Trace Kerberos authentication protocol carriers

[eve0805]

Summary

Depends on #21717 and #21729.

This PR adds application-protocol carrier tracing for Kerberos service authentication over HTTP, SMB, LDAP, and MSSQL.

It builds on the service-authentication trace events and presentation introduced by #21729. The carrier callbacks describe where GSS-Kerberos or SPNEGO tokens are transported by each application protocol, while reusing the shared token parsing from #21717.

This is a stacked PR. Until its dependencies are merged, the GitHub diff against master also includes the commits from #21717 and #21729.

Functionality

This adds 10 request/response carrier callbacks:

Protocol	Request	Response
HTTP	Authorization header	WWW-Authenticate header
SMB1	Session Setup request security blob	Session Setup response security blob
SMB2	Session Setup request security blob	Session Setup response buffer
LDAP	SASL initial credential	serverSaslCreds
MSSQL	TDS7 Login SSPI security blob	TDS login response metadata

HTTP

• Traces outgoing Authorization headers.
• Traces incoming WWW-Authenticate headers.
• Records the authentication scheme and Base64/decoded token lengths.
• Handles both Kerberos and Negotiate response schemes.

SMB

• Traces SMB1 Session Setup request and response security blobs.
• Traces SMB2 Session Setup request security blobs and response buffers.
• Records the SMB version, direction, field name, and blob metadata.

LDAP

• Traces the SASL bind initial_credential.
• Traces the returned serverSaslCreds.
• Works with the existing GSS-SPNEGO LDAP authentication flow, including channel binding and sign/seal setup.

MSSQL

• Traces the SSPI security blob placed in the TDS7 Login packet.
• Records metadata for the corresponding TDS login response.

Carrier presentation

The Kerberos subscriber interface now includes:

• on_protocol_carrier

ServiceAuthenticationTracePresenter presents carrier metadata including, when available:

• Protocol and direction
• Carrier and field/header name
• HTTP authentication scheme
• Host and port
• Service principal
• Encoded and decoded token lengths
• Security-blob length
• GSS-Kerberos or SPNEGO token summary

Carrier tokens are identified as:

• GSS-Kerberos
• SPNEGO NegTokenInit
• SPNEGO NegTokenResp

Malformed or unsupported carrier tokens are shown as structured parse failures.

Trace modes

Protocol carriers are shown in the existing metadata and full trace modes:

• metadata reports structured carrier and token metadata while redacting binary contents.
• full includes hexadecimal binary token contents.

Tracing failures are isolated from the authentication flow and do not interrupt authentication.

Scope

This PR owns the generic protocol-carrier event, its presentation, and the HTTP, SMB, LDAP, and MSSQL integrations.

It does not introduce:

• Low-level GSS/SPNEGO token handling, which belongs to Add shared Kerberos GSS and SPNEGO token handling #21717.
• AP-REQ, AP-REP, KRB-ERROR, mutual-authentication, or service-ticket trace presentation, which belongs to Add Kerberos service authentication tracing #21729.

Testing

Direct unit tests cover all four protocol integrations and their request/response callbacks, together with the carrier subscriber and presenter behavior.

The following affected test suites were run:

bundle exec rspec \
  spec/lib/rex/proto/kerberos \
  spec/lib/msf/core/exploit/remote/kerberos \
  spec/lib/msf/base/serializer/readable_text_spec.rb \
  spec/lib/rex/proto/http/client_spec.rb \
  spec/lib/msf/core/exploit/remote/smb/client/kerberos_authentication_spec.rb \
  spec/lib/rex/proto/ldap/auth_adapter/rex_kerberos_spec.rb \
  spec/lib/rex/proto/mssql/client_spec.rb

[github-actions]

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.