The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

messages

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/messages"

Package messages provides Kerberos protocol message types and constants as defined in RFC 4120 and related specifications.

Index

Constants

The protocol constants live canonically in the iana leaf package. They are re-exported here as aliases so message code and existing callers can keep referring to messages.<Const>; iana remains the single source of truth.

const (
    KerberosV5 = iana.KerberosV5

    MsgTypeASReq   = iana.MsgTypeASReq
    MsgTypeASRep   = iana.MsgTypeASRep
    MsgTypeTGSReq  = iana.MsgTypeTGSReq
    MsgTypeTGSRep  = iana.MsgTypeTGSRep
    MsgTypeAPReq   = iana.MsgTypeAPReq
    MsgTypeAPRep   = iana.MsgTypeAPRep
    MsgTypeKRBCred = iana.MsgTypeKRBCred
    MsgTypeError   = iana.MsgTypeError

    NameTypePrincipal  = iana.NameTypePrincipal
    NameTypeSRVInst    = iana.NameTypeSRVInst
    NameTypeSRVHST     = iana.NameTypeSRVHST
    NameTypeEnterprise = iana.NameTypeEnterprise

    ETypeRC4HMAC             = iana.ETypeRC4HMAC
    ETypeAES128CTSHMACSHA196 = iana.ETypeAES128CTSHMACSHA196
    ETypeAES256CTSHMACSHA196 = iana.ETypeAES256CTSHMACSHA196
    ETypeAES128CTSHMACSHA256 = iana.ETypeAES128CTSHMACSHA256
    ETypeAES256CTSHMACSHA384 = iana.ETypeAES256CTSHMACSHA384

    PATGSReq             = iana.PATGSReq
    PAEncTimestamp       = iana.PAEncTimestamp
    PAETypeInfo2         = iana.PAETypeInfo2
    PAPACRequest         = iana.PAPACRequest
    PASvrReferralInfo    = iana.PASvrReferralInfo
    PAFXCookie           = iana.PAFXCookie
    PAFXFast             = iana.PAFXFast
    PAFXError            = iana.PAFXError
    PAEncryptedChallenge = iana.PAEncryptedChallenge
    PAPKASReq            = iana.PAPKASReq
    PAPKASRep            = iana.PAPKASRep
    PAPKASReqOld         = iana.PAPKASReqOld
    PAPKASRepOld         = iana.PAPKASRepOld

    ErrNone              = iana.ErrNone
    ErrCPrincipalUnknown = iana.ErrCPrincipalUnknown
    ErrSPrincipalUnknown = iana.ErrSPrincipalUnknown
    ErrPreauthFailed     = iana.ErrPreauthFailed
    ErrPreauthRequired   = iana.ErrPreauthRequired
    ErrSkew              = iana.ErrSkew
    ErrResponseTooBig    = iana.ErrResponseTooBig
    ErrWrongRealm        = iana.ErrWrongRealm

    APOptionUseSessionKey = iana.APOptionUseSessionKey
    APOptionMutualAuth    = iana.APOptionMutualAuth

    TicketFlagForwardable = iana.TicketFlagForwardable
    TicketFlagForwarded   = iana.TicketFlagForwarded
    TicketFlagProxiable   = iana.TicketFlagProxiable
    TicketFlagProxy       = iana.TicketFlagProxy
    TicketFlagMayPostdate = iana.TicketFlagMayPostdate
    TicketFlagPostdated   = iana.TicketFlagPostdated
    TicketFlagInvalid     = iana.TicketFlagInvalid
    TicketFlagPreAuthent  = iana.TicketFlagPreAuthent
    TicketFlagInitial     = iana.TicketFlagInitial
    TicketFlagRenewable   = iana.TicketFlagRenewable
)

FAST armor types (RFC 6113 §5.4.1). FX_FAST_ARMOR_AP_REQUEST carries a DER-encoded AP-REQ whose authenticator subkey, combined with the armor ticket’s session key, yields the armor key.

const (
    FXFastArmorAPRequest = 1 // FX_FAST_ARMOR_AP_REQUEST
)

FastOptions bit positions (RFC 6113 §5.4.2). Bit 0 is the MSB.

const (
    // FastOptionHideClientNames requests that the KDC omit the client identity
    // from error replies (a critical option).
    FastOptionHideClientNames = 1
)

func EncodeKDCReqBody

func EncodeKDCReqBody(b KDCReqBody) ([]byte, error)

EncodeKDCReqBody marshals a KDC-REQ-BODY to its bare SEQUENCE TLV (the DER of the “KDC-REQ-BODY” type, without the [4]/[2] context wrapper it carries inside a KDC-REQ or KrbFastReq). It is exported for FAST (RFC 6113), whose req-checksum is computed over exactly these bytes. Additional-tickets, when present, are spliced in with their correct APPLICATION[1] encoding.

func ExplicitGeneralString

func ExplicitGeneralString(tag int, s string) asn1.RawValue

ExplicitGeneralString returns s encoded as an ASN.1 [tag] EXPLICIT { GeneralString } context element. Exported for other packages (e.g. the MS-SFU PA-FOR-USER builder) that must emit GeneralString fields the standard library would otherwise encode as PrintableString.

func MarshalPAFXFastRequest

func MarshalPAFXFastRequest(req *KrbFastArmoredReq) ([]byte, error)

MarshalPAFXFastRequest encodes a KrbFastArmoredReq as the PA-FX-FAST-REQUEST padata-value (RFC 6113 §5.4.2):

PA-FX-FAST-REQUEST ::= CHOICE { armored-data [0] KrbFastArmoredReq, ... }

A CHOICE has no SEQUENCE wrapper: the value is the chosen alternative’s [0] EXPLICIT context element wrapping the KrbFastArmoredReq SEQUENCE.

func NewKerberosFlags

func NewKerberosFlags(bits ...int) asn1.BitString

NewKerberosFlags builds a KerberosFlags/KDCOptions/APOptions/TicketFlags BIT STRING from the given set bit positions. Per RFC 4120 Section 5.2.8 a KerberosFlags value is always at least 32 bits, sent in full (no DER trailing-zero truncation), with bit 0 the most-significant bit of the first octet. This helper guarantees that 32-bit, MSB-first encoding.

type APRep

APRep is a Kerberos AP-REP (Application Reply) message, APPLICATION[15], as defined in RFC 4120 Section 5.5.2. A service returns it to the client only when the AP-REQ set the mutual-required option; it proves the service holds the ticket session key. The enc-part is an encrypted EncAPRepPart (key usage 12, under the ticket session key).

type APRep struct {
    PVNO    int
    MsgType int
    EncPart EncryptedData
}

func (*APRep) Marshal

func (r *APRep) Marshal() ([]byte, error)

Marshal encodes the AP-REP as an ASN.1 APPLICATION[15] wrapped SEQUENCE.

func (*APRep) Unmarshal

func (r *APRep) Unmarshal(data []byte) (int, error)

Unmarshal decodes an AP-REP from an ASN.1 APPLICATION[15] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type APReq

APReq is a Kerberos AP-REQ (Application Request) message, APPLICATION[14], as defined in RFC 4120 Section 5.5.1. It is sent by the client to a service as part of mutual authentication, and is also embedded in TGS-REQ PA-DATA (PA-TGS-REQ).

type APReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeAPReq = 14).
    MsgType int
    // APOptions contains bit flags controlling the AP exchange.
    APOptions asn1.BitString
    // Ticket is the service ticket (parsed form).
    Ticket Ticket
    // TicketRaw holds raw APPLICATION[1] bytes from the KDC, used verbatim in Marshal
    // to avoid re-encoding the ticket (which might differ from the KDC's original encoding).
    TicketRaw []byte
    // Authenticator is the encrypted Authenticator proving the client's identity.
    Authenticator EncryptedData
}

func (*APReq) Marshal

func (r *APReq) Marshal() ([]byte, error)

Marshal encodes the AP-REQ as an ASN.1 APPLICATION[14] wrapped SEQUENCE.

func (*APReq) Unmarshal

func (r *APReq) Unmarshal(data []byte) (int, error)

Unmarshal decodes an AP-REQ from an ASN.1 APPLICATION[14] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type ASRep

ASRep is a Kerberos AS-REP (Authentication Service Reply) message, APPLICATION[11], as defined in RFC 4120 Section 5.4.2. It is sent by the KDC in response to a successful AS-REQ.

type ASRep struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeASRep = 11).
    MsgType int
    // PAData contains pre-authentication data (rarely set in AS-REP).
    PAData []PAData
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name as returned by the KDC.
    CName PrincipalName
    // Ticket is the issued Ticket Granting Ticket (parsed).
    Ticket Ticket
    // TicketRaw holds the raw APPLICATION[1] ticket bytes as received from the KDC.
    // Use these verbatim in AP-REQ to avoid re-encoding differences.
    TicketRaw []byte
    // EncPart is the encrypted reply body, decryptable with the client's key.
    EncPart EncryptedData
}

func (*ASRep) Marshal

func (r *ASRep) Marshal() ([]byte, error)

Marshal encodes the AS-REP as an ASN.1 APPLICATION[11] wrapped SEQUENCE.

func (*ASRep) Unmarshal

func (r *ASRep) Unmarshal(data []byte) (int, error)

Unmarshal decodes an AS-REP from an ASN.1 APPLICATION[11] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type ASReq

ASReq is a Kerberos AS-REQ (Authentication Service Request) message, APPLICATION[10], as defined in RFC 4120 Section 5.4.1. It is sent by the client to the KDC to request a TGT.

type ASReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeASReq = 10).
    MsgType int
    // PAData contains pre-authentication data (e.g. PA-ENC-TIMESTAMP).
    PAData []PAData
    // ReqBody is the KDC request body containing client/server names and options.
    ReqBody KDCReqBody
}

func (*ASReq) Marshal

func (r *ASReq) Marshal() ([]byte, error)

Marshal encodes the AS-REQ as an ASN.1 APPLICATION[10] wrapped SEQUENCE.

func (*ASReq) Unmarshal

func (r *ASReq) Unmarshal(data []byte) (int, error)

Unmarshal decodes an AS-REQ from an ASN.1 APPLICATION[10] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type Authenticator

Authenticator is a Kerberos Authenticator (APPLICATION[2]), as defined in RFC 4120 Section 5.5.1. It is encrypted within an AP-REQ and proves the client’s identity.

type Authenticator struct {
    // AVno is the Authenticator version number (always 5).
    AVno int
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name.
    CName PrincipalName
    // Cksum is an optional checksum over application data. The GSS-API mechanism
    // (RFC 1964) uses it to carry the 0x8003 channel-binding/flags structure.
    Cksum *Checksum
    // CUSec is the microseconds component of CTime.
    CUSec int
    // CTime is the client's current time (must match server time within clock skew).
    CTime time.Time
    // SubKey is an optional client-chosen sub-session key.
    SubKey *EncryptionKey
    // SeqNumber is the optional sequence number.
    SeqNumber int
}

func (*Authenticator) Marshal

func (a *Authenticator) Marshal() ([]byte, error)

Marshal encodes the Authenticator as an ASN.1 APPLICATION[2] wrapped SEQUENCE.

func (*Authenticator) Unmarshal

func (a *Authenticator) Unmarshal(data []byte) (int, error)

Unmarshal decodes an Authenticator from an ASN.1 APPLICATION[2] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type AuthorizationData

AuthorizationData is an authorization-data element, as defined in RFC 4120 Section 5.2.6.

type AuthorizationData struct {
    // ADType identifies the authorization-data type.
    ADType int `asn1:"explicit,tag:0"`
    // ADData contains the type-specific authorization data.
    ADData []byte `asn1:"explicit,tag:1"`
}

type Checksum

Checksum contains a cryptographic checksum as defined in RFC 4120 Section 5.2.9.

type Checksum struct {
    // CKSumType identifies the checksum algorithm.
    CKSumType int `asn1:"explicit,tag:0"`
    // Checksum contains the raw checksum bytes.
    Checksum []byte `asn1:"explicit,tag:1"`
}

type ETypeInfo2

ETypeInfo2 is a sequence of ETypeInfo2Entry values returned in PA-ETYPE-INFO2. The KDC uses this to tell the client which encryption types and salts to use.

type ETypeInfo2 []ETypeInfo2Entry

func (ETypeInfo2) Marshal

func (e ETypeInfo2) Marshal() ([]byte, error)

Marshal encodes ETypeInfo2 as an ASN.1 SEQUENCE OF.

func (*ETypeInfo2) Unmarshal

func (e *ETypeInfo2) Unmarshal(data []byte) (int, error)

Unmarshal decodes ETypeInfo2 from an ASN.1 SEQUENCE OF. Returns the number of bytes consumed from data.

type ETypeInfo2Entry

ETypeInfo2Entry is a single entry in a PA-ETYPE-INFO2 pre-authentication element, as defined in RFC 4120 Section 5.2.7.5. It specifies an encryption type and optional salt/parameters for string-to-key derivation.

type ETypeInfo2Entry struct {
    // EType identifies the encryption type.
    EType int `asn1:"explicit,tag:0"`
    // Salt is the optional salt string for string-to-key derivation.
    Salt string `asn1:"explicit,tag:1,optional,utf8"`
    // S2KParams contains optional string-to-key parameters (e.g. iteration count).
    S2KParams []byte `asn1:"explicit,tag:2,optional"`
}

type EncAPRepPart

EncAPRepPart is the decrypted enc-part of an AP-REP (APPLICATION[27]), as defined in RFC 4120 Section 5.5.2. The client verifies that CTime/CUSec echo the values it placed in its Authenticator, confirming the service decrypted the ticket and thus holds the session key (mutual authentication).

type EncAPRepPart struct {
    // CTime must echo the ctime from the client's Authenticator.
    CTime time.Time
    // CUSec must echo the cusec from the client's Authenticator.
    CUSec int
    // SubKey is an optional service-chosen sub-session key.
    SubKey *EncryptionKey
    // SeqNumber is the optional service sequence number.
    SeqNumber int
}

func (*EncAPRepPart) Marshal

func (e *EncAPRepPart) Marshal() ([]byte, error)

Marshal encodes the EncAPRepPart as an ASN.1 APPLICATION[27] wrapped SEQUENCE.

func (*EncAPRepPart) Unmarshal

func (e *EncAPRepPart) Unmarshal(data []byte) (int, error)

Unmarshal decodes an EncAPRepPart from an ASN.1 APPLICATION[27] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type EncASRepPart

EncASRepPart is the decrypted enc-part of an AS-REP (APPLICATION 25), as defined in RFC 4120 Section 5.4.2. It contains the session key and ticket metadata.

type EncASRepPart struct {
    // Key is the session key for use with the issued ticket.
    Key EncryptionKey
    // Nonce must match the nonce in the AS-REQ.
    Nonce int
    // Flags contains the ticket flags.
    Flags asn1.BitString
    // AuthTime is the time the client was authenticated.
    AuthTime time.Time
    // StartTime is the ticket's start time (optional).
    StartTime time.Time
    // EndTime is the ticket's expiry time.
    EndTime time.Time
    // RenewTill is the renewable lifetime end time (optional).
    RenewTill time.Time
    // SRealm is the realm of the service.
    SRealm string
    // SName is the service principal name.
    SName PrincipalName
}

func (*EncASRepPart) Marshal

func (e *EncASRepPart) Marshal() ([]byte, error)

Marshal encodes the EncASRepPart as an ASN.1 APPLICATION[25] wrapped SEQUENCE.

func (*EncASRepPart) Unmarshal

func (e *EncASRepPart) Unmarshal(data []byte) (int, error)

Unmarshal decodes an EncASRepPart from an ASN.1 APPLICATION[25] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type EncKrbCredPart

EncKrbCredPart is the decrypted enc-part of a KRB-CRED (APPLICATION[29]), RFC 4120 Section 5.8.1. It is encrypted under a key the two parties share (key usage 14); for a locally exported ticket (.kirbi) it is commonly stored unencrypted with etype 0.

type EncKrbCredPart struct {
    TicketInfo []KrbCredInfo
    Nonce      int
    Timestamp  time.Time
    Usec       int
}

func (*EncKrbCredPart) Marshal

func (e *EncKrbCredPart) Marshal() ([]byte, error)

Marshal encodes the EncKrbCredPart as an ASN.1 APPLICATION[29] SEQUENCE.

func (*EncKrbCredPart) Unmarshal

func (e *EncKrbCredPart) Unmarshal(data []byte) (int, error)

Unmarshal decodes an EncKrbCredPart from an APPLICATION[29] SEQUENCE.

type EncTGSRepPart

EncTGSRepPart is the decrypted enc-part of a TGS-REP (APPLICATION 26), as defined in RFC 4120 Section 5.4.2. It has the same structure as EncASRepPart but a different APPLICATION tag.

type EncTGSRepPart struct {
    // Key is the session key for use with the service ticket.
    Key EncryptionKey
    // Nonce must match the nonce in the TGS-REQ.
    Nonce int
    // Flags contains the ticket flags.
    Flags asn1.BitString
    // AuthTime is the time of original authentication.
    AuthTime time.Time
    // StartTime is the ticket's start time (optional).
    StartTime time.Time
    // EndTime is the ticket's expiry time.
    EndTime time.Time
    // RenewTill is the renewable lifetime end time (optional).
    RenewTill time.Time
    // SRealm is the realm of the service.
    SRealm string
    // SName is the service principal name.
    SName PrincipalName
}

func (*EncTGSRepPart) Marshal

func (e *EncTGSRepPart) Marshal() ([]byte, error)

Marshal encodes the EncTGSRepPart as an ASN.1 APPLICATION[26] wrapped SEQUENCE.

func (*EncTGSRepPart) Unmarshal

func (e *EncTGSRepPart) Unmarshal(data []byte) (int, error)

Unmarshal decodes an EncTGSRepPart from an ASN.1 APPLICATION[26] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type EncTicketPart

EncTicketPart is the encrypted portion of a Kerberos ticket (APPLICATION[3]), as defined in RFC 4120 Section 5.3. It carries the ticket flags, the session key, the client principal, validity times, and — for a Windows ticket — the PAC inside the authorization-data field. The KDC encrypts its DER encoding under the service’s long-term key (key usage 2); forging a ticket means building this structure and encrypting it under a compromised service or krbtgt key.

type EncTicketPart struct {
    // Flags are the ticket flags (forwardable, renewable, pre-authent, …).
    Flags asn1.BitString
    // Key is the session key sealed inside the ticket.
    Key EncryptionKey
    // CRealm is the client's realm.
    CRealm string
    // CName is the client principal the ticket is issued to.
    CName PrincipalName
    // Transited is the transited-realm encoding (empty for a locally issued ticket).
    Transited TransitedEncoding
    // AuthTime is the time of the initial authentication.
    AuthTime time.Time
    // StartTime is the time from which the ticket is valid (optional).
    StartTime time.Time
    // EndTime is the ticket's expiry time.
    EndTime time.Time
    // RenewTill is the end of the renewable lifetime (optional).
    RenewTill time.Time
    // AuthorizationData carries the authorization-data elements (the AD-IF-RELEVANT
    // wrapped AD-WIN2K-PAC for a Windows ticket). Optional.
    AuthorizationData []AuthorizationData
}

func (*EncTicketPart) Marshal

func (e *EncTicketPart) Marshal() ([]byte, error)

Marshal encodes the EncTicketPart as an ASN.1 APPLICATION[3] wrapped SEQUENCE, ready to be encrypted under the service (or krbtgt) key as a ticket enc-part.

func (*EncTicketPart) Unmarshal

func (e *EncTicketPart) Unmarshal(data []byte) (int, error)

Unmarshal decodes an EncTicketPart from an ASN.1 APPLICATION[3] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type EncryptedData

EncryptedData holds a Kerberos encrypted blob, as defined in RFC 4120 Section 5.2.9. The actual encryption algorithm and key are identified by EType.

type EncryptedData struct {
    // EType identifies the encryption algorithm used.
    EType int `asn1:"explicit,tag:0"`
    // KvNo is the optional key version number.
    KvNo int `asn1:"explicit,tag:1,optional"`
    // Cipher contains the encrypted bytes.
    Cipher []byte `asn1:"explicit,tag:2"`
}

type EncryptionKey

EncryptionKey holds a Kerberos encryption key as defined in RFC 4120 Section 5.2.9.

type EncryptionKey struct {
    // KeyType identifies the encryption algorithm.
    KeyType int `asn1:"explicit,tag:0"`
    // KeyValue contains the raw key bytes.
    KeyValue []byte `asn1:"explicit,tag:1"`
}

type HostAddress

HostAddress represents a network address, as defined in RFC 4120 Section 5.2.5.

type HostAddress struct {
    // AddrType identifies the address type (e.g. 2 = IPv4, 24 = IPv6).
    AddrType int `asn1:"explicit,tag:0"`
    // Address contains the raw address bytes.
    Address []byte `asn1:"explicit,tag:1"`
}

type KDCOptions

KDCOptions is a bit string encoding KDC request options flags, as defined in RFC 4120 Section 5.4.1.

type KDCOptions = asn1.BitString

type KDCReqBody

KDCReqBody is the body of a KDC request (AS-REQ or TGS-REQ), as defined in RFC 4120 Section 5.4.1.

type KDCReqBody struct {
    // KDCOptions contains bit flags controlling the KDC request behavior.
    KDCOptions asn1.BitString `asn1:"explicit,tag:0"`
    // CName is the client principal name (present in AS-REQ, absent in TGS-REQ).
    CName PrincipalName `asn1:"explicit,tag:1,optional"`
    // Realm is the realm for the request (crealm in AS-REQ, srealm in TGS-REQ).
    Realm string `asn1:"explicit,tag:2,generalstring"`
    // SName is the server principal name being requested.
    SName PrincipalName `asn1:"explicit,tag:3,optional"`
    // From is the requested start time for the ticket (optional).
    From time.Time `asn1:"explicit,tag:4,optional,generalized"`
    // Till is the requested expiry time for the ticket.
    Till time.Time `asn1:"explicit,tag:5,generalized"`
    // RTime is the requested renewable lifetime end time (optional).
    RTime time.Time `asn1:"explicit,tag:6,optional,generalized"`
    // Nonce is a random number used to detect replays.
    Nonce int `asn1:"explicit,tag:7"`
    // EType lists the client's supported encryption types, in preference order.
    EType []int `asn1:"explicit,tag:8"`
    // Addresses restricts the ticket to specific network addresses (optional).
    Addresses []HostAddress `asn1:"explicit,tag:9,optional"`
    // EncAuthData contains encrypted authorization data (optional, TGS-REQ).
    EncAuthData EncryptedData `asn1:"explicit,tag:10,optional"`
    // AdditTickets holds additional tickets (parsed form) for the TGS-REQ
    // additional-tickets field — used by U2U and S4U2Proxy. Marshaled by
    // encodeKDCReqBodyForTGS (not by generic asn1, which would mis-encode the
    // APPLICATION[1] tickets), hence asn1:"-".
    AdditTickets []Ticket `asn1:"-"`
    // AdditTicketsRaw holds the raw APPLICATION[1] bytes of additional tickets,
    // preferred over AdditTickets on marshal to re-emit KDC-issued bytes verbatim.
    AdditTicketsRaw [][]byte `asn1:"-"`
}

type KRBCred

KRBCred is a Kerberos KRB-CRED message (APPLICATION[22]), RFC 4120 Section 5.8.1.

type KRBCred struct {
    PVNO    int
    MsgType int
    // Tickets holds the parsed tickets.
    Tickets []Ticket
    // TicketsRaw holds the raw APPLICATION[1] bytes of each ticket, preferred on
    // Marshal to re-emit exactly what a KDC issued.
    TicketsRaw [][]byte
    // EncPart is the (usually unencrypted, etype 0) EncKrbCredPart.
    EncPart EncryptedData
}

func (*KRBCred) Marshal

func (c *KRBCred) Marshal() ([]byte, error)

Marshal encodes the KRB-CRED as an ASN.1 APPLICATION[22] SEQUENCE.

func (*KRBCred) Unmarshal

func (c *KRBCred) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KRB-CRED from an APPLICATION[22] SEQUENCE.

type KRBError

KRBError is a Kerberos KRB-ERROR message (APPLICATION[30]), as defined in RFC 4120 Section 5.9.1. It is sent by the KDC when an error occurs processing a request.

type KRBError struct {
    // PVNO is the Kerberos protocol version.
    PVNO int
    // MsgType is the message type (MsgTypeError = 30).
    MsgType int
    // STime is the server time at which the error occurred.
    STime time.Time
    // SUSec is the microsecond component of STime.
    SUSec int
    // ErrorCode identifies the specific error.
    ErrorCode int
    // CRealm is the client's realm as echoed by the KDC (optional). For a
    // KDC_ERR_WRONG_REALM error this carries the realm the client should retry
    // against (RFC 4120 Section 3.3.3.1, RFC 6806).
    CRealm string
    // Realm is the server's realm.
    Realm string
    // SName is the server's principal name.
    SName PrincipalName
    // EText is a human-readable error description.
    EText string
    // EData contains additional structured error information.
    EData []byte
}

func (*KRBError) Error

func (e *KRBError) Error() string

Error implements the error interface, returning a description of the KRB error.

func (*KRBError) Marshal

func (e *KRBError) Marshal() ([]byte, error)

Marshal encodes the KRBError as an ASN.1 APPLICATION[30] wrapped SEQUENCE.

func (*KRBError) Unmarshal

func (e *KRBError) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KRBError from an ASN.1 APPLICATION[30] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type KerberosTime

KerberosTime represents a Kerberos timestamp (GeneralizedTime without fractional seconds). It is stored as a standard Go time.Time value.

type KerberosTime = time.Time

type KrbCredInfo

KrbCredInfo is one entry of an EncKrbCredPart’s ticket-info (RFC 4120 Section 5.8.1). Every field except Key is OPTIONAL on the wire; in practice a ticket carries prealm/pname/flags/times/srealm/sname.

type KrbCredInfo struct {
    Key       EncryptionKey
    PRealm    string
    PName     PrincipalName
    Flags     asn1.BitString
    AuthTime  time.Time
    StartTime time.Time
    EndTime   time.Time
    RenewTill time.Time
    SRealm    string
    SName     PrincipalName
}

type KrbFastArmor

KrbFastArmor is the FAST armor descriptor (RFC 6113 §5.4.1):

KrbFastArmor ::= SEQUENCE {
    armor-type  [0] Int32,
    armor-value [1] OCTET STRING,
    ...
}

type KrbFastArmor struct {
    ArmorType  int    `asn1:"explicit,tag:0"`
    ArmorValue []byte `asn1:"explicit,tag:1"`
}

func (*KrbFastArmor) Marshal

func (a *KrbFastArmor) Marshal() ([]byte, error)

Marshal encodes the KrbFastArmor SEQUENCE.

func (*KrbFastArmor) Unmarshal

func (a *KrbFastArmor) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastArmor SEQUENCE, returning bytes consumed.

type KrbFastArmoredRep

KrbFastArmoredRep is the armored FAST reply (RFC 6113 §5.4.3):

KrbFastArmoredRep ::= SEQUENCE {
    enc-fast-rep [0] EncryptedData -- KrbFastResponse --,
    ...
}

enc-fast-rep is a KrbFastResponse encrypted under the armor key (key usage 52).

type KrbFastArmoredRep struct {
    EncFastRep EncryptedData `asn1:"explicit,tag:0"`
}

func ParsePAFXFastReply

func ParsePAFXFastReply(data []byte) (KrbFastArmoredRep, error)

ParsePAFXFastReply decodes a PA-FX-FAST-REPLY padata-value (RFC 6113 §5.4.3):

PA-FX-FAST-REPLY ::= CHOICE { armored-data [0] KrbFastArmoredRep, ... }

It unwraps the [0] EXPLICIT alternative and parses the KrbFastArmoredRep.

func (*KrbFastArmoredRep) Marshal

func (r *KrbFastArmoredRep) Marshal() ([]byte, error)

Marshal encodes the KrbFastArmoredRep SEQUENCE.

func (*KrbFastArmoredRep) Unmarshal

func (r *KrbFastArmoredRep) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastArmoredRep SEQUENCE, returning bytes consumed.

type KrbFastArmoredReq

KrbFastArmoredReq is the armored FAST request (RFC 6113 §5.4.2):

KrbFastArmoredReq ::= SEQUENCE {
    armor        [0] KrbFastArmor OPTIONAL,
    req-checksum [1] Checksum,
    enc-fast-req [2] EncryptedData -- KrbFastReq --,
    ...
}

For an AS-REQ the armor field MUST be present. req-checksum is a keyed checksum, computed with the armor key (key usage 50), over the outer KDC-REQ-BODY. enc-fast-req is the KrbFastReq encrypted under the armor key (key usage 51).

type KrbFastArmoredReq struct {
    Armor       *KrbFastArmor
    ReqChecksum Checksum
    EncFastReq  EncryptedData
}

func (*KrbFastArmoredReq) Marshal

func (r *KrbFastArmoredReq) Marshal() ([]byte, error)

Marshal encodes the KrbFastArmoredReq SEQUENCE.

func (*KrbFastArmoredReq) Unmarshal

func (r *KrbFastArmoredReq) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastArmoredReq SEQUENCE, returning bytes consumed.

type KrbFastFinished

KrbFastFinished authenticates the FAST exchange to the client (RFC 6113 §5.4.3):

KrbFastFinished ::= SEQUENCE {
    timestamp       [0] KerberosTime,
    usec            [1] Microseconds,
    crealm          [2] Realm,
    cname           [3] PrincipalName,
    ticket-checksum [4] Checksum,
    ...
}

ticket-checksum is a keyed checksum over the issued ticket, computed with the armor key (key usage 53).

type KrbFastFinished struct {
    Timestamp      time.Time
    Usec           int
    CRealm         string
    CName          PrincipalName
    TicketChecksum Checksum
}

func (*KrbFastFinished) Marshal

func (f *KrbFastFinished) Marshal() ([]byte, error)

Marshal encodes the KrbFastFinished SEQUENCE with GeneralString names.

func (*KrbFastFinished) Unmarshal

func (f *KrbFastFinished) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastFinished SEQUENCE, returning bytes consumed.

type KrbFastReq

KrbFastReq is the plaintext of the enc-fast-req field (RFC 6113 §5.4.2):

KrbFastReq ::= SEQUENCE {
    fast-options [0] FastOptions,
    padata       [1] SEQUENCE OF PA-DATA,
    req-body     [2] KDC-REQ-BODY,
    ...
}

The KDC uses this inner req-body and padata in preference to the outer, unprotected KDC-REQ.

type KrbFastReq struct {
    FastOptions asn1.BitString
    PAData      []PAData
    ReqBody     KDCReqBody
}

func (*KrbFastReq) Marshal

func (r *KrbFastReq) Marshal() ([]byte, error)

Marshal encodes the KrbFastReq SEQUENCE with GeneralString-encoded names.

func (*KrbFastReq) Unmarshal

func (r *KrbFastReq) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastReq SEQUENCE, returning bytes consumed.

type KrbFastResponse

KrbFastResponse is the plaintext of enc-fast-rep (RFC 6113 §5.4.3):

KrbFastResponse ::= SEQUENCE {
    padata         [0] SEQUENCE OF PA-DATA,
    strengthen-key [1] EncryptionKey OPTIONAL,
    finished       [2] KrbFastFinished OPTIONAL,
    nonce          [3] UInt32,
    ...
}

When strengthen-key is present the reply key is replaced by KRB-FX-CF2(strengthen-key, reply-key, “strengthenkey”, “replykey”). nonce echoes the inner KDC-REQ-BODY nonce and MUST match it.

type KrbFastResponse struct {
    PAData        []PAData
    StrengthenKey *EncryptionKey
    Finished      *KrbFastFinished
    Nonce         int
}

func (*KrbFastResponse) Marshal

func (r *KrbFastResponse) Marshal() ([]byte, error)

Marshal encodes the KrbFastResponse SEQUENCE.

func (*KrbFastResponse) Unmarshal

func (r *KrbFastResponse) Unmarshal(data []byte) (int, error)

Unmarshal decodes a KrbFastResponse SEQUENCE, returning bytes consumed.

type LastReq

LastReq is a last-request entry as defined in RFC 4120 Section 5.4.2.

type LastReq struct {
    // LRType identifies the type of last request.
    LRType int `asn1:"explicit,tag:0"`
    // LRValue is the time of the last request.
    LRValue time.Time `asn1:"explicit,tag:1,generalized"`
}

type PAData

PAData is a pre-authentication data element, as defined in RFC 4120 Section 5.2.7.

type PAData struct {
    // PADataType identifies the pre-authentication data type.
    PADataType int `asn1:"explicit,tag:1"`
    // PADataValue contains the pre-authentication data bytes.
    PADataValue []byte `asn1:"explicit,tag:2"`
}

type PAEncTSEnc

PAEncTSEnc is the plaintext body of a PA-ENC-TIMESTAMP pre-authentication element, as defined in RFC 4120 Section 5.2.7.2. It is encrypted with the client’s key and used to prove knowledge of the password.

type PAEncTSEnc struct {
    // PATimestamp is the client's current time.
    PATimestamp time.Time `asn1:"explicit,tag:0,generalized"`
    // PAUSec is the optional microseconds component of PATimestamp.
    PAUSec int `asn1:"explicit,tag:1,optional"`
}

func (*PAEncTSEnc) Marshal

func (p *PAEncTSEnc) Marshal() ([]byte, error)

Marshal encodes PAEncTSEnc as a plain ASN.1 SEQUENCE (no APPLICATION wrapper).

func (*PAEncTSEnc) Unmarshal

func (p *PAEncTSEnc) Unmarshal(data []byte) (int, error)

Unmarshal decodes PAEncTSEnc from a plain ASN.1 SEQUENCE. Returns the number of bytes consumed from data.

type PrincipalName

PrincipalName contains a name-type and a sequence of name strings, as defined in RFC 4120 Section 5.2.2.

type PrincipalName struct {
    // NameType specifies the type of name (e.g. NT-PRINCIPAL = 1).
    NameType int `asn1:"explicit,tag:0"`
    // NameString contains the sequence of name components.
    NameString []string `asn1:"explicit,tag:1"`
}

type PrincipalNameMarshal

PrincipalNameMarshal is the wire representation of PrincipalName for marshaling. It uses []asn1.RawValue (GeneralString) instead of []string, which Go’s asn1 would incorrectly encode as PrintableString.

type PrincipalNameMarshal struct {
    NameType   int             `asn1:"explicit,tag:0"`
    NameString []asn1.RawValue `asn1:"explicit,tag:1"`
}

func MarshalPrincipalName

func MarshalPrincipalName(pn PrincipalName) PrincipalNameMarshal

MarshalPrincipalName converts a PrincipalName to its GeneralString-encoded form.

type TGSRep

TGSRep is a Kerberos TGS-REP (Ticket Granting Service Reply) message, APPLICATION[13], as defined in RFC 4120 Section 5.4.2. It is sent by the TGS in response to a successful TGS-REQ.

type TGSRep struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeTGSRep = 13).
    MsgType int
    // PAData contains pre-authentication data (rarely set in TGS-REP).
    PAData []PAData
    // CRealm is the realm of the client.
    CRealm string
    // CName is the client's principal name.
    CName PrincipalName
    // Ticket is the issued service ticket (parsed).
    Ticket Ticket
    // TicketRaw holds the raw APPLICATION[1] ticket bytes as received from the
    // KDC. Use these verbatim when embedding the ticket in an AP-REQ to avoid
    // re-encoding differences between Go's encoding/asn1 and the KDC's original
    // DER output (see ASRep.TicketRaw for the matching field on AS-REP).
    TicketRaw []byte
    // EncPart is the encrypted reply body, decryptable with the TGT session key.
    EncPart EncryptedData
}

func (*TGSRep) Marshal

func (r *TGSRep) Marshal() ([]byte, error)

Marshal encodes the TGS-REP as an ASN.1 APPLICATION[13] wrapped SEQUENCE.

func (*TGSRep) Unmarshal

func (r *TGSRep) Unmarshal(data []byte) (int, error)

Unmarshal decodes a TGS-REP from an ASN.1 APPLICATION[13] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type TGSReq

TGSReq is a Kerberos TGS-REQ (Ticket Granting Service Request) message, APPLICATION[12], as defined in RFC 4120 Section 5.4.1. It is sent by the client to the TGS to request a service ticket. The PA-TGS-REQ pre-authentication data must contain an AP-REQ with the TGT.

type TGSReq struct {
    // PVNO is the Kerberos protocol version (always 5).
    PVNO int
    // MsgType is the message type (always MsgTypeTGSReq = 12).
    MsgType int
    // PAData contains the PA-TGS-REQ with the AP-REQ carrying the TGT.
    PAData []PAData
    // ReqBody is the request body specifying the requested service ticket parameters.
    ReqBody KDCReqBody
}

func (*TGSReq) Marshal

func (r *TGSReq) Marshal() ([]byte, error)

Marshal encodes the TGS-REQ as an ASN.1 APPLICATION[12] wrapped SEQUENCE.

func (*TGSReq) Unmarshal

func (r *TGSReq) Unmarshal(data []byte) (int, error)

Unmarshal decodes a TGS-REQ from an ASN.1 APPLICATION[12] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type Ticket

Ticket is a Kerberos ticket (APPLICATION[1]), as defined in RFC 4120 Section 5.3. It carries an encrypted session key and authorization data for a service principal.

type Ticket struct {
    // TktVno is the Kerberos version number embedded in the ticket (always 5).
    TktVno int
    // Realm is the realm of the service principal.
    Realm string
    // SName is the name of the service principal.
    SName PrincipalName
    // EncPart is the encrypted portion of the ticket.
    EncPart EncryptedData
}

func (*Ticket) Marshal

func (t *Ticket) Marshal() ([]byte, error)

Marshal encodes the Ticket as an ASN.1 APPLICATION[1] wrapped SEQUENCE.

func (*Ticket) Unmarshal

func (t *Ticket) Unmarshal(data []byte) (int, error)

Unmarshal decodes a Ticket from an ASN.1 APPLICATION[1] wrapped SEQUENCE. Returns the number of bytes consumed from data.

type TransitedEncoding

TransitedEncoding is the transited-realm field of a ticket, as defined in RFC 4120 Section 5.3. A freshly issued (or forged) ticket carries an empty contents with TRType 0 (DOMAIN-X500-COMPRESS), meaning no cross-realm hops.

type TransitedEncoding struct {
    // TRType identifies the encoding of the transited field (0 = X.500 compress).
    TRType int `asn1:"explicit,tag:0"`
    // Contents holds the encoded transited realms (empty when no realms transited).
    Contents []byte `asn1:"explicit,tag:1"`
}