rubyntlm 0.6.5 → 0.6.7

data/lib/net/ntlm.rb

@@ -1,4 +1,5 @@
-# encoding: UTF-8
+# frozen_string_literal: true
+
 #
 # = net/ntlm.rb
 #
@@ -61,21 +62,20 @@ require 'net/ntlm/message/type3'
 require 'net/ntlm/encode_util'
 require 'net/ntlm/md4'
 require 'net/ntlm/rc4'
+require 'net/ntlm/response'
 
 require 'net/ntlm/client'
 require 'net/ntlm/channel_binding'
 require 'net/ntlm/target_info'
 
 module Net
+  # Ruby/NTLM library: message creator and parser for NTLM authentication.
   module NTLM
-
     LM_MAGIC = "KGS!@\#$%"
-    TIME_OFFSET = 11644473600
+    TIME_OFFSET = 11_644_473_600
     MAX64 = 0xffffffffffffffff
 
-
     class << self
-
       # Valid format for LAN Manager hex digest portion: 32 hexadecimal characters.
       LAN_MANAGER_HEX_DIGEST_REGEXP = /[0-9a-f]{32}/i
       # Valid format for NT LAN Manager hex digest portion: 32 hexadecimal characters.
@@ -86,7 +86,7 @@ module Net
       # Takes a string and determines whether it is a valid NTLM Hash
       # @param [String] the string to validate
       # @return [Boolean] whether or not the string is a valid NTLM hash
-      def is_ntlm_hash?(data)
+      def ntlm_hash?(data)
         decoded_data = data.dup
         decoded_data = EncodeUtil.decode_utf16le(decoded_data)
         if DATA_REGEXP.match(decoded_data)
@@ -96,10 +96,12 @@ module Net
         end
       end
 
+      alias is_ntlm_hash? ntlm_hash?
+
       # Convert the value to a 64-bit little-endian integer
       # @param [String] val The string to convert
       def pack_int64le(val)
-        [val & 0x00000000ffffffff, val >> 32].pack("V2")
+        [val & 0x00000000ffffffff, val >> 32].pack('V2')
       end
 
       # Builds an array of strings that are 7 characters long
@@ -107,9 +109,7 @@ module Net
       # @api private
       def split7(str)
         s = str.dup
-        until s.empty?
-          (ret ||= []).push s.slice!(0, 7)
-        end
+        (ret ||= []).push s.slice!(0, 7) until s.empty?
         ret
       end
 
@@ -118,18 +118,18 @@ module Net
       # @param [String] str String to generate keys for
       # @api private
       def gen_keys(str)
-        split7(str).map{ |str7|
-          bits = split7(str7.unpack("B*")[0]).inject('')\
-            {|ret, tkn| ret += tkn + (tkn.gsub('1', '').size % 2).to_s }
-          [bits].pack("B*")
+        split7(str).map { |str7|
+          bits = split7(str7.unpack1('B*')).inject('')\
+            { |ret, tkn| ret + tkn + (tkn.gsub('1', '').size % 2).to_s }
+          [bits].pack('B*')
         }
       end
 
       def apply_des(plain, keys)
-        keys.map {|k|
+        keys.map { |k|
           # Spec requires des-cbc, but openssl 3 does not support single des
           # by default, so just do triple DES (EDE) with the same key
-          dec = OpenSSL::Cipher.new("des-ede-cbc").encrypt
+          dec = OpenSSL::Cipher.new('des-ede-cbc').encrypt
           dec.padding = 0
           dec.key = k + k
           dec.update(plain) + dec.final
@@ -148,9 +148,7 @@ module Net
       # @option opt :unicode (false) Unicode encode the password
       def ntlm_hash(password, opt = {})
         pwd = password.dup
-        unless opt[:unicode]
-          pwd = EncodeUtil.encode_utf16le(pwd)
-        end
+        pwd = EncodeUtil.encode_utf16le(pwd) unless opt[:unicode]
         Net::NTLM::Md4.digest pwd
       end
 
@@ -159,124 +157,38 @@ module Net
       # @param [String] password The password
       # @param [String] target The domain or workstation to authenticate to
       # @option [Boolean] opt :unicode (false) Unicode encode the domain.
-      def ntlmv2_hash(user, password, target, opt={})
-        if is_ntlm_hash? password
-          decoded_password = EncodeUtil.decode_utf16le(password)
-          ntlmhash = [decoded_password.upcase[33,65]].pack('H32')
-        else
-          ntlmhash = ntlm_hash(password, opt)
-        end
-
-        if opt[:unicode]
-          # Uppercase operation on username containing non-ASCI characters
-          # after behing unicode encoded with `EncodeUtil.encode_utf16le`
-          # doesn't play well. Upcase should be done before encoding.
-          user_upcase = EncodeUtil.decode_utf16le(user).upcase
-          user_upcase = EncodeUtil.encode_utf16le(user_upcase)
-        else
-          user_upcase = user.upcase
-        end
-        userdomain = user_upcase + target
-
-        unless opt[:unicode]
-          userdomain = EncodeUtil.encode_utf16le(userdomain)
-        end
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmhash, userdomain)
+      def ntlmv2_hash(user, password, target, opt = {})
+        ntlmhash = ntlmv2_key(password, opt)
+        userdomain = ntlmv2_userdomain(user, target, opt)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), ntlmhash, userdomain)
       end
 
-      def lm_response(arg)
-        begin
-          hash = arg[:lm_hash]
-          chal = arg[:challenge]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-        keys = gen_keys hash.ljust(21, "\0")
-        apply_des(chal, keys).join
-      end
-
-      def ntlm_response(arg)
-        hash = arg[:ntlm_hash]
-        chal = arg[:challenge]
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-        keys = gen_keys hash.ljust(21, "\0")
-        apply_des(chal, keys).join
-      end
+      private
 
-      def ntlmv2_response(arg, opt = {})
-        begin
-          key = arg[:ntlmv2_hash]
-          chal = arg[:challenge]
-          ti = arg[:target_info]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc  = opt[:client_challenge]
-        else
-          cc = rand(MAX64)
-        end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        if opt[:timestamp]
-          ts = opt[:timestamp]
+      def ntlmv2_key(password, opt)
+        if ntlm_hash? password
+          decoded = EncodeUtil.decode_utf16le(password)
+          [decoded.upcase[33, 65]].pack('H32')
         else
-          ts = Time.now.to_i
+          ntlm_hash(password, opt)
         end
-        # epoch -> milsec from Jan 1, 1601
-        ts = 10_000_000 * (ts + TIME_OFFSET)
-
-        blob = Blob.new
-        blob.timestamp = ts
-        blob.challenge = cc
-        blob.target_info = ti
-
-        bb = blob.serialize
-
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, chal + bb) + bb
       end
 
-      def lmv2_response(arg, opt = {})
-        key = arg[:ntlmv2_hash]
-        chal = arg[:challenge]
-
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc  = opt[:client_challenge]
-        else
-          cc = rand(MAX64)
-        end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, chal + cc) + cc
+      def ntlmv2_userdomain(user, target, opt)
+        userdomain = ntlmv2_upcase_user(user, opt) + target
+        opt[:unicode] ? userdomain : EncodeUtil.encode_utf16le(userdomain)
       end
 
-      def ntlm2_session(arg, opt = {})
-        begin
-          passwd_hash = arg[:ntlm_hash]
-          chal = arg[:challenge]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc = opt[:client_challenge]
+      def ntlmv2_upcase_user(user, opt)
+        if opt[:unicode]
+          # Uppercase operation on username containing non-ASCI characters
+          # after behing unicode encoded with `EncodeUtil.encode_utf16le`
+          # doesn't play well. Upcase should be done before encoding.
+          EncodeUtil.encode_utf16le(EncodeUtil.decode_utf16le(user).upcase)
         else
-          cc = rand(MAX64)
+          user.upcase
         end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        keys = gen_keys(passwd_hash.ljust(21, "\0"))
-        session_hash = OpenSSL::Digest::MD5.digest(chal + cc).slice(0, 8)
-        response = apply_des(session_hash, keys).join
-        [cc.ljust(24, "\0"), response]
       end
     end
-
   end
 end

data/lib/rubyntlm.rb

@@ -1 +1,3 @@
-require 'net/ntlm'
+# frozen_string_literal: true
+
+require 'net/ntlm'

metadata

@@ -1,86 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: rubyntlm
 version: !ruby/object:Gem::Version
-  version: 0.6.5
+  version: 0.6.7
 platform: ruby
 authors:
 - Kohei Kajimoto
 - Paul Morton
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-06-12 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: github_changelog_generator
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 1.14.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 1.14.3
-- !ruby/object:Gem::Dependency
-  name: pry
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.11'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '2.11'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -103,24 +32,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".devcontainer/devcontainer.json"
-- ".github/dependabot.yml"
-- ".github/workflows/build.yml"
-- ".gitignore"
-- ".rspec"
 - CHANGELOG.md
-- Gemfile
 - LICENSE
 - README.md
-- Rakefile
-- examples/http.rb
-- examples/imap.rb
-- examples/smtp.rb
 - lib/net/ntlm.rb
 - lib/net/ntlm/blob.rb
 - lib/net/ntlm/channel_binding.rb
 - lib/net/ntlm/client.rb
 - lib/net/ntlm/client/session.rb
+- lib/net/ntlm/client/session_crypto.rb
 - lib/net/ntlm/encode_util.rb
 - lib/net/ntlm/exceptions.rb
 - lib/net/ntlm/field.rb
@@ -135,44 +55,20 @@ files:
 - lib/net/ntlm/message/type2.rb
 - lib/net/ntlm/message/type3.rb
 - lib/net/ntlm/rc4.rb
+- lib/net/ntlm/response.rb
 - lib/net/ntlm/security_buffer.rb
 - lib/net/ntlm/string.rb
 - lib/net/ntlm/target_info.rb
 - lib/net/ntlm/version.rb
 - lib/rubyntlm.rb
-- rubyntlm.gemspec
-- spec/lib/net/ntlm/blob_spec.rb
-- spec/lib/net/ntlm/channel_binding_spec.rb
-- spec/lib/net/ntlm/client/session_spec.rb
-- spec/lib/net/ntlm/client_spec.rb
-- spec/lib/net/ntlm/encode_util_spec.rb
-- spec/lib/net/ntlm/field_set_spec.rb
-- spec/lib/net/ntlm/field_spec.rb
-- spec/lib/net/ntlm/int16_le_spec.rb
-- spec/lib/net/ntlm/int32_le_spec.rb
-- spec/lib/net/ntlm/int64_le_spec.rb
-- spec/lib/net/ntlm/message/type0_spec.rb
-- spec/lib/net/ntlm/message/type1_spec.rb
-- spec/lib/net/ntlm/message/type2_spec.rb
-- spec/lib/net/ntlm/message/type3_spec.rb
-- spec/lib/net/ntlm/message_spec.rb
-- spec/lib/net/ntlm/security_buffer_spec.rb
-- spec/lib/net/ntlm/string_spec.rb
-- spec/lib/net/ntlm/target_info_spec.rb
-- spec/lib/net/ntlm/version_spec.rb
-- spec/lib/net/ntlm_spec.rb
-- spec/spec_helper.rb
-- spec/support/certificates/sha_256_hash.pem
-- spec/support/shared/examples/net/ntlm/field_shared.rb
-- spec/support/shared/examples/net/ntlm/fieldset_shared.rb
-- spec/support/shared/examples/net/ntlm/int_shared.rb
-- spec/support/shared/examples/net/ntlm/message_shared.rb
 homepage: https://github.com/winrb/rubyntlm
 licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
+  source_code_uri: https://github.com/winrb/rubyntlm
+  changelog_uri: https://github.com/winrb/rubyntlm/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/winrb/rubyntlm/issues
 rdoc_options: []
 require_paths:
 - lib
@@ -180,41 +76,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby/NTLM library.
-test_files:
-- spec/lib/net/ntlm/blob_spec.rb
-- spec/lib/net/ntlm/channel_binding_spec.rb
-- spec/lib/net/ntlm/client/session_spec.rb
-- spec/lib/net/ntlm/client_spec.rb
-- spec/lib/net/ntlm/encode_util_spec.rb
-- spec/lib/net/ntlm/field_set_spec.rb
-- spec/lib/net/ntlm/field_spec.rb
-- spec/lib/net/ntlm/int16_le_spec.rb
-- spec/lib/net/ntlm/int32_le_spec.rb
-- spec/lib/net/ntlm/int64_le_spec.rb
-- spec/lib/net/ntlm/message/type0_spec.rb
-- spec/lib/net/ntlm/message/type1_spec.rb
-- spec/lib/net/ntlm/message/type2_spec.rb
-- spec/lib/net/ntlm/message/type3_spec.rb
-- spec/lib/net/ntlm/message_spec.rb
-- spec/lib/net/ntlm/security_buffer_spec.rb
-- spec/lib/net/ntlm/string_spec.rb
-- spec/lib/net/ntlm/target_info_spec.rb
-- spec/lib/net/ntlm/version_spec.rb
-- spec/lib/net/ntlm_spec.rb
-- spec/spec_helper.rb
-- spec/support/certificates/sha_256_hash.pem
-- spec/support/shared/examples/net/ntlm/field_shared.rb
-- spec/support/shared/examples/net/ntlm/fieldset_shared.rb
-- spec/support/shared/examples/net/ntlm/int_shared.rb
-- spec/support/shared/examples/net/ntlm/message_shared.rb
+test_files: []

data/.devcontainer/devcontainer.json

@@ -1,22 +0,0 @@
-// For format details, see https://aka.ms/devcontainer.json. For config options, see the
-// README at: https://github.com/devcontainers/templates/tree/main/src/ruby
-{
-	"name": "Ruby",
-	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/ruby:1-3.3-bullseye"
-
-	// Features to add to the dev container. More info: https://containers.dev/features.
-	// "features": {},
-
-	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// "forwardPorts": [],
-
-	// Use 'postCreateCommand' to run commands after the container is created.
-	// "postCreateCommand": "ruby --version",
-
-	// Configure tool-specific properties.
-	// "customizations": {},
-
-	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-	// "remoteUser": "root"
-}

data/.github/dependabot.yml

@@ -1,10 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "devcontainers"
-    directory: "/"
-    schedule:
-      interval: weekly

data/.github/workflows/build.yml

@@ -1,24 +0,0 @@
----
-name: build
-
-"on":
-  pull_request:
-  push:
-    branches:
-      - master
-
-jobs:
-  unit:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-2019]
-        ruby: ['2.6', '2.7', '3.0', '3.1', '3.2', '3.3']
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby }}
-        bundler-cache: true
-    - run: bundle exec rake

data/.gitignore

@@ -1,5 +0,0 @@
-.bundle
-.yardoc
-/doc
-Gemfile.lock
-pkg

data/.rspec

@@ -1,2 +0,0 @@
---format documentation
---color

data/Gemfile

@@ -1,3 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec

data/Rakefile

@@ -1,25 +0,0 @@
-require "bundler/gem_tasks"
-require 'github_changelog_generator/task'
-
-require 'rspec/core/rake_task'
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec
-
-desc "Generate code coverage"
-task :coverage do
-  ENV['COVERAGE'] = 'true'
-  Rake::Task["spec"].execute
-end
-
-desc "Open a Pry console for this library"
-task :console do
-  require 'pry'
-  require 'net/ntlm'
-  ARGV.clear
-  Pry.start
-end
-
-GitHubChangelogGenerator::RakeTask.new :changelog do |config|
-  config.future_release = Net::NTLM::VERSION::STRING
-end

data/examples/http.rb

@@ -1,86 +0,0 @@
-# $Id: http.rb,v 1.2 2006/10/05 01:36:52 koheik Exp $
-require 'socket'
-$:.unshift(File.dirname(__FILE__) + '/../lib')
-require 'net/ntlm'
-
-$user = nil
-$passwd = nil
-
-$host = "www"
-$port = 80
-
-def header(f, host)
-	f.print "GET / HTTP/1.1\r\n"
-	f.print "Host: #{host}\r\n"
-	f.print "Keep-Alive: 300\r\n"
-	f.print "Connection: keep-alive\r\n"
-end
-
-def main
-
-	s = TCPSocket.new($host, $port)
-
-	# client -> server
-	t1 = Net::NTLM::Message::Type1.new()
-	header(s, $host)
-	s.print "Authorization: NTLM " + t1.encode64 + "\r\n"
-	s.print "\r\n"
-
-	# server -> client
-	length = 0
-	while(line = s.gets)
-		
-		if /^WWW-Authenticate: (NTLM|Negotiate) (.+)\r\n/ =~ line
-			msg = $2
-		end
-		
-		if /^Content-Length: (\d+)\r\n/ =~ line
-			length = $1.to_i
-		end
-		if /^\r\n/ =~ line
-			if length > 0
-				cont = s.read(length)
-			end
-			break
-		end
-	end
-	t2 = Net::NTLM::Message.decode64(msg)
-	
-	unless $user and $passwd
-		target = t2.target_name
-		target = Net::NTLM::EncodeUtil.decode_utf16le(target) if t2.has_flag?(:UNICODE)
-		puts "Target: #{target}"
-		print "User name: "
-		($user = $stdin.readline).chomp!
-		print "Password: "
-		($passwd = $stdin.readline).chomp!
-	end
-	
-	# client -> server, again
-	t3 = t2.response({:user => $user, :password => $passwd}, {:ntlmv2 => true})
-	header(s, $host)
-	s.print "Authorization: NTLM " + t3.encode64 + "\r\n"
-	s.print "\r\n"
-	
-	# server -> client
-	length = 0
-	while(line = s.gets)
-		
-		if /^WWW-Authenticate: (NTLM|Negotiate) (.+)\r\n/ =~ line
-			msg = $2
-		end
-		
-		if /^Content-Length: (\d+)\r\n/ =~ line
-			length = $1.to_i
-		end
-		if /^\r\n/ =~ line
-			if length > 0
-				p cont = s.read(length)
-			end
-			break
-		end
-	end
-	s.close
-end
-
-main