Mqtt frames v3

[hsadia538]

Ticket: https://redmine.openinfosecfoundation.org/issues/5731

Previous PR: #1065

Describe changes:

• Add tests for mqtt frames for truncated messages

Requires: OISF/suricata#8513

[jufajardini]

I have added a few comments. :)
Especially for the truncated test checks, I would like us to check on the frame length, too, so we can ensure things are being calculated as expected.
I am again wondering if we should have a special type for truncated frames, as, for instance, the length for the pdu frame in such case isn't the actual pdu length, just the max that suricata will process, as per MQTT standards.
So, having a truncated frame might let people know what to expect in such cases. Maybe in such circumstances, we could have a trunc_data frame instead of a data frame?

[jufajardini]

These are not needed :)

[jufajardini]

nit: we usually add a new line between each test.yaml session.

[jufajardini]

Let's add the min-version: 7 requirement here, since frame support, so far, is from 7 on, only.

[hsadia538]

alright

[hsadia538]

I have added a few comments. :) Especially for the truncated test checks, I would like us to check on the frame length, too, so we can ensure things are being calculated as expected. I am again wondering if we should have a special type for truncated frames, as, for instance, the length for the pdu frame in such case isn't the actual pdu length, just the max that suricata will process, as per MQTT standards. So, having a truncated frame might let people know what to expect in such cases. Maybe in such circumstances, we could have a trunc_data frame instead of a data frame?

Sure I can do that . Will update this PR after the new frames PR

[hsadia538]

I have added a few comments. :) Especially for the truncated test checks, I would like us to check on the frame length, too, so we can ensure things are being calculated as expected. I am again wondering if we should have a special type for truncated frames, as, for instance, the length for the pdu frame in such case isn't the actual pdu length, just the max that suricata will process, as per MQTT standards. So, having a truncated frame might let people know what to expect in such cases. Maybe in such circumstances, we could have a trunc_data frame instead of a data frame?

Do you also think that we should Have trunc_pdu as well along with trunc_data or just trunc_data

[jufajardini]

I have added a few comments. :) Especially for the truncated test checks, I would like us to check on the frame length, too, so we can ensure things are being calculated as expected. I am again wondering if we should have a special type for truncated frames, as, for instance, the length for the pdu frame in such case isn't the actual pdu length, just the max that suricata will process, as per MQTT standards. So, having a truncated frame might let people know what to expect in such cases. Maybe in such circumstances, we could have a trunc_data frame instead of a data frame?

Do you also think that we should Have trunc_pdu as well along with trunc_data or just trunc_data

🤔 What about asking the others about this?

[hsadia538]

followed by #1123