]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: respect directionality for filestore
authorPhilippe Antoine <pantoine@oisf.net>
Thu, 25 Jan 2024 13:26:09 +0000 (14:26 +0100)
committerVictor Julien <victor@inliniac.net>
Wed, 14 Feb 2024 20:20:51 +0000 (21:20 +0100)
commit63caa0b40a66ecf1a34bbb6d942d4a044b7728a5
tree707ac7f86cca89ea15296467d2bab708841c3706
parent41a621178fd2d177866cf9cadcd5d38fc6eb2afd
detect: respect directionality for filestore

Ticket: 6617

So that rules with keyword like `filestore:to_server,flow`
only store the files to server and not the ones to client...

Directionality only worked with the default scope, ie the
current file, and not the scope tx or scope flow.
For non-default scope, tx or flow, both directions were stored
whatever the directionality specified.

For these non-default scopes, this commit keeps a default
of both directions, but use only one direction if specified.

Need to split flag FLOWFILE_STORE per direction, so that Suricata
can retain this (optional) directional info from the filestore
keyword.

Fixes: 79499e476979 ("app-layer: move files into transactions")
src/detect-filestore.c
src/flow.h
src/util-file.c