Project

General

Profile

Actions
Copy link

Feature #1199

closed

protocol: LDAP support

Added by Peter Manev over 10 years ago. Updated about 1 month ago.

Status:
Closed
Priority:
High
Assignee:
Giuseppe Longo
Target version:
8.0.0-beta1
Effort:
medium
Difficulty:
medium
Label:
Protocol

Description

Support for LDAP.
LDAP is widely used and present in many networks.

example - 

ldap://host:port/DN?attributes?scope?filter?extensions

As defined in - http://tools.ietf.org/html/rfc4516

Related issues 7 (7 open — 0 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4151: Research: New protocol supportNewCommunity TicketActions
Related to Suricata - Task #5488: Suricon 2022 brainstormAssignedVictor JulienActions
Related to Suricata - Task #5685: tracking: active directory protocols supportNewVictor JulienActions
Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Blocks Suricata - Task #7118: tracking: add support for new protocolsAssignedVictor JulienActions
Blocks Suricata - Story #7119: protocols: protocol additionsNewVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien over 10 years ago

  • Assignee set to Anonymous
  • Target version set to TBD

I think this would be a great feature for members of the community to either develop or fund.

Actions
Copy link
 #2

Updated by Jason Ish over 6 years ago

  • Effort set to medium
  • Difficulty set to medium
Actions
Copy link
 #3

Updated by Andreas Herz over 5 years ago

  • Assignee set to Community Ticket
Actions
Copy link
 #4

Updated by Victor Julien about 5 years ago

Implementation should be in Rust.

Actions
Copy link
 #5

Updated by Victor Julien almost 5 years ago

  • Label Protocol added
Actions
Copy link
 #6

Updated by Jason Ish about 4 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions
Copy link
 #7

Updated by Jason Ish about 4 years ago

Lots of interest at the 2020 Brainstorm.

Actions
Copy link
 #8

Updated by Pierre Chifflier about 4 years ago

Bringing back this 6-years ticket!

update:

I have a test implementation (currently standalone parser, not a suricata applayer) for LDAP version 3, that more or less works (I still need to work on reliability / testing every possible corner case). LDAP being based on BER, it is based on the same BER/DER decoder than kerberos and x509 parsers embedded in suricata. It currently uses nom 6 and recent versions of everything, so I would primarily target suricata 7.0 (unless there is a great interest for 6.x).

One difficulty though is that to be fully interesting, more protocols have to be decoded: LDAP can use SASL, and can embed GSS-API and/or GSS-SPNEGO layers (this is a common case for Windows networks, where you often encounter integrity-only transport of data).

Call for help: there are many variants of implementations, and I can't have them all here. If you have pcaps to share (especially of LDAP in Active Directory environments), please tell me!

Actions
Copy link
 #9

Updated by Victor Julien almost 4 years ago

  • Related to Task #4151: Research: New protocol support added
Actions
Copy link
 #10

Updated by Victor Julien almost 4 years ago

  • Status changed from New to In Progress
  • Assignee changed from Community Ticket to Pierre Chifflier
  • Target version changed from TBD to 7.0.0-beta1

Hi Pierre, did I understand correctly that you've made further progress on this?

Actions
Copy link
 #11

Updated by Pierre Chifflier almost 4 years ago

Hi Victor,
Yes, I have a working LDAP parser for suricata, based on the ldap-parser crate I published to crates.io.
It supports LDAPv3 protocol, as well as the cleartext variants of SASL and GSSAPI (for ex. integrity-only encapsulation).

Before submitting the PR, the code still needs some polishing. It currently parse the protocol and log metadata (LDAP operation, bind DN, password if cleartext, etc.), but do not have detect keywords (TBD).

Actions
Copy link
 #12

Updated by Victor Julien over 2 years ago

  • Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Actions
Copy link
 #13

Updated by Philippe Antoine about 2 years ago

  • Related to Task #5488: Suricon 2022 brainstorm added
Actions
Copy link
 #14

Updated by Philippe Antoine about 2 years ago

And Active Directory support ?..

Actions
Copy link
 #15

Updated by Philippe Antoine about 2 years ago

  • Priority changed from Normal to High
Actions
Copy link
 #16

Updated by Victor Julien about 2 years ago

  • Subject changed from LDAP support to protocol: LDAP
Actions
Copy link
 #17

Updated by Victor Julien about 2 years ago

  • Subject changed from protocol: LDAP to protocol: LDAP support
Actions
Copy link
 #18

Updated by Victor Julien about 2 years ago

  • Related to Task #5685: tracking: active directory protocols support added
Actions
Copy link
 #19

Updated by Peter Manev almost 2 years ago

Among other good reasons to have it - here is also a point for detection
https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/
(LDAP Host Discovery)

Actions
Copy link
 #20

Updated by Philippe Antoine about 1 year ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions
Copy link
 #21

Updated by Giuseppe Longo 12 months ago

I'd like to pick it up if nobody is currently working on it.

Actions
Copy link
 #22

Updated by Victor Julien 12 months ago

  • Assignee changed from Pierre Chifflier to Giuseppe Longo
Actions
Copy link
 #23

Updated by Victor Julien 7 months ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #24

Updated by Victor Julien 5 months ago

  • Blocks Task #7118: tracking: add support for new protocols added
Actions
Copy link
 #25

Updated by Victor Julien 5 months ago

  • Blocks Story #7119: protocols: protocol additions added
Actions
Copy link
 #26

Updated by Juliana Fajardini Reichow 4 months ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF