LDAP Analyzer
Note
Zeek 6.1 and later versions include the LDAP analyzer. You no longer need this package when using those Zeek versions.
Here's what it has:
- ASN.1 structure decoding: this is probably generally useful for more than just the LDAP parser, so it may be of interest for this to be included somehow as part of spicy's standard modules or whatever
- everything is working except for the "constructed" forms of
ASN1BitStringandASN1OctetString
- everything is working except for the "constructed" forms of
- LDAP: the LDAP parsing is basically "done once" through a single call to
ASN1Message(which parses itself recursively) and then the application-level data is also parsed via&parse-froma byte array belonging to the outer ASN.1 sequence. This second level of parsing is also done using the ASN.1 data types.- events
ldap::message- called for each LDAP messageldap::bindreq- when a bind request is madeldap::searchreq- basic search request informationldap::searchres- called each time a search result is returned
- enums
ProtocolOpcodeResultCodeBindAuthTypeSearchScopeSearchDerefAliasFilterType
- Zeek log files
ldap.log- contains information about all LDAP messages except those that are search-related. Log lines are grouped by connection ID + message IDts(time)uid(connection UID)id(connection ID 4-tuple)proto(transport protocol)message_id(LDAP message ID)version(LDAP version for bind requests)opcode(set of 1..n operations from this uid+message_id)result(set of 1..n results from this uid+message_id)diagnostic_message(vector of 0..n diagnostic message strings)object(vector of 0..n "objects," the meaning of which depends on the operation)argument(vector of 0..n "argument," the meaning of which depends on the operation)
ldap_search.log- contains information about LDAP searches. Log lines are grouped by connection ID + message IDts(time)uid(connection UID)id(connection ID 4-tuple)proto(transport protocol)message_id(LDAP message ID)scope(set of 1..n search scopes defined in this uid+message_id)deref(set of 1..n search deref alias options defined in this uid+message_id)base_object(vector of 0..n search base objects specified)result_count(number of result entries returned)result(set of 1..n results from this uid+message_id)diagnostic_message(vector of 0..n diagnostic message strings)filter(search filter string)attributes(vector of 0..n "attributes", the attributes that were returned)
- test
- basic tests for detecting plugin presence and simple bind and search result/requests
- events
Here's what it doesn't have, which could be added by future parties interested in expanding it:
- LDAP referrals are not parsed out of the results
- SASL credentials in bind requests are not being parsed beyond the mechanism string
- SASL information in bind responses are not being parsed; for that matter, SASL-based LDAP stuff hasn't been tested much and may have issues
- Search filters and attributes: the search filters, reconstructed from the query tree, is represented in string format. The AND and OR filters have a tree structure and are parsed with the
ParseNestedAndOrunit, whereas the NOT filter consist of one single nested SearchFilter and is parsed with aParseNestedNotunit. The remaining filter types can all be decoded to a string using theDecodedAttributeValueunit, which takes theFilterTypeas a parameter. TheFILTER_PRESENTconsists of a single octet string and can be parsed directly. By recursively constructing leafs and nodes in the tree, the final search filter can be represented, e.g.(&(objectclass=*)(sAMAccountName=xxxxxxxx)). The returned attributes are represented in a list and returned to theldap_search.logifoption default_log_search_attributes = T;is set (the default is False). - the details of
SearchResultReferenceare not being parsed - the only detail of
ModifyRequestbeing parsed is the object name - the details of
AddRequestare not being parsed - the details of
ModDNRequestare not being parsed - the details of
CompareRequestare not being parsed - the details of
AbandonRequestare not being parsed - the details of
ExtendedRequestare not being parsed - the details of
ExtendedResponseare not being parsed - the details of
IntermediateResponseare not being parsed - Logging policy is available.
Useful Links: