return 0;
}
-/**
- * \brief Check if a signature contains the filesize keyword.
- *
- * \param s signature
- *
- * \retval 0 no
- * \retval 1 yes
- */
-int SignatureIsFilesizeInspecting(const Signature *s)
-{
- if (s == NULL)
- return 0;
-
- if (s->file_flags & FILE_SIG_NEED_SIZE)
- return 1;
-
- return 0;
-}
-
static bool SignatureInspectsBuffers(const Signature *s)
{
return (s->init_data->buffer_index > 0);
int SignatureIsFileMd5Inspecting(const Signature *);
int SignatureIsFileSha1Inspecting(const Signature *s);
int SignatureIsFileSha256Inspecting(const Signature *s);
-int SignatureIsFilesizeInspecting(const Signature *);
void SignatureSetType(DetectEngineCtx *de_ctx, Signature *s);
int SigPrepareStage1(DetectEngineCtx *de_ctx);
if (s == NULL)
continue;
- if (SignatureIsFilesizeInspecting(s)) {
- sgh->flags |= SIG_GROUP_HEAD_HAVEFILESIZE;
- }
if (SignatureIsFileMd5Inspecting(s)) {
sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMD5;
SCLogDebug("sgh %p has filemd5", sgh);
SCLogDebug("requesting disabling sha256 for flow");
flow_file_flags |= (FLOWFILE_NO_SHA256_TS|FLOWFILE_NO_SHA256_TC);
}
- if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESIZE)) {
- SCLogDebug("requesting disabling filesize for flow");
- flow_file_flags |= (FLOWFILE_NO_SIZE_TS|FLOWFILE_NO_SIZE_TC);
- }
}
if (flow_file_flags != 0) {
FileUpdateFlowFileFlags(f, flow_file_flags, direction);
#define SIG_GROUP_HEAD_HAVEFILEMAGIC BIT_U16(1)
#endif
#define SIG_GROUP_HEAD_HAVEFILEMD5 BIT_U16(2)
-#define SIG_GROUP_HEAD_HAVEFILESIZE BIT_U16(3)
+// vacancy
#define SIG_GROUP_HEAD_HAVEFILESHA1 BIT_U16(4)
#define SIG_GROUP_HEAD_HAVEFILESHA256 BIT_U16(5)
SWAP_FLAGS(f->file_flags, FLOWFILE_NO_MD5_TS, FLOWFILE_NO_MD5_TC);
SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SHA1_TS, FLOWFILE_NO_SHA1_TC);
SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SHA256_TS, FLOWFILE_NO_SHA256_TC);
- SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SIZE_TS, FLOWFILE_NO_SIZE_TC);
}
static inline void TcpStreamFlowSwap(Flow *f)
#define FLOWFILE_NO_SHA256_TS BIT_U16(8)
#define FLOWFILE_NO_SHA256_TC BIT_U16(9)
-/** no size tracking of files in this flow */
-#define FLOWFILE_NO_SIZE_TS BIT_U16(10)
-#define FLOWFILE_NO_SIZE_TC BIT_U16(11)
+// vacancy(2)
/** store files in the flow */
#define FLOWFILE_STORE_TS BIT_U16(12)
#define FLOWFILE_STORE_TC BIT_U16(13)
-#define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \
- FLOWFILE_NO_STORE_TS | \
- FLOWFILE_NO_MD5_TS | \
- FLOWFILE_NO_SHA1_TS | \
- FLOWFILE_NO_SHA256_TS| \
- FLOWFILE_NO_SIZE_TS)
-#define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \
- FLOWFILE_NO_STORE_TC | \
- FLOWFILE_NO_MD5_TC | \
- FLOWFILE_NO_SHA1_TC | \
- FLOWFILE_NO_SHA256_TC| \
- FLOWFILE_NO_SIZE_TC)
+#define FLOWFILE_NONE_TS \
+ (FLOWFILE_NO_MAGIC_TS | FLOWFILE_NO_STORE_TS | FLOWFILE_NO_MD5_TS | FLOWFILE_NO_SHA1_TS | \
+ FLOWFILE_NO_SHA256_TS)
+#define FLOWFILE_NONE_TC \
+ (FLOWFILE_NO_MAGIC_TC | FLOWFILE_NO_STORE_TC | FLOWFILE_NO_MD5_TC | FLOWFILE_NO_SHA1_TC | \
+ FLOWFILE_NO_SHA256_TC)
#define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC)
#define FLOW_IS_IPV4(f) \
void FileForceTrackingEnable(void)
{
g_file_force_tracking = 1;
- g_file_flow_mask |= (FLOWFILE_NO_SIZE_TS|FLOWFILE_NO_SIZE_TC);
}
/**