mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
31122f335f
Mostly staring at the PCAPs and opened a few RFCs. For now, only if the MS_KRB5 OID is used and accepted in a bind response, start stripping KRB5 wrap tokens for both, client and server traffic. Would probably be nice to forward the GSS-API data to the analyzer... Closes zeek/spicy-ldap#29.
11 lines
546 B
Text
11 lines
546 B
Text
# Copyright (c) 2024 by the Zeek Project. See LICENSE for details.
|
|
|
|
# @TEST-REQUIRES: have-spicy
|
|
# @TEST-EXEC: zeek -C -r ${TRACES}/ldap/missing_krbtgt_ldap_request.pcapng %INPUT
|
|
# @TEST-EXEC: cat conn.log | zeek-cut -Cn local_orig local_resp > conn.log2 && mv conn.log2 conn.log
|
|
# @TEST-EXEC: btest-diff conn.log
|
|
# @TEST-EXEC: btest-diff ldap.log
|
|
# @TEST-EXEC: btest-diff ldap_search.log
|
|
# @TEST-EXEC: ! test -f dpd.log
|
|
#
|
|
# @TEST-DOC: Test LDAP analyzer with GSS-API integrity traffic where we can still peak into LDAP wrapped into WRAP tokens.
|