app-layer: "close" all txs if protocol reaches error state
Currently, in case there was a mis-detection of protocol or something led to incomplete data error in a protocol parser, the cleanup is not done properly.
Victor says "we should have logic that "closes" all txs (marks them as done), or handle this in the lower layers"
This came up when DCE/RPC over UDP packet was misdetected as Wireguard protocol and took too much of processing power.
- Subject changed from Logic that "closes" all txs to app-layer: "close" all txs if protocol reaches error state
- Assignee changed from Victor Julien to Philippe Antoine
- Status changed from Assigned to In Review
When an error is returned by an app-layer parser over UDP, nothing happens (the return value of
AppLayerHandleUdp is ignored)
There is no equivalent of
Should we do something ?
- Priority changed from Normal to Low
- Effort set to high
- Difficulty set to high
- Target version changed from 7.0rc1 to TBD
- Status changed from In Review to Assigned
Also available in: Atom