-
Notifications
You must be signed in to change notification settings - Fork 6
/
packet-kerberos.c
8932 lines (7615 loc) · 342 KB
/
packet-kerberos.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* Do not modify this file. Changes will be overwritten. */
/* Generated automatically by the ASN.1 to Wireshark dissector compiler */
/* packet-kerberos.c */
/* asn2wrs.py -b -p kerberos -c ./kerberos.cnf -s ./packet-kerberos-template -D . -O ../.. KerberosV5Spec2.asn k5.asn RFC3244.asn RFC6113.asn */
/* Input file: packet-kerberos-template.c */
#line 1 "./asn1/kerberos/packet-kerberos-template.c"
/* packet-kerberos.c
* Routines for Kerberos
* Wes Hardaker (c) 2000
* wjhardaker@ucdavis.edu
* Richard Sharpe (C) 2002, rsharpe@samba.org, modularized a bit more and
* added AP-REQ and AP-REP dissection
*
* Ronnie Sahlberg (C) 2004, major rewrite for new ASN.1/BER API.
* decryption of kerberos blobs if keytab is provided
*
* See RFC 1510, and various I-Ds and other documents showing additions,
* e.g. ones listed under
*
* http://clifford.neuman.name/krb-revisions/
*
* and
*
* https://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-clarifications-07
*
* and
*
* https://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-referrals-05
*
* Some structures from RFC2630
*
* Wireshark - Network traffic analyzer
* By Gerald Combs <gerald@wireshark.org>
* Copyright 1998 Gerald Combs
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
/*
* Some of the development of the Kerberos protocol decoder was sponsored by
* Cable Television Laboratories, Inc. ("CableLabs") based upon proprietary
* CableLabs' specifications. Your license and use of this protocol decoder
* does not mean that you are licensed to use the CableLabs'
* specifications. If you have questions about this protocol, contact
* jf.mule [AT] cablelabs.com or c.stuart [AT] cablelabs.com for additional
* information.
*/
#include <config.h>
#include <stdio.h>
// krb5.h needs to be included before the defines in packet-kerberos.h
#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
#ifdef _WIN32
/* prevent redefinition warnings in krb5's win-mac.h */
#define SSIZE_T_DEFINED
#endif /* _WIN32 */
#include <krb5.h>
#endif
#include <epan/packet.h>
#include <epan/exceptions.h>
#include <epan/strutil.h>
#include <epan/conversation.h>
#include <epan/asn1.h>
#include <epan/expert.h>
#include <epan/prefs.h>
#include <wsutil/wsgcrypt.h>
#include <wsutil/file_util.h>
#include <wsutil/str_util.h>
#include <wsutil/pint.h>
#include "packet-kerberos.h"
#include "packet-netbios.h"
#include "packet-tcp.h"
#include "packet-ber.h"
#include "packet-pkinit.h"
#include "packet-cms.h"
#include "packet-windows-common.h"
#include "read_keytab_file.h"
#include "packet-dcerpc-netlogon.h"
#include "packet-dcerpc.h"
#include "packet-gssapi.h"
#include "packet-x509af.h"
#define KEY_USAGE_FAST_REQ_CHKSUM 50
#define KEY_USAGE_FAST_ENC 51
#define KEY_USAGE_FAST_REP 52
#define KEY_USAGE_FAST_FINISHED 53
#define KEY_USAGE_ENC_CHALLENGE_CLIENT 54
#define KEY_USAGE_ENC_CHALLENGE_KDC 55
void proto_register_kerberos(void);
void proto_reg_handoff_kerberos(void);
#define UDP_PORT_KERBEROS 88
#define TCP_PORT_KERBEROS 88
#define ADDRESS_STR_BUFSIZ 256
typedef struct kerberos_key {
guint32 keytype;
int keylength;
const guint8* keyvalue;
} kerberos_key_t;
typedef void (*kerberos_key_save_fn)(tvbuff_t* tvb _U_, int offset _U_, int length _U_,
asn1_ctx_t* actx _U_, proto_tree* tree _U_,
int parent_hf_index _U_,
int hf_index _U_);
typedef struct {
guint32 msg_type;
gboolean is_win2k_pkinit;
guint32 errorcode;
gboolean try_nt_status;
guint32 etype;
guint32 padata_type;
guint32 is_enc_padata;
guint32 enctype;
kerberos_key_t key;
proto_tree* key_tree;
proto_item* key_hidden_item;
tvbuff_t* key_tvb;
kerberos_callbacks* callbacks;
guint32 ad_type;
guint32 addr_type;
guint32 checksum_type;
#ifdef HAVE_KERBEROS
enc_key_t* last_decryption_key;
enc_key_t* last_added_key;
#endif
gint save_encryption_key_parent_hf_index;
kerberos_key_save_fn save_encryption_key_fn;
guint learnt_key_ids;
guint missing_key_ids;
wmem_list_t* decryption_keys;
wmem_list_t* learnt_keys;
wmem_list_t* missing_keys;
guint32 within_PA_TGS_REQ;
#ifdef HAVE_KERBEROS
enc_key_t* PA_TGS_REQ_key;
enc_key_t* PA_TGS_REQ_subkey;
#endif
guint32 fast_type;
guint32 fast_armor_within_armor_value;
#ifdef HAVE_KERBEROS
enc_key_t* PA_FAST_ARMOR_AP_key;
enc_key_t* PA_FAST_ARMOR_AP_subkey;
enc_key_t* fast_armor_key;
enc_key_t* fast_strengthen_key;
#endif
} kerberos_private_data_t;
static dissector_handle_t kerberos_handle_udp;
/* Forward declarations */
static int dissect_kerberos_Applications(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_AuthorizationData(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_ENC_TIMESTAMP(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
#ifdef HAVE_KERBEROS
static int dissect_kerberos_PA_ENC_TS_ENC(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
#endif
static int dissect_kerberos_PA_PAC_REQUEST(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_S4U2Self(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_S4U_X509_USER(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_ETYPE_INFO(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_ETYPE_INFO2(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_AD_IF_RELEVANT(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_AUTHENTICATION_SET_ELEM(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_FX_FAST_REQUEST(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_EncryptedChallenge(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_FX_FAST_REPLY(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_PA_PAC_OPTIONS(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_KERB_AD_RESTRICTION_ENTRY(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_SEQUENCE_OF_ENCTYPE(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
#ifdef HAVE_KERBEROS
static int dissect_kerberos_KrbFastReq(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_KrbFastResponse(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
static int dissect_kerberos_FastOptions(gboolean implicit_tag _U_, tvbuff_t* tvb _U_, int offset _U_, asn1_ctx_t* actx _U_, proto_tree* tree _U_, int hf_index _U_);
#endif
/* Desegment Kerberos over TCP messages */
static gboolean krb_desegment = TRUE;
static gint proto_kerberos = -1;
static gint hf_krb_rm_reserved = -1;
static gint hf_krb_rm_reclen = -1;
static gint hf_krb_provsrv_location = -1;
static gint hf_krb_pw_salt = -1;
static gint hf_krb_ext_error_nt_status = -1;
static gint hf_krb_ext_error_reserved = -1;
static gint hf_krb_ext_error_flags = -1;
static gint hf_krb_address_ip = -1;
static gint hf_krb_address_netbios = -1;
static gint hf_krb_address_ipv6 = -1;
static gint hf_krb_gssapi_len = -1;
static gint hf_krb_gssapi_bnd = -1;
static gint hf_krb_gssapi_dlgopt = -1;
static gint hf_krb_gssapi_dlglen = -1;
static gint hf_krb_gssapi_c_flag_deleg = -1;
static gint hf_krb_gssapi_c_flag_mutual = -1;
static gint hf_krb_gssapi_c_flag_replay = -1;
static gint hf_krb_gssapi_c_flag_sequence = -1;
static gint hf_krb_gssapi_c_flag_conf = -1;
static gint hf_krb_gssapi_c_flag_integ = -1;
static gint hf_krb_gssapi_c_flag_dce_style = -1;
static gint hf_krb_midl_version = -1;
static gint hf_krb_midl_hdr_len = -1;
static gint hf_krb_midl_fill_bytes = -1;
static gint hf_krb_midl_blob_len = -1;
static gint hf_krb_pac_signature_type = -1;
static gint hf_krb_pac_signature_signature = -1;
static gint hf_krb_w2k_pac_entries = -1;
static gint hf_krb_w2k_pac_version = -1;
static gint hf_krb_w2k_pac_type = -1;
static gint hf_krb_w2k_pac_size = -1;
static gint hf_krb_w2k_pac_offset = -1;
static gint hf_krb_pac_clientid = -1;
static gint hf_krb_pac_namelen = -1;
static gint hf_krb_pac_clientname = -1;
static gint hf_krb_pac_logon_info = -1;
static gint hf_krb_pac_credential_data = -1;
static gint hf_krb_pac_credential_info = -1;
static gint hf_krb_pac_credential_info_version = -1;
static gint hf_krb_pac_credential_info_etype = -1;
static gint hf_krb_pac_s4u_delegation_info = -1;
static gint hf_krb_pac_upn_dns_info = -1;
static gint hf_krb_pac_upn_flags = -1;
static gint hf_krb_pac_upn_dns_offset = -1;
static gint hf_krb_pac_upn_dns_len = -1;
static gint hf_krb_pac_upn_upn_offset = -1;
static gint hf_krb_pac_upn_upn_len = -1;
static gint hf_krb_pac_upn_upn_name = -1;
static gint hf_krb_pac_upn_dns_name = -1;
static gint hf_krb_pac_server_checksum = -1;
static gint hf_krb_pac_privsvr_checksum = -1;
static gint hf_krb_pac_client_info_type = -1;
static gint hf_krb_pac_client_claims_info = -1;
static gint hf_krb_pac_device_info = -1;
static gint hf_krb_pac_device_claims_info = -1;
static gint hf_krb_pa_supported_enctypes = -1;
static gint hf_krb_pa_supported_enctypes_des_cbc_crc = -1;
static gint hf_krb_pa_supported_enctypes_des_cbc_md5 = -1;
static gint hf_krb_pa_supported_enctypes_rc4_hmac = -1;
static gint hf_krb_pa_supported_enctypes_aes128_cts_hmac_sha1_96 = -1;
static gint hf_krb_pa_supported_enctypes_aes256_cts_hmac_sha1_96 = -1;
static gint hf_krb_pa_supported_enctypes_fast_supported = -1;
static gint hf_krb_pa_supported_enctypes_compound_identity_supported = -1;
static gint hf_krb_pa_supported_enctypes_claims_supported = -1;
static gint hf_krb_pa_supported_enctypes_resource_sid_compression_disabled = -1;
static gint hf_krb_ad_ap_options = -1;
static gint hf_krb_ad_ap_options_cbt = -1;
static gint hf_krb_ad_target_principal = -1;
static gint hf_krb_key_hidden_item = -1;
#ifdef HAVE_KERBEROS
static gint hf_kerberos_KrbFastResponse = -1;
static gint hf_kerberos_strengthen_key = -1;
static gint hf_kerberos_finished = -1;
static gint hf_kerberos_fast_options = -1;
static gint hf_kerberos_ticket_checksum = -1;
static gint hf_krb_patimestamp = -1;
static gint hf_krb_pausec = -1;
static gint hf_kerberos_FastOptions_reserved = -1;
static gint hf_kerberos_FastOptions_hide_client_names = -1;
static gint hf_kerberos_FastOptions_spare_bit2 = -1;
static gint hf_kerberos_FastOptions_spare_bit3 = -1;
static gint hf_kerberos_FastOptions_spare_bit4 = -1;
static gint hf_kerberos_FastOptions_spare_bit5 = -1;
static gint hf_kerberos_FastOptions_spare_bit6 = -1;
static gint hf_kerberos_FastOptions_spare_bit7 = -1;
static gint hf_kerberos_FastOptions_spare_bit8 = -1;
static gint hf_kerberos_FastOptions_spare_bit9 = -1;
static gint hf_kerberos_FastOptions_spare_bit10 = -1;
static gint hf_kerberos_FastOptions_spare_bit11 = -1;
static gint hf_kerberos_FastOptions_spare_bit12 = -1;
static gint hf_kerberos_FastOptions_spare_bit13 = -1;
static gint hf_kerberos_FastOptions_spare_bit14 = -1;
static gint hf_kerberos_FastOptions_spare_bit15 = -1;
static gint hf_kerberos_FastOptions_kdc_follow_referrals = -1;
#endif
/*--- Included file: packet-kerberos-hf.c ---*/
#line 1 "./asn1/kerberos/packet-kerberos-hf.c"
static int hf_kerberos_ticket = -1; /* Ticket */
static int hf_kerberos_authenticator = -1; /* Authenticator */
static int hf_kerberos_encTicketPart = -1; /* EncTicketPart */
static int hf_kerberos_as_req = -1; /* AS_REQ */
static int hf_kerberos_as_rep = -1; /* AS_REP */
static int hf_kerberos_tgs_req = -1; /* TGS_REQ */
static int hf_kerberos_tgs_rep = -1; /* TGS_REP */
static int hf_kerberos_ap_req = -1; /* AP_REQ */
static int hf_kerberos_ap_rep = -1; /* AP_REP */
static int hf_kerberos_krb_safe = -1; /* KRB_SAFE */
static int hf_kerberos_krb_priv = -1; /* KRB_PRIV */
static int hf_kerberos_krb_cred = -1; /* KRB_CRED */
static int hf_kerberos_encASRepPart = -1; /* EncASRepPart */
static int hf_kerberos_encTGSRepPart = -1; /* EncTGSRepPart */
static int hf_kerberos_encAPRepPart = -1; /* EncAPRepPart */
static int hf_kerberos_encKrbPrivPart = -1; /* ENC_KRB_PRIV_PART */
static int hf_kerberos_encKrbCredPart = -1; /* EncKrbCredPart */
static int hf_kerberos_krb_error = -1; /* KRB_ERROR */
static int hf_kerberos_name_type = -1; /* NAME_TYPE */
static int hf_kerberos_name_string = -1; /* SEQUENCE_OF_KerberosString */
static int hf_kerberos_name_string_item = -1; /* KerberosString */
static int hf_kerberos_cname_string = -1; /* SEQUENCE_OF_CNameString */
static int hf_kerberos_cname_string_item = -1; /* CNameString */
static int hf_kerberos_sname_string = -1; /* SEQUENCE_OF_SNameString */
static int hf_kerberos_sname_string_item = -1; /* SNameString */
static int hf_kerberos_addr_type = -1; /* ADDR_TYPE */
static int hf_kerberos_address = -1; /* T_address */
static int hf_kerberos_HostAddresses_item = -1; /* HostAddress */
static int hf_kerberos_AuthorizationData_item = -1; /* AuthorizationData_item */
static int hf_kerberos_ad_type = -1; /* AUTHDATA_TYPE */
static int hf_kerberos_ad_data = -1; /* T_ad_data */
static int hf_kerberos_padata_type = -1; /* PADATA_TYPE */
static int hf_kerberos_padata_value = -1; /* T_padata_value */
static int hf_kerberos_keytype = -1; /* T_keytype */
static int hf_kerberos_keyvalue = -1; /* T_keyvalue */
static int hf_kerberos_cksumtype = -1; /* CKSUMTYPE */
static int hf_kerberos_checksum = -1; /* T_checksum */
static int hf_kerberos_etype = -1; /* ENCTYPE */
static int hf_kerberos_kvno = -1; /* UInt32 */
static int hf_kerberos_encryptedTicketData_cipher = -1; /* T_encryptedTicketData_cipher */
static int hf_kerberos_encryptedAuthorizationData_cipher = -1; /* T_encryptedAuthorizationData_cipher */
static int hf_kerberos_encryptedAuthenticator_cipher = -1; /* T_encryptedAuthenticator_cipher */
static int hf_kerberos_encryptedKDCREPData_cipher = -1; /* T_encryptedKDCREPData_cipher */
static int hf_kerberos_encryptedAPREPData_cipher = -1; /* T_encryptedAPREPData_cipher */
static int hf_kerberos_encryptedKrbPrivData_cipher = -1; /* T_encryptedKrbPrivData_cipher */
static int hf_kerberos_encryptedKrbCredData_cipher = -1; /* T_encryptedKrbCredData_cipher */
static int hf_kerberos_tkt_vno = -1; /* INTEGER_5 */
static int hf_kerberos_realm = -1; /* Realm */
static int hf_kerberos_sname = -1; /* SName */
static int hf_kerberos_ticket_enc_part = -1; /* EncryptedTicketData */
static int hf_kerberos_flags = -1; /* TicketFlags */
static int hf_kerberos_encTicketPart_key = -1; /* T_encTicketPart_key */
static int hf_kerberos_crealm = -1; /* Realm */
static int hf_kerberos_cname = -1; /* CName */
static int hf_kerberos_transited = -1; /* TransitedEncoding */
static int hf_kerberos_authtime = -1; /* KerberosTime */
static int hf_kerberos_starttime = -1; /* KerberosTime */
static int hf_kerberos_endtime = -1; /* KerberosTime */
static int hf_kerberos_renew_till = -1; /* KerberosTime */
static int hf_kerberos_caddr = -1; /* HostAddresses */
static int hf_kerberos_authorization_data = -1; /* AuthorizationData */
static int hf_kerberos_tr_type = -1; /* Int32 */
static int hf_kerberos_contents = -1; /* OCTET_STRING */
static int hf_kerberos_pvno = -1; /* INTEGER_5 */
static int hf_kerberos_msg_type = -1; /* MESSAGE_TYPE */
static int hf_kerberos_padata = -1; /* SEQUENCE_OF_PA_DATA */
static int hf_kerberos_padata_item = -1; /* PA_DATA */
static int hf_kerberos_req_body = -1; /* KDC_REQ_BODY */
static int hf_kerberos_kdc_options = -1; /* KDCOptions */
static int hf_kerberos_from = -1; /* KerberosTime */
static int hf_kerberos_till = -1; /* KerberosTime */
static int hf_kerberos_rtime = -1; /* KerberosTime */
static int hf_kerberos_nonce = -1; /* UInt32 */
static int hf_kerberos_kDC_REQ_BODY_etype = -1; /* SEQUENCE_OF_ENCTYPE */
static int hf_kerberos_kDC_REQ_BODY_etype_item = -1; /* ENCTYPE */
static int hf_kerberos_addresses = -1; /* HostAddresses */
static int hf_kerberos_enc_authorization_data = -1; /* EncryptedAuthorizationData */
static int hf_kerberos_additional_tickets = -1; /* SEQUENCE_OF_Ticket */
static int hf_kerberos_additional_tickets_item = -1; /* Ticket */
static int hf_kerberos_kDC_REP_enc_part = -1; /* EncryptedKDCREPData */
static int hf_kerberos_encKDCRepPart_key = -1; /* T_encKDCRepPart_key */
static int hf_kerberos_last_req = -1; /* LastReq */
static int hf_kerberos_key_expiration = -1; /* KerberosTime */
static int hf_kerberos_srealm = -1; /* Realm */
static int hf_kerberos_encrypted_pa_data = -1; /* T_encrypted_pa_data */
static int hf_kerberos_LastReq_item = -1; /* LastReq_item */
static int hf_kerberos_lr_type = -1; /* LR_TYPE */
static int hf_kerberos_lr_value = -1; /* KerberosTime */
static int hf_kerberos_ap_options = -1; /* APOptions */
static int hf_kerberos_authenticator_enc_part = -1; /* EncryptedAuthenticator */
static int hf_kerberos_authenticator_vno = -1; /* INTEGER_5 */
static int hf_kerberos_cksum = -1; /* Checksum */
static int hf_kerberos_cusec = -1; /* Microseconds */
static int hf_kerberos_ctime = -1; /* KerberosTime */
static int hf_kerberos_authenticator_subkey = -1; /* T_authenticator_subkey */
static int hf_kerberos_seq_number = -1; /* UInt32 */
static int hf_kerberos_aP_REP_enc_part = -1; /* EncryptedAPREPData */
static int hf_kerberos_encAPRepPart_subkey = -1; /* T_encAPRepPart_subkey */
static int hf_kerberos_safe_body = -1; /* KRB_SAFE_BODY */
static int hf_kerberos_kRB_SAFE_BODY_user_data = -1; /* T_kRB_SAFE_BODY_user_data */
static int hf_kerberos_timestamp = -1; /* KerberosTime */
static int hf_kerberos_usec = -1; /* Microseconds */
static int hf_kerberos_s_address = -1; /* HostAddress */
static int hf_kerberos_r_address = -1; /* HostAddress */
static int hf_kerberos_kRB_PRIV_enc_part = -1; /* EncryptedKrbPrivData */
static int hf_kerberos_encKrbPrivPart_user_data = -1; /* T_encKrbPrivPart_user_data */
static int hf_kerberos_tickets = -1; /* SEQUENCE_OF_Ticket */
static int hf_kerberos_tickets_item = -1; /* Ticket */
static int hf_kerberos_kRB_CRED_enc_part = -1; /* EncryptedKrbCredData */
static int hf_kerberos_ticket_info = -1; /* SEQUENCE_OF_KrbCredInfo */
static int hf_kerberos_ticket_info_item = -1; /* KrbCredInfo */
static int hf_kerberos_krbCredInfo_key = -1; /* T_krbCredInfo_key */
static int hf_kerberos_prealm = -1; /* Realm */
static int hf_kerberos_pname = -1; /* PrincipalName */
static int hf_kerberos_stime = -1; /* KerberosTime */
static int hf_kerberos_susec = -1; /* Microseconds */
static int hf_kerberos_error_code = -1; /* ERROR_CODE */
static int hf_kerberos_e_text = -1; /* KerberosString */
static int hf_kerberos_e_data = -1; /* T_e_data */
static int hf_kerberos_e_checksum = -1; /* Checksum */
static int hf_kerberos_METHOD_DATA_item = -1; /* PA_DATA */
static int hf_kerberos_pA_ENC_TIMESTAMP_cipher = -1; /* T_pA_ENC_TIMESTAMP_cipher */
static int hf_kerberos_info_salt = -1; /* OCTET_STRING */
static int hf_kerberos_ETYPE_INFO_item = -1; /* ETYPE_INFO_ENTRY */
static int hf_kerberos_info2_salt = -1; /* KerberosString */
static int hf_kerberos_s2kparams = -1; /* OCTET_STRING */
static int hf_kerberos_ETYPE_INFO2_item = -1; /* ETYPE_INFO2_ENTRY */
static int hf_kerberos_include_pac = -1; /* BOOLEAN */
static int hf_kerberos_name = -1; /* PrincipalName */
static int hf_kerberos_auth = -1; /* GeneralString */
static int hf_kerberos_user_id = -1; /* S4UUserID */
static int hf_kerberos_checksum_01 = -1; /* Checksum */
static int hf_kerberos_cname_01 = -1; /* PrincipalName */
static int hf_kerberos_subject_certificate = -1; /* T_subject_certificate */
static int hf_kerberos_options = -1; /* BIT_STRING */
static int hf_kerberos_flags_01 = -1; /* PAC_OPTIONS_FLAGS */
static int hf_kerberos_restriction_type = -1; /* Int32 */
static int hf_kerberos_restriction = -1; /* OCTET_STRING */
static int hf_kerberos_newpasswd = -1; /* OCTET_STRING */
static int hf_kerberos_targname = -1; /* PrincipalName */
static int hf_kerberos_targrealm = -1; /* Realm */
static int hf_kerberos_pa_type = -1; /* PADATA_TYPE */
static int hf_kerberos_pa_hint = -1; /* OCTET_STRING */
static int hf_kerberos_pa_value = -1; /* OCTET_STRING */
static int hf_kerberos_armor_type = -1; /* KrbFastArmorTypes */
static int hf_kerberos_armor_value = -1; /* T_armor_value */
static int hf_kerberos_armored_data_request = -1; /* KrbFastArmoredReq */
static int hf_kerberos_encryptedKrbFastReq_cipher = -1; /* T_encryptedKrbFastReq_cipher */
static int hf_kerberos_armor = -1; /* KrbFastArmor */
static int hf_kerberos_req_checksum = -1; /* Checksum */
static int hf_kerberos_enc_fast_req = -1; /* EncryptedKrbFastReq */
static int hf_kerberos_armored_data_reply = -1; /* KrbFastArmoredRep */
static int hf_kerberos_encryptedKrbFastResponse_cipher = -1; /* T_encryptedKrbFastResponse_cipher */
static int hf_kerberos_enc_fast_rep = -1; /* EncryptedKrbFastResponse */
static int hf_kerberos_encryptedChallenge_cipher = -1; /* T_encryptedChallenge_cipher */
/* named bits */
static int hf_kerberos_APOptions_reserved = -1;
static int hf_kerberos_APOptions_use_session_key = -1;
static int hf_kerberos_APOptions_mutual_required = -1;
static int hf_kerberos_TicketFlags_reserved = -1;
static int hf_kerberos_TicketFlags_forwardable = -1;
static int hf_kerberos_TicketFlags_forwarded = -1;
static int hf_kerberos_TicketFlags_proxiable = -1;
static int hf_kerberos_TicketFlags_proxy = -1;
static int hf_kerberos_TicketFlags_may_postdate = -1;
static int hf_kerberos_TicketFlags_postdated = -1;
static int hf_kerberos_TicketFlags_invalid = -1;
static int hf_kerberos_TicketFlags_renewable = -1;
static int hf_kerberos_TicketFlags_initial = -1;
static int hf_kerberos_TicketFlags_pre_authent = -1;
static int hf_kerberos_TicketFlags_hw_authent = -1;
static int hf_kerberos_TicketFlags_transited_policy_checked = -1;
static int hf_kerberos_TicketFlags_ok_as_delegate = -1;
static int hf_kerberos_TicketFlags_unused = -1;
static int hf_kerberos_TicketFlags_enc_pa_rep = -1;
static int hf_kerberos_TicketFlags_anonymous = -1;
static int hf_kerberos_KDCOptions_reserved = -1;
static int hf_kerberos_KDCOptions_forwardable = -1;
static int hf_kerberos_KDCOptions_forwarded = -1;
static int hf_kerberos_KDCOptions_proxiable = -1;
static int hf_kerberos_KDCOptions_proxy = -1;
static int hf_kerberos_KDCOptions_allow_postdate = -1;
static int hf_kerberos_KDCOptions_postdated = -1;
static int hf_kerberos_KDCOptions_unused7 = -1;
static int hf_kerberos_KDCOptions_renewable = -1;
static int hf_kerberos_KDCOptions_unused9 = -1;
static int hf_kerberos_KDCOptions_unused10 = -1;
static int hf_kerberos_KDCOptions_opt_hardware_auth = -1;
static int hf_kerberos_KDCOptions_unused12 = -1;
static int hf_kerberos_KDCOptions_unused13 = -1;
static int hf_kerberos_KDCOptions_constrained_delegation = -1;
static int hf_kerberos_KDCOptions_canonicalize = -1;
static int hf_kerberos_KDCOptions_request_anonymous = -1;
static int hf_kerberos_KDCOptions_unused17 = -1;
static int hf_kerberos_KDCOptions_unused18 = -1;
static int hf_kerberos_KDCOptions_unused19 = -1;
static int hf_kerberos_KDCOptions_unused20 = -1;
static int hf_kerberos_KDCOptions_unused21 = -1;
static int hf_kerberos_KDCOptions_unused22 = -1;
static int hf_kerberos_KDCOptions_unused23 = -1;
static int hf_kerberos_KDCOptions_unused24 = -1;
static int hf_kerberos_KDCOptions_unused25 = -1;
static int hf_kerberos_KDCOptions_disable_transited_check = -1;
static int hf_kerberos_KDCOptions_renewable_ok = -1;
static int hf_kerberos_KDCOptions_enc_tkt_in_skey = -1;
static int hf_kerberos_KDCOptions_unused29 = -1;
static int hf_kerberos_KDCOptions_renew = -1;
static int hf_kerberos_KDCOptions_validate = -1;
static int hf_kerberos_PAC_OPTIONS_FLAGS_claims = -1;
static int hf_kerberos_PAC_OPTIONS_FLAGS_branch_aware = -1;
static int hf_kerberos_PAC_OPTIONS_FLAGS_forward_to_full_dc = -1;
static int hf_kerberos_PAC_OPTIONS_FLAGS_resource_based_constrained_delegation = -1;
static int isPku2u = -1;
/*--- End of included file: packet-kerberos-hf.c ---*/
#line 282 "./asn1/kerberos/packet-kerberos-template.c"
/* Initialize the subtree pointers */
static gint ett_kerberos = -1;
static gint ett_krb_recordmark = -1;
static gint ett_krb_pac = -1;
static gint ett_krb_pac_drep = -1;
static gint ett_krb_pac_midl_blob = -1;
static gint ett_krb_pac_logon_info = -1;
static gint ett_krb_pac_credential_info = -1;
static gint ett_krb_pac_s4u_delegation_info = -1;
static gint ett_krb_pac_upn_dns_info = -1;
static gint ett_krb_pac_device_info = -1;
static gint ett_krb_pac_server_checksum = -1;
static gint ett_krb_pac_privsvr_checksum = -1;
static gint ett_krb_pac_client_info_type = -1;
static gint ett_krb_pa_supported_enctypes = -1;
static gint ett_krb_ad_ap_options = -1;
#ifdef HAVE_KERBEROS
static gint ett_krb_pa_enc_ts_enc = -1;
static gint ett_kerberos_KrbFastFinished = -1;
static gint ett_kerberos_KrbFastResponse = -1;
static gint ett_kerberos_KrbFastReq = -1;
static gint ett_kerberos_FastOptions = -1;
#endif
/*--- Included file: packet-kerberos-ett.c ---*/
#line 1 "./asn1/kerberos/packet-kerberos-ett.c"
static gint ett_kerberos_Applications = -1;
static gint ett_kerberos_PrincipalName = -1;
static gint ett_kerberos_SEQUENCE_OF_KerberosString = -1;
static gint ett_kerberos_CName = -1;
static gint ett_kerberos_SEQUENCE_OF_CNameString = -1;
static gint ett_kerberos_SName = -1;
static gint ett_kerberos_SEQUENCE_OF_SNameString = -1;
static gint ett_kerberos_HostAddress = -1;
static gint ett_kerberos_HostAddresses = -1;
static gint ett_kerberos_AuthorizationData = -1;
static gint ett_kerberos_AuthorizationData_item = -1;
static gint ett_kerberos_PA_DATA = -1;
static gint ett_kerberos_EncryptionKey = -1;
static gint ett_kerberos_Checksum = -1;
static gint ett_kerberos_EncryptedTicketData = -1;
static gint ett_kerberos_EncryptedAuthorizationData = -1;
static gint ett_kerberos_EncryptedAuthenticator = -1;
static gint ett_kerberos_EncryptedKDCREPData = -1;
static gint ett_kerberos_EncryptedAPREPData = -1;
static gint ett_kerberos_EncryptedKrbPrivData = -1;
static gint ett_kerberos_EncryptedKrbCredData = -1;
static gint ett_kerberos_Ticket_U = -1;
static gint ett_kerberos_EncTicketPart_U = -1;
static gint ett_kerberos_TransitedEncoding = -1;
static gint ett_kerberos_KDC_REQ = -1;
static gint ett_kerberos_SEQUENCE_OF_PA_DATA = -1;
static gint ett_kerberos_KDC_REQ_BODY = -1;
static gint ett_kerberos_SEQUENCE_OF_ENCTYPE = -1;
static gint ett_kerberos_SEQUENCE_OF_Ticket = -1;
static gint ett_kerberos_KDC_REP = -1;
static gint ett_kerberos_EncKDCRepPart = -1;
static gint ett_kerberos_LastReq = -1;
static gint ett_kerberos_LastReq_item = -1;
static gint ett_kerberos_AP_REQ_U = -1;
static gint ett_kerberos_Authenticator_U = -1;
static gint ett_kerberos_AP_REP_U = -1;
static gint ett_kerberos_EncAPRepPart_U = -1;
static gint ett_kerberos_KRB_SAFE_U = -1;
static gint ett_kerberos_KRB_SAFE_BODY = -1;
static gint ett_kerberos_KRB_PRIV_U = -1;
static gint ett_kerberos_EncKrbPrivPart = -1;
static gint ett_kerberos_KRB_CRED_U = -1;
static gint ett_kerberos_EncKrbCredPart_U = -1;
static gint ett_kerberos_SEQUENCE_OF_KrbCredInfo = -1;
static gint ett_kerberos_KrbCredInfo = -1;
static gint ett_kerberos_KRB_ERROR_U = -1;
static gint ett_kerberos_METHOD_DATA = -1;
static gint ett_kerberos_PA_ENC_TIMESTAMP = -1;
static gint ett_kerberos_ETYPE_INFO_ENTRY = -1;
static gint ett_kerberos_ETYPE_INFO = -1;
static gint ett_kerberos_ETYPE_INFO2_ENTRY = -1;
static gint ett_kerberos_ETYPE_INFO2 = -1;
static gint ett_kerberos_APOptions = -1;
static gint ett_kerberos_TicketFlags = -1;
static gint ett_kerberos_KDCOptions = -1;
static gint ett_kerberos_PA_PAC_REQUEST = -1;
static gint ett_kerberos_PA_S4U2Self = -1;
static gint ett_kerberos_PA_S4U_X509_USER = -1;
static gint ett_kerberos_S4UUserID = -1;
static gint ett_kerberos_PAC_OPTIONS_FLAGS = -1;
static gint ett_kerberos_PA_PAC_OPTIONS = -1;
static gint ett_kerberos_KERB_AD_RESTRICTION_ENTRY_U = -1;
static gint ett_kerberos_ChangePasswdData = -1;
static gint ett_kerberos_PA_AUTHENTICATION_SET_ELEM = -1;
static gint ett_kerberos_KrbFastArmor = -1;
static gint ett_kerberos_PA_FX_FAST_REQUEST = -1;
static gint ett_kerberos_EncryptedKrbFastReq = -1;
static gint ett_kerberos_KrbFastArmoredReq = -1;
static gint ett_kerberos_PA_FX_FAST_REPLY = -1;
static gint ett_kerberos_EncryptedKrbFastResponse = -1;
static gint ett_kerberos_KrbFastArmoredRep = -1;
static gint ett_kerberos_EncryptedChallenge = -1;
/*--- End of included file: packet-kerberos-ett.c ---*/
#line 307 "./asn1/kerberos/packet-kerberos-template.c"
static expert_field ei_kerberos_missing_keytype = EI_INIT;
static expert_field ei_kerberos_decrypted_keytype = EI_INIT;
static expert_field ei_kerberos_learnt_keytype = EI_INIT;
static expert_field ei_kerberos_address = EI_INIT;
static expert_field ei_krb_gssapi_dlglen = EI_INIT;
static dissector_handle_t krb4_handle = NULL;
/* Global variables */
static guint32 gbl_keytype;
static gboolean gbl_do_col_info;
/*--- Included file: packet-kerberos-val.h ---*/
#line 1 "./asn1/kerberos/packet-kerberos-val.h"
#define id_krb5 "1.3.6.1.5.2"
typedef enum _KERBEROS_AUTHDATA_TYPE_enum {
KERBEROS_AD_IF_RELEVANT = 1,
KERBEROS_AD_INTENDED_FOR_SERVER = 2,
KERBEROS_AD_INTENDED_FOR_APPLICATION_CLASS = 3,
KERBEROS_AD_KDC_ISSUED = 4,
KERBEROS_AD_AND_OR = 5,
KERBEROS_AD_MANDATORY_TICKET_EXTENSIONS = 6,
KERBEROS_AD_IN_TICKET_EXTENSIONS = 7,
KERBEROS_AD_MANDATORY_FOR_KDC = 8,
KERBEROS_AD_INITIAL_VERIFIED_CAS = 9,
KERBEROS_AD_OSF_DCE = 64,
KERBEROS_AD_SESAME = 65,
KERBEROS_AD_OSF_DCE_PKI_CERTID = 66,
KERBEROS_AD_AUTHENTICATION_STRENGTH = 70,
KERBEROS_AD_FX_FAST_ARMOR = 71,
KERBEROS_AD_FX_FAST_USED = 72,
KERBEROS_AD_WIN2K_PAC = 128,
KERBEROS_AD_GSS_API_ETYPE_NEGOTIATION = 129,
KERBEROS_AD_TOKEN_RESTRICTIONS = 141,
KERBEROS_AD_LOCAL = 142,
KERBEROS_AD_AP_OPTIONS = 143,
KERBEROS_AD_TARGET_PRINCIPAL = 144,
KERBEROS_AD_SIGNTICKET_OLDER = -17,
KERBEROS_AD_SIGNTICKET = 512
} KERBEROS_AUTHDATA_TYPE_enum;
/* enumerated values for ADDR_TYPE */
#define KERBEROS_ADDR_TYPE_IPV4 2
#define KERBEROS_ADDR_TYPE_CHAOS 5
#define KERBEROS_ADDR_TYPE_XEROX 6
#define KERBEROS_ADDR_TYPE_ISO 7
#define KERBEROS_ADDR_TYPE_DECNET 12
#define KERBEROS_ADDR_TYPE_APPLETALK 16
#define KERBEROS_ADDR_TYPE_NETBIOS 20
#define KERBEROS_ADDR_TYPE_IPV6 24
typedef enum _KERBEROS_PADATA_TYPE_enum {
KERBEROS_PA_NONE = 0,
KERBEROS_PA_TGS_REQ = 1,
KERBEROS_PA_ENC_TIMESTAMP = 2,
KERBEROS_PA_PW_SALT = 3,
KERBEROS_PA_ENC_UNIX_TIME = 5,
KERBEROS_PA_SANDIA_SECUREID = 6,
KERBEROS_PA_SESAME = 7,
KERBEROS_PA_OSF_DCE = 8,
KERBEROS_PA_CYBERSAFE_SECUREID = 9,
KERBEROS_PA_AFS3_SALT = 10,
KERBEROS_PA_ETYPE_INFO = 11,
KERBEROS_PA_SAM_CHALLENGE = 12,
KERBEROS_PA_SAM_RESPONSE = 13,
KERBEROS_PA_PK_AS_REQ_19 = 14,
KERBEROS_PA_PK_AS_REP_19 = 15,
KERBEROS_PA_PK_AS_REQ = 16,
KERBEROS_PA_PK_AS_REP = 17,
KERBEROS_PA_PK_OCSP_RESPONSE = 18,
KERBEROS_PA_ETYPE_INFO2 = 19,
KERBEROS_PA_USE_SPECIFIED_KVNO = 20,
KERBEROS_PA_SAM_REDIRECT = 21,
KERBEROS_PA_GET_FROM_TYPED_DATA = 22,
KERBEROS_TD_PADATA = 22,
KERBEROS_PA_SAM_ETYPE_INFO = 23,
KERBEROS_PA_ALT_PRINC = 24,
KERBEROS_PA_SERVER_REFERRAL = 25,
KERBEROS_PA_SAM_CHALLENGE2 = 30,
KERBEROS_PA_SAM_RESPONSE2 = 31,
KERBEROS_PA_EXTRA_TGT = 41,
KERBEROS_TD_PKINIT_CMS_CERTIFICATES = 101,
KERBEROS_TD_KRB_PRINCIPAL = 102,
KERBEROS_TD_KRB_REALM = 103,
KERBEROS_TD_TRUSTED_CERTIFIERS = 104,
KERBEROS_TD_CERTIFICATE_INDEX = 105,
KERBEROS_TD_APP_DEFINED_ERROR = 106,
KERBEROS_TD_REQ_NONCE = 107,
KERBEROS_TD_REQ_SEQ = 108,
KERBEROS_TD_DH_PARAMETERS = 109,
KERBEROS_TD_CMS_DIGEST_ALGORITHMS = 111,
KERBEROS_TD_CERT_DIGEST_ALGORITHMS = 112,
KERBEROS_PA_PAC_REQUEST = 128,
KERBEROS_PA_FOR_USER = 129,
KERBEROS_PA_FOR_X509_USER = 130,
KERBEROS_PA_FOR_CHECK_DUPS = 131,
KERBEROS_PA_PK_AS_09_BINDING = 132,
KERBEROS_PA_FX_COOKIE = 133,
KERBEROS_PA_AUTHENTICATION_SET = 134,
KERBEROS_PA_AUTH_SET_SELECTED = 135,
KERBEROS_PA_FX_FAST = 136,
KERBEROS_PA_FX_ERROR = 137,
KERBEROS_PA_ENCRYPTED_CHALLENGE = 138,
KERBEROS_PA_OTP_CHALLENGE = 141,
KERBEROS_PA_OTP_REQUEST = 142,
KERBEROS_PA_OTP_CONFIRM = 143,
KERBEROS_PA_OTP_PIN_CHANGE = 144,
KERBEROS_PA_EPAK_AS_REQ = 145,
KERBEROS_PA_EPAK_AS_REP = 146,
KERBEROS_PA_PKINIT_KX = 147,
KERBEROS_PA_PKU2U_NAME = 148,
KERBEROS_PA_REQ_ENC_PA_REP = 149,
KERBEROS_PA_SUPPORTED_ETYPES = 165,
KERBEROS_PA_EXTENDED_ERROR = 166,
KERBEROS_PA_PAC_OPTIONS = 167,
KERBEROS_PA_PROV_SRV_LOCATION = -1
} KERBEROS_PADATA_TYPE_enum;
typedef enum _KERBEROS_KRBFASTARMORTYPES_enum {
KERBEROS_FX_FAST_RESERVED = 0,
KERBEROS_FX_FAST_ARMOR_AP_REQUEST = 1
} KERBEROS_KRBFASTARMORTYPES_enum;
/*--- End of included file: packet-kerberos-val.h ---*/
#line 321 "./asn1/kerberos/packet-kerberos-template.c"
static void
call_kerberos_callbacks(packet_info* pinfo, proto_tree* tree, tvbuff_t* tvb, int tag, kerberos_callbacks* cb)
{
if (!cb) {
return;
}
while (cb->tag) {
if (cb->tag == tag) {
cb->callback(pinfo, tvb, tree);
return;
}
cb++;
}
return;
}
static kerberos_private_data_t*
kerberos_new_private_data(void)
{
kerberos_private_data_t* p;
p = wmem_new0(wmem_packet_scope(), kerberos_private_data_t);
if (p == NULL) {
return NULL;
}
p->decryption_keys = wmem_list_new(wmem_packet_scope());
p->learnt_keys = wmem_list_new(wmem_packet_scope());
p->missing_keys = wmem_list_new(wmem_packet_scope());
return p;
}
static kerberos_private_data_t*
kerberos_get_private_data(asn1_ctx_t* actx)
{
if (!actx->private_data) {
actx->private_data = kerberos_new_private_data();
}
return (kerberos_private_data_t*)(actx->private_data);
}
static gboolean
kerberos_private_is_kdc_req(kerberos_private_data_t* private_data)
{
switch (private_data->msg_type) {
case KERBEROS_APPLICATIONS_AS_REQ:
case KERBEROS_APPLICATIONS_TGS_REQ:
return TRUE;
}
return FALSE;
}
gboolean
kerberos_is_win2k_pkinit(asn1_ctx_t* actx)
{
kerberos_private_data_t* private_data = kerberos_get_private_data(actx);
return private_data->is_win2k_pkinit;
}
#ifdef HAVE_KERBEROS
/* Decrypt Kerberos blobs */
gboolean krb_decrypt = FALSE;
/* keytab filename */
static const char* keytab_filename = "";
void
read_keytab_file_from_preferences(void)
{
static char* last_keytab = NULL;
if (!krb_decrypt) {
return;
}
if (keytab_filename == NULL) {
return;
}
if (last_keytab && !strcmp(last_keytab, keytab_filename)) {
return;
}
g_free(last_keytab);
last_keytab = g_strdup(keytab_filename);
read_keytab_file(last_keytab);
}
#endif /* HAVE_KERBEROS */
#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
enc_key_t* enc_key_list = NULL;
static guint kerberos_longterm_ids = 0;
wmem_map_t* kerberos_longterm_keys = NULL;
static wmem_map_t* kerberos_all_keys = NULL;
static wmem_map_t* kerberos_app_session_keys = NULL;
static gboolean
enc_key_list_cb(wmem_allocator_t* allocator _U_, wmem_cb_event_t event _U_, void* user_data _U_)
{
enc_key_list = NULL;
kerberos_longterm_ids = 0;
/* keep the callback registered */
return TRUE;
}
static gint enc_key_cmp_id(gconstpointer k1, gconstpointer k2)
{
const enc_key_t* key1 = (const enc_key_t*)k1;
const enc_key_t* key2 = (const enc_key_t*)k2;
if (key1->fd_num < key2->fd_num) {
return -1;
}
if (key1->fd_num > key2->fd_num) {
return 1;
}
if (key1->id < key2->id) {
return -1;
}
if (key1->id > key2->id) {
return 1;
}
return 0;
}
static gboolean
enc_key_content_equal(gconstpointer k1, gconstpointer k2)
{
const enc_key_t* key1 = (const enc_key_t*)k1;
const enc_key_t* key2 = (const enc_key_t*)k2;
int cmp;
if (key1->keytype != key2->keytype) {
return FALSE;
}
if (key1->keylength != key2->keylength) {
return FALSE;
}
cmp = memcmp(key1->keyvalue, key2->keyvalue, key1->keylength);
if (cmp != 0) {
return FALSE;
}
return TRUE;
}
static guint
enc_key_content_hash(gconstpointer k)
{
const enc_key_t* key = (const enc_key_t*)k;
guint ret = 0;
ret += wmem_strong_hash((const guint8*)&key->keytype,
sizeof(key->keytype));
ret += wmem_strong_hash((const guint8*)&key->keylength,
sizeof(key->keylength));
ret += wmem_strong_hash((const guint8*)key->keyvalue,
key->keylength);
return ret;
}
static void
kerberos_key_map_insert(wmem_map_t* key_map, enc_key_t* new_key)
{
enc_key_t* existing = NULL;
enc_key_t* cur = NULL;
gint cmp;
existing = (enc_key_t*)wmem_map_lookup(key_map, new_key);
if (existing == NULL) {
wmem_map_insert(key_map, new_key, new_key);
return;
}
if (key_map != kerberos_all_keys) {
/*
* It should already be linked to the existing key...
*/
return;
}
if (existing->fd_num == -1 && new_key->fd_num != -1) {
/*
* We can't reference a learnt key
* from a longterm key. As they have
* a shorter lifetime.
*
* So just let the learnt key remember the
* match.
*/
new_key->same_list = existing;
new_key->num_same = existing->num_same + 1;
return;
}
/*
* If a key with the same content (keytype,keylength,keyvalue)
* already exists, we want the earliest key to be
* in the list.
*/
cmp = enc_key_cmp_id(new_key, existing);
if (cmp == 0) {
/*
* It's the same, nothing to do...
*/
return;
}
if (cmp < 0) {
/* The new key has should be added to the list. */
new_key->same_list = existing;
new_key->num_same = existing->num_same + 1;
wmem_map_insert(key_map, new_key, new_key);
return;
}
/*
* We want to link the new_key to the existing one.
*
* But we want keep the list sorted, so we need to forward
* to the correct spot.
*/
for (cur = existing; cur->same_list != NULL; cur = cur->same_list) {
cmp = enc_key_cmp_id(new_key, cur->same_list);
if (cmp == 0) {
/*
* It's the same, nothing to do...
*/
return;
}
if (cmp < 0) {
/*
* We found the correct spot,
* the new_key should added
* between existing and existing->same_list
*/
new_key->same_list = cur->same_list;
new_key->num_same = cur->num_same;
break;
}
}
/*
* finally link new_key to existing
* and fix up the numbers
*/
cur->same_list = new_key;
for (cur = existing; cur != new_key; cur = cur->same_list) {
cur->num_same += 1;
}