSL::ASN1::ObjectId] mech_type the mechanism selected by the client
+        # @return [Boolean]
+        def supports_mech_type?(mech_type)
+          return false if mech_type.nil?
+
+          mech_types.any? { |oid| oid.oid == mech_type.oid }
+        end
+
         #
         # Whether or not anonymous authentication attempts should be permitted.
         #
@@ -42,3 +62,5 @@ end
 
 require 'ruby_smb/gss/provider/authenticator'
 require 'ruby_smb/gss/provider/ntlm'
+require 'ruby_smb/gss/provider/kerberos'
+require 'ruby_smb/gss/provider/multi'

data/lib/ruby_smb/gss/spnego_neg_token_init.rb

@@ -0,0 +1,81 @@
+require 'rasn1'
+
+module RubySMB
+  module Gss
+    # The SPNEGO negotiation token an initiator sends first, and that a server sends to advertise the mechanisms it
+    # supports. Modelled with RASN1 so the fields can be read and built by name rather than by walking a decoded
+    # structure by hand.
+    #
+    # https://datatracker.ietf.org/doc/html/rfc4178#section-4.2.1
+    class MechType < RASN1::Types::ObjectId
+    end
+
+    class MechTypeList < RASN1::Model
+      sequence_of(:mech_type, MechType)
+    end
+
+    class ContextFlags < RASN1::Types::BitString
+      def initialize(options = {})
+        options[:bit_length] = 32
+        super
+      end
+    end
+
+    # RASN1 does not define a GeneralString type, and a SPNEGO negHints carries its hintName as one, so it is defined
+    # here as an octet string tagged UNIVERSAL 27.
+    class GeneralString < RASN1::Types::OctetString
+      ID = 27
+
+      def self.type
+        'GeneralString'
+      end
+    end
+
+    # NegHints, the optional field Microsoft servers place at [3] of a NegTokenInit2 in lieu of a mechListMIC. Windows
+    # servers send a fixed placeholder hintName, so a client that expects the field still finds one.
+    #
+    # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-spng/8e71cf53-e867-4b79-9df6-cc9edb7f8829
+    class NegHints < RASN1::Model
+      define_type_accel('general_string', GeneralString)
+
+      sequence :neg_hints,
+               content: [general_string(:hint_name, explicit: 0, class: :context, constructed: true, optional: true),
+                         octet_string(:hint_address, explicit: 1, class: :context, constructed: true, optional: true)]
+    end
+
+    class NegTokenInit < RASN1::Model
+      sequence :neg_token_init, explicit: 0, class: :context, constructed: true,
+               content: [wrapper(model(:mech_type_list, MechTypeList), explicit: 0, constructed: true),
+                         wrapper(model(:context_flags, ContextFlags), explicit: 1, constructed: true, optional: true),
+                         octet_string(:mech_token, explicit: 2, constructed: true, optional: true),
+                         wrapper(model(:neg_hints, NegHints), explicit: 3, constructed: true, optional: true)]
+    end
+
+    class SpnegoNegTokenInit < RASN1::Model
+      # The placeholder hintName a Windows server sends, reproduced so the advertisement matches what a client expects.
+      NEG_HINTS_NAME = 'not_defined_in_RFC4178@please_ignore'.freeze
+
+      sequence :gssapi, implicit: 0, class: :application, constructed: true,
+               content: [objectid(:oid),
+                         model(:neg_token_init, NegTokenInit)]
+
+      # Build the NegTokenInit a server sends to advertise the mechanisms it supports, including the Microsoft negHints
+      # placeholder so the token is shaped as a Windows server's is.
+      #
+      # @param [Array<OpenSSL::ASN1::ObjectId>] mech_types the mechanisms to advertise, in preference order.
+      # @return [String] the DER encoded token.
+      def self.build(mech_types)
+        token = new
+        token[:gssapi][:oid].value = Gss::OID_SPNEGO.oid
+        token[:gssapi][:neg_token_init][:mech_type_list][:mech_type] = mech_types.map { |mech| MechType.new(value: mech.oid) }
+        token[:gssapi][:neg_token_init][:neg_hints][:hint_name] = NEG_HINTS_NAME
+        token.to_der
+      end
+
+      # @return [String, nil] the mechanism token the initiator carried, or nil if it carried none.
+      def mech_token
+        self[:gssapi][:neg_token_init][:mech_token].value
+      end
+    end
+  end
+end

data/lib/ruby_smb/gss/spnego_neg_token_targ.rb

@@ -0,0 +1,27 @@
+require 'rasn1'
+
+module RubySMB
+  module Gss
+    # The SPNEGO negotiation token exchanged after the first, carrying a continuation of the selected mechanism.
+    # A client sends one to continue an exchange, so it is where a mechanism token arrives on any leg past the first.
+    #
+    # https://www.rfc-editor.org/rfc/rfc2478
+    class SpnegoNegTokenTarg < RASN1::Model
+      NEG_RESULTS = { 'accept-completed' => 0,
+                      'accept-incomplete' => 1,
+                      'reject' => 2,
+                      'request-mic' => 3 }.freeze
+
+      sequence :token, explicit: 1, class: :context, constructed: true,
+               content: [enumerated(:neg_result, enum: NEG_RESULTS, explicit: 0, class: :context, constructed: true, optional: true),
+                         objectid(:supported_mech, explicit: 1, class: :context, constructed: true, optional: true),
+                         octet_string(:response_token, explicit: 2, class: :context, constructed: true, optional: true),
+                         octet_string(:mech_list_mic, explicit: 3, class: :context, constructed: true, optional: true)]
+
+      # @return [String, nil] the mechanism token the continuation carried, or nil if it carried none.
+      def response_token
+        self[:response_token].value
+      end
+    end
+  end
+end

data/lib/ruby_smb/gss.rb

@@ -2,11 +2,18 @@ module RubySMB
   # module containing methods required for using the [GSS-API](http://www.rfc-editor.org/rfc/rfc2743.txt)
   # for Secure Protected Negotiation(SPNEGO) in SMB Authentication.
   module Gss
+    require 'ruby_smb/gss/spnego_neg_token_init'
+    require 'ruby_smb/gss/spnego_neg_token_targ'
     require 'ruby_smb/gss/provider'
 
     OID_SPNEGO = OpenSSL::ASN1::ObjectId.new('1.3.6.1.5.5.2')
     OID_NEGOEX = OpenSSL::ASN1::ObjectId.new('1.3.6.1.4.1.311.2.2.30')
     OID_NTLMSSP = OpenSSL::ASN1::ObjectId.new('1.3.6.1.4.1.311.2.2.10')
+    # The Kerberos v5 GSS-API mechanism (RFC 4121). Microsoft's SPNEGO
+    # implementation also uses a legacy OID that differs by a single arc, and
+    # clients may offer or select either, so both are defined here.
+    OID_KERBEROS_5 = OpenSSL::ASN1::ObjectId.new('1.2.840.113554.1.2.2')
+    OID_MICROSOFT_KERBEROS_5 = OpenSSL::ASN1::ObjectId.new('1.2.840.48018.1.2.2')
 
     # Allow safe navigation of a decoded ASN.1 data structure. Similar to Ruby's
     # builtin Hash#dig method but using the #value attribute of each ASN object.
@@ -46,6 +53,22 @@ module RubySMB
       encoded_string
     end
 
+    # Build the SPNEGO NegTokenInit that a server sends to advertise the
+    # authentication mechanisms it supports, per RFC 4178 section 4.2.1.
+    #
+    # The mechTypes list is supplied by the caller so that it reflects every
+    # mechanism the server actually offers, rather than being fixed to a single
+    # mechanism by whichever provider happens to build the token.
+    #
+    # @param [Array<OpenSSL::ASN1::ObjectId>] mech_types the mechanisms to
+    #   advertise, in preference order (most preferred first).
+    # @return [String] the DER encoded NegTokenInit.
+    def self.gss_neg_token_init(mech_types)
+      raise ArgumentError, 'at least one mechanism must be advertised' if mech_types.nil? || mech_types.empty?
+
+      SpnegoNegTokenInit.build(mech_types)
+    end
+
     # Create a GSS Security Blob of an NTLM Type 1 Message.
     def self.gss_type1(type1)
       OpenSSL::ASN1::ASN1Data.new([

data/lib/ruby_smb/nbss/name_service_header_flags.rb

@@ -0,0 +1,18 @@
+module RubySMB
+  module Nbss
+    # The NM_FLAGS field of the NetBIOS Name Service header, as defined in
+    # RFC 1002 section 4.2.1.1. The surrounding R/OPCODE and RCODE bits are
+    # declared inline in the header records that embed this field
+    # ({NodeStatusRequest} and {NodeStatusResponse}).
+    class NameServiceHeaderFlags < BinData::Record
+      endian :big
+
+      bit1 :authoritative_answer, label: 'Authoritative Answer', initial_value: 0
+      bit1 :truncated,            label: 'Truncated',            initial_value: 0
+      bit1 :recursion_desired,    label: 'Recursion Desired',    initial_value: 0
+      bit1 :recursion_available,  label: 'Recursion Available',  initial_value: 0
+      bit2 :reserved,             label: 'Reserved',             initial_value: 0
+      bit1 :broadcast,            label: 'Broadcast',            initial_value: 0
+    end
+  end
+end

data/lib/ruby_smb/nbss/negative_session_response.rb

@@ -12,15 +12,15 @@ module RubySMB
 
       def error_msg
         case error_code
-        when 0x80
+        when NOT_LISTENING_ON_CALLED_NAME
           'Not listening on called name'
-        when 0x81
+        when NOT_LISTENING_FOR_CALLING_NAME
           'Not listening for calling name'
-        when 0x82
+        when CALLED_NAME_NOT_PRESENT
           'Called name not present'
-        when 0x83
+        when CALLED_NAME_INSUFFICIENT_RESOURCES
           'Called name present, but insufficient resources'
-        when 0x8F
+        when UNSPECIFIED_ERROR
           'Unspecified error'
         end
       end