Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Log rfb skipped tx v2 #9114

Closed
wants to merge 2 commits into from
Closed

Log rfb skipped tx v2 #9114

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
db18690
rfb: ensure logging of incompletely parsed txs
satta Jun 29, 2023
87227ac
rfb: also set unimplemented auth types
satta Jun 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 22 additions & 8 deletions rust/src/rfb/rfb.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,15 @@ impl RFBState {
current = rem;

let chosen_security_type = request.security_type;

if let Some(current_transaction) = self.get_current_tx() {
current_transaction.ts_security_type_selection = Some(request);
current_transaction.chosen_security_type =
Some(chosen_security_type as u32);
} else {
debug_validate_fail!("no transaction set at security type stage");
}

match chosen_security_type {
2 => self.state = parser::RFBGlobalState::TCVncChallenge,
1 => self.state = parser::RFBGlobalState::TSClientInit,
Expand All @@ -256,14 +265,6 @@ impl RFBState {
return AppLayerResult::ok();
}
}

if let Some(current_transaction) = self.get_current_tx() {
current_transaction.ts_security_type_selection = Some(request);
current_transaction.chosen_security_type =
Some(chosen_security_type as u32);
} else {
debug_validate_fail!("no transaction set at security type stage");
}
}
Err(Err::Incomplete(_)) => {
return AppLayerResult::incomplete(
Expand All @@ -274,6 +275,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// We failed to parse the security type.
// Continue the flow but stop trying to map the protocol.
Expand Down Expand Up @@ -312,6 +314,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand Down Expand Up @@ -348,6 +351,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// We failed to parse the client init.
// Continue the flow but stop trying to map the protocol.
Expand All @@ -371,6 +375,7 @@ impl RFBState {
SCLogDebug!("Invalid state for request: {}", self.state);
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::ConfusedState);
current_transaction.complete = true;
}
self.state = parser::RFBGlobalState::Skip;
return AppLayerResult::ok();
Expand Down Expand Up @@ -479,6 +484,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand Down Expand Up @@ -511,6 +517,7 @@ impl RFBState {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction
.set_event(RFBEvent::UnimplementedSecurityType);
current_transaction.complete = true;
} else {
debug_validate_fail!(
"no transaction set at security type stage"
Expand Down Expand Up @@ -542,6 +549,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand Down Expand Up @@ -579,6 +587,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand Down Expand Up @@ -614,6 +623,7 @@ impl RFBState {
} else {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::UnknownSecurityResult);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand All @@ -629,6 +639,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand All @@ -655,6 +666,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand Down Expand Up @@ -695,6 +707,7 @@ impl RFBState {
Err(_) => {
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::MalformedMessage);
current_transaction.complete = true;
}
// Continue the flow but stop trying to map the protocol.
self.state = parser::RFBGlobalState::Skip;
Expand All @@ -718,6 +731,7 @@ impl RFBState {
SCLogDebug!("Invalid state for response: {}", self.state);
if let Some(current_transaction) = self.get_current_tx() {
current_transaction.set_event(RFBEvent::ConfusedState);
current_transaction.complete = true;
}
self.state = parser::RFBGlobalState::Skip;
return AppLayerResult::ok();
Expand Down