Merge pull request #2898 in SNORT/snort3 from ~BSACHDEV/snort3:file_count to master

Squashed commit of the following:

commit 5cfba19416d2f864eb6fb9e1bc490ba66a499c4a
Author: bsachdev <bsachdev@cisco.com>
Date:   Fri May 21 07:23:10 2021 -0400

    file_api: increase file count only once per file

    Signed-off-by: bsachdev <bsachdev@cisco.com>

diff --git a/src/file_api/file_flows.cc b/src/file_api/file_flows.cc
index c5ce91bfd8257bc4a8b1397a9e1e1bd5233391f0..3e940bb119957fdb37e0d6661eb150c063bcbdef 100644 (file)
--- a/src/file_api/file_flows.cc
+++ b/src/file_api/file_flows.cc
@@ -309,7 +309,10 @@ bool FileFlows::file_process(Packet* p, uint64_t file_id, const uint8_t* file_da
 
     set_current_file_context(context);
 
-    if (!context->get_processed_bytes())
+    // Only increase file count when there are no queued segments
+    // This will ensure we only count a file once in case it has
+    // processed bytes 0 but many queued segments
+    if (!context->get_processed_bytes() and !context->segments_queued())
     {
         context->check_policy(flow, dir, file_policy);
         context->set_file_id(file_id);

diff --git a/src/file_api/file_lib.h b/src/file_api/file_lib.h
index 8476ee9459cc371e83ab7eab735d057682c87434..d250f3aa1d78d192b7e4a591e9b73c50864abfcf 100644 (file)
--- a/src/file_api/file_lib.h
+++ b/src/file_api/file_lib.h
@@ -140,6 +140,7 @@ public:
     char* get_UTF8_fname(size_t* converted_len);
     void set_not_cacheable() { cacheable = false; }
     bool is_cacheable() { return cacheable; }
+    bool segments_queued() { return (file_segments != nullptr); }
 
 private:
     uint64_t processed_bytes = 0;