From: Victor Julien <victor@inliniac.net>
Date: Tue, 13 Feb 2018 12:42:39 +0000 (+0100)
Subject: file: fix files not getting pruned
X-Git-Tag: suricata-4.1.0-beta1~131
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F3247%2Fhead;p=thirdparty%2Fsuricata.git

file: fix files not getting pruned

When the filedata logger is enabled (file extraction), but a file is not
stored due to no rules matching to force this, the file would never be
freed.

This was caused by a check in the file pruning logic that only freed a
file when the FILE_STORED flag was set. However files can also have the
FILE_NOSTORE flag set which indicates that a file won't be stored.

This patch makes sure that both conditions lead to file pruning.
---

diff --git a/src/util-file.c b/src/util-file.c
index 5b4a575ad6..2620758f6b 100644
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -334,7 +334,7 @@ static int FilePruneFile(File *file)
     /* file is done when state is closed+, logging/storing is done (if any) */
     if (file->state >= FILE_STATE_CLOSED &&
         (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) &&
-        (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED)))
+        (!RunModeOutputFiledataEnabled() || (file->flags & (FILE_STORED|FILE_NOSTORE))))
     {
         SCReturnInt(1);
     } else {