detect: clean app-layer txs when we pass the flow

catenacyber · catenacyber · commit 3adaddee6830 · 2026-06-04T10:23:32.000+02:00
Ticket: 8619 Do not wait to run inspection on the other side of transactions as we do not run any tx detection on passing flows. Avoids accumulating txs (cherry picked from commit 2eede11)
diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
@@ -968,7 +968,8 @@ void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)
             goto next;
         }
 
-        if (has_tx_detect_flags) {
+        // for passing flow, do not skip tx as we will not run detection on the other side
+        if (has_tx_detect_flags && (f->flags & (FLOW_ACTION_PASS)) == 0) {
             if (!IS_DISRUPTED(ts_disrupt_flags) &&
                     (f->sgh_toserver != NULL || (f->flags & FLOW_SGH_TOSERVER) == 0)) {
                 if ((txd->flags & (APP_LAYER_TX_INSPECTED_TS | APP_LAYER_TX_SKIP_INSPECT_TS)) ==

Original file line number	Diff line number	Diff line change
`@@ -968,7 +968,8 @@ void AppLayerParserTransactionsCleanup(Flow *f, const uint8_t pkt_dir)`
`968`	`968`	`goto next;`
`969`	`969`	`}`
`970`	`970`
`971`		`- if (has_tx_detect_flags) {`
	`971`	`+ // for passing flow, do not skip tx as we will not run detection on the other side`
	`972`	`+ if (has_tx_detect_flags && (f->flags & (FLOW_ACTION_PASS)) == 0) {`
`972`	`973`	`if (!IS_DISRUPTED(ts_disrupt_flags) &&`
`973`	`974`	`(f->sgh_toserver != NULL \|\| (f->flags & FLOW_SGH_TOSERVER) == 0)) {`
`974`	`975`	`if ((txd->flags & (APP_LAYER_TX_INSPECTED_TS \| APP_LAYER_TX_SKIP_INSPECT_TS)) ==`