Suricata

Suricata 8.0.5 does not support the Microsoft Sicily LDAP authentication mechanism used by Active Directory.

The attached PCAP contains the following valid Sicily authentication sequence:

• sicilyPackageDiscovery [9]
• sicilyNegotiate [10]
• sicilyResponse [11]

The current ldap-parser implementation supports only Simple [0] and SASL [3] authentication choices. Sicily BindRequest messages are therefore not parsed, and Suricata stops creating subsequent LDAP transactions for the affected connections.

The response to sicilyNegotiate also uses a Microsoft-specific SicilyBindResponse:

resultCode
serverCreds
errorMessage

The serverCreds field contains binary authentication data. In the attached traffic, it contains an NTLM Type 2 challenge. The current parser attempts to interpret this field as the standard LDAP matchedDN, which causes a parser error.

Results with unmodified Suricata 8.0.5:

app_layer.tx.ldap_tcp           = 8
app_layer.error.ldap_tcp.parser = 2

The two connections using Sicily authentication contain only one transaction each. All subsequent LDAP requests on these connections are missed.

Results after the proof-of-concept fix:

app_layer.tx.ldap_tcp           = 56
app_layer.error.ldap_tcp.parser = 0

The complete Sicily authentication sequence and all subsequent LDAP requests are parsed successfully.

Required changes¶

• rusticata/ldap-parser/src/ldap.rs ** Add authentication variants for sicilyPackageDiscovery, sicilyNegotiate, and sicilyResponse.

• rusticata/ldap-parser/src/parser.rs ** Parse context-specific authentication tags [9], [10], and [11]. ** Parse SicilyBindResponse with binary serverCreds. ** Add tests for Sicily BindRequest and BindResponse messages.

• OISF/suricata-verify ** Add a regression test using the attached PCAP.

Attachments¶

• ldap_with_sicily_auth.pcap
• eve.json
• eve_after_fix.json
• stats.log
• stats_after_fix.log

eve.json and stats.log were generated with unmodified Suricata 8.0.5.

eve_after_fix.json and stats_after_fix.log were generated with the proof-of-concept parser fix.