|
|
|
@ -88,6 +88,7 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
|
|
|
|
|
uint32_t *buffer_len,
|
|
|
|
|
uint32_t *stream_start_offset)
|
|
|
|
|
{
|
|
|
|
|
SCEnter();
|
|
|
|
|
int index = 0;
|
|
|
|
|
uint8_t *buffer = NULL;
|
|
|
|
|
*buffer_len = 0;
|
|
|
|
@ -108,7 +109,9 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
|
|
|
|
|
if (det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len != 0) {
|
|
|
|
|
*buffer_len = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len;
|
|
|
|
|
*stream_start_offset = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].offset;
|
|
|
|
|
return det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer;
|
|
|
|
|
buffer = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer;
|
|
|
|
|
|
|
|
|
|
SCReturnPtr(buffer, "uint8_t");
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
if (SMTPCreateSpace(det_ctx, (tx_id - det_ctx->smtp_start_tx_id) + 1) < 0)
|
|
|
|
@ -122,6 +125,11 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
|
|
|
|
|
index = (tx_id - det_ctx->smtp_start_tx_id);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SCLogDebug("smtp_config.content_limit %u, smtp_config.content_inspect_min_size %u",
|
|
|
|
|
smtp_config.content_limit, smtp_config.content_inspect_min_size);
|
|
|
|
|
|
|
|
|
|
SCLogDebug("file %p size %"PRIu64", state %d", curr_file, curr_file->content_len_so_far, curr_file->state);
|
|
|
|
|
|
|
|
|
|
/* no new data */
|
|
|
|
|
if (curr_file->content_inspected == curr_file->content_len_so_far) {
|
|
|
|
|
SCLogDebug("no new data");
|
|
|
|
@ -188,12 +196,15 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
|
|
|
|
|
|
|
|
|
|
/* updat inspected tracker */
|
|
|
|
|
curr_file->content_inspected = curr_file->chunks_tail->stream_offset + curr_file->chunks_tail->len;
|
|
|
|
|
SCLogDebug("curr_file->content_inspected now %"PRIu64, curr_file->content_inspected);
|
|
|
|
|
|
|
|
|
|
buffer = det_ctx->smtp[index].buffer;
|
|
|
|
|
*buffer_len = det_ctx->smtp[index].buffer_len;
|
|
|
|
|
*stream_start_offset = det_ctx->smtp[index].offset;
|
|
|
|
|
|
|
|
|
|
end:
|
|
|
|
|
return buffer;
|
|
|
|
|
SCLogDebug("buffer %p, len %u", buffer, *buffer_len);
|
|
|
|
|
SCReturnPtr(buffer, "uint8_t");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int DetectEngineInspectSMTPFiledata(ThreadVars *tv,
|
|
|
|
|