Task #9022
Updated by Jason Ish 10 days ago
We have a number of cases where app-layer events are lost, as there is no transaction to attach them to. Or the app-layer event is attached to an existing transaction but might not be related to it. The better pattern is likely to create a *carrier* transaction solely for the application layer if there is not an associated transaction for the PDU.
The following table was generated by an AI review looking for this pattern, but will need further review.
Reviewed @main@ at commit @928ac01215@. Excluding DNP3, 13 app-layer names across 11 implementations are affected.
|_. App layer(s) |_. Evidence |_. Result |
| DNS, mDNS, LLMNR | @rust/src/dns/dns.rs:602@ returns when the transaction list is empty. Parse failures occur before transaction creation at lines 630–638 and 696. | Event is lost without a transaction, or attached to the previous transaction. |
| HTTP/2 | @rust/src/http2/http2.rs:799@ returns when no transaction exists. Several frame errors are raised before @find_or_create_tx@, including @LongFrameData@, @InvalidFrameHeader@, and @InvalidClientMagic@. | Event is lost or attached to an unrelated previous stream transaction. |
| IKEv1 | Events are sent through the state helper at @rust/src/ike/ikev1.rs:138@ and line 151, while the new transaction is not inserted until line 167. | The first event is lost; later events can be attached to the previous transaction. |
| Kerberos/KRB5 | Malformed-message events at @rust/src/krb/krb5.rs:257@ and line 262 use a helper that does nothing without a last transaction. | Event is lost or attached to the previous transaction. |
| LDAP | @rust/src/ldap/ldap.rs:182@ requires an existing transaction. Invalid and incomplete messages can raise events before allocation at lines 265, 376, 410–414, and 484–488. | Event is lost or attached to the previous transaction. |
| NFS | @rust/src/nfs/nfs.rs:507@ returns when the transaction list is empty. RPC and NFS decoding errors can occur before transaction insertion, including lines 1547–1878. | Event is lost or attached to a previous RPC transaction. |
| NTP | Parse errors at @rust/src/ntp/ntp.rs:126@ and line 131 use a helper at line 161 that requires a transaction. | Event is lost or attached to the previous transaction. |
| SIP | @rust/src/sip/sip.rs:119@ requires an existing transaction. Invalid request and response events occur before allocation at lines 151, 210, 244, and 303. | Event is lost or attached to the previous transaction. |
| SMB | @rust/src/smb/events.rs:71@ explicitly returns when the transaction list is empty. Top-level malformed-record paths in @rust/src/smb/smb.rs@ raise events before a transaction exists. | Transaction event is lost or attached to a previous transaction. Some paths also retain a frame event. |
| SNMP | A malformed-message event at @rust/src/snmp/snmp.rs:228@ uses a helper at line 261 that requires a last transaction. | Event is lost or attached to the previous transaction. |
| SMTP | @SMTPSetEvent@ at @src/app-layer-smtp.c:544@ only updates @curr_tx@. Invalid or truncated replies can occur before a client command creates a transaction. | Event is lost when no current transaction exists. |