aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

file: remove FILE_USE_DETECT flag

Browse Source 
All implementations were converted to use the logic, so the flag itself
can be removed.
pull/9237/head
Victor Julien 2 years ago
parent 59fea84956
commit 389f166d78
8 changed files with 10 additions and 26 deletions
Show Stats Download Patch File Download Diff File

2
rust/src/filecontainer.rs
Unescape Escape View File

@ -24,8 +24,6 @@ use crate::core::*;
extern {
pub fn FileFlowFlagsToFlags(flow_file_flags: u16, flags: u8) -> u16;
}
pub const FILE_USE_DETECT: u16 = BIT_U16!(13);
#[repr(C)]
#[derive(Debug)]

4
rust/src/http2/http2.rs
Unescape Escape View File

@ -211,8 +211,8 @@ impl HTTP2Transaction {
}
pub fn update_file_flags(&mut self, flow_file_flags: u16) {
self.ft_ts.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, STREAM_TOSERVER) | FILE_USE_DETECT };
self.ft_tc.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, STREAM_TOCLIENT) | FILE_USE_DETECT };
self.ft_ts.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, STREAM_TOSERVER) };
self.ft_tc.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, STREAM_TOCLIENT) };
}
fn decompress<'a>(

2
rust/src/nfs/nfs.rs
Unescape Escape View File

@ -154,7 +154,7 @@ impl NFSTransactionFile {
}
pub fn update_file_flags(&mut self, flow_file_flags: u16) {
let dir_flag = if self.direction == Direction::ToServer { STREAM_TOSERVER } else { STREAM_TOCLIENT };
self.file_tracker.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, dir_flag) | FILE_USE_DETECT };
self.file_tracker.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, dir_flag) };
}
}

2
rust/src/smb/files.rs
Unescape Escape View File

@ -46,7 +46,7 @@ impl SMBTransactionFile {
pub fn update_file_flags(&mut self, flow_file_flags: u16) {
let dir_flag = if self.direction == Direction::ToServer { STREAM_TOSERVER } else { STREAM_TOCLIENT };
self.file_tracker.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, dir_flag) | FILE_USE_DETECT };
self.file_tracker.file_flags = unsafe { FileFlowFlagsToFlags(flow_file_flags, dir_flag) };
}
}

3
src/app-layer-ftp.c
Unescape Escape View File

@ -1002,8 +1002,7 @@ static AppLayerResult FTPDataParse(Flow *f, FtpDataState *ftpdata_state,
ftpdata_state->tx_data.file_tx = direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
/* we depend on detection engine for file pruning */
const uint16_t flags =
FileFlowFlagsToFlags(ftpdata_state->tx_data.file_flags, direction) | FILE_USE_DETECT;
const uint16_t flags = FileFlowFlagsToFlags(ftpdata_state->tx_data.file_flags, direction);
int ret = 0;
SCLogDebug("FTP-DATA input_len %u flags %04x dir %d/%s EOF %s", input_len, flags, direction,

4
src/app-layer-htp-file.c
Unescape Escape View File

@ -67,8 +67,6 @@ int HTPFileOpen(HtpState *s, HtpTxUserData *tx, const uint8_t *filename, uint16_
flags = FileFlowFlagsToFlags(tx->tx_data.file_flags, STREAM_TOSERVER);
}
flags |= FILE_USE_DETECT;
if (FileOpenFileWithId(files, &htp_sbcfg, s->file_track_id++, filename, filename_len, data,
data_len, flags) != 0) {
retval = -1;
@ -166,8 +164,6 @@ int HTPFileOpenWithRange(HtpState *s, HtpTxUserData *txud, const uint8_t *filena
flags = FileFlowToFlags(s->f, STREAM_TOCLIENT);
FileContainer *files = &txud->files_tc;
flags |= FILE_USE_DETECT;
// we open a file for this specific range
if (FileOpenFileWithId(files, &htp_sbcfg, s->file_track_id++, filename, filename_len, data,
data_len, flags) != 0) {

4
src/app-layer-smtp.c
Unescape Escape View File

@ -496,8 +496,6 @@ int SMTPProcessDataChunk(const uint8_t *chunk, uint32_t len,
DEBUG_VALIDATE_BUG_ON(tx == NULL);
uint16_t flags = FileFlowToFlags(flow, STREAM_TOSERVER);
/* we depend on detection engine for file pruning */
flags |= FILE_USE_DETECT;
/* Find file */
if (entity->ctnt_flags & CTNT_IS_ATTACHMENT) {
@ -1214,7 +1212,7 @@ static int SMTPProcessRequest(SMTPState *state, Flow *f, AppLayerParserState *ps
}
if (FileOpenFileWithId(&tx->files_ts, &smtp_config.sbcfg, state->file_track_id++,
(uint8_t *)rawmsgname, strlen(rawmsgname), NULL, 0,
FILE_NOMD5 | FILE_NOMAGIC | FILE_USE_DETECT) == 0) {
FILE_NOMD5 | FILE_NOMAGIC) == 0) {
SMTPNewFile(tx, tx->files_ts.tail);
}
} else if (smtp_config.decode_mime) {

15
src/util-file.c
Unescape Escape View File

@ -386,9 +386,9 @@ static int FilePruneFile(File *file, const StreamingBufferConfig *cfg)
if (file->flags & FILE_STORE) {
left_edge = MIN(left_edge,file->content_stored);
}
if (file->flags & FILE_USE_DETECT) {
left_edge = MIN(left_edge, file->content_inspected);
if (!g_detect_disabled) {
left_edge = MIN(left_edge, file->content_inspected);
/* if file has inspect window and min size set, we
* do some house keeping here */
if (file->inspect_window != 0 && file->inspect_min_size != 0) {
@ -441,13 +441,11 @@ void FilePrintFlags(const File *file)
"FILE_STORE %s "
"FILE_STORED %s "
"FILE_NOTRACK %s "
"FILE_USE_DETECT %s "
"FILE_HAS_GAPS %s",
file, file->flags, P(file, FILE_TRUNCATED), P(file, FILE_NOMAGIC), P(file, FILE_NOMD5),
P(file, FILE_MD5), P(file, FILE_NOSHA1), P(file, FILE_SHA1), P(file, FILE_NOSHA256),
P(file, FILE_SHA256), P(file, FILE_LOGGED), P(file, FILE_NOSTORE), P(file, FILE_STORE),
P(file, FILE_STORED), P(file, FILE_NOTRACK), P(file, FILE_USE_DETECT),
P(file, FILE_HAS_GAPS));
P(file, FILE_STORED), P(file, FILE_NOTRACK), P(file, FILE_HAS_GAPS));
}
#undef P
#endif
@ -727,8 +725,7 @@ static int FileAppendDataDo(
SCReturnInt(-1);
}
if ((ff->flags & FILE_USE_DETECT) == 0 &&
FileStoreNoStoreCheck(ff) == 1) {
if (g_detect_disabled && FileStoreNoStoreCheck(ff) == 1) {
int hash_done = 0;
/* no storage but forced hashing */
if (ff->md5_ctx) {
@ -941,10 +938,6 @@ static File *FileOpenFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg
SCLogDebug("not doing sha256 for this file");
ff->flags |= FILE_NOSHA256;
}
if (!g_detect_disabled && flags & FILE_USE_DETECT) {
SCLogDebug("considering content_inspect tracker when pruning");
ff->flags |= FILE_USE_DETECT;
}
if (!(ff->flags & FILE_NOMD5) || g_file_force_md5) {
ff->md5_ctx = SCMd5New();

Write Preview
Loading…
Cancel
Save