mirror of https://github.com/OISF/suricata
ftp: don't halt the flow when raising too_many_transactions
The first version of the event set done=true on state->curr_tx and returned NULL when the limit hit. curr_tx is usually the active command just received — marking it done mid-request throws off response matching, and subsequent commands in the flow stop getting logged. SMB behavior is mirrored here: Walk the tx list, find the oldest tx that isn't done, mark it done and tag it with the event, then fall through and create the new tx so the flow parsing continues. One stale tx gets reaped per overflow so memory stays bounded. Issue: 8489pull/15344/head
parent
9ea2e29581
commit
5ddd808e9b
Loading…
Reference in New Issue