Actions
Task #9022
open
JI
OD
tracking: app-layer events lost when no open transaction
Task #9022:
tracking: app-layer events lost when no open transaction
Description
We have a number of cases where app-layer events are lost, as there is no transaction to attach them to. Or the app-layer event is attached to an existing transaction but might not be related to it. The better pattern is likely to create a carrier transaction solely for the application layer if there is not an associated transaction for the PDU.
The following table was generated by an AI review looking for this pattern, but will need further review.
| App layer(s) | Evidence | Result |
|---|---|---|
| DNS, mDNS, LLMNR | rust/src/dns/dns.rs:602 returns when the transaction list is empty. Parse failures occur before transaction creation at lines 630–638 and 696. |
Event is lost without a transaction, or attached to the previous transaction. |
| HTTP/2 | rust/src/http2/http2.rs:799 returns when no transaction exists. Several frame errors are raised before find_or_create_tx, including LongFrameData, InvalidFrameHeader, and InvalidClientMagic. |
Event is lost or attached to an unrelated previous stream transaction. |
| IKEv1 | Events are sent through the state helper at rust/src/ike/ikev1.rs:138 and line 151, while the new transaction is not inserted until line 167. |
The first event is lost; later events can be attached to the previous transaction. |
| Kerberos/KRB5 | Malformed-message events at rust/src/krb/krb5.rs:257 and line 262 use a helper that does nothing without a last transaction. |
Event is lost or attached to the previous transaction. |
| LDAP | rust/src/ldap/ldap.rs:182 requires an existing transaction. Invalid and incomplete messages can raise events before allocation at lines 265, 376, 410–414, and 484–488. |
Event is lost or attached to the previous transaction. |
| NFS | rust/src/nfs/nfs.rs:507 returns when the transaction list is empty. RPC and NFS decoding errors can occur before transaction insertion, including lines 1547–1878. |
Event is lost or attached to a previous RPC transaction. |
| NTP | Parse errors at rust/src/ntp/ntp.rs:126 and line 131 use a helper at line 161 that requires a transaction. |
Event is lost or attached to the previous transaction. |
| SIP | rust/src/sip/sip.rs:119 requires an existing transaction. Invalid request and response events occur before allocation at lines 151, 210, 244, and 303. |
Event is lost or attached to the previous transaction. |
| SMB | rust/src/smb/events.rs:71 explicitly returns when the transaction list is empty. Top-level malformed-record paths in rust/src/smb/smb.rs raise events before a transaction exists. |
Transaction event is lost or attached to a previous transaction. Some paths also retain a frame event. |
| SNMP | A malformed-message event at rust/src/snmp/snmp.rs:228 uses a helper at line 261 that requires a last transaction. |
Event is lost or attached to the previous transaction. |
| SMTP | SMTPSetEvent at src/app-layer-smtp.c:544 only updates curr_tx. Invalid or truncated replies can occur before a client command creates a transaction. |
Event is lost when no current transaction exists. |
PA Updated by Philippe Antoine 2 days ago
- Status changed from New to Triaged
Actions