From 158d72e7f3c0f2d1b3603552e0fe35bebc6b0ea5 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 23 Dec 2011 12:15:52 +0100 Subject: [PATCH] file-inspection: inspect new files in same tx but opposite direction as well. --- src/app-layer-htp-file.c | 14 ++++++++++++++ src/detect-engine-state.c | 30 +++++++++++++++++------------- 2 files changed, 31 insertions(+), 13 deletions(-) diff --git a/src/app-layer-htp-file.c b/src/app-layer-htp-file.c index a6b5b8b3a1..89ce9df108 100644 --- a/src/app-layer-htp-file.c +++ b/src/app-layer-htp-file.c @@ -82,6 +82,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len, int retval = 0; uint8_t flags = 0; FileContainer *files = NULL; + FileContainer *files_opposite = NULL; SCLogDebug("data %p data_len %"PRIu32, data, data_len); @@ -99,6 +100,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len, } files = s->files_tc; + files_opposite = s->files_ts; if (s->flags & HTP_FLAG_STORE_FILES_TS || (s->flags & HTP_FLAG_STORE_FILES_TX_TS && txid == s->store_tx_id)) { @@ -114,6 +116,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len, } files = s->files_ts; + files_opposite = s->files_tc; if (s->flags & HTP_FLAG_STORE_FILES_TC || (s->flags & HTP_FLAG_STORE_FILES_TX_TC && txid == s->store_tx_id)) { @@ -134,6 +137,17 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len, s->flags |= HTP_FLAG_NEW_FILE_TX_TS; } } + if (files_opposite != NULL && files_opposite->tail != NULL && files_opposite->tail->txid == txid) { + SCLogDebug("new file in same tx, flagging http state for de_state reset"); + + if (direction & STREAM_TOCLIENT) { + SCLogDebug("flagging TC"); + s->flags |= HTP_FLAG_NEW_FILE_TX_TC; + } else { + SCLogDebug("flagging TS"); + s->flags |= HTP_FLAG_NEW_FILE_TX_TS; + } + } if (!(flags & FILE_STORE) && s->f->flags & FLOW_FILE_NO_STORE) { flags |= FILE_NOSTORE; diff --git a/src/detect-engine-state.c b/src/detect-engine-state.c index b007508c7b..0a85928547 100644 --- a/src/detect-engine-state.c +++ b/src/detect-engine-state.c @@ -710,19 +710,21 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete /* if we already fully matched previously, detect that here */ if (item->flags & DE_STATE_FLAG_FULL_MATCH) { - if (flags & STREAM_TOSERVER && - item->flags & DE_STATE_FLAG_FILE_TS_INSPECT && - f->de_state->flags & DE_STATE_FILE_TS_NEW) - { - /* new file, fall through */ - item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT; - } else if (flags & STREAM_TOCLIENT && - item->flags & DE_STATE_FLAG_FILE_TC_INSPECT && - f->de_state->flags & DE_STATE_FILE_TC_NEW) - { - /* new file, fall through */ - item->flags &= ~DE_STATE_FLAG_FILE_TC_INSPECT; - } else { + /* check first if we have received new files in the livetime of + * this de_state (this tx). */ + if (item->flags & (DE_STATE_FLAG_FILE_TC_INSPECT|DE_STATE_FLAG_FILE_TS_INSPECT)) { + if (flags & STREAM_TOCLIENT && f->de_state->flags & DE_STATE_FILE_TC_NEW) { + item->flags &= ~DE_STATE_FLAG_FILE_TC_INSPECT; + item->flags &= ~DE_STATE_FLAG_FULL_MATCH; + } + + if (flags & STREAM_TOSERVER && f->de_state->flags & DE_STATE_FILE_TS_NEW) { + item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT; + item->flags &= ~DE_STATE_FLAG_FULL_MATCH; + } + } + + if (item->flags & DE_STATE_FLAG_FULL_MATCH) { det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_FULL; SCLogDebug("full match state"); continue; @@ -1113,9 +1115,11 @@ static void DeStateResetFileInspection(Flow *f, uint16_t alproto, void *alstate) HtpState *htp_state = (HtpState *)alstate; if (htp_state->flags & HTP_FLAG_NEW_FILE_TX_TC) { + SCLogDebug("new file in the TC direction"); htp_state->flags &= ~HTP_FLAG_NEW_FILE_TX_TC; f->de_state->flags |= DE_STATE_FILE_TC_NEW; } else if (htp_state->flags & HTP_FLAG_NEW_FILE_TX_TS) { + SCLogDebug("new file in the TS direction"); htp_state->flags &= ~HTP_FLAG_NEW_FILE_TX_TS; f->de_state->flags |= DE_STATE_FILE_TS_NEW; }