ftp: skip ts inspection on tc only transactions

In FTP, the first transaction is a banner from the server. Skip TS
inspection on this transaction.

Allows firewall mode to get past this transaction and onto the next.

Ticket: #8662
pull/15663/head
Jason Ish 1 month ago committed by Victor Julien
parent 097975e289
commit d346e469c5

@ -650,6 +650,10 @@ static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserS
FTPTransaction *tx = FTPGetOldestTx(state, lasttx);
if (tx == NULL) {
tx = FTPTransactionCreate(state);
if (tx != NULL) {
/* This is a TC only transaction, skip TS inspection. */
tx->tx_data.flags |= APP_LAYER_TX_SKIP_INSPECT_TS;
}
}
if (unlikely(tx == NULL)) {
SCReturnStruct(APP_LAYER_ERROR);

Loading…
Cancel
Save