From: Sascha Steinbiss <satta@debian.org>
Date: Sun, 20 Oct 2024 09:27:51 +0000 (+0200)
Subject: mqtt: add reason code support for SUBACK
X-Git-Tag: suricata-8.0.0-beta1~746
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=377d4705e15aa54ae26176822b23eec0a98bbc59;p=thirdparty%2Fsuricata.git

mqtt: add reason code support for SUBACK

Ticket: #7323
---

diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs
index c7dedc7ee8..951652ecd8 100644
--- a/rust/src/mqtt/detect.rs
+++ b/rust/src/mqtt/detect.rs
@@ -243,16 +243,29 @@ fn mqtt_tx_get_reason_code(tx: &MQTTTransaction) -> Option<u8> {
     return None;
 }
 
-fn mqtt_tx_unsuback_has_reason_code(tx: &MQTTTransaction, code: &DetectUintData<u8>) -> c_int {
+fn mqtt_tx_suback_unsuback_has_reason_code(
+    tx: &MQTTTransaction, code: &DetectUintData<u8>,
+) -> c_int {
     for msg in tx.msg.iter() {
-        if let MQTTOperation::UNSUBACK(ref unsuback) = msg.op {
-            if let Some(ref reason_codes) = unsuback.reason_codes {
-                for rc in reason_codes.iter() {
+        match msg.op {
+            MQTTOperation::UNSUBACK(ref unsuback) => {
+                if let Some(ref reason_codes) = unsuback.reason_codes {
+                    for rc in reason_codes.iter() {
+                        if detect_match_uint(code, *rc) {
+                            return 1;
+                        }
+                    }
+                }
+            }
+            MQTTOperation::SUBACK(ref suback) => {
+                // in SUBACK these are stored as "QOS granted" historically
+                for rc in suback.qoss.iter() {
                     if detect_match_uint(code, *rc) {
                         return 1;
                     }
                 }
             }
+            _ => {}
         }
     }
     return 0;
@@ -476,7 +489,7 @@ unsafe extern "C" fn mqtt_reason_code_match(
             return 1;
         }
     }
-    return mqtt_tx_unsuback_has_reason_code(tx, ctx);
+    return mqtt_tx_suback_unsuback_has_reason_code(tx, ctx);
 }
 
 unsafe extern "C" fn mqtt_reason_code_free(_de: *mut c_void, ctx: *mut c_void) {