@tier0/node-red-contrib-opcda-client 1.0.5 → 1.0.7

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmauthentication.js

@@ -0,0 +1,303 @@
+// @ts-check
+const Crypto = require('crypto');
+const NtlmFlags = require('./ntlmflags.js');
+const Security = require('../security.js');
+const Type1Message = require('./messages/type1message.js');
+const Type2Message = require('./messages/type2message.js');
+const Type3Message = require('./messages/type3message.js');
+const os = require('os');
+const Responses = require('./responses.js');
+const NTLMKeyFactory = require('./ntlmkeyfactory.js');
+const Ntlm1 = require('./ntlm1.js');
+
+/**
+ *  NTLM Authentication class
+ */
+class NTLMAuthentication
+{
+  /**
+   *
+   * @param {Object} domain 
+   */
+  constructor(domain)
+  {
+    this.AUTHENTICATION_SERVICE_NTLM = 10;
+    this.UNICODE_SUPPORTED = true;
+
+    this.BASIC_FLAGS = NtlmFlags.NTLMSSP_REQUEST_TARGET | NtlmFlags.NTLMSSP_NEGOTIATE_NTLM |
+      NtlmFlags.NTLMSSP_NEGOTIATE_OEM | NtlmFlags.NTLMSSP_NEGOTIATE_ALWAYS_SIGN |
+      (this.UNICODE_SUPPORTED ? NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE : 0);
+
+    this.security;
+    this.authenticationSource;
+    this.lanManagerkey = false;
+    this.seal = false;
+    this.sign = true;
+    this.keyExchange = true;
+    this.useNtlm2sessionsecurity = true;
+    this.useNtlmV2 = true;
+    
+    let user = domain.username;
+    let password = domain.password;
+
+    const keyLength = 128;
+    if (keyLength != null) {
+      try {
+        this.keyLength = Number.parseInt(keyLength);
+      } catch (err) {
+        throw new Error('Invalid key length: ' + keyLength);
+      }
+    }
+
+    this.domain = domain.domain;
+    this.credentials = {domain: domain.domain, username: user, password: password};
+  }
+
+  /**
+   *  @return {Boolean} security value
+   */
+  getSecurity() {
+    return this.security;
+  }
+
+  getDefaultFlags()
+  {
+    var flags = this.BASIC_FLAGS;
+
+    if (this.lanManagerkey) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_LM_KEY;
+    if (this.sign) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_SIGN;
+    if (this.seal) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_SEAL;
+    if (this.keyExchange) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH;
+    if (this.keyLength >= 56) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_56;
+    if (this.keyLength >= 128) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_128;
+
+    flags |= NtlmFlags.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY;
+    if (this.useNtlmV2) flags |= NtlmFlags.NTLMSSP_NEGOTIATE_TARGET_INFO;
+    return flags;
+  }
+
+  adjustFlags(flags)
+  {
+    if (this.UNICODE_SUPPORTED && ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE) != 0)) {
+        flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_OEM;
+        flags |= NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE;
+    } else {
+        flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_UNICODE;
+        flags |= NtlmFlags.NTLMSSP_NEGOTIATE_OEM;
+    }
+    if (!this.lanManagerkey) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_LM_KEY;
+    if (!(this.sign || this.seal)) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_SIGN;
+    if (!this.seal) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_SEAL;
+    if (!this.keyExchange) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH;
+    if (this.keyLength < 128) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_128;
+    if (this.keyLength < 56) flags &= ~NtlmFlags.NTLMSSP_NEGOTIATE_56;
+    return flags;
+  }
+
+  createType1(domain)
+  {
+    var flags = this.getDefaultFlags();
+    return new Type1Message(null, flags, domain,
+      os.hostname());
+  }
+
+  createType2(type1)
+  {
+    var flags;
+    if (type1 == null) {
+      flags = this.getDefaultFlags();
+    } else {
+      flags = this.adjustFlags(type1.getFlags());
+    }
+    // challenge accept response flag
+    flags |= 0x00020000;
+
+    var type2Message = new Type2Message(flags, [1,2,3,4,5,6,7,8],
+      this.credentials.domain);
+
+    return type2Message;
+  }
+
+  /**
+   * 
+   * @param {Type2Message} type2
+   * @param {Object} info
+   * @return {Type3Message}
+   */
+  createType3(type2, info) {
+    let flags = type2.getFlags();
+
+    if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_DATAGRAM_STYLE) != 0) {
+      flags = this.adjustFlags(flags);
+      flags &= ~0x00020000;
+    }
+
+    let type3 = null;
+    let clientNonce = new Array(8);
+    
+    let target = null;
+
+    if (target == null) {
+      target = info.domain.toUpperCase();
+      if (target == '') {
+        target = this.getTargetFromTargetInformation(type2.getTargetInformation());
+      }
+    }
+
+    if (this.useNtlmV2) {
+      clientNonce = [...(Crypto.randomBytes(8))];
+      try {
+        const lmv2Response = new Responses().getLMv2Response(target,
+            this.credentials.username, this.credentials.password,
+            type2.getChallenge(), clientNonce);
+        const retval = new Responses().getNTLMv2Response(target,
+            this.credentials.username, this.credentials.password,
+            type2.getTargetInformation(), type2.getChallenge(), clientNonce);
+        const ntlmv2Response = retval[0];
+        const blob = retval[1];
+        type3 = new Type3Message(flags, lmv2Response, ntlmv2Response, target,
+            this.credentials.username, os.hostname());
+
+        // NTLMv2 session key derivation
+        if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) != 0) {
+          const ntProofStr = ntlmv2Response.slice(0, 16);
+          const ntlmv2Hash = new Responses().ntlmv2Hash(target,
+              this.credentials.username, this.credentials.password);
+          const sessionBaseKey = new Responses().hmacMD5(ntProofStr, ntlmv2Hash);
+
+          let exportedSessionKey;
+          if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH) != 0) {
+            exportedSessionKey = [...Crypto.randomBytes(16)];
+            const ntlmKeyFactory = new NTLMKeyFactory();
+            const encryptedSessionKey = ntlmKeyFactory.encryptSecondarySessionKey(
+                exportedSessionKey, sessionBaseKey);
+            type3.setEncryptedSessionKey(encryptedSessionKey);
+          } else {
+            exportedSessionKey = sessionBaseKey;
+          }
+
+          if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_SIGN) != 0 ||
+              (flags & NtlmFlags.NTLMSSP_NEGOTIATE_SEAL) != 0) {
+            this.security = new Ntlm1(flags, exportedSessionKey, false);
+          }
+        }
+
+      } catch (err) {
+        throw new Error('Exception occurred while forming NTLMv2 Type3Response: ' +
+            (err.message || err));
+      }
+    } else if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY)
+         != 0) {
+      flags = this.adjustFlags(flags);
+      flags &= ~0x00020000;
+                
+      const challenge = type2.getChallenge();
+      let lmResponse = new Array(24);
+
+      clientNonce = [...(Crypto.randomBytes(8))];
+      for (let i = 0; i < 8; i++) lmResponse[i] = clientNonce[i];
+      for (let i = 8; i < 24; i++) lmResponse[i] = 0;
+
+      let ntResponse;
+      
+      try {
+        ntResponse = new Responses().getNTLM2SessionResponse(
+            this.credentials.password, Buffer.from(challenge), Buffer.from(clientNonce));
+      } catch (e) {
+        throw new Error('Exception occurred while forming Session Security Type3Response: ' +
+            (e.message || e));
+      }
+      
+      type3 = new Type3Message(flags, lmResponse, ntResponse, target,
+          this.credentials.username, os.hostname());
+    } else {
+      const challenge = type2.getChallenge();
+      let lmResponse, ntResponse;
+      try {
+        lmResponse = new Responses().getLMResponse(this.credentials.password, challenge);
+        ntResponse = new Responses().getNTLMResponse(this.credentials.password, challenge);
+      } catch (e) {
+        throw new Error('Exception occurred while forming NTLMv1 Type3Response: ' +
+            (e.message || e));
+      }
+
+      type3 = new Type3Message(flags, lmResponse, ntResponse, target,
+          this.credentials.username, os.hostname());
+
+      if ((flags & NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH) != 0) {
+        throw new Error('Key Exchange not supported for NTLMv1');
+      }
+    }
+    
+    return type3;
+  }
+
+  getTargetFromTargetInformation(targetInformation)
+  {
+    if (!targetInformation || targetInformation.length === 0) return null;
+
+    var i = 0;
+    while (i < targetInformation.length) {
+      let avId = (targetInformation[i] & 0xff) | ((targetInformation[i + 1] & 0xff) << 8);
+      i += 2;
+      let avLen = (targetInformation[i] & 0xff) | ((targetInformation[i + 1] & 0xff) << 8);
+      i += 2;
+
+      if (avId === 0) break;
+
+      if (avId === 2) {
+        let domainBytes = targetInformation.slice(i, i + avLen);
+        try {
+          return Buffer.from(domainBytes).toString('utf16le');
+        } catch (err) {
+          return null;
+        }
+      }
+      i += avLen;
+    }
+    return null;
+  }
+
+  createSecurityWhenServer(type3)
+  {
+    var type3Message = type3;
+
+    var flags = type3Message.getFlags();
+    var ntlmKeyFactory = new NTLMKeyFactory();
+
+    var secondayMasterKey;
+    var sessionResponseUserSessionKey = null;
+
+    if (type3Message.getFlag(0x00000800)) {
+      sessionResponseUserSessionKey = new Array(16);
+    } else if (this.useNtlmV2) {
+      // TODO: create the key for NTLMv2 server-side
+    } else {
+      var servernonce;
+      var challenge = new Array(1,2,3,4,5,6,7,8);
+      servernonce = [...challenge];
+      let lmResp = type3Message.getLMResponse();
+      if (lmResp) {
+        servernonce = [...servernonce, ...lmResp.slice(0, 8)];
+      }
+      try {
+        sessionResponseUserSessionKey = ntlmKeyFactory.getNTLM2SessionResponseUserSessionKey(
+            this.credentials.password, servernonce);
+      } catch (e) {
+        throw new Error("Exception occurred while forming Session Security from Type3 AUTH: " +
+            (e.message || e));
+      }
+    }
+
+    try {
+      secondayMasterKey = ntlmKeyFactory.decryptSecondarySessionKey(
+          type3Message.getEncryptedSessionKey(), sessionResponseUserSessionKey);
+      this.security = new Ntlm1(flags, secondayMasterKey, true);
+    } catch (e) {
+      throw new Error("Exception occurred while forming Session Security Type3Response: " +
+          (e.message || e));
+    }
+  }
+}
+
+module.exports = NTLMAuthentication;

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmconnection.js

@@ -0,0 +1,110 @@
+var DefaultConnection = require('../defaultconnection.js');
+var AuthenticationVerifier = require('../core/authenticationverifier.js');
+var NdrBuffer = require('../../ndr/ndrbuffer.js');
+var NTLMAuthentication = require('./ntlmauthentication.js');
+var NTLMFlags = require('./ntlmflags.js');
+var Security = require('../security.js');
+var Type1Message = require('./messages/type1message.js');
+var Type2Message = require('./messages/type2message.js');
+var Type3Message = require('./messages/type3message.js');
+
+
+var contextSerial = 0;
+/**
+ * NTLM Connection for secure communication
+ */
+class NTLMConnection extends DefaultConnection
+{
+  constructor(info)
+  {
+    super();
+    this.authentication = new NTLMAuthentication(info);
+    this.ntlm;
+  }
+
+  setTransmitLength(transmitLength)
+  {
+    this.transmitLength = transmitLength;
+    this.transmitBuffer = new NdrBuffer([transmitLength]);
+  }
+
+  setReceiveLength(receiveLength)
+  {
+    this.receiveLength = receiveLength;
+    this.receiveBuffer = new NdrBuffer([receiveLength]);
+  }
+
+  incomingRebind(verifier)
+  {    
+    switch (verifier.body[8]) {
+      case 1:
+        this.contextId = verifier.contextId;
+        this.ntlm = new Type1Message(verifier.body);
+        break;
+      case 2:
+        this.ntlm = new Type2Message(verifier.body);
+        break;
+      case 3:
+        var type2 = this.ntlm;
+        this.ntlm = new Type3Message(verifier.body);
+        /* FIXME: In the future usentlmv2 and other things that the original
+        *  library was reading from properties should be defined diferently
+        *  so our lib can also support to manually choose those values
+        */
+        var usentlmv2 = true;
+        if (usentlmv2) {
+          this.authentication.createSecurityWhenServer(this.ntlm);
+          this.setSecurity(this.authentication.getSecurity());
+        }
+        break;
+      default:
+        throw new Error("Invalid NTLM message type");
+    }
+  }
+
+  /**
+   * 
+   * @param {Object} info
+   * @return {NtlmMessage}
+   */
+  outgoingRebind(info, pduType)
+  {
+    if (this.ntlm == null) {
+      this.contextId = ++contextSerial;
+      this.ntlm = this.authentication.createType1(info.domain);
+    } else if (this.ntlm instanceof Type1Message) {
+      this.ntlm = this.authentication.createType2(this.ntlm);
+    } else if (this.ntlm instanceof Type2Message) {
+      const type2 = this.ntlm;
+      this.ntlm = this.authentication.createType3(type2, info);
+      // FIXME: same as incomingRebind
+      const usentlmv2 = true;
+      if (usentlmv2) {
+        this.setSecurity(this.authentication.getSecurity());
+      }
+    } else if (this.ntlm instanceof Type3Message) {
+      const _sec = new Security();
+      const currentLevel = this.security != null ?
+        this.security.getProtectionLevel() : _sec.PROTECTION_LEVEL_CONNECT;
+
+      if (pduType == 0x00) {
+        return new AuthenticationVerifier(
+          this.authentication.AUTHENTICATION_SERVICE_NTLM, currentLevel,
+          this.contextId, [1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+      } else if (pduType == 0x0e) {
+        return null;
+      }
+    } else {
+      throw new Error("Unrecognized NTLM message.");
+    }
+
+    let protectionLevel = this.ntlm.getFlag(NTLMFlags.NTLMSSP_NEGOTIATE_SEAL) ?
+      new Security().PROTECTION_LEVEL_PRIVACY : this.ntlm.getFlag(NTLMFlags.NTLMSSP_NEGOTIATE_SIGN) ?
+                    new Security().PROTECTION_LEVEL_INTEGRITY : new Security().PROTECTION_LEVEL_CONNECT;
+
+    return new AuthenticationVerifier(this.authentication.AUTHENTICATION_SERVICE_NTLM, protectionLevel,
+      this.contextId, this.ntlm.toByteArray());
+  }
+}
+
+module.exports = NTLMConnection;

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmconnectioncontext.js

@@ -0,0 +1,133 @@
+var PresentationContext = require("../core/presentationcontext.js");
+var PresentationResult = require("../core/presentationresult.js");
+var AlterContextPdu = require("../pdu/altercontextpdu.js");
+var AlterContextResponsePdu = require("../pdu/altercontextresponsepdu.js");
+var BindAcknowledgePdu = require("../pdu/bindacknowledgepdu.js");
+var BindNoAcknowledgePdu = require('../pdu/bindnoacknowledgepdu.js');
+var BindPdu = require('../pdu/bindPdu.js');
+var FaultCoPdu = require('../pdu/faultCoPdu.js');
+var ShutdownPdu = require('../pdu/shutdownpdu.js');
+var DefaultConnection = require('../defaultconnection.js');
+var NTLMConnection = require('./ntlmconnection.js');
+var Auth3Pdu = require('../pdu/auth3pdu.js');
+
+class NTLMConnectionContext
+{
+  constructor()
+  {
+    this.DEFAULT_MAX_TRANSMIT_FRAGMENT = 4280;
+    this.DEFAULT_MAX_RECEIVE_FRAGMENT = 4280;
+    this.maxTransmitFragment;
+    this.maxReceiveFragment;
+
+    this.connection;
+    this.established;
+    this.transmitLength;
+    this.receiveLength;
+    this.assocGroupId;
+  }
+
+  init2(context, info)
+  {
+    this.established = false;
+    var maxTransmit = this.DEFAULT_MAX_TRANSMIT_FRAGMENT;
+    if (maxTransmit != null) {
+      this.maxTransmitFragment = maxTransmit;
+    }
+    var maxReceive = this.DEFAULT_MAX_RECEIVE_FRAGMENT;
+    if (maxReceive != null) {
+      this.maxReceiveFragment = maxReceive;
+    }
+    var pdu = new BindPdu();
+    pdu.setContextList([context]);
+    pdu.setMaxTransmitFragment(this.maxTransmitFragment);
+    pdu.setMaxReceiveFragment(this.maxReceiveFragment);
+    this.connection = new NTLMConnection(info);
+    this.assocGroupId = 0;
+    return pdu;
+  }
+
+  init(context, info)
+  {
+    var pdu = this.init2(context, info);
+    pdu.resetCallIdCounter();
+    return pdu;
+  }
+
+  alter(context)
+  {
+    this.established = false;
+    var pdu = new AlterContextPdu();
+    pdu.setContextList([context]);
+    pdu.setAssociationGroupId(this.assocGroupId);
+    return pdu;
+  }
+
+  accept(pdu){
+    var results = null;
+
+    switch (pdu.getType()){
+      case new BindAcknowledgePdu().BIND_ACKNOWLEDGE_TYPE:
+        var bindAck = pdu;
+
+        results = bindAck.getResultList();
+        if (results == null){
+          throw new Error("No presentation context results.");
+        }
+        for (var i = results.length - 1; i >= 0; i--){
+          if (results[i].result != new PresentationResult().ACCEPTANCE){
+            throw new Error("Context rejected.", results[i]);
+          }
+        }
+        this.transmitLength = bindAck.getMaxReceiveFragment();
+        this.receiveLength = bindAck.getMaxTransmitFragment();
+        this.established = true;
+        this.connection.setTransmitLength(this.transmitLength);
+        this.connection.setReceiveLength(this.receiveLength);
+        this.assocGroupId = bindAck.getAssociationGroupId();
+        
+        return new Auth3Pdu();
+      case new AlterContextResponsePdu().ALTER_CONTEXT_RESPONSE_TYPE:
+        var alterContextResponse = pdu;
+        results = alterContextResponse.getResultList();
+        if (results == null){
+          throw new Error("No prsentation context results.");
+        }
+        for (var i = results.length - 1; i >= 0; i--){
+          if (results[i].result != new PresentationResult().ACCEPTANCE){
+            throw new Error("Context rejected.", results[i]);
+          }
+        }
+        this.established = true;
+        return null;
+      case new BindNoAcknowledgePdu().BIND_NO_ACKNOWLEDGE_TYPE:
+        throw new Error("Unable to bind.", pdu.getRejectReason());
+      case new FaultCoPdu().FAULT_TYPE:
+        throw new Error("Fault occurred, status=0x" + ((pdu.getStatus() >>> 0).toString(16)));
+      case new ShutdownPdu().SHUTDOWN_TYPE:
+        throw new Error("Server shutdown connection.");
+      case new BindPdu().BIND_TYPE:
+        this.established = false;
+      case new AlterContextPdu().ALTER_CONTEXT_TYPE:
+        this.established = false;
+        throw new Error("Server-side currently unsupported.");
+      case new Auth3Pdu().AUTH3_TYPE:
+        this.established = true;
+        return null;
+      default:
+        throw new Error("Unkonwn/unnacceptable PDU type.");
+    }
+  }
+
+  getConnection()
+  {
+    return this.connection;
+  }
+
+  isEstablished()
+  {
+    return this.established;
+  }
+}
+
+module.exports = NTLMConnectionContext;

package/node_modules/@tier0/node-dcom/dcom/rpc/security/ntlmflags.js

@@ -0,0 +1,161 @@
+var NtlmFlags = {
+  /**
+     * Indicates whether Unicode strings are supported or used.
+     */
+    NTLMSSP_NEGOTIATE_UNICODE : 0x00000001,
+
+    /**
+     * Indicates whether OEM strings are supported or used.
+     */
+    NTLMSSP_NEGOTIATE_OEM : 0x00000002,
+
+    /**
+     * Indicates whether the authentication target is requested from
+     * the server.
+     */
+    NTLMSSP_REQUEST_TARGET : 0x00000004,
+
+    /**
+     * Specifies that communication across the authenticated channel
+     * should carry a digital signature (message integrity).
+     */
+    NTLMSSP_NEGOTIATE_SIGN : 0x00000010,
+
+    /**
+     * Specifies that communication across the authenticated channel
+     * should be encrypted (message confidentiality).
+     */
+    NTLMSSP_NEGOTIATE_SEAL : 0x00000020,
+
+    /**
+     * Indicates datagram authentication.
+     */
+    NTLMSSP_NEGOTIATE_DATAGRAM_STYLE : 0x00000040,
+
+    /**
+     * Indicates that the LAN Manager session key should be used for
+     * signing and sealing authenticated communication.
+     */
+    NTLMSSP_NEGOTIATE_LM_KEY : 0x00000080,
+
+    /**
+     * ??? According to spec this is a reserved bit and must be set to zero
+     */
+    NTLMSSP_NEGOTIATE_NETWARE : 0x00000100,
+
+    /**
+     * Indicates support for NTLM authentication.
+     */
+    NTLMSSP_NEGOTIATE_NTLM : 0x00000200,
+
+    /**
+     * Indicates that this is an anonymous connection
+     */
+    NTLMSSP_NEGOTIATE_ANONYMOUS : 0x00000800,
+
+    /**
+     * Indicates whether the OEM-formatted domain name in which the
+     * client workstation has membership is supplied in the Type-1 message.
+     * This is used in the negotation of local authentication.
+     */
+    NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED : 0x00001000,
+
+    /**
+     * Indicates whether the OEM-formatted workstation name is supplied
+     * in the Type-1 message. This is used in the negotiation of local
+     * authentication.
+     */
+    NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED : 0x00002000,
+
+    /**
+     * Sent by the server to indicate that the server and client are
+     * on the same machine. This implies that the server will include
+     * a local security context handle in the Type 2 message, for
+     * use in local authentication.
+     */
+    NTLMSSP_NEGOTIATE_LOCAL_CALL : 0x00004000,
+
+    /**
+     * Indicates that authenticated communication between the client
+     * and server should carry a "dummy" digital signature.
+     */
+    NTLMSSP_NEGOTIATE_ALWAYS_SIGN : 0x00008000,
+
+    /**
+     * Sent by the server in the Type 2 message to indicate that the
+     * target authentication realm is a domain.
+     */
+    NTLMSSP_TARGET_TYPE_DOMAIN : 0x00010000,
+
+    /**
+     * Sent by the server in the Type 2 message to indicate that the
+     * target authentication realm is a server.
+     */
+    NTLMSSP_TARGET_TYPE_SERVER : 0x00020000,
+
+    /**
+     * Sent by the server in the Type 2 message to indicate that the
+     * target authentication realm is a share (presumably for share-level
+     * authentication).
+     */
+    NTLMSSP_TARGET_TYPE_SHARE : 0x00040000,
+
+    /**
+     * Indicates that the NTLM2 signing and sealing scheme should be used
+     * for protecting authenticated communications. This refers to a
+     * particular session security scheme, and is not related to the use
+     * of NTLMv2 authentication.
+     */
+    NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY : 0x00080000,
+
+    /**
+     * Alias for NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY.
+     */
+    NTLMSSP_NEGOTIATE_NTLM2 : 0x00080000,
+
+    /**
+     * ?? According to spec this is a reserved bit and must be set to zero
+     */
+    NTLMSSP_REQUEST_INIT_RESPONSE : 0x00100000,
+
+    /**
+     * ?? According to spec this is NTLMSSP_NEGOTIATE_IDENTIFY
+     *
+     * If set, requests an identify level token
+     */
+    NTLMSSP_REQUEST_ACCEPT_RESPONSE : 0x00200000,
+
+    /**
+     * Requests the usage of the LMOWF
+     */
+    NTLMSSP_REQUEST_NON_NT_SESSION_KEY : 0x00400000,
+
+    /**
+     * Sent by the server in the Type 2 message to indicate that it is
+     * including a Target Information block in the message. The Target
+     * Information block is used in the calculation of the NTLMv2 response.
+     */
+    NTLMSSP_NEGOTIATE_TARGET_INFO : 0x00800000,
+
+    /**
+     *
+     */
+    NTLMSSP_NEGOTIATE_VERSION : 0x2000000,
+
+    /**
+     * Indicates that 128-bit encryption is supported.
+     */
+    NTLMSSP_NEGOTIATE_128 : 0x20000000,
+
+    /**
+     * Request explicit key exchange
+     */
+    NTLMSSP_NEGOTIATE_KEY_EXCH : 0x40000000,
+
+    /**
+     * Indicates that 56-bit encryption is supported.
+     */
+    NTLMSSP_NEGOTIATE_56 : 0x80000000,
+}
+
+module.exports = Object.freeze(NtlmFlags);