files: properly close files on flow timeout

If a file transfer stops on flow timeout, it won't be closed or
truncated. This patch makes sure that in such cases the files
are indeed truncated. This fixes the filestore-v2 output module,
as that requires a sha256 for storing the partial file correctly.

diff --git a/src/output-filedata.c b/src/output-filedata.c
index a407adca421eeb276bb220619fceec8c2230495a..1ec23539560b7307a23a68a29731cd1d0736dde4 100644 (file)
--- a/src/output-filedata.c
+++ b/src/output-filedata.c
@@ -152,6 +152,9 @@ static void OutputFiledataLogFfc(ThreadVars *tv, OutputLoggerThreadStore *store,
              * close the logger(s) */
             if (FileDataSize(ff) == ff->content_stored &&
                 (file_trunc || file_close)) {
+                if (ff->state < FILE_STATE_CLOSED) {
+                    FileCloseFilePtr(ff, NULL, 0, FILE_TRUNCATED);
+                }
                 CallLoggers(tv, store, p, ff, NULL, 0, OUTPUT_FILEDATA_FLAG_CLOSE);
                 ff->flags |= FILE_STORED;
                 continue;
@@ -171,7 +174,7 @@ static void OutputFiledataLogFfc(ThreadVars *tv, OutputLoggerThreadStore *store,
             /* if file needs to be closed or truncated, inform
              * loggers */
             if ((file_close || file_trunc) && ff->state < FILE_STATE_CLOSED) {
-                ff->state = FILE_STATE_TRUNCATED;
+                FileCloseFilePtr(ff, NULL, 0, FILE_TRUNCATED);
             }
 
             /* tell the logger we're closing up */

diff --git a/src/util-file.c b/src/util-file.c
index 2620758f6b54bd834101f3ce2fe46914cde8bea6..4c2581982a9dd6c978cc929e87f6315240fafbf4 100644 (file)
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -847,7 +847,7 @@ int FileOpenFileWithId(FileContainer *ffc, const StreamingBufferConfig *sbcfg,
     return 0;
 }
 
-static int FileCloseFilePtr(File *ff, const uint8_t *data,
+int FileCloseFilePtr(File *ff, const uint8_t *data,
         uint32_t data_len, uint16_t flags)
 {
     SCEnter();

diff --git a/src/util-file.h b/src/util-file.h
index 8de03699376033f0616c136e4e7d150cd8eee015..535e42ff17e758bba71a755e60a19c4d32243dd9 100644 (file)
--- a/src/util-file.h
+++ b/src/util-file.h
@@ -145,6 +145,8 @@ int FileCloseFile(FileContainer *, const uint8_t *data, uint32_t data_len,
         uint16_t flags);
 int FileCloseFileById(FileContainer *, uint32_t track_id,
         const uint8_t *data, uint32_t data_len, uint16_t flags);
+int FileCloseFilePtr(File *ff, const uint8_t *data,
+        uint32_t data_len, uint16_t flags);
 
 /**
  *  \brief Store a chunk of file data in the flow. The open "flowfile"