file-inspection: inspect new files in same tx but opposite direction as well.

src/app-layer-htp-file.c

@@ -82,6 +82,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len,
     int retval = 0;
     uint8_t flags = 0;
     FileContainer *files = NULL;
+    FileContainer *files_opposite = NULL;
 
     SCLogDebug("data %p data_len %"PRIu32, data, data_len);
 
@@ -99,6 +100,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len,
         }
 
         files = s->files_tc;
+        files_opposite = s->files_ts;
 
         if (s->flags & HTP_FLAG_STORE_FILES_TS ||
                 (s->flags & HTP_FLAG_STORE_FILES_TX_TS && txid == s->store_tx_id)) {
@@ -114,6 +116,7 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len,
         }
 
         files = s->files_ts;
+        files_opposite = s->files_tc;
 
         if (s->flags & HTP_FLAG_STORE_FILES_TC ||
                 (s->flags & HTP_FLAG_STORE_FILES_TX_TC && txid == s->store_tx_id)) {
@@ -134,6 +137,17 @@ int HTPFileOpen(HtpState *s, uint8_t *filename, uint16_t filename_len,
             s->flags |= HTP_FLAG_NEW_FILE_TX_TS;
         }
     }
+    if (files_opposite != NULL && files_opposite->tail != NULL && files_opposite->tail->txid == txid) {
+        SCLogDebug("new file in same tx, flagging http state for de_state reset");
+
+        if (direction & STREAM_TOCLIENT) {
+            SCLogDebug("flagging TC");
+            s->flags |= HTP_FLAG_NEW_FILE_TX_TC;
+        } else {
+            SCLogDebug("flagging TS");
+            s->flags |= HTP_FLAG_NEW_FILE_TX_TS;
+        }
+    }
 
     if (!(flags & FILE_STORE) && s->f->flags & FLOW_FILE_NO_STORE) {
         flags |= FILE_NOSTORE;

src/detect-engine-state.c

@@ -710,19 +710,21 @@ int DeStateDetectContinueDetection(ThreadVars *tv, DetectEngineCtx *de_ctx, Dete
 
             /* if we already fully matched previously, detect that here */
             if (item->flags & DE_STATE_FLAG_FULL_MATCH) {
-                if (flags & STREAM_TOSERVER &&
+                /* check first if we have received new files in the livetime of
-                        item->flags & DE_STATE_FLAG_FILE_TS_INSPECT &&
+                 * this de_state (this tx). */
-                        f->de_state->flags & DE_STATE_FILE_TS_NEW)
+                if (item->flags & (DE_STATE_FLAG_FILE_TC_INSPECT|DE_STATE_FLAG_FILE_TS_INSPECT)) {
-                {
+                    if (flags & STREAM_TOCLIENT && f->de_state->flags & DE_STATE_FILE_TC_NEW) {
-                    /* new file, fall through */
-                    item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT;
-                } else if (flags & STREAM_TOCLIENT &&
-                        item->flags & DE_STATE_FLAG_FILE_TC_INSPECT &&
-                        f->de_state->flags & DE_STATE_FILE_TC_NEW)
-                {
-                    /* new file, fall through */
                         item->flags &= ~DE_STATE_FLAG_FILE_TC_INSPECT;
-                } else {
+                        item->flags &= ~DE_STATE_FLAG_FULL_MATCH;
+                    }
+
+                    if (flags & STREAM_TOSERVER && f->de_state->flags & DE_STATE_FILE_TS_NEW) {
+                        item->flags &= ~DE_STATE_FLAG_FILE_TS_INSPECT;
+                        item->flags &= ~DE_STATE_FLAG_FULL_MATCH;
+                    }
+                }
+
+                if (item->flags & DE_STATE_FLAG_FULL_MATCH) {
                     det_ctx->de_state_sig_array[item->sid] = DE_STATE_MATCH_FULL;
                     SCLogDebug("full match state");
                     continue;
@@ -1113,9 +1115,11 @@ static void DeStateResetFileInspection(Flow *f, uint16_t alproto, void *alstate)
     HtpState *htp_state = (HtpState *)alstate;
 
     if (htp_state->flags & HTP_FLAG_NEW_FILE_TX_TC) {
+        SCLogDebug("new file in the TC direction");
         htp_state->flags &= ~HTP_FLAG_NEW_FILE_TX_TC;
         f->de_state->flags |= DE_STATE_FILE_TC_NEW;
     } else if (htp_state->flags & HTP_FLAG_NEW_FILE_TX_TS) {
+        SCLogDebug("new file in the TS direction");
         htp_state->flags &= ~HTP_FLAG_NEW_FILE_TX_TS;
         f->de_state->flags |= DE_STATE_FILE_TS_NEW;
     }