AH - Authentication Header

pcapkit.protocols.internet.ah contains AH only, which implements extractor for Authentication Header (AH) [*], whose structure is described as below:

Octets

Bits

Name

Description

0

0

ah.next

Next Header

1

8

ah.length

Payload Length

2

16

ah.reserved

Reserved (must be zero)

4

32

ah.spi

Security Parameters Index (SPI)

8

64

ah.seq

Sequence Number Field

12

96

ah.icv

Integrity Check Value (ICV)
class pcapkit.protocols.internet.ah.AH(file=None, length=None, **kwargs)[source]

Bases: IPsec[AH, AH], IPv6_Ext[AH, AH]

This class implements Authentication Header.

Double-inherited (GitHub issue #917): AH is both a member of the IPsec family and an IPv6 extension header. IANA’s IPv6 Extension Header Types registry lists it at 51 (RFC 4302 Section 3.1.1 has it appear after the hop-by-hop, routing and fragmentation extension headers in the IPv6 header chain), and ExtensionHeader agrees. The same section places it after the IP header and before the next-layer protocol under IPv4, so it also travels directly as an IPv4 payload, which is what qualifies it for a base besides IPv6_Ext. IPsec comes first so that its id() takes precedence.

Changed in version 1.5.0: A rebuild writes the reserved field back as captured rather than as zero (#1327).

property name: Literal['Authentication Header']

Name of corresponding protocol.

property length: int

Header length of current protocol.

property payload: ProtocolBase | NoReturn

Payload of current instance.

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

property protocol: str | None | NoReturn

Name of next layer protocol (if any).

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

property protochain: ProtoChain | NoReturn

Protocol chain of current instance.

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

classmethod id()[source]

Index ID of the protocol.

Return type:

tuple[Literal['AH']]

Returns:

Index ID of the protocol.

read(length=None, *, version=4, extension=False, **kwargs)[source]

Read Authentication Header.

Structure of AH header [RFC 4302]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Header   |  Payload Len  |          RESERVED             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 Security Parameters Index (SPI)               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Sequence Number Field                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                Integrity Check Value-ICV (variable)           |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Parameters:

  • length (int | None) – Length of packet data.

  • version (Literal[4, 6]) – IP protocol version.

  • extension (bool) – If the protocol is used as an IPv6 extension header.

  • **kwargs (Any) – Arbitrary keyword arguments.

Return type:

AH

Returns:

Parsed packet data.

make(next=<TransType.UDP: 17>, next_default=None, next_namespace=None, next_reversed=False, reserved=0, spi=0, seq=0, icv=b'', payload=b'', **kwargs)[source]

Make (construct) packet data.

Parameters:

  • next (TransType | IntEnum | IntEnum | str | int) – Next header type.

  • next_default (int | None) – Default value of next header type.

  • next_namespace (dict[str, int] | dict[int, str] | Type[IntEnum] | Type[IntEnum] | None) – Namespace of next header type.

  • next_reversed (bool) – If the namespace is reversed.

  • reserved (int) – Reserved field; zero on send per RFC 4302 Section 2.3, but written as given so that a parsed header rebuilds unchanged.

  • spi (int) – Security Parameters Index.

  • seq (int) – Sequence Number Field.

  • icv (bytes) – Integrity Check Value-ICV.

  • payload (bytes | ProtocolBase | Schema) – Payload of current instance.

  • **kwargs (Any) – Arbitrary keyword arguments.

Return type:

AH

Returns:

Constructed packet data.

classmethod _make_data(data)[source]

Create key-value pairs from data for protocol construction.

Parameters:

data (AH) – protocol data

Return type:

dict[str, Any]

Returns:

Key-value pairs for protocol construction.

__post_init__(file=None, length=None, *, version=4, extension=False, **kwargs)[source]

Post initialisation hook.

Overloads:

  • self, file (IO[bytes] | bytes), length (Optional[int]), version (Literal[4, 6]), extension (bool), kwargs (Any) → None

  • self, kwargs (Any) → None

Parameters:

  • file (IO[bytes] | bytes | None) – Source packet stream.

  • length (int | None) – Length of packet data.

  • version (Literal[4, 6]) – IP protocol version.

  • extension (bool) – If the protocol is used as an IPv6 extension header.

  • **kwargs (Any) – Arbitrary keyword arguments.

See also

For construction argument, please refer to self.make.

classmethod __index__()[source]

Numeral registry index of the protocol.

Return type:

TransType

Returns:

Numeral registry index of the protocol in IANA.

Header Schemas

pcapkit.protocols.schema.internet.ah.AH_HEADER_LEN = 12

Length of the fixed part of an IP Authentication Header (AH), before its Integrity Check Value, RFC 4302 Section 2. The one home of this value (#1739), here so that the schema’s ICV length and the protocol modules read the same one; it is fixed by the RFC, so it is never configurable.

Added in version 1.5.0.

class pcapkit.protocols.schema.internet.ah.AH(*args: _VT, **kwargs: _VT)[source]

Bases: Schema

Header schema for AH packet.

next: TransType = <EnumField next>

Next header.

len: int = <UInt8Field len>

Payload length.

reserved: int = <UInt16Field reserved>

Reserved.

spi: int = <UInt32Field spi>

Security parameters index.

seq: int = <UInt32Field seq>

Sequence number field.

icv: bytes = <BytesField icv>

Integrity check value.

payload: bytes = <PayloadField payload>

Payload.

Data Models

class pcapkit.protocols.data.internet.ah.AH(*args: VT, **kwargs: VT)[source]

Bases: Protocol

Data model for AH protocol.

Changed in version 1.5.0: New required field reserved (#1327).

next: TransType

Next header.

length: int

Header length, in octets, decoded from the Payload Len field.

reserved: int

Reserved.

spi: int

Security parameters index.

seq: int

Sequence number field.

icv: bytes

Integrity check value.

Footnotes