filestore v2: print sid in json output

diff --git a/src/detect-filestore.c b/src/detect-filestore.c
index 5c474927c55336d297f3d19be76c6ab113ceabbf..b2f84d911444555591029f2fec67890b53d9a87a 100644 (file)
--- a/src/detect-filestore.c
+++ b/src/detect-filestore.c
@@ -264,8 +264,27 @@ static int DetectFilestoreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
      * matches. */
     if (file != NULL) {
         file_id = file->file_store_id;
+        if (file->sid != NULL && s->id > 0) {
+            if (file->sid_cnt >= file->sid_max) {
+                void *p = SCRealloc(file->sid, sizeof(uint32_t) * (file->sid_max + 8));
+                if (p == NULL) {
+                    SCFree(file->sid);
+                    file->sid = NULL;
+                    file->sid_cnt = 0;
+                    file->sid_max = 0;
+                    goto continue_after_realloc_fail;
+                } else {
+                    file->sid = p;
+                    file->sid_max += 8;
+                }
+            }
+            file->sid[file->sid_cnt] = s->id;
+            file->sid_cnt++;
+        }
     }
 
+continue_after_realloc_fail:
+
     det_ctx->filestore[det_ctx->filestore_cnt].file_id = file_id;
     det_ctx->filestore[det_ctx->filestore_cnt].tx_id = det_ctx->tx_id;
 

diff --git a/src/output-json-file.c b/src/output-json-file.c
index 18bd2adf7f00ef7391ce1b8fe781dcec43c0819e..25b05d959cadef3ca2f3382e2a7f1a1f102e5e2c 100644 (file)
--- a/src/output-json-file.c
+++ b/src/output-json-file.c
@@ -149,6 +149,18 @@ json_t *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
     char filename_string[filename_size];
     BytesToStringBuffer(ff->name, ff->name_len, filename_string, filename_size);
     json_object_set_new(fjs, "filename", SCJsonString(filename_string));
+
+    json_t *sig_ids = json_array();
+    if (unlikely(sig_ids == NULL)) {
+        json_decref(js);
+        return NULL;
+    }
+
+    for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
+        json_array_append(sig_ids, json_integer(ff->sid[i]));
+    }
+    json_object_set_new(fjs, "sid", sig_ids);
+
 #ifdef HAVE_MAGIC
     if (ff->magic)
         json_object_set_new(fjs, "magic", json_string((char *)ff->magic));

diff --git a/src/util-file.c b/src/util-file.c
index 4c2581982a9dd6c978cc929e87f6315240fafbf4..d3fd235ab02936f12db1b59bfed17bdd6a6cbd9b 100644 (file)
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -454,6 +454,13 @@ static File *FileAlloc(const uint8_t *name, uint16_t name_len)
     new->name_len = name_len;
     memcpy(new->name, name, name_len);
 
+    new->sid_cnt = 0;
+    new->sid_max = 8;
+    /* SCMalloc() is allowed to fail here because sid well be checked later on */
+    new->sid = SCMalloc(sizeof(uint32_t) * new->sid_max);
+    if (new->sid == NULL)
+        new->sid_max = 0;
+
     return new;
 }
 
@@ -464,6 +471,8 @@ static void FileFree(File *ff)
 
     if (ff->name != NULL)
         SCFree(ff->name);
+    if (ff->sid != NULL)
+        SCFree(ff->sid);
 #ifdef HAVE_MAGIC
     /* magic returned by libmagic is strdup'd by MagicLookup. */
     if (ff->magic != NULL)

diff --git a/src/util-file.h b/src/util-file.h
index 535e42ff17e758bba71a755e60a19c4d32243dd9..4f67e73d3f99512773103b7068302577e15b918a 100644 (file)
--- a/src/util-file.h
+++ b/src/util-file.h
@@ -89,6 +89,10 @@ typedef struct File_ {
                                      *   flag is set */
     uint64_t content_stored;
     uint64_t size;
+
+    uint32_t *sid; /* signature id of a rule that triggered the filestore event */
+    uint32_t sid_cnt;
+    uint32_t sid_max;
 } File;
 
 typedef struct FileContainer_ {