ldap: set invalid_data event

[glongo]

Currently in parse_request function LdapEvent::InvalidData is not set when a request is not parsed correctly.

Previous PR: #14723

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8258

[github-actions]

NOTE: This PR may contain new authors.

[victorjulien]

What is the conclusion on the SV test?

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 29925

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.91%. Comparing base (569ba3d) to head (7542b71).
⚠️ Report is 27 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14913      +/-   ##
==========================================
- Coverage   81.93%   81.91%   -0.03%     
==========================================
  Files         986      986              
  Lines      271105   271102       -3     
  Branches    31005    31005              
==========================================
- Hits       222139   222081      -58     
- Misses      46822    46875      +53     
- Partials     2144     2146       +2     

Flag	Coverage Δ
fuzzcorpus	60.99% <100.00%> (-0.01%)	⬇️
livemode	18.26% <0.00%> (-0.01%)	⬇️
netns	18.36% <0.00%> (-0.04%)	⬇️
pcap	45.20% <66.66%> (-0.02%)	⬇️
suricata-verify	58.49% <66.66%> (-0.04%)	⬇️
unittests	58.84% <0.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[glongo]

What is the conclusion on the SV test?

I think what @catenacyber meant is that when only a response is sent (which is the case in the test), tx_old.tx_data.updated_tc = true; is set in new_tx(), although the condition if self.transactions.len() > unsafe { LDAP_MAX_TX } must be true. I’m not 100% sure.

[catenacyber]

I think the code is good now.

The rustfmt part could be its own commit

And it would be nice to have a SV test that exercices this code path (maybe crafting/corrupting an existing SV ldap pcap) to see the anomaly event

[victorjulien]

Merged in #14931, thanks!