Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

filestore v2: print sid in json output (Optimization #2530) v7 #3657

Closed
wants to merge 1 commit into from
Closed

filestore v2: print sid in json output (Optimization #2530) v7 #3657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
19 changes: 19 additions & 0 deletions src/detect-filestore.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,8 +264,27 @@ static int DetectFilestoreMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* matches. */
if (file != NULL) {
file_id = file->file_store_id;
if (file->sid != NULL && s->id > 0) {
if (file->sid_cnt >= file->sid_max) {
void *p = SCRealloc(file->sid, sizeof(uint32_t) * (file->sid_max + 8));
if (p == NULL) {
SCFree(file->sid);
file->sid = NULL;
file->sid_cnt = 0;
file->sid_max = 0;
goto continue_after_realloc_fail;
} else {
file->sid = p;
file->sid_max += 8;
}
}
file->sid[file->sid_cnt] = s->id;
file->sid_cnt++;
}
}

continue_after_realloc_fail:

det_ctx->filestore[det_ctx->filestore_cnt].file_id = file_id;
det_ctx->filestore[det_ctx->filestore_cnt].tx_id = det_ctx->tx_id;

Expand Down
12 changes: 12 additions & 0 deletions src/output-json-file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,18 @@ json_t *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
json_object_set_new(fjs, "filename", SCJsonString(s));
if (s != NULL)
SCFree(s);

json_t *sig_ids = json_array();
if (unlikely(fjs == NULL)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should check sig_ids I think. I'll fix it up

json_decref(js);
return NULL;
}

for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
json_array_append(sig_ids, json_integer(ff->sid[i]));
}
json_object_set_new(fjs, "sid", sig_ids);

#ifdef HAVE_MAGIC
if (ff->magic)
json_object_set_new(fjs, "magic", json_string((char *)ff->magic));
Expand Down
9 changes: 9 additions & 0 deletions src/util-file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,6 +454,13 @@ static File *FileAlloc(const uint8_t *name, uint16_t name_len)
new->name_len = name_len;
memcpy(new->name, name, name_len);

new->sid_cnt = 0;
new->sid_max = 8;
/* SCMalloc() is allowed to fail here because sid well be checked later on */
new->sid = SCMalloc(sizeof(uint32_t) * new->sid_max);
if (new->sid == NULL)
new->sid_max = 0;

return new;
}

Expand All @@ -464,6 +471,8 @@ static void FileFree(File *ff)

if (ff->name != NULL)
SCFree(ff->name);
if (ff->sid != NULL)
SCFree(ff->sid);
#ifdef HAVE_MAGIC
/* magic returned by libmagic is strdup'd by MagicLookup. */
if (ff->magic != NULL)
Expand Down
4 changes: 4 additions & 0 deletions src/util-file.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,10 @@ typedef struct File_ {
* flag is set */
uint64_t content_stored;
uint64_t size;

uint32_t *sid; /* signature id of a rule that triggered the filestore event */
uint32_t sid_cnt;
uint32_t sid_max;
} File;

typedef struct FileContainer_ {
Expand Down