spicy-redis: Abort parsing if server data comes first

Redis seems to only want client data first to request server data. The
DPD signature seems to pick up on some cases where server data comes
first, but is otherwise "valid" RESP. See if this helps lower FP rates.
This commit is contained in:
Evan Typanski 2025-01-29 09:52:56 -05:00
parent 90d56ce630
commit aef9fe11dc
4 changed files with 31 additions and 3 deletions

View file

@ -0,0 +1,14 @@
# @TEST-DOC: Test that Redis does not parse if it starts with the server data
#
# @TEST-EXEC: zeek -Cr $TRACES/redis/start-with-server.pcap base/protocols/redis %INPUT >output
# @TEST-EXEC: btest-diff output
event Redis::command(c: connection, is_orig: bool, command: Redis::Command)
{
print "BAD", command;
}
event Redis::server_data(c: connection, is_orig: bool, dat: Redis::ServerData)
{
print "BAD", dat;
}