kerberos/gss enhancements

add a parameter *datalen to decrypt_krb5_data() so that we can pass back
the length of the decrypted blob back to the caller.
This is useful for when there are "junk" at the end of the blob and thus
the decrypted data is not the same size as the encrypted blob.
GSS CFX is one such example.
(we should have done this earlier since it might have made some other
stuff easier to imlement...)

make the preference setting krb_decrypt a globally visible variable so
we can see its value and act on it from callers of krb decryption from
outside of packet-kerberos.c    i.e.   from GSS CFX

Make keytype == -1  a wildcard that when passed to decrypt_krb5_data()
will try any/all encryption keys.
This since GSS CFX does not provide the enctype in the GSS layer.
(The GSS CFX enctype is only negotiated during the AP-REQ/REP  so we
should later pick this value up and store it in a CFX session variable.
That is for a later enhancement.
)

Enhance the GSS decryption (that for hitorical reasons are implemented
in packet-spnego.c  and not packet-gssapi.c :-)  )
to also handle decryption of GSS CFX

This should make wireshark able to decrypt any/all GSSAPI  RFC4121
packets, if the keytab file is provided.

I have successfully decrypted LDAP using GSS CFX with AES encryption
with this.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@26350 f5534014-38df-0310-8fa8-9805f1628bb7

diff --git a/asn1/spnego/packet-spnego-template.c b/asn1/spnego/packet-spnego-template.c
index db50eef85fc6841dbc6185573100744183f4af4a..9ec5b0fc3ad8f6cb637f7ff7249d5ae7dc7620fd 100644 (file)
--- a/asn1/spnego/packet-spnego-template.c
+++ b/asn1/spnego/packet-spnego-template.c
@@ -646,13 +646,100 @@ decrypt_gssapi_krb_arcfour_wrap(proto_tree *tree, packet_info *pinfo, tvbuff_t *
        }
        return;
 }
+
+/* borrowed from heimdal */
+static int
+rrc_rotate(void *data, int len, guint16 rrc, int unrotate)
+{
+       u_char *tmp, buf[256];
+       size_t left;
+
+       if (len == 0)
+               return 0;
+
+       rrc %= len;
+
+       if (rrc == 0)
+               return 0;
+
+       left = len - rrc;
+
+       if (rrc <= sizeof(buf)) {
+               tmp = buf;
+       } else {
+               tmp = malloc(rrc);
+               if (tmp == NULL)
+                       return -1;
+       }
+
+       if (unrotate) {
+               memcpy(tmp, data, rrc);
+               memmove(data, (u_char *)data + rrc, left);
+               memcpy((u_char *)data + left, tmp, rrc);
+       } else {
+               memcpy(tmp, (u_char *)data + left, rrc);
+               memmove((u_char *)data + rrc, data, left);
+               memcpy(data, tmp, rrc);
+       }
+
+       if (rrc > sizeof(buf))
+               free(tmp);
+
+       return 0;
+}
+
+
+#define KRB5_KU_USAGE_ACCEPTOR_SEAL    22
+#define KRB5_KU_USAGE_ACCEPTOR_SIGN    23
+#define KRB5_KU_USAGE_INITIATOR_SEAL   24
+#define KRB5_KU_USAGE_INITIATOR_SIGN   25
+
+static void
+decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff_t *tvb _U_, guint16 ec _U_, guint16 rrc _U_, int keytype, unsigned int usage)
+{
+       int res;
+       char *rotated;
+       char *output;
+       int datalen;
+
+       /* dont do anything if we are not attempting to decrypt data */
+       if(!krb_decrypt){
+               return;
+       }
+
+       rotated = ep_alloc(tvb_length(tvb));
+
+       tvb_memcpy(tvb, rotated, 0, tvb_length(tvb));
+       res = rrc_rotate(rotated, tvb_length(tvb), rrc, TRUE);
+
+       output = decrypt_krb5_data(tree, pinfo, usage, tvb_length(tvb),
+                 rotated, keytype, &datalen);
+
+       if (output) {
+               char *outdata;
+
+               outdata = ep_alloc(tvb_length(tvb));
+               memcpy(outdata, output, tvb_length(tvb));
+               g_free(output);
+
+               pinfo->gssapi_decrypted_tvb=tvb_new_real_data(
+                       outdata,
+                       datalen-16,
+                       datalen-16);
+               tvb_set_child_real_data_tvbuff(tvb, pinfo->gssapi_decrypted_tvb);
+               add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
+               return;
+       }
+       return;
+}
+
 #endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
 
 
 #endif
 
 /*
- * XXX - This is for GSSAPI Wrap tokens ...
+ * This is for GSSAPI Wrap tokens ...
  */
 static int
 dissect_spnego_krb5_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
@@ -880,7 +967,7 @@ dissect_spnego_krb5_cfx_flags(tvbuff_t *tvb, int offset,
 }
 
 /*
- * XXX - This is for GSSAPI CFX Wrap tokens ...
+ * This is for GSSAPI CFX Wrap tokens ...
  */
 static int
 dissect_spnego_krb5_cfx_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
@@ -975,6 +1062,24 @@ dissect_spnego_krb5_cfx_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
                }
        }
 
+#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
+       pinfo->gssapi_encrypted_tvb = tvb_new_subset(tvb, 16, -1, -1);
+
+       if (flags & 0x0002) {
+               if(pinfo->gssapi_encrypted_tvb){
+                       decrypt_gssapi_krb_cfx_wrap(tree,
+                               pinfo,
+                               pinfo->gssapi_encrypted_tvb,
+                               ec,
+                               rrc,
+                               -1,
+                               (flags & 0x0001)?
+                               KRB5_KU_USAGE_ACCEPTOR_SEAL:
+                               KRB5_KU_USAGE_INITIATOR_SEAL);
+               }
+       }
+#endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
+
        /*
         * Return the offset past the checksum, so that we know where
         * the data we're wrapped around starts.  Also, set the length

diff --git a/epan/dissectors/packet-kerberos.c b/epan/dissectors/packet-kerberos.c
index bff55eefe8e60d5241f1767e2688ea8196f1ebf3..8f683ad9739cb3e0389a165783ee2598266251df 100644 (file)
--- a/epan/dissectors/packet-kerberos.c
+++ b/epan/dissectors/packet-kerberos.c
@@ -382,7 +382,7 @@ call_kerberos_callbacks(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int
 #ifdef HAVE_KERBEROS
 
 /* Decrypt Kerberos blobs */
-static gboolean krb_decrypt = FALSE;
+gboolean krb_decrypt = FALSE;
 
 /* keytab filename */
 static const char *keytab_filename = "insert filename here";
@@ -406,7 +406,7 @@ add_encryption_key(packet_info *pinfo, int keytype, int keylength, const char *k
        if(pinfo->fd->flags.visited){
                return;
        }
-printf("added key in %u\n",pinfo->fd->num);
+printf("added key in %u    keytype:%d len:%d\n",pinfo->fd->num, keytype, keylength);
 
        new_key=g_malloc(sizeof(enc_key_t));
        g_snprintf(new_key->key_origin, KRB_MAX_ORIG_LEN, "%s learnt from frame %u",origin,pinfo->fd->num);
@@ -497,7 +497,8 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                        int usage,
                        int length,
                        const guint8 *cryptotext,
-                       int keytype)
+                       int keytype,
+                       int *datalen)
 {
        static int first_time=1;
        krb5_error_code ret;
@@ -523,7 +524,7 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                krb5_enc_data input;
 
                /* shortcircuit and bail out if enctypes are not matching */
-               if(ek->keytype!=keytype){
+               if((keytype != -1) && (ek->keytype != keytype)) {
                        continue;
                }
 
@@ -544,11 +545,14 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                if((ret == 0) && (length>0)){
                        char *user_data;
 
-printf("woohoo decrypted keytype:%d in frame:%u\n", keytype, pinfo->fd->num);
+printf("woohoo decrypted keytype:%d in frame:%u\n", ek->keytype, pinfo->fd->num);
                        proto_tree_add_text(tree, NULL, 0, 0, "[Decrypted using: %s]", ek->key_origin);
                        /* return a private g_malloced blob to the caller */
                        user_data=g_malloc(data.length);
                        memcpy(user_data, data.data, data.length);
+                       if (datalen) {
+                               *datalen = data.length;
+                       }
                        return user_data;
                }
        }
@@ -565,7 +569,6 @@ read_keytab_file(const char *filename)
        krb5_keytab keytab;
        krb5_error_code ret;
        krb5_keytab_entry key;
-       krb5_error_code ret;
        krb5_kt_cursor cursor;
        enc_key_t *new_key;
        static int first_time=1;
@@ -631,7 +634,8 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                        int usage,
                        int length,
                        const guint8 *cryptotext,
-                       int keytype)
+                       int keytype,
+                       int *datalen)
 {
        static int first_time=1;
        krb5_error_code ret;
@@ -658,7 +662,7 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                guint8 *cryptocopy; /* workaround for pre-0.6.1 heimdal bug */
 
                /* shortcircuit and bail out if enctypes are not matching */
-               if(ek->keytype!=keytype){
+               if((keytype != -1) && (ek->keytype != keytype)) {
                        continue;
                }
 
@@ -686,12 +690,15 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                if((ret == 0) && (length>0)){
                        char *user_data;
 
-printf("woohoo decrypted keytype:%d in frame:%u\n", keytype, pinfo->fd->num);
+printf("woohoo decrypted keytype:%d in frame:%u\n", ek->keytype, pinfo->fd->num);
                        proto_tree_add_text(tree, NULL, 0, 0, "[Decrypted using: %s]", ek->key_origin);
                        krb5_crypto_destroy(krb5_ctx, crypto);
                        /* return a private g_malloced blob to the caller */
                        user_data=g_malloc(data.length);
                        memcpy(user_data, data.data, data.length);
+                       if (datalen) {
+                               *datalen = data.length;
+                       }
                        return user_data;
                }
                krb5_crypto_destroy(krb5_ctx, crypto);
@@ -802,7 +809,8 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                        int _U_ usage,
                        int length,
                        const guint8 *cryptotext,
-                       int keytype)
+                       int keytype,
+                       int *datalen)
 {
        tvbuff_t *encr_tvb;
        guint8 *decrypted_data = NULL, *plaintext = NULL;
@@ -882,6 +890,9 @@ g_warning("woohoo decrypted keytype:%d in frame:%u\n", keytype, pinfo->fd->num);
                        tvb_memcpy(encr_tvb, plaintext, CONFOUNDER_PLUS_CHECKSUM, data_len);
                        tvb_free(encr_tvb);
 
+                       if (datalen) {
+                               *datalen = data_len;
+                       }
                        g_free(decrypted_data);
                        return(plaintext);
                }
@@ -2087,7 +2098,7 @@ dissect_krb5_decrypt_PA_ENC_TIMESTAMP (proto_tree *tree, tvbuff_t *tvb, int offs
         * == 1
         */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 1, length, tvb_get_ptr(tvb, offset, length), PA_ENC_TIMESTAMP_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 1, length, tvb_get_ptr(tvb, offset, length), PA_ENC_TIMESTAMP_etype, NULL);
        }
 
        if(plaintext){
@@ -3473,7 +3484,7 @@ dissect_krb5_decrypt_PRIV (proto_tree *tree, tvbuff_t *tvb, int offset, asn1_ctx
        length=tvb_length_remaining(tvb, offset);
 
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 13, length, tvb_get_ptr(tvb, offset, length), PRIV_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 13, length, tvb_get_ptr(tvb, offset, length), PRIV_etype, NULL);
        }
 
        if(plaintext){
@@ -3627,7 +3638,7 @@ dissect_krb5_decrypt_EncKrbCredPart (proto_tree *tree, tvbuff_t *tvb, int offset
         * == 14
         */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 14, length, tvb_get_ptr(tvb, offset, length), EncKrbCredPart_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 14, length, tvb_get_ptr(tvb, offset, length), EncKrbCredPart_etype, NULL);
        }
 
        if(plaintext){
@@ -3783,10 +3794,10 @@ dissect_krb5_decrypt_enc_authorization_data(proto_tree *tree, tvbuff_t *tvb, int
        if a sub-session key is used, or 4 if the session key is used.
        */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 4, length, tvb_get_ptr(tvb, offset, length), enc_authorization_data_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 4, length, tvb_get_ptr(tvb, offset, length), enc_authorization_data_etype, NULL);
        }
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 5, length, tvb_get_ptr(tvb, offset, length), enc_authorization_data_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 5, length, tvb_get_ptr(tvb, offset, length), enc_authorization_data_etype, NULL);
        }
 
        if(plaintext){
@@ -3977,10 +3988,10 @@ dissect_krb5_decrypt_authenticator_data (proto_tree *tree, tvbuff_t *tvb, int of
         * == 11
         */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 7, length, tvb_get_ptr(tvb, offset, length), authenticator_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 7, length, tvb_get_ptr(tvb, offset, length), authenticator_etype, NULL);
        }
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 11, length, tvb_get_ptr(tvb, offset, length), authenticator_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 11, length, tvb_get_ptr(tvb, offset, length), authenticator_etype, NULL);
        }
 
        if(plaintext){
@@ -4061,7 +4072,7 @@ dissect_krb5_decrypt_Ticket_data (proto_tree *tree, tvbuff_t *tvb, int offset, a
         * 7.5.1
         * All Ticket encrypted parts use usage == 2
         */
-       if( (plaintext=decrypt_krb5_data(tree, actx->pinfo, 2, length, tvb_get_ptr(tvb, offset, length), Ticket_etype)) ){
+       if( (plaintext=decrypt_krb5_data(tree, actx->pinfo, 2, length, tvb_get_ptr(tvb, offset, length), Ticket_etype, NULL)) ){
                tvbuff_t *next_tvb;
                next_tvb = tvb_new_real_data (plaintext,
                                           length,
@@ -4193,7 +4204,7 @@ dissect_krb5_decrypt_AP_REP_data(proto_tree *tree, tvbuff_t *tvb, int offset, as
         * == 11
         */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 12, length, tvb_get_ptr(tvb, offset, length), AP_REP_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 12, length, tvb_get_ptr(tvb, offset, length), AP_REP_etype, NULL);
        }
 
        if(plaintext){
@@ -4301,13 +4312,13 @@ dissect_krb5_decrypt_KDC_REP_data (proto_tree *tree, tvbuff_t *tvb, int offset,
      * == 9
         */
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 3, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 3, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype, NULL);
        }
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 8, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 8, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype, NULL);
        }
        if(!plaintext){
-               plaintext=decrypt_krb5_data(tree, actx->pinfo, 9, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype);
+               plaintext=decrypt_krb5_data(tree, actx->pinfo, 9, length, tvb_get_ptr(tvb, offset, length), KDC_REP_etype, NULL);
        }
 
        if(plaintext){

diff --git a/epan/dissectors/packet-kerberos.h b/epan/dissectors/packet-kerberos.h
index 748971a5b7f78e2458b2a973a131f67062c004ac..c9607bd7a6d844adbb3e866f80b3745f3b766243 100644 (file)
--- a/epan/dissectors/packet-kerberos.h
+++ b/epan/dissectors/packet-kerberos.h
@@ -79,10 +79,13 @@ decrypt_krb5_data(proto_tree *tree, packet_info *pinfo,
                        int usage,
                        int length,
                        const guint8 *cryptotext,
-                       int keytype);
+                       int keytype,
+                       int *datalen);
 
 #endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
 
+extern gboolean krb_decrypt;
+
 #endif /* HAVE_KERBEROS */
 
 #endif /* __PACKET_KERBEROS_H */

diff --git a/epan/dissectors/packet-kink.c b/epan/dissectors/packet-kink.c
index 22c876a2b1dd8f80b0ef7abad0fa4da47640b209..c92fc9135e82af5ecfdd9fd6a875156b02fc9c2b 100644 (file)
--- a/epan/dissectors/packet-kink.c
+++ b/epan/dissectors/packet-kink.c
@@ -745,7 +745,7 @@ dissect_payload_kink_encrypt(packet_info *pinfo, tvbuff_t *tvb, int offset, prot
 
   if(keytype != 0){
 #ifdef HAVE_KERBEROS
-    plaintext=decrypt_krb5_data(tree, pinfo, 0, encrypt_length, data_value, keytype);    
+    plaintext=decrypt_krb5_data(tree, pinfo, 0, encrypt_length, data_value, keytype, NULL);    
     if(plaintext){
       next_tvb=tvb_new_real_data(plaintext, encrypt_length, encrypt_length);
       tvb_set_child_real_data_tvbuff(tvb, next_tvb);

diff --git a/epan/dissectors/packet-spnego.c b/epan/dissectors/packet-spnego.c
index 4e342284139b75aa8e6637191fa58e37629189fd..a8f8a1a85221bd03334ffef54eb70721941fca78 100644 (file)
--- a/epan/dissectors/packet-spnego.c
+++ b/epan/dissectors/packet-spnego.c
@@ -1145,13 +1145,100 @@ decrypt_gssapi_krb_arcfour_wrap(proto_tree *tree, packet_info *pinfo, tvbuff_t *
        }
        return;
 }
+
+/* borrowed from heimdal */
+static int
+rrc_rotate(void *data, int len, guint16 rrc, int unrotate)
+{
+       u_char *tmp, buf[256];
+       size_t left;
+
+       if (len == 0)
+               return 0;
+
+       rrc %= len;
+
+       if (rrc == 0)
+               return 0;
+
+       left = len - rrc;
+
+       if (rrc <= sizeof(buf)) {
+               tmp = buf;
+       } else {
+               tmp = malloc(rrc);
+               if (tmp == NULL)
+                       return -1;
+       }
+
+       if (unrotate) {
+               memcpy(tmp, data, rrc);
+               memmove(data, (u_char *)data + rrc, left);
+               memcpy((u_char *)data + left, tmp, rrc);
+       } else {
+               memcpy(tmp, (u_char *)data + left, rrc);
+               memmove((u_char *)data + rrc, data, left);
+               memcpy(data, tmp, rrc);
+       }
+
+       if (rrc > sizeof(buf))
+               free(tmp);
+
+       return 0;
+}
+
+
+#define KRB5_KU_USAGE_ACCEPTOR_SEAL    22
+#define KRB5_KU_USAGE_ACCEPTOR_SIGN    23
+#define KRB5_KU_USAGE_INITIATOR_SEAL   24
+#define KRB5_KU_USAGE_INITIATOR_SIGN   25
+
+static void
+decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff_t *tvb _U_, guint16 ec _U_, guint16 rrc _U_, int keytype, unsigned int usage)
+{
+       int res;
+       char *rotated;
+       char *output;
+       int datalen;
+
+       /* dont do anything if we are not attempting to decrypt data */
+       if(!krb_decrypt){
+               return;
+       }
+
+       rotated = ep_alloc(tvb_length(tvb));
+
+       tvb_memcpy(tvb, rotated, 0, tvb_length(tvb));
+       res = rrc_rotate(rotated, tvb_length(tvb), rrc, TRUE);
+
+       output = decrypt_krb5_data(tree, pinfo, usage, tvb_length(tvb),
+                 rotated, keytype, &datalen);
+
+       if (output) {
+               char *outdata;
+
+               outdata = ep_alloc(tvb_length(tvb));
+               memcpy(outdata, output, tvb_length(tvb));
+               g_free(output);
+
+               pinfo->gssapi_decrypted_tvb=tvb_new_real_data(
+                       outdata,
+                       datalen-16,
+                       datalen-16);
+               tvb_set_child_real_data_tvbuff(tvb, pinfo->gssapi_decrypted_tvb);
+               add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
+               return;
+       }
+       return;
+}
+
 #endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
 
 
 #endif
 
 /*
- * XXX - This is for GSSAPI Wrap tokens ...
+ * This is for GSSAPI Wrap tokens ...
  */
 static int
 dissect_spnego_krb5_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
@@ -1379,7 +1466,7 @@ dissect_spnego_krb5_cfx_flags(tvbuff_t *tvb, int offset,
 }
 
 /*
- * XXX - This is for GSSAPI CFX Wrap tokens ...
+ * This is for GSSAPI CFX Wrap tokens ...
  */
 static int
 dissect_spnego_krb5_cfx_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
@@ -1474,6 +1561,24 @@ dissect_spnego_krb5_cfx_wrap_base(tvbuff_t *tvb, int offset, packet_info *pinfo
                }
        }
 
+#if defined(HAVE_HEIMDAL_KERBEROS) || defined(HAVE_MIT_KERBEROS)
+       pinfo->gssapi_encrypted_tvb = tvb_new_subset(tvb, 16, -1, -1);
+
+       if (flags & 0x0002) {
+               if(pinfo->gssapi_encrypted_tvb){
+                       decrypt_gssapi_krb_cfx_wrap(tree,
+                               pinfo,
+                               pinfo->gssapi_encrypted_tvb,
+                               ec,
+                               rrc,
+                               -1,
+                               (flags & 0x0001)?
+                               KRB5_KU_USAGE_ACCEPTOR_SEAL:
+                               KRB5_KU_USAGE_INITIATOR_SEAL);
+               }
+       }
+#endif /* HAVE_HEIMDAL_KERBEROS || HAVE_MIT_KERBEROS */
+
        /*
         * Return the offset past the checksum, so that we know where
         * the data we're wrapped around starts.  Also, set the length
@@ -1858,7 +1963,7 @@ void proto_register_spnego(void) {
         "", HFILL }},
 
 /*--- End of included file: packet-spnego-hfarr.c ---*/
-#line 1274 "packet-spnego-template.c"
+#line 1379 "packet-spnego-template.c"
        };
 
        /* List of subtrees */
@@ -1880,7 +1985,7 @@ void proto_register_spnego(void) {
     &ett_spnego_InitialContextToken_U,
 
 /*--- End of included file: packet-spnego-ettarr.c ---*/
-#line 1284 "packet-spnego-template.c"
+#line 1389 "packet-spnego-template.c"
        };
 
        /* Register protocol */