]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
template: use response_gap in rust parser
authorPhilippe Antoine <contact@catenacyber.fr>
Fri, 5 Feb 2021 14:15:27 +0000 (15:15 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 12 Feb 2021 13:52:31 +0000 (14:52 +0100)
rust/src/applayertemplate/template.rs

index 99d9343eb951d31cfcfcbadc37b5073a284234dd..feabfc65686bf181533d6f70f9a0f2158da8d65b 100644 (file)
@@ -177,6 +177,17 @@ impl TemplateState {
             return AppLayerResult::ok();
         }
 
+        if self.response_gap {
+            if probe(input).is_err() {
+                // The parser now needs to decide what to do as we are not in sync.
+                // For this template, we'll just try again next time.
+                return AppLayerResult::ok();
+            }
+
+            // It looks like we're in sync with a message header, clear gap
+            // state and keep parsing.
+            self.response_gap = false;
+        }
         let mut start = input;
         while start.len() > 0 {
             match parser::parse_message(start) {