detect/file.data: update buffer initialization logic

pull/8482/head
Victor Julien 4 years ago
parent 9c34e82471
commit 50fd691efb

@ -485,14 +485,14 @@ static int PrefilterMpmHTTPFiledataRegister(DetectEngineCtx *de_ctx, SigGroupHea
static inline InspectionBuffer *FiledataWithXformsGetDataCallback(DetectEngineThreadCtx *det_ctx, static inline InspectionBuffer *FiledataWithXformsGetDataCallback(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, const int list_id, int local_file_id, const DetectEngineTransforms *transforms, const int list_id, int local_file_id,
InspectionBuffer *base_buffer, const bool first) InspectionBuffer *base_buffer)
{ {
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, local_file_id); InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, local_file_id);
if (buffer == NULL) { if (buffer == NULL) {
SCLogDebug("list_id: %d: no buffer", list_id); SCLogDebug("list_id: %d: no buffer", list_id);
return NULL; return NULL;
} }
if (!first && buffer->inspect != NULL) { if (buffer->initialized) {
SCLogDebug("list_id: %d: returning %p", list_id, buffer); SCLogDebug("list_id: %d: returning %p", list_id, buffer);
return buffer; return buffer;
} }
@ -505,11 +505,10 @@ static inline InspectionBuffer *FiledataWithXformsGetDataCallback(DetectEngineTh
static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx, static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Flow *f, uint8_t flow_flags, File *cur_file, const DetectEngineTransforms *transforms, Flow *f, uint8_t flow_flags, File *cur_file,
const int list_id, const int base_id, int local_file_id, bool first) const int list_id, const int base_id, int local_file_id)
{ {
SCEnter(); SCEnter();
SCLogDebug( SCLogDebug("starting: list_id %d base_id %d", list_id, base_id);
"starting: list_id %d base_id %d first %s", list_id, base_id, first ? "true" : "false");
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, base_id, local_file_id); InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, base_id, local_file_id);
SCLogDebug("base: buffer %p", buffer); SCLogDebug("base: buffer %p", buffer);
@ -518,9 +517,9 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
if (base_id != list_id && buffer->inspect != NULL) { if (base_id != list_id && buffer->inspect != NULL) {
SCLogDebug("handle xform %s", (list_id != base_id) ? "true" : "false"); SCLogDebug("handle xform %s", (list_id != base_id) ? "true" : "false");
return FiledataWithXformsGetDataCallback( return FiledataWithXformsGetDataCallback(
det_ctx, transforms, list_id, local_file_id, buffer, first); det_ctx, transforms, list_id, local_file_id, buffer);
} }
if (!first && buffer->inspect != NULL) { if (buffer->initialized) {
SCLogDebug("base_id: %d, not first: use %p", base_id, buffer); SCLogDebug("base_id: %d, not first: use %p", base_id, buffer);
return buffer; return buffer;
} }
@ -532,8 +531,8 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
// TODO this is unused, is that right? // TODO this is unused, is that right?
//const uint32_t content_inspect_window = de_ctx->filedata_config[f->alproto].content_inspect_window; //const uint32_t content_inspect_window = de_ctx->filedata_config[f->alproto].content_inspect_window;
SCLogDebug("[list %d] first: %d, content_limit %u, content_inspect_min_size %u", list_id, SCLogDebug("[list %d] content_limit %u, content_inspect_min_size %u", list_id, content_limit,
first ? 1 : 0, content_limit, content_inspect_min_size); content_inspect_min_size);
SCLogDebug("[list %d] file %p size %" PRIu64 ", state %d", list_id, cur_file, file_size, SCLogDebug("[list %d] file %p size %" PRIu64 ", state %d", list_id, cur_file, file_size,
cur_file->state); cur_file->state);
@ -578,7 +577,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
if (list_id != base_id) { if (list_id != base_id) {
SCLogDebug("regular %d has been set up: now handle xforms id %d", base_id, list_id); SCLogDebug("regular %d has been set up: now handle xforms id %d", base_id, list_id);
InspectionBuffer *tbuffer = FiledataWithXformsGetDataCallback( InspectionBuffer *tbuffer = FiledataWithXformsGetDataCallback(
det_ctx, transforms, list_id, local_file_id, buffer, first); det_ctx, transforms, list_id, local_file_id, buffer);
SCReturnPtr(tbuffer, "InspectionBuffer"); SCReturnPtr(tbuffer, "InspectionBuffer");
} else { } else {
SCLogDebug("regular buffer %p size %u", buffer, buffer->inspect_len); SCLogDebug("regular buffer %p size %u", buffer, buffer->inspect_len);
@ -608,7 +607,7 @@ static uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngine
File *file = ffc->head; File *file = ffc->head;
for (; file != NULL; file = file->next) { for (; file != NULL; file = file->next) {
InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, transforms, f, flags, file, InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, transforms, f, flags, file,
engine->sm_list, engine->sm_list_base, local_file_id, false); engine->sm_list, engine->sm_list_base, local_file_id);
if (buffer == NULL) if (buffer == NULL)
continue; continue;
@ -667,7 +666,7 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect
int local_file_id = 0; int local_file_id = 0;
for (File *file = ffc->head; file != NULL; file = file->next) { for (File *file = ffc->head; file != NULL; file = file->next) {
InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, ctx->transforms, f, flags, InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, ctx->transforms, f, flags,
file, list_id, ctx->base_list_id, local_file_id, true); file, list_id, ctx->base_list_id, local_file_id);
if (buffer == NULL) if (buffer == NULL)
continue; continue;

Loading…
Cancel
Save