KRB5(3)

📦 version 3.2, in debian trixie, fedora 43, fedora 44, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🌸 KRB5(3) 🌸

hiii bestie 💖 this is the manual page for packet.application.krb5, and it rides along with krb5 1.0. It's a long one so we're doing it in two parts — this is part 1, so don't go anywhere, okay? 🫶

✨ NAME ✨

packet.application.krb5 — the KRB5 module, that's it, that's the whole name, periodt 💅

🦋 DESCRIPTION 🦋

Okay so, real talk: this module decodes the KRB5 layer. The decoding is done using ASN.1 DER (Distinguished Encoding Representation) — you know, the strict little encoding that does NOT play games. 😌

It's built to follow these two RFCs, and they are iconic:

  • RFC 4120 — <b>The Kerberos Network Authentication Service (V5)</b>
  • RFC 6113 — <b>A Generalized Framework for Kerberos Pre-Authentication</b>

🎀 CLASSES 🎀

okay this is the big part, stay with me 💖 every single class is listed below, and yes, we're doing all of them, no skips, no shortcuts. 🫡

💅 class APOptions(packet.utils.OptionFlags)

AP Option flags — literally the flags for AP options. That's the vibe. ✨

🌸 class AP_REP(baseobj.BaseObj)

The definition, verbatim, because ASN.1 does not do ~approximately~:

AP-REP  ::= [APPLICATION 15] SEQUENCE {
    pvno      [0] INTEGER (5),
    msg-type  [1] INTEGER (15),
    enc-part  [2] EncryptedData -- EncAPRepPart
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Sets up the object's private data based on whatever args you hand it. You can pass them positionally, by name, or a lil mix of both. your call, bestie 🫶

🦋 class AP_REQ(baseobj.BaseObj)

AP-REQ  ::= [APPLICATION 14] SEQUENCE {
    pvno           [0] INTEGER (5),
    msg-type       [1] INTEGER (14),
    options        [2] APOptions,
    ticket         [3] Ticket,
    authenticator  [4] EncryptedData -- Authenticator
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data according to the arguments you give. Positional, named, or a combo — all valid. ✨

🎀 class Checksum(baseobj.BaseObj)

Checksum  ::= SEQUENCE {
    cksumtype  [0] Int32,
    checksum   [1] OCTET STRING
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Wires up the object's private data from the arguments passed in, whether that's positional, named, or both together. 💜

⭐ class EncryptedData(baseobj.BaseObj)

EncryptedData  ::= SEQUENCE {
    etype   [0] Int32 -- EncryptionType --,
    kvno    [1] UInt32 OPTIONAL,
    cipher  [2] OCTET STRING -- ciphertext
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Fills the object's private data per the arguments given. Positional args, named args, or a blend of the two — whatever feels right. 😌

🧚 class EtypeInfo2Entry(baseobj.BaseObj)

ETYPE-INFO2-ENTRY  ::= SEQUENCE {
    etype      [0] Int32,
    salt       [1] KerberosString OPTIONAL,
    s2kparams  [2] OCTET STRING OPTIONAL
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Sets up the object's private data according to the arguments supplied. Positional, named, or a mix of both — all fine. 🎀

🌈 class HostAddress(baseobj.BaseObj)

HostAddress  ::= SEQUENCE  {
    addr-type  [0] Int32,
    address    [1] OCTET STRING
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data based on the args you give it. Positional, named, or a combination of the two. 🦋

👑 class KDCOptions(packet.utils.OptionFlags)

KDC Option flags — the flags, for KDC options. Short and sweet, we love her. 💅

💖 class KDC_REP(baseobj.BaseObj)

KDC-REP  ::= SEQUENCE {
    pvno      [0] INTEGER (5),
    msg-type  [1] INTEGER (11 -- AS -- | 13 -- TGS --),
    padata    [2] SEQUENCE OF PA-DATA OPTIONAL
                  -- NOTE: not empty --,
    crealm    [3] Realm,
    cname     [4] PrincipalName,
    ticket    [5] Ticket,
    enc-part  [6] EncryptedData
                  -- EncASRepPart or EncTGSRepPart,
                  -- as appropriate
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Sets the object's private data according to the arguments given. Positional, named, or both at once — go off. ✨

🎀 class KDC_REQ(baseobj.BaseObj)

heads up, bestie — peep the note, the first tag is [1], <b>not</b> [0]. Don't come for me, it's right there in the source:

KDC-REQ  ::= SEQUENCE {
    -- NOTE: first tag is [1], not [0]
    pvno      [1] INTEGER (5) ,
    msg-type  [2] INTEGER (10 -- AS -- | 12 -- TGS --),
    padata    [3] SEQUENCE OF PA-DATA OPTIONAL
                  -- NOTE: not empty --,
    req-body  [4] KDC-REQ-BODY
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data per the arguments passed. Positional, named, or a mix of both — all good. 💜

🌸 class KDC_REQ_BODY(baseobj.BaseObj)

KDC-REQ-BODY  ::= SEQUENCE {
    options                  [0] KDCOptions,
    cname                    [1] PrincipalName OPTIONAL
                                 -- Used only in AS-REQ --,
    realm                    [2] Realm
                                 -- Server's realm
                                 -- Also client's in AS-REQ --,
    sname                    [3] PrincipalName OPTIONAL,
    from                     [4] KerberosTime OPTIONAL,
    till                     [5] KerberosTime,
    rtime                    [6] KerberosTime OPTIONAL,
    nonce                    [7] UInt32,
    etype                    [8] SEQUENCE OF Int32 -- EncryptionType
                                 -- in preference order --,
    addresses                [9] HostAddresses OPTIONAL,
    enc-authorization-data  [10] EncryptedData OPTIONAL
                                 -- AuthorizationData --,
    additional-tickets      [11] SEQUENCE OF Ticket OPTIONAL
                                 -- NOTE: not empty
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Builds the object's private data according to the arguments given. Positional, named, or a combination of both. 🫶

🔥 class KRB5(baseobj.BaseObj)

the main character herself 👑 — the KRB5 object.

Usage ✨

from packet.application.krb5 import KRB5

# Decode KRB5 layer
x = KRB5(pktt, proto)

Object definition 🌈

KRB5(
    appid = int,  # Application Identifier
    kdata = KDC_REQ|KDC_REP|KRB_ERROR
}

Methods defined here 💅

  • __bool__(self) — Truth value testing for the built-in operation bool(). So you can just ask the object if it's true. vibe check, but make it Python. ✅
  • __init__(self, pktt, proto) — Constructor. Initializes the object's private data, and it takes:
    • pktt: the packet trace object (packet.pktt.Pktt), so this layer can reach up into its parent layers 🫶
    • proto: the transport layer protocol.

💀 class KRB_ERROR(baseobj.BaseObj)

KRB-ERROR  ::= [APPLICATION 30] SEQUENCE {
    pvno        [0] INTEGER (5),
    msg-type    [1] INTEGER (30),
    ctime       [2] KerberosTime OPTIONAL,
    cusec       [3] Microseconds OPTIONAL,
    stime       [4] KerberosTime,
    susec       [5] Microseconds,
    error-code  [6] Int32,
    crealm      [7] Realm OPTIONAL,
    cname       [8] PrincipalName OPTIONAL,
    realm       [9] Realm -- service realm --,
    sname       [10] PrincipalName -- service name --,
    e-text      [11] KerberosString OPTIONAL,
    e-data      [12] OCTET STRING OPTIONAL
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Sets up the object's private data according to the arguments given. Positional, named, or both together. 😭 (affectionate)

🛡️ class KrbFastArmor(baseobj.BaseObj)

KrbFastArmor  ::= SEQUENCE {
    armor-type   [0] Int32,
        -- Type of the armor.
    armor-value  [1] OCTET STRING,
        -- Value of the armor.
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data per the arguments you pass. Positional, named, or a mix of the two. ✨

🎀 class KrbFastArmoredRep(baseobj.BaseObj)

KrbFastArmoredRep ::= SEQUENCE {
   enc-fast-rep  [0] EncryptedData, -- KrbFastResponse --
       -- The encryption key is the armor key in the request, and
       -- the key usage number is KEY_USAGE_FAST_REP.
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Fills the object's private data according to the arguments given. Positional, named, or a combination of both. 💜

🌈 class KrbFastArmoredReq(baseobj.BaseObj)

KrbFastArmoredReq ::= SEQUENCE {
    armor        [0] KrbFastArmor OPTIONAL,
        -- Contains the armor that identifies the armor key.
        -- MUST be present in AS-REQ.
    req-checksum [1] Checksum,
        -- For AS, contains the checksum performed over the type
        -- KDC-REQ-BODY for the req-body field of the KDC-REQ
        -- structure;
        -- For TGS, contains the checksum performed over the type
        -- AP-REQ in the PA-TGS-REQ padata.
        -- The checksum key is the armor key, the checksum
        -- type is the required checksum type for the enctype of
        -- the armor key, and the key usage number is
        -- KEY_USAGE_FAST_REQ_CHKSUM.
    enc-fast-req [2] EncryptedData, -- KrbFastReq --
        -- The encryption key is the armor key, and the key usage
        -- number is KEY_USAGE_FAST_ENC.
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data according to the arguments given. Positional, named, or both — your pick. 🦋

🧚 class PrincipalName(baseobj.BaseObj)

PrincipalName  ::= SEQUENCE {
    name-type    [0] Int32,
    name-string  [1] SEQUENCE OF KerberosString
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Sets the object's private data according to the arguments supplied. Positional, named, or a mix of both. ✨

🎟️ class Ticket(baseobj.BaseObj)

Ticket  ::= [APPLICATION 1] SEQUENCE {
    tkt-vno   [0] INTEGER (5),
    realm     [1] Realm,
    sname     [2] PrincipalName,
    enc-part  [3] EncryptedData -- EncTicketPart
}

Methods defined here 💅

  • __init__(self, obj) — Constructor. Initializes the object's private data based on the arguments given. Positional, named, or a combination of both. 🫶

🌟 class krb5_addrtype(packet.utils.Enum)

enum krb5_addrtype — an enum. Short, iconic, no notes. 💅

🌟 class krb5_adtype(packet.utils.Enum)

enum krb5_adtype — also an enum. She's giving minimalism. ✨

🌟 class krb5_application(packet.utils.Enum)

enum krb5_application — enum behavior, no further commentary. 🎀

🌟 class krb5_ctype(packet.utils.Enum)

enum krb5_ctype — it's an enum, bestie. 💜

🌟 class krb5_etype(packet.utils.Enum)

enum krb5_etype — enum, exactly as the source says. 🦋

🌟 class krb5_fatype(packet.utils.Enum)

enum krb5_fatype — yep, an enum. 😌

🌟 class krb5_patype(packet.utils.Enum)

enum krb5_patype — an enum, we love a consistent queen. 🌸

🌟 class krb5_principal(packet.utils.Enum)

enum krb5_principal — last enum of part one, and she ate. 👑

class krb5_status(packet.utils.Enum) 💅

enum krb5_status

Okay bestie, it’s literally an enum named krb5_status. Slay. ✨

class paData(baseobj.BaseObj) 🎀

PA-DATA  ::= SEQUENCE {
    -- NOTE: first tag is [1], not [0]
    padata-type   [1] Int32,
    padata-value  [2] OCTET STRING
}

Methods defined here: 🫶

  • __init__(self, obj)

Constructor

Initialize object’s private data according to the arguments given. Arguments can be given as positional, named arguments or a combination of both.

✨ FUNCTIONS ✨ 🦋

  • KerberosTime(stime, usec=None) — Convert floating point time to a DateStr object, include the microseconds if given 💖
  • Optional(obj, objtype) — Get Optional item of the given object type 🔍
  • SequenceOf(obj, objtype) — SEQUENCE OF: return list of the given object type 📜

🌸 SEE ALSO 🌸 🌈

💀 BUGS 💀 😭

No known bugs.

👑 AUTHOR 👑 💜

Jorge Mora (mora@netapp.com)

Later, bestie! This whole vibe is from NFStest 3.2, dated 21 March 2023, and it’s KRB5(3). Periodt. 💅✨

📦 where this page comes from