rubyntlm 0.6.6 → 0.6.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f618c1c4edae0dd1fc9e9a20d690f3b56d7280ba4e07dc097bfe86e8720ab043
-  data.tar.gz: 8b1516a2ae5919c22fd2788fbdb1c3cb78492826a629536fcb597afa6d2ecd69
+  metadata.gz: b4756f78ef7cc152c4b05490fed4854c0650f85ac0bacab33ed4fdc7b888f35f
+  data.tar.gz: be12c6a59dae4bb73fe783fd2590e3486af5e682b14ba4f7cd1fed58945f2ae4
 SHA512:
-  metadata.gz: 0c5a6e37d4945d1abef840ceaf4b78b9149aba4c3cfc05f9b3bbeaa8b0e488b87c551d9652e0e9bda69983b788430cde3e8b968978dae0046f5d5f1dbf99cee2
-  data.tar.gz: a8a0fa4b29d5fa6b9d39bbaf6c3e1a9c342eb2c16e6cd43d969be33dac159c4b19babab2210810b4d14e1a1a0a2c62308cc04b05d6d6b84fe70dc232f5410ade
+  metadata.gz: 1a14372acf83aeef63f0656757ae5c7ce7f263c1a4c17b9d8b83a2dcb3bcb1296d898075d5c69968e572cb71847d1d9bf4d8e0a7c077c55273192d17a7a27e2b
+  data.tar.gz: 9bdfccee2d76d806b93306600f94d5a6e4304568a47c186f11b6e81360f33f07d9c59508538264131673ea6fd538f97f11746c934a201fe0923a5dd464e69ec4

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## 0.6.8 (2026-09-14)
+
+* Fix `NameError` on sign, seal, unseal, and verify: the 0.6.7 refactor moved the crypto methods into `SessionCrypto` but left their constants behind in `Session`, breaking message protection for encrypted winrm sessions ([#81](https://github.com/WinRb/rubyntlm/issues/81), [#80](https://github.com/WinRb/rubyntlm/pull/80))
+## 0.6.7 (2026-09-14)
+
+* Fix gem packaging: 0.6.6 shipped every file with mode 0660 (no world-read), so `require` failed for non-owner users. 0.6.7 is identical code, repackaged with the standard 0644 modes ([#77](https://github.com/WinRb/rubyntlm/issues/77))
+
 ## 0.6.6 (2026-09-09)
 
 * Security: fix NTLMv2 authentication bypass in `Type3#password?`, which verified NTLMv2 responses against an empty password instead of the supplied one

data/README.md

@@ -1,48 +1,48 @@
-# Ruby/NTLM -- NTLM Authentication Library for Ruby
-
-[![build status](https://github.com/WinRb/rubyntlm/actions/workflows/build.yml/badge.svg?branch=master&event=push)](https://github.com/WinRb/rubyntlm/actions/workflows/build.yml?query=branch%3Amaster+event%3Apush)
-
-Ruby/NTLM provides message creator and parser for the NTLM authentication. 
-
-__100% Ruby__
-
-How to install
---------------
-
-```ruby
-require 'rubyntlm'
-```
-
-Simple Example
---------------
-
-### Creating NTLM Type 1 message
-
-```ruby
-   t1 = Net::NTLM::Message::Type1.new()
-```
-
-### Parsing NTLM Type 2 message from server
-
-```ruby
-   t2 = Net::NTLM::Message.parse(message_from_server)
-```
-
-### Creating NTLM Type 3 message
-
-```ruby
-   t3 = t2.response({:user => 'user', :password => 'passwd'})
-```
-
-Support
--------
-
-https://groups.google.com/forum/?fromgroups#!forum/rubyntlm
-
-Contributing
-------------
-1. Fork it.
-2. Create a branch (git checkout -b my_feature_branch)
-3. Commit your changes (git commit -am "Added a sweet feature")
-4. Push to the branch (git push origin my_feature_branch)
-5. Create a pull requst from your branch into master (Please be sure to provide enough detail for us to cipher what this change is doing)
+# Ruby/NTLM -- NTLM Authentication Library for Ruby
+
+[![build status](https://github.com/WinRb/rubyntlm/actions/workflows/build.yml/badge.svg)](https://github.com/WinRb/rubyntlm/actions/workflows/build.yml)
+
+Ruby/NTLM provides message creator and parser for the NTLM authentication. 
+
+__100% Ruby__
+
+How to install
+--------------
+
+```ruby
+require 'rubyntlm'
+```
+
+Simple Example
+--------------
+
+### Creating NTLM Type 1 message
+
+```ruby
+   t1 = Net::NTLM::Message::Type1.new()
+```
+
+### Parsing NTLM Type 2 message from server
+
+```ruby
+   t2 = Net::NTLM::Message.parse(message_from_server)
+```
+
+### Creating NTLM Type 3 message
+
+```ruby
+   t3 = t2.response({:user => 'user', :password => 'passwd'})
+```
+
+Support
+-------
+
+https://groups.google.com/forum/?fromgroups#!forum/rubyntlm
+
+Contributing
+------------
+1. Fork it.
+2. Create a branch (git checkout -b my_feature_branch)
+3. Commit your changes (git commit -am "Added a sweet feature")
+4. Push to the branch (git push origin my_feature_branch)
+5. Create a pull request from your branch into main (Please be sure to provide enough detail for us to cipher what this change is doing)

data/lib/net/ntlm/blob.rb

@@ -1,18 +1,20 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
-
     BLOB_SIGN = 0x00000101
 
+    # NTLMv2 client challenge blob structure.
     class Blob < FieldSet
-      int32LE    :blob_signature, {:value => BLOB_SIGN}
-      int32LE    :reserved,       {:value => 0}
-      int64LE    :timestamp,      {:value => 0}
-      string     :challenge,      {:value => "", :size => 8}
-      int32LE    :unknown1,       {:value => 0}
-      string     :target_info,    {:value => "", :size => 0}
-      int32LE    :unknown2,       {:value => 0}
+      int32_le :blob_signature, { value: BLOB_SIGN }
+      int32_le :reserved, { value: 0 }
+      int64_le :timestamp, { value: 0 }
+      string :challenge, { value: '', size: 8 }
+      int32_le :unknown1, { value: 0 }
+      string :target_info, { value: '', size: 0 }
+      int32_le :unknown2, { value: 0 }
 
-      def parse(str, offset=0)
+      def parse(str, offset = 0)
         # 28 is the length of all fields before the variable-length
         # target_info field.
         if str.size > 28
@@ -23,6 +25,5 @@ module Net
         super
       end
     end
-
   end
 end

data/lib/net/ntlm/channel_binding.rb

@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
+    # Channel binding data used for the MsvAvChannelBindings AV_PAIR.
     class ChannelBinding
-
       # Creates a ChannelBinding used for Extended Protection Authentication
       # @see http://blogs.msdn.com/b/openspecification/archive/2013/03/26/ntlm-and-channel-binding-hash-aka-exteneded-protection-for-authentication.aspx
       #
@@ -24,9 +26,8 @@ module Net
         @acceptor_address_length = 0
       end
 
-      attr_reader :channel, :unique_prefix, :initiator_addtype
-      attr_reader :initiator_address_length, :acceptor_addrtype
-      attr_reader :acceptor_address_length
+      attr_reader :channel, :unique_prefix, :initiator_addtype, :initiator_address_length, :acceptor_addrtype,
+                  :acceptor_address_length
 
       # Returns a channel binding hash acceptable for use as a AV_PAIR MsvAvChannelBindings
       #   field value as specified in the NTLM protocol
@@ -38,10 +39,7 @@ module Net
 
       def gss_channel_bindings_struct
         @gss_channel_bindings_struct ||= begin
-          token = [initiator_addtype].pack('I')
-          token << [initiator_address_length].pack('I')
-          token << [acceptor_addrtype].pack('I')
-          token << [acceptor_address_length].pack('I')
+          token = pack_address_header
           token << [application_data.length].pack('I')
           token << application_data
           token
@@ -54,12 +52,18 @@ module Net
 
       def application_data
         @application_data ||= begin
-          data = unique_prefix
+          data = +unique_prefix
           data << ':'
           data << channel_hash.digest
           data
         end
       end
+
+      private
+
+      def pack_address_header
+        [initiator_addtype, initiator_address_length, acceptor_addrtype, acceptor_address_length].pack('I4')
+      end
     end
   end
 end

data/lib/net/ntlm/client/session.rb

@@ -1,14 +1,16 @@
+# frozen_string_literal: true
+
+require 'net/ntlm/client/session_crypto'
+
 module Net
   module NTLM
+    # An authenticated NTLM session: message signing, sealing and key exchange.
     class Client::Session
+      include Client::SessionCrypto
 
       VERSION_MAGIC = "\x01\x00\x00\x00"
-      TIME_OFFSET   = 11644473600
+      TIME_OFFSET   = 11_644_473_600
       MAX64         = 0xffffffffffffffff
-      CLIENT_TO_SERVER_SIGNING = "session key to client-to-server signing key magic constant\0"
-      SERVER_TO_CLIENT_SIGNING = "session key to server-to-client signing key magic constant\0"
-      CLIENT_TO_SERVER_SEALING = "session key to client-to-server sealing key magic constant\0"
-      SERVER_TO_CLIENT_SEALING = "session key to server-to-client sealing key magic constant\0"
 
       attr_reader :client, :challenge_message, :channel_binding
 
@@ -25,50 +27,22 @@ module Net
       # @return [Net::NTLM::Message::Type3]
       def authenticate!
         calculate_user_session_key!
-        type3_opts = {
-          :lm_response   => is_anonymous? ? "\x00".b : lmv2_resp,
-          :ntlm_response => is_anonymous? ? '' : ntlmv2_resp,
-          :domain        => domain,
-          :user          => username,
-          :workstation   => workstation,
-          :flag          => (challenge_message.flag & client.flags)
-        }
-        t3 = Message::Type3.create type3_opts
-        if negotiate_key_exchange?
-          t3.enable(:session_key)
-          rc4 = Net::NTLM::Rc4.new(user_session_key)
-          sk = rc4.encrypt exported_session_key
-          t3.session_key = sk
-        end
+        t3 = Message::Type3.create(type3_options)
+        exchange_session_key(t3) if negotiate_key_exchange?
         t3
       end
 
-      def exported_session_key
-        @exported_session_key ||=
-          begin
-            if negotiate_key_exchange?
-              OpenSSL::Random.random_bytes(16)
-            else
-              user_session_key
-            end
-          end
-      end
-
       def sign_message(message)
         seq = sequence
-        sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, client_sign_key, "#{seq}#{message}")[0..7]
-        if negotiate_key_exchange?
-          sig = client_cipher.encrypt sig
-        end
+        sig = OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), client_sign_key, "#{seq}#{message}")[0..7]
+        sig = client_cipher.encrypt sig if negotiate_key_exchange?
         "#{VERSION_MAGIC}#{sig}#{seq}"
       end
 
       def verify_signature(signature, message)
-        seq = signature[-4..-1]
-        sig = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, server_sign_key, "#{seq}#{message}")[0..7]
-        if negotiate_key_exchange?
-          sig = server_cipher.encrypt sig
-        end
+        seq = signature[-4..]
+        sig = OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), server_sign_key, "#{seq}#{message}")[0..7]
+        sig = server_cipher.encrypt sig if negotiate_key_exchange?
         "#{VERSION_MAGIC}#{sig}#{seq}" == signature
       end
 
@@ -80,74 +54,38 @@ module Net
         server_cipher.encrypt(emessage)
       end
 
-      def is_anonymous?
+      def anonymous?
         username == '' && password == ''
       end
 
-      private
-
-
-      def user_session_key
-        @user_session_key ||=  nil
-      end
-
-      def sequence
-        [raw_sequence].pack("V*")
-      end
-
-      def raw_sequence
-        if defined? @raw_sequence
-          @raw_sequence += 1
-        else
-          @raw_sequence = 0
-        end
-      end
-
-      def client_sign_key
-        @client_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SIGNING}"
-      end
-
-      def server_sign_key
-        @server_sign_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SIGNING}"
-      end
-
-      def client_seal_key
-        @client_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{CLIENT_TO_SERVER_SEALING}"
-      end
-
-      def server_seal_key
-        @server_seal_key ||= OpenSSL::Digest::MD5.digest "#{exported_session_key}#{SERVER_TO_CLIENT_SEALING}"
-      end
-
-      def client_cipher
-        @client_cipher ||= Net::NTLM::Rc4.new(client_seal_key)
-      end
+      alias is_anonymous? anonymous?
 
-      def server_cipher
-        @server_cipher ||= Net::NTLM::Rc4.new(server_seal_key)
-      end
-
-      def client_challenge
-        @client_challenge ||= NTLM.pack_int64le(rand(MAX64))
-      end
+      private
 
-      def server_challenge
-        @server_challenge ||= challenge_message[:challenge].serialize
+      def type3_options
+        {
+          lm_response: anonymous? ? "\x00".b : lmv2_resp,
+          ntlm_response: anonymous? ? '' : ntlmv2_resp,
+          domain: domain,
+          user: username,
+          workstation: workstation,
+          flag: (challenge_message.flag & client.flags)
+        }
       end
 
-      # epoch -> milsec from Jan 1, 1601
-      # @see http://support.microsoft.com/kb/188768
-      def timestamp
-        @timestamp ||= 10_000_000 * (Time.now.to_i + TIME_OFFSET)
+      def exchange_session_key(type3)
+        type3.enable(:session_key)
+        rc4 = Net::NTLM::Rc4.new(user_session_key)
+        type3.session_key = rc4.encrypt(exported_session_key)
       end
 
       def use_oem_strings?
         # @see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832
-        !challenge_message.has_flag?(:UNICODE) && challenge_message.has_flag?(:OEM)
+        !challenge_message.flag?(:UNICODE) && challenge_message.flag?(:OEM)
       end
 
       def negotiate_key_exchange?
-        challenge_message.has_flag? :KEY_EXCHANGE
+        challenge_message.flag? :KEY_EXCHANGE
       end
 
       def username
@@ -159,11 +97,11 @@ module Net
       end
 
       def workstation
-        (client.workstation ? oem_or_unicode_str(client.workstation) : "")
+        (client.workstation ? oem_or_unicode_str(client.workstation) : '')
       end
 
       def domain
-        (client.domain ? oem_or_unicode_str(client.domain) : "")
+        (client.domain ? oem_or_unicode_str(client.domain) : '')
       end
 
       def oem_or_unicode_str(str)
@@ -173,55 +111,6 @@ module Net
           NTLM::EncodeUtil.encode_utf16le str
         end
       end
-
-      def ntlmv2_hash
-        @ntlmv2_hash ||= NTLM.ntlmv2_hash(username, password, domain, {:client_challenge => client_challenge, :unicode => !use_oem_strings?})
-      end
-
-      def calculate_user_session_key!
-        if is_anonymous?
-          # see MS-NLMP section 3.4
-          @user_session_key = "\x00".b * 16
-        else
-          @user_session_key = OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, nt_proof_str)
-        end
-      end
-
-      def lmv2_resp
-        OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + client_challenge) + client_challenge
-      end
-
-      def ntlmv2_resp
-        nt_proof_str + blob
-      end
-
-      def nt_proof_str
-        @nt_proof_str ||= OpenSSL::HMAC.digest(OpenSSL::Digest::MD5.new, ntlmv2_hash, server_challenge + blob)
-      end
-
-      def blob
-        @blob ||=
-          begin
-            b = Blob.new
-            b.timestamp = timestamp
-            b.challenge = client_challenge
-            b.target_info = target_info
-            b.serialize
-          end
-      end
-
-      def target_info
-        @target_info ||= begin
-          if channel_binding
-            t = Net::NTLM::TargetInfo.new(challenge_message.target_info)
-            av_id = Net::NTLM::TargetInfo::MSV_AV_CHANNEL_BINDINGS
-            t.av_pairs[av_id] = channel_binding.channel_binding_token
-            t.to_s
-          else
-            challenge_message.target_info
-          end
-        end
-      end
     end
   end
 end

data/lib/net/ntlm/client/session_crypto.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+module Net
+  module NTLM
+    class Client
+      # Session key derivation and NTLMv2 response building for
+      # {Net::NTLM::Client::Session}. Included into Session; not used directly.
+      module SessionCrypto
+        CLIENT_TO_SERVER_SIGNING = "session key to client-to-server signing key magic constant\0"
+        SERVER_TO_CLIENT_SIGNING = "session key to server-to-client signing key magic constant\0"
+        CLIENT_TO_SERVER_SEALING = "session key to client-to-server sealing key magic constant\0"
+        SERVER_TO_CLIENT_SEALING = "session key to server-to-client sealing key magic constant\0"
+
+        # @return [String] session key exchanged with (or derived for) the server
+        def exported_session_key
+          @exported_session_key ||=
+            if negotiate_key_exchange?
+              OpenSSL::Random.random_bytes(16)
+            else
+              user_session_key
+            end
+        end
+
+        private
+
+        def user_session_key
+          @user_session_key ||= nil
+        end
+
+        def calculate_user_session_key!
+          @user_session_key = if anonymous?
+                                # see MS-NLMP section 3.4
+                                "\x00".b * 16
+                              else
+                                OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), ntlmv2_hash, nt_proof_str)
+                              end
+        end
+
+        def ntlmv2_hash
+          @ntlmv2_hash ||= NTLM.ntlmv2_hash(username, password, domain,
+                                            { client_challenge: client_challenge, unicode: !use_oem_strings? })
+        end
+
+        def lmv2_resp
+          OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), ntlmv2_hash,
+                               server_challenge + client_challenge) + client_challenge
+        end
+
+        def ntlmv2_resp
+          nt_proof_str + blob
+        end
+
+        def nt_proof_str
+          @nt_proof_str ||= OpenSSL::HMAC.digest(OpenSSL::Digest.new('MD5'), ntlmv2_hash, server_challenge + blob)
+        end
+
+        def blob
+          @blob ||=
+            begin
+              b = Blob.new
+              b.timestamp = timestamp
+              b.challenge = client_challenge
+              b.target_info = target_info
+              b.serialize
+            end
+        end
+
+        def target_info
+          @target_info ||= if channel_binding
+                             t = Net::NTLM::TargetInfo.new(challenge_message.target_info)
+                             av_id = Net::NTLM::TargetInfo::MSV_AV_CHANNEL_BINDINGS
+                             t.av_pairs[av_id] = channel_binding.channel_binding_token
+                             t.to_s
+                           else
+                             challenge_message.target_info
+                           end
+        end
+
+        def client_sign_key
+          @client_sign_key ||= OpenSSL::Digest.digest('MD5', "#{exported_session_key}#{CLIENT_TO_SERVER_SIGNING}")
+        end
+
+        def server_sign_key
+          @server_sign_key ||= OpenSSL::Digest.digest('MD5', "#{exported_session_key}#{SERVER_TO_CLIENT_SIGNING}")
+        end
+
+        def client_seal_key
+          @client_seal_key ||= OpenSSL::Digest.digest('MD5', "#{exported_session_key}#{CLIENT_TO_SERVER_SEALING}")
+        end
+
+        def server_seal_key
+          @server_seal_key ||= OpenSSL::Digest.digest('MD5', "#{exported_session_key}#{SERVER_TO_CLIENT_SEALING}")
+        end
+
+        def client_cipher
+          @client_cipher ||= Net::NTLM::Rc4.new(client_seal_key)
+        end
+
+        def server_cipher
+          @server_cipher ||= Net::NTLM::Rc4.new(server_seal_key)
+        end
+
+        def client_challenge
+          @client_challenge ||= NTLM.pack_int64le(rand(MAX64))
+        end
+
+        def server_challenge
+          @server_challenge ||= challenge_message[:challenge].serialize
+        end
+
+        # epoch -> milsec from Jan 1, 1601
+        # @see http://support.microsoft.com/kb/188768
+        def timestamp
+          @timestamp ||= 10_000_000 * (Time.now.to_i + TIME_OFFSET)
+        end
+
+        def sequence
+          [raw_sequence].pack('V*')
+        end
+
+        def raw_sequence
+          if defined? @raw_sequence
+            @raw_sequence += 1
+          else
+            @raw_sequence = 0
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ntlm/client.rb

@@ -1,11 +1,13 @@
+# frozen_string_literal: true
+
 module Net
   module NTLM
+    # High-level NTLM client: builds type1 and type3 messages for a session.
     class Client
-
       DEFAULT_FLAGS = NTLM::FLAGS[:UNICODE] | NTLM::FLAGS[:OEM] |
-        NTLM::FLAGS[:SIGN]   | NTLM::FLAGS[:SEAL]         | NTLM::FLAGS[:REQUEST_TARGET] |
-        NTLM::FLAGS[:NTLM]   | NTLM::FLAGS[:ALWAYS_SIGN]  | NTLM::FLAGS[:NTLM2_KEY] |
-        NTLM::FLAGS[:KEY128] | NTLM::FLAGS[:KEY_EXCHANGE] | NTLM::FLAGS[:KEY56]
+                      NTLM::FLAGS[:SIGN]   | NTLM::FLAGS[:SEAL]         | NTLM::FLAGS[:REQUEST_TARGET] |
+                      NTLM::FLAGS[:NTLM]   | NTLM::FLAGS[:ALWAYS_SIGN]  | NTLM::FLAGS[:NTLM2_KEY] |
+                      NTLM::FLAGS[:KEY128] | NTLM::FLAGS[:KEY_EXCHANGE] | NTLM::FLAGS[:KEY56]
 
       attr_reader :username, :password, :domain, :workstation, :flags
 
@@ -38,9 +40,7 @@ module Net
       end
 
       # @return [Client::Session]
-      def session
-        @session
-      end
+      attr_reader :session
 
       def session_key
         @session.exported_session_key
@@ -57,9 +57,8 @@ module Net
 
         type1
       end
-
     end
   end
 end
 
-require "net/ntlm/client/session"
+require 'net/ntlm/client/session'