Commit graph

10 commits

Author SHA1 Message Date
Arne Welzel
ff58be2f36 ldap: Only switch into MS_KRB5 mode if responseToken exists
If the server doesn't include a responseToken within negTokenResp,
assume there won't be signing or sealing happening on the
connection. Don't switch into MS_KRB5 mode.

Closes #4275
2025-04-15 20:10:52 +02:00
Arne Welzel
26c4d0df8b btest/ldap: Add regression test for #3919
This works as expected in master, it's just that we forgot to backport
PR #3845 to 7.0.1. Add the PCAP from Martin anyhow.

Closes #3919.
2024-09-06 19:16:49 +02:00
Arne Welzel
02e3d30227 ldap: Recognize SASL+SPNEGO+NTLMSSP
The ctu-sme-11-win7ad-1-ldap-tcp-50041.pcap file was harvested
from the CTU-SME-11 (Experiment-VM-Microsoft-Windows7AD-1) dataset
at https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258).

Closes #3853
2024-07-26 14:37:36 +02:00
Arne Welzel
a70ccc51ab ldap: Add LDAP sample with SASL-SRP mechanism
This is what @dopheide-esnet actually saw. Produced with a custom
cyrus-sasl and openldap build :-(
2024-07-23 11:29:00 +02:00
Arne Welzel
724c08f286 ldap: Fix assuming GSS-SPNEGO for all bindResponses
In retrospect that's an obvious bug.
2024-07-23 11:29:00 +02:00
Arne Welzel
09a48c7028 ldap: Implement extended request/response and StartTLS support
PCAP was produced with a local OpenLDAP server configured to support StartTLS.

This puts the Zeek calls into a separate ldap_zeek.spicy file/module
to separate it from LDAP.
2024-07-23 11:29:00 +02:00
Arne Welzel
0cab87c185 ldap: Harden parsing a bit
ASN1Message(True) may go off parsing arbitrary input data as
"something ASN.1" This could be GBs of octet strings or just very
long sequences. Avoid this by open-coding some top-level types expected.

This also tries to avoid some of the &parse-from usages that result
in unnecessary copies of data.

Adds a locally generated PCAP with addRequest/addResponse that we
don't currently handle.
2024-07-17 15:27:14 +02:00
Arne Welzel
31122f335f ldap: Handle integrity-only KRB wrap tokens
Mostly staring at the PCAPs and opened a few RFCs. For now, only if the
MS_KRB5 OID is used and accepted in a bind response, start stripping
KRB5 wrap tokens for both, client and server traffic.

Would probably be nice to forward the GSS-API data to the analyzer...

Closes zeek/spicy-ldap#29.
2024-07-17 15:26:30 +02:00
Arne Welzel
6a6cc7f551 ldap: Fix substring filter parsing and rendering
The initial (prefix) and final (suffix) strings are specified individually
with a variable number of "any" matches that can occur between these.
The previous implementation assumed a single string and rendered it
as *<string>*.

Reported and PCAP provided by @martinvanhensbergen, thanks!

Closes zeek/spicy-ldap#27
2024-01-05 16:06:23 +01:00
Benjamin Bannier
d7db52dff6 Integrate spicy-ldap test suite 2023-10-10 09:21:57 +02:00