Commit graph

12 commits

Author SHA1 Message Date
Arne Welzel
fb31ad0c6e ldap: Add spicy-events.zeek 2023-10-19 10:48:34 +02:00
Arne Welzel
72df1a0216 Merge remote-tracking branch 'origin/topic/bbannier/issue-3234'
* origin/topic/bbannier/issue-3234:
  Introduce dedicated `LDAP::Info`
  Remove redundant storing of protocol in LDAP logs
  Use LDAP `RemovalHook` instead of implementing `connection_state_remove`
  Tidy up LDAP code by using local references
  Pluralize container names in LDAP types
  Move LDAP script constants to their own file
  Name `LDAP::Message` and `LDAP::Search` `*Info`
  Make ports for LDAP analyzers fully configurable
  Require have-spicy for tests which log spicy-ldap information
  Fix LDAP analyzer setup for when Spicy analyzers are disabled
  Bump zeek-testing-private
  Integrate spicy-ldap test suite
  Move spicy-ldap into Zeek protocol analyzer tree
  Explicitly use all of spicy-ldap's modules
  Explicitly list `asn1.spicy` as spicy-ldap source
  Remove uses of `zeek` module in spicy-ldap
  Fix typos in spicy-ldap
  Remove project configuration files in spicy-ldap
  Integrate spicy-ldap into build
  Import zeek/spicy-ldap@57b5eff988
2023-10-10 20:07:03 +02:00
Benjamin Bannier
346d2c49a9 Introduce dedicated LDAP::Info 2023-10-10 18:49:25 +02:00
Benjamin Bannier
301d8722bf Remove redundant storing of protocol in LDAP logs 2023-10-10 18:49:25 +02:00
Benjamin Bannier
82b3a4048f Use LDAP RemovalHook instead of implementing connection_state_remove 2023-10-10 18:49:25 +02:00
Benjamin Bannier
1d4412a9e7 Tidy up LDAP code by using local references 2023-10-10 18:49:25 +02:00
Benjamin Bannier
3a60a60619 Pluralize container names in LDAP types 2023-10-10 18:49:25 +02:00
Benjamin Bannier
0c126f3c6b Move LDAP script constants to their own file 2023-10-10 18:28:13 +02:00
Benjamin Bannier
c43bc52e18 Name LDAP::Message and LDAP::Search *Info 2023-10-10 18:28:13 +02:00
Benjamin Bannier
9b02b93889 Make ports for LDAP analyzers fully configurable
This moves the ports the LDAP analyzers should be triggered on from the
EVT file to the Zeek module. This gives users full control over which
ports the analyzers are registered for while previously they could only
register them for additional ports (there is no Zeek script equivalent
of `Manager::UnregisterAnalyzerForPort`).

The analyzers could still be triggered via DPD, but this is intentional.
To fully disable analyzers users can use e.g.,

```zeek
event zeek_init()
    {
    Analyzer::disable_analyzer(Analyzer::ANALYZER_LDAP_TCP);
    }
```
2023-10-10 18:28:13 +02:00
Benjamin Bannier
53d4052d68 Fix LDAP analyzer setup for when Spicy analyzers are disabled 2023-10-10 09:21:57 +02:00
Benjamin Bannier
f172febbcb Move spicy-ldap into Zeek protocol analyzer tree 2023-10-10 09:21:57 +02:00