From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 25 Apr 2024 19:24:33 +0000 (+0200)
Subject: modbus: abort flow parsing on flood
X-Git-Tag: suricata-7.0.6~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a753cdbe84caee3b66d0bf49b2712d29a50d67ae;p=thirdparty%2Fsuricata.git

modbus: abort flow parsing on flood

Ticket: 6987

Let's not spend more resources for a flow which is trying to
make us do it...

(cherry picked from commit 37509e8e0ed097f8e0174df754835ac60584fc72)
---

diff --git a/rust/src/modbus/modbus.rs b/rust/src/modbus/modbus.rs
index 0008d74893..b09c26b118 100644
--- a/rust/src/modbus/modbus.rs
+++ b/rust/src/modbus/modbus.rs
@@ -189,7 +189,7 @@ impl ModbusState {
                                 None => {
                                     let mut tx = match self.new_tx() {
                                         Some(tx) => tx,
-                                        None => return AppLayerResult::ok(),
+                                        None => return AppLayerResult::err(),
                                     };
                                     tx.set_events_from_flags(&msg.error_flags);
                                     tx.request = Some(msg);
@@ -215,7 +215,7 @@ impl ModbusState {
                             None => {
                                 let mut tx = match self.new_tx() {
                                     Some(tx) => tx,
-                                    None => return AppLayerResult::ok(),
+                                    None => return AppLayerResult::err(),
                                 };
                                 if msg
                                     .access_type