Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

ldap: Fix substring filter parsing and rendering

Browse source 
The initial (prefix) and final (suffix) strings are specified individually
with a variable number of "any" matches that can occur between these.
The previous implementation assumed a single string and rendered it
as *<string>*.

Reported and PCAP provided by @martinvanhensbergen, thanks!

Closes zeek/spicy-ldap#27
This commit is contained in:
Arne Welzel 2024-01-05 15:26:06 +01:00
parent fe0f981f87
commit 6a6cc7f551
6 changed files with 64 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/ldap/ldap_substring_search.zeek Normal file
View file

@ -0,0 +1,13 @@
# Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
# @TEST-REQUIRES: have-spicy
# @TEST-EXEC: zeek -b -C -r ${TRACES}/ldap/ldap_star_single.pcap %INPUT >output 2>&1
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: cat conn.log | zeek-cut -m ts uid history service > conn.log2 && mv conn.log2 conn.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ldap_search.log
#
# @TEST-DOC: Test substring filter parsed and rendered properly when initial and final are present, but no anys.
@load base/protocols/conn
@load base/protocols/ldap