Krb5: make TCP probing function less strict, messages can be fragmented

diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs
index 63a9b9d0e065a5cdd5df3cccc80763e24e79dfdc..4d1a44f8cee7bd018ff004cd9d3485879a01b22c 100644 (file)
--- a/rust/src/krb/krb5.rs
+++ b/rust/src/krb/krb5.rs
@@ -443,7 +443,8 @@ pub extern "C" fn rs_krb5_probing_parser_tcp(_flow: *const Flow, input:*const li
     if slice.len() <= 14 { return unsafe{ALPROTO_FAILED}; }
     match be_u32(slice) {
         IResult::Done(rem, record_mark) => {
-            if record_mark != rem.len() as u32 { return unsafe{ALPROTO_FAILED}; }
+            // protocol implementations forbid very large requests
+            if record_mark > 16384 { return unsafe{ALPROTO_FAILED}; }
             return rs_krb5_probing_parser(_flow, rem.as_ptr(), rem.len() as u32);
         },
         IResult::Incomplete(_) => {