aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

file: fix storing parallel files

Browse Source 
When looping available files 'flags' misuse would lead to all files
being closed after the first close.

This patch separates per file and per call flags.
pull/2712/head
Victor Julien 8 years ago
parent ae99e08396
commit afedd5c6df
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File

17
src/output-filedata.c
Unescape Escape View File

@ -141,7 +141,7 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
BUG_ON(logger != NULL && store == NULL); BUG_ON(logger != NULL && store == NULL);
BUG_ON(logger == NULL && store == NULL); BUG_ON(logger == NULL && store == NULL);
uint8_t flags = 0; uint8_t call_flags = 0;
Flow * const f = p->flow; Flow * const f = p->flow;
/* no flow, no files */ /* no flow, no files */
@ -150,9 +150,9 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
} }
if (p->flowflags & FLOW_PKT_TOCLIENT) if (p->flowflags & FLOW_PKT_TOCLIENT)
flags |= STREAM_TOCLIENT; call_flags |= STREAM_TOCLIENT;
else else
flags |= STREAM_TOSERVER; call_flags |= STREAM_TOSERVER;
int file_close = (p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0; int file_close = (p->flags & PKT_PSEUDO_STREAM_END) ? 1 : 0;
int file_trunc = 0; int file_trunc = 0;
@ -160,11 +160,12 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
file_trunc = StreamTcpReassembleDepthReached(p); file_trunc = StreamTcpReassembleDepthReached(p);
FileContainer *ffc = AppLayerParserGetFiles(p->proto, f->alproto, FileContainer *ffc = AppLayerParserGetFiles(p->proto, f->alproto,
f->alstate, flags); f->alstate, call_flags);
SCLogDebug("ffc %p", ffc); SCLogDebug("ffc %p", ffc);
if (ffc != NULL) { if (ffc != NULL) {
File *ff; File *ff;
for (ff = ffc->head; ff != NULL; ff = ff->next) { for (ff = ffc->head; ff != NULL; ff = ff->next) {
uint8_t file_flags = call_flags;
#ifdef HAVE_MAGIC #ifdef HAVE_MAGIC
if (FileForceMagic() && ff->magic == NULL) { if (FileForceMagic() && ff->magic == NULL) {
FilemagicGlobalLookup(ff); FilemagicGlobalLookup(ff);
@ -196,7 +197,7 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
if (ff->file_store_id == 0) { if (ff->file_store_id == 0) {
/* new file */ /* new file */
ff->file_store_id = SC_ATOMIC_ADD(g_file_store_id, 1); ff->file_store_id = SC_ATOMIC_ADD(g_file_store_id, 1);
flags |= OUTPUT_FILEDATA_FLAG_OPEN; file_flags |= OUTPUT_FILEDATA_FLAG_OPEN;
} else { } else {
/* existing file */ /* existing file */
} }
@ -209,7 +210,7 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
/* tell the logger we're closing up */ /* tell the logger we're closing up */
if (ff->state >= FILE_STATE_CLOSED) if (ff->state >= FILE_STATE_CLOSED)
flags |= OUTPUT_FILEDATA_FLAG_CLOSE; file_flags |= OUTPUT_FILEDATA_FLAG_CLOSE;
/* do the actual logging */ /* do the actual logging */
const uint8_t *data = NULL; const uint8_t *data = NULL;
@ -219,12 +220,12 @@ static TmEcode OutputFiledataLog(ThreadVars *tv, Packet *p, void *thread_data)
&data, &data_len, &data, &data_len,
ff->content_stored); ff->content_stored);
int file_logged = CallLoggers(tv, store, p, ff, data, data_len, flags); int file_logged = CallLoggers(tv, store, p, ff, data, data_len, file_flags);
if (file_logged) { if (file_logged) {
ff->content_stored += data_len; ff->content_stored += data_len;
/* all done */ /* all done */
if (flags & OUTPUT_FILEDATA_FLAG_CLOSE) { if (file_flags & OUTPUT_FILEDATA_FLAG_CLOSE) {
ff->flags |= FILE_STORED; ff->flags |= FILE_STORED;
} }
} }

Write Preview
Loading…
Cancel
Save