]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
modbus: abort flow parsing on flood
authorPhilippe Antoine <pantoine@oisf.net>
Thu, 25 Apr 2024 19:24:33 +0000 (21:24 +0200)
committerVictor Julien <vjulien@oisf.net>
Tue, 25 Jun 2024 09:34:17 +0000 (11:34 +0200)
Ticket: 6987

Let's not spend more resources for a flow which is trying to
make us do it...

rust/src/modbus/modbus.rs

index 18e98089b2519a9e37f00c9d962e12aeeddf2908..02e2bcfd035dabede24b3737c47d7aa3df19bf88 100644 (file)
@@ -189,7 +189,7 @@ impl ModbusState {
                                 None => {
                                     let mut tx = match self.new_tx() {
                                         Some(tx) => tx,
-                                        None => return AppLayerResult::ok(),
+                                        None => return AppLayerResult::err(),
                                     };
                                     tx.set_events_from_flags(&msg.error_flags);
                                     tx.request = Some(msg);
@@ -215,7 +215,7 @@ impl ModbusState {
                             None => {
                                 let mut tx = match self.new_tx() {
                                     Some(tx) => tx,
-                                    None => return AppLayerResult::ok(),
+                                    None => return AppLayerResult::err(),
                                 };
                                 if msg
                                     .access_type