From: Victor Julien <vjulien@oisf.net>
Date: Wed, 12 Jul 2023 06:25:28 +0000 (+0200)
Subject: detect/filemagic: fix thread ctx registration; reloads
X-Git-Tag: suricata-7.0.0~38
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2cac440f7d062aa54dbff54712087eecce5c7437;p=thirdparty%2Fsuricata.git

detect/filemagic: fix thread ctx registration; reloads

Make sure thread ctx registration happens and id remains correct
in case of reloads.

To do so, move id var into the detect ctx.
---

diff --git a/src/detect-engine.c b/src/detect-engine.c
index 111dab7f0d..d11e6ed1a4 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -2468,6 +2468,7 @@ static DetectEngineCtx *DetectEngineCtxInitReal(enum DetectEngineType type, cons
     TAILQ_INIT(&de_ctx->sig_stat.failed_sigs);
     de_ctx->sigerror = NULL;
     de_ctx->type = type;
+    de_ctx->filemagic_thread_ctx_id = -1;
 
     if (type == DETECT_ENGINE_TYPE_DD_STUB || type == DETECT_ENGINE_TYPE_MT_STUB) {
         de_ctx->version = DetectEngineGetVersion();
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index f7ff87c999..4b8905bc73 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -96,8 +96,6 @@ static uint8_t DetectEngineInspectFilemagic(DetectEngineCtx *de_ctx, DetectEngin
         const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags,
         void *alstate, void *txv, uint64_t tx_id);
 
-static int g_magic_thread_ctx_id = -1;
-
 /**
  * \brief Registration function for keyword: filemagic
  */
@@ -247,10 +245,10 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
                 de_ctx, s, NULL, DETECT_FILE_MAGIC, g_file_magic_buffer_id, s->alproto) < 0)
         return -1;
 
-    if (g_magic_thread_ctx_id == -1) {
-        g_magic_thread_ctx_id = DetectRegisterThreadCtxFuncs(
+    if (de_ctx->filemagic_thread_ctx_id == -1) {
+        de_ctx->filemagic_thread_ctx_id = DetectRegisterThreadCtxFuncs(
                 de_ctx, "filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
-        if (g_magic_thread_ctx_id == -1)
+        if (de_ctx->filemagic_thread_ctx_id == -1)
             return -1;
     }
     return 0;
@@ -272,11 +270,10 @@ static int DetectFilemagicSetupSticky(DetectEngineCtx *de_ctx, Signature *s, con
     if (DetectBufferSetActiveList(de_ctx, s, g_file_magic_buffer_id) < 0)
         return -1;
 
-    if (g_magic_thread_ctx_id == -1) {
-        g_magic_thread_ctx_id = DetectRegisterThreadCtxFuncs(de_ctx, "filemagic",
-                DetectFilemagicThreadInit, NULL,
-                DetectFilemagicThreadFree, 1);
-        if (g_magic_thread_ctx_id == -1)
+    if (de_ctx->filemagic_thread_ctx_id == -1) {
+        de_ctx->filemagic_thread_ctx_id = DetectRegisterThreadCtxFuncs(
+                de_ctx, "filemagic", DetectFilemagicThreadInit, NULL, DetectFilemagicThreadFree, 1);
+        if (de_ctx->filemagic_thread_ctx_id == -1)
             return -1;
     }
     return 0;
@@ -296,7 +293,8 @@ static InspectionBuffer *FilemagicGetDataCallback(DetectEngineThreadCtx *det_ctx
 
     if (cur_file->magic == NULL) {
         DetectFilemagicThreadData *tfilemagic =
-            (DetectFilemagicThreadData *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, g_magic_thread_ctx_id);
+                (DetectFilemagicThreadData *)DetectThreadCtxGetKeywordThreadCtx(
+                        det_ctx, det_ctx->de_ctx->filemagic_thread_ctx_id);
         if (tfilemagic == NULL) {
             InspectionBufferSetupMultiEmpty(buffer);
             return NULL;
diff --git a/src/detect.h b/src/detect.h
index 0c26442ed5..7dd42a1477 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -876,6 +876,9 @@ typedef struct DetectEngineCtx_ {
     /* maximum recursion depth for content inspection */
     int inspection_recursion_limit;
 
+    /* registration id for per thread ctx for the filemagic/file.magic keywords */
+    int filemagic_thread_ctx_id;
+
     /* spm thread context prototype, built as spm matchers are constructed and
      * later used to construct thread context for each thread. */
     SpmGlobalThreadCtx *spm_global_thread_ctx;