From: Philippe Antoine Date: Thu, 2 Sep 2021 14:31:20 +0000 (+0200) Subject: http2: better file tracking X-Git-Tag: suricata-6.0.4~62 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F6392%2Fhead;p=thirdparty%2Fsuricata.git http2: better file tracking If an HTTP2 file was within only ont DATA frame, the filetracker would open it and close it in the same call, preventing the firther call to incr_files_opened Also includes rustfmt again for all HTTP2 files (cherry picked from commit bb98a18b3d6d104d11a105aea3886d3daa5956cf) --- diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs index c6676d66cc..c4452cdab8 100644 --- a/rust/src/http2/http2.rs +++ b/rust/src/http2/http2.rs @@ -199,6 +199,12 @@ impl HTTP2Transaction { let xid: u32 = self.tx_id as u32; if dir == STREAM_TOCLIENT { + self.ft_tc.tx_id = self.tx_id - 1; + if !self.ft_tc.file_open { + // we are now sure that new_chunk will open a file + // even if it may close it right afterwards + self.tx_data.incr_files_opened(); + } self.ft_tc.new_chunk( sfcm, files, @@ -212,6 +218,10 @@ impl HTTP2Transaction { &xid, ); } else { + self.ft_ts.tx_id = self.tx_id - 1; + if !self.ft_ts.file_open { + self.tx_data.incr_files_opened(); + } self.ft_ts.new_chunk( sfcm, files, @@ -839,14 +849,7 @@ impl HTTP2State { //borrow checker forbids to reuse directly tx let index = self.find_tx_index(sid); if index > 0 { - let mut tx_same = &mut self.transactions[index - 1]; - let is_open = if dir == STREAM_TOCLIENT { - tx_same.ft_tc.tx_id = tx_same.tx_id - 1; - tx_same.ft_tc.file_open - } else { - tx_same.ft_ts.tx_id = tx_same.tx_id - 1; - tx_same.ft_ts.file_open - }; + let tx_same = &mut self.transactions[index - 1]; let (files, flags) = self.files.get(dir); match tx_same.decompress( &rem[..hlsafe], @@ -859,17 +862,7 @@ impl HTTP2State { Err(_e) => { self.set_event(HTTP2Event::FailedDecompression); } - _ => { - if dir == STREAM_TOCLIENT { - if !is_open && tx_same.ft_tc.file_open { - tx_same.tx_data.incr_files_opened(); - } - } else { - if !is_open && tx_same.ft_ts.file_open { - tx_same.tx_data.incr_files_opened(); - } - } - } + _ => {} } } }