| 130 | |
| 131 | |
| 132 | class GSSAPI_BLOB_SIGNATURE(ASN1_Packet): |
| 133 | ASN1_codec = ASN1_Codecs.BER |
| 134 | ASN1_root = ASN1F_GSSAPI_APPLICATION( |
| 135 | ASN1F_OID("MechType", "1.3.6.1.5.5.2"), |
| 136 | ASN1F_PACKET( |
| 137 | "innerToken", |
| 138 | None, |
| 139 | None, |
| 140 | next_cls_cb=lambda pkt: _GSSAPI_SIGNATURE_OIDS.get( |
| 141 | pkt.MechType.val, conf.raw_layer |
| 142 | ), # noqa: E501 |
| 143 | ), |
| 144 | ) |
| 145 | |
| 146 | @classmethod |
| 147 | def dispatch_hook(cls, _pkt=None, *args, **kargs): |
| 148 | if _pkt and len(_pkt) >= 2: |
| 149 | # Sometimes the token is raw. Detect that with educated |
| 150 | # heuristics. |
| 151 | if _pkt[:2] in [b"\x04\x04", b"\x05\x04"]: |
| 152 | from scapy.layers.kerberos import KRB_InnerToken |
| 153 | |
| 154 | return KRB_InnerToken |
| 155 | elif len(_pkt) >= 4 and _pkt[:4] == b"\x01\x00\x00\x00": |
| 156 | from scapy.layers.ntlm import NTLMSSP_MESSAGE_SIGNATURE |
| 157 | |
| 158 | return NTLMSSP_MESSAGE_SIGNATURE |
| 159 | return cls |
| 160 | |
| 161 | |
| 162 | class _GSSAPI_Field(PacketField): |
no test coverage detected