Commit graph

4 commits

Author SHA1 Message Date
Arne Welzel
0cab87c185 ldap: Harden parsing a bit
ASN1Message(True) may go off parsing arbitrary input data as
"something ASN.1" This could be GBs of octet strings or just very
long sequences. Avoid this by open-coding some top-level types expected.

This also tries to avoid some of the &parse-from usages that result
in unnecessary copies of data.

Adds a locally generated PCAP with addRequest/addResponse that we
don't currently handle.
2024-07-17 15:27:14 +02:00
Arne Welzel
31122f335f ldap: Handle integrity-only KRB wrap tokens
Mostly staring at the PCAPs and opened a few RFCs. For now, only if the
MS_KRB5 OID is used and accepted in a bind response, start stripping
KRB5 wrap tokens for both, client and server traffic.

Would probably be nice to forward the GSS-API data to the analyzer...

Closes zeek/spicy-ldap#29.
2024-07-17 15:26:30 +02:00
Arne Welzel
6a6cc7f551 ldap: Fix substring filter parsing and rendering
The initial (prefix) and final (suffix) strings are specified individually
with a variable number of "any" matches that can occur between these.
The previous implementation assumed a single string and rendered it
as *<string>*.

Reported and PCAP provided by @martinvanhensbergen, thanks!

Closes zeek/spicy-ldap#27
2024-01-05 16:06:23 +01:00
Benjamin Bannier
d7db52dff6 Integrate spicy-ldap test suite 2023-10-10 09:21:57 +02:00