]> git.ipfire.org Git - people/ms/suricata.git/commit
file extraction: always prune files after detect
authorJason Ish <jason.ish@oisf.net>
Mon, 7 Oct 2019 22:20:02 +0000 (16:20 -0600)
committerVictor Julien <victor@inliniac.net>
Tue, 8 Oct 2019 18:30:49 +0000 (20:30 +0200)
commitebcc4db84ac2c1957a6cc23b5154d7d6333f4cb8
tree4beb22e88790461d34457ab0868681e1cbfb06f2
parentc7e4433fe942e440a47d7b14417b3bd4769b0db7
file extraction: always prune files after detect

If a keyword like filemd5 was being used without a filestore,
or a file output enabled, it would be pruned before detection
had a chance to match.

Consolidate file pruning to the end of the flow worker so files
are available for detection even when a file output is not
enabled.

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/2490
src/app-layer-ftp.c
src/app-layer-htp-file.c
src/app-layer-smtp.c
src/flow-worker.c
src/output-file.c
src/output-filedata.c