From 2d3d5ae0053b61ceed2d6a4d53cce3ed9828a69e Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 7 Dec 2023 10:32:03 +0100 Subject: [PATCH] filestore: do not try to store a file set to nostore Ticket: 6390 This can happen with keyword filestore:both,flow If one direction does not have a signature group with a filestore, the file is set to nostore on opening, until a signature in the other direction tries to set it to store. Subsequent files will be stored in both directions as flow flags are now set. --- src/util-file.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/util-file.c b/src/util-file.c index 3221d116870d..cb15c23e1148 100644 --- a/src/util-file.c +++ b/src/util-file.c @@ -297,6 +297,13 @@ void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File * uint16_t update_flags = FileFlowFlagsToFlags(txd->file_flags, direction); DEBUG_VALIDATE_BUG_ON( (file->flags & (FILE_STORE | FILE_NOSTORE)) == (FILE_STORE | FILE_NOSTORE)); + // May happen with keyword filestore:both,flow : + // There may be one opened unclosed file in one direction without filestore + // As such it has file->flags & FILE_NOSTORE + // But a new file in the other direction may trigger filestore:both,flow + // And thus set txd->file_flags & FILE_STORE + if (file->flags & FILE_NOSTORE) + update_flags &= ~FILE_STORE; if (file->flags & FILE_STORE) update_flags &= ~FILE_NOSTORE;