ftp: raise too_many_transactions event on overflow

Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions
event when a flow exceeds its per-flow transaction limit. FTP had
the limit wired up through app-layer.protocols.ftp.max-tx but just
dropped the excess transaction on the floor with a "FTP does not set
events yet..." TODO, so no event was raised when the limit was
reached.

Add the FtpEventTooManyTransactions variant, a stock rule at
sid 2232002, and raise the event from FTPTransactionCreate when the
live-tx count goes past ftp_config_maxtx.

Issue: 8489
(cherry picked from commit 9ea2e29581)
pull/15379/head
Jeff Lucovsky 3 months ago committed by Victor Julien
parent ad9d979f92
commit 9162048a93

@ -25,6 +25,8 @@ pub enum FtpEvent {
FtpEventRequestCommandTooLong,
#[name("response_command_too_long")]
FtpEventResponseCommandTooLong,
#[name("too_many_transactions")]
FtpEventTooManyTransactions,
}
/// Wrapper around the Rust generic function for get_event_info.

@ -222,7 +222,10 @@ static FTPTransaction *FTPTransactionCreate(FtpState *state)
SCEnter();
FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list);
if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) {
// FTP does not set events yet...
FTPTransaction *event_tx = state->curr_tx ? state->curr_tx : firsttx;
event_tx->done = true;
event_tx->tx_data.updated_ts = true;
AppLayerDecoderEventsSetEventRaw(&event_tx->tx_data.events, FtpEventTooManyTransactions);
return NULL;
}
FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));

Loading…
Cancel
Save