Skip to content

detect/ldap: add BindRequest keywords - #16098

Closed
0x-0ddc0de wants to merge 1 commit into
OISF:mainfrom
0x-0ddc0de:ldap-bind-detect-7536
Closed

0x-0ddc0de wants to merge 1 commit into
OISF:mainfrom
0x-0ddc0de:ldap-bind-detect-7536

Conversation

@0x-0ddc0de

Copy link
Copy Markdown

Implements Redmine #7536.

Adds LDAP BindRequest detection support for:

  • ldap.bind_request.version
  • ldap.bind_request.authentication
  • ldap.bind_request.sasl.mechanism
  • ldap.bind_request.sasl.credentials

Also adds documentation for the new keywords.

The corresponding suricata-verify tests are in PR 3311

Redmine: https://redmine.openinfosecfoundation.org/issues/7536

SV_BRANCH=OISF/suricata-verify#3311

@codecov

codecov Bot commented Aug 25, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 89.05473% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.02%. Comparing base (acd9d3a) to head (615d192).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #16098      +/-   ##
==========================================
- Coverage   83.05%   83.02%   -0.03%     
==========================================
  Files        1004     1004              
  Lines      277359   277560     +201     
==========================================
+ Hits       230370   230458      +88     
- Misses      46989    47102     +113     
Flag Coverage Δ
fuzzcorpus 61.47% <30.84%> (-0.06%) ⬇️
livemode 18.42% <30.84%> (-0.18%) ⬇️
netns 22.85% <30.84%> (-0.06%) ⬇️
pcap 45.33% <30.84%> (-0.08%) ⬇️
suricata-verify 67.17% <89.05%> (+0.01%) ⬆️
unittests 58.50% <30.84%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@victorjulien victorjulien left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is looking pretty good. Ticket reference needs to go into the commit message as:

Ticket: #7536.

Can you rebase and add that?

@0x-0ddc0de

Copy link
Copy Markdown
Author

Implements Redmine #7536.

Done

@victorjulien

Copy link
Copy Markdown
Member

Replaced by #16183

@github-actions

github-actions Bot commented Sep 5, 2026

Copy link
Copy Markdown

Closing this pull request: its branch was updated after the pull
request was opened.

Per our workflow, a new pull request is required when changes are made
to an existing one. Please open a new pull request with the updated
changes.

If you wish to create an in progress pull request that you can push to,
please create a draft pull request.

Please see our GitHub Pull Request Workflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants