From: Giuseppe Longo <glongo@stamus-networks.com>
Date: Mon, 12 Mar 2018 11:41:35 +0000 (+0100)
Subject: app-layer-htp: close file with TRUNCATE state
X-Git-Tag: suricata-4.1.0-rc2~155
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc38013975ab8875863e23efda97eaecb7ff7a09;p=thirdparty%2Fsuricata.git

app-layer-htp: close file with TRUNCATE state

When a file in TOSERVER direction is being stored and
libhtp or stream depth limit is reached,
it will be closed by HTPCallbackRequest without setting
any flags so the file state will be set to CLOSED
instead of TRUNCATED.
---

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 604a7b9203..eff10cb070 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1760,6 +1760,12 @@ static int HTPCallbackRequestBodyData(htp_tx_data_t *d)
             HtpRequestBodyHandlePUT(hstate, tx_ud, d->tx, (uint8_t *)d->data, (uint32_t)d->len);
         }
 
+    } else {
+        if (tx_ud->tsflags & HTP_FILENAME_SET) {
+            SCLogDebug("closing file that was being stored");
+            (void)HTPFileClose(hstate, NULL, 0, FILE_TRUNCATED, STREAM_TOSERVER);
+            tx_ud->tsflags &= ~HTP_FILENAME_SET;
+        }
     }
 
 end: