spicy-redis: Abort parsing if server data comes first

Redis seems to only want client data first to request server data. The
DPD signature seems to pick up on some cases where server data comes
first, but is otherwise "valid" RESP. See if this helps lower FP rates.

src/analyzer/protocol/redis/resp.spicy

@@ -10,15 +10,29 @@ const MAX_SIZE = 1024 * 1024;
 const MAX_RECURSION_DEPTH = 20;
 
 public type ClientMessages = unit {
+    # The context here refers to whether we saw client data first. It is a one-time switch,
+    # either we have seen client data or not.
+    %context = bool;
+    on %init {
+        *self.context() = True;
+    }
     : ClientData[];
 };
 
 public type ServerMessages = unit {
+    %context = bool;
+    on %init {
+        if (!*self.context()) {
+            throw "Server responses must come after a client request is seen";
+        }
+    }
     : (ServerData &synchronize)[];
 };
 
 public type ClientData = unit {
-    on %init() { self.start = self.input(); }
+    on %init() {
+        self.start = self.input();
+    }
 
     # Clients can only be an array or inline
     ty: uint8 &convert=DataType($$) {
@@ -59,7 +73,6 @@ type BulkStringWithTy = unit {
     : skip RedisBytes;
 };
 
-
 public type ServerData = unit {
     %synchronize-after = b"\x0d\x0a";
     var depth: uint8& = new uint8;

testing/btest/Baseline/scripts.base.protocols.redis.start-with-server/output

@@ -0,0 +1 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.

testing/btest/scripts/base/protocols/redis/start-with-server.zeek

@@ -0,0 +1,14 @@
+# @TEST-DOC: Test that Redis does not parse if it starts with the server data
+#
+# @TEST-EXEC: zeek -Cr $TRACES/redis/start-with-server.pcap base/protocols/redis %INPUT >output
+# @TEST-EXEC: btest-diff output
+
+event Redis::command(c: connection, is_orig: bool, command: Redis::Command)
+	{
+	print "BAD", command;
+	}
+
+event Redis::server_data(c: connection, is_orig: bool, dat: Redis::ServerData)
+	{
+	print "BAD", dat;
+	}