Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ldap: Only switch into MS_KRB5 mode if responseToken exists

Browse source 
If the server doesn't include a responseToken within negTokenResp,
assume there won't be signing or sealing happening on the
connection. Don't switch into MS_KRB5 mode.

Closes #4275
This commit is contained in:
Arne Welzel 2025-04-11 16:44:07 +02:00
parent ee5ebc1b2a
commit ff58be2f36
9 changed files with 63 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
testing/btest/scripts/base/protocols/ldap/aduser1.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-REQUIRES: have-spicy
# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1.pcap %INPUT
# @TEST-EXEC: mkdir krb && mv *.log krb
# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/aduser1-ntlm.pcap %INPUT
# @TEST-EXEC: mkdir ntlm && mv *.log ntlm
# @TEST-EXEC: btest-diff krb/ldap.log
# @TEST-EXEC: btest-diff krb/ldap_search.log
# @TEST-EXEC: btest-diff ntlm/ldap.log
# @TEST-EXEC: btest-diff ntlm/ldap_search.log
#
# @TEST-DOC: Check two traces using different authentication mechanisms, but the same search request.