diff --git a/rust/src/ftp/event.rs b/rust/src/ftp/event.rs index cc327369d8..9d7c6c6750 100644 --- a/rust/src/ftp/event.rs +++ b/rust/src/ftp/event.rs @@ -25,6 +25,8 @@ pub enum FtpEvent { FtpEventRequestCommandTooLong, #[name("response_command_too_long")] FtpEventResponseCommandTooLong, + #[name("too_many_transactions")] + FtpEventTooManyTransactions, } /// Wrapper around the Rust generic function for get_event_info. diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c index e049c2df4b..8c403da1fd 100644 --- a/src/app-layer-ftp.c +++ b/src/app-layer-ftp.c @@ -222,7 +222,10 @@ static FTPTransaction *FTPTransactionCreate(FtpState *state) SCEnter(); FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list); if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) { - // FTP does not set events yet... + FTPTransaction *event_tx = state->curr_tx ? state->curr_tx : firsttx; + event_tx->done = true; + event_tx->tx_data.updated_ts = true; + AppLayerDecoderEventsSetEventRaw(&event_tx->tx_data.events, FtpEventTooManyTransactions); return NULL; } FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));