[python-ldap] dirSync control, no Cookie

[William Brown]

> On 8 Oct 2022, at 02:30, Christopher Paul <chris.paul at rexconsulting.net> wrote:
> 
>> -----Original Message-----
>> From: William Brown <william at blackhats.net.au>
>> Sent: Tuesday, October 4, 2022 7:53 PM
>> To: Christopher Paul <chris.paul at rexconsulting.net>
>> Cc: python-ldap at python.org
>> Subject: Re: [python-ldap] dirSync control, no Cookie
>> 
>> 
>> Anyway, it'd probably be best to see what you have code-wise (heck it could
>> even be a good submission I think content sync is already in python-ldap)
> 
> Hi William,
> 
> I don't mind sharing my experimental code. I have attached to this message. 
> I have been trying this using Redhat 8.4 with python 3.6.8 and python-ldap 3.3.1.
> 
> 

Hey mate, sorry about the delay. I've looked into this further today for you, and it looks like your definition to send the control was correct! 

The issue you are hitting is result4 gives a 6 tuple response:

+ rcode, resset, id, response_controls, _, _  = adldapconn.result4(msgid=ldap.RES_ANY, all=1, add_intermediates=1, add_extop=1, timeout=30)


But that alone isn't everything. I can see in my testing that the response controls aren't being decoded. I think in this case because while you are passing in a correctly encoded control to the server, there is no way for the library to decode the dirsync control.


The best example for you to "follow" to duplicate this (and quite honestly, would be a good PR to the python ldap project) would be to add "winsync.py" to https://github.com/python-ldap/python-ldap/tree/master/Lib/ldap/controls . You can model this on the "similar" syncrepl control source found here:

https://github.com/python-ldap/python-ldap/blob/master/Lib/ldap/syncrepl.py

Most notably, what you need is the https://github.com/python-ldap/python-ldap/blob/master/Lib/ldap/syncrepl.py#L70 with "encodeControlValue", and the reverse https://github.com/python-ldap/python-ldap/blob/master/Lib/ldap/syncrepl.py#L149 on the same type (since ad winsync uses the same OID in both directions. 


Once you have that, I think you'll find that the control will work "a bit nicer" :) 

Hope that helps! 



--
Sincerely,

William