py-mspack-decoder 0.1.1__tar.gz

py_mspack_decoder-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Simon Fonteneau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

py_mspack_decoder-0.1.1/PKG-INFO

@@ -0,0 +1,55 @@
+Metadata-Version: 2.4
+Name: py-mspack-decoder
+Version: 0.1.1
+Summary: Pure-Python Microsoft Kerberos PAC decoder
+Author: Simon Fonteneau
+License-Expression: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: gssapi
+Requires-Dist: gssapi>=1.8; extra == "gssapi"
+Dynamic: license-file
+
+# py-mspack-decoder
+
+Pure-Python decoder for Microsoft Kerberos PAC structures, including compressed claims (LZNT1, XPRESS and XPRESS Huffman). No third-party dependencies for PAC **decoding**.
+
+**AI-assisted development:** Most of the implementation was written with AI coding tools under human direction. It has not undergone an independent security audit.
+
+
+
+## Minimal Flask + Kerberos example
+
+See [examples/flask_gssapi.py](examples/flask_gssapi.py). It accepts an HTTP `Authorization: Negotiate` token using the service keytab, obtains a completed **Kerberos acceptor** context, and calls:
+
+```python
+from pac_decoder.gssapi_helpers import decode_completed_context
+
+pac_info = decode_completed_context(ctx)
+print(pac_info["sid"], pac_info["groups"])
+```
+
+The helper requires a completed Kerberos acceptor context and exactly one `urn:mspac:` attribute flagged `authenticated` and `complete` by GSSAPI. It then strictly decodes the PAC. The underlying GSSAPI/Kerberos implementation, **not this package**, verifies PAC authenticity; successful authentication alone is not enough if the authenticated PAC attribute is missing.
+
+### Run the example
+
+The server must have a valid `HTTP/<hostname>@REALM` principal in its keytab, and MIT Kerberos must support the authenticated `urn:mspac:` attribute.
+
+```bash
+export KRB5_KTNAME=/path/to/http.keytab
+export KERBEROS_HOSTNAME=service.example.com
+flask --app examples/flask_gssapi.py run --host 127.0.0.1
+```
+
+From a Kerberos-authenticated client, over your HTTPS reverse proxy:
+
+```bash
+curl --negotiate -u : https://service.example.com/pac
+```
+
+This is intentionally a **one-round-trip Kerberos HTTP** example. It rejects negotiations needing several GSSAPI exchanges instead of attempting to resume a lost context. Use TLS, a trusted reverse proxy and a production WSGI server for a real service. The endpoint returns identity information only as a demonstration; do not expose it publicly. PAC group membership reflects ticket issuance time, not necessarily current AD state.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

py_mspack_decoder-0.1.1/README.md

@@ -0,0 +1,42 @@
+# py-mspack-decoder
+
+Pure-Python decoder for Microsoft Kerberos PAC structures, including compressed claims (LZNT1, XPRESS and XPRESS Huffman). No third-party dependencies for PAC **decoding**.
+
+**AI-assisted development:** Most of the implementation was written with AI coding tools under human direction. It has not undergone an independent security audit.
+
+
+
+## Minimal Flask + Kerberos example
+
+See [examples/flask_gssapi.py](examples/flask_gssapi.py). It accepts an HTTP `Authorization: Negotiate` token using the service keytab, obtains a completed **Kerberos acceptor** context, and calls:
+
+```python
+from pac_decoder.gssapi_helpers import decode_completed_context
+
+pac_info = decode_completed_context(ctx)
+print(pac_info["sid"], pac_info["groups"])
+```
+
+The helper requires a completed Kerberos acceptor context and exactly one `urn:mspac:` attribute flagged `authenticated` and `complete` by GSSAPI. It then strictly decodes the PAC. The underlying GSSAPI/Kerberos implementation, **not this package**, verifies PAC authenticity; successful authentication alone is not enough if the authenticated PAC attribute is missing.
+
+### Run the example
+
+The server must have a valid `HTTP/<hostname>@REALM` principal in its keytab, and MIT Kerberos must support the authenticated `urn:mspac:` attribute.
+
+```bash
+export KRB5_KTNAME=/path/to/http.keytab
+export KERBEROS_HOSTNAME=service.example.com
+flask --app examples/flask_gssapi.py run --host 127.0.0.1
+```
+
+From a Kerberos-authenticated client, over your HTTPS reverse proxy:
+
+```bash
+curl --negotiate -u : https://service.example.com/pac
+```
+
+This is intentionally a **one-round-trip Kerberos HTTP** example. It rejects negotiations needing several GSSAPI exchanges instead of attempting to resume a lost context. Use TLS, a trusted reverse proxy and a production WSGI server for a real service. The endpoint returns identity information only as a demonstration; do not expose it publicly. PAC group membership reflects ticket issuance time, not necessarily current AD state.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

py_mspack_decoder-0.1.1/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "py-mspack-decoder"
+version = "0.1.1"
+description = "Pure-Python Microsoft Kerberos PAC decoder"
+readme = "README.md"
+requires-python = ">=3.9"
+license = "MIT"
+authors = [{ name = "Simon Fonteneau" }]
+dependencies = []
+
+[project.optional-dependencies]
+gssapi = ["gssapi>=1.8"]
+
+[tool.setuptools.packages.find]
+where = ["src"]

py_mspack_decoder-0.1.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

py_mspack_decoder-0.1.1/src/pac_decoder/__init__.py

@@ -0,0 +1,220 @@
+"""Pure-Python, dependency-free Microsoft Privilege Attribute Certificate decoding.
+
+Security contract:
+* ``decode_pac`` is a parser and does NOT authenticate PACs or signatures.
+* For authorization, use ``decode_completed_context`` after GSSAPI has verified
+  the PAC name attribute, or otherwise establish the trust of the raw bytes.
+* The default strict mode rejects ambiguous or malformed recognized buffers,
+  rather than returning an incomplete authorization identity.
+* ``strict=False`` is for offline diagnostics ONLY, never authorization.
+"""
+
+from __future__ import annotations
+from .binary import (
+    PACDecodeError, decode_attributes_info, decode_client_info,
+    decode_sid, decode_signature_type, decode_upn_dns_info, parse_pac,
+)
+from .claims import decode_claims_info
+from .logon import decode_device_info, decode_logon_info, decode_delegation_info
+
+BUFFER_NAMES = {
+    1: "logon_info", 2: "credential_info", 6: "server_checksum",
+    7: "kdc_checksum", 10: "client_info", 11: "constrained_delegation",
+    12: "upn_dns_info", 13: "client_claims_info", 14: "device_info",
+    15: "device_claims_info", 16: "ticket_checksum", 17: "attributes_info",
+    18: "requestor_sid", 19: "full_checksum",
+}
+SIG_NAMES = {6: "server", 7: "kdc", 16: "ticket", 19: "full"}
+# [MS-PAC] 2.4 explicitly requires recipients to ignore additional instances
+# of these known buffer types. PAC_REQUESTOR_SID (18) is deliberately omitted:
+# the published type entry requires one but does not specify how to handle
+# additional instances. Do not silently choose between different requestors.
+# https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/3341cfa2-6ef5-42e0-b7bc-4544884bf399
+_IGNORABLE_DUPLICATE_TYPES = frozenset({
+    1, 2, 6, 7, 10, 11, 12, 13, 14, 15, 16, 17, 19,
+})
+_EMPTY = (
+    "sid", "sam_name", "upn", "dns_domain", "upn_dns_flags", "upn_constructed",
+    "rid", "domain_sid", "domain_name", "logon_server", "full_name",
+    "groups", "group_memberships", "primary_group_rid", "extra_sids", "resource_groups",
+    "group_count", "account_flags", "user_flags", "sub_auth_status",
+    "last_logon", "last_successful_logon", "last_failed_logon",
+    "logoff_time", "kickoff_time", "password_last_set",
+    "password_can_change", "password_must_change", "logon_count",
+    "bad_password_count", "failed_logon_count", "home_directory",
+    "home_drive", "logon_script", "profile_path", "client_name",
+    "client_auth_time", "requestor_sid", "pac_requested",
+    "pac_given_implicitly", "pac_attributes_flags", "delegation_proxy_target",
+    "delegation_transited_services", "device_info", "client_claims_present",
+    "device_claims_present", "client_claims", "device_claims",
+    "credential_info_present", "pac_signature_types", "pac_version",
+    "pac_size", "pac_buffer_types", "pac_buffer_type_ids",
+)
+
+
+def empty_pac_info() -> dict:
+    return dict.fromkeys(_EMPTY)
+
+
+def _same_name(left: str | None, right: str | None) -> bool:
+    """SAM account names are case-insensitive; UPNs are separate identifiers."""
+    return left is None or right is None or left.casefold() == right.casefold()
+
+
+def _same_upn_info(left: dict, right: dict) -> bool:
+    """Do not silently prefer a separately supplied GSS attribute over the PAC."""
+    for key in ("sid", "sam_name", "upn", "dns_domain"):
+        a, b = left.get(key), right.get(key)
+        if isinstance(a, str) and isinstance(b, str):
+            if a.casefold() != b.casefold():
+                return False
+        elif a != b:
+            return False
+    return left["upn_dns_flags"] == right["upn_dns_flags"]
+
+
+def decode_pac(raw_pac: bytes, upn_dns_attribute: bytes | None = None,
+               *, errors: list[int] | None = None, strict: bool = True,
+               require_logon: bool = False,
+               ignore_invalid_claims: bool = False,
+               include_resource_groups: bool = True) -> dict:
+    """Decode a raw MS-PAC as a dictionary; **does not authenticate it**.
+    In strict mode (default), malformed recognized buffers, conflicting
+    identity buffers, and missing/invalid LOGON_INFO (when
+    ``require_logon=True``) raise PACDecodeError. For buffer types that MS-PAC
+    2.4 explicitly says may be duplicated, only the FIRST occurrence is
+    interpreted; later ones are ignored. Duplicate PAC_REQUESTOR_SID buffers
+    remain an error because MS-PAC does not specify an ignore rule for them.
+    Unknown buffer types are retained as metadata, not interpreted.
+    No partial result is returned.
+    ``strict=False`` is ONLY for offline diagnostics. In this mode malformed
+    buffers are skipped and their type IDs are recorded in ``errors``. Its
+    output MUST NOT be used for authorization. This is intentionally explicit
+    to preserve the older diagnostic API while making normal use fail closed.
+    ``upn_dns_attribute`` may ONLY come from an *independently authenticated*
+    and complete GSSAPI name attribute. The library can't establish trust
+    when caller-provided bytes are passed directly to this function.
+
+    ``ignore_invalid_claims=True`` is an explicit compatibility mode: only
+    malformed optional client/device claims (types 13 and 15) are skipped,
+    never identity, logon, group, or other buffers. Missing claims must not
+    be treated as successful claims-based authorization.
+    ``include_resource_groups=False`` excludes only PAC_LOGON_INFO
+    resource groups from top-level ``groups`` and ``resource_groups``.
+    It does not change raw ``group_memberships``, PAC_DEVICE_INFO, or
+    ``extra_sids`` (which may contain resource-domain SIDs).
+    """
+    if (type(strict) is not bool or type(require_logon) is not bool
+            or type(ignore_invalid_claims) is not bool
+            or type(include_resource_groups) is not bool):
+        raise TypeError("PAC decoder options must be booleans")
+    pac = parse_pac(raw_pac)
+    info = empty_pac_info()
+    info["pac_size"] = pac.size
+    info["pac_version"] = pac.version
+    info["pac_buffer_type_ids"] = [buf.type_id for buf in pac.buffers]
+    info["pac_buffer_types"] = [
+        BUFFER_NAMES.get(buf.type_id, f"unknown_{buf.type_id}")
+        for buf in pac.buffers
+    ]
+    present = set(info["pac_buffer_type_ids"])
+    info["client_claims_present"] = 13 in present
+    info["device_claims_present"] = 15 in present
+    info["credential_info_present"] = 2 in present
+    info["pac_signature_types"] = {}
+
+    seen = set()
+    buffers = {}
+    for buf in pac.buffers:
+        if buf.type_id in seen:
+            # The first occurrence always wins; an invalid FIRST occurrence
+            # must still fail strict parsing (never fall back to a later one).
+            # parse_pac() already validated the directory spans of ALL buffers.
+            if (strict and buf.type_id in BUFFER_NAMES
+                    and buf.type_id not in _IGNORABLE_DUPLICATE_TYPES):
+                raise PACDecodeError(
+                    f"duplicate PAC buffer without defined ignore semantics: "
+                    f"{BUFFER_NAMES[buf.type_id]} ({buf.type_id})"
+                )
+            continue
+        seen.add(buf.type_id)
+        buffers[buf.type_id] = buf.data
+
+    # Decode BOTH versions of UPN_DNS_INFO, if present. Do not allow a
+    # separately authenticated attribute to overwrite identity silently.
+    inline = buffers.get(12)
+    try:
+        if inline is not None:
+            info.update(decode_upn_dns_info(inline))
+        if upn_dns_attribute is not None:
+            separate = decode_upn_dns_info(upn_dns_attribute)
+            if inline is not None and not _same_upn_info(info, separate):
+                raise PACDecodeError("conflicting PAC and GSSAPI UPN_DNS_INFO")
+            if inline is None:
+                info.update(separate)
+    except PACDecodeError as exc:
+        if strict:
+            raise PACDecodeError(f"invalid PAC UPN_DNS_INFO: {exc}") from exc
+        if errors is not None:
+            errors.append(12)
+        # Do not expose even the original UPN fields on an inconsistent parse.
+        for key in ("sid", "sam_name", "upn", "dns_domain", "upn_dns_flags", "upn_constructed"):
+            info[key] = None
+
+    for t, data in buffers.items():
+        if t == 12:
+            continue
+        try:
+            if t == 1:
+                logon = decode_logon_info(data, include_resource_groups=include_resource_groups)
+                if not logon.get("sid") or not isinstance(logon.get("groups"), list):
+                    raise PACDecodeError("LOGON_INFO missing account SID or group list")
+                if info["sid"] is not None and info["sid"] != logon["sid"]:
+                    raise PACDecodeError("conflicting account SIDs in PAC identity buffers")
+                if not _same_name(info["sam_name"], logon["sam_name"]):
+                    raise PACDecodeError("conflicting SAM account names in PAC identity buffers")
+                upn_sam = info["sam_name"]
+                info.update(logon)
+                if upn_sam is not None:
+                    info["sam_name"] = upn_sam
+            elif t == 10:
+                info.update(decode_client_info(data))
+            elif t == 11:
+                info.update(decode_delegation_info(data))
+            elif t == 14:
+                info["device_info"] = decode_device_info(data)
+            elif t == 17:
+                info.update(decode_attributes_info(data))
+            elif t == 18:
+                info["requestor_sid"] = decode_sid(data)
+            elif t in SIG_NAMES:
+                info["pac_signature_types"][SIG_NAMES[t]] = decode_signature_type(data)
+            elif t in (13, 15):
+                key = "client_claims" if t == 13 else "device_claims"
+                # Samba and Windows may include a zero-length claims buffer
+                # when there are no claims. There is no NDR envelope to parse.
+                # Keep *_claims_present=True and decoded claims=None.
+                if data:
+                    info[key] = decode_claims_info(data)
+        except PACDecodeError as exc:
+            if strict and not (ignore_invalid_claims and t in (13, 15)):
+                raise PACDecodeError(
+                    f"invalid PAC {BUFFER_NAMES.get(t, f'buffer {t}')} ({t}): {exc}"
+                ) from exc
+            if errors is not None:
+                errors.append(t)
+            # In diagnostic mode, never leak authorization identity from an
+            # invalid LOGON_INFO (even if UPN_DNS_INFO was decoded earlier).
+            if t == 1:
+                for field in ("groups", "group_memberships", "extra_sids", "resource_groups", "group_count"):
+                    info[field] = None
+    if require_logon and (1 not in buffers or info["sid"] is None or info["groups"] is None):
+        raise PACDecodeError("valid PAC LOGON_INFO required")
+    return info
+
+
+__all__ = [
+    "PACDecodeError", "parse_pac", "decode_sid", "decode_upn_dns_info",
+    "decode_logon_info", "decode_device_info", "decode_delegation_info",
+    "decode_pac", "empty_pac_info", "decode_claims_info",
+]

py_mspack_decoder-0.1.1/src/pac_decoder/binary.py

@@ -0,0 +1,170 @@
+"""Dependency-free binary primitives for Microsoft MS-PAC.
+
+No Kerberos validation is performed here. Only pass PAC data obtained from an
+*authenticated and complete* GSSAPI name attribute.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+import struct
+
+MAX_PAC_BYTES = 4 * 1024 * 1024
+MAX_PAC_ENTRIES = 16_384
+MAX_PAC_GROUPS = 65_535  # Samba-style per-array group/SID bound.
+MAX_GROUP_MEMBERSHIPS = 200_000  # Maximum number of distinct authorization group SIDs.
+MAX_SID_SUBAUTHS = 15
+
+
+class PACDecodeError(ValueError):
+    """Malformed, truncated or unsupported PAC encoding."""
+
+
+@dataclass(frozen=True)
+class PACBuffer:
+    type_id: int
+    data: bytes
+
+
+@dataclass(frozen=True)
+class PAC:
+    version: int
+    size: int
+    buffers: tuple[PACBuffer, ...]
+
+
+def parse_pac(raw: bytes) -> PAC:
+    """Validate and extract an MS-PAC PACTYPE (not an ASN.1 wrapper)."""
+    if not isinstance(raw, bytes) or not 8 <= len(raw) <= MAX_PAC_BYTES:
+        raise PACDecodeError("invalid PAC length or input type")
+    n, version = struct.unpack_from("<II", raw)
+    if n > MAX_PAC_ENTRIES or n > (len(raw) - 8) // 16:
+        raise PACDecodeError("invalid PAC directory size")
+    if version != 0:
+        raise PACDecodeError("unsupported PAC version")
+    directory_end = 8 + 16 * n
+    entries = []
+    ranges = []
+    for i in range(n):
+        type_id, size, offset = struct.unpack_from("<IIQ", raw, 8 + 16 * i)
+        if offset % 8 or offset < directory_end or offset > len(raw):
+            raise PACDecodeError("invalid PAC buffer offset")
+        if size > len(raw) - offset:
+            raise PACDecodeError("PAC buffer exceeds packet")
+        if size:
+            ranges.append((offset, offset + size))
+        entries.append((type_id, offset, size))
+    ranges.sort()
+    for previous, current in zip(ranges, ranges[1:]):
+        if previous[1] > current[0]:
+            raise PACDecodeError("overlapping PAC buffers")
+    buffers = tuple(PACBuffer(t, raw[o:o + n]) for t, o, n in entries)
+    return PAC(version=version, size=len(raw), buffers=buffers)
+
+
+def decode_sid(raw: bytes) -> str:
+    """Decode an exact self-relative binary SID, rejecting malformed SIDs."""
+    if len(raw) < 12:
+        raise PACDecodeError("SID too short")
+    revision, count = raw[0], raw[1]
+    if revision != 1 or not 1 <= count <= MAX_SID_SUBAUTHS:
+        raise PACDecodeError("unsupported SID revision or subauthority count")
+    if len(raw) != 8 + count * 4:
+        raise PACDecodeError("SID size mismatch")
+    authority = int.from_bytes(raw[2:8], "big")
+    subs = struct.unpack_from("<" + "I" * count, raw, 8)
+    return f"S-{revision}-{authority}" + "".join(f"-{n}" for n in subs)
+
+
+def filetime_to_iso(value: int) -> str | None:
+    """Convert Windows FILETIME, including sentinel values used by AD."""
+    if not 0 < value < 0x7FFFFFFFFFFFFFFF:
+        return None
+    try:
+        instant = datetime(1601, 1, 1, tzinfo=timezone.utc) + timedelta(
+            microseconds=value // 10
+        )
+    except (ValueError, OverflowError):
+        return None
+    return instant.isoformat(timespec="seconds").replace("+00:00", "Z")
+
+
+def decode_upn_dns_info(data: bytes) -> dict:
+    """UPN_DNS_INFO, including optional SAM and SID (PAC buffer type 12)."""
+    if not isinstance(data, bytes) or len(data) < 12:
+        raise PACDecodeError("truncated or invalid UPN_DNS_INFO")
+    upn_length, upn_offset, dns_length, dns_offset, flags = struct.unpack_from(
+        "<HHHHI", data
+    )
+    extended = bool(flags & 0x2)
+    header_size = 20 if extended else 12
+    if len(data) < header_size:
+        raise PACDecodeError("truncated extended UPN_DNS_INFO")
+
+    def read_text(length: int, offset: int) -> str | None:
+        if not length:
+            return None
+        if length & 1 or offset < header_size or length > len(data) - offset:
+            raise PACDecodeError("invalid UPN_DNS_INFO UTF-16 span")
+        try:
+            return data[offset:offset + length].decode("utf-16-le") or None
+        except UnicodeDecodeError as exc:
+            raise PACDecodeError("invalid UPN_DNS_INFO UTF-16") from exc
+
+    result = {
+        "upn": read_text(upn_length, upn_offset),
+        "dns_domain": read_text(dns_length, dns_offset),
+        "upn_dns_flags": flags,
+        "upn_constructed": bool(flags & 1),
+        "sam_name": None,
+        "sid": None,
+    }
+    if extended:
+        sam_length, sam_offset, sid_length, sid_offset = struct.unpack_from(
+            "<HHHH", data, 12
+        )
+        result["sam_name"] = read_text(sam_length, sam_offset)
+        if sid_length:
+            if sid_offset < header_size or sid_length > len(data) - sid_offset:
+                raise PACDecodeError("invalid UPN_DNS_INFO SID span")
+            result["sid"] = decode_sid(data[sid_offset:sid_offset + sid_length])
+    return result
+
+
+def decode_client_info(data: bytes) -> dict:
+    if len(data) < 10:
+        raise PACDecodeError("truncated PAC_CLIENT_INFO")
+    filetime, length = struct.unpack_from("<QH", data)
+    if length & 1 or length > len(data) - 10:
+        raise PACDecodeError("invalid client name length")
+    try:
+        name = data[10:10 + length].decode("utf-16-le").rstrip("\x00")
+    except UnicodeDecodeError as exc:
+        raise PACDecodeError("invalid client name UTF-16") from exc
+    return {"client_name": name or None, "client_auth_time": filetime_to_iso(filetime)}
+
+
+def decode_attributes_info(data: bytes) -> dict:
+    if len(data) < 8:
+        raise PACDecodeError("truncated PAC_ATTRIBUTES_INFO")
+    nbits = struct.unpack_from("<I", data)[0]
+    if nbits > 256:
+        raise PACDecodeError("unsupported PAC flag length")
+    needed = ((nbits + 31) // 32) * 4
+    if needed > len(data) - 4:
+        raise PACDecodeError("truncated PAC_ATTRIBUTES_INFO flags")
+    flags = int.from_bytes(data[4:4 + needed], "little")
+    if nbits:
+        flags &= (1 << nbits) - 1
+    return {
+        "pac_attributes_flags": flags,
+        "pac_requested": bool(flags & 1),
+        "pac_given_implicitly": bool(flags & 2),
+    }
+
+
+def decode_signature_type(data: bytes) -> int:
+    if len(data) < 4:
+        raise PACDecodeError("truncated PAC_SIGNATURE_DATA")
+    return struct.unpack_from("<i", data)[0]

py_mspack_decoder-0.1.1/src/pac_decoder/claims.py

@@ -0,0 +1,130 @@
+"""MS-ADTS CLAIMS_SET_METADATA and CLAIMS_SET, bounded NDR32 decoding.
+
+No claims are returned unless the complete structure, including deferred
+pointers and every value, was decoded successfully. No cryptography here.
+"""
+import struct
+from .binary import PACDecodeError, MAX_PAC_ENTRIES, MAX_PAC_BYTES
+from .ndr import ndr_serialized_pointer
+from .compression import decompress_claims, MAX_CLAIMS_BYTES
+
+_TYPE_NAMES = {1: 'int64', 2: 'uint64', 3: 'string', 6: 'boolean'}
+_SOURCE_NAMES = {1: 'ad', 2: 'certificate'}
+
+
+def _array(r, pointer: int, count: int, *, bound=MAX_PAC_ENTRIES) -> bool:
+    if not 0 <= count <= bound:
+        raise PACDecodeError('excessive claims array count')
+    if not pointer:
+        if count:
+            raise PACDecodeError('nonempty null claims array')
+        return False
+    if r.u32() != count:
+        raise PACDecodeError('claims conformance count mismatch')
+    return True
+
+
+def _blob(r, pointer: int, count: int, *, bound=MAX_CLAIMS_BYTES) -> bytes:
+    return r.bytes(count) if _array(r, pointer, count, bound=bound) else b''
+
+
+def _string(r) -> str:
+    maximum, offset, actual = r.u32(), r.u32(), r.u32()
+    if (not actual or offset != 0 or actual > maximum
+            or maximum > MAX_CLAIMS_BYTES // 2):
+        raise PACDecodeError('invalid claims string bounds')
+    raw = r.bytes(actual * 2, 2)
+    if raw[-2:] != b'\0\0':
+        raise PACDecodeError('unterminated claims string')
+    try:
+        result = raw[:-2].decode('utf-16-le')
+    except UnicodeDecodeError as exc:
+        raise PACDecodeError('invalid UTF-16 claim') from exc
+    if '\0' in result:
+        raise PACDecodeError('embedded NUL in claim string')
+    return result
+
+
+def _finish(r) -> None:
+    if len(r.data) - r.offset > 7:
+        raise PACDecodeError('unconsumed claims payload')
+
+
+def decode_claims_set(data: bytes) -> list[dict]:
+    """Return source-tagged claim arrays from a serialized CLAIMS_SET."""
+    if not isinstance(data, bytes) or len(data) > MAX_CLAIMS_BYTES:
+        raise PACDecodeError('invalid claims input')
+    r = ndr_serialized_pointer(data)
+    count, arrays_ptr = r.u32(), r.u32()
+    r.u16()
+    reserved_size, reserved_ptr = r.u32(), r.u32()
+    arrays = []
+    total_entries = total_values = 0
+    if _array(r, arrays_ptr, count):
+        headers = [(r.u16(), r.u32(), r.u32()) for _ in range(count)]
+        for source, claim_count, entries_ptr in headers:
+            total_entries += claim_count
+            if total_entries > MAX_PAC_ENTRIES:
+                raise PACDecodeError('excessive total claims count')
+            entries = []
+            if _array(r, entries_ptr, claim_count):
+                fixed = []
+                for _ in range(claim_count):
+                    id_ptr, typ, discriminant = r.u32(), r.u16(), r.u16()
+                    if typ != discriminant or typ not in _TYPE_NAMES:
+                        raise PACDecodeError('unsupported claims union')
+                    n, value_ptr = r.u32(), r.u32()
+                    total_values += n
+                    if not id_ptr or not n or total_values > MAX_PAC_ENTRIES:
+                        raise PACDecodeError('invalid claim identifier/value count')
+                    fixed.append((typ, n, value_ptr))
+                for typ, n, value_ptr in fixed:
+                    identifier = _string(r)
+                    if not identifier:
+                        raise PACDecodeError('empty claim identifier')
+                    if not _array(r, value_ptr, n):
+                        raise PACDecodeError('null claim value array')
+                    if typ == 3:
+                        refs = [r.u32() for _ in range(n)]
+                        if not all(refs):
+                            raise PACDecodeError('null claim string pointer')
+                        values = [_string(r) for _ in refs]
+                    else:
+                        raw = r.bytes(n * 8, 8)
+                        values = list(struct.unpack('<' + ('q' if typ == 1 else 'Q') * n, raw))
+                        if typ == 6:
+                            if any(value not in (0, 1) for value in values):
+                                raise PACDecodeError('invalid boolean claim value')
+                            values = [bool(value) for value in values]
+                    entries.append({'id': identifier, 'type': _TYPE_NAMES[typ],
+                                    'type_id': typ, 'values': values})
+            arrays.append({'source': _SOURCE_NAMES.get(source, 'unknown'),
+                           'source_id': source, 'claims': entries})
+    _blob(r, reserved_ptr, reserved_size)
+    _finish(r)
+    return arrays
+
+
+def decode_claims_info(data: bytes) -> dict:
+    """Decode PAC buffers 13/15 (serialized CLAIMS_SET_METADATA).
+
+    Shape: {compression_format, uncompressed_size, arrays: [{source,
+    source_id, claims: [{id, type, type_id, values}]}]}. Unknown source IDs are
+    preserved numerically, never mislabeled as AD or certificate claims.
+    """
+    if not isinstance(data, bytes) or len(data) > MAX_PAC_BYTES:
+        raise PACDecodeError('invalid claims metadata input')
+    r = ndr_serialized_pointer(data)
+    size, claims_ptr, compression = r.u32(), r.u32(), r.u16()
+    uncompressed_size = r.u32()
+    r.u16()
+    reserved_size, reserved_ptr = r.u32(), r.u32()
+    if not claims_ptr or size == 0:
+        raise PACDecodeError('missing encoded CLAIMS_SET')
+    compressed = _blob(r, claims_ptr, size, bound=MAX_PAC_BYTES)
+    _blob(r, reserved_ptr, reserved_size)
+    _finish(r)
+    plain = decompress_claims(compressed, compression, uncompressed_size)
+    arrays = decode_claims_set(plain)
+    return {'compression_format': compression,
+            'uncompressed_size': uncompressed_size, 'arrays': arrays}