/** * \brief post-match function for filestore * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param p packet * * The match function for filestore records store candidates in the det_ctx. * When we are sure all parts of the signature matched, we run this function * to finalize the filestore. */ int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s) { uint8_t flags = 0; SCEnter(); if (det_ctx->filestore_cnt == 0) { SCReturnInt(0); } if (s->filestore_sm == NULL || p->flow == NULL) { #ifndef DEBUG SCReturnInt(0); #else BUG_ON(1); #endif } if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else flags |= STREAM_TOSERVER; if (det_ctx->flow_locked == 0) FLOWLOCK_WRLOCK(p->flow); FileContainer *ffc = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, flags); /* filestore for single files only */ if (s->filestore_sm->ctx == NULL) { uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FileStoreFileById(ffc, det_ctx->filestore[u].file_id); } } else { DetectFilestoreData *filestore = (DetectFilestoreData *)s->filestore_sm->ctx; uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FilestorePostMatchWithOptions(p, p->flow, filestore, ffc, det_ctx->filestore[u].file_id, det_ctx->filestore[u].tx_id); } } if (det_ctx->flow_locked == 0) FLOWLOCK_UNLOCK(p->flow); SCReturnInt(0); }
/** * \brief post-match function for filestore * * \param t thread local vars * \param det_ctx pattern matcher thread local data * \param p packet * * The match function for filestore records store candidates in the det_ctx. * When we are sure all parts of the signature matched, we run this function * to finalize the filestore. */ int DetectFilestorePostMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s) { uint8_t flags = 0; SCEnter(); if (det_ctx->filestore_cnt == 0) { SCReturnInt(0); } if (s->filestore_sm == NULL || p->flow == NULL) { #ifndef DEBUG SCReturnInt(0); #else BUG_ON(1); #endif } /* set filestore depth for stream reassembling */ TcpSession *ssn = (TcpSession *)p->flow->protoctx; TcpSessionSetReassemblyDepth(ssn, FileReassemblyDepth()); if (p->flowflags & FLOW_PKT_TOCLIENT) flags |= STREAM_TOCLIENT; else flags |= STREAM_TOSERVER; FileContainer *ffc = AppLayerParserGetFiles(p->flow->proto, p->flow->alproto, p->flow->alstate, flags); /* filestore for single files only */ if (s->filestore_sm->ctx == NULL) { uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FileStoreFileById(ffc, det_ctx->filestore[u].file_id); } } else { DetectFilestoreData *filestore = (DetectFilestoreData *)s->filestore_sm->ctx; uint16_t u; for (u = 0; u < det_ctx->filestore_cnt; u++) { FilestorePostMatchWithOptions(p, p->flow, filestore, ffc, det_ctx->filestore[u].file_id, det_ctx->filestore[u].tx_id); } } SCReturnInt(0); }