From f42bcd8b7e48c2c8a2bb8784c3886a9cbc9e8bf6 Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Mon, 2 Feb 2026 02:00:38 +0000
Subject: [PATCH] Recognize Z/OS error messages related to FTP over TLS. Close
 #3255, fix #2315

---
 nselib/ftp.lua | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nselib/ftp.lua b/nselib/ftp.lua
index 0e6802294..cf112ffed 100644
--- a/nselib/ftp.lua
+++ b/nselib/ftp.lua
@@ -115,11 +115,14 @@ end
 
 -- Should we try STARTTLS based on this error?
 local function should_try_ssl(code, message)
-  return code and code >= 400 and (
-        message:match('[Ss][Ss][Ll]') or
-        message:match('[Tt][Ll][Ss]') or
-        message:match('[Ss][Ee][Cc][Uu][Rr]')
-        )
+  if not code or code < 400 then return false end
+  message = message:lower()
+  return message:find("ssl", 1, true) or
+         message:find("tls", 1, true) or
+         message:find("secur", 1, true) or
+         -- z/OS Communications Server
+         -- https://www.ibm.com/docs/en/zos/2.4.0?topic=codes-534-reply
+         message:find("server requires authentication before", 1, true)
 end
 
 -- Try to reconnect over STARTTLS.