Merge pull request #760 in SNORT/snort3 from file_reload to master

Squashed commit of the following:

commit 758044e06f1da69e4984fd3a5c7bf8ff46d73794
Author: huica <huica@cisco.com>
Date:   Fri Dec 16 10:13:26 2016 -0500

    Add file inspector to avoid reload issues

diff --git a/src/file_api/CMakeLists.txt b/src/file_api/CMakeLists.txt
index c6c1ab4a6c90a33291a035366032c30df7f3ddd1..26b04a8b8c83b73dc5a4be5329417f0b0b6a4d1f 100644 (file)
--- a/src/file_api/CMakeLists.txt
+++ b/src/file_api/CMakeLists.txt
@@ -5,7 +5,8 @@ set( FILE_API_INCLUDES
     file_cache.h 
     file_flows.h
     file_identifier.h 
-    file_lib.h 
+    file_lib.h
+    file_module.h 
     file_policy.h
     file_segment.h
     file_service.h 

diff --git a/src/file_api/Makefile.am b/src/file_api/Makefile.am
index d91c2f3f63755f66e718836c0f23ed0e9b022388..33d8a6d491787bbb5b6634e4a9ef9713f08802c5 100644 (file)
--- a/src/file_api/Makefile.am
+++ b/src/file_api/Makefile.am
@@ -9,6 +9,7 @@ file_config.h \
 file_flows.h \
 file_identifier.h \
 file_lib.h \
+file_module.h \
 file_policy.h \
 file_segment.h \
 file_service.h

diff --git a/src/file_api/file_capture.cc b/src/file_api/file_capture.cc
index fe902e150142aac9869f527fbc21d6b30f8cddbb..127e353ba6364cdfe6bb6dd54be2ac9a3d6c2273 100644 (file)
--- a/src/file_api/file_capture.cc
+++ b/src/file_api/file_capture.cc
@@ -48,6 +48,7 @@
 #include "file_stats.h"
 
 FileMemPool* FileCapture::file_mempool = nullptr;
+int64_t FileCapture::capture_block_size = 0;
 
 std::mutex FileCapture::capture_mutex;
 std::condition_variable FileCapture::capture_cv;
@@ -82,7 +83,7 @@ void FileCapture::writer_thread()
     }
 }
 
-FileCapture::FileCapture()
+FileCapture::FileCapture(int64_t min_size, int64_t max_size)
 {
     reserved = 0;
     capture_size = 0;
@@ -90,6 +91,8 @@ FileCapture::FileCapture()
     current_data = nullptr;
     current_data_len = 0;
     capture_state = FILE_CAPTURE_SUCCESS;
+    capture_min_size = min_size;
+    capture_max_size = max_size;
 }
 
 FileCapture::~FileCapture()
@@ -126,10 +129,10 @@ FileCapture::~FileCapture()
         delete file_info;
 }
 
-void FileCapture::init()
+void FileCapture::init(int64_t memcap, int64_t block_size)
 {
-    FileConfig& file_config = snort_conf->file_config;
-    init_mempool(file_config.capture_memcap, file_config.capture_block_size);
+    capture_block_size = block_size;
+    init_mempool(memcap, capture_block_size);
     file_storer = new std::thread(writer_thread);
 }
 
@@ -217,7 +220,6 @@ inline FileCaptureState FileCapture::save_to_file_buffer(const uint8_t* file_dat
 {
     FileCaptureBlock* lastBlock = last;
     int64_t available_bytes;
-    FileConfig& file_config =  snort_conf->file_config;
 
     if ( data_size + (int64_t)capture_size > max_size)
     {
@@ -228,7 +230,7 @@ inline FileCaptureState FileCapture::save_to_file_buffer(const uint8_t* file_dat
     }
 
     /* Check whether current file block can hold file data*/
-    available_bytes = file_config.capture_block_size - lastBlock->length;
+    available_bytes = capture_block_size - lastBlock->length;
 
     if ( data_size > available_bytes)
     {
@@ -240,7 +242,7 @@ inline FileCaptureState FileCapture::save_to_file_buffer(const uint8_t* file_dat
         memcpy((uint8_t*)lastBlock + lastBlock->length + sizeof (*lastBlock),
             file_current, available_bytes);
 
-        lastBlock->length = file_config.capture_block_size;
+        lastBlock->length = capture_block_size;
         file_current += available_bytes;
 
         /* We can support any file capture block size */
@@ -259,12 +261,12 @@ inline FileCaptureState FileCapture::save_to_file_buffer(const uint8_t* file_dat
             last = new_block;
 
             /*Save data to the new block*/
-            if (file_current + file_config.capture_block_size < file_end)
+            if (file_current + capture_block_size < file_end)
             {
                 memcpy((uint8_t*)last + sizeof(*new_block),
-                    file_current,  file_config.capture_block_size);
-                new_block->length =  file_config.capture_block_size;
-                file_current += file_config.capture_block_size;
+                    file_current,  capture_block_size);
+                new_block->length =  capture_block_size;
+                file_current += capture_block_size;
             }
             else
             {
@@ -307,8 +309,6 @@ inline FileCaptureState FileCapture::save_to_file_buffer(const uint8_t* file_dat
 FileCaptureState FileCapture::process_buffer(const uint8_t* file_data,
     int data_size, FilePosition position)
 {
-    FileConfig& file_config =  snort_conf->file_config;
-
     current_data = file_data;
     current_data_len = data_size;
 
@@ -337,7 +337,7 @@ FileCaptureState FileCapture::process_buffer(const uint8_t* file_data,
             file_counts.files_buffered_total++;
         }
 
-        return (save_to_file_buffer(file_data, data_size, file_config.capture_max_size));
+        return (save_to_file_buffer(file_data, data_size, capture_max_size));
     }
 
     return FILE_CAPTURE_SUCCESS;
@@ -348,8 +348,6 @@ FileCaptureState FileCapture::reserve_file(const FileInfo* file)
 {
     uint64_t fileSize;
 
-    FileConfig& file_config =  snort_conf->file_config;
-
     if (capture_state != FILE_CAPTURE_SUCCESS)
     {
         return error_capture(capture_state);
@@ -362,13 +360,13 @@ FileCaptureState FileCapture::reserve_file(const FileInfo* file)
      */
     fileSize = file->get_file_size();
 
-    if ( fileSize < (unsigned)file_config.capture_min_size)
+    if ( fileSize < (unsigned)capture_min_size)
     {
         file_counts.file_size_min++;
         return error_capture(FILE_CAPTURE_MIN);
     }
 
-    if ( fileSize > (unsigned)file_config.capture_max_size)
+    if ( fileSize > (unsigned)capture_max_size)
     {
         file_counts.file_size_max++;
         return error_capture(FILE_CAPTURE_MAX);
@@ -398,7 +396,7 @@ FileCaptureState FileCapture::reserve_file(const FileInfo* file)
 
     /*Copy the last piece of file to file buffer*/
     if (save_to_file_buffer(current_data,
-            current_data_len, file_config.capture_max_size) )
+            current_data_len, capture_max_size) )
     {
         return error_capture(capture_state);
     }

diff --git a/src/file_api/file_capture.h b/src/file_api/file_capture.h
index 60a3f6486449ee9adc250934e5196025cabcc815..c023a9325ef2bab5ef4b6202c66d57443082687a 100644 (file)
--- a/src/file_api/file_capture.h
+++ b/src/file_api/file_capture.h
@@ -50,11 +50,11 @@ struct FileCaptureBlock
 class FileCapture
 {
 public:
-    FileCapture();
+    FileCapture(int64_t capture_min_size, int64_t capture_max_size);
     ~FileCapture();
 
     // this must be called during snort init
-    static void init();
+    static void init(int64_t memcap, int64_t block_size);
 
     // Capture file data to local buffer
     // This is the main function call to enable file capture
@@ -93,6 +93,8 @@ public:
 
     static FileCaptureState error_capture(FileCaptureState);
 
+    static int64_t get_block_size() { return capture_block_size; };
+
 private:
 
     static void init_mempool(int64_t max_file_mem, int64_t block_size);
@@ -103,6 +105,7 @@ private:
     void write_file_data(uint8_t* buf, size_t buf_len, FILE* fh);
 
     static FileMemPool* file_mempool;
+    static int64_t capture_block_size;
     static std::mutex capture_mutex;
     static std::condition_variable capture_cv;
     static std::thread* file_storer;
@@ -118,6 +121,8 @@ private:
     uint32_t current_data_len;
     FileCaptureState capture_state;
     FileInfo* file_info = nullptr;
+    int64_t capture_min_size;
+    int64_t capture_max_size;
 };
 
 #endif

diff --git a/src/file_api/file_config.cc b/src/file_api/file_config.cc
index 914d8f9d602f102e2eba4571d6142ab27269afeb..74b19e441c1cc67e843bc45f5123a1e6cae14b54 100644 (file)
--- a/src/file_api/file_config.cc
+++ b/src/file_api/file_config.cc
@@ -30,8 +30,11 @@
 #endif
 
 #include "main/snort_config.h"
+#include "managers/inspector_manager.h"
 #include "parser/parse_utils.h"
 
+#include "file_flows.h"
+
 bool FileConfig::process_file_magic(FileMagicData& magic)
 {
     bool negated = false;
@@ -86,6 +89,19 @@ std::string FileConfig::file_type_name(uint32_t id)
 
 std::string file_type_name(uint32_t id)
 {
-    return snort_conf->file_config.file_type_name(id);
+    FileConfig* conf = get_file_config();
+    if (conf)
+        return conf->file_type_name(id);
+    else
+        return "NA";
 }
 
+FileConfig* get_file_config ()
+{
+    FileInspect* fi = (FileInspect*)InspectorManager::get_inspector(FILE_ID_NAME);
+
+    if (fi)
+        return (fi->config);
+    else
+        return nullptr;
+}

diff --git a/src/file_api/file_config.h b/src/file_api/file_config.h
index 678faa92e997f52b89d21e25a35445f90d7fd219..0436e0e6cddbc2e198a8eee7fb574125d8c63a5c 100644 (file)
--- a/src/file_api/file_config.h
+++ b/src/file_api/file_config.h
@@ -38,6 +38,9 @@
 #define DEFAULT_FILE_CAPTURE_BLOCK_SIZE     32768       // 32 KiB
 #define DEFAULT_MAX_FILES_CACHED            65536
 
+#define FILE_ID_NAME "file_id"
+#define FILE_ID_HELP "configure file identification"
+
 class FileConfig
 {
 public:
@@ -72,6 +75,6 @@ private:
 };
 
 std::string file_type_name(uint32_t id);
-
+FileConfig* get_file_config ();
 #endif
 

diff --git a/src/file_api/file_enforcer.cc b/src/file_api/file_enforcer.cc
index 808f0f59c285c41b47c6478a14a395fcd16c509b..536cf01829af22836f25e544999398ff16513efd 100644 (file)
--- a/src/file_api/file_enforcer.cc
+++ b/src/file_api/file_enforcer.cc
@@ -62,12 +62,9 @@ void FileEnforcer::update_file_node(FileNode* node, FileInfo* file)
     *(node->file) = *file;
 }
 
-FileVerdict FileEnforcer::check_verdict(Flow* flow, FileNode* node, SFXHASH_NODE* hash_node)
+FileVerdict FileEnforcer::check_verdict(Flow* flow, FileNode* node,
+    SFXHASH_NODE* hash_node, FilePolicy& inspect)
 {
-    // Query the file policy in case verdict has been changed
-    // Check file type first
-    FilePolicy& inspect = FileService::get_inspect();
-
     assert(node->file);
 
     FileVerdict verdict = inspect.type_lookup(flow, node->file);
@@ -184,7 +181,8 @@ bool FileEnforcer::apply_verdict(Flow* flow, FileInfo* file, FileVerdict verdict
     return false;
 }
 
-FileVerdict FileEnforcer::cached_verdict_lookup(Flow* flow, FileInfo* file)
+FileVerdict FileEnforcer::cached_verdict_lookup(Flow* flow, FileInfo* file,
+    FilePolicy& inspect)
 {
     FileVerdict verdict = FILE_VERDICT_UNKNOWN;
     SFXHASH_NODE* hash_node;
@@ -228,7 +226,7 @@ FileVerdict FileEnforcer::cached_verdict_lookup(Flow* flow, FileInfo* file)
             return verdict;
         }
         /*Query the file policy in case verdict has been changed*/
-        verdict = check_verdict(flow, node, hash_node);
+        verdict = check_verdict(flow, node, hash_node, inspect);
     }
 
     return verdict;

diff --git a/src/file_api/file_enforcer.h b/src/file_api/file_enforcer.h
index abac40bf8fec2cef8e8fe96bf9d94c703e7e9285..a90016dab7e0109d49f5da1f504070c9fa3c1d0e 100644 (file)
--- a/src/file_api/file_enforcer.h
+++ b/src/file_api/file_enforcer.h
@@ -31,6 +31,7 @@
 #include "utils/cpp_macros.h"
 
 #include "file_config.h"
+#include "file_policy.h"
 
 class FileInfo;
 
@@ -48,7 +49,7 @@ public:
 
     FileEnforcer();
     ~FileEnforcer();
-    FileVerdict cached_verdict_lookup(Flow*, FileInfo*);
+    FileVerdict cached_verdict_lookup(Flow*, FileInfo*, FilePolicy&);
     bool apply_verdict(Flow*, FileInfo*, FileVerdict);
 
 private:
@@ -64,7 +65,7 @@ PADDING_GUARD_BEGIN
 PADDING_GUARD_END
 
     void update_file_node(FileNode*, FileInfo*);
-    FileVerdict check_verdict(Flow*, FileNode*, SFXHASH_NODE*);
+    FileVerdict check_verdict(Flow*, FileNode*, SFXHASH_NODE*, FilePolicy&);
     int store_verdict(Flow*, FileInfo*);
 
     /* The hash table of expected files */

diff --git a/src/file_api/file_flows.cc b/src/file_api/file_flows.cc
index 409068fb51cbc568cf1adac7b679beb6345e6d03..0e0a4be92e1ecccea2b888ae3be6177ec0504298 100644 (file)
--- a/src/file_api/file_flows.cc
+++ b/src/file_api/file_flows.cc
@@ -29,9 +29,11 @@
 #include "config.h"
 #endif
 
+#include "managers/inspector_manager.h"
 #include "protocols/packet.h"
 
 #include "file_cache.h"
+#include "file_config.h"
 #include "file_lib.h"
 #include "file_service.h"
 
@@ -240,3 +242,65 @@ FilePosition get_file_position(Packet* pkt)
     return position;
 }
 
+FileInspect::FileInspect(FileIdModule* fm)
+{
+    fm->fc.get_file_policy().load();
+    config = &(fm->fc);
+}
+
+static Module* mod_ctor()
+{ return new FileIdModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static void file_init()
+{
+    FileFlows::init();
+}
+
+static void file_term()
+{
+}
+
+static Inspector* file_ctor(Module* m)
+{
+    FileIdModule* mod = (FileIdModule*)m;
+    return new FileInspect(mod);
+}
+
+static void file_dtor(Inspector* p)
+{
+    delete p;
+}
+
+static const InspectApi file_inspect_api =
+{
+    {
+        PT_INSPECTOR,
+        sizeof(InspectApi),
+        INSAPI_VERSION,
+        0,
+        API_RESERVED,
+        API_OPTIONS,
+        FILE_ID_NAME,
+        FILE_ID_HELP,
+        mod_ctor,
+        mod_dtor
+    },
+    IT_PASSIVE,
+    (uint16_t)PktType::NONE,
+    nullptr,
+    "file",
+    file_init,
+    file_term,
+    nullptr, // tinit
+    nullptr, // tterm
+    file_ctor,
+    file_dtor,
+    nullptr, // ssn
+    nullptr  // reset
+};
+
+const BaseApi* sin_file = &file_inspect_api.base;
+

diff --git a/src/file_api/file_flows.h b/src/file_api/file_flows.h
index 096bbac0ad8fe35962642df5f2828bd3571ef30f..c9d7a04da22c995e25684261a5d36ffa2080f647 100644 (file)
--- a/src/file_api/file_flows.h
+++ b/src/file_api/file_flows.h
@@ -27,9 +27,11 @@
 #include "main/snort_types.h"
 
 #include "file_api.h"
+#include "file_module.h"
 
 class FileContext;
 class Flow;
+class FileConfig;
 
 class SO_PUBLIC FileFlows : public FlowData
 {
@@ -76,5 +78,15 @@ private:
     uint64_t current_file_id = 0;
     Flow* flow = nullptr;
 };
+
+class FileInspect : public Inspector
+{
+public:
+    FileInspect(FileIdModule*);
+    void eval(Packet*) override { }
+
+    FileConfig* config;
+};
+
 #endif
 

diff --git a/src/file_api/file_lib.cc b/src/file_api/file_lib.cc
index bdc22b07b150168a9b8889f46f321db2afd7835a..6472a42d076427460f7902003fca2f0efc6fab7d 100644 (file)
--- a/src/file_api/file_lib.cc
+++ b/src/file_api/file_lib.cc
@@ -35,11 +35,13 @@
 #include "hash/hashes.h"
 #include "framework/data_bus.h"
 #include "main/snort_config.h"
+#include "managers/inspector_manager.h"
 #include "utils/util.h"
 
 #include "file_capture.h"
 #include "file_config.h"
 #include "file_enforcer.h"
+#include "file_flows.h"
 #include "file_service.h"
 #include "file_segment.h"
 #include "file_stats.h"
@@ -167,9 +169,10 @@ FileContext::FileContext ()
 {
     file_type_context = nullptr;
     file_signature_context = nullptr;
-    file_config = &(snort_conf->file_config);
     file_capture = nullptr;
     file_segments = nullptr;
+    inspector = (FileInspect*)InspectorManager::acquire(FILE_ID_NAME, snort_conf);
+    file_config = inspector->config;
 }
 
 FileContext::~FileContext ()
@@ -180,6 +183,7 @@ FileContext::~FileContext ()
         stop_file_capture();
     if (file_segments)
         delete file_segments;
+    InspectorManager::release(inspector);
 }
 
 inline int FileContext::get_data_size_from_depth_limit(FileProcessType type, int
@@ -187,9 +191,6 @@ inline int FileContext::get_data_size_from_depth_limit(FileProcessType type, int
 {
     uint64_t max_depth;
 
-    if (!file_config)
-        return data_size;
-
     switch (type)
     {
     case SNORT_FILE_TYPE_ID:
@@ -241,7 +242,7 @@ void FileContext::log_file_event(Flow* flow)
         default:
             break;
         }
-        if ( snort_conf->file_config.trace_type )
+        if ( file_config->trace_type )
             print(std::cout);
     }
 }
@@ -250,7 +251,7 @@ FileVerdict FileContext::file_signature_lookup(Flow* flow)
 {
     if (get_file_sig_sha256() && is_file_signature_enabled())
     {
-        FilePolicy& inspect = FileService::get_inspect();
+        FilePolicy& inspect = file_config->get_file_policy();
         return inspect.signature_lookup(flow, this);
     }
     else
@@ -262,7 +263,7 @@ void FileContext::finish_signature_lookup(Flow* flow)
     if (get_file_sig_sha256())
     {
         //Check file type based on file policy
-        FilePolicy& inspect = FileService::get_inspect();
+        FilePolicy& inspect = file_config->get_file_policy();
         inspect.signature_lookup(flow, this);
         log_file_event(flow);
         config_file_signature(false);
@@ -274,7 +275,7 @@ void FileContext::check_policy(Flow* flow, FileDirection dir)
 {
     file_counts.files_total++;
     set_file_direction(dir);
-    FilePolicy& inspect = FileService::get_inspect();
+    FilePolicy& inspect = file_config->get_file_policy();
     inspect.policy_check(flow, this);
 }
 
@@ -286,10 +287,10 @@ void FileContext::check_policy(Flow* flow, FileDirection dir)
 bool FileContext::process(Flow* flow, const uint8_t* file_data, int data_size,
     FilePosition position)
 {
-    if ( snort_conf->file_config.trace_stream )
+    if ( file_config->trace_stream )
     {
         FileContext::print_file_data(stdout, file_data, data_size,
-            snort_conf->file_config.show_data_depth);
+            file_config->show_data_depth);
     }
 
     file_counts.file_data_total += data_size;
@@ -300,8 +301,8 @@ bool FileContext::process(Flow* flow, const uint8_t* file_data, int data_size,
         return false;
     }
 
-    if ((FileService::get_file_enforcer()->cached_verdict_lookup(flow, this)
-            != FILE_VERDICT_UNKNOWN))
+    if ((FileService::get_file_enforcer()->cached_verdict_lookup(flow, this,
+        file_config->get_file_policy()) != FILE_VERDICT_UNKNOWN))
         return true;
 
     /*file type id*/
@@ -324,7 +325,7 @@ bool FileContext::process(Flow* flow, const uint8_t* file_data, int data_size,
             config_file_type(false);
             file_stats->files_processed[get_file_type()][get_file_direction()]++;
             //Check file type based on file policy
-            FilePolicy& inspect = FileService::get_inspect();
+            FilePolicy& inspect = file_config->get_file_policy();
             inspect.type_lookup(flow, this);
             log_file_event(flow);
         }
@@ -341,7 +342,7 @@ bool FileContext::process(Flow* flow, const uint8_t* file_data, int data_size,
 
         update_file_size(data_size, position);
 
-        if ( snort_conf->file_config.trace_signature )
+        if ( file_config->trace_signature )
             print_file_sha256(std::cout);
 
         /*Fails to capture, when out of memory or size limit, need lookup*/
@@ -382,9 +383,6 @@ void FileContext::process_file_type(const uint8_t* file_data, int size, FilePosi
 {
     int data_size;
 
-    if (!file_config)
-        return;
-
     /* file type already found and no magics to continue*/
     if (file_type_id && !file_type_context)
         return;
@@ -460,7 +458,8 @@ FileCaptureState FileContext::process_file_capture(const uint8_t* file_data,
 {
     if (!file_capture)
     {
-        file_capture = new FileCapture;
+        file_capture = new FileCapture(file_config->capture_min_size,
+            file_config->capture_max_size);
     }
 
     file_state.capture_state =

diff --git a/src/file_api/file_lib.h b/src/file_api/file_lib.h
index 34d4648a9445fe7c9117b1890b9f04bb860780c8..e0f7acfeb65a80323a0b8158ea702e33207233ed 100644 (file)
--- a/src/file_api/file_lib.h
+++ b/src/file_api/file_lib.h
@@ -36,6 +36,7 @@ class FileCapture;
 class FileConfig;
 class FileSegments;
 class Flow;
+class FileInspect;
 
 class SO_PUBLIC FileInfo
 {
@@ -125,6 +126,7 @@ private:
     void* file_type_context;
     void* file_signature_context;
     FileConfig* file_config;
+    FileInspect* inspector;
     FileCapture* file_capture;
     FileSegments* file_segments;
     FileState file_state = { FILE_CAPTURE_SUCCESS, FILE_SIG_PROCESSING };

diff --git a/src/file_api/file_log.cc b/src/file_api/file_log.cc
index 2316460a6bd5423a76f01ae2e785812d1f0b26e9..0d52e2bca9bbf6f96dd2bce1837618945a8f1bf6 100644 (file)
--- a/src/file_api/file_log.cc
+++ b/src/file_api/file_log.cc
@@ -302,9 +302,12 @@ static const InspectApi fl_api
     nullptr  // reset
 };
 
+extern const BaseApi* sin_file;
+
 const BaseApi* file_inspectors[] =
 {
     &fl_api.base,
+    sin_file,
     nullptr
 };
 

diff --git a/src/file_api/file_module.cc b/src/file_api/file_module.cc
index 3ad59c51fea70b95dad60f6adfb41514a1175104..3e97c140ce6588a1a1ad01aa589e306cd5dc6f48 100644 (file)
--- a/src/file_api/file_module.cc
+++ b/src/file_api/file_module.cc
@@ -178,10 +178,7 @@ static const PegInfo file_pegs[] =
     { nullptr, nullptr }
 };
 
-#define file_id_help \
-    "configure file identification"
-
-FileIdModule::FileIdModule() : Module("file_id", file_id_help, file_id_params) { }
+FileIdModule::FileIdModule() : Module(FILE_ID_NAME, FILE_ID_HELP, file_id_params) { }
 
 const PegInfo* FileIdModule::get_pegs() const
 { return file_pegs; }
@@ -195,10 +192,8 @@ void FileIdModule::sum_stats()
     Module::sum_stats();
 }
 
-bool FileIdModule::set(const char*, Value& v, SnortConfig* sc)
+bool FileIdModule::set(const char*, Value& v, SnortConfig*)
 {
-    FileConfig& fc = sc->file_config;
-
     FilePolicy& fp = fc.get_file_policy();
 
     if ( v.is("type_depth") )
@@ -348,10 +343,8 @@ bool FileIdModule::begin(const char* fqn, int idx, SnortConfig*)
     return true;
 }
 
-bool FileIdModule::end(const char* fqn, int idx, SnortConfig* sc)
+bool FileIdModule::end(const char* fqn, int idx, SnortConfig*)
 {
-    FileConfig& fc = sc->file_config;
-
     if (!idx)
         return true;
 

diff --git a/src/file_api/file_module.h b/src/file_api/file_module.h
index 27d393d436fef2270adb95729a0be3aee8a59a21..7d5a5030d00403557623daec9b4e4c75223c03bb 100644 (file)
--- a/src/file_api/file_module.h
+++ b/src/file_api/file_module.h
@@ -24,6 +24,7 @@
 
 #include "framework/module.h"
 
+#include "file_config.h"
 #include "file_identifier.h"
 #include "file_policy.h"
 
@@ -45,6 +46,8 @@ public:
 
     void sum_stats() override;
 
+    FileConfig fc;
+
 private:
     FileMagicRule rule;
     FileMagicData magic;

diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc
index 5cbefbaf1c63ad5a66fcdf6d86cec20d313a2950..ae8a02d2b7d504a1f8ea250b1b23dbc491661eb9 100644 (file)
--- a/src/file_api/file_service.cc
+++ b/src/file_api/file_service.cc
@@ -53,12 +53,13 @@ void FileService::init()
 
 void FileService::post_init()
 {
-    FilePolicy& fp  = get_inspect();
+    FileConfig* conf = get_file_config();
 
-    fp.load();
+    if (!conf)
+        return;
 
     if (file_capture_enabled)
-        FileCapture::init();
+        FileCapture::init(conf->capture_memcap, conf->capture_block_size);
 }
 
 void FileService::close()
@@ -126,29 +127,32 @@ bool FileService::is_file_service_enabled()
  */
 int64_t FileService::get_max_file_depth()
 {
-    FileConfig& file_config =  snort_conf->file_config;
+    FileConfig* file_config = get_file_config();
 
-    if (file_config.file_depth)
-        return file_config.file_depth;
+    if (!file_config)
+        return -1;
+
+    if (file_config->file_depth)
+        return file_config->file_depth;
 
-    file_config.file_depth = -1;
+    file_config->file_depth = -1;
 
     if (file_type_id_enabled)
     {
-        file_config.file_depth = file_config.file_type_depth;
+        file_config->file_depth = file_config->file_type_depth;
     }
 
     if (file_signature_enabled)
     {
-        if (file_config.file_signature_depth > file_config.file_depth)
-            file_config.file_depth = file_config.file_signature_depth;
+        if (file_config->file_signature_depth > file_config->file_depth)
+            file_config->file_depth = file_config->file_signature_depth;
     }
 
-    if (file_config.file_depth > 0)
+    if (file_config->file_depth > 0)
     {
         /*Extra byte for deciding whether file data will be over limit*/
-        file_config.file_depth++;
-        return (file_config.file_depth);
+        file_config->file_depth++;
+        return (file_config->file_depth);
     }
     else
     {
@@ -156,11 +160,6 @@ int64_t FileService::get_max_file_depth()
     }
 }
 
-FilePolicy& FileService::get_inspect()
-{
-    return (snort_conf->file_config.get_file_policy());
-}
-
 uint64_t get_file_processed_size(Flow* flow)
 {
     FileFlows* file_flows = FileFlows::get_file_flows(flow);

diff --git a/src/file_api/file_service.h b/src/file_api/file_service.h
index 6e180faf0657b31a98e315cbe9508d627ae54339..7392ede5b1921d5d3c8d78b122b4280abbaecbed 100644 (file)
--- a/src/file_api/file_service.h
+++ b/src/file_api/file_service.h
@@ -54,7 +54,6 @@ public:
     static bool is_file_service_enabled();
     static int64_t get_max_file_depth();
 
-    static FilePolicy& get_inspect();
     static FileEnforcer* get_file_enforcer() { return file_enforcer; }
     static FileCache* get_file_cache() { return file_cache; }
 

diff --git a/src/main/modules.cc b/src/main/modules.cc
index a47396474bcb428af9839e022db900acd63d7637..0ffa2a8e8874b89f53b1235bb899a25bd5a6865a 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -1708,7 +1708,6 @@ void module_init()
 
     // these modules could be in traffic policy
     ModuleManager::add_module(new ActiveModule);
-    ModuleManager::add_module(new FileIdModule);
 
     ModuleManager::add_module(new LatencyModule);
 

diff --git a/src/mime/file_mime_config.cc b/src/mime/file_mime_config.cc
index 854c44bf59d29e0c3c579ea1e46053162864b4f6..a2864203c1a5b0b879770ccdf859105d3090a974 100644 (file)
--- a/src/mime/file_mime_config.cc
+++ b/src/mime/file_mime_config.cc
@@ -28,11 +28,6 @@
 
 #include "file_mime_process.h"
 
-DecodeConfig::DecodeConfig()
-{
-    sync_all_depths();
-}
-
 void DecodeConfig::set_ignore_data(bool ignored)
 {
     ignore_data = ignored;

diff --git a/src/mime/file_mime_config.h b/src/mime/file_mime_config.h
index f3d2b8a09bba983fd4484361f7b581131919015c..e50f93679da575912089511e25a85fac98598d8d 100644 (file)
--- a/src/mime/file_mime_config.h
+++ b/src/mime/file_mime_config.h
@@ -38,7 +38,6 @@
 class SO_PUBLIC DecodeConfig
 {
 public:
-    DecodeConfig();
     void set_ignore_data(bool);
     bool is_ignore_data();
     void set_max_mime_mem(int);