Wireshark · Ethereal-dev: Re: [Ethereal-dev] I am confused by the MS impl of SPNEGO vs spec ...

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Aug 28, 2002 at 05:15:40PM +0930, Richard Sharpe wrote:
> I assumed that this means that I would find a negTokenTarg consisting of:
> 
>  OBJECT IDENTIFIER SPNEGO (1 3 6 1 5 5 2)

That's not part of a negTokenTarg.  That's the thisMech member of an
InitialContextToken, as per section 3.1 or RFC 2078.

Everything that follows it is the innerContextToken.
complnent of the initial token of a GSS-API context establishment
sequence, as per section 3.1 of RFC 2078.

> However, what I seem to find is:
> 
>     <60 50>
> 0000 60   50: [APPLICATION 0] {
>     <06 06>
> 0002 06    6:   OBJECT IDENTIFIER SPNEGO (1 3 6 1 5 5 2)

Yup, that's an InitialContextToken, as per RFC 2078:

       InitialContextToken ::=
       -- option indication (delegation, etc.) indicated within
       -- mechanism-specific token
       [APPLICATION 0] IMPLICIT SEQUENCE {
               thisMech MechType,
               innerContextToken ANY DEFINED BY thisMech
                  -- contents mechanism-specific
                  -- ASN.1 structure not required
               }

and all the stuff that follows is the innerContextToken, which, as RFC
2478 says, is described by the syntax you quoted.


>     <A0 46>
> 000A A0   46:   [0] {

So that's the "CHOICE { [0] {" part of a NegotiationToken, and it chose
[0], or a NegTokenInit.

>     <30 44>
> 000C 30   44:     SEQUENCE {

So that's the "SEQUENCE {" part of a NegTokenInit...

>     <A0 0E>
> 000E A0    E:       [0] {

...and that's the "[0]" part of a NegTokenInit, so the next item
is a MechTypeList.

>     <30 0C>
> 0010 30    C:         SEQUENCE {

SEQUENCE and SEQUENCE OF both have a tag of universal class and number
16, so they both start with hex 30, so that's actually

    <30 0C>
0010 30    C:         SEQUENCE OF {

which means this is a MechTypeList, or a sequence of MechTypes, which
are OBJECT IDENTIFIERs.

>     <06 0A>
> 0012 06    A:           OBJECT IDENTIFIER
>             :             Microsoft NTLMSSP (1 3 6 1 4 1 311 2 2 10
>             :           }
>             :         }

and there's the first (and presumably only) member of that list.

>     <A2 32>
> 001E A2   32:       [2] {

That's the [2] part of a NegTokenInit; all parts are optional, and the
reqFlags part ([1]) was omitted.

>     <04 30>
> 0020 04   30:         OCTET STRING    

...and that introduces the mechToken.