KRBSafe

README.md

@@ -15,4 +15,7 @@ This is work in progress and does not yet work...
 [text](https://www.ietf.org/rfc/rfc3962.txt) [html](https://tools.ietf.org/html/rfc3962)
 
 ## Useful Links
-* https://en.wikipedia.org/wiki/Ciphertext_stealing#CBC_ciphertext_stealing
+* https://en.wikipedia.org/wiki/Ciphertext_stealing#CBC_ciphertext_stealing
+
+## Thanks
+* Greg Hudsons from the MIT Consortium for Kerberos and Internet Trust for providing useful test vectors.

messages/KRBSafe.go

@@ -0,0 +1,55 @@
+package messages
+
+import (
+	"encoding/asn1"
+	"fmt"
+	"github.com/jcmturner/gokrb5/types"
+	"github.com/jcmturner/gokrb5/types/asnAppTag"
+	"time"
+)
+
+/*
+KRB-SAFE        ::= [APPLICATION 20] SEQUENCE {
+	pvno            [0] INTEGER (5),
+	msg-type        [1] INTEGER (20),
+	safe-body       [2] KRB-SAFE-BODY,
+	cksum           [3] Checksum
+}
+
+KRB-SAFE-BODY   ::= SEQUENCE {
+	user-data       [0] OCTET STRING,
+	timestamp       [1] KerberosTime OPTIONAL,
+	usec            [2] Microseconds OPTIONAL,
+	seq-number      [3] UInt32 OPTIONAL,
+	s-address       [4] HostAddress,
+	r-address       [5] HostAddress OPTIONAL
+}
+*/
+
+type KRBSafe struct {
+	PVNO     int            `asn1:"explicit,tag:0"`
+	MsgType  int            `asn1:"explicit,tag:1"`
+	SafeBody KRBSafeBody    `asn1:"explicit,tag:2"`
+	Cksum    types.Checksum `asn1:"explicit,tag:3"`
+}
+
+type KRBSafeBody struct {
+	UserData       []byte            `asn1:"explicit,tag:0"`
+	Timestamp      time.Time         `asn1:"optional,explicit,tag:1"`
+	Usec           int               `asn1:"optional,explicit,tag:2"`
+	SequenceNumber int               `asn1:"optional,explicit,tag:3"`
+	SAddress       types.HostAddress `asn1:"explicit,tag:4"`
+	RAddress       types.HostAddress `asn1:"optional,explicit,tag:5"`
+}
+
+func (s *KRBSafe) Unmarshal(b []byte) error {
+	_, err := asn1.UnmarshalWithParams(b, s, fmt.Sprintf("application,explicit,tag:%v", asnAppTag.KRBSafe))
+	if err != nil {
+		return err
+	}
+	expectedMsgType := types.KrbDictionary.MsgTypesByName["KRB_SAFE"]
+	if s.MsgType != expectedMsgType {
+		return fmt.Errorf("Message ID does not indicate a KRB_SAFE. Expected: %v; Actual: %v", expectedMsgType, s.MsgType)
+	}
+	return nil
+}

messages/KRBSafe_test.go

@@ -0,0 +1,59 @@
+package messages
+
+import (
+	"encoding/hex"
+	"github.com/jcmturner/gokrb5/testdata"
+	"github.com/jcmturner/gokrb5/types"
+	"github.com/stretchr/testify/assert"
+	"testing"
+	"time"
+)
+
+func TestUnmarshalKRBSafe(t *testing.T) {
+	var a KRBSafe
+	v := "encode_krb5_safe"
+	b, err := hex.DecodeString(testdata.TestVectors[v])
+	if err != nil {
+		t.Fatalf("Test vector read error of %s: %v\n", v, err)
+	}
+	err = a.Unmarshal(b)
+	if err != nil {
+		t.Fatalf("Unmarshal error of %s: %v\n", v, err)
+	}
+	//Parse the test time value into a time.Time type
+	tt, _ := time.Parse(testdata.TEST_TIME_FORMAT, testdata.TEST_TIME)
+
+	assert.Equal(t, testdata.TEST_KVNO, a.PVNO, "PVNO not as expected")
+	assert.Equal(t, types.KrbDictionary.MsgTypesByName["KRB_SAFE"], a.MsgType, "MsgType is not as expected")
+	assert.Equal(t, []byte("krb5data"), a.SafeBody.UserData, "Safe body userdata not as expected")
+	assert.Equal(t, tt, a.SafeBody.Timestamp, "Safe body timestamp not as expected")
+	assert.Equal(t, 123456, a.SafeBody.Usec, "Safe body microseconds not as expected")
+	assert.Equal(t, 17, a.SafeBody.SequenceNumber, "Safe body sequence number not as expected")
+	assert.Equal(t, 2, a.SafeBody.SAddress.AddrType, "SAddress type not as expected")
+	assert.Equal(t, "12d00023", hex.EncodeToString(a.SafeBody.SAddress.Address), "SAddress not as expected")
+	assert.Equal(t, 2, a.SafeBody.RAddress.AddrType, "RAddress type not as expected")
+	assert.Equal(t, "12d00023", hex.EncodeToString(a.SafeBody.RAddress.Address), "RAddress not as expected")
+	assert.Equal(t, 1, a.Cksum.CksumType, "Checksum type not as expected")
+	assert.Equal(t, []byte("1234"), a.Cksum.Checksum, "Checksum not as expected")
+}
+
+func TestUnmarshalKRBSafe_optionalsNULL(t *testing.T) {
+	var a KRBSafe
+	v := "encode_krb5_safe(optionalsNULL)"
+	b, err := hex.DecodeString(testdata.TestVectors[v])
+	if err != nil {
+		t.Fatalf("Test vector read error of %s: %v\n", v, err)
+	}
+	err = a.Unmarshal(b)
+	if err != nil {
+		t.Fatalf("Unmarshal error of %s: %v\n", v, err)
+	}
+
+	assert.Equal(t, testdata.TEST_KVNO, a.PVNO, "PVNO not as expected")
+	assert.Equal(t, types.KrbDictionary.MsgTypesByName["KRB_SAFE"], a.MsgType, "MsgType is not as expected")
+	assert.Equal(t, []byte("krb5data"), a.SafeBody.UserData, "Safe body userdata not as expected")
+	assert.Equal(t, 2, a.SafeBody.SAddress.AddrType, "SAddress type not as expected")
+	assert.Equal(t, "12d00023", hex.EncodeToString(a.SafeBody.SAddress.Address), "SAddress not as expected")
+	assert.Equal(t, 1, a.Cksum.CksumType, "Checksum type not as expected")
+	assert.Equal(t, []byte("1234"), a.Cksum.Checksum, "Checksum not as expected")
+}

messages/Safe.go

@@ -1,22 +0,0 @@
-package messages
-
-/*
-KRB-SAFE        ::= [APPLICATION 20] SEQUENCE {
-	pvno            [0] INTEGER (5),
-	msg-type        [1] INTEGER (20),
-	safe-body       [2] KRB-SAFE-BODY,
-	cksum           [3] Checksum
-}
-
-KRB-SAFE-BODY   ::= SEQUENCE {
-	user-data       [0] OCTET STRING,
-	timestamp       [1] KerberosTime OPTIONAL,
-	usec            [2] Microseconds OPTIONAL,
-	seq-number      [3] UInt32 OPTIONAL,
-	s-address       [4] HostAddress,
-	r-address       [5] HostAddress OPTIONAL
-}
-*/
-
-//encode_krb5_safe
-//encode_krb5_safe(optionalsNULL)

messages/Safe_test.go

@@ -1 +0,0 @@
-package messages

testdata/test_vectors.go

@@ -2,18 +2,18 @@ package testdata
 
 const (
 	//Expected unmarshaled values
-	TEST_REALM                  = "ATHENA.MIT.EDU"
-	TEST_CIPHERTEXT             = "krbASN.1 test message"
-	TEST_TIME_FORMAT            = "20060102150405"
-	TEST_TIME                   = "19940610060317"
-	TEST_PRINCIPALNAME_NAMETYPE = 1
-	TEST_KVNO                   = 5
-	TEST_ETYPE                  = 0
-	TEST_NONCE                  = 42
-	TEST_AUTHORIZATION_DATA_TYPE = 1
+	TEST_REALM                    = "ATHENA.MIT.EDU"
+	TEST_CIPHERTEXT               = "krbASN.1 test message"
+	TEST_TIME_FORMAT              = "20060102150405"
+	TEST_TIME                     = "19940610060317"
+	TEST_PRINCIPALNAME_NAMETYPE   = 1
+	TEST_KVNO                     = 5
+	TEST_ETYPE                    = 0
+	TEST_NONCE                    = 42
+	TEST_AUTHORIZATION_DATA_TYPE  = 1
 	TEST_AUTHORIZATION_DATA_VALUE = "foobar"
-	TEST_PADATA_TYPE = 13
-	TEST_PADATA_VALUE = "pa-data"
+	TEST_PADATA_TYPE              = 13
+	TEST_PADATA_VALUE             = "pa-data"
 )
 
 var TEST_PRINCIPALNAME_NAMESTRING = []string{"hftsai", "extra"}
@@ -46,8 +46,8 @@ var TestVectors = map[string]string{
 	"encode_krb5_kdc_req_body":                                   "308201A6A007030500FEDCBA90A11A3018A003020101A111300F1B066866747361691B056578747261A2101B0E415448454E412E4D49542E454455A31A3018A003020101A111300F1B066866747361691B056578747261A411180F31393934303631303036303331375AA511180F31393934303631303036303331375AA611180F31393934303631303036303331375AA70302012AA8083006020100020101A920301E300DA003020102A106040412D00023300DA003020102A106040412D00023AA253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765AB81BF3081BC615C305AA003020105A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765615C305AA003020105A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765",
 	"encode_krb5_kdc_req_body(optionalsNULLexceptsecond_ticket)": "3081FFA007030500FEDCBA98A2101B0E415448454E412E4D49542E454455A511180F31393934303631303036303331375AA70302012AA8083006020100020101AB81BF3081BC615C305AA003020105A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765615C305AA003020105A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765",
 	"encode_krb5_kdc_req_body(optionalsNULLexceptserver)":        "3059A007030500FEDCBA90A2101B0E415448454E412E4D49542E454455A31A3018A003020101A111300F1B066866747361691B056578747261A511180F31393934303631303036303331375AA70302012AA8083006020100020101",
-	//"encode_krb5_safe":                                           "746E306CA003020105A103020114A24F304DA00A04086B72623564617461A111180F31393934303631303036303331375AA205020301E240A303020111A40F300DA003020102A106040412D00023A50F300DA003020102A106040412D00023A30F300DA003020101A106040431323334",
-	//"encode_krb5_safe(optionalsNULL)":                            "743E303CA003020105A103020114A21F301DA00A04086B72623564617461A40F300DA003020102A106040412D00023A30F300DA003020101A106040431323334",
+	"encode_krb5_safe":                                           "746E306CA003020105A103020114A24F304DA00A04086B72623564617461A111180F31393934303631303036303331375AA205020301E240A303020111A40F300DA003020102A106040412D00023A50F300DA003020102A106040412D00023A30F300DA003020101A106040431323334",
+	"encode_krb5_safe(optionalsNULL)":                            "743E303CA003020105A103020114A21F301DA00A04086B72623564617461A40F300DA003020102A106040412D00023A30F300DA003020101A106040431323334",
 	//"encode_krb5_priv":                                           "75333031A003020105A103020115A3253023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765",
 	//"encode_krb5_enc_priv_part":                                  "7C4F304DA00A04086B72623564617461A111180F31393934303631303036303331375AA205020301E240A303020111A40F300DA003020102A106040412D00023A50F300DA003020102A106040412D00023",
 	//"encode_krb5_enc_priv_part(optionalsNULL)":                   "7C1F301DA00A04086B72623564617461A40F300DA003020102A106040412D00023",
@@ -56,27 +56,27 @@ var TestVectors = map[string]string{
 	//"encode_krb5_enc_cred_part(optionalsNULL)":                   "7D82010E3082010AA0820106308201023015A0133011A003020101A10A040831323334353637383081E8A0133011A003020101A10A04083132333435363738A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A307030500FEDCBA98A411180F31393934303631303036303331375AA511180F31393934303631303036303331375AA611180F31393934303631303036303331375AA711180F31393934303631303036303331375AA8101B0E415448454E412E4D49542E454455A91A3018A003020101A111300F1B066866747361691B056578747261AA20301E300DA003020102A106040412D00023300DA003020102A106040412D00023",
 	//"encode_krb5_error":                                          "7E81BA3081B7A003020105A10302011EA211180F31393934303631303036303331375AA305020301E240A411180F31393934303631303036303331375AA505020301E240A60302013CA7101B0E415448454E412E4D49542E454455A81A3018A003020101A111300F1B066866747361691B056578747261A9101B0E415448454E412E4D49542E454455AA1A3018A003020101A111300F1B066866747361691B056578747261AB0A1B086B72623564617461AC0A04086B72623564617461",
 	//"encode_krb5_error(optionalsNULL)":                           "7E60305EA003020105A10302011EA305020301E240A411180F31393934303631303036303331375AA505020301E240A60302013CA9101B0E415448454E412E4D49542E454455AA1A3018A003020101A111300F1B066866747361691B056578747261",
-	"encode_krb5_authorization_data":                             "3022300FA003020101A1080406666F6F626172300FA003020101A1080406666F6F626172",
-	"encode_krb5_padata_sequence":                                "30243010A10302010DA209040770612D646174613010A10302010DA209040770612D64617461",
+	"encode_krb5_authorization_data": "3022300FA003020101A1080406666F6F626172300FA003020101A1080406666F6F626172",
+	"encode_krb5_padata_sequence":    "30243010A10302010DA209040770612D646174613010A10302010DA209040770612D64617461",
 	//"encode_krb5_typed_data":                                     "30243010A00302010DA109040770612D646174613010A00302010DA109040770612D64617461",
-	"encode_krb5_padata_sequence(empty)":                         "3000",
-	"encode_krb5_etype_info":                                     "30333014A003020100A10D040B4D6F72746F6E27732023303005A0030201013014A003020102A10D040B4D6F72746F6E2773202332",
-	"encode_krb5_etype_info(only1)":                              "30163014A003020100A10D040B4D6F72746F6E2773202330",
-	"encode_krb5_etype_info(noinfo)":                             "3000",
-	"encode_krb5_etype_info2":                                    "3051301EA003020100A10D1B0B4D6F72746F6E2773202330A208040673326B3A2030300FA003020101A208040673326B3A2031301EA003020102A10D1B0B4D6F72746F6E2773202332A208040673326B3A2032",
-	"encode_krb5_etype_info2(only1)":                             "3020301EA003020100A10D1B0B4D6F72746F6E2773202330A208040673326B3A2030",
-	"encode_krb5_pa_enc_ts":                                      "301AA011180F31393934303631303036303331375AA105020301E240",
-	"encode_krb5_pa_enc_ts(nousec)":                              "3013A011180F31393934303631303036303331375A",
-	"encode_krb5_enc_data":                                       "3023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765",
-	"encode_krb5_enc_data(MSB-setkvno)":                          "3026A003020100A1060204FF000000A21704156B726241534E2E312074657374206D657373616765",
-	"encode_krb5_enc_data(kvno= -1)":                             "3023A003020100A1030201FFA21704156B726241534E2E312074657374206D657373616765",
+	"encode_krb5_padata_sequence(empty)": "3000",
+	"encode_krb5_etype_info":             "30333014A003020100A10D040B4D6F72746F6E27732023303005A0030201013014A003020102A10D040B4D6F72746F6E2773202332",
+	"encode_krb5_etype_info(only1)":      "30163014A003020100A10D040B4D6F72746F6E2773202330",
+	"encode_krb5_etype_info(noinfo)":     "3000",
+	"encode_krb5_etype_info2":            "3051301EA003020100A10D1B0B4D6F72746F6E2773202330A208040673326B3A2030300FA003020101A208040673326B3A2031301EA003020102A10D1B0B4D6F72746F6E2773202332A208040673326B3A2032",
+	"encode_krb5_etype_info2(only1)":     "3020301EA003020100A10D1B0B4D6F72746F6E2773202330A208040673326B3A2030",
+	"encode_krb5_pa_enc_ts":              "301AA011180F31393934303631303036303331375AA105020301E240",
+	"encode_krb5_pa_enc_ts(nousec)":      "3013A011180F31393934303631303036303331375A",
+	"encode_krb5_enc_data":               "3023A003020100A103020105A21704156B726241534E2E312074657374206D657373616765",
+	"encode_krb5_enc_data(MSB-setkvno)":  "3026A003020100A1060204FF000000A21704156B726241534E2E312074657374206D657373616765",
+	"encode_krb5_enc_data(kvno= -1)":     "3023A003020100A1030201FFA21704156B726241534E2E312074657374206D657373616765",
 	//"encode_krb5_sam_challenge_2":                                "3022A00D300B04096368616C6C656E6765A111300F300DA003020101A106040431323334",
 	//"encode_krb5_sam_challenge_2_body":                           "3064A00302012AA10703050080000000A20B040974797065206E616D65A411040F6368616C6C656E6765206C6162656CA510040E6368616C6C656E67652069707365A6160414726573706F6E73655F70726F6D70742069707365A8050203543210A903020101",
 	//"encode_krb5_sam_response_2":                                 "3042A00302012BA10703050080000000A20C040A747261636B2064617461A31D301BA003020101A10402020D36A20E040C6E6F6E6365206F7220736164A4050203543210",
 	//"encode_krb5_enc_sam_response_enc_2":                         "301FA003020158A1180416656E635F73616D5F726573706F6E73655F656E635F32",
 	//"encode_krb5_pa_for_user":                                    "304BA01A3018A003020101A111300F1B066866747361691B056578747261A1101B0E415448454E412E4D49542E454455A20F300DA003020101A106040431323334A30A1B086B72623564617461",
 	//"encode_krb5_pa_s4u_x509_user":                               "3068A0553053A006020400CA149AA11A3018A003020101A111300F1B066866747361691B056578747261A2101B0E415448454E412E4D49542E454455A312041070615F7334755F783530395F75736572A40703050080000000A10F300DA003020101A106040431323334",
-	"encode_krb5_ad_kdcissued":                                   "3065A00F300DA003020101A106040431323334A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3243022300FA003020101A1080406666F6F626172300FA003020101A1080406666F6F626172",
+	"encode_krb5_ad_kdcissued": "3065A00F300DA003020101A106040431323334A1101B0E415448454E412E4D49542E454455A21A3018A003020101A111300F1B066866747361691B056578747261A3243022300FA003020101A1080406666F6F626172300FA003020101A1080406666F6F626172",
 	//"encode_krb5_ad_signedpath_data":                             "3081C7A030302EA01A3018A003020101A111300F1B066866747361691B056578747261A1101B0E415448454E412E4D49542E454455A111180F31393934303631303036303331375AA2323030302EA01A3018A003020101A111300F1B066866747361691B056578747261A1101B0E415448454E412E4D49542E454455A32630243010A10302010DA209040770612D646174613010A10302010DA209040770612D64617461A4243022300FA003020101A1080406666F6F626172300FA003020101A1080406666F6F626172",
 	//"encode_krb5_ad_signedpath":                                  "303EA003020101A10F300DA003020101A106040431323334A32630243010A10302010DA209040770612D646174613010A10302010DA209040770612D64617461",
 	//"encode_krb5_iakerb_header":                                  "3018A10A04086B72623564617461A20A04086B72623564617461",