From 5aee386fa99c643602d311a986a9c09ca98cb0ed Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 9 Mar 2016 17:24:51 +0100 Subject: [PATCH] smtp: add file_data debug code --- src/detect-engine-filedata-smtp.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/src/detect-engine-filedata-smtp.c b/src/detect-engine-filedata-smtp.c index 2af1fe0dd2..5b8f8dca4c 100644 --- a/src/detect-engine-filedata-smtp.c +++ b/src/detect-engine-filedata-smtp.c @@ -88,6 +88,7 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, uint32_t *buffer_len, uint32_t *stream_start_offset) { + SCEnter(); int index = 0; uint8_t *buffer = NULL; *buffer_len = 0; @@ -108,7 +109,9 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, if (det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len != 0) { *buffer_len = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer_len; *stream_start_offset = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].offset; - return det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer; + buffer = det_ctx->smtp[(tx_id - det_ctx->smtp_start_tx_id)].buffer; + + SCReturnPtr(buffer, "uint8_t"); } } else { if (SMTPCreateSpace(det_ctx, (tx_id - det_ctx->smtp_start_tx_id) + 1) < 0) @@ -122,6 +125,11 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, index = (tx_id - det_ctx->smtp_start_tx_id); } + SCLogDebug("smtp_config.content_limit %u, smtp_config.content_inspect_min_size %u", + smtp_config.content_limit, smtp_config.content_inspect_min_size); + + SCLogDebug("file %p size %"PRIu64", state %d", curr_file, curr_file->content_len_so_far, curr_file->state); + /* no new data */ if (curr_file->content_inspected == curr_file->content_len_so_far) { SCLogDebug("no new data"); @@ -188,12 +196,15 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id, /* updat inspected tracker */ curr_file->content_inspected = curr_file->chunks_tail->stream_offset + curr_file->chunks_tail->len; + SCLogDebug("curr_file->content_inspected now %"PRIu64, curr_file->content_inspected); buffer = det_ctx->smtp[index].buffer; *buffer_len = det_ctx->smtp[index].buffer_len; *stream_start_offset = det_ctx->smtp[index].offset; + end: - return buffer; + SCLogDebug("buffer %p, len %u", buffer, *buffer_len); + SCReturnPtr(buffer, "uint8_t"); } int DetectEngineInspectSMTPFiledata(ThreadVars *tv,