pgsql: add events to handle parser errors - v1

[jufajardini]

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/5524 https://redmine.openinfosecfoundation.org/issues/5566

Describe changes:

• Add events to pgsql, so when there's a recoverable error the parser can offer insight into what's wrong, and still parse possible following pgsql messages

Sharing as a draft as I'm not sure I fully grasp how applayer events work, so not sure I'm doing the right thing here. So far, I wasn't able to create sv tests that will showcase if InvalidLength and MalformedData work, but the SV shows a simple case for TruncatedData with DataRow messages.

TODOs:

• decide whether TruncatedMessage is actually needed - going with it, for now
• add more SV tests (InvalidLength and MalformedMessage)
• document
• Add descriptions of each event to the commit message
• clean up commit message

Provide values to any of the below to override the defaults.

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1356

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.pgsql	0	55	-
.app_layer.tx.pgsql	55	106	192.73%
.app_layer.error.pgsql.parser	55	0	-

Pipeline 15679

[catenacyber]

Sharing as a draft as I'm not sure I fully grasp how applayer events work, so not sure I'm doing the right thing here. So far, I wasn't able to create sv tests that will showcase if InvalidLength and MalformedData work, but the SV shows a simple case for TruncatedData with DataRow messages.

If you have one SV test with a triggering rule with an app-layer event, it looks good :-) It is just that you do not have a pcap that triggers the other events...

To complete this, I think you should also add a file rules/pgsql.rules (and reserve a sid space in the redmine wiki) as is done for other protocols

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.pgsql	0	55	-
.app_layer.tx.pgsql	55	106	192.73%
.app_layer.error.pgsql.parser	55	0	-

Pipeline 15679

[jufajardini]

This got stale due to higher priority things, but will get back to it soon, with a new PR.