mirror of
https://github.com/mandiant/gopacket
synced 2026-06-21 13:57:02 +00:00
Jacob Paullus
cebc5749ef
MS-DRSR 4.1.4.1.1 specifies structLen as the exact byte size, rounded to a 4-byte boundary. Impacket carries a "+2" on top of the round-up that no part of the spec or wire trace justifies; AD is forgiving in practice but a stricter implementation could reject. Keep just the alignment round, drop the unexplained 2 extra bytes. This is the last open item from #32. Request-side change with no parser-side regression detection, so it was held out of #33 pending lab verification. Verified end-to-end against the GOAD lab (sevenkingdoms.local forest root + north.sevenkingdoms.local child domain): secretsdump --just-dc-ntlm exercises DsBind, DsDomainControllerInfo, DsCrackNames, and DsGetNCChanges in sequence and returns success on both domains. Output is byte-for-byte identical to the pre-fix dumps captured before removing the +2. Closes #32.