Additional flexibility around session keys

[petrsnd]

We were able to make progress with the following changes:

• Expose SessionKey, ClientSubSessionKey and ServerSubSessionKey from ApplicationSessionContext
• Try to decrypt AP_REP with SessionKey and ClientSubSessionKey
• Remove sequence number validation on decrypted AP_REP

What's the problem?

We are unable to implement a simple WinRM (HTTP/SOAP) connection setup using GSS-API Krb5 while simulating the WinRM protocol with Kerberos authentication. When selecting the Kerberos authentication option, PowerShell uses Kerberos directly, not SPNEGO.

The Kerberos.NET code needs to be more flexible when trying/selecting session keys to decrypt GSS-API tokens, and it also needs to relax specific requirements around sequence number validation, because handling can vary by application.

• Bugfix
• New Feature

What's the solution?

ApplicationSessionContext needs to keep track of sub session keys as well and try multiple options before giving up, in order to accommodate applications that may misbehave relative to common expectations and specifications.

ApplicationSessionContext should not try to validate that the sequence numbers match.

• Includes unit tests
• Requires manual test

The provided code can be used to manually test.

What issue is this related to, if any?

The issue is described in #398.

[SteveSyfuhs]

@petrsnd apologies, I was traveling last week and didn't get a chance to review. Why did you close this? The basic shape looked about right as an improvement.

[petrsnd]

@SteveSyfuhs No problem at all.

I was just reworking the branch for the PR, and when I deleted it from GitHub before pushing it back up, GitHub closed the PR.

There is still one unit test failing with our removal of sequence number checking in Crypto\DecryptedKrbApRep.cs. These lines:

if (this.SequenceNumber != this.Response.SequenceNumber)
{
    throw new KerberosValidationException(
        $"SequenceNumber does not match. Sent: {this.SequenceNumber}; Received: {this.Response.SequenceNumber}",
        nameof(this.SequenceNumber)
    );
}

I can either delete the test or rework the code to support a configurable sequence number validation function that gets passed in. What would you like?

[petrsnd]

The specific test is:

 DecryptedKrbApRep_Validate_Sequence
   Source: ValidatorTests.cs line 389
   Duration: < 1 ms

  Message: 
Test method did not throw expected exception Kerberos.NET.KerberosValidationException.

[petrsnd]

Reopened PR as #400