Add support for pkauthdata and pkdhkeydata OIDs.

git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@12426 f5534014-38df-0310-8fa8-9805f1628bb7

12 files changed, 389 insertions, 59 deletions

diff --git a/asn1/cms/CryptographicMessageSyntax.asn b/asn1/cms/CryptographicMessageSyntax.asn
index 03e2c7c809..08a431fbc5 100644
--- a/asn1/cms/CryptographicMessageSyntax.asn
+++ b/asn1/cms/CryptographicMessageSyntax.asn
@@ -49,6 +49,7 @@ DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
 
 SignerInfos ::= SET OF SignerInfo
 
+--             Implemented by hand in the template
 EncapsulatedContentInfo ::= SEQUENCE {
   eContentType ContentType,
   eContent [0] EXPLICIT OCTET STRING OPTIONAL }
diff --git a/asn1/cms/cms.cnf b/asn1/cms/cms.cnf
index 44dc20347d..ddf3b742dd 100644
--- a/asn1/cms/cms.cnf
+++ b/asn1/cms/cms.cnf
@@ -24,6 +24,7 @@ AuthenticatedData B "1.2.840.113549.1.9.16.1.2" "id-ct-authenticatedData"
 
 #.NO_EMIT
 OtherKeyAttribute
+EncapsulatedContentInfo
 
 #.TYPE_RENAME
 
diff --git a/asn1/cms/packet-cms-template.c b/asn1/cms/packet-cms-template.c
index 7be19a3065..600b0b004e 100644
--- a/asn1/cms/packet-cms-template.c
+++ b/asn1/cms/packet-cms-template.c
@@ -46,6 +46,7 @@
 int proto_cms = -1;
 static int hf_cms_keyAttr_id = -1;
 static int hf_cms_ci_contentType = -1;
+static int hf_cms_eci_eContentType = -1;
 #include "packet-cms-hf.c"
 
 /* Initialize the subtree pointers */
@@ -59,16 +60,16 @@ static int dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tv
 
 
 static char keyAttr_id[64]; /*64 chars should be long enough? */
-static int 
-dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
                                          hf_cms_keyAttr_id, keyAttr_id);
   return offset;
 }
 
-static int 
-dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset=call_ber_oid_callback(keyAttr_id, tvb, offset, pinfo, tree);
 
@@ -93,15 +94,15 @@ dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tvb, int offs
 
 /* ContentInfo can not yet be handled by the compiler */
 static char ci_contentType[64]; /*64 chars should be long enough? */
-static int 
-dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
                                          hf_cms_ci_contentType, ci_contentType);
   return offset;
 }
-static int 
-dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset=call_ber_oid_callback(ci_contentType, tvb, offset, pinfo, tree);
 
@@ -123,6 +124,48 @@ dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet
 }
 
 
+/* Do the same thing for EncapsulatedContentInfo */
+static char eci_eContentType[64]; /*64 chars should be long enough? */
+static int
+dissect_hf_cms_eContentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
+{
+  offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
+                                         hf_cms_eci_eContentType, eci_eContentType);
+  return offset;
+}
+static int
+dissect_hf_cms_eContentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
+{
+  guint8 class;
+  gboolean pc, ind;
+  guint32 tag, len;
+  int pdu_offset = offset;
+
+  /* XXX Do we care about printing out the octet string? */
+  offset = dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_eContent);
+
+  pdu_offset = get_ber_identifier(tvb, pdu_offset, &class, &pc, &tag);
+  pdu_offset = get_ber_length(tvb, pdu_offset, &len, &ind);
+  pdu_offset = call_ber_oid_callback(eci_eContentType, tvb, pdu_offset, pinfo, tree);
+
+  return offset;
+}
+
+static const ber_sequence EncapsulatedContentInfo_sequence[] = {
+  { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_hf_cms_eContentType },
+  { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_hf_cms_eContentType_content },
+  { 0, 0, 0, NULL }
+};
+
+int
+dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo);
+
+  return offset;
+}
+
+
 /*--- proto_register_cms ----------------------------------------------*/
 void proto_register_cms(void) {
 
@@ -132,6 +175,10 @@ void proto_register_cms(void) {
       { "contentType", "cms.contentInfo.contentType",
         FT_STRING, BASE_NONE, NULL, 0,
         "ContentType", HFILL }},
+    { &hf_cms_eci_eContentType,
+      { "eContentType", "cms.encapContentInfo.eContentType",
+        FT_STRING, BASE_NONE, NULL, 0,
+        "EncapsulatedContentType", HFILL }},
     { &hf_cms_keyAttr_id,
       { "keyAttr_id", "cms.keyAttr_id",
         FT_STRING, BASE_NONE, NULL, 0,
@@ -142,6 +189,7 @@ void proto_register_cms(void) {
   /* List of subtrees */
   static gint *ett[] = {
 	&ett_cms_ContentInfo,
+	&ett_cms_EncapsulatedContentInfo,
 #include "packet-cms-ettarr.c"
   };
 
diff --git a/asn1/cms/packet-cms-template.h b/asn1/cms/packet-cms-template.h
index 37898db9c0..6fdba19a13 100644
--- a/asn1/cms/packet-cms-template.h
+++ b/asn1/cms/packet-cms-template.h
@@ -26,6 +26,7 @@
 #define PACKET_CMS_H
 
 int dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index);
+int dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index);
 
 #include "packet-cms-exp.h"
 
diff --git a/asn1/pkinit/PKINIT.asn b/asn1/pkinit/PKINIT.asn
index 12dd24fc67..2a1549d304 100644
--- a/asn1/pkinit/PKINIT.asn
+++ b/asn1/pkinit/PKINIT.asn
@@ -54,7 +54,7 @@ BEGIN
 --        kerberosv5 (2) pkinit (3) }
 --
 --
---    id-pkdhkeydata  OBJECT IDENTIFIER  ::= { id-pkinit 1 }
+--    id-pkauthdata  OBJECT IDENTIFIER  ::= { id-pkinit 1 }
 --    id-pkdhkeydata  OBJECT IDENTIFIER  ::= { id-pkinit 2 }
 --    id-pkrkeydata  OBJECT IDENTIFIER  ::= { id-pkinit 3 }
 --    id-pkekuoid  OBJECT IDENTIFIER  ::= { id-pkinit 4 }
@@ -89,24 +89,24 @@ TrustedCA ::= CHOICE {
     ...
 }
 
---
---    AuthPack ::= SEQUENCE {
---        pkAuthenticator         [0] PKAuthenticator,
---        clientPublicValue       [1] SubjectPublicKeyInfo OPTIONAL,
---        supportedCMSTypes       [2] SEQUENCE OF AlgorithmIdentifier
---                                    OPTIONAL,
---        ...
---    }
---
---
---    PKAuthenticator ::= SEQUENCE {
---        cusec                   [0] INTEGER,
---        ctime                   [1] KerberosTime,
---        nonce                   [2] INTEGER (0..4294967295),
---        paChecksum              [3] Checksum,
---        ...
---    }
---
+
+AuthPack ::= SEQUENCE {
+    pkAuthenticator         [0] PKAuthenticator,
+    clientPublicValue       [1] SubjectPublicKeyInfo OPTIONAL,
+    supportedCMSTypes       [2] SEQUENCE OF AlgorithmIdentifier
+                                OPTIONAL,
+    ...
+}
+
+
+PKAuthenticator ::= SEQUENCE {
+    cusec                   [0] INTEGER,
+    ctime                   [1] KerberosTime,
+    nonce                   [2] INTEGER (0..4294967295),
+    paChecksum              [3] Checksum,
+    ...
+}
+
 --
 --    TrustedCertifiers ::= SEQUENCE OF Name
 --
@@ -134,13 +134,13 @@ PaPkAsRep ::= CHOICE {
 }
 
 
---    KDCDHKeyInfo ::= SEQUENCE {
---        subjectPublicKey        [0] BIT STRING,
---        nonce                   [1] INTEGER,
---        dhKeyExpiration         [2] KerberosTime OPTIONAL,
---        ...
---    }
---
+KDCDHKeyInfo ::= SEQUENCE {
+    subjectPublicKey        [0] BIT STRING,
+    nonce                   [1] INTEGER,
+    dhKeyExpiration         [2] KerberosTime OPTIONAL,
+    ...
+}
+
 --
 --    ReplyKeyPack ::= SEQUENCE {
 --        replyKey                [0] EncryptionKey,
diff --git a/asn1/pkinit/packet-pkinit-template.c b/asn1/pkinit/packet-pkinit-template.c
index 2dd03e6e09..627f7565ac 100644
--- a/asn1/pkinit/packet-pkinit-template.c
+++ b/asn1/pkinit/packet-pkinit-template.c
@@ -37,6 +37,7 @@
 #include "packet-pkinit.h"
 #include "packet-cms.h"
 #include "packet-pkix1explicit.h"
+#include "packet-kerberos.h"
 
 #define PNAME  "PKINIT"
 #define PSNAME "PKInit"
@@ -49,6 +50,8 @@ static int proto_pkinit = -1;
 /* Initialize the subtree pointers */
 #include "packet-pkinit-ett.c"
 
+static int dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_);
+static int dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_);
 
 #include "packet-pkinit-fn.c"
 
@@ -64,6 +67,18 @@ dissect_pkinit_PA_PK_AS_REP(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb,
   return offset;
 }
 
+static int
+dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) {
+  offset = dissect_krb5_ctime(pinfo, tree, tvb, offset);
+  return offset;
+}
+
+static int
+dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) {
+  offset = dissect_krb5_Checksum(pinfo, tree, tvb, offset);
+  return offset;
+}
+
 
 /*--- proto_register_pkinit ----------------------------------------------*/
 void proto_register_pkinit(void) {
@@ -90,5 +105,7 @@ void proto_register_pkinit(void) {
 
 /*--- proto_reg_handoff_pkinit -------------------------------------------*/
 void proto_reg_handoff_pkinit(void) {
+  register_ber_oid_dissector("1.3.6.1.5.2.3.1", dissect_AuthPack_PDU, proto_pkinit, "id-pkauthdata");
+  register_ber_oid_dissector("1.3.6.1.5.2.3.2", dissect_KDCDHKeyInfo_PDU, proto_pkinit, "id-pkdhkeydata");
 }
 
diff --git a/asn1/pkinit/pkinit.cnf b/asn1/pkinit/pkinit.cnf
index 6fc1ad5536..d893daf6a2 100644
--- a/asn1/pkinit/pkinit.cnf
+++ b/asn1/pkinit/pkinit.cnf
@@ -12,7 +12,9 @@ CryptographicMessageSyntax   cms
 
 #.EXPORTS
 
-#.PDU
+#.REGISTER
+AuthPack     B "1.3.6.1.5.2.3.1" "id-pkauthdata"
+KDCDHKeyInfo B "1.3.6.1.5.2.3.2" "id-pkdhkeydata"
 
 #.NO_EMIT
 
diff --git a/epan/dissectors/packet-cms.c b/epan/dissectors/packet-cms.c
index 04585b7799..d3e82289f1 100644
--- a/epan/dissectors/packet-cms.c
+++ b/epan/dissectors/packet-cms.c
@@ -8,7 +8,7 @@
 /* packet-cms.c
  * Routines for RFC2630 Cryptographic Message Syntax packet dissection
  *
- * $Id: packet-cms-template.c 12245 2004-10-08 20:28:04Z guy $
+ * $Id: packet-cms-template.c 12394 2004-10-26 13:54:09Z sahlberg $
  *
  * Ethereal - Network traffic analyzer
  * By Gerald Combs <gerald@ethereal.com>
@@ -53,6 +53,7 @@
 int proto_cms = -1;
 static int hf_cms_keyAttr_id = -1;
 static int hf_cms_ci_contentType = -1;
+static int hf_cms_eci_eContentType = -1;
 
 /*--- Included file: packet-cms-hf.c ---*/
 
@@ -289,19 +290,6 @@ static int dissect_keyIdentifier(packet_info *pinfo, proto_tree *tree, tvbuff_t
   return dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_keyIdentifier);
 }
 
-static const ber_sequence EncapsulatedContentInfo_sequence[] = {
-  { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_eContentType },
-  { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_eContent },
-  { 0, 0, 0, NULL }
-};
-
-static int
-dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
-  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
-                                EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo);
-
-  return offset;
-}
 static int dissect_encapContentInfo(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
   return dissect_cms_EncapsulatedContentInfo(FALSE, tvb, offset, pinfo, tree, hf_cms_encapContentInfo);
 }
@@ -1181,16 +1169,16 @@ static void dissect_AuthenticatedData_PDU(tvbuff_t *tvb, packet_info *pinfo, pro
 
 
 static char keyAttr_id[64]; /*64 chars should be long enough? */
-static int 
-dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_keyAttrId(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
                                          hf_cms_keyAttr_id, keyAttr_id);
   return offset;
 }
 
-static int 
-dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_keyAttr_type(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset=call_ber_oid_callback(keyAttr_id, tvb, offset, pinfo, tree);
 
@@ -1215,15 +1203,15 @@ dissect_cms_OtherKeyAttribute(gboolean implicit_tag _U_, tvbuff_t *tvb, int offs
 
 /* ContentInfo can not yet be handled by the compiler */
 static char ci_contentType[64]; /*64 chars should be long enough? */
-static int 
-dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_hf_cms_contentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
                                          hf_cms_ci_contentType, ci_contentType);
   return offset;
 }
-static int 
-dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) 
+static int
+dissect_hf_cms_contentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
   offset=call_ber_oid_callback(ci_contentType, tvb, offset, pinfo, tree);
 
@@ -1245,6 +1233,48 @@ dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet
 }
 
 
+/* Do the same thing for EncapsulatedContentInfo */
+static char eci_eContentType[64]; /*64 chars should be long enough? */
+static int
+dissect_hf_cms_eContentType(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
+{
+  offset = dissect_ber_object_identifier(FALSE, pinfo, tree, tvb, offset,
+                                         hf_cms_eci_eContentType, eci_eContentType);
+  return offset;
+}
+static int
+dissect_hf_cms_eContentType_content(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
+{
+  guint8 class;
+  gboolean pc, ind;
+  guint32 tag, len;
+  int pdu_offset = offset;
+
+  /* XXX Do we care about printing out the octet string? */
+  offset = dissect_cms_OCTET_STRING(FALSE, tvb, offset, pinfo, tree, hf_cms_eContent);
+
+  pdu_offset = get_ber_identifier(tvb, pdu_offset, &class, &pc, &tag);
+  pdu_offset = get_ber_length(tvb, pdu_offset, &len, &ind);
+  pdu_offset = call_ber_oid_callback(eci_eContentType, tvb, pdu_offset, pinfo, tree);
+
+  return offset;
+}
+
+static const ber_sequence EncapsulatedContentInfo_sequence[] = {
+  { BER_CLASS_UNI, BER_UNI_TAG_OID, BER_FLAGS_NOOWNTAG, dissect_hf_cms_eContentType },
+  { BER_CLASS_CON, 0, BER_FLAGS_OPTIONAL, dissect_hf_cms_eContentType_content },
+  { 0, 0, 0, NULL }
+};
+
+int
+dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                EncapsulatedContentInfo_sequence, hf_index, ett_cms_EncapsulatedContentInfo);
+
+  return offset;
+}
+
+
 /*--- proto_register_cms ----------------------------------------------*/
 void proto_register_cms(void) {
 
@@ -1254,6 +1284,10 @@ void proto_register_cms(void) {
       { "contentType", "cms.contentInfo.contentType",
         FT_STRING, BASE_NONE, NULL, 0,
         "ContentType", HFILL }},
+    { &hf_cms_eci_eContentType,
+      { "eContentType", "cms.encapContentInfo.eContentType",
+        FT_STRING, BASE_NONE, NULL, 0,
+        "EncapsulatedContentType", HFILL }},
     { &hf_cms_keyAttr_id,
       { "keyAttr_id", "cms.keyAttr_id",
         FT_STRING, BASE_NONE, NULL, 0,
@@ -1557,6 +1591,7 @@ void proto_register_cms(void) {
   /* List of subtrees */
   static gint *ett[] = {
 	&ett_cms_ContentInfo,
+	&ett_cms_EncapsulatedContentInfo,
 
 /*--- Included file: packet-cms-ettarr.c ---*/
 
diff --git a/epan/dissectors/packet-cms.h b/epan/dissectors/packet-cms.h
index 9bb4746f93..e55dfd5369 100644
--- a/epan/dissectors/packet-cms.h
+++ b/epan/dissectors/packet-cms.h
@@ -33,6 +33,7 @@
 #define PACKET_CMS_H
 
 int dissect_cms_ContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index);
+int dissect_cms_EncapsulatedContentInfo(gboolean implicit_tag, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index);
 
 
 /*--- Included file: packet-cms-exp.h ---*/
diff --git a/epan/dissectors/packet-kerberos.c b/epan/dissectors/packet-kerberos.c
index d2fd03824c..09ad53d4cf 100644
--- a/epan/dissectors/packet-kerberos.c
+++ b/epan/dissectors/packet-kerberos.c
@@ -1462,7 +1462,7 @@ dissect_krb5_rtime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offs
 	return offset;
 }
 
-static int
+int
 dissect_krb5_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
 	offset=dissect_ber_generalized_time(pinfo, tree, tvb, offset, hf_krb_ctime);
@@ -2805,7 +2805,7 @@ static ber_sequence Checksum_sequence[] = {
 		dissect_krb5_checksum_checksum },
 	{ 0, 0, 0, NULL }
 };
-static int
+int
 dissect_krb5_Checksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset)
 {
 	offset=dissect_ber_sequence(FALSE, pinfo, tree, tvb, offset, Checksum_sequence, hf_krb_Checksum, ett_krb_Checksum);
diff --git a/epan/dissectors/packet-kerberos.h b/epan/dissectors/packet-kerberos.h
index 9e915e5618..08c0173f2c 100644
--- a/epan/dissectors/packet-kerberos.h
+++ b/epan/dissectors/packet-kerberos.h
@@ -43,4 +43,10 @@ typedef struct _kerberos_callbacks {
 gint
 dissect_kerberos_main(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int do_col_info, kerberos_callbacks *cb);
 
+int
+dissect_krb5_Checksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset);
+
+int
+dissect_krb5_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset);
+
 #endif /* __PACKET_KERBEROS_H */
diff --git a/epan/dissectors/packet-pkinit.c b/epan/dissectors/packet-pkinit.c
index 750283a46b..bb720b139d 100644
--- a/epan/dissectors/packet-pkinit.c
+++ b/epan/dissectors/packet-pkinit.c
@@ -44,6 +44,7 @@
 #include "packet-pkinit.h"
 #include "packet-cms.h"
 #include "packet-pkix1explicit.h"
+#include "packet-kerberos.h"
 
 #define PNAME  "PKINIT"
 #define PSNAME "PKInit"
@@ -54,14 +55,27 @@ static int proto_pkinit = -1;
 
 /*--- Included file: packet-pkinit-hf.c ---*/
 
+static int hf_pkinit_AuthPack_PDU = -1;           /* AuthPack */
+static int hf_pkinit_KDCDHKeyInfo_PDU = -1;       /* KDCDHKeyInfo */
 static int hf_pkinit_signedAuthPack = -1;         /* ContentInfo */
 static int hf_pkinit_trustedCertifiers = -1;      /* SEQUNCE_OF_TrustedCA */
 static int hf_pkinit_trustedCertifiers_item = -1;  /* TrustedCA */
 static int hf_pkinit_kdcCert = -1;                /* IssuerAndSerialNumber */
 static int hf_pkinit_caName = -1;                 /* Name */
 static int hf_pkinit_issuerAndSerial = -1;        /* IssuerAndSerialNumber */
+static int hf_pkinit_pkAuthenticator = -1;        /* PKAuthenticator */
+static int hf_pkinit_clientPublicValue = -1;      /* SubjectPublicKeyInfo */
+static int hf_pkinit_supportedCMSTypes = -1;      /* SEQUNCE_OF_AlgorithmIdentifier */
+static int hf_pkinit_supportedCMSTypes_item = -1;  /* AlgorithmIdentifier */
+static int hf_pkinit_cusec = -1;                  /* INTEGER */
+static int hf_pkinit_ctime = -1;                  /* KerberosTime */
+static int hf_pkinit_nonce = -1;                  /* INTEGER_0_4294967295 */
+static int hf_pkinit_paChecksum = -1;             /* Checksum */
 static int hf_pkinit_dhSignedData = -1;           /* ContentInfo */
 static int hf_pkinit_encKeyPack = -1;             /* ContentInfo */
+static int hf_pkinit_subjectPublicKey = -1;       /* BIT_STRING */
+static int hf_pkinit_nonce1 = -1;                 /* INTEGER */
+static int hf_pkinit_dhKeyExpiration = -1;        /* KerberosTime */
 
 /*--- End of included file: packet-pkinit-hf.c ---*/
 
@@ -73,11 +87,17 @@ static int hf_pkinit_encKeyPack = -1;             /* ContentInfo */
 static gint ett_pkinit_PaPkAsReq = -1;
 static gint ett_pkinit_SEQUNCE_OF_TrustedCA = -1;
 static gint ett_pkinit_TrustedCA = -1;
+static gint ett_pkinit_AuthPack = -1;
+static gint ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier = -1;
+static gint ett_pkinit_PKAuthenticator = -1;
 static gint ett_pkinit_PaPkAsRep = -1;
+static gint ett_pkinit_KDCDHKeyInfo = -1;
 
 /*--- End of included file: packet-pkinit-ett.c ---*/
 
 
+static int dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_);
+static int dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_);
 
 
 /*--- Included file: packet-pkinit-fn.c ---*/
@@ -96,12 +116,27 @@ static int dissect_caName(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, i
 static int dissect_issuerAndSerial(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
   return dissect_cms_IssuerAndSerialNumber(FALSE, tvb, offset, pinfo, tree, hf_pkinit_issuerAndSerial);
 }
+static int dissect_clientPublicValue(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkix1explicit_SubjectPublicKeyInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_clientPublicValue);
+}
+static int dissect_supportedCMSTypes_item(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkix1explicit_AlgorithmIdentifier(FALSE, tvb, offset, pinfo, tree, hf_pkinit_supportedCMSTypes_item);
+}
+static int dissect_ctime(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_KerberosV5Spec2_KerberosTime(FALSE, tvb, offset, pinfo, tree, hf_pkinit_ctime);
+}
+static int dissect_paChecksum(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_KerberosV5Spec2_Checksum(FALSE, tvb, offset, pinfo, tree, hf_pkinit_paChecksum);
+}
 static int dissect_dhSignedData(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
   return dissect_cms_ContentInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_dhSignedData);
 }
 static int dissect_encKeyPack(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
   return dissect_cms_ContentInfo(FALSE, tvb, offset, pinfo, tree, hf_pkinit_encKeyPack);
 }
+static int dissect_dhKeyExpiration(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_KerberosV5Spec2_KerberosTime(FALSE, tvb, offset, pinfo, tree, hf_pkinit_dhKeyExpiration);
+}
 
 
 static const value_string TrustedCA_vals[] = {
@@ -158,6 +193,82 @@ dissect_pkinit_PaPkAsReq(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, p
 }
 
 
+
+static int
+dissect_pkinit_INTEGER(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_integer(pinfo, tree, tvb, offset, hf_index, NULL);
+
+  return offset;
+}
+static int dissect_cusec(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_INTEGER(FALSE, tvb, offset, pinfo, tree, hf_pkinit_cusec);
+}
+static int dissect_nonce1(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_INTEGER(FALSE, tvb, offset, pinfo, tree, hf_pkinit_nonce1);
+}
+
+
+
+static int
+dissect_pkinit_INTEGER_0_4294967295(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_integer(pinfo, tree, tvb, offset, hf_index, NULL);
+
+  return offset;
+}
+static int dissect_nonce(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_INTEGER_0_4294967295(FALSE, tvb, offset, pinfo, tree, hf_pkinit_nonce);
+}
+
+static const ber_sequence PKAuthenticator_sequence[] = {
+  { BER_CLASS_CON, 0, 0, dissect_cusec },
+  { BER_CLASS_CON, 1, 0, dissect_ctime },
+  { BER_CLASS_CON, 2, 0, dissect_nonce },
+  { BER_CLASS_CON, 3, 0, dissect_paChecksum },
+  { 0, 0, 0, NULL }
+};
+
+static int
+dissect_pkinit_PKAuthenticator(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                PKAuthenticator_sequence, hf_index, ett_pkinit_PKAuthenticator);
+
+  return offset;
+}
+static int dissect_pkAuthenticator(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_PKAuthenticator(FALSE, tvb, offset, pinfo, tree, hf_pkinit_pkAuthenticator);
+}
+
+static const ber_sequence SEQUNCE_OF_AlgorithmIdentifier_sequence_of[1] = {
+  { BER_CLASS_UNI, BER_UNI_TAG_SEQUENCE, BER_FLAGS_NOOWNTAG, dissect_supportedCMSTypes_item },
+};
+
+static int
+dissect_pkinit_SEQUNCE_OF_AlgorithmIdentifier(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence_of(implicit_tag, pinfo, tree, tvb, offset,
+                                   SEQUNCE_OF_AlgorithmIdentifier_sequence_of, hf_index, ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier);
+
+  return offset;
+}
+static int dissect_supportedCMSTypes(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_SEQUNCE_OF_AlgorithmIdentifier(FALSE, tvb, offset, pinfo, tree, hf_pkinit_supportedCMSTypes);
+}
+
+static const ber_sequence AuthPack_sequence[] = {
+  { BER_CLASS_CON, 0, 0, dissect_pkAuthenticator },
+  { BER_CLASS_CON, 1, BER_FLAGS_OPTIONAL, dissect_clientPublicValue },
+  { BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_supportedCMSTypes },
+  { 0, 0, 0, NULL }
+};
+
+static int
+dissect_pkinit_AuthPack(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                AuthPack_sequence, hf_index, ett_pkinit_AuthPack);
+
+  return offset;
+}
+
+
 static const value_string PaPkAsRep_vals[] = {
   {   0, "dhSignedData" },
   {   1, "encKeyPack" },
@@ -179,6 +290,43 @@ dissect_pkinit_PaPkAsRep(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, p
 }
 
 
+static int
+dissect_pkinit_BIT_STRING(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_bitstring(implicit_tag, pinfo, tree, tvb, offset,
+                                 NULL, hf_index, -1,
+                                 NULL);
+
+  return offset;
+}
+static int dissect_subjectPublicKey(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb, int offset) {
+  return dissect_pkinit_BIT_STRING(FALSE, tvb, offset, pinfo, tree, hf_pkinit_subjectPublicKey);
+}
+
+static const ber_sequence KDCDHKeyInfo_sequence[] = {
+  { BER_CLASS_CON, 0, 0, dissect_subjectPublicKey },
+  { BER_CLASS_CON, 1, 0, dissect_nonce1 },
+  { BER_CLASS_CON, 2, BER_FLAGS_OPTIONAL, dissect_dhKeyExpiration },
+  { 0, 0, 0, NULL }
+};
+
+static int
+dissect_pkinit_KDCDHKeyInfo(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *tree, int hf_index) {
+  offset = dissect_ber_sequence(implicit_tag, pinfo, tree, tvb, offset,
+                                KDCDHKeyInfo_sequence, hf_index, ett_pkinit_KDCDHKeyInfo);
+
+  return offset;
+}
+
+/*--- PDUs ---*/
+
+static void dissect_AuthPack_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
+  dissect_pkinit_AuthPack(FALSE, tvb, 0, pinfo, tree, hf_pkinit_AuthPack_PDU);
+}
+static void dissect_KDCDHKeyInfo_PDU(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
+  dissect_pkinit_KDCDHKeyInfo(FALSE, tvb, 0, pinfo, tree, hf_pkinit_KDCDHKeyInfo_PDU);
+}
+
+
 /*--- End of included file: packet-pkinit-fn.c ---*/
 
 
@@ -194,6 +342,18 @@ dissect_pkinit_PA_PK_AS_REP(packet_info *pinfo, proto_tree *tree, tvbuff_t *tvb,
   return offset;
 }
 
+static int
+dissect_KerberosV5Spec2_KerberosTime(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) {
+  offset = dissect_krb5_ctime(pinfo, tree, tvb, offset);
+  return offset;
+}
+
+static int
+dissect_KerberosV5Spec2_Checksum(gboolean implicit_tag _U_, tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, int hf_index _U_) {
+  offset = dissect_krb5_Checksum(pinfo, tree, tvb, offset);
+  return offset;
+}
+
 
 /*--- proto_register_pkinit ----------------------------------------------*/
 void proto_register_pkinit(void) {
@@ -203,6 +363,14 @@ void proto_register_pkinit(void) {
 
 /*--- Included file: packet-pkinit-hfarr.c ---*/
 
+    { &hf_pkinit_AuthPack_PDU,
+      { "AuthPack", "pkinit.AuthPack",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "AuthPack", HFILL }},
+    { &hf_pkinit_KDCDHKeyInfo_PDU,
+      { "KDCDHKeyInfo", "pkinit.KDCDHKeyInfo",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "KDCDHKeyInfo", HFILL }},
     { &hf_pkinit_signedAuthPack,
       { "signedAuthPack", "pkinit.signedAuthPack",
         FT_NONE, BASE_NONE, NULL, 0,
@@ -227,6 +395,38 @@ void proto_register_pkinit(void) {
       { "issuerAndSerial", "pkinit.issuerAndSerial",
         FT_NONE, BASE_NONE, NULL, 0,
         "TrustedCA/issuerAndSerial", HFILL }},
+    { &hf_pkinit_pkAuthenticator,
+      { "pkAuthenticator", "pkinit.pkAuthenticator",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "AuthPack/pkAuthenticator", HFILL }},
+    { &hf_pkinit_clientPublicValue,
+      { "clientPublicValue", "pkinit.clientPublicValue",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "AuthPack/clientPublicValue", HFILL }},
+    { &hf_pkinit_supportedCMSTypes,
+      { "supportedCMSTypes", "pkinit.supportedCMSTypes",
+        FT_UINT32, BASE_DEC, NULL, 0,
+        "AuthPack/supportedCMSTypes", HFILL }},
+    { &hf_pkinit_supportedCMSTypes_item,
+      { "Item", "pkinit.supportedCMSTypes_item",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "AuthPack/supportedCMSTypes/_item", HFILL }},
+    { &hf_pkinit_cusec,
+      { "cusec", "pkinit.cusec",
+        FT_INT32, BASE_DEC, NULL, 0,
+        "PKAuthenticator/cusec", HFILL }},
+    { &hf_pkinit_ctime,
+      { "ctime", "pkinit.ctime",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "PKAuthenticator/ctime", HFILL }},
+    { &hf_pkinit_nonce,
+      { "nonce", "pkinit.nonce",
+        FT_UINT32, BASE_DEC, NULL, 0,
+        "PKAuthenticator/nonce", HFILL }},
+    { &hf_pkinit_paChecksum,
+      { "paChecksum", "pkinit.paChecksum",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "PKAuthenticator/paChecksum", HFILL }},
     { &hf_pkinit_dhSignedData,
       { "dhSignedData", "pkinit.dhSignedData",
         FT_NONE, BASE_NONE, NULL, 0,
@@ -235,6 +435,18 @@ void proto_register_pkinit(void) {
       { "encKeyPack", "pkinit.encKeyPack",
         FT_NONE, BASE_NONE, NULL, 0,
         "PaPkAsRep/encKeyPack", HFILL }},
+    { &hf_pkinit_subjectPublicKey,
+      { "subjectPublicKey", "pkinit.subjectPublicKey",
+        FT_BYTES, BASE_HEX, NULL, 0,
+        "KDCDHKeyInfo/subjectPublicKey", HFILL }},
+    { &hf_pkinit_nonce1,
+      { "nonce", "pkinit.nonce",
+        FT_INT32, BASE_DEC, NULL, 0,
+        "KDCDHKeyInfo/nonce", HFILL }},
+    { &hf_pkinit_dhKeyExpiration,
+      { "dhKeyExpiration", "pkinit.dhKeyExpiration",
+        FT_NONE, BASE_NONE, NULL, 0,
+        "KDCDHKeyInfo/dhKeyExpiration", HFILL }},
 
 /*--- End of included file: packet-pkinit-hfarr.c ---*/
 
@@ -248,7 +460,11 @@ void proto_register_pkinit(void) {
     &ett_pkinit_PaPkAsReq,
     &ett_pkinit_SEQUNCE_OF_TrustedCA,
     &ett_pkinit_TrustedCA,
+    &ett_pkinit_AuthPack,
+    &ett_pkinit_SEQUNCE_OF_AlgorithmIdentifier,
+    &ett_pkinit_PKAuthenticator,
     &ett_pkinit_PaPkAsRep,
+    &ett_pkinit_KDCDHKeyInfo,
 
 /*--- End of included file: packet-pkinit-ettarr.c ---*/
 
@@ -266,5 +482,7 @@ void proto_register_pkinit(void) {
 
 /*--- proto_reg_handoff_pkinit -------------------------------------------*/
 void proto_reg_handoff_pkinit(void) {
+  register_ber_oid_dissector("1.3.6.1.5.2.3.1", dissect_AuthPack_PDU, proto_pkinit, "id-pkauthdata");
+  register_ber_oid_dissector("1.3.6.1.5.2.3.2", dissect_KDCDHKeyInfo_PDU, proto_pkinit, "id-pkdhkeydata");
 }