stream: add stream.rst_with_data event for RST with data

src/decode-events.c

@@ -814,6 +814,10 @@ const struct DecodeEvents_ DEvents[] = {
             "stream.rst_invalid_ack",
             STREAM_RST_INVALID_ACK,
     },
+    {
+            "stream.rst_with_data",
+            STREAM_RST_WITH_DATA,
+    },
     {
             "stream.pkt_retransmission",
             STREAM_PKT_RETRANSMISSION,

src/decode-events.h

@@ -280,6 +280,7 @@ enum {
     STREAM_PKT_INVALID_ACK,
     STREAM_PKT_BROKEN_ACK,
     STREAM_RST_INVALID_ACK,
+    STREAM_RST_WITH_DATA,
     STREAM_PKT_RETRANSMISSION,
     STREAM_PKT_SPURIOUS_RETRANSMISSION,
     STREAM_PKT_BAD_WINDOW_UPDATE,

src/stream-tcp.c

@@ -5865,6 +5865,21 @@ static int StreamTcpValidateRst(TcpSession *ssn, Packet *p)
         }
     }
 
+    /* RST with data, it's complicated:
+
+         4.2.2.12  RST Segment: RFC-793 Section 3.4
+
+            A TCP SHOULD allow a received RST segment to include data.
+
+            DISCUSSION
+                 It has been suggested that a RST segment could contain
+                 ASCII text that encoded and explained the cause of the
+                 RST.  No standard has yet been established for such
+                 data.
+    */
+    if (p->payload_len)
+        StreamTcpSetEvent(p, STREAM_RST_WITH_DATA);
+
     /* Set up the os_policy to be used in validating the RST packets based on
        target system */
     if (PKT_IS_TOSERVER(p)) {