From 05296457909af10bdca855660f1e41a8fef01ec6 Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Sat, 23 Aug 2025 19:49:58 +0200
Subject: [PATCH] HTTP: Scan ban should only be triggered by HTTP parse errors

---
 crates/http/src/request.rs | 53 ++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 25 deletions(-)

diff --git a/crates/http/src/request.rs b/crates/http/src/request.rs
index 5a71ce0e..70e00082 100644
--- a/crates/http/src/request.rs
+++ b/crates/http/src/request.rs
@@ -813,33 +813,36 @@ async fn handle_session<T: SessionStream>(inner: Arc<Inner>, session: SessionDat
         .with_upgrades()
         .await
     {
-        match inner
-            .build_server()
-            .is_scanner_fail2banned(session.remote_ip)
-            .await
-        {
-            Ok(true) => {
-                trc::event!(
-                    Security(SecurityEvent::ScanBan),
-                    SpanId = session.session_id,
-                    RemoteIp = session.remote_ip,
-                    Reason = http_err.to_string(),
-                );
-            }
-            Ok(false) => {
-                trc::event!(
-                    Http(trc::HttpEvent::Error),
-                    SpanId = session.session_id,
-                    Reason = http_err.to_string(),
-                );
-            }
-            Err(err) => {
-                trc::error!(
-                    err.span_id(session.session_id)
-                        .details("Failed to check for fail2ban")
-                );
+        if http_err.is_parse() {
+            match inner
+                .build_server()
+                .is_scanner_fail2banned(session.remote_ip)
+                .await
+            {
+                Ok(true) => {
+                    trc::event!(
+                        Security(SecurityEvent::ScanBan),
+                        SpanId = session.session_id,
+                        RemoteIp = session.remote_ip,
+                        Reason = http_err.to_string(),
+                    );
+                    return;
+                }
+                Ok(false) => {}
+                Err(err) => {
+                    trc::error!(
+                        err.span_id(session.session_id)
+                            .details("Failed to check for fail2ban")
+                    );
+                }
             }
         }
+
+        trc::event!(
+            Http(trc::HttpEvent::Error),
+            SpanId = session.session_id,
+            Reason = http_err.to_string(),
+        );
     }
 }