Module ldap 

LDAPv3 server with hand-written ASN.1 BER coding.

No LDAP crate is used, so this module decodes attacker-controlled BER by hand — the highest-risk parsing in the file-service protocol group. The invariant every decoder here keeps: no index or range is used before it has been checked against the remaining buffer. read_ber_element is the single entry point, and it validates that an element’s claimed length actually fits before handing back a value slice; nothing else slices raw input. Recursion (search filters) is depth-limited, and message size is capped.

There is no directory. A bind is granted by the model, a search returns entries the model names, and add/modify/delete are acknowledged without anything changing here, because there is nothing here to change. Whether a following search agrees with an earlier add is the model’s memory to keep.

Not implemented: SASL (the mechanism is reported so it can be refused), StartTLS, LDAPS, referrals, controls, extended operations, compare, modifyDN, and abandon. Search scope, filter and requested-attribute list are decoded and handed to the model as text, but never evaluated here.

Modules

actions

LDAP protocol actions implementation.

Structs

LdapServer

LDAP server that handles directory operations with LLM

SearchRequestFields

What a SearchRequest tells the model: the fields of ldap_search’s event data.

Constants

MAX_FILTER_DEPTH

Maximum search-filter nesting rendered. Filters are recursive and client-supplied, so an unbounded renderer would overflow the stack on a deliberately deep filter.

MAX_LDAP_MESSAGE

Largest LDAP message accepted, in bytes. A long-form length header can promise up to 4 GiB.

Functions

decode_ldap_message

Split an LDAPMessage into (messageID, protocolOp tag, protocolOp content).

ldap_message_len

Length of the complete LDAPMessage at the front of buffer, if it has all arrived.

parse_search_request

Decode a SearchRequest’s content octets.