ruby_smb 3.3.22 → 3.3.25

data/spec/lib/ruby_smb/gss/provider/multi_spec.rb

@@ -0,0 +1,174 @@
+RSpec.describe RubySMB::Gss::Provider::Multi do
+  let(:username) { 'RubySMB' }
+  let(:domain) { 'WORKGROUP' }
+  let(:password) { 'password' }
+  let(:ntlm_provider) do
+    RubySMB::Gss::Provider::NTLM.new.tap { |provider| provider.put_account(username, password, domain: domain) }
+  end
+  let(:other_authenticator) { double('authenticator', process: nil, reset!: nil, session_key: nil) }
+  # a stand-in for any non-NTLM mechanism, so the routing can be exercised without a second real provider
+  let(:other_provider) do
+    authenticator = other_authenticator
+    Class.new(RubySMB::Gss::Provider::Base) do
+      define_method(:mech_types) do
+        [RubySMB::Gss::OID_KERBEROS_5, RubySMB::Gss::OID_MICROSOFT_KERBEROS_5]
+      end
+
+      define_method(:new_authenticator) { |_server_client| authenticator }
+    end.new
+  end
+  let(:server_client) { double('server_client', logger: Logger.new(IO::NULL)) }
+
+  # referenced explicitly rather than via described_class, which resolves to the authenticator inside the nested group
+  subject(:provider) { RubySMB::Gss::Provider::Multi.new([other_provider, ntlm_provider]) }
+
+  describe '#initialize' do
+    it 'requires at least one provider' do
+      expect { RubySMB::Gss::Provider::Multi.new([]) }.to raise_error(ArgumentError)
+      expect { RubySMB::Gss::Provider::Multi.new(nil) }.to raise_error(ArgumentError)
+    end
+  end
+
+  describe '#mech_types' do
+    it 'advertises every mechanism of every provider' do
+      expect(provider.mech_types.map(&:oid)).to eq(
+        [
+          RubySMB::Gss::OID_KERBEROS_5.oid,
+          RubySMB::Gss::OID_MICROSOFT_KERBEROS_5.oid,
+          RubySMB::Gss::OID_NTLMSSP.oid
+        ]
+      )
+    end
+
+    it 'preserves the order the providers were given in' do
+      reversed = RubySMB::Gss::Provider::Multi.new([ntlm_provider, other_provider])
+      expect(reversed.mech_types.first.oid).to eq(RubySMB::Gss::OID_NTLMSSP.oid)
+    end
+
+    it 'advertises a mechanism supported by two providers only once' do
+      duplicated = RubySMB::Gss::Provider::Multi.new([ntlm_provider, RubySMB::Gss::Provider::NTLM.new])
+      expect(duplicated.mech_types.length).to eq(1)
+    end
+  end
+
+  describe '#provider_for' do
+    it 'finds the provider that handles the mechanism' do
+      expect(provider.provider_for(RubySMB::Gss::OID_KERBEROS_5)).to be(other_provider)
+      expect(provider.provider_for(RubySMB::Gss::OID_NTLMSSP)).to be(ntlm_provider)
+    end
+
+    it 'is nil when no provider handles the mechanism' do
+      expect(provider.provider_for(RubySMB::Gss::OID_NEGOEX)).to be_nil
+    end
+  end
+
+  describe RubySMB::Gss::Provider::Multi::Authenticator do
+    subject(:authenticator) { provider.new_authenticator(server_client) }
+
+    describe '#process' do
+      context 'when building the advertisement' do
+        it 'offers all of the mechanisms' do
+          buffer = authenticator.process(nil).buffer
+          expect(buffer).to eq(RubySMB::Gss.gss_neg_token_init(provider.mech_types))
+        end
+
+        it 'matches the underlying provider when only one is held' do
+          single = described_class.new(RubySMB::Gss::Provider::Multi.new([ntlm_provider]), server_client)
+          expect(single.process(nil).buffer).to eq(ntlm_provider.new_authenticator(server_client).process(nil).buffer)
+        end
+
+        it 'succeeds' do
+          expect(authenticator.process(nil).nt_status).to eq(WindowsError::NTStatus::STATUS_SUCCESS)
+        end
+      end
+
+      context 'when the client selects a mechanism' do
+        it 'routes the token to the provider that handles it' do
+          expect(other_authenticator).to receive(:process)
+          authenticator.process(gss_init(RubySMB::Gss::OID_KERBEROS_5))
+        end
+
+        it 'routes an NTLM token to the NTLM provider' do
+          type1 = Net::NTLM::Message::Type1.new.tap { |msg| msg.domain = domain }
+          result = authenticator.process(RubySMB::Gss.gss_type1(type1.serialize))
+          expect(result.nt_status).to eq(WindowsError::NTStatus::STATUS_MORE_PROCESSING_REQUIRED)
+        end
+
+        it 'refuses a mechanism no provider handles' do
+          expect(authenticator.process(gss_init(RubySMB::Gss::OID_NEGOEX))).to be_nil
+        end
+      end
+
+      context 'when the client continues an exchange' do
+        it 'refuses a continuation before a mechanism has been selected' do
+          # a NegTokenResp carries no mechanism OID, so there is nothing to route on
+          expect(authenticator.process(RubySMB::Gss.gss_type3('anything'))).to be_nil
+        end
+      end
+
+      it 'returns nil for a malformed request' do
+        expect(authenticator.process('not asn1 at all')).to be_nil
+      end
+    end
+
+    describe 'a complete NTLM exchange' do
+      it 'authenticates the same as the NTLM provider on its own' do
+        expect(complete_ntlm_exchange(authenticator)).to eq(
+          complete_ntlm_exchange(ntlm_provider.new_authenticator(server_client))
+        )
+      end
+
+      it 'succeeds for a known account' do
+        status, identity = complete_ntlm_exchange(authenticator)
+        expect(status).to eq(WindowsError::NTStatus::STATUS_SUCCESS)
+        expect(identity).to eq("#{domain}\\#{username}")
+      end
+
+      it 'exposes the session key of the mechanism that authenticated' do
+        complete_ntlm_exchange(authenticator)
+        expect(authenticator.session_key).to_not be_nil
+      end
+    end
+
+    describe '#reset!' do
+      it 'forgets the selected mechanism' do
+        complete_ntlm_exchange(authenticator)
+        authenticator.reset!
+        expect(authenticator.session_key).to be_nil
+        # with no mechanism selected, a continuation token has nothing to route to
+        expect(authenticator.process(RubySMB::Gss.gss_type3('anything'))).to be_nil
+      end
+    end
+  end
+
+  # Build a NegTokenInit that selects the specified mechanism, with an empty mechToken.
+  def gss_init(mech_type)
+    OpenSSL::ASN1::ASN1Data.new(
+      [
+        RubySMB::Gss::OID_SPNEGO,
+        OpenSSL::ASN1::ASN1Data.new(
+          [
+            OpenSSL::ASN1::Sequence.new(
+              [
+                OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::Sequence.new([mech_type])], 0, :CONTEXT_SPECIFIC),
+                OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::OctetString.new('')], 2, :CONTEXT_SPECIFIC)
+              ]
+            )
+          ], 0, :CONTEXT_SPECIFIC
+        )
+      ], 0, :APPLICATION
+    ).to_der
+  end
+
+  # Drive a full NTLM negotiation through the authenticator, returning the final status and identity.
+  def complete_ntlm_exchange(authenticator)
+    authenticator.process(nil)
+    type1 = Net::NTLM::Message::Type1.new.tap { |msg| msg.domain = domain }
+    challenge_result = authenticator.process(RubySMB::Gss.gss_type1(type1.serialize))
+    raw_type2 = RubySMB::Gss.asn1dig(OpenSSL::ASN1.decode(challenge_result.buffer), 0, 2, 0).value
+    type2 = Net::NTLM::Message.parse(raw_type2)
+    type3 = type2.response({ user: username, password: password, domain: domain }, { ntlmv2: true })
+    result = authenticator.process(RubySMB::Gss.gss_type3(type3.serialize))
+    [result.nt_status, result.identity]
+  end
+end

data/spec/lib/ruby_smb/gss/provider/ntlm/authenticator_spec.rb

@@ -65,6 +65,19 @@ RSpec.describe RubySMB::Gss::Provider::NTLM::Authenticator do
     it 'should process a NTLM type 1 message and return a type2 message' do
       expect(authenticator.process_ntlm_type1(type1_msg)).to be_a Net::NTLM::Message::Type2
     end
+
+    it 'includes the server names in the serialized target info' do
+      type2_msg = Net::NTLM::Message.parse(authenticator.process_ntlm_type1(type1_msg).serialize)
+      target_info = Net::NTLM::TargetInfo.new(type2_msg.target_info)
+
+      expect(target_info.av_pairs).to include(
+        Net::NTLM::TargetInfo::MSV_AV_NB_DOMAIN_NAME => provider.netbios_domain.encode('UTF-16LE').b,
+        Net::NTLM::TargetInfo::MSV_AV_NB_COMPUTER_NAME => provider.netbios_hostname.encode('UTF-16LE').b,
+        Net::NTLM::TargetInfo::MSV_AV_DNS_DOMAIN_NAME => provider.dns_domain.encode('UTF-16LE').b,
+        Net::NTLM::TargetInfo::MSV_AV_DNS_COMPUTER_NAME => provider.dns_hostname.encode('UTF-16LE').b
+      )
+      expect(target_info.av_pairs[Net::NTLM::TargetInfo::MSV_AV_TIMESTAMP].bytesize).to eq 8
+    end
   end
 
   describe '#process_ntlm_type3' do

data/spec/lib/ruby_smb/gss/spnego_spec.rb

@@ -0,0 +1,80 @@
+RSpec.describe 'SPNEGO negotiation tokens' do
+  let(:mech_types) do
+    [RubySMB::Gss::OID_KERBEROS_5, RubySMB::Gss::OID_MICROSOFT_KERBEROS_5, RubySMB::Gss::OID_NTLMSSP]
+  end
+
+  describe RubySMB::Gss::SpnegoNegTokenInit do
+    describe '.build' do
+      subject(:token) { described_class.build(mech_types) }
+
+      # the exact bytes a server advertised before this was modelled with RASN1, kept so the wire format does not
+      # drift: the SPNEGO OID, the three mechanisms, and the Microsoft negHints placeholder
+      let(:legacy_der) do
+        [
+          '605e06062b0601050502a0543052a024302206092a864886f71201020206092a864882' \
+          'f712010202060a2b06010401823702020aa32a3028a0261b246e6f745f646566696e65' \
+          '645f696e5f5246433431373840706c656173655f69676e6f7265'
+        ].pack('H*')
+      end
+
+      it 'is byte-identical to the token the hand-rolled builder produced' do
+        expect(token).to eq(legacy_der)
+      end
+
+      # the exact NTLM-only advertisement a default server built before this change, when the NTLM provider
+      # hardcoded a single OID_NTLMSSP. existing servers still emit this, so lock it against a wire regression.
+      it 'is byte-identical to the NTLM-only advertisement a default server built before this change' do
+        legacy_ntlm_der = [
+          '604806062b0601050502a03e303ca00e300c060a2b06010401823702020aa32a3028' \
+          'a0261b246e6f745f646566696e65645f696e5f5246433431373840706c656173655f' \
+          '69676e6f7265'
+        ].pack('H*')
+        expect(described_class.build([RubySMB::Gss::OID_NTLMSSP])).to eq(legacy_ntlm_der)
+      end
+
+      it 'advertises the mechanisms in order' do
+        decoded = OpenSSL::ASN1.decode(token)
+        mech_list = decoded.value[1].value[0].value[0].value[0].value
+        expect(mech_list.map(&:oid)).to eq(mech_types.map(&:oid))
+      end
+
+      it 'carries the Microsoft negHints placeholder' do
+        decoded = OpenSSL::ASN1.decode(token)
+        hint = decoded.value[1].value[0].value[1].value[0].value[0].value[0].value
+        expect(hint).to eq(RubySMB::Gss::SpnegoNegTokenInit::NEG_HINTS_NAME)
+      end
+    end
+
+    describe '.parse' do
+      # a SPNEGO NegTokenInit selecting Kerberos and carrying the given mechanism token
+      def neg_token_init(token)
+        inner = [OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::Sequence.new([RubySMB::Gss::OID_KERBEROS_5])], 0, :CONTEXT_SPECIFIC)]
+        inner << OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::OctetString.new(token)], 2, :CONTEXT_SPECIFIC) unless token.nil?
+
+        OpenSSL::ASN1::ASN1Data.new(
+          [
+            RubySMB::Gss::OID_SPNEGO,
+            OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::Sequence.new(inner)], 0, :CONTEXT_SPECIFIC)
+          ], 0, :APPLICATION
+        ).to_der
+      end
+
+      it 'reads the mechanism token' do
+        expect(described_class.parse(neg_token_init('a mechanism token')).mech_token).to eq('a mechanism token')
+      end
+
+      it 'is nil when the token carries no mechanism token' do
+        expect(described_class.parse(neg_token_init(nil)).mech_token).to be_nil
+      end
+    end
+  end
+
+  describe RubySMB::Gss::SpnegoNegTokenTarg do
+    describe '.parse' do
+      it 'reads the response token from a continuation' do
+        targ = described_class.parse(RubySMB::Gss.gss_type3('a continuation token'))
+        expect(targ.response_token).to eq('a continuation token')
+      end
+    end
+  end
+end

data/spec/lib/ruby_smb/nbss/node_status_request_spec.rb

@@ -0,0 +1,52 @@
+require 'spec_helper'
+
+RSpec.describe RubySMB::Nbss::NodeStatusRequest do
+  subject(:request) { described_class.new(transaction_id: 0x1234) }
+
+  describe 'encoded bytes' do
+    let(:bytes) { request.to_binary_s }
+
+    it 'starts with a 12-byte NBNS header' do
+      expect(bytes[0, 2].unpack1('n')).to eq(0x1234)
+      expect(bytes[2, 2].unpack1('n')).to eq(0x0000)  # flags
+      expect(bytes[4, 2].unpack1('n')).to eq(1)       # qdcount
+      expect(bytes[6, 2].unpack1('n')).to eq(0)       # ancount
+      expect(bytes[8, 2].unpack1('n')).to eq(0)       # nscount
+      expect(bytes[10, 2].unpack1('n')).to eq(0)      # arcount
+    end
+
+    it 'encodes the wildcard question name as 34 bytes (length + 32-char L1 + null)' do
+      expect(bytes[12].unpack1('C')).to eq(0x20)   # label length
+      expect(bytes[13, 32]).to eq('CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')
+      expect(bytes[45].unpack1('C')).to eq(0x00)   # null label terminator
+    end
+
+    it 'ends with QTYPE=NBSTAT and QCLASS=IN' do
+      expect(bytes[46, 2].unpack1('n')).to eq(described_class::QUESTION_TYPE_NBSTAT)
+      expect(bytes[48, 2].unpack1('n')).to eq(described_class::QUESTION_CLASS_IN)
+    end
+
+    it 'is exactly 50 bytes long' do
+      expect(bytes.bytesize).to eq(50)
+    end
+  end
+
+  describe 'flags' do
+    it 'packs the OPCODE, NM_FLAGS and RCODE fields in RFC bit order' do
+      request.response = 1
+      request.nm_flags.authoritative_answer = 1
+      request.nm_flags.broadcast = 1
+      request.rcode = 0x5
+
+      expect(request.to_binary_s[2, 2].unpack1('n')).to eq(0x8415)
+    end
+
+    it 'defaults every request flag bit to zero' do
+      expect(request.to_binary_s[2, 2].unpack1('n')).to eq(0x0000)
+      expect(request.response.to_i).to eq(0)
+      expect(request.opcode.to_i).to eq(0)
+      expect(request.nm_flags.broadcast.to_i).to eq(0)
+      expect(request.rcode.to_i).to eq(0)
+    end
+  end
+end

data/spec/lib/ruby_smb/nbss/node_status_response_spec.rb

@@ -0,0 +1,75 @@
+require 'spec_helper'
+
+RSpec.describe RubySMB::Nbss::NodeStatusResponse do
+  def build_response(names)
+    data = ''.b
+    data << [0x1234].pack('n')         # transaction_id
+    data << [0x8400].pack('n')         # flags: response, authoritative
+    data << [0].pack('n')              # qdcount
+    data << [1].pack('n')              # ancount
+    data << [0].pack('n') << [0].pack('n')  # nscount, arcount
+    data << [0x20].pack('C') << ('A' * 32) << "\x00".b  # owner name L1
+    data << [0x0021].pack('n')         # RR type NBSTAT
+    data << [0x0001].pack('n')         # RR class IN
+    data << [0].pack('N')              # TTL
+    data << [1 + names.length * 18 + 46].pack('n')  # rdlength
+    data << [names.length].pack('C')
+    names.each do |name, suffix, flags|
+      data << name.to_s.ljust(15, ' ') << [suffix].pack('C') << [flags].pack('n')
+    end
+    data << ("\x00".b * 46)  # statistics (unused)
+    data
+  end
+
+  describe 'parsing' do
+    it 'decodes the name table' do
+      response = described_class.read(build_response([
+        ['WIN95', 0x00, 0x0400],
+        ['WIN95', 0x20, 0x0400],
+        ['WORKGROUP', 0x00, 0x8400]
+      ]))
+      expect(response.num_names).to eq(3)
+      expect(response.node_names[0].netbios_name.to_s.rstrip).to eq('WIN95')
+      expect(response.node_names[0].suffix).to eq(0x00)
+      expect(response.node_names[1].suffix).to eq(0x20)
+      expect(response.node_names[2].group?).to be true
+      expect(response.response.to_i).to eq(1)
+      expect(response.nm_flags.authoritative_answer.to_i).to eq(1)
+    end
+  end
+
+  describe 'flags' do
+    it 'decodes the header OPCODE and NM_FLAGS fields from the second word' do
+      response = described_class.read(build_response([['WIN95', 0x20, 0x0400]]))
+
+      expect(response.response.to_i).to eq(1)                 # high bit of 0x8400
+      expect(response.nm_flags.authoritative_answer.to_i).to eq(1)
+    end
+
+    it 'defines NODE_NAME flags in RFC bit order' do
+      flags = RubySMB::Nbss::NodeStatusNameFlags.new
+      flags.group = 1
+      flags.active = 1
+
+      expect(flags.to_binary_s.unpack1('n')).to eq(0x8400)
+      expect(flags.group.to_i).to eq(1)
+      expect(flags.active.to_i).to eq(1)
+    end
+
+    it 'exposes parsed NODE_NAME flags as named fields' do
+      response = described_class.read(build_response([
+        ['WORKGROUP', 0x00, 0x8400],
+        ['FILESERVER', 0x20, 0x0400]
+      ]))
+
+      group_entry = response.node_names[0]
+      unique_entry = response.node_names[1]
+
+      expect(group_entry.name_flags.group.to_i).to eq(1)
+      expect(group_entry.name_flags.active.to_i).to eq(1)
+      expect(group_entry.group?).to be true
+      expect(unique_entry.name_flags.group.to_i).to eq(0)
+      expect(unique_entry.unique?).to be true
+    end
+  end
+end

data/spec/lib/ruby_smb/nbss/node_status_spec.rb

@@ -0,0 +1,146 @@
+require 'spec_helper'
+
+RSpec.describe RubySMB::Nbss::NodeStatus do
+  let(:udp_sock) { double('UDPSocket') }
+  # #recvfrom returns the sender as [address_family, port, host, numeric_host];
+  # the numeric address at index 3 is matched against the queried target.
+  let(:peer) { ['AF_INET', 137, '10.0.0.2', '10.0.0.2'] }
+
+  # Node Status requests carry a random transaction ID; the response is only
+  # accepted when it echoes that ID back. Pin it so the fixtures match.
+  before { allow(SecureRandom).to receive(:random_number).and_return(0x1234) }
+
+  def build_response(names)
+    data = ''.b
+    data << [0x1234].pack('n')               # transaction_id
+    data << [0x8400].pack('n')               # flags
+    data << [0].pack('n') << [1].pack('n')   # qdcount, ancount
+    data << [0].pack('n') << [0].pack('n')   # nscount, arcount
+    data << [0x20].pack('C') << ('A' * 32) << "\x00".b  # owner name
+    data << [0x0021].pack('n') << [0x0001].pack('n')
+    data << [0].pack('N')                    # TTL
+    data << [1 + names.length * 18 + 46].pack('n')
+    data << [names.length].pack('C')
+    names.each do |name, suffix, flags|
+      data << name.to_s.ljust(15, ' ') << [suffix].pack('C') << [flags].pack('n')
+    end
+    data << ("\x00".b * 46)
+    data
+  end
+
+  describe '.query' do
+    it 'sends the request with #send(mesg, flags, host, port) and reads via recvfrom(maxlen)' do
+      response_bytes = build_response([
+        ['WIN95', 0x00, 0x0400],
+        ['WIN95', 0x20, 0x0400],
+        ['WORKGROUP', 0x00, 0x8400]
+      ])
+
+      expect(udp_sock).to receive(:send) do |bytes, flags, host, port|
+        expect(flags).to eq(0)
+        expect(host).to eq('10.0.0.2')
+        expect(port).to eq(137)
+        expect(bytes.bytesize).to eq(50)
+      end
+      expect(IO).to receive(:select).and_return([udp_sock])
+      expect(udp_sock).to receive(:recvfrom).with(4096).and_return([response_bytes, peer])
+
+      entries = described_class.query('10.0.0.2', udp_socket: udp_sock)
+      expect(entries.size).to eq(3)
+      expect(entries[1].name).to eq('WIN95')
+      expect(entries[1].suffix).to eq(0x20)
+      expect(entries[1].unique?).to be true
+      expect(entries[2].group).to be true
+    end
+
+    it 'retries up to the configured limit before giving up' do
+      call_count = 0
+      allow(udp_sock).to receive(:send) { call_count += 1 }
+      allow(IO).to receive(:select).and_return(nil) # always time out
+
+      expect(described_class.query('10.0.0.2', retries: 4, timeout: 0.01, udp_socket: udp_sock)).to be_nil
+      expect(call_count).to eq(4)
+    end
+
+    it 'returns nil when the response can not be parsed' do
+      expect(udp_sock).to receive(:send)
+      expect(IO).to receive(:select).and_return([udp_sock])
+      expect(udp_sock).to receive(:recvfrom).and_return(["\xff\xff".b, peer])
+      expect(described_class.query('10.0.0.2', retries: 1, timeout: 0.01, udp_socket: udp_sock)).to be_nil
+    end
+
+    it 'retries after a malformed datagram and succeeds on a later attempt' do
+      good = build_response([['WIN95', 0x20, 0x0400]])
+      allow(udp_sock).to receive(:send)
+      allow(IO).to receive(:select).and_return([udp_sock])
+      # First datagram is truncated (NodeStatusResponse.read raises); the second
+      # is well-formed. The rescue must stay inside the retry loop for this.
+      allow(udp_sock).to receive(:recvfrom).and_return(["\xff\xff".b, peer], [good, peer])
+
+      entries = described_class.query('10.0.0.2', retries: 3, timeout: 0.01, udp_socket: udp_sock)
+      expect(entries).not_to be_nil
+      expect(entries.first.suffix).to eq(0x20)
+    end
+
+    it 'raises ArgumentError when host is not a numeric IPv4 address' do
+      expect { described_class.query('example.com', udp_socket: udp_sock) }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects a reply whose transaction ID does not match the request' do
+      allow(SecureRandom).to receive(:random_number).and_return(0x1234)
+      mismatched = build_response([['WIN95', 0x20, 0x0400]])
+      mismatched[0, 2] = [0x9999].pack('n') # overwrite transaction_id
+      expect(udp_sock).to receive(:send)
+      expect(IO).to receive(:select).and_return([udp_sock])
+      expect(udp_sock).to receive(:recvfrom).and_return([mismatched, peer])
+      expect(described_class.query('10.0.0.2', retries: 1, timeout: 0.01, udp_socket: udp_sock)).to be_nil
+    end
+
+    it 'rejects a reply from an unexpected source address' do
+      spoofed = build_response([['WIN95', 0x20, 0x0400]])
+      expect(udp_sock).to receive(:send)
+      expect(IO).to receive(:select).and_return([udp_sock])
+      expect(udp_sock).to receive(:recvfrom).and_return([spoofed, ['AF_INET', 137, '10.0.0.9', '10.0.0.9']])
+      expect(described_class.query('10.0.0.2', retries: 1, timeout: 0.01, udp_socket: udp_sock)).to be_nil
+    end
+
+    it 'returns nil on IOError and does not close the socket' do
+      allow(udp_sock).to receive(:send).and_raise(IOError, 'boom')
+      expect(udp_sock).not_to receive(:close)
+      expect(described_class.query('10.0.0.2', retries: 1, udp_socket: udp_sock)).to be_nil
+    end
+  end
+
+  describe '.file_server_name' do
+    it 'returns the unique 0x20 entry' do
+      response_bytes = build_response([
+        ['WORKGROUP', 0x00, 0x8400],
+        ['FILESERVER', 0x20, 0x0400]
+      ])
+      allow(udp_sock).to receive(:send)
+      allow(IO).to receive(:select).and_return([udp_sock])
+      allow(udp_sock).to receive(:recvfrom).and_return([response_bytes, peer])
+
+      expect(described_class.file_server_name('10.0.0.2', udp_socket: udp_sock)).to eq('FILESERVER')
+    end
+
+    it 'returns nil when no unique 0x20 entry is present' do
+      response_bytes = build_response([['HOST', 0x00, 0x0400]])
+      allow(udp_sock).to receive(:send)
+      allow(IO).to receive(:select).and_return([udp_sock])
+      allow(udp_sock).to receive(:recvfrom).and_return([response_bytes, peer])
+
+      expect(described_class.file_server_name('10.0.0.2', udp_socket: udp_sock)).to be_nil
+    end
+  end
+
+  describe RubySMB::Nbss::NodeStatus::Entry do
+    it '#to_s formats like nmblookup output' do
+      entry = described_class.new('WIN95', 0x20, false, true)
+      expect(entry.to_s).to include('WIN95')
+      expect(entry.to_s).to include('<20>')
+      expect(entry.to_s).to include('UNIQUE')
+      expect(entry.to_s).to include('ACTIVE')
+    end
+  end
+end

data/spec/lib/ruby_smb/ntlm/client/session_spec.rb

@@ -8,7 +8,9 @@ RSpec.describe RubySMB::NTLM::Client::Session do
     AGwAbwBjAGEAbAADADgAVwBJAE4ALQAzAE0AUwBQADgASwAyAEwAQwBHAEMA
     LgBtAHMAZgBsAGEAYgAuAGwAbwBjAGEAbAAHAAgAS6UAWjxl2AEAAAAA
   }) }
-  subject(:client) { RubySMB::NTLM::Client.new('rubysmb', 'rubysmb', flags: RubySMB::NTLM::DEFAULT_CLIENT_FLAGS) }
+  let(:username) { 'rubysmb' }
+  let(:password) { 'rubysmb' }
+  let(:client) { RubySMB::NTLM::Client.new(username, password, flags: RubySMB::NTLM::DEFAULT_CLIENT_FLAGS) }
   subject(:session) { described_class.new(client, message) }
 
   describe '#authenticate!' do
@@ -17,72 +19,49 @@ RSpec.describe RubySMB::NTLM::Client::Session do
       session.authenticate!
     end
 
-    it 'checks if it is anonymous' do
-      expect(session).to receive(:is_anonymous?).at_least(1).times.and_call_original
-      session.authenticate!
-    end
-
     it 'returns a Type3 message' do
       expect(session.authenticate!).to be_a Net::NTLM::Message::Type3
       expect(session.authenticate!).to be_a Net::NTLM::Message
     end
 
     context 'when it is anonymous' do
-      before(:each) { allow(session).to receive(:is_anonymous?).and_return(true) }
-      after(:each) { session.authenticate! }
+      let(:username) { '' }
+      let(:password) { '' }
 
       it 'uses the correct lm response' do
-        expect(session).to_not receive(:lmv2_resp)
-        expect(Net::NTLM::Message::Type3).to receive(:create).and_wrap_original do |method, params|
-          expect(params).to include :lm_response
-          expect(params[:lm_response]).to eq "\x00".b
-          method.call(params)
-        end
+        expect(session.authenticate!.lm_response).to eq "\x00".b
       end
 
       it 'uses the correct ntlm response' do
-        expect(session).to_not receive(:ntlmv2_resp)
-        expect(Net::NTLM::Message::Type3).to receive(:create).and_wrap_original do |method, params|
-          expect(params).to include :ntlm_response
-          expect(params[:ntlm_response]).to eq ''
-          method.call(params)
-        end
+        expect(session.authenticate!.ntlm_response).to eq ''
       end
     end
 
     context 'when it is not anonymous' do
-      before(:each) { allow(session).to receive(:is_anonymous?).and_return(false) }
-      after(:each) { session.authenticate! }
-
       it 'uses the correct lm response' do
-        expect(session).to receive(:lmv2_resp).and_call_original
-        expect(Net::NTLM::Message::Type3).to receive(:create).and_wrap_original do |method, params|
-          expect(params).to include :lm_response
-          expect(params[:lm_response].length).to be > 16
-          method.call(params)
-        end
+        expect(session.authenticate!.lm_response.length).to be > 16
       end
 
       it 'uses the correct ntlm response' do
-        expect(session).to receive(:ntlmv2_resp).and_call_original
-        expect(Net::NTLM::Message::Type3).to receive(:create).and_wrap_original do |method, params|
-          expect(params).to include :ntlm_response
-          expect(params[:ntlm_response].length).to be > 16
-          method.call(params)
-        end
+        expect(session.authenticate!.ntlm_response.length).to be > 16
       end
     end
   end
 
   describe '#calculate_user_session_key!' do
-    it 'returns an all zero key when it is anonymous' do
-      expect(session).to receive(:is_anonymous?).and_return(true)
-      expect(session.send(:calculate_user_session_key!)).to eq "\x00".b * 16
+    context 'when it is anonymous' do
+      let(:username) { '' }
+      let(:password) { '' }
+
+      it 'returns an all zero key' do
+        expect(session.send(:calculate_user_session_key!)).to eq "\x00".b * 16
+      end
     end
 
     it 'returns a session key' do
-      expect(session).to receive(:is_anonymous?).and_return(false)
-      expect(session.send(:calculate_user_session_key!)).to_not eq "\x00".b * 16
+      session_key = session.send(:calculate_user_session_key!)
+      expect(session_key.bytesize).to eq 16
+      expect(session_key).to_not eq "\x00".b * 16
     end
   end