From ff58be2f36a986a9fc744231336dfccf4e9241d9 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Fri, 11 Apr 2025 16:44:07 +0200
Subject: [PATCH] ldap: Only switch into MS_KRB5 mode if responseToken exists

If the server doesn't include a responseToken within negTokenResp,
assume there won't be signing or sealing happening on the
connection. Don't switch into MS_KRB5 mode.

Closes #4275
---
 src/analyzer/protocol/ldap/ldap.spicy           |   5 +++--
 .../krb.ldap.log                                |  11 +++++++++++
 .../krb.ldap_search.log                         |  11 +++++++++++
 .../ntlm.ldap.log                               |  12 ++++++++++++
 .../ntlm.ldap_search.log                        |  11 +++++++++++
 testing/btest/Traces/README                     |   5 ++++-
 testing/btest/Traces/ldap/aduser1-ntlm.pcap     | Bin 0 -> 3159 bytes
 testing/btest/Traces/ldap/aduser1.pcap          | Bin 0 -> 13575 bytes
 .../scripts/base/protocols/ldap/aduser1.zeek    |  11 +++++++++++
 9 files changed, 63 insertions(+), 3 deletions(-)
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap.log
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap_search.log
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap.log
 create mode 100644 testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap_search.log
 create mode 100644 testing/btest/Traces/ldap/aduser1-ntlm.pcap
 create mode 100644 testing/btest/Traces/ldap/aduser1.pcap
 create mode 100644 testing/btest/scripts/base/protocols/ldap/aduser1.zeek

diff --git a/src/analyzer/protocol/ldap/ldap.spicy b/src/analyzer/protocol/ldap/ldap.spicy
index f448d71f0c..63379d9a83 100644
--- a/src/analyzer/protocol/ldap/ldap.spicy
+++ b/src/analyzer/protocol/ldap/ldap.spicy
@@ -423,6 +423,7 @@ type GSS_SPNEGO_Subsequent = unit {
 type GSS_SPNEGO_negTokenResp = unit {
   var accepted: bool;
   var supportedMech: ASN1::ASN1Message;
+  var responseToken: optional<bytes>;
 
   # Parse the contained Sequence.
   seq: ASN1::ASN1Message(True) {
@@ -433,7 +434,7 @@ type GSS_SPNEGO_negTokenResp = unit {
       } else if ( msg.application_id == 1 ) {
         self.supportedMech = msg;
       } else if ( msg.application_id == 2 ) {
-        # ignore responseToken
+        self.responseToken = msg.application_data;
       } else if ( msg.application_id == 3 ) {
         # ignore mechListMec
       } else {
@@ -523,7 +524,7 @@ type BindResponse = unit(inout message: Message, ctx: Ctx&) {
     if ( $$?.negTokenResp ) {
       local token = $$.negTokenResp;
       if ( token.accepted && token?.supportedMechOid ) {
-        if ( token.supportedMechOid == GSSAPI_MECH_MS_KRB5 ) {
+        if ( token.supportedMechOid == GSSAPI_MECH_MS_KRB5 && token.responseToken ) {
           ctx.messageMode = MessageMode::MS_KRB5;
         }
       }
diff --git a/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap.log b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap.log
new file mode 100644
index 0000000000..740ca715e6
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ldap
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	message_id	version	opcode	result	diagnostic_message	object	argument
+#types	time	string	addr	port	addr	port	int	int	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	ClEkJM2Vm5giqnMf4h	192.168.226.131	54544	192.168.226.136	389	1440128865	3	bind SASL	success	-	User1	GSS-SPNEGO
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap_search.log b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap_search.log
new file mode 100644
index 0000000000..76424d5afc
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/krb.ldap_search.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ldap_search
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	message_id	scope	deref_aliases	base_object	result_count	result	diagnostic_message	filter	attributes
+#types	time	string	addr	port	addr	port	int	string	string	string	count	string	string	string	vector[string]
+XXXXXXXXXX.XXXXXX	ClEkJM2Vm5giqnMf4h	192.168.226.131	54544	192.168.226.136	389	1319382063	tree	never	dc=ADHACKING,dc=LOCAL	3	success	-	(&(&(sAMAccountName=*)(mail=*))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap.log b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap.log
new file mode 100644
index 0000000000..502d28b4f4
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap.log
@@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ldap
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	message_id	version	opcode	result	diagnostic_message	object	argument
+#types	time	string	addr	port	addr	port	int	int	string	string	string	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.226.131	37618	192.168.226.136	389	173945320	3	<undefined>	success	-	User1	-
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.226.131	37618	192.168.226.136	389	1489001992	3	<undefined>	success	-	User1	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap_search.log b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap_search.log
new file mode 100644
index 0000000000..a02df616d7
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.ldap.aduser1/ntlm.ldap_search.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	ldap_search
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	message_id	scope	deref_aliases	base_object	result_count	result	diagnostic_message	filter	attributes
+#types	time	string	addr	port	addr	port	int	string	string	string	count	string	string	string	vector[string]
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.226.131	37618	192.168.226.136	389	1673297393	tree	never	dc=ADHACKING,dc=LOCAL	3	success	-	(&(&(sAMAccountName=*)(mail=*))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Traces/README b/testing/btest/Traces/README
index 6f9576cb71..ec244576a9 100644
--- a/testing/btest/Traces/README
+++ b/testing/btest/Traces/README
@@ -49,4 +49,7 @@ Trace Index/Sources:
 - tunnels/geneve-tagged-udp-packet.pcap
   Provided by Eldon Koyle Corelight for testing.
 - cdp-v1.pcap
-  From the Wireshark library of captures at https://wiki.wireshark.org/samplecaptures.
\ No newline at end of file
+  From the Wireshark library of captures at https://wiki.wireshark.org/samplecaptures.
+- ldap/adduser1.pcap ldap/adduser1-ntlm.pcap
+  Provided by Mohan-Dhawan on #4275
+  https://github.com/zeek/zeek/issues/4275
diff --git a/testing/btest/Traces/ldap/aduser1-ntlm.pcap b/testing/btest/Traces/ldap/aduser1-ntlm.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..3498d7a3cba5402cdf3fa5743d5c85057ee2e7b7
GIT binary patch
literal 3159
zcmds3Z){Ul6hHU%b}NM_`vY4vgOLR{adhwX?;CEi+VN*ww~^q`ScNrR8O74#+KE9R
zWr(0cB8w!(D0VYO910@fP!tA=elQL-d@&e92p<-sGBD!<iNSO3+q$(YD<*#Oz24q;
z-@Wg5&hMPxJ?~xo>XRM`IE)`07!D48G}x|R4^WTS)L_Pgiw|_+e_z3611tfk>OWos
zHCa`C0|&3{z_z>l2HTkvdipdij!U<O%k~3ETz{NP2IKT+FJ#kwrqg8;@>9ViWW?0)
zHRQnCH4w|HKTD{D&USX+@MK-NhUjPFxwmhBxmQC*Gy|c7v-AjAAmrCK06dD8s7><O
z+J8d$d^E-9Gl)JMo5^ne=0hKu@Yg`7g!uC&faej6+9bsF{htcN&1n$}+0Ba=5{SZ2
z*(!14YGtUkTw*$|Z;ALjlvj$I9&<OYT)9F-UN7yAlc|XZ`7w73Kqsb#nwE$0n6dW2
z0g74O{*;&vW6VZkg~hsU?V2CR>SK(RQGOA}3pHQ7bUn|=fOoONF;^tCl8dK`y<U2`
zH&&#d{>NWC<uSJgVNeLe2wR%*-n~w!h2`J`7c@W}G{G{E@af5S8O(vl#fpWn3Rg9Q
z4eU6s#C{2`Z$L55N%Ncuf)EBDc(K>PBN;GE84&atZDfN1&itNp<E?#{DB$Q7CE@bc
zDdp8K#Bd}<3?rVbt0gF}k)fMf5-<TXC=rDC-Wvc03^uh?d9hplCkb)UP+G)7HnPu<
zK+GdVxr?2X_!9%G4Xs`5<haCM?P7gnnbo18LOj=Dzkn@ZG3@8yS%bY1&(+w|LGyI<
zA%7C(<XoD-jrnt7tliK85%5C?C{Ub#wAeG-?0N0*w=MVSwjGK#`|5qGHm^VS!goKq
zubsGFkUK5@=Ek+}GZ9xvM0so-+5G=#XBw2DY6Gwq<5Q7AwZxnb(#54701sYMOWp3!
z7<fmN$ivCo{c1^0Xw50y?ktM2r9y_9IEHG=qwNlPnlfm+LpE*qQBhYP!a00^+9V0;
z`#&QIKKx6v1lOEGQCG!Kg3tY(kYE9sleZ5_-1o)S>%Q%AKC8`F?W|qybT!m9Ei1=?
zyV>P*8<~XWCGkTQ#Orq56LB^=eZFvKDB9%R;NQhJcmu&+<%5dtvlWxsq*`T@qF8J;
zyGb!wO{#3^%B9jd`iLtWigtv9JD6Es$Wx%WapR^ow>J`9>5p;&%cli#=nl7sL-7)M
z9#3b%qEzy1Sue3RZQp-$7+?|CT52|Uc_2>NSUQ-JjjEhb>mJHRX-6U(1DK5hk&W-Q
zD78^G&hk=MQ#CP?%SSIF<+ZK}p~FEi?DGc2qut^^e*zJOP;{KhV&;K~q{UP|&s8iI
z)h^2xi_M{`W`|<8h_ywj0Tb)9wO5k{SE9vDOcd~0o#bYXw{4x*_e>zvZW{ON*9nw<
zN>EbnhSIyjnfa-d5`H@rv)y4en^i@2WaenIsFjMWs<J&ZM@1}2!%_Jc9L@g;N7-(-
zS30Z?MX}ulM~AgiwX1fsnwg{dP8`i?IeN4_Mo3i6yfN73-MFZtVrjU;ABon6B2R`x
z{)j2Dtu+BuphA;ZOd;U(25Q5&>qAo+NM138frbeT7W3*+2B|LNR>RV<HqhSL;f)5u
zp(y}sH9$XwWUO|^Y4DH;?fg4dk?CR{E6HfFed+9!Ul5;*FNhD5i*4&3Pu7q%mc#zM
zVo4O+A}qE8^rmp1OF~Tkn6?Ibs5aG~Pp(ZvR;*2XV>64{*Y_uC(|N2-MTB@75$(v0
XT57d}vOupu{2?9UihO{%=K=l!B>FKB

literal 0
HcmV?d00001

diff --git a/testing/btest/Traces/ldap/aduser1.pcap b/testing/btest/Traces/ldap/aduser1.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..a1d1c5aa4a6ac259e0515ee8a23819ee90b0a135
GIT binary patch
literal 13575
zcmeHtc{o&U`2U%4W^CElh=fXF8oL%-NV1y<m3?GnUt3fRc`ZqLE$uOAp}f%^ZHg9A
zQM3q^v`DC^yvpx+&NP!5Uhn(6uJ0e;?{#%}<~hrAKIh)fec#W0o(I<|3-Jhw{Mt|i
z2M!(`X<SoWKtPs(eb|sGb4(7<!EdQdCm&*oAd56#nIfjdy7gC%yhs8qHDML*Vs(XO
z9vobNAMTG*L=ZemIECW*1O&Z!n&EjI4-YRyZe(yE157496FKm^DUv|6@qwri9d|Kd
zm38u2A%LD=AU--OdYOp~(D)!aLRz&MJ^>=f6%&xf;7PEJqghw88>2aai{^ZQE}S5W
z8#2lTG~zINA3#)ySbvy+WB@SO#vyLfe2pRMPlzas8*(GD5g$TCfMGdGv0EGo(PVKq
zVaM7=M}O`qBY6AeO15@NWRjLPf(OHuv`J(#d)LIo1XGY>838c{+JcR#nqOkXkpq7~
zF)j<{5~DB>V`qY_5|4sBlQck90ubLrfbsPQc$O*HVQx6g6j(?9r8h%(kWoB>#EM;+
zm+VDYx|e5gtM75Ci@ey)3E-F6W?bl&*pvMf(v58i$U3a|jwKT35^)3qz95(!RIrG=
zfG7ZtQ5@X>k5?q}tEVibe-X#w@z`z(b5{VIW$yBf87)wxPF5?JC9fJ97VYIv4WNZm
z{k>?RUd~I*b+rr(O~Zq!K2cOJ+M3X?NGeqHy<?M_&Kpe8o4FL-X`Osd0GQ6;B0ILC
zTcAWC;=X$X<OJXgwsEGz(0q#_icE+oiyQ2ZVIy`xM1T>*)DK&15Et9VpJ83$>{Wq&
z;8;`8>|#P<U6(|LY*_2JF2p@LiZv3C7sVqykpAEYliJrPW?ySL?dzOCb;S~UXkX4o
zZ2QUp_SFIKf7%y|+F$m?I>VyjpL%Ft@Soehtgssrz%R3v$iDqwXJ2<-5RgtlA#CHU
zp-J-{w1(PtPHR|VZ=HOem;kJy{3+WSx_~u6Z?tEuHH?)Ycme;@HWfg!2D&j_CU)p;
z%6<#=$+`u?<SAp{D~2+vWWU_jjzV$7Zr7uycCt`dJ+z+9uL#I3fDhX^?^HztHkd%P
z?%=eZ^F&}h?}7E;Teq{VCkt3l7dT2{@hgoWSD@{%i09@P7#@m9vS|6$^Ml=`$U<Bp
z9cMtM<8%sm1aP=QPUh&iX($~h%VH2hi-SKy(Cg9DUQ~9OT%o<ZV$A|=L>jU9D1gK}
zfO8^dhy{3r8DfsuAl8UIVuj$r-Q&;V5JhAKHbN6|1*04gJwzWI&j-CF7;ghOP@LdC
z5)zDrA%2Jt=y?$1f59OA3j*O^pTUdpA!A=AsMyW{0`dhg3)?tDeyiDo8FC$$A-}gy
zzK{tGS#~+wklz49&H@+}EX6`V9I^#=*aqHoj_scm%W25&?0X7VkX;xQ)QP1{hzHHa
z^ydh(pFQh%Y%hw40_j1m1M@x;em=6rfx7yU{ycu7Y#rtu$wLGr9}Iwv+rE)B8V=gG
zjVPymU&ySkuqp)hjT;JNiUEk=Phj6~0EQE{7+CiGU&X+*Z+@hZmrQ`RjU@?n!vrK9
zpu;v!Tk)Fjp|<L@Ikja~2(<MAYD;uBTU+lSsQ|-bESY$qEk1}0Hk8@1e_7h9xEPlF
zEo!-7j>V6Yqon%za2&KF#}N+7IJ3Zb8XgniG%f+Y00Mjq1vs*YEx=qLz;^(29A!`-
zaQi39QUY8b7mA6!oZc!T-YiQ}W>I$b2S<L&mH84wq0D;wSu%Slird=AxUB@A1T)`M
zVUEnV2cBnTz73-s$ecVcqVZrnuVnMQ^`WSIi>M?(p8+%9VdHU`Zyw;i2TBvg5huxf
ziD4McU$|(V0nnvj<~v)8t>^bZ&v_8Bm`I!?|F2&S5$E7oh`s)ZTb{boAWI6)X&h4M
z9V-Q4J`QAVDWI4XJXlgd+<N_$W$ttU^dTq(T-i7&>;h8gg)~p+pG*q%o*2!1Tr>{>
z^iC)RQX*RlAAl5gLB#U_@dqFtwsG%If4vt(RI`~75#;|BztTbs5n!APN<2+YtSscg
z;|L7!BTytomLQ82qIf)#z~D!*mluZ{El%7{PRuCa<sl%B2?$asP8KZy!*PZDWL|lK
zOB6Lyiy<a2VrH?_%-qJ>-il=FU~Xnxq)Jw14wENOl_#!^^o?E<J#JKqn5>94SzC{+
zqoqYQ)YH{9^f)yB)L|kX72m%k?+Aem9xM)};Veu<-VqS2aXURi8;t-pXL+7WbDeqW
zGb$5Am3W9Q>~|Jw>;r-jUDwiy&SW~#9uiG}LJ?$;$QopIxGTX>L1&PslNI1a@j_{N
zNiJ?NDHM&DLh%H`Dxst2edy?EG99g8K5YDbjQ=FPB03rdP}VZ30;J&?baXXJN8Ojd
z@Zh(jDkwYmOP#1YQ_1)$so`0F==LU(rkG`>?y@b>(gvILklcFbhyrt?OvWEPA7&)9
zDI3M)js7icc~<P~8_{o$^$I5b_=_jC<G+l=HQg8xq0P!a6#e@8i$`mG9~A}38|GVk
zOQ^m*^AcytXFQjfv)s<)eXk&Sror%8!pva$X!wl^(_?l>7rDmow9~<%a%2AVnClgi
zp9CLU|1GQA&^T*^G-#G@KK-HK(`%~5o<W^Ti+Jax^l03nNS}%eIbW-uR-xE@VV-Bt
zw%Qga=edop=Ssgy^4|YjPRvt(yXN1If{d+oFF3j99Bp6K`r1FOWJkG6^M<NTQ+u;_
zi8i6x&01TIw^C^vkDXh@qyP4L6WvB+^mFLf51kIr9S(&Wk5Y6myD48Q&+(zH>Q*Ta
zD>#|Oh$a-Yp6PgU%#Lqc&9u0hbS+ukY4p(=%Bs3!CW-U1&SxuGFO8U`pkrFl&?nd}
z+LiuMjwkm)`S;+wD=$Z$W^TX4tL^i?(&1y8f7*aJaf^4j!QMbez3H!eZ}ntOWjM@z
z(|4=uMMIog<IZyTn=XepY%6UV*jg%wzn)%da`eV)$=>z72CD8Wdrz%BvT{11Wv%`8
zmW~tJUp}d>J5sy-!PWr%?HbG46sDhEb!MGU;{e`sn)nwvpD!D(=P5m_H(RnGr1h3y
zw=ey<cGhE&o~n!^v_sYI;YsE0(^fdD7pUI*R<7hqTVH=REp1=hvAE47lj|8)j{S=$
z_j9wTIW5r!wM38nFT$6)<pP(J=O5l1^5h_{V@st|^JhtM<LR>~9p6NSGvX;%qqpb`
z$aoyGO_=JFW4bkD+Sx7Ep}6dbL_6`y)c$7{?<&g~v1<hrduK=MS}lAgxAB7({?k2^
zfv%Yu?_XD*LC_h83SUrVM~e94=gS=3e>7Mnb;W`oDQ`n-sE4=e>9<E~-rbIGwBZ%J
z7V<T-Fh-lUT3;mb_Ox{l&y~f(mU^vk9yWMsHGk>O^lT+D!-|V>H>*$AgGqF6%Jsj^
zr@zv>UMY7d*2L^HLidk-bg=A2!1r%uitX!hJ2di3eI5+&yw9t0<kGyLXY2Ppv>o(*
z!IRN=b=0_on(FRgn;!2uP?D08RCsNZ!E8^#bFZ?UG~Zk;y(M~LY80;S%<*daM#{3o
zs|~I>mDn10+*4GtqFmf~c*HrVp`tvZ6BRmOFimh_vX#Y0={BWZs@sG*<N{A7zWA;&
zTeIEc?-SM1Y4_g;wO*@5yn0W}5E&shZ2m4UXqDo+yCLRpa<Qm{n2hFg{?M1!Mk_~m
zC@I7>Wey#3>V6^LAyKf}aum7NqLFPK6@J@h_nfWri}hAWZ6$7#p1RO>ZvU`YeD>4i
zbPaUoyP5mmz1AibAKNwG2>FQXu-SWZbajxVklcnYS?{g2uXEC=x{~eR(_J2>-RQir
zW>_WHT4E=O5+3zt>YEGl+xE6;Y_+;{esJW#fzXuwS`Ump=9wSf>E@;;XW8IyRO|U*
zfBxq)rHAM^4KQU<8|!j#a$u$+?Rjh8)%p5w#Bbc(QBrAhakcKJmT&^Uc=Y@3qItJg
ztIWJ2x2bNJw`_O3g-X_!fGQ{R8c*MRDZ%q{_5D3{jeFFaOKNu?H~c<Fj7n86$lg8p
zb))VMIkm?3rL{#*J<|R%4azAofS!L9@cf@a_=1hw^CR6fBJ}*r$~irMQ!3{9K{3G6
ziPQ62q)Ipz1Y|zdsf=mc)8He|*nPuY($=?cWnN`K_2ZREy2QC|+oMnQJ@m=Gr1Gq3
zbBce;nyI1!p9D5OJ~$<R*VRwPo~;*0u106%I@oC*G?PxHuB70W=+sPge|PJa7S*v|
zWMo@5{~rvYGUYDP>Y*76aUzvNXE&=I{%jrp$?cWZ7SGZRNvh3KM*a_jvXiDPKdoet
zuPgd=ZA8)^ajkzj?2w2|9UWSGSNxGNe~<kB2<?#jPzE_7lV%s*Saw0=%mrptD$6vb
zCWzvvs1e!OMIS4>D4iV92SX%`M{HgI5S3?x6#HkrvY&-`Sz=NeeKACILPRluxR8xF
zz(Vws;y~og)^usSShnWHsrlvwK=UVI%;$GyYknVy`2$dniqb?d+eNT8&X&|@d>CTT
zM2L=(2-29soIhw5bI`?^rR!?;LQc8s(^hY-ldIHW!A}1!i&In@aGDG0lDf+~NyaPl
z79zIAuw@sHxb>u-UJqXgnD+<H9Gmf?zVJLN?>~5t1DR8Xi)j29$1Y<y4lh5~dKI8=
zfEn)=d+v;PwUD3}>I-SUd7pQZyk7<@E49UQ(Yyhm*T9VTm?~Qeeh6u`5JYrq;vJjg
zamba>Ces6@(9--*i1luqhzLS>6-*~QC({Yf*g5Z%B09kvoLL2$8$63+&<PGGonRA6
zCs=`#=FAKYToGo#3>a=8?fRX-{Z8P1Cvd+Lxc_?zTyX?B3`^b^foQ<uO}_em`rWoh
zQx1d+B~#J`Qk-)adjGhir<8g-?q*h^nr}_!!<o5WCN4rc=wn&JR7r}xhB%daZC;w_
z=Z7YH>na^a=nJ&0-J%T>cdsy}Skj`CRc{3^*XrGT;q2w3J?>@q{!&mb4k53_$_J*2
zi0DM60%fuiBne+Ql`JC<J%2dx{7Jym!Zxnf5hH`u3fty$dj2Y9ES7*;hp8Z^=SPG6
zeZu8MR#@9>x>`Bt>08g&voy1rp!5Li4AZTPFCGD38t^z7JWdpk19V{p2eg?Zym1Cj
zU77$EI9G86&YGUoDnFQfq-rur0-;S91WZ53<i1B7;f(_klrRJ#qUFhdLZk!9z?2Ih
zia<mV-iAWxgpVL*ePG8dq5oczI0#A-dqFWFpLz2HB?%5KO)OIo8CL)d3T9w1obrHz
zge53Qm<=BLbH7J>)Wgm)yO?~T&qiI-+>V%i^GUvEqiOP_=h*A5j5wV;pHKVf9vNJ3
z+pyBYS?hSjx~sLuOB;U3$*Ie1JbKwBe1T`ysqe;nvMU-NnmG-R%wKF&eScGt!_I>T
zkO$Xgb{G3AKS^~}unV|GnKMlK(oHYhvg-1!p38!*YlJ-geI7jhY9%0&{4rZZb>t4E
z`h23Rs({y?K+Ed4gH8mVKjZG+$5T;nhO}p2v0{syXP=vNM7rYMH8vF<4OuxO5)oad
zJp1m-sDED?sLFRdcNf+9u}r%xb>VppyD8rYB5M7W_L8U2ve}P2s5#$!(|Tgdr5hKd
zWhH)Wxl(XmrB7vD*vUWFL`TVId$`Go3|C%qt8f)XepntlvIlkEX_;JgQ!!oXgQiP|
zj<bIqVn5qA^?KX&ds|Z7rc#nZyR*9_ijL-X{?#gfA*=ATTacW0p;NR%@?6yj7m2&K
z&Qo(JC+C)T->7@=>~i;t10I)d%wOu(dV=V7wC7ov<Y&7Tv&{6PZ#0n*nUQQk4TZSJ
zO^gA)gNTA&&i>k+i=4YQ?x^~Rd>$<|7}nw=Xw1uxcTn5uK35>KN|_>->3H+V@>pqd
zWaalAHqUGB2#%ha**Z;%Ci=2QNU$wzhP&6j^leAv`d)N|S)6!sdy#%bzv}DG()@RA
zhN%*#>>6;+uL5u%gBADB>rT4u+xgJob#P?TAHsk2+_+!T9VtPObw9RHe0a{(R7<xq
zYQU>{;-e=DQUg+NvwirU>5^tvW-e_a^LCQ6%T8XFY*bnEjq!1s-I7D^jY8{l<9FWM
ziX-tpu^-glyKb&yO6(dX9_5?sTf*11-iw@d|3K+`V#AOAh)c?94du^1mx<K5MQ>`F
zwVs3sMHhx7%kN5RD*2pe8-4=6p<IBj9N${p;h3>yWvkMnh;(JW$PLrxx->7z8!SJ#
z@LN=i*@9DtFIYMGZ;I&M;eFho<x1u(tuM|(S3d_C{Fyl7_SGu>TuxP8M#yg4$LsQX
zE#KYu%3ppb=1H7|$)fd^Z-$>=BEQt!yLHzUC)oj?%7t%lD?Bh0_})nPwC_$WA-(L-
zNKMwctbowwMCrQeuLRC6JlVN$L7|%5qYNt-^;;%9UKtnq__f}3&6)XKOCxem|C+;#
zYuBHCuIgf`d`IGoYRuOlS^4~nUzSDh&ae6^A=BSm$uP)^&{t1&B&>>)ET8Qm@+>|x
z-1@F!guYxsw}o)a-IY-(J6tZF@FvHdSXdDq93`q-W}ErIYr}KJRZ6FGa}WBvC@)F;
z^DmkZA3^ZGQCr)_u&B}nM3veL$3+5r10?M?og_3o8EvQatt;s|DspvMYP)Ss!)Szw
zH^n<S*OeBVf0`oNy!XKN;G|`<^e;~zsQfNk<ly3<xbxB+TgxBiePxP*2dRt2&g~7+
zxw6zkKuxe-!Mx;Z8_6gvX8D^9@`1yf;zFj3K8xOP-MC$3(csfTP<W6Ag$HrWwJ_*7
zeo%8D+&t|Xt}5-#dx!UC^I00@=-JmEo5E*{1WKKHBe?0V!Zxc!!i&Y0`Q3I6h`m?6
z({gh{eod-ENb*Y=*X0%a%69J&TI(J%Evf%-(Y8pF?L$iFt|~!^xmi!lNR@marCuLC
zzO5uHCQsig=jn~%kUpO)F?FBs#FR=li7{p=CN!$~8|<vUMob>`%UjgVul-%M%u;e)
zfk-*S><(Ycqqv!8++RJe<ME*BuV`G?w4LX<T!da)C-nS>falKv{u{P&)6Nvy6fBm&
zj|14UBk<V)Ov0W8VX*|1F!Vw>J^%JF+js7<abanj%=gf|Y-~;rEq001osl!wLiOd7
zqYpc+iul4~Rkr<Du*xCJV!$ITX}8mW{N+EZo(%P7QD%EhTeLo-;{HDU={G<9m`VxR
zUzmOX(pd7CBi?aLz7Sm*Y*O3CUUb!qO+l;tAf2$pPyi;Q%z^+)g%JuOo|zo+12(B$
z#}(8eVl{@y{s8z3vH!`WH1=VLaT6kn0UBqGr!nX$2O>vIMs#UHm}cC$G*b;U;}4@e
zoy69RD2U0}YMvT^I7x{?7(?`*2oaVTmRd1O44rKpba81z6O&yXTXxJPa6d~7VxYtT
zmV5owMgXhCaQ7JpA~&ZZ7+ot^bTOB{RjGrIp6>vsIGG_fr(%H90H|M^_DMMv#Sncb
zLWG>Q3o|*r^@<m%1M_UyxKlsEIbt}}>6=J^f-Uy@`N@;{`4FUjOBS;^4FsI#fov!N
zkGixR^zo(>VnIHFGCx>>X@4LpU`3&5QXK6qt>BE`4UAaMUT;DtECu&k6bO+8$E@}O
z#Q`laR1*{j=77sH*@+fMao~3<^*fdNol5;qrT(|3QrLVPOwME&{;03#kXa+~(X}@f
z^J9<mwg+0(cJ@}<wn?`nUFp!T`dezdN{029)H2uS7t|X!btNZmj^BItsXy)QM~c&e
zmYvH64Xc~v)#g}~nAAnD*iEE+7<i^WB@ly_U29)yp>tBl_nGl-7#nu?@gi_xC$_i~
zTfEKm?bt$VDoqTF4XW(ez+7%3)yTM8k{~<%hinEr+DL$C6G%=5P;;4n-3RVZ2WyN_
z@b`ywp(Gikh~Thrtl!4ckA9AT#}z_}5iqdy4sr&TyCq;<$`V+gR`O>DmbD<Ek${Mi
zUwIJ;ur>-d?ofpz5F;@}l?f3+s7kM9BZfdka$+MMwJ+9~=a*Q3O8NU4v6mQVfCFqz
zg#Zo@IKyNAI2=-7{fBUrnVp%RUsz0Nw7pLV^$#?}hZfAxIyx^=T8pGjGSmetx3zTi
z^z=zuBwdmrS%)qTmn!_c#XKxDIx;Lc38zigM7f|)f$%tgTc4<C3N;$VU{U^HaA+I0
zCM>i-g**eD=m|Pn^WnM?JkB4*mR1Fg@FELP1Z&)xE~-HjhkCbSS50tCy)S8G+>3=P
zck#cn3|XM}5KQk4Oey(8y<bIVo7)>fj>sB6ccL^b%*Tih90Z5?`2=IP?!<m2$1tJ=
zQFu@s8M`uTEYsK}NmN`*N5@c~OxDrSGcYvNHqg@7!Nw|Z3k)02%gisBa4Jl>VHadj
zsTfG6sgHl4kKbBa=o->5y4uIE)Wl{<>%Xv6gb_27n<X~g24r1GwVsx?f#JXNsHbB%
zAFRVMB<ue>k6PG}33$}{|KL&ke~3qYLoFRGJsmwJ-IMB3&p>y+p}wKMHd7vx>QVcj
zc+{Sd$CXSyMnR);K<!}JalyQKOTfDRsA!AOD37pEY7~k6S~Cq`9<Wf(5tA73#1F6t
z18;rkWDnpRG06jL#&BSQ8vW#en`H2+0oM^gTN4xM6HN;XodnQ=2}p$^;r;2Q3*f<A
zOtdrq(TfOT*MTPiZXG&X1m&CL^CB?{bGDy2o$b9?`4&mz1TkEnJXjq2a|RR+oUJTG
z3?gtKa?gMypl`CFaK<D_W8j<O;9T!JSRMSc{wfcAQ#eF?0uU#e>q%mWo)aO$8PK(I
G1o?l2(4R^G

literal 0
HcmV?d00001

diff --git a/testing/btest/scripts/base/protocols/ldap/aduser1.zeek b/testing/btest/scripts/base/protocols/ldap/aduser1.zeek
new file mode 100644
index 0000000000..fdafa692f6
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/ldap/aduser1.zeek
@@ -0,0 +1,11 @@
+# @TEST-REQUIRES: have-spicy
+# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1.pcap %INPUT
+# @TEST-EXEC: mkdir krb && mv *.log krb
+# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1-ntlm.pcap %INPUT
+# @TEST-EXEC: mkdir ntlm && mv *.log ntlm
+# @TEST-EXEC: btest-diff krb/ldap.log
+# @TEST-EXEC: btest-diff krb/ldap_search.log
+# @TEST-EXEC: btest-diff ntlm/ldap.log
+# @TEST-EXEC: btest-diff ntlm/ldap_search.log
+#
+# @TEST-DOC: Check two traces using different authentication mechanisms, but the same search request.