Project

General

Profile

Actions
Copy link

Feature #7536

open
AD WL

detect/ldap: add keywords for LDAP BindRequest

Feature #7536: detect/ldap: add keywords for LDAP BindRequest

Added by Alice da Silva Akaki over 1 year ago. Updated 3 days ago.

Status:
In Review
Priority:
High
Assignee:
William Ling
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

ldap.bind_request.version, an integer between 1 and 127
ldap.bind_request.authentication, enum + an octet string

Eve fields to match:
ldap.request.bind_request.version

ldap.request.bind_request.sasl.mechanism
ldap.request.bind_request.sasl.credentials

Related issues 2 (2 open — 0 closed)

Related to Suricata - Feature #7470: detect/ldap: add ldap.bind.version keywordTriagedWilliam LingActions
Blocks Suricata - Task #7452: ldap: add keywords to match outputIn ProgressOISF DevActions

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #1

  • Blocks Task #7452: ldap: add keywords to match output added

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #2

ldap.bind_request.authentication is an enum + an octet string...

AD Updated by Alice da Silva Akaki over 1 year ago Actions
Copy link
 #3

  • Description updated (diff)

AD Updated by Alice da Silva Akaki over 1 year ago Actions
Copy link
 #4

  • Subject changed from detect: add keywords for BindRequest to detect/ldap: add keywords for LDAP BindRequest

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #5

  • Priority changed from Normal to High

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #6

Idea for ldap.request.bind.auth keyword : have it a sticky buffer but with required option, like ldap.request.bind.auth: sasl; content: "toto"; and the parser only accepts the 4 different auth mechanisms defined in ldap asn1

PA Updated by Philippe Antoine over 1 year ago Actions
Copy link
 #7

  • Related to Feature #7470: detect/ldap: add ldap.bind.version keyword added

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #8

  • Target version changed from 8.0.0 to 9.0.0-beta1

JF Updated by Juliana Fajardini Reichow 9 months ago Actions
Copy link
 #9

  • Assignee changed from Alice da Silva Akaki to OISF Dev

Hi there, considering our stale tickets policy, I'm unclaiming this ticket. Feel free to ask to work on this or another again, if you have time in the future :)

WL Updated by William Ling 18 days ago Actions
Copy link
 #10

  • Assignee changed from OISF Dev to William Ling

WL Updated by William Ling 18 days ago Actions
Copy link
 #11

Following discussion on Discord, the agreed approach is:

- `ldap.bind_request.authentication` — enum keyword accepting simple or sasl
- `ldap.bind_request.sasl.mechanism` — sticky buffer exposing the SASL mechanism
- `ldap.bind_request.sasl.credentials` — sticky buffer exposing the SASL credentials

We won't add a sticky buffer for simple-bind credentials, as the intended simple-bind use case is to detect usage of simple bind, rather than to inspect the simple-bind credential contents.

Actions
Copy link

Also available in: PDF Atom