From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 21 May 2025 12:48:15 +0000 (+0200)
Subject: snmp: probing parser returns unknown if not enough data
X-Git-Tag: suricata-7.0.11~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0e9d05b8e5c8d7b60e6bb93586aeeb46548b8435;p=thirdparty%2Fsuricata.git

snmp: probing parser returns unknown if not enough data

Ticket: 7019
(cherry picked from commit 54a3a18a9e0af5e08cbe012ee23d6225dd6ae9cd)
---

diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index 1ff5b3f54b..ede7cec844 100644
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -362,7 +362,7 @@ pub unsafe extern "C" fn rs_snmp_probing_parser(_flow: *const Flow,
     }
     let slice = build_slice!(input,input_len as usize);
     let alproto = ALPROTO_SNMP;
-    if slice.len() < 4 { return ALPROTO_FAILED; }
+    if slice.len() < 4 { return ALPROTO_UNKNOWN; }
     match parse_pdu_envelope_version(slice) {
         Ok((_,_))               => alproto,
         Err(Err::Incomplete(_)) => ALPROTO_UNKNOWN,