pgsql: add unknonwn frontend message type

We had unkonwn message type for the backend, but not the frontend
messages. It's important to better identify those to improve pgsql
probing functions.

Related to
Bug #6080
pull/9978/head
Juliana Fajardini 2 years ago committed by Victor Julien
parent c1bf955326
commit 1ac5d97259

@ -102,6 +102,13 @@ fn log_request(req: &PgsqlFEMessage, flags: u32) -> Result<JsonBuilder, JsonErro
}) => {
js.set_string("message", req.to_str())?;
}
PgsqlFEMessage::UnknownMessageType(RegularPacket {
identifier: _,
length: _,
payload: _,
}) => {
// We don't want to log these, for now. Cf redmine: #6576
}
}
js.close()?;
Ok(js)

@ -320,6 +320,7 @@ pub enum PgsqlFEMessage {
SASLResponse(RegularPacket),
SimpleQuery(RegularPacket),
Terminate(TerminationMessage),
UnknownMessageType(RegularPacket),
}
impl PgsqlFEMessage {
@ -332,6 +333,7 @@ impl PgsqlFEMessage {
PgsqlFEMessage::SASLResponse(_) => "sasl_response",
PgsqlFEMessage::SimpleQuery(_) => "simple_query",
PgsqlFEMessage::Terminate(_) => "termination_message",
PgsqlFEMessage::UnknownMessageType(_) => "unknown_message_type",
}
}
}
@ -673,7 +675,17 @@ pub fn parse_request(i: &[u8]) -> IResult<&[u8], PgsqlFEMessage> {
b'\0' => pgsql_parse_startup_packet(i)?,
b'Q' => parse_simple_query(i)?,
b'X' => parse_terminate_message(i)?,
_ => return Err(Err::Error(make_error(i, ErrorKind::Switch))),
_ => {
let (i, identifier) = be_u8(i)?;
let (i, length) = verify(be_u32, |&x| x > PGSQL_LENGTH_FIELD)(i)?;
let (i, payload) = take(length - PGSQL_LENGTH_FIELD)(i)?;
let unknown = PgsqlFEMessage::UnknownMessageType (RegularPacket{
identifier,
length,
payload: payload.to_vec(),
});
(i, unknown)
}
};
Ok((i, message))
}

@ -284,6 +284,11 @@ impl PgsqlState {
SCLogDebug!("Match: Terminate message");
Some(PgsqlStateProgress::ConnectionTerminated)
}
PgsqlFEMessage::UnknownMessageType(_) => {
SCLogDebug!("Match: Unknown message type");
// Not changing state when we don't know the message
None
}
}
}

Loading…
Cancel
Save