mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
ldap: Use scalar values in logs where appropriate
Skimming through the RFC, the previous approach of having containers for most fields seems unfounded for normal protocol operation. The new weirds could just as well be considered protocol violations. Outside of duplicated or missed data they just shouldn't happen for well-behaved client/server behavior. Additionally, with non-conformant traffic it would be trivial to cause unbounded state growth and immense log record sizes. Unfortunately, things have become a bit clunky now. Closes #3504
This commit is contained in:
parent
46d0287b49
commit
242db4981d
13 changed files with 189 additions and 119 deletions
25
NEWS
25
NEWS
|
@ -23,6 +23,31 @@ Breaking Changes
|
|||
SOURCES ...
|
||||
)
|
||||
|
||||
- Certain ``ldap.log`` and ``ldap_search.log`` fields have been renamed from
|
||||
plural to singular and their types changed to scalars. This maps better onto
|
||||
the expected request-response protocol used between client and server. Additionally,
|
||||
it removes the burden of working with non-scalar columns from downstream systems.
|
||||
|
||||
Specifically, for ``ldap.log``:
|
||||
* ``arguments: vector of string`` is now ``argument: string``
|
||||
* ``diagnostic_messages: vector of string`` is now ``diagnostic_message: string``
|
||||
* ``objects: vector of string`` is now ``object: string``
|
||||
* ``opcodes: set[string]`` is now ``opcode: string``
|
||||
* ``results: set[string]`` is now ``result: string``
|
||||
|
||||
For ``ldap_search.log``, the following fields were changed:
|
||||
* ``base_objects: vector of string`` is now ``base_object: string``
|
||||
* ``derefs: set[string]`` is now ``deref_aliases: string``
|
||||
* ``diagnostic_messages: vector of string`` is now ``diagnostic_message: string``
|
||||
* ``results: set[string]`` is now ``result: string``
|
||||
* ``scopes: set[string]`` is now ``scope: string``
|
||||
|
||||
In the unlikely scenario that a request-response pair with the same message
|
||||
identifier is observed, containing different values for certain fields, new
|
||||
weirds are raised and will appear in ``weird.log``, including the old and new
|
||||
values as well as the LDAP message identifier. The value within the LDAP logs
|
||||
will be the most recently observed one.
|
||||
|
||||
New Functionality
|
||||
-----------------
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue