# Copyright (c) 2021 by the Zeek Project. See LICENSE for details.

%doc-id = Zeek::LDAP;
%doc-description = "LDAP analyzer";

protocol analyzer LDAP_TCP over TCP:
    parse with LDAP::Messages;

protocol analyzer LDAP_UDP over UDP:
    parse with LDAP::Messages;

import LDAP;

on LDAP::Message -> event LDAP::message($conn,
                                        self.messageID,
                                        self.opcode,
                                        self.result_.code,
                                        self.result_.matchedDN,
                                        self.result_.diagnosticMessage,
                                        self.obj,
                                        self.arg);

on LDAP::BindRequest -> event LDAP::bind_request($conn,
                                                 message.messageID,
                                                 self.version,
                                                 self.name,
                                                 self.authType,
                                                 message.arg);

on LDAP::SearchRequest -> event LDAP::search_request($conn,
                                                     message.messageID,
                                                     self.baseObject,
                                                     self.scope,
                                                     self.deref,
                                                     self.sizeLimit,
                                                     self.timeLimit,
                                                     self.typesOnly,
                                                     self.filter,
                                                     self.attributes);

on LDAP::SearchResultEntry -> event LDAP::search_result_entry($conn,
                                                              message.messageID,
                                                              self.objectName);

on LDAP::ExtendedRequest -> event LDAP::extended_request($conn,
                                                         message.messageID,
                                                         self.requestName,
                                                         self.requestValue);

on LDAP::ExtendedResponse -> event LDAP::extended_response($conn,
                                                           message.messageID,
                                                           message.result_.code,
                                                           self.responseName,
                                                           self.responseValue);

# Once switched into MessageMode::TLS, we won't parse messages anymore,
# so this is raised just once.
on LDAP::Message if (ctx.messageMode == LDAP::MessageMode::TLS) -> event LDAP::starttls($conn);
