From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 23 Apr 2021 19:55:20 +0000 (+0200)
Subject: http2: have filecontainer for both directions
X-Git-Tag: suricata-6.0.3~39
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=56bda0f9cb6a1899cb6de854773cd53abe1dd4b6;p=thirdparty%2Fsuricata.git

http2: have filecontainer for both directions

(cherry picked from commit 6fe8bce3b0c653df8e72bdb81bc235672386b8b1)
---

diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs
index a726bfeff4..a3277d10b9 100644
--- a/rust/src/http2/http2.rs
+++ b/rust/src/http2/http2.rs
@@ -132,7 +132,8 @@ pub struct HTTP2Transaction {
     de_state: Option<*mut core::DetectEngineState>,
     events: *mut core::AppLayerDecoderEvents,
     tx_data: AppLayerTxData,
-    ft: FileTransferTracker,
+    ft_tc: FileTransferTracker,
+    ft_ts: FileTransferTracker,
 
     //temporary escaped header for detection
     //must be attached to transaction for memory management (be freed at the right time)
@@ -152,7 +153,8 @@ impl HTTP2Transaction {
             de_state: None,
             events: std::ptr::null_mut(),
             tx_data: AppLayerTxData::new(),
-            ft: FileTransferTracker::new(),
+            ft_tc: FileTransferTracker::new(),
+            ft_ts: FileTransferTracker::new(),
             escaped: Vec::with_capacity(16),
         }
     }
@@ -181,18 +183,33 @@ impl HTTP2Transaction {
         let mut output = Vec::with_capacity(decompression::HTTP2_DECOMPRESSION_CHUNK_SIZE);
         let decompressed = self.decoder.decompress(input, &mut output, dir)?;
         let xid: u32 = self.tx_id as u32;
-        self.ft.new_chunk(
-            sfcm,
-            files,
-            flags,
-            b"",
-            decompressed,
-            self.ft.tracked, //offset = append
-            decompressed.len() as u32,
-            0,
-            over,
-            &xid,
-        );
+        if dir == STREAM_TOCLIENT {
+            self.ft_tc.new_chunk(
+                sfcm,
+                files,
+                flags,
+                b"",
+                decompressed,
+                self.ft_tc.tracked, //offset = append
+                decompressed.len() as u32,
+                0,
+                over,
+                &xid,
+            );
+        } else {
+            self.ft_ts.new_chunk(
+                sfcm,
+                files,
+                flags,
+                b"",
+                decompressed,
+                self.ft_ts.tracked, //offset = append
+                decompressed.len() as u32,
+                0,
+                over,
+                &xid,
+            );
+        };
         return Ok(());
     }
 
@@ -808,7 +825,11 @@ impl HTTP2State {
                                 let index = self.find_tx_index(sid);
                                 if index > 0 {
                                     let mut tx_same = &mut self.transactions[index - 1];
-                                    tx_same.ft.tx_id = tx_same.tx_id - 1;
+                                    if dir == STREAM_TOCLIENT {
+                                        tx_same.ft_tc.tx_id = tx_same.tx_id - 1;
+                                    } else {
+                                        tx_same.ft_ts.tx_id = tx_same.tx_id - 1;
+                                    }
                                     let (files, flags) = self.files.get(dir);
                                     match tx_same.decompress(
                                         &rem[..hlsafe],