detect/files: optimize file.data by skipping non-file txs

As well as 'file' txs not in our direction.

Implement the same logic for file.name and file.magic prefilter engines.
pull/7957/head
Victor Julien 3 years ago
parent db0f9ddc69
commit 41265a859e

@ -654,10 +654,13 @@ static uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngine
* \param flags STREAM_* flags including direction
*/
static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
{
SCEnter();
if (!AppLayerParserHasFilesInDir(txd, flags))
return;
const PrefilterMpmFiledata *ctx = (const PrefilterMpmFiledata *)pectx;
const MpmCtx *mpm_ctx = ctx->mpm_ctx;
const int list_id = ctx->list_id;

@ -531,10 +531,13 @@ typedef struct PrefilterMpmFilemagic {
* \param pectx inspection context
*/
static void PrefilterTxFilemagic(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
{
SCEnter();
if (!AppLayerParserHasFilesInDir(txd, flags))
return;
const PrefilterMpmFilemagic *ctx = (const PrefilterMpmFilemagic *)pectx;
const MpmCtx *mpm_ctx = ctx->mpm_ctx;
const int list_id = ctx->list_id;

@ -427,10 +427,13 @@ typedef struct PrefilterMpmFilename {
* \param pectx inspection context
*/
static void PrefilterTxFilename(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
{
SCEnter();
if (!AppLayerParserHasFilesInDir(txd, flags))
return;
const PrefilterMpmFilename *ctx = (const PrefilterMpmFilename *)pectx;
const MpmCtx *mpm_ctx = ctx->mpm_ctx;
const int list_id = ctx->list_id;

Loading…
Cancel
Save