From: Sascha Steinbiss <satta@debian.org>
Date: Thu, 29 Jun 2023 22:20:12 +0000 (+0200)
Subject: rfb: ensure logging of incompletely parsed txs
X-Git-Tag: suricata-6.0.14~61
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b1d2d786225a047977087396a1ef10eefa834afd;p=thirdparty%2Fsuricata.git

rfb: ensure logging of incompletely parsed txs

(cherry picked from commit 1606aca881c5ba1c2cccbbe0de78530d47a4d8a1)
---

diff --git a/rust/src/rfb/rfb.rs b/rust/src/rfb/rfb.rs
index 1ad79370dc..926ea13614 100644
--- a/rust/src/rfb/rfb.rs
+++ b/rust/src/rfb/rfb.rs
@@ -261,6 +261,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // We failed to parse the security type.
                             // Continue the flow but stop trying to map the protocol.
@@ -292,6 +293,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -322,6 +324,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // We failed to parse the client init.
                             // Continue the flow but stop trying to map the protocol.
@@ -346,6 +349,7 @@ impl RFBState {
                     SCLogDebug!("Invalid state for request: {}", self.state);
                     if let Some(current_transaction) = self.get_current_tx() {
                         current_transaction.set_event(RFBEvent::ConfusedState);
+                        current_transaction.complete = true;
                     }
                     self.state = parser::RFBGlobalState::Skip;
                     return AppLayerResult::ok();
@@ -437,6 +441,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -461,6 +466,7 @@ impl RFBState {
                                     if let Some(current_transaction) = self.get_current_tx() {
                                         current_transaction
                                             .set_event(RFBEvent::UnimplementedSecurityType);
+                                        current_transaction.complete = true;
                                     } else {
                                         debug_validate_fail!(
                                             "no transaction set at security type stage"
@@ -492,6 +498,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -522,6 +529,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -550,6 +558,7 @@ impl RFBState {
                             } else {
                                 if let Some(current_transaction) = self.get_current_tx() {
                                     current_transaction.set_event(RFBEvent::UnknownSecurityResult);
+                                    current_transaction.complete = true;
                                 }
                                 // Continue the flow but stop trying to map the protocol.
                                 self.state = parser::RFBGlobalState::Skip;
@@ -565,6 +574,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -591,6 +601,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -623,6 +634,7 @@ impl RFBState {
                         Err(_) => {
                             if let Some(current_transaction) = self.get_current_tx() {
                                 current_transaction.set_event(RFBEvent::MalformedMessage);
+                                current_transaction.complete = true;
                             }
                             // Continue the flow but stop trying to map the protocol.
                             self.state = parser::RFBGlobalState::Skip;
@@ -646,6 +658,7 @@ impl RFBState {
                     SCLogDebug!("Invalid state for response: {}", self.state);
                     if let Some(current_transaction) = self.get_current_tx() {
                         current_transaction.set_event(RFBEvent::ConfusedState);
+                        current_transaction.complete = true;
                     }
                     self.state = parser::RFBGlobalState::Skip;
                     return AppLayerResult::ok();