main.zeek

LDAP

Namespace:: LDAP
Imports:: base/frameworks/reporter, base/protocols/conn/removal-hooks.zeek, base/protocols/ldap/consts.zeek

Summary

Runtime Options

`LDAP::default_capture_password`: `bool` `&redef`	Whether clear text passwords are captured or not.
`LDAP::default_log_search_attributes`: `bool` `&redef`	Whether to log LDAP search attributes or not.
`LDAP::max_asn1_aggregate_elements`: `count` `&redef`	Maximum total ASN.1 aggregate child values retained while parsing one LDAP message.

Redefinable Options

`LDAP::max_pending_messages`: `count` `&redef`	The maximum number of outstanding LDAP requests to allow for a single connection.
`LDAP::max_pending_searches`: `count` `&redef`	The maximum number of outstanding LDAP search requests to allow for a single connection.
`LDAP::ports_tcp`: `set` `&redef`	TCP ports which should be considered for analysis.
`LDAP::ports_udp`: `set` `&redef`	UDP ports which should be considered for analysis.

Types

`LDAP::MessageInfo`: `record`
`LDAP::SearchInfo`: `record`
`LDAP::State`: `record`

Redefinitions

`Log::ID`: `enum`	`LDAP::LDAP_LOG` `LDAP::LDAP_SEARCH_LOG`
`connection`: `record`	New Fields: `connection` ldap: `LDAP::State` `&optional`

Events

`LDAP::log_ldap`: `event`
`LDAP::log_ldap_search`: `event`

Hooks

`LDAP::finalize_ldap`: `Conn::RemovalHook`	LDAP finalization hook.
`LDAP::log_policy`: `Log::PolicyHook`	Default logging policy hook for LDAP_LOG.
`LDAP::log_policy_search`: `Log::PolicyHook`	Default logging policy hook for LDAP_SEARCH_LOG.

Detailed Interface

Runtime Options

LDAP::default_capture_password 

Type:: bool
Attributes:: &redef
Default:: F

Whether clear text passwords are captured or not.

LDAP::default_log_search_attributes 

Type:: bool
Attributes:: &redef
Default:: F

Whether to log LDAP search attributes or not.

LDAP::max_asn1_aggregate_elements 

Type:: count
Attributes:: &redef
Default:: 20000

Maximum total ASN.1 aggregate child values retained while parsing one LDAP message. A value of zero disables the limit.

Redefinable Options

LDAP::max_pending_messages 

Type:: count
Attributes:: &redef
Default:: 10

The maximum number of outstanding LDAP requests to allow for a single connection. Once reached, all pending requests will be logged and a LDAP_max_pending_messages_exceeded weird raised. Setting this variable to 0 disables the limit.

LDAP::max_pending_searches 

Type:: count
Attributes:: &redef
Default:: 10

The maximum number of outstanding LDAP search requests to allow for a single connection. Once reached, all pending search requests will be logged and a LDAP_max_pending_searches_exceeded weird raised. Setting this variable to 0 disables the limit.

LDAP::ports_tcp 

Type:

set [port]

Attributes:

&redef

Default: