messages

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/messages"

const (
    // MsgTypeASReq is the Authentication Service Request message type.
    MsgTypeASReq = 10
    // MsgTypeASRep is the Authentication Service Reply message type.
    MsgTypeASRep = 11
    // MsgTypeTGSReq is the Ticket Granting Service Request message type.
    MsgTypeTGSReq = 12
    // MsgTypeTGSRep is the Ticket Granting Service Reply message type.
    MsgTypeTGSRep = 13
    // MsgTypeAPReq is the Application Request message type.
    MsgTypeAPReq = 14
    // MsgTypeAPRep is the Application Reply message type.
    MsgTypeAPRep = 15
    // MsgTypeError is the KRB-ERROR message type.
    MsgTypeError = 30
)

const (
    // NameTypePrincipal is the general principal name type (NT-PRINCIPAL).
    NameTypePrincipal = 1
    // NameTypeSRVInst is the service instance name type (NT-SRV-INST).
    NameTypeSRVInst = 2
    // NameTypeSRVHST is the service with host name type (NT-SRV-HST).
    NameTypeSRVHST = 3
    // NameTypeEnterprise is the enterprise name type (NT-ENTERPRISE).
    NameTypeEnterprise = 10
)

const (
    // ETypeRC4HMAC is the RC4-HMAC encryption type (etype 23), per RFC 4757.
    ETypeRC4HMAC = 23
    // ETypeAES128CTSHMACSHA196 is AES-128-CTS-HMAC-SHA1-96 (etype 17), per RFC 3962.
    ETypeAES128CTSHMACSHA196 = 17
    // ETypeAES256CTSHMACSHA196 is AES-256-CTS-HMAC-SHA1-96 (etype 18), per RFC 3962.
    ETypeAES256CTSHMACSHA196 = 18
)

const (
    // PATGSReq is the TGS-REQ pre-auth type (PA-TGS-REQ).
    PATGSReq = 1
    // PAEncTimestamp is the encrypted timestamp pre-auth type (PA-ENC-TIMESTAMP).
    PAEncTimestamp = 2
    // PAETypeInfo2 is the encryption type info version 2 pre-auth type (PA-ETYPE-INFO2).
    PAETypeInfo2 = 19
    // PAPACRequest is the Microsoft PA-PAC-REQUEST pre-auth type (MS-KILE).
    // Required by Windows KDCs to avoid silent dropping of AS-REQs without pre-auth.
    PAPACRequest = 128
)

const (
    // ErrNone indicates no error.
    ErrNone = 0
    // ErrCPrincipalUnknown is KDC_ERR_C_PRINCIPAL_UNKNOWN: client not found in database.
    ErrCPrincipalUnknown = 6
    // ErrKDCUnavailable is KRB_ERR_GENERIC: KDC unavailable.
    ErrKDCUnavailable = 13
    // ErrPreauthRequired is KDC_ERR_PREAUTH_REQUIRED: pre-authentication required.
    ErrPreauthRequired = 25
)

const (
    // APOptionUseSessionKey requests use of session key instead of service key.
    APOptionUseSessionKey = 1
    // APOptionMutualAuth requests mutual authentication.
    APOptionMutualAuth = 2
)

const (
    // TicketFlagForwardable marks the ticket as forwardable.
    TicketFlagForwardable = 1
    // TicketFlagForwarded marks the ticket as forwarded.
    TicketFlagForwarded = 2
    // TicketFlagProxiable marks the ticket as proxiable.
    TicketFlagProxiable = 3
    // TicketFlagProxy marks the ticket as a proxy ticket.
    TicketFlagProxy = 4
    // TicketFlagPreAuthent marks the ticket as pre-authenticated.
    TicketFlagPreAuthent = 6
    // TicketFlagInitial marks the ticket as an initial ticket.
    TicketFlagInitial = 7
    // TicketFlagRenewable marks the ticket as renewable.
    TicketFlagRenewable = 8
)

const KerberosV5 = 5

type APReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeAPReq = 14).
    MsgType int
    // APOptions contains bit flags controlling the AP exchange.
    APOptions asn1.BitString
    // Ticket is the service ticket (parsed form).
    Ticket Ticket
    // TicketRaw holds raw APPLICATION[1] bytes from the KDC, used verbatim in Marshal
    // to avoid re-encoding the ticket (which might differ from the KDC's original encoding).
    TicketRaw []byte
    // Authenticator is the encrypted Authenticator proving the client's identity.
    Authenticator EncryptedData
}

func (r *APReq) Marshal() ([]byte, error)

func (r *APReq) Unmarshal(data []byte) (int, error)

type ASRep struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeASRep = 11).
    MsgType int
    // PAData contains pre-authentication data (rarely set in AS-REP).
    PAData []PAData
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name as returned by the KDC.
    CName PrincipalName
    // Ticket is the issued Ticket Granting Ticket (parsed).
    Ticket Ticket
    // TicketRaw holds the raw APPLICATION[1] ticket bytes as received from the KDC.
    // Use these verbatim in AP-REQ to avoid re-encoding differences.
    TicketRaw []byte
    // EncPart is the encrypted reply body, decryptable with the client's key.
    EncPart EncryptedData
}

func (r *ASRep) Marshal() ([]byte, error)

func (r *ASRep) Unmarshal(data []byte) (int, error)

type ASReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeASReq = 10).
    MsgType int
    // PAData contains pre-authentication data (e.g. PA-ENC-TIMESTAMP).
    PAData []PAData
    // ReqBody is the KDC request body containing client/server names and options.
    ReqBody KDCReqBody
}

func (r *ASReq) Marshal() ([]byte, error)

func (r *ASReq) Unmarshal(data []byte) (int, error)

type Authenticator struct {
    // AVno is the Authenticator version number (always 5).
    AVno int
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name.
    CName PrincipalName
    // CUSec is the microseconds component of CTime.
    CUSec int
    // CTime is the client's current time (must match server time within clock skew).
    CTime time.Time
    // SubKey is an optional client-chosen sub-session key.
    SubKey *EncryptionKey
    // SeqNumber is the optional sequence number.
    SeqNumber int
}

func (a *Authenticator) Marshal() ([]byte, error)

func (a *Authenticator) Unmarshal(data []byte) (int, error)

type AuthorizationData struct {
    // ADType identifies the authorization-data type.
    ADType int `asn1:"explicit,tag:0"`
    // ADData contains the type-specific authorization data.
    ADData []byte `asn1:"explicit,tag:1"`
}

type Checksum struct {
    // CKSumType identifies the checksum algorithm.
    CKSumType int `asn1:"explicit,tag:0"`
    // Checksum contains the raw checksum bytes.
    Checksum []byte `asn1:"explicit,tag:1"`
}

type ETypeInfo2 []ETypeInfo2Entry

func (e ETypeInfo2) Marshal() ([]byte, error)

func (e *ETypeInfo2) Unmarshal(data []byte) (int, error)

type ETypeInfo2Entry struct {
    // EType identifies the encryption type.
    EType int `asn1:"explicit,tag:0"`
    // Salt is the optional salt string for string-to-key derivation.
    Salt string `asn1:"explicit,tag:1,optional,utf8"`
    // S2KParams contains optional string-to-key parameters (e.g. iteration count).
    S2KParams []byte `asn1:"explicit,tag:2,optional"`
}

type EncASRepPart struct {
    // Key is the session key for use with the issued ticket.
    Key EncryptionKey
    // Nonce must match the nonce in the AS-REQ.
    Nonce int
    // Flags contains the ticket flags.
    Flags asn1.BitString
    // AuthTime is the time the client was authenticated.
    AuthTime time.Time
    // StartTime is the ticket's start time (optional).
    StartTime time.Time
    // EndTime is the ticket's expiry time.
    EndTime time.Time
    // RenewTill is the renewable lifetime end time (optional).
    RenewTill time.Time
    // SRealm is the realm of the service.
    SRealm string
    // SName is the service principal name.
    SName PrincipalName
}

func (e *EncASRepPart) Unmarshal(data []byte) (int, error)

type EncTGSRepPart struct {
    // Key is the session key for use with the service ticket.
    Key EncryptionKey
    // Nonce must match the nonce in the TGS-REQ.
    Nonce int
    // Flags contains the ticket flags.
    Flags asn1.BitString
    // AuthTime is the time of original authentication.
    AuthTime time.Time
    // StartTime is the ticket's start time (optional).
    StartTime time.Time
    // EndTime is the ticket's expiry time.
    EndTime time.Time
    // RenewTill is the renewable lifetime end time (optional).
    RenewTill time.Time
    // SRealm is the realm of the service.
    SRealm string
    // SName is the service principal name.
    SName PrincipalName
}

func (e *EncTGSRepPart) Unmarshal(data []byte) (int, error)

type EncryptedData struct {
    // EType identifies the encryption algorithm used.
    EType int `asn1:"explicit,tag:0"`
    // KvNo is the optional key version number.
    KvNo int `asn1:"explicit,tag:1,optional"`
    // Cipher contains the encrypted bytes.
    Cipher []byte `asn1:"explicit,tag:2"`
}

type EncryptionKey struct {
    // KeyType identifies the encryption algorithm.
    KeyType int `asn1:"explicit,tag:0"`
    // KeyValue contains the raw key bytes.
    KeyValue []byte `asn1:"explicit,tag:1"`
}

type HostAddress struct {
    // AddrType identifies the address type (e.g. 2 = IPv4, 24 = IPv6).
    AddrType int `asn1:"explicit,tag:0"`
    // Address contains the raw address bytes.
    Address []byte `asn1:"explicit,tag:1"`
}

type KDCOptions = asn1.BitString

type KDCReqBody struct {
    // KDCOptions contains bit flags controlling the KDC request behavior.
    KDCOptions asn1.BitString `asn1:"explicit,tag:0"`
    // CName is the client principal name (present in AS-REQ, absent in TGS-REQ).
    CName PrincipalName `asn1:"explicit,tag:1,optional"`
    // Realm is the realm for the request (crealm in AS-REQ, srealm in TGS-REQ).
    Realm string `asn1:"explicit,tag:2,generalstring"`
    // SName is the server principal name being requested.
    SName PrincipalName `asn1:"explicit,tag:3,optional"`
    // From is the requested start time for the ticket (optional).
    From time.Time `asn1:"explicit,tag:4,optional,generalized"`
    // Till is the requested expiry time for the ticket.
    Till time.Time `asn1:"explicit,tag:5,generalized"`
    // RTime is the requested renewable lifetime end time (optional).
    RTime time.Time `asn1:"explicit,tag:6,optional,generalized"`
    // Nonce is a random number used to detect replays.
    Nonce int `asn1:"explicit,tag:7"`
    // EType lists the client's supported encryption types, in preference order.
    EType []int `asn1:"explicit,tag:8"`
    // Addresses restricts the ticket to specific network addresses (optional).
    Addresses []HostAddress `asn1:"explicit,tag:9,optional"`
    // EncAuthData contains encrypted authorization data (optional, TGS-REQ).
    EncAuthData EncryptedData `asn1:"explicit,tag:10,optional"`
    // AdditTickets contains additional tickets (optional, for TGS renewal/forwarding).
    AdditTickets []Ticket `asn1:"explicit,tag:11,optional"`
}

type KRBError struct {
    // PVNO is the Kerberos protocol version.
    PVNO int
    // MsgType is the message type (MsgTypeError = 30).
    MsgType int
    // STime is the server time at which the error occurred.
    STime time.Time
    // SUSec is the microsecond component of STime.
    SUSec int
    // ErrorCode identifies the specific error.
    ErrorCode int
    // Realm is the server's realm.
    Realm string
    // SName is the server's principal name.
    SName PrincipalName
    // EText is a human-readable error description.
    EText string
    // EData contains additional structured error information.
    EData []byte
}

func (e *KRBError) Error() string

func (e *KRBError) Marshal() ([]byte, error)

func (e *KRBError) Unmarshal(data []byte) (int, error)

type KerberosTime = time.Time

type LastReq struct {
    // LRType identifies the type of last request.
    LRType int `asn1:"explicit,tag:0"`
    // LRValue is the time of the last request.
    LRValue time.Time `asn1:"explicit,tag:1,generalized"`
}

type PAData struct {
    // PADataType identifies the pre-authentication data type.
    PADataType int `asn1:"explicit,tag:1"`
    // PADataValue contains the pre-authentication data bytes.
    PADataValue []byte `asn1:"explicit,tag:2"`
}

type PAEncTSEnc struct {
    // PATimestamp is the client's current time.
    PATimestamp time.Time `asn1:"explicit,tag:0,generalized"`
    // PAUSec is the optional microseconds component of PATimestamp.
    PAUSec int `asn1:"explicit,tag:1,optional"`
}

func (p *PAEncTSEnc) Marshal() ([]byte, error)

func (p *PAEncTSEnc) Unmarshal(data []byte) (int, error)

type PrincipalName struct {
    // NameType specifies the type of name (e.g. NT-PRINCIPAL = 1).
    NameType int `asn1:"explicit,tag:0"`
    // NameString contains the sequence of name components.
    NameString []string `asn1:"explicit,tag:1"`
}

type PrincipalNameMarshal struct {
    NameType   int             `asn1:"explicit,tag:0"`
    NameString []asn1.RawValue `asn1:"explicit,tag:1"`
}

func MarshalPrincipalName(pn PrincipalName) PrincipalNameMarshal

type TGSRep struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeTGSRep = 13).
    MsgType int
    // PAData contains pre-authentication data (rarely set in TGS-REP).
    PAData []PAData
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name.
    CName PrincipalName
    // Ticket is the issued service ticket (parsed).
    Ticket Ticket
    // TicketRaw holds the raw APPLICATION[1] ticket bytes as received from the
    // KDC. Use these verbatim when embedding the ticket in an AP-REQ to avoid
    // re-encoding differences between Go's encoding/asn1 and the KDC's original
    // DER output (see ASRep.TicketRaw for the matching field on AS-REP).
    TicketRaw []byte
    // EncPart is the encrypted reply body, decryptable with the TGT session key.
    EncPart EncryptedData
}

func (r *TGSRep) Marshal() ([]byte, error)

func (r *TGSRep) Unmarshal(data []byte) (int, error)

type TGSReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeTGSReq = 12).
    MsgType int
    // PAData contains the PA-TGS-REQ with the AP-REQ carrying the TGT.
    PAData []PAData
    // ReqBody is the request body specifying the requested service ticket parameters.
    ReqBody KDCReqBody
}

func (r *TGSReq) Marshal() ([]byte, error)

func (r *TGSReq) Unmarshal(data []byte) (int, error)

type Ticket struct {
    // TktVno is the Kerberos version number embedded in the ticket (always 5).
    TktVno int
    // Realm is the realm of the service principal.
    Realm string
    // SName is the name of the service principal.
    SName PrincipalName
    // EncPart is the encrypted portion of the ticket.
    EncPart EncryptedData
}

func (t *Ticket) Marshal() ([]byte, error)

func (t *Ticket) Unmarshal(data []byte) (int, error)