ldap: add port 3268 (used by Active Directory)

jasonish · Nov 26, 2024 · 3341907 · 3341907
1 parent c26cb9a
commit 3341907
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/rust/src/ldap/ldap.rs b/rust/src/ldap/ldap.rs
@@ -617,7 +617,7 @@ const PARSER_NAME: &[u8] = b"ldap\0";
 
 #[no_mangle]
 pub unsafe extern "C" fn SCRegisterLdapTcpParser() {
-    let default_port = CString::new("389").unwrap();
+    let default_port = CString::new("[389, 3268]").unwrap();
     let parser = RustParser {
         name: PARSER_NAME.as_ptr() as *const c_char,
         default_port: default_port.as_ptr(),
@@ -674,7 +674,7 @@ pub unsafe extern "C" fn SCRegisterLdapTcpParser() {
 
 #[no_mangle]
 pub unsafe extern "C" fn SCRegisterLdapUdpParser() {
-    let default_port = CString::new("389").unwrap();
+    let default_port = CString::new("[389, 3268]").unwrap();
     let parser = RustParser {
         name: PARSER_NAME.as_ptr() as *const c_char,
         default_port: default_port.as_ptr(),

diff --git a/suricata.yaml.in b/suricata.yaml.in
@@ -1188,11 +1188,11 @@ app-layer:
       tcp:
         enabled: yes
         detection-ports:
-          dp: 389
+          dp: 389, 3268
       udp:
         enabled: yes
         detection-ports:
-          dp: 389
+          dp: 389, 3268
       # Maximum number of live LDAP transactions per flow
       # max-tx: 1024