Example #1
0
static int FilePruneFile(File *file)
{
    SCEnter();

    SCLogDebug("file %p, file->chunks_cnt %"PRIu64, file, file->chunks_cnt);

    if (!(file->flags & FILE_NOMAGIC)) {
        /* need magic but haven't set it yet, bail out */
        if (file->magic == NULL)
            SCReturnInt(0);
        else
            SCLogDebug("file->magic %s", file->magic);
    } else {
        SCLogDebug("file->flags & FILE_NOMAGIC == true");
    }

    /* okay, we now know we can prune */
    FileData *fd = file->chunks_head;

    while (fd != NULL) {
        SCLogDebug("fd %p", fd);

        if (file->flags & FILE_NOSTORE || fd->stored == 1) {
            file->chunks_head = fd->next;
            if (file->chunks_tail == fd)
                file->chunks_tail = fd->next;

            FileDataFree(fd);

            fd = file->chunks_head;
#ifdef DEBUG
            file->chunks_cnt--;
            SCLogDebug("file->chunks_cnt %"PRIu64, file->chunks_cnt);
#endif
        } else if (fd->stored == 0) {
            fd = NULL;
            SCReturnInt(0);
            break;
        }
    }

    /* file is done when state is closed+, logging/storing is done (if any) */
    if (file->state >= FILE_STATE_CLOSED &&
        (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) &&
        (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED)))
    {
        SCReturnInt(1);
    } else {
        SCReturnInt(0);
    }
}
Example #2
0
static int FilePruneFile(File *file)
{
    SCEnter();

    SCLogDebug("file %p, file->chunks_cnt %"PRIu64, file, file->chunks_cnt);

    if (!(file->flags & FILE_NOMAGIC)) {
        /* need magic but haven't set it yet, bail out */
        if (file->magic == NULL)
            SCReturnInt(0);
        else
            SCLogDebug("file->magic %s", file->magic);
    } else {
        SCLogDebug("file->flags & FILE_NOMAGIC == true");
    }

    /* okay, we now know we can prune */
    FileData *fd = file->chunks_head;

    while (fd != NULL) {
        SCLogDebug("fd %p", fd);

        if (file->flags & FILE_NOSTORE || fd->stored == 1) {
            /* keep chunks in memory as long as we still need to
             * inspect them or parts of them */
            if (file->flags & FILE_USE_DETECT) {
                uint64_t right_edge = fd->stream_offset + fd->len;
                if (file->content_inspected < right_edge)
                    break;
            }

            file->chunks_head = fd->next;
            if (file->chunks_tail == fd)
                file->chunks_tail = fd->next;

            FileDataFree(fd);

            fd = file->chunks_head;
#ifdef DEBUG
            file->chunks_cnt--;
            SCLogDebug("file->chunks_cnt %"PRIu64, file->chunks_cnt);
#endif
        } else if (fd->stored == 0) {
            fd = NULL;
            SCReturnInt(0);
            break;
        }
    }

    SCLogDebug("file->state %d. Is >= FILE_STATE_CLOSED: %s", file->state, (file->state >= FILE_STATE_CLOSED) ? "yes" : "no");

    /* file is done when state is closed+, logging/storing is done (if any) */
    if (file->state >= FILE_STATE_CLOSED &&
        (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) &&
        (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED)))
    {
        SCReturnInt(1);
    } else {
        SCReturnInt(0);
    }
}