From 9d2d1c4f8f804bb3eec1c0711f4b2f397b401484 Mon Sep 17 00:00:00 2001 From: David Wharton Date: Mon, 13 Oct 2025 22:35:07 -0400 Subject: [PATCH] doc: minor verbiage tweaks and reST fix --- doc/userguide/file-extraction/file-extraction.rst | 4 ++-- doc/userguide/rules/file-keywords.rst | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/userguide/file-extraction/file-extraction.rst b/doc/userguide/file-extraction/file-extraction.rst index 482fd18df7..feb00fc0fd 100644 --- a/doc/userguide/file-extraction/file-extraction.rst +++ b/doc/userguide/file-extraction/file-extraction.rst @@ -26,9 +26,9 @@ Supported protocols are: Settings ~~~~~~~~ -*stream.checksum_validation* controls whether or not the stream engine rejects packets with invalid checksums. A good idea normally, but the network interface performs checksum offloading a lot of packets may seem to be broken. This setting is enabled by default, and can be disabled by setting to "no". Note that the checksum handling can be controlled per interface, see "checksum_checks" in example configuration. +*stream.checksum_validation* controls whether or not the stream engine rejects packets with invalid checksums. This is a good idea normally, but if the network interface performs checksum offloading, a lot of packets may seem to be broken. This setting is enabled by default, and can be disabled by setting to "no". Note that the checksum handling can be controlled per interface; see "checksum_checks" in example configuration. -*file-store.stream-depth* controls how far into a stream reassembly is done. Beyond this value no reassembly will be done. This means that after this value the HTTP session will no longer be tracked. By default a setting of 1 Megabyte is used. 0 sets it to unlimited. If set to no, it is disabled and stream.reassembly.depth is considered. Non-zero values must be greater than ``stream.stream-depth`` to be used. +*file-store.stream-depth* controls how far into a stream reassembly is done. Beyond this value no reassembly will be done. This means that after this value the HTTP session will no longer be tracked. By default a setting of 1 Megabyte is used. 0 sets it to unlimited. If set to "no", it is disabled and *stream.reassembly.depth* is considered. Non-zero values must be greater than ``stream.stream-depth`` to be used. *libhtp.default-config.request-body-limit* / *libhtp.server-config..request-body-limit* controls how much of the HTTP request body is tracked for inspection by the `http_client_body` keyword, but also used to limit file inspection. A value of 0 means unlimited. diff --git a/doc/userguide/rules/file-keywords.rst b/doc/userguide/rules/file-keywords.rst index e1b832ec04..35db1dd742 100644 --- a/doc/userguide/rules/file-keywords.rst +++ b/doc/userguide/rules/file-keywords.rst @@ -90,7 +90,7 @@ Example:: file.name; content:".pdf"; nocase; endswith; -**Note**: While``fileeext`` and ``file.name`` can both be used +**Note**: While ``fileeext`` and ``file.name`` can both be used to match on file extensions, ``file.name`` allows for partial matching on file extensions. The following would match on a file with the extension of .pd as well as .pdf.