mirror of https://github.com/OISF/suricata
ftp: raise too_many_transactions event on overflow
Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions
event when a flow exceeds its per-flow transaction limit. FTP had
the limit wired up through app-layer.protocols.ftp.max-tx but just
dropped the excess transaction on the floor with a "FTP does not set
events yet..." TODO, so no event was raised when the limit was
reached.
Add the FtpEventTooManyTransactions variant, a stock rule at
sid 2232002, and raise the event from FTPTransactionCreate when the
live-tx count goes past ftp_config_maxtx.
Issue: 8489
(cherry picked from commit 9ea2e29581)
pull/15379/head
parent
ad9d979f92
commit
9162048a93
Loading…
Reference in New Issue