From: Victor Julien <victor@inliniac.net>
Date: Tue, 14 Aug 2018 07:21:04 +0000 (+0200)
Subject: files: only prune in own direction
X-Git-Tag: suricata-4.1.0-rc2~129
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39ca1db8e8042a384c4fee4575aac2307470e7ee;p=thirdparty%2Fsuricata.git

files: only prune in own direction

Only prune files in own direction. The opposite direction may still
require inspection.
---

diff --git a/src/output-file.c b/src/output-file.c
index b47e76aea3..fdded0572e 100644
--- a/src/output-file.c
+++ b/src/output-file.c
@@ -144,8 +144,6 @@ static void OutputFileLogFfc(ThreadVars *tv,
                 }
             }
         }
-
-        FilePrune(ffc);
     }
 }
 
@@ -180,6 +178,11 @@ static TmEcode OutputFileLog(ThreadVars *tv, Packet *p, void *thread_data)
     OutputFileLogFfc(tv, op_thread_data, p, ffc_ts, file_close_ts, file_trunc, STREAM_TOSERVER);
     OutputFileLogFfc(tv, op_thread_data, p, ffc_tc, file_close_tc, file_trunc, STREAM_TOCLIENT);
 
+    if (ffc_ts && (p->flowflags & FLOW_PKT_TOSERVER))
+        FilePrune(ffc_ts);
+    if (ffc_tc && (p->flowflags & FLOW_PKT_TOCLIENT))
+        FilePrune(ffc_tc);
+
     return TM_ECODE_OK;
 }