ldap: return empty buffer in ldap_tx_get_responses_dn

Funciton ldap_tx_get_responses_dn returns empty buffer in case
the response doesn't contain the distinguished name field

Fixes: 73ae6e997f ("detect: add ldap.responses.dn")

doc/userguide/rules/ldap-keywords.rst

@@ -234,6 +234,12 @@ This keyword maps to the EVE fields:
    - ``ldap.responses[].compare_response.matched_dn``
    - ``ldap.responses[].extended_response.matched_dn``
 
+.. note::
+
+    If a response within the array does not contain the
+    distinguished name field, this field will be interpreted
+    as an empty buffer.
+
 Example
 ^^^^^^^
 

rust/src/ldap/detect.rs

@@ -371,7 +371,9 @@ unsafe extern "C" fn ldap_tx_get_responses_dn(
         ProtocolOp::ModDnResponse(resp) => resp.matched_dn.0.as_str(),
         ProtocolOp::CompareResponse(resp) => resp.matched_dn.0.as_str(),
         ProtocolOp::ExtendedResponse(resp) => resp.result.matched_dn.0.as_str(),
-        _ => return false,
+        _ => "",
+        // This ensures that the iteration continues,
+        // allowing other responses in the transaction to be processed correctly
     };
 
     *buffer = str_buffer.as_ptr();