AH - Authentication Header

pcapkit.protocols.internet.ah.protocol contains AH only, which implements the extractor for Authentication Header (AH) [*], whose structure is:

Octets	Bits	Name	Description
0	0	ah.next	Next Header
1	8	ah.length	Payload Length
2	16	ah.reserved	Reserved (must be zero)
4	32	ah.spi	Security Parameters Index (SPI)
8	64	ah.seq	Sequence Number Field
12	96	ah.icv	Integrity Check Value (ICV)

class pcapkit.protocols.internet.ah.protocol.AH(file=None, length=None, **kwargs)

Bases: IPsec[AH, AH], IPv6_Ext[AH, AH]

This class implements Authentication Header.

Double-inherited (#917): AH is both a member of the IPsec family and an IPv6 extension header. IANA’s IPv6 Extension Header Types registry lists it at 51 (RFC 4302 Section 3.1.1 has it appear after the hop-by-hop, routing and fragmentation extension headers in the IPv6 header chain), and ExtensionHeader agrees. The same section places it after the IP header and before the next-layer protocol under IPv4, so it also travels directly as an IPv4 payload, which is what qualifies it for a base besides IPv6_Ext. IPsec comes first so that its id() takes precedence.

Changed in version 1.5.0: A rebuild writes the reserved field back as captured rather than as zero (#1327).

Changed in version 1.6.0: next of make() takes a member or an int code, resolved with the enumeration’s get; a name, a bool, or a code that does not fit in one octet raises ProtocolError, rather than resolving against an enumeration inferred from the caller’s frame or writing a different value (#2594).

Removed in version 1.6.0: The next_default, next_namespace and next_reversed arguments of make(); resolve a name with resolve_index() first (#2594).

property name: Literal['Authentication Header']

Name of corresponding protocol.

property alias: Literal['AH']

Acronym of corresponding protocol.

Spelled out rather than left to Protocol.alias’s class-name default, because IPv6_Ext sits between this class and that default in the MRO and carries its own 'IPv6-Ext' (#917). Inheriting it would rename this header in every ProtoChain string and in IPv6._decode_next_layer’s packet dict key.

property length: int

Header length of current protocol.

property payload: ProtocolBase | NoReturn

Payload of current instance.

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

property protocol: str | None | NoReturn

Name of next layer protocol (if any).

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

property protochain: ProtoChain | NoReturn

Protocol chain of current instance.

Raises:

UnsupportedCall – if the protocol is used as an IPv6 extension header

read(length=None, *, version=4, extension=False, **kwargs)

Read Authentication Header.

Structure of AH header [RFC 4302]:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Next Header   |  Payload Len  |          RESERVED             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 Security Parameters Index (SPI)               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                    Sequence Number Field                      |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                                                               |
+                Integrity Check Value-ICV (variable)           |
|                                                               |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters:

• length (int | None) – Length of packet data.

• version (Literal[4, 6]) – IP protocol version.

• extension (bool) – If the protocol is used as an IPv6 extension header.

• **kwargs (Any) – Arbitrary keyword arguments.

Return type:

AH

Returns:

Parsed packet data.

make(next=TransType.UDP, reserved=0, spi=0, seq=0, icv=b'', payload=b'', **kwargs)

Make (construct) packet data.

Parameters:

• next (TransType | int) – Next header type.

• reserved (int) – Reserved field; zero on send per RFC 4302 Section 2.3, but written as given so that a parsed header rebuilds unchanged.

• spi (int) – Security Parameters Index.

• seq (int) – Sequence Number Field.

• icv (bytes) – Integrity Check Value (ICV).

• payload (bytes | ProtocolBase | Schema) – Payload of current instance.

• **kwargs (Any) – Arbitrary keyword arguments.

Return type:

AH

Returns:

Constructed packet data.

Raises:

ProtocolError – If next is a name, a bool, or a member or code that does not fit in one octet.

Changed in version 1.5.0: Takes reserved ahead of spi (#1327), which shifts every later positional argument.

classmethod id()

Index ID of the protocol.

Return type:

tuple[Literal['AH']]

Returns:

Index ID of the protocol.

__post_init__(file=None, length=None, *, version=4, extension=False, **kwargs)

Post initialisation hook.

Overloads:

• file (IO[bytes] | bytes), length (int | None) = ..., *, version (Literal[4, 6]) = ..., extension (bool) = ..., **kwargs (Any) → None

• **kwargs (Any) → None

Parameters:

• file (IO[bytes] | bytes | None) – Source packet stream.

• length (int | None) – Length of packet data.

• version (Literal[4, 6]) – IP protocol version.

• extension (bool) – If the protocol is used as an IPv6 extension header.

• **kwargs (Any) – Arbitrary keyword arguments.

See also

For construction arguments, please refer to self.make.

classmethod __index__()

Numeral registry index of the protocol.

Return type:

TransType

Returns:

Numeral registry index of the protocol in IANA.

classmethod _make_data(data)

Create key-value pairs from data for protocol construction.

Parameters:

data (AH) – protocol data

Return type:

dict[str, Any]

Returns:

Key-value pairs for protocol construction.

Header Schemas

Removed in version 1.6.0: pcapkit.protocols.schema.internet.ah, with no alias: the module moved here (#2534).

pcapkit.protocols.internet.ah.schema.AH_HEADER_LEN = 12

Length of the fixed part of an IP Authentication Header (AH), before its Integrity Check Value, RFC 4302 Section 2. The one home of this value (#1739), here so that the schema’s ICV length and the protocol modules read the same one; it is fixed by the RFC, so it is never configurable.

Added in version 1.5.0.

class pcapkit.protocols.internet.ah.schema.AH(next=NO_VALUE, len=NO_VALUE, reserved=NO_VALUE, spi=NO_VALUE, seq=NO_VALUE, icv=NO_VALUE, payload=NO_VALUE, *, __packet__=None, **kwargs)

Bases: Schema

Header schema for AH packet.

Changed in version 1.5.0: reserved is read as an int rather than as zero padding bytes, and written back as given (#1327).

next: TransType = <EnumField next>

Next header.

len: int = <UInt8Field len>

Payload length.

reserved: int = <UInt16Field reserved>

Reserved.

spi: int = <UInt32Field spi>

Security parameters index.

seq: int = <UInt32Field seq>

Sequence number field.

icv: bytes = <BytesField icv>

Integrity check value.

payload: bytes = <PayloadField payload>

Payload.

Data Models

Removed in version 1.6.0: pcapkit.protocols.data.internet.ah, with no alias: the module moved here (#2534).

class pcapkit.protocols.internet.ah.data.AH(next, length, reserved, spi, seq, icv)

Bases: Protocol

Data model for AH protocol.

Changed in version 1.5.0: New required field reserved (#1327).

next: TransType

Next header.

length: int

Header length, in octets, decoded from the Payload Len field.

reserved: int

Reserved.

spi: int

Security parameters index.

seq: int

Sequence number field.

icv: bytes

Integrity check value.

Footnotes

[*]

https://en.wikipedia.org/wiki/IPsec