From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 5 Feb 2021 14:15:27 +0000 (+0100)
Subject: template: use response_gap in rust parser
X-Git-Tag: suricata-7.0.0-beta1~1822
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=32b604e8c720fc30398e7bf255fc75cfe22825dd;p=thirdparty%2Fsuricata.git

template: use response_gap in rust parser
---

diff --git a/rust/src/applayertemplate/template.rs b/rust/src/applayertemplate/template.rs
index 99d9343eb9..feabfc6568 100644
--- a/rust/src/applayertemplate/template.rs
+++ b/rust/src/applayertemplate/template.rs
@@ -177,6 +177,17 @@ impl TemplateState {
             return AppLayerResult::ok();
         }
 
+        if self.response_gap {
+            if probe(input).is_err() {
+                // The parser now needs to decide what to do as we are not in sync.
+                // For this template, we'll just try again next time.
+                return AppLayerResult::ok();
+            }
+
+            // It looks like we're in sync with a message header, clear gap
+            // state and keep parsing.
+            self.response_gap = false;
+        }
         let mut start = input;
         while start.len() > 0 {
             match parser::parse_message(start) {