From edba518af55bda14ae75f263422e289f067376fa Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 21 Sep 2023 11:56:24 +0200 Subject: [PATCH 1/2] detect/file.data: formatting fixup --- src/detect-file-data.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/detect-file-data.c b/src/detect-file-data.c index e15db5b20731..4438053ec5f3 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -93,7 +93,8 @@ void DetectFiledataRegister(void) g_file_data_buffer_id = DetectBufferTypeGetByName("file_data"); } -static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) { +static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) +{ if (de_ctx->filedata_config) return; From 92267b33c26f4444f704251180db389e17fe9e89 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 21 Sep 2023 11:57:14 +0200 Subject: [PATCH 2/2] detect/file.data: ips mode optimization Reduce rescanning for smaller files after they are truncated/closed. --- src/detect-file-data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-file-data.c b/src/detect-file-data.c index 4438053ec5f3..53c046449f99 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -344,7 +344,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx, /* update inspected tracker */ buffer->inspect_offset = offset; - if (ips && file_size < cur_file->inspect_min_size) { + if (ips && file_size < cur_file->inspect_min_size && cur_file->state == FILE_STATE_OPENED) { // don't update content_inspected yet } else { SCLogDebug("content inspected: %" PRIu64, cur_file->content_inspected);