20260619 import lber

.github/workflows/rust_build.yml

@@ -28,6 +28,9 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - name: Setup sccache
         uses: mozilla-actions/sccache-action@v0.0.9
+      - name: Clippy check
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
       - name: "Build the workspace"
         run: cargo build --workspace
 

Cargo.toml

@@ -4,32 +4,31 @@ lto = "thin"
 
 [workspace]
 resolver = "2"
-members = ["proto", "client", "cli"]
+members = ["lber", "proto", "client", "cli"]
 
 
 [workspace.package]
-version = "0.7.1"
+version = "0.8.0"
 authors = ["William Brown <william@blackhats.net.au>"]
-rust-version = "1.74"
-edition = "2021"
+rust-version = "1.85"
+edition = "2024"
 license = "MPL-2.0"
 homepage = "https://github.com/kanidm/ldap3/"
 repository = "https://github.com/kanidm/ldap3/"
 keywords = ["ldap", "protocol", "authentication", "chaos"]
 
 [workspace.dependencies]
-ldap3_client = { path = "./client", version = "=0.7.1" }
-ldap3_proto = { path = "./proto", version = "=0.7.1" }
+ldap3_lber = { path = "./lber", version = "=0.8.0" }
+ldap3_client = { path = "./client", version = "=0.8.0" }
+ldap3_proto = { path = "./proto", version = "=0.8.0" }
 
 base64 = "0.22"
-bytes = "^1.1.0"
+bytes = "^1.10.1"
 clap = "^4.0"
 clap_complete = "^4.0"
 futures = "^0.3.21"
 futures-util = "^0.3.21"
-lber = "^0.4.0"
-# Must match lber
-nom = "7"
+nom = "7.1.3"
 peg = "0.8.1"
 ron = "^0.12.0"
 rpassword = "7.0.0"

cli/build.rs

@@ -4,7 +4,7 @@ use std::env;
 use std::path::PathBuf;
 
 use clap::CommandFactory;
-use clap_complete::{generate_to, Shell};
+use clap_complete::{Shell, generate_to};
 
 include!("src/ldap_opt.rs");
 include!("src/cldap_opt.rs");

cli/src/ldap.rs

@@ -17,7 +17,7 @@ use ldap3_client::*;
 use rustls::pki_types::pem::PemObject;
 use tracing::*;
 
-use base64::{engine::general_purpose, Engine as _};
+use base64::{Engine as _, engine::general_purpose};
 
 include!("./ldap_opt.rs");
 

cli/src/lib.rs

@@ -11,9 +11,9 @@
 // We allow expect since it forces good error messages at the least.
 #![allow(clippy::expect_used)]
 
+use tracing_subscriber::EnvFilter;
 use tracing_subscriber::filter::LevelFilter;
 use tracing_subscriber::prelude::*;
-use tracing_subscriber::EnvFilter;
 
 pub fn start_tracing(verbose: bool) {
     let fmt_layer = tracing_subscriber::fmt::layer().with_target(false);

client/src/lib.rs

@@ -10,11 +10,11 @@
 // We allow expect since it forces good error messages at the least.
 #![allow(clippy::expect_used)]
 
-use base64::{engine::general_purpose, Engine as _};
+use base64::{Engine as _, engine::general_purpose};
 use futures_util::sink::SinkExt;
 use futures_util::stream::StreamExt;
-use ldap3_proto::proto::*;
 use ldap3_proto::LdapCodec;
+use ldap3_proto::proto::*;
 use rustls_platform_verifier::ConfigVerifierExt;
 use serde::{Deserialize, Serialize};
 use std::borrow::Borrow;
@@ -26,12 +26,12 @@ use tokio::net::TcpStream;
 use tokio::time;
 
 use tokio_rustls::{
+    TlsConnector,
     client::TlsStream,
-    rustls::client::{danger::*, ClientConfig},
-    rustls::pki_types::{CertificateDer, ServerName, UnixTime},
     rustls::Error as RustlsError,
+    rustls::client::{ClientConfig, danger::*},
+    rustls::pki_types::{CertificateDer, ServerName, UnixTime},
     rustls::{DigitallySignedStruct, SignatureScheme},
-    TlsConnector,
 };
 
 use tokio_util::codec::{FramedRead, FramedWrite};
@@ -113,12 +113,23 @@ impl fmt::Display for LdapError {
             LdapError::TransportWriteError => {
                 write!(f, "An error occurred writing to the transport")
             }
-            LdapError::UnavailableCriticalExtension => write!(f, "An extension marked as critical was not available"),
+            LdapError::UnavailableCriticalExtension => {
+                write!(f, "An extension marked as critical was not available")
+            }
             LdapError::InvalidCredentials => write!(f, "Invalid DN or Password"),
             LdapError::InsufficentAccessRights => write!(f, "Insufficient Access"),
-            LdapError::UnwillingToPerform => write!(f, "Too many failures, server is unwilling to perform the operation."),
-            LdapError::EsyncRefreshRequired => write!(f, "An initial content sync is required. The current cookie should be considered invalid."),
-            LdapError::NotImplemented => write!(f, "An error occurred, but we haven't implemented code to handle this error yet.")
+            LdapError::UnwillingToPerform => write!(
+                f,
+                "Too many failures, server is unwilling to perform the operation."
+            ),
+            LdapError::EsyncRefreshRequired => write!(
+                f,
+                "An initial content sync is required. The current cookie should be considered invalid."
+            ),
+            LdapError::NotImplemented => write!(
+                f,
+                "An error occurred, but we haven't implemented code to handle this error yet."
+            ),
         }
     }
 }
@@ -445,13 +456,19 @@ impl<U: Borrow<Url>> LdapClientBuilder<U> {
             let (r, w) = tokio::io::split(tlsstream);
             (
                 LdapWriteTransport::Tls(FramedWrite::new(w, LdapCodec::default())),
-                LdapReadTransport::Tls(FramedRead::new(r, LdapCodec::new(Some(max_ber_size)))),
+                LdapReadTransport::Tls(FramedRead::new(
+                    r,
+                    LdapCodec::new(Some(max_ber_size), None),
+                )),
             )
         } else {
             let (r, w) = tokio::io::split(tcpstream);
             (
                 LdapWriteTransport::Plain(FramedWrite::new(w, LdapCodec::default())),
-                LdapReadTransport::Plain(FramedRead::new(r, LdapCodec::new(Some(max_ber_size)))),
+                LdapReadTransport::Plain(FramedRead::new(
+                    r,
+                    LdapCodec::new(Some(max_ber_size), None),
+                )),
             )
         };
 
@@ -595,7 +612,7 @@ impl ServerCertVerifier for YoloCertValidator {
 /// Doesn't test the actual *build* step because that requires a live LDAP server.
 #[test]
 fn test_ldapclient_builder() {
-    let url = Url::parse("ldap://ldap.example.com:389").unwrap();
+    let url = Url::parse("ldap://ldap.example.com:389").expect("failed to parse URL");
     let client = LdapClientBuilder::new(&url).max_ber_size(Some(1234567));
     assert_eq!(client.timeout, Duration::from_secs(30));
     let client = client.set_timeout(Duration::from_secs(60));

clippy.toml

@@ -0,0 +1,5 @@
+allow-expect-in-tests = true
+allow-unwrap-in-tests = false
+allow-panic-in-tests = true
+allow-dbg-in-tests = true
+allow-indexing-slicing-in-tests = true

lber/.gitignore

@@ -0,0 +1,2 @@
+target
+Cargo.lock

lber/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "ldap3_lber"
+description = "An ASN.1/BER parser/encoder based on nom"
+
+version.workspace = true
+authors.workspace = true
+rust-version.workspace = true
+edition.workspace = true
+homepage.workspace = true
+repository.workspace = true
+
+license = "MIT"
+categories = ["encoding", "parsing"]
+keywords = ["ASN1", "BER", "nom"]
+documentation = "https://docs.rs/ldap3_lber"
+
+[dependencies]
+bytes.workspace = true
+nom.workspace = true

lber/LICENSE

@@ -0,0 +1,24 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 William Brown <william@blackhats.net.au>
+Copyright (c) 2017 Gregor Reitzenstein <dean4devil@paranoidlabs.org>
+Copyright (c) 2017 Ivan Nejgebaure <inejge@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

lber/README.md

@@ -0,0 +1,12 @@
+# LBER - lightweight BER
+
+ASN.1/BER implementation based on nom.
+
+Forked from [lber](https://crates.io/crates/lber), not intended to be a generic ASN.1 solution.
+
+Future versions will probably use Serde to make encoding and (especially)
+decoding less of a chore.
+
+# License
+
+Licensed under the [MIT license](LICENSE).

lber/src/common.rs

@@ -0,0 +1,36 @@
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum TagStructure {
+    Primitive = 0,
+    Constructed = 1,
+}
+
+impl TagStructure {
+    pub fn from_u8(n: u8) -> Option<TagStructure> {
+        match n {
+            0 => Some(TagStructure::Primitive),
+            1 => Some(TagStructure::Constructed),
+            _ => None,
+        }
+    }
+}
+
+/// Possible classes for a tag.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum TagClass {
+    Universal = 0,
+    Application = 1,
+    Context = 2,
+    Private = 3,
+}
+
+impl TagClass {
+    pub fn from_u8(n: u8) -> Option<TagClass> {
+        match n {
+            0 => Some(TagClass::Universal),
+            1 => Some(TagClass::Application),
+            2 => Some(TagClass::Context),
+            3 => Some(TagClass::Private),
+            _ => None,
+        }
+    }
+}

lber/src/lib.rs

@@ -0,0 +1,12 @@
+extern crate bytes;
+extern crate nom;
+
+pub mod common;
+pub mod parse;
+pub mod structure;
+pub mod structures;
+pub mod universal;
+pub mod write;
+
+pub use nom::{Err, IResult};
+pub use parse::Parser;