search

USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Close Output Module in Followstream #97

Closed amm3 closed 7 years ago

amm3 commented 7 years ago

I recently noted that the closing body and html tags were not being applied in HTML output from followstream. Looking into it further, I noted that when output modules are instantiated from within the decoder's __init__, they are not closed by decode.py because out now differs from decoder.out within decode's main.

I explored calling self.out.close() from the decoder's __del__, but by the time this function is called (at the end of decode.py's main) the filehandle (decoder.out.fh = out.fh) has been closed, so colorout's attempt to write the closing tags generates a ValueError (I/O operation on closed file).

Another approach would be to test each decoder at the end of main to see if its output decoder is equal to the default out and close it appropriately, but I didn't want to make this change unilaterally.

dev195 commented 7 years ago

Nice catch!

We'll accept your pull request in the short-term, and work on a more long-term solution over the next few weeks. I noticed this bug also bites other decoders that work the same way (e.g. the new voip/sip.py decoder).

amm3 commented 7 years ago

Sounds good! I've got another minor pull coming in followstream, but I wanted to make sure you guys were good with this one before sending it up. Thanks...