From a753cdbe84caee3b66d0bf49b2712d29a50d67ae Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 25 Apr 2024 21:24:33 +0200 Subject: [PATCH] modbus: abort flow parsing on flood Ticket: 6987 Let's not spend more resources for a flow which is trying to make us do it... (cherry picked from commit 37509e8e0ed097f8e0174df754835ac60584fc72) --- rust/src/modbus/modbus.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/src/modbus/modbus.rs b/rust/src/modbus/modbus.rs index 0008d74893..b09c26b118 100644 --- a/rust/src/modbus/modbus.rs +++ b/rust/src/modbus/modbus.rs @@ -189,7 +189,7 @@ impl ModbusState { None => { let mut tx = match self.new_tx() { Some(tx) => tx, - None => return AppLayerResult::ok(), + None => return AppLayerResult::err(), }; tx.set_events_from_flags(&msg.error_flags); tx.request = Some(msg); @@ -215,7 +215,7 @@ impl ModbusState { None => { let mut tx = match self.new_tx() { Some(tx) => tx, - None => return AppLayerResult::ok(), + None => return AppLayerResult::err(), }; if msg .access_type -- 2.47.2