Make sure we check the sgh for no magic and no store once per flow direction.

remotes/origin/master-1.2.x
Victor Julien 15 years ago
parent f3fbc1a44c
commit 042fd850fc

@ -1768,40 +1768,37 @@ end:
SCMutexLock(&p->flow->m);
if (!(sms_runflags & SMS_USE_FLOW_SGH)) {
if (p->flowflags & FLOW_PKT_TOSERVER && !(p->flow->flags & FLOW_SGH_TOSERVER)) {
/* first time we see this toserver sgh, store it */
p->flow->sgh_toserver = det_ctx->sgh;
p->flow->flags |= FLOW_SGH_TOSERVER;
/* see if this sgh requires us to consider file storing */
if (p->flow->sgh_toserver == NULL || p->flow->sgh_toserver->filestore_cnt == 0) {
FileDisableStoring(p->flow, STREAM_TOSERVER);
}
/* see if this sgh requires us to consider file magic */
if (!FileForceMagic() && (p->flow->sgh_toserver == NULL ||
!(p->flow->sgh_toserver->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)))
{
SCLogDebug("disabling magic for flow");
FileDisableMagic(p->flow, STREAM_TOSERVER);
}
} else if (p->flowflags & FLOW_PKT_TOCLIENT && !(p->flow->flags & FLOW_SGH_TOCLIENT)) {
p->flow->sgh_toclient = det_ctx->sgh;
p->flow->flags |= FLOW_SGH_TOCLIENT;
}
if (p->flow->flags & FLOW_SGH_TOCLIENT && (p->flow->sgh_toclient == NULL ||
p->flow->sgh_toclient->filestore_cnt == 0))
{
FileDisableStoring(p->flow, STREAM_TOCLIENT);
}
if (p->flow->flags & FLOW_SGH_TOSERVER && (p->flow->sgh_toserver == NULL ||
p->flow->sgh_toserver->filestore_cnt == 0))
{
FileDisableStoring(p->flow, STREAM_TOSERVER);
}
if (p->flow->sgh_toclient == NULL || p->flow->sgh_toclient->filestore_cnt == 0) {
FileDisableStoring(p->flow, STREAM_TOCLIENT);
}
/* check if this flow needs magic, if not disable it */
if (!(FileForceMagic())) {
if (p->flow->flags & FLOW_SGH_TOCLIENT && (p->flow->sgh_toclient == NULL ||
/* check if this flow needs magic, if not disable it */
if (!FileForceMagic() && (p->flow->sgh_toclient == NULL ||
!(p->flow->sgh_toclient->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)))
{
SCLogInfo("disabling magic for flow");
SCLogDebug("disabling magic for flow");
FileDisableMagic(p->flow, STREAM_TOCLIENT);
}
if (p->flow->flags & FLOW_SGH_TOSERVER && (p->flow->sgh_toserver == NULL ||
!(p->flow->sgh_toserver->flags & SIG_GROUP_HEAD_HAVEFILEMAGIC)))
{
SCLogInfo("disabling magic for flow");
FileDisableMagic(p->flow, STREAM_TOSERVER);
}
}
}

Loading…
Cancel
Save