rdp: correctly returns incomplete in parse_tc

Adding the already consumed bytes
In case an incomplete tls handshake is handled with/after
a refular rdp t123_tpkt

(cherry picked from commit 6da9a37285a50b513077e5c88094f8112740ffcb)

diff --git a/rust/src/rdp/rdp.rs b/rust/src/rdp/rdp.rs
index fac136b6e3e51169ec7f590243113bc1ee315915..89e08db4aedefa3b2dabe200abb525d0005251bf 100644 (file)
--- a/rust/src/rdp/rdp.rs
+++ b/rust/src/rdp/rdp.rs
@@ -360,7 +360,14 @@ impl RdpState {
                     Err(nom::Err::Failure(_)) | Err(nom::Err::Error(_)) => {
                         if probe_tls_handshake(available) {
                             self.tls_parsing = true;
-                            return self.parse_tc(available);
+                            let r = self.parse_tc(available);
+                            if r.status == 1 {
+                                //adds bytes already consumed to incomplete result
+                                let consumed = (input.len() - available.len()) as u32;
+                                return AppLayerResult::incomplete(r.consumed + consumed, r.needed);
+                            } else {
+                                return r;
+                            }
                         } else {
                             return AppLayerResult::err();
                         }