diff --git a/rules/ftp-events.rules b/rules/ftp-events.rules index d32c93f32759..501fe1016555 100644 --- a/rules/ftp-events.rules +++ b/rules/ftp-events.rules @@ -4,3 +4,4 @@ alert ftp any any -> any any (msg:"SURICATA FTP Request command too long"; flow:to_server; app-layer-event:ftp.request_command_too_long; classtype:protocol-command-decode; sid:2232000; rev:1;) alert ftp any any -> any any (msg:"SURICATA FTP Response command too long"; flow:to_client; app-layer-event:ftp.response_command_too_long; classtype:protocol-command-decode; sid:2232001; rev:1;) +alert ftp any any -> any any (msg:"SURICATA FTP too many transactions"; app-layer-event:ftp.too_many_transactions; classtype:protocol-command-decode; sid:2232002; rev:1;) diff --git a/rust/src/ftp/event.rs b/rust/src/ftp/event.rs index d7ee6969d64c..ce25fd2ce12c 100644 --- a/rust/src/ftp/event.rs +++ b/rust/src/ftp/event.rs @@ -25,6 +25,8 @@ pub enum FtpEvent { FtpEventRequestCommandTooLong, #[name("response_command_too_long")] FtpEventResponseCommandTooLong, + #[name("too_many_transactions")] + FtpEventTooManyTransactions, } /// Wrapper around the Rust generic function for get_event_info. diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c index d1eb32e62b22..6b90683eee92 100644 --- a/src/app-layer-ftp.c +++ b/src/app-layer-ftp.c @@ -223,8 +223,17 @@ static FTPTransaction *FTPTransactionCreate(FtpState *state) SCEnter(); FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list); if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) { - // FTP does not set events yet... - return NULL; + FTPTransaction *tx_old; + TAILQ_FOREACH (tx_old, &state->tx_list, next) { + if (!tx_old->done) { + tx_old->done = true; + tx_old->tx_data.updated_ts = true; + tx_old->tx_data.updated_tc = true; + SCAppLayerDecoderEventsSetEventRaw( + &tx_old->tx_data.events, FtpEventTooManyTransactions); + break; + } + } } FTPTransaction *tx = FTPCalloc(1, sizeof(*tx)); if (tx == NULL) { diff --git a/suricata.yaml.in b/suricata.yaml.in index 859c443903de..964245d2fba4 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -1000,6 +1000,7 @@ app-layer: ftp: enabled: yes # memcap: 64 MiB + # max-tx: 1024 websocket: #enabled: yes # Maximum used payload size, the rest is skipped