0

Need to send an LDAP search request with message ID set to 0 value (as part of RFC validation testing). Tried the following modified code from apache directory api examples section:

import java.io.IOException;
import org.apache.directory.api.ldap.model.entry.DefaultEntry;
import org.apache.directory.api.ldap.model.entry.ModificationOperation;
import org.apache.directory.api.ldap.model.exception.LdapException;
import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.ldap.client.api.LdapConnection;
import org.apache.directory.ldap.client.api.LdapNetworkConnection;
import org.apache.directory.api.ldap.model.message.SearchRequest;
import org.apache.directory.api.ldap.model.message.SearchRequestImpl;
import org.apache.directory.api.ldap.model.cursor.SearchCursor;
import org.apache.directory.api.ldap.model.exception.LdapNoPermissionException;
import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.api.ldap.model.exception.LdapInvalidDnException;

public class ManageLDAPConnection {

private static Dn getSafeSearchBaseDn(String dn) throws LdapInvalidDnException{
     Dn searchBaseDn = null;
     if (dn != null && !dn.isEmpty()){
         searchBaseDn = new Dn(dn);
    }else{
         searchBaseDn = Dn.ROOT_DSE;
    }
    return searchBaseDn;
 }

public static void main (String[] args) {

int messageId = 0;
int port = 389;
String username = "<Admin CN>";
String password = "<Password>";
String hostname = "<IP>";
SearchCursor searchResult = null;
String dn = "<DN>";
String filterExpr = "(objectclass=*)";

org.apache.directory.api.ldap.model.message.SearchScope searchScopeValue = org.apache.directory.api.ldap.model.message.SearchScope.OBJECT;

LdapConnection connection = new LdapNetworkConnection(hostname, port);

try {
    connection.bind(username, password);       
    System.out.println("Connected successfully");
} catch (LdapException e) {
    System.out.println("Unable to bind");
}

try {
    SearchRequest searchRequest = new SearchRequestImpl();
    System.out.println(searchRequest.getMessageId());
    searchRequest.setMessageId(0);
    System.out.println(searchRequest.getMessageId());
        searchRequest.setBase(getSafeSearchBaseDn(dn));
        searchRequest.setFilter(filterExpr);
        searchRequest.setScope(searchScopeValue);
    searchResult = connection.search(searchRequest);
} catch (LdapNoPermissionException e){
    System.out.println("No permission exception");
} catch (LdapException e){
    System.out.println("LDAP Exception: " + e.getMessage());
}
}
}

The above code is able to send the request, but the message ID is still sent as non zero, even though the following has been done:

searchRequest.setMessageId(0);
user3308983
  • 11
  • 6
  • Why? It's required to be non-zero by [RFC 4511](http://tools.ietf.org/html/rfc4511#section-4.1.1.1). Ten seconds in Google to discover that. – user207421 Apr 09 '14 at 05:19
  • Because I am doing RFC validation here :) – user3308983 Apr 09 '14 at 05:24
  • So you've found that it's invalid, and that the client library you're using knows that. You have an RFC validation success. – user207421 Apr 09 '14 at 05:28
  • Hi EJP, I want to test the response from server side for an LDAP bind request or search request with message ID of 0. The intention is to find whether the server considers the request as a "notice of disconnection" as mentioned in the RFC – user3308983 Apr 09 '14 at 05:33
  • Don't you think you should have stated all that in the question? I certainly do. – user207421 Apr 09 '14 at 05:39

2 Answers2

0

You're clearly going to have to use a different library, or modify this one, or go to a lower level. It isn't at all surprising that this library prevents you from shooting yourself in the foot.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • Modified the question :) . Is there a library that can be used to send such a request? – user3308983 Apr 09 '14 at 05:49
  • No idea. People speak highly of the UnboundID SDK, but I've never used it, and I'd be surprised if it allowed you to do this in any case. There is also a Netscape library, now hosted somewhere at Mozilla, and there are no doubt others again. Do you really have to test this for search requests? – user207421 Apr 09 '14 at 06:04
  • Thanks EJP. Will check unboundID sdk. I actually need to test for all requests. Started with a search request because there was some sort of code available in apache website :) – user3308983 Apr 09 '14 at 08:59
  • You might get a response from @TerryGardner now you've added the UnboundID tag. He seems to work there, or at least be a very power user of it. – user207421 Apr 10 '14 at 05:51
0

Had some solution in python's pyasn1-modules. The following seems to work well:

from pyasn1.type import univ, namedval, namedtype, tag
from pyasn1.codec.ber import encoder
                                                                                           import socket
from pyasn1_modules.rfc2251 import *

ldap_bind_request = BindRequest()
ldap_bind_request.setComponentByName('version', 3)
ldap_bind_request.setComponentByName('name', 'cn=admin,o=org')

ldap_auth = AuthenticationChoice()
ldap_auth.setComponentByName('simple', 'mypwd')

ldap_bind_request.setComponentByName('authentication', ldap_auth)

ldap_message = LDAPMessage()

ldap_message.setComponentByName('messageID', 0)
ldap_message.setComponentByName('protocolOp', ldap_bind_request)

print(ldap_bind_request.prettyPrint())

print(dir(ldap_bind_request))

encoded_request = encoder.encode(ldap_message)
print(encoded_request)

asock = socket.socket()

asock.connect(('127.0.0.1', 389))
asock.send(encoded_request)

There is something named JAVA ASN.1 Compiler (JAC). Trying to see if they provide something similar, with less of object oriented complexity which is common in java :)

user3308983
  • 11
  • 6