filestore: do not try to store a file set to nostore #9996
Conversation
Ticket: 6390 This can happen with keyword filestore:both,flow If one direction does not have a signature group with a filestore, the file is set to nostore on opening, until a signature in the other direction tries to set it to store. Subsequent files will be stored in both directions as flow flags are now set.
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #9996 +/- ##
=======================================
Coverage 82.47% 82.47%
=======================================
Files 970 970
Lines 271355 271357 +2
=======================================
+ Hits 223798 223801 +3
+ Misses 47557 47556 -1
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Red CI : need to fix SV test so that it does not use
|
| // May happen with keyword filestore:both,flow : | ||
| // There may be one opened unclosed file in one direction without filestore | ||
| // As such it has file->flags & FILE_NOSTORE | ||
| // But a new file in the other direction may trigger filestore:both,flow | ||
| // And thus set txd->file_flags & FILE_STORE |
There was a problem hiding this comment.
Why don't we store file flags per direction?
There was a problem hiding this comment.
Looks like this was removed by 79499e4, so this should be another bug/ticket...
There was a problem hiding this comment.
I created this: https://redmine.openinfosecfoundation.org/issues/6617
Please set the version, assignee etc as you see fit. Thank you :)
There was a problem hiding this comment.
I reworded the title.
Would you want to create a S-V test for it ?
using filestore:to_server,flow; and checking that files to_client do not get stored ?
There was a problem hiding this comment.
Please check OISF/suricata-verify#1556
|
Information: QA ran without warnings. Pipeline 16953 |
|
Rebased in #10372 |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6390
Describe changes:
use of keyword
filestore:both,flowmay try to store a file that has already been opened (in the other direction) and set to nostore...OISF/suricata-verify#1524