rubyntlm 0.6.6 → 0.6.7

data/lib/net/ntlm.rb

@@ -1,4 +1,5 @@
-# encoding: UTF-8
+# frozen_string_literal: true
+
 #
 # = net/ntlm.rb
 #
@@ -61,21 +62,20 @@ require 'net/ntlm/message/type3'
 require 'net/ntlm/encode_util'
 require 'net/ntlm/md4'
 require 'net/ntlm/rc4'
+require 'net/ntlm/response'
 
 require 'net/ntlm/client'
 require 'net/ntlm/channel_binding'
 require 'net/ntlm/target_info'
 
 module Net
+  # Ruby/NTLM library: message creator and parser for NTLM authentication.
   module NTLM
-
     LM_MAGIC = "KGS!@\#$%"
-    TIME_OFFSET = 11644473600
+    TIME_OFFSET = 11_644_473_600
     MAX64 = 0xffffffffffffffff
 
-
     class << self
-
       # Valid format for LAN Manager hex digest portion: 32 hexadecimal characters.
       LAN_MANAGER_HEX_DIGEST_REGEXP = /[0-9a-f]{32}/i
       # Valid format for NT LAN Manager hex digest portion: 32 hexadecimal characters.
@@ -86,7 +86,7 @@ module Net
       # Takes a string and determines whether it is a valid NTLM Hash
       # @param [String] the string to validate
       # @return [Boolean] whether or not the string is a valid NTLM hash
-      def is_ntlm_hash?(data)
+      def ntlm_hash?(data)
         decoded_data = data.dup
         decoded_data = EncodeUtil.decode_utf16le(decoded_data)
         if DATA_REGEXP.match(decoded_data)
@@ -96,10 +96,12 @@ module Net
         end
       end
 
+      alias is_ntlm_hash? ntlm_hash?
+
       # Convert the value to a 64-bit little-endian integer
       # @param [String] val The string to convert
       def pack_int64le(val)
-        [val & 0x00000000ffffffff, val >> 32].pack("V2")
+        [val & 0x00000000ffffffff, val >> 32].pack('V2')
       end
 
       # Builds an array of strings that are 7 characters long
@@ -107,9 +109,7 @@ module Net
       # @api private
       def split7(str)
         s = str.dup
-        until s.empty?
-          (ret ||= []).push s.slice!(0, 7)
-        end
+        (ret ||= []).push s.slice!(0, 7) until s.empty?
         ret
       end
 
@@ -118,18 +118,18 @@ module Net
       # @param [String] str String to generate keys for
       # @api private
       def gen_keys(str)
-        split7(str).map{ |str7|
-          bits = split7(str7.unpack("B*")[0]).inject('')\
-            {|ret, tkn| ret += tkn + (tkn.gsub('1', '').size % 2).to_s }
-          [bits].pack("B*")
+        split7(str).map { |str7|
+          bits = split7(str7.unpack1('B*')).inject('')\
+            { |ret, tkn| ret + tkn + (tkn.gsub('1', '').size % 2).to_s }
+          [bits].pack('B*')
         }
       end
 
       def apply_des(plain, keys)
-        keys.map {|k|
+        keys.map { |k|
           # Spec requires des-cbc, but openssl 3 does not support single des
           # by default, so just do triple DES (EDE) with the same key
-          dec = OpenSSL::Cipher.new("des-ede-cbc").encrypt
+          dec = OpenSSL::Cipher.new('des-ede-cbc').encrypt
           dec.padding = 0
           dec.key = k + k
           dec.update(plain) + dec.final
@@ -148,9 +148,7 @@ module Net
       # @option opt :unicode (false) Unicode encode the password
       def ntlm_hash(password, opt = {})
         pwd = password.dup
-        unless opt[:unicode]
-          pwd = EncodeUtil.encode_utf16le(pwd)
-        end
+        pwd = EncodeUtil.encode_utf16le(pwd) unless opt[:unicode]
         Net::NTLM::Md4.digest pwd
       end
 
@@ -159,124 +157,38 @@ module Net
       # @param [String] password The password
       # @param [String] target The domain or workstation to authenticate to
       # @option [Boolean] opt :unicode (false) Unicode encode the domain.
-      def ntlmv2_hash(user, password, target, opt={})
-        if is_ntlm_hash? password
-          decoded_password = EncodeUtil.decode_utf16le(password)
-          ntlmhash = [decoded_password.upcase[33,65]].pack('H32')
-        else
-          ntlmhash = ntlm_hash(password, opt)
-        end
-
-        if opt[:unicode]
-          # Uppercase operation on username containing non-ASCI characters
-          # after behing unicode encoded with `EncodeUtil.encode_utf16le`
-          # doesn't play well. Upcase should be done before encoding.
-          user_upcase = EncodeUtil.decode_utf16le(user).upcase
-          user_upcase = EncodeUtil.encode_utf16le(user_upcase)
-        else
-          user_upcase = user.upcase
-        end
-        userdomain = user_upcase + target
-
-        unless opt[:unicode]
-          userdomain = EncodeUtil.encode_utf16le(userdomain)
-        end
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmhash, userdomain)
+      def ntlmv2_hash(user, password, target, opt = {})
+        ntlmhash = ntlmv2_key(password, opt)
+        userdomain = ntlmv2_userdomain(user, target, opt)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), ntlmhash, userdomain)
       end
 
-      def lm_response(arg)
-        begin
-          hash = arg[:lm_hash]
-          chal = arg[:challenge]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-        keys = gen_keys hash.ljust(21, "\0")
-        apply_des(chal, keys).join
-      end
-
-      def ntlm_response(arg)
-        hash = arg[:ntlm_hash]
-        chal = arg[:challenge]
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-        keys = gen_keys hash.ljust(21, "\0")
-        apply_des(chal, keys).join
-      end
+      private
 
-      def ntlmv2_response(arg, opt = {})
-        begin
-          key = arg[:ntlmv2_hash]
-          chal = arg[:challenge]
-          ti = arg[:target_info]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc  = opt[:client_challenge]
-        else
-          cc = rand(MAX64)
-        end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        if opt[:timestamp]
-          ts = opt[:timestamp]
+      def ntlmv2_key(password, opt)
+        if ntlm_hash? password
+          decoded = EncodeUtil.decode_utf16le(password)
+          [decoded.upcase[33, 65]].pack('H32')
         else
-          ts = Time.now.to_i
+          ntlm_hash(password, opt)
         end
-        # epoch -> milsec from Jan 1, 1601
-        ts = 10_000_000 * (ts + TIME_OFFSET)
-
-        blob = Blob.new
-        blob.timestamp = ts
-        blob.challenge = cc
-        blob.target_info = ti
-
-        bb = blob.serialize
-
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, chal + bb) + bb
       end
 
-      def lmv2_response(arg, opt = {})
-        key = arg[:ntlmv2_hash]
-        chal = arg[:challenge]
-
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc  = opt[:client_challenge]
-        else
-          cc = rand(MAX64)
-        end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, key, chal + cc) + cc
+      def ntlmv2_userdomain(user, target, opt)
+        userdomain = ntlmv2_upcase_user(user, opt) + target
+        opt[:unicode] ? userdomain : EncodeUtil.encode_utf16le(userdomain)
       end
 
-      def ntlm2_session(arg, opt = {})
-        begin
-          passwd_hash = arg[:ntlm_hash]
-          chal = arg[:challenge]
-        rescue
-          raise ArgumentError
-        end
-        chal = NTLM::pack_int64le(chal) if chal.is_a?(Integer)
-
-        if opt[:client_challenge]
-          cc = opt[:client_challenge]
+      def ntlmv2_upcase_user(user, opt)
+        if opt[:unicode]
+          # Uppercase operation on username containing non-ASCI characters
+          # after behing unicode encoded with `EncodeUtil.encode_utf16le`
+          # doesn't play well. Upcase should be done before encoding.
+          EncodeUtil.encode_utf16le(EncodeUtil.decode_utf16le(user).upcase)
         else
-          cc = rand(MAX64)
+          user.upcase
         end
-        cc = NTLM::pack_int64le(cc) if cc.is_a?(Integer)
-
-        keys = gen_keys(passwd_hash.ljust(21, "\0"))
-        session_hash = OpenSSL::Digest::MD5.digest(chal + cc).slice(0, 8)
-        response = apply_des(session_hash, keys).join
-        [cc.ljust(24, "\0"), response]
       end
     end
-
   end
 end

data/lib/rubyntlm.rb

@@ -1 +1,3 @@
-require 'net/ntlm'
+# frozen_string_literal: true
+
+require 'net/ntlm'

metadata

@@ -1,15 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubyntlm
 version: !ruby/object:Gem::Version
-  version: 0.6.6
+  version: 0.6.7
 platform: ruby
 authors:
 - Kohei Kajimoto
 - Paul Morton
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-09 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -33,24 +32,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".devcontainer/devcontainer.json"
-- ".github/dependabot.yml"
-- ".github/workflows/build.yml"
-- ".gitignore"
-- ".rspec"
 - CHANGELOG.md
-- Gemfile
 - LICENSE
 - README.md
-- Rakefile
-- examples/http.rb
-- examples/imap.rb
-- examples/smtp.rb
 - lib/net/ntlm.rb
 - lib/net/ntlm/blob.rb
 - lib/net/ntlm/channel_binding.rb
 - lib/net/ntlm/client.rb
 - lib/net/ntlm/client/session.rb
+- lib/net/ntlm/client/session_crypto.rb
 - lib/net/ntlm/encode_util.rb
 - lib/net/ntlm/exceptions.rb
 - lib/net/ntlm/field.rb
@@ -65,39 +55,12 @@ files:
 - lib/net/ntlm/message/type2.rb
 - lib/net/ntlm/message/type3.rb
 - lib/net/ntlm/rc4.rb
+- lib/net/ntlm/response.rb
 - lib/net/ntlm/security_buffer.rb
 - lib/net/ntlm/string.rb
 - lib/net/ntlm/target_info.rb
 - lib/net/ntlm/version.rb
 - lib/rubyntlm.rb
-- rubyntlm.gemspec
-- spec/lib/net/ntlm/blob_spec.rb
-- spec/lib/net/ntlm/channel_binding_spec.rb
-- spec/lib/net/ntlm/client/session_spec.rb
-- spec/lib/net/ntlm/client_spec.rb
-- spec/lib/net/ntlm/encode_util_spec.rb
-- spec/lib/net/ntlm/field_set_spec.rb
-- spec/lib/net/ntlm/field_spec.rb
-- spec/lib/net/ntlm/int16_le_spec.rb
-- spec/lib/net/ntlm/int32_le_spec.rb
-- spec/lib/net/ntlm/int64_le_spec.rb
-- spec/lib/net/ntlm/md4_spec.rb
-- spec/lib/net/ntlm/message/type0_spec.rb
-- spec/lib/net/ntlm/message/type1_spec.rb
-- spec/lib/net/ntlm/message/type2_spec.rb
-- spec/lib/net/ntlm/message/type3_spec.rb
-- spec/lib/net/ntlm/message_spec.rb
-- spec/lib/net/ntlm/security_buffer_spec.rb
-- spec/lib/net/ntlm/string_spec.rb
-- spec/lib/net/ntlm/target_info_spec.rb
-- spec/lib/net/ntlm/version_spec.rb
-- spec/lib/net/ntlm_spec.rb
-- spec/spec_helper.rb
-- spec/support/certificates/sha_256_hash.pem
-- spec/support/shared/examples/net/ntlm/field_shared.rb
-- spec/support/shared/examples/net/ntlm/fieldset_shared.rb
-- spec/support/shared/examples/net/ntlm/int_shared.rb
-- spec/support/shared/examples/net/ntlm/message_shared.rb
 homepage: https://github.com/winrb/rubyntlm
 licenses:
 - MIT
@@ -106,7 +69,6 @@ metadata:
   source_code_uri: https://github.com/winrb/rubyntlm
   changelog_uri: https://github.com/winrb/rubyntlm/blob/master/CHANGELOG.md
   bug_tracker_uri: https://github.com/winrb/rubyntlm/issues
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -121,8 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.19
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby/NTLM library.
 test_files: []

data/.devcontainer/devcontainer.json

@@ -1,22 +0,0 @@
-// For format details, see https://aka.ms/devcontainer.json. For config options, see the
-// README at: https://github.com/devcontainers/templates/tree/main/src/ruby
-{
-	"name": "Ruby",
-	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/ruby:1-3.3-bullseye"
-
-	// Features to add to the dev container. More info: https://containers.dev/features.
-	// "features": {},
-
-	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// "forwardPorts": [],
-
-	// Use 'postCreateCommand' to run commands after the container is created.
-	// "postCreateCommand": "ruby --version",
-
-	// Configure tool-specific properties.
-	// "customizations": {},
-
-	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-	// "remoteUser": "root"
-}

data/.github/dependabot.yml

@@ -1,10 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "devcontainers"
-    directory: "/"
-    schedule:
-      interval: weekly

data/.github/workflows/build.yml

@@ -1,55 +0,0 @@
----
-name: build
-
-"on":
-  pull_request:
-  push:
-    branches:
-      - master
-
-# The job only ever reads the checkout; deny everything else by default.
-permissions:
-  contents: read
-
-# A new push to a PR makes the in-flight run redundant. Never cancel master,
-# because those runs are what the README badge reports.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  unit:
-    name: ${{ matrix.os }} / ruby ${{ matrix.ruby }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
-    # Nightly builds break for reasons that are not this gem's fault, so they
-    # report without failing the run.
-    continue-on-error: ${{ matrix.experimental || false }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-        ruby: ['3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
-        include:
-          - os: ubuntu-latest
-            ruby: 'head'
-            experimental: true
-          - os: windows-latest
-            ruby: 'head'
-            experimental: true
-          # truffleruby has no Windows build via setup-ruby.
-          - os: ubuntu-latest
-            ruby: 'truffleruby'
-          - os: ubuntu-latest
-            ruby: 'truffleruby-head'
-            experimental: true
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby }}
-          bundler-cache: true
-
-      - name: Run specs
-        run: bundle exec rake spec

data/.gitignore

@@ -1,11 +0,0 @@
-.bundle
-.yardoc
-/doc
-Gemfile.lock
-pkg
-
-# Generated by SimpleCov (`rake coverage`)
-/coverage
-
-# RSpec's example status cache, used by `rspec --only-failures`
-/spec/examples.txt

data/.rspec

@@ -1,3 +0,0 @@
---require spec_helper
---format documentation
---color

data/Gemfile

@@ -1,20 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec
-
-# Development dependencies live here rather than in the gemspec so that they
-# can be grouped, and so that consumers of the gem never resolve them.
-group :development, :test do
-  gem 'pry'
-  gem 'rake'
-  gem 'rspec', '~> 3.13'
-  gem 'simplecov', require: false
-end
-
-# Release tooling only. Marked optional so it is not installed by default:
-# github_changelog_generator drags in a large, slow-moving dependency tree that
-# does not resolve on every Ruby we test against. Opt in when cutting a release
-# with `bundle install --with changelog`.
-group :changelog, optional: true do
-  gem 'github_changelog_generator'
-end

data/Rakefile

@@ -1,37 +0,0 @@
-require "bundler/gem_tasks"
-
-require 'rspec/core/rake_task'
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec
-
-desc "Generate code coverage"
-task :coverage do
-  ENV['COVERAGE'] = 'true'
-  Rake::Task["spec"].execute
-end
-
-desc "Open a Pry console for this library"
-task :console do
-  require 'pry'
-  require 'net/ntlm'
-  ARGV.clear
-  Pry.start
-end
-
-# Release tooling only, and deliberately optional: the :changelog bundle group
-# is not installed by default, so this must never break `rake` or `rake spec`.
-# Run `bundle install --with changelog` to enable it.
-begin
-  require 'github_changelog_generator/task'
-
-  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
-    config.future_release = Net::NTLM::VERSION::STRING
-  end
-rescue LoadError
-  desc "Generate CHANGELOG.md (requires: bundle install --with changelog)"
-  task :changelog do
-    abort "github_changelog_generator is not installed. " \
-          "Run `bundle install --with changelog` first."
-  end
-end

data/examples/http.rb

@@ -1,86 +0,0 @@
-# $Id: http.rb,v 1.2 2006/10/05 01:36:52 koheik Exp $
-require 'socket'
-$:.unshift(File.dirname(__FILE__) + '/../lib')
-require 'net/ntlm'
-
-$user = nil
-$passwd = nil
-
-$host = "www"
-$port = 80
-
-def header(f, host)
-	f.print "GET / HTTP/1.1\r\n"
-	f.print "Host: #{host}\r\n"
-	f.print "Keep-Alive: 300\r\n"
-	f.print "Connection: keep-alive\r\n"
-end
-
-def main
-
-	s = TCPSocket.new($host, $port)
-
-	# client -> server
-	t1 = Net::NTLM::Message::Type1.new()
-	header(s, $host)
-	s.print "Authorization: NTLM " + t1.encode64 + "\r\n"
-	s.print "\r\n"
-
-	# server -> client
-	length = 0
-	while(line = s.gets)
-		
-		if /^WWW-Authenticate: (NTLM|Negotiate) (.+)\r\n/ =~ line
-			msg = $2
-		end
-		
-		if /^Content-Length: (\d+)\r\n/ =~ line
-			length = $1.to_i
-		end
-		if /^\r\n/ =~ line
-			if length > 0
-				cont = s.read(length)
-			end
-			break
-		end
-	end
-	t2 = Net::NTLM::Message.decode64(msg)
-	
-	unless $user and $passwd
-		target = t2.target_name
-		target = Net::NTLM::EncodeUtil.decode_utf16le(target) if t2.has_flag?(:UNICODE)
-		puts "Target: #{target}"
-		print "User name: "
-		($user = $stdin.readline).chomp!
-		print "Password: "
-		($passwd = $stdin.readline).chomp!
-	end
-	
-	# client -> server, again
-	t3 = t2.response({:user => $user, :password => $passwd}, {:ntlmv2 => true})
-	header(s, $host)
-	s.print "Authorization: NTLM " + t3.encode64 + "\r\n"
-	s.print "\r\n"
-	
-	# server -> client
-	length = 0
-	while(line = s.gets)
-		
-		if /^WWW-Authenticate: (NTLM|Negotiate) (.+)\r\n/ =~ line
-			msg = $2
-		end
-		
-		if /^Content-Length: (\d+)\r\n/ =~ line
-			length = $1.to_i
-		end
-		if /^\r\n/ =~ line
-			if length > 0
-				p cont = s.read(length)
-			end
-			break
-		end
-	end
-	s.close
-end
-
-main

data/examples/imap.rb

@@ -1,73 +0,0 @@
-# $Id: imap.rb,v 1.1 2006/10/05 01:36:52 koheik Exp $
-
-require "net/imap"
-$:.unshift(File.dirname(__FILE__) + '/../lib')
-require "net/ntlm"
-
-Net::IMAP::debug = true
-
-$host = "localhost"
-$port = 143
-$ssl = false
-$user = nil
-$passwd = nil
-
-module Net
-  class IMAP
-    class NtlmAuthenticator
-      def process(data)
-        case @state
-        when 1
-          @state = 2
-          t1 = Net::NTLM::Message::Type1.new()
-          return t1.serialize
-        when 2
-          @state = 3
-          t2 = Net::NTLM::Message.parse(data)
-          t3 = t2.response({:user => @user, :password => @password}, {:ntlmv2 => (@ntlm_type == "ntlmv2")})
-          return t3.serialize
-        end
-      end
-
-      private
-
-      def initialize(user, password, ntlm_type = "ntlmv2")
-        @user = user
-        @password = password
-        @ntlm_type = @ntlm_type
-        @state = 1
-      end
-    end
-    add_authenticator "NTLM", NtlmAuthenticator
-
-    class ResponseParser
-      def continue_req
-        match(T_PLUS)
-        if lookahead.symbol == T_CRLF # means empty message
-          return ContinuationRequest.new(ResponseText.new(nil, ""), @str)
-        end
-        match(T_SPACE)
-        return ContinuationRequest.new(resp_text, @str)
-      end
-    end
-  end
-end
-
-unless $user and $passwd
-  print "User name: "
-  ($user = $stdin.readline).chomp!
-  print "Password: "
-  ($passwd = $stdin.readline).chomp!
-end
-
-imap = Net::IMAP.new($host, $port, $ssl)
-imap.authenticate("NTLM", $user, $passwd)
-imap.examine("Inbox")
-# imap.search(["RECENT"]).each do |message_id|
-# envelope = imap.fetch(message_id, "ENVELOPE")[0].attr["ENVELOPE"]
-# from = envelope.from.nil? ? "" : envelope.from[0].name
-# subject = envelope.subject
-# puts "#{message_id} #{from}: \t#{subject}"
-# end
-imap.logout
-# imap.disconnect