From 9ea2e29581c567c5b272ea6f96822429e74838b0 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Thu, 16 Apr 2026 09:50:39 -0400 Subject: [PATCH] ftp: raise too_many_transactions event on overflow Other parsers (SMB, POP3, ENIP) already raise a too_many_transactions event when a flow exceeds its per-flow transaction limit. FTP had the limit wired up through app-layer.protocols.ftp.max-tx but just dropped the excess transaction on the floor with a "FTP does not set events yet..." TODO, so no event was raised when the limit was reached. Add the FtpEventTooManyTransactions variant, a stock rule at sid 2232002, and raise the event from FTPTransactionCreate when the live-tx count goes past ftp_config_maxtx. Issue: 8489 --- rust/src/ftp/event.rs | 2 ++ src/app-layer-ftp.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/rust/src/ftp/event.rs b/rust/src/ftp/event.rs index d7ee6969d6..ce25fd2ce1 100644 --- a/rust/src/ftp/event.rs +++ b/rust/src/ftp/event.rs @@ -25,6 +25,8 @@ pub enum FtpEvent { FtpEventRequestCommandTooLong, #[name("response_command_too_long")] FtpEventResponseCommandTooLong, + #[name("too_many_transactions")] + FtpEventTooManyTransactions, } /// Wrapper around the Rust generic function for get_event_info. diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c index d1eb32e62b..de3c512c13 100644 --- a/src/app-layer-ftp.c +++ b/src/app-layer-ftp.c @@ -223,7 +223,10 @@ static FTPTransaction *FTPTransactionCreate(FtpState *state) SCEnter(); FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list); if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) { - // FTP does not set events yet... + FTPTransaction *event_tx = state->curr_tx ? state->curr_tx : firsttx; + event_tx->done = true; + event_tx->tx_data.updated_ts = true; + SCAppLayerDecoderEventsSetEventRaw(&event_tx->tx_data.events, FtpEventTooManyTransactions); return NULL; } FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));