aboutsummaryrefslogtreecommitdiffstats
path: root/epan/dissectors/asn1/kerberos/kerberos.cnf
blob: 4a7e62333664c861ec806f3f4ea4d34521215353 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
# kerberos.cnf
# kerberos conformation file
# Copyright 2008 Anders Broman

#.EXPORTS
ChangePasswdData
Applications ONLY_ENUM

#.FIELD_RENAME
KDC-REQ-BODY/etype kDC-REQ-BODY_etype
KRB-SAFE-BODY/user-data kRB-SAFE-BODY_user_data
EncKrbPrivPart/user-data encKrbPrivPart_user_data
EncryptedTicketData/cipher encryptedTicketData_cipher
EncryptedAuthenticator/cipher encryptedAuthenticator_cipher
EncryptedAuthorizationData/cipher encryptedAuthorizationData_cipher
EncryptedKDCREPData/cipher encryptedKDCREPData_cipher
PA-ENC-TIMESTAMP/cipher pA-ENC-TIMESTAMP_cipher
EncryptedAPREPData/cipher encryptedAPREPData_cipher
EncryptedKrbPrivData/cipher encryptedKrbPrivData_cipher
EncryptedKrbCredData/cipher encryptedKrbCredData_cipher
KRB-CRED/_untag/enc-part kRB_CRED_enc_part
KRB-PRIV/_untag/enc-part kRB_PRIV_enc_part
AP-REP/_untag/enc-part aP_REP_enc_part
KDC-REP/enc-part kDC_REP_enc_part
Ticket/_untag/enc-part ticket_enc_part
ETYPE-INFO-ENTRY/salt info_salt
ETYPE-INFO2-ENTRY/salt info2_salt
AP-REQ/_untag/authenticator authenticator_enc_part

#.OMIT_ASSIGNMENT
AD-AND-OR
AD-KDCIssued
AD-LoginAlias
AD-MANDATORY-FOR-KDC
ChangePasswdDataMS
EtypeList
KRB5SignedPath
KRB5SignedPathData
KRB5SignedPathPrincipals
Krb5int32
Krb5uint32
PA-ClientCanonicalized
PA-ClientCanonicalizedNames
PA-ENC-SAM-RESPONSE-ENC
PA-SAM-CHALLENGE-2
PA-SAM-CHALLENGE-2-BODY
PA-SAM-REDIRECT
PA-SAM-RESPONSE-2
PA-SAM-TYPE
PA-SERVER-REFERRAL-DATA
PA-ServerReferralData
PA-SvrReferralData
Principal
PROV-SRV-LOCATION
SAMFlags
TYPED-DATA
KrbFastReq
KrbFastResponse
KrbFastFinished
FastOptions
KerberosFlags

#.NO_EMIT ONLY_VALS
Applications
PA-FX-FAST-REPLY
PA-FX-FAST-REQUEST

#.MAKE_DEFINES
ADDR-TYPE TYPE_PREFIX
Applications TYPE_PREFIX

#.MAKE_ENUM
PADATA-TYPE PROT_PREFIX UPPER_CASE
AUTHDATA-TYPE PROT_PREFIX UPPER_CASE

#.FN_BODY MESSAGE-TYPE VAL_PTR = &msgtype
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
	guint32 msgtype;

%(DEFAULT_BODY)s

#.FN_FTR MESSAGE-TYPE
	if (gbl_do_col_info) {
		col_add_str(actx->pinfo->cinfo, COL_INFO,
			val_to_str(msgtype, krb5_msg_types,
			"Unknown msg type %#x"));
	}
	gbl_do_col_info=FALSE;

##if 0
	/* append the application type to the tree */
	proto_item_append_text(tree, " %s", val_to_str(msgtype, krb5_msg_types, "Unknown:0x%x"));
##endif
	if (private_data->msg_type == 0) {
		private_data->msg_type = msgtype;
	}

#.FN_BODY ERROR-CODE VAL_PTR = &private_data->errorcode
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s

#.FN_FTR ERROR-CODE
	if (private_data->errorcode) {
		col_add_fstr(actx->pinfo->cinfo, COL_INFO,
			"KRB Error: %s",
			val_to_str(private_data->errorcode, krb5_error_codes,
			"Unknown error code %#x"));
	}

	return offset;
#.END
#.FN_BODY KRB-ERROR/_untag/e-data
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	switch (private_data->errorcode) {
	case KRB5_ET_KRB5KDC_ERR_BADOPTION:
	case KRB5_ET_KRB5KDC_ERR_CLIENT_REVOKED:
	case KRB5_ET_KRB5KDC_ERR_KEY_EXP:
	case KRB5_ET_KRB5KDC_ERR_POLICY:
		/* ms windows kdc sends e-data of this type containing a "salt"
		 * that contains the nt_status code for these error codes.
		 */
		private_data->try_nt_status = TRUE;
		offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_kerberos_e_data, dissect_kerberos_PA_DATA);
		break;
	case KRB5_ET_KRB5KDC_ERR_PREAUTH_REQUIRED:
	case KRB5_ET_KRB5KDC_ERR_PREAUTH_FAILED:
	case KRB5_ET_KRB5KDC_ERR_ETYPE_NOSUPP:
	case KRB5_ET_KDC_ERR_WRONG_REALM:
	case KRB5_ET_KDC_ERR_PREAUTH_EXPIRED:
	case KRB5_ET_KDC_ERR_MORE_PREAUTH_DATA_REQUIRED:
	case KRB5_ET_KDC_ERR_PREAUTH_BAD_AUTHENTICATION_SET:
	case KRB5_ET_KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_kerberos_e_data, dissect_kerberos_SEQUENCE_OF_PA_DATA);

		break;
	default:
		offset=dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_kerberos_e_data, NULL);
	}


#.FN_BODY PADATA-TYPE VAL_PTR=&(private_data->padata_type)
	kerberos_private_data_t* private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s
#.FN_FTR PADATA-TYPE
	if(tree){
		proto_item_append_text(tree, " %s",
			val_to_str(private_data->padata_type, kerberos_PADATA_TYPE_vals,
			"Unknown:%d"));
	}

#.FN_BODY PA-DATA/padata-value
	proto_tree *sub_tree=tree;
	kerberos_private_data_t* private_data = kerberos_get_private_data(actx);

	if(actx->created_item){
		sub_tree=proto_item_add_subtree(actx->created_item, ett_kerberos_PA_DATA);
	}

	switch(private_data->padata_type){
	case KERBEROS_PA_TGS_REQ:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_Applications);
		break;
	case KERBEROS_PA_PK_AS_REP_19:
		private_data->is_win2k_pkinit = TRUE;
		if (kerberos_private_is_kdc_req(private_data)) {
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_pkinit_PA_PK_AS_REQ_Win2k);
		} else {
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_pkinit_PA_PK_AS_REP_Win2k);
		}
		break;
	case KERBEROS_PA_PK_AS_REQ:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_pkinit_PaPkAsReq);
		break;
	case KERBEROS_PA_PK_AS_REP:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_pkinit_PaPkAsRep);
		break;
	case KERBEROS_PA_PAC_REQUEST:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_PAC_REQUEST);
		break;
	case KERBEROS_PA_FOR_USER: /* S4U2SELF */
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_S4U2Self);
		break;
	case KERBEROS_PA_FOR_X509_USER:
		if(private_data->msg_type == KRB5_MSG_AS_REQ){
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_x509af_Certificate);
		}else if(private_data->is_enc_padata){
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, NULL);
		}else{
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_S4U_X509_USER);
		}
		break;
	case KERBEROS_PA_PROV_SRV_LOCATION:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_krb5_PA_PROV_SRV_LOCATION);
		break;
	case KERBEROS_PA_ENC_TIMESTAMP:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_ENC_TIMESTAMP);
		break;
	case KERBEROS_PA_ETYPE_INFO:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_ETYPE_INFO);
		break;
	case KERBEROS_PA_ETYPE_INFO2:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_ETYPE_INFO2);
		break;
	case KERBEROS_PA_PW_SALT:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_krb5_PW_SALT);
		break;
	case KERBEROS_PA_AUTHENTICATION_SET:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_AUTHENTICATION_SET);
		break;
	case KERBEROS_PA_FX_FAST:
		if(private_data->msg_type == KRB5_MSG_AS_REQ || private_data->msg_type == KRB5_MSG_TGS_REQ){
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_FX_FAST_REQUEST);
		}else{
			offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_FX_FAST_REPLY);
		}
		break;
	case KERBEROS_PA_ENCRYPTED_CHALLENGE:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_EncryptedChallenge);
		break;
	case KERBEROS_PA_SUPPORTED_ETYPES:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_PA_SUPPORTED_ENCTYPES);
		break;
	case KERBEROS_PA_PAC_OPTIONS:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset, hf_index, dissect_kerberos_PA_PAC_OPTIONS);
		break;
	case KERBEROS_PA_REQ_ENC_PA_REP:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, dissect_kerberos_Checksum);
		break;
	default:
		offset=dissect_ber_octet_string_wcb(FALSE, actx, sub_tree, tvb, offset,hf_index, NULL);
	}

#.FN_BODY HostAddress/address
	gint8 appclass;
	gboolean pc;
	gint32 tag;
	guint32 len;
	const char *address_str;
	proto_item *it=NULL;
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	/* read header and len for the octet string */
	offset=dissect_ber_identifier(actx->pinfo, tree, tvb, offset, &appclass, &pc, &tag);
	offset=dissect_ber_length(actx->pinfo, tree, tvb, offset, &len, NULL);

	switch(private_data->addr_type){
	case KERBEROS_ADDR_TYPE_IPV4:
		it=proto_tree_add_item(tree, hf_krb_address_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
		address_str = tvb_ip_to_str(tvb, offset);
		break;
	case KERBEROS_ADDR_TYPE_NETBIOS:
		{
		char netbios_name[(NETBIOS_NAME_LEN - 1)*4 + 1];
		int netbios_name_type;
		int netbios_name_len = (NETBIOS_NAME_LEN - 1)*4 + 1;

		netbios_name_type = process_netbios_name(tvb_get_ptr(tvb, offset, 16), netbios_name, netbios_name_len);
		address_str = wmem_strdup_printf(wmem_packet_scope(), "%s<%02x>", netbios_name, netbios_name_type);
		it=proto_tree_add_string_format(tree, hf_krb_address_netbios, tvb, offset, 16, netbios_name, "NetBIOS Name: %s (%s)", address_str, netbios_name_type_descr(netbios_name_type));
		}
		break;
	case KERBEROS_ADDR_TYPE_IPV6:
		it=proto_tree_add_item(tree, hf_krb_address_ipv6, tvb, offset, INET6_ADDRLEN, ENC_NA);
		address_str = tvb_ip6_to_str(tvb, offset);
		break;
	default:
		proto_tree_add_expert(tree, actx->pinfo, &ei_kerberos_address, tvb, offset, len);
		address_str = NULL;
	}

	/* push it up two levels in the decode pane */
	if(it && address_str){
		proto_item_append_text(proto_item_get_parent(it), " %s",address_str);
		proto_item_append_text(proto_item_get_parent_nth(it, 2), " %s",address_str);
	}

	offset+=len;
	return offset;


#.TYPE_ATTR
#xxx TYPE = FT_UINT16  DISPLAY = BASE_DEC  STRINGS = VALS(xx_vals)

#.FN_BODY ENCTYPE VAL_PTR=&(private_data->etype)
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s

#.FN_BODY EncryptedTicketData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_ticket_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedAuthorizationData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_authorization_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedAuthenticator/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_authenticator_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedKDCREPData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_KDC_REP_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY PA-ENC-TIMESTAMP/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_PA_ENC_TIMESTAMP);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedAPREPData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_AP_REP_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedKrbPrivData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_PRIV_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;

#.FN_BODY EncryptedKrbCredData/cipher
##ifdef HAVE_KERBEROS
	offset=dissect_ber_octet_string_wcb(FALSE, actx, tree, tvb, offset, hf_index, dissect_krb5_decrypt_CRED_data);
##else
%(DEFAULT_BODY)s
##endif
	return offset;


#.FN_BODY CKSUMTYPE VAL_PTR=&(private_data->checksum_type)
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s

#.FN_BODY Checksum/checksum
	tvbuff_t *next_tvb;
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	switch(private_data->checksum_type){
	case KRB5_CHKSUM_GSSAPI:
		offset=dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, &next_tvb);
		dissect_krb5_rfc1964_checksum(actx, tree, next_tvb);
		break;
	default:
		offset=dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, NULL);
	}
	return offset;

#.FN_BODY EncryptionKey/keytype VAL_PTR=&gbl_keytype
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	offset = dissect_ber_integer(implicit_tag, actx, tree, tvb, offset, hf_index,
									&gbl_keytype);
	private_data->key.keytype = gbl_keytype;

#.FN_BODY EncryptionKey/keyvalue VAL_PTR=&out_tvb
	tvbuff_t *out_tvb;
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

%(DEFAULT_BODY)s

	private_data->key.keylength = tvb_reported_length(out_tvb);
	private_data->key.keyvalue = tvb_get_ptr(out_tvb, 0, private_data->key.keylength);

#.FN_BODY EncryptionKey
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	%(DEFAULT_BODY)s

	if (private_data->key.keytype != 0 && private_data->key.keylength > 0) {
##ifdef HAVE_KERBEROS
		add_encryption_key(actx->pinfo, private_data->key.keytype, private_data->key.keylength, private_data->key.keyvalue, "key");
##endif
	}

#.FN_BODY AUTHDATA-TYPE VAL_PTR=&(private_data->ad_type)
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s

#.FN_BODY AuthorizationData/_item/ad-data
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);

	switch(private_data->ad_type){
	case KERBEROS_AD_WIN2K_PAC:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_krb5_AD_WIN2K_PAC);
		break;
	case KERBEROS_AD_IF_RELEVANT:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_kerberos_AD_IF_RELEVANT);
		break;
	case KERBEROS_AD_GSS_API_ETYPE_NEGOTIATION:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_kerberos_SEQUENCE_OF_ENCTYPE);
		break;
	case KERBEROS_AD_TOKEN_RESTRICTIONS:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_kerberos_KERB_AD_RESTRICTION_ENTRY);
		break;
	case KERBEROS_AD_AP_OPTIONS:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_kerberos_AD_AP_OPTIONS);
		break;
	case KERBEROS_AD_TARGET_PRINCIPAL:
		offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset, hf_index, dissect_kerberos_AD_TARGET_PRINCIPAL);
		break;
	default:
		offset=dissect_ber_octet_string(implicit_tag, actx, tree, tvb, offset, hf_index, NULL);
	}

#.FN_BODY S4UUserID/subject-certificate
	offset=dissect_ber_octet_string_wcb(implicit_tag, actx, tree, tvb, offset,hf_index, dissect_x509af_Certificate);

#.FN_BODY ADDR-TYPE VAL_PTR=&(private_data->addr_type)
	kerberos_private_data_t *private_data = kerberos_get_private_data(actx);
%(DEFAULT_BODY)s

#.FN_BODY KDC-REQ-BODY
	conversation_t *conversation;

	/*
	 * UDP replies to KDC_REQs are sent from the server back to the client's
	 * source port, similar to the way TFTP works.  Set up a conversation
	 * accordingly.
	 *
	 * Ref: Section 7.2.1 of
	 * http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-kerberos-clarifications-07.txt
	 */
	if (actx->pinfo->destport == UDP_PORT_KERBEROS && actx->pinfo->ptype == PT_UDP) {
		conversation = find_conversation(actx->pinfo->num, &actx->pinfo->src, &actx->pinfo->dst, ENDPOINT_UDP,
											actx->pinfo->srcport, 0, NO_PORT_B);
		if (conversation == NULL) {
			conversation = conversation_new(actx->pinfo->num, &actx->pinfo->src, &actx->pinfo->dst, ENDPOINT_UDP,
											actx->pinfo->srcport, 0, NO_PORT2);
			conversation_set_dissector(conversation, kerberos_handle_udp);
		}
	}

	%(DEFAULT_BODY)s

#.FN_BODY KRB-SAFE-BODY/user-data
	kerberos_private_data_t* private_data = kerberos_get_private_data(actx);
	tvbuff_t *new_tvb;
	offset=dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, &new_tvb);
	if (new_tvb) {
		call_kerberos_callbacks(actx->pinfo, tree, new_tvb, KRB_CBTAG_SAFE_USER_DATA, private_data->callbacks);
	}

#.FN_BODY EncKrbPrivPart/user-data
	kerberos_private_data_t* private_data = kerberos_get_private_data(actx);
	tvbuff_t *new_tvb;
	offset=dissect_ber_octet_string(FALSE, actx, tree, tvb, offset, hf_index, &new_tvb);
	if (new_tvb) {
		call_kerberos_callbacks(actx->pinfo, tree, new_tvb, KRB_CBTAG_PRIV_USER_DATA, private_data->callbacks);
	}

#.FN_HDR EncKDCRepPart/encrypted-pa-data
	kerberos_private_data_t* private_data = kerberos_get_private_data(actx);
	private_data->is_enc_padata = TRUE;

#.FN_FTR EncKDCRepPart/encrypted-pa-data
	private_data->is_enc_padata = FALSE;