detect/files: optimize file.data by skipping non-file txs

As well as 'file' txs not in our direction.

Implement the same logic for file.name and file.magic prefilter engines.

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 891bc4111e15c9a0b307891ef065c6d04d073c3a..4307a69c1982422ebd6a270ea37e9ea7051f7d0b 100644 (file)
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -654,10 +654,13 @@ static uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngine
  *  \param flags STREAM_* flags including direction
  */
 static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
-        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
+        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
 {
     SCEnter();
 
+    if (!AppLayerParserHasFilesInDir(txd, flags))
+        return;
+
     const PrefilterMpmFiledata *ctx = (const PrefilterMpmFiledata *)pectx;
     const MpmCtx *mpm_ctx = ctx->mpm_ctx;
     const int list_id = ctx->list_id;

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 82d5784a357bbced8c6d0bc575b6b5db25b4d855..cccd44ebb229242cdf3611de028d3df68555e46f 100644 (file)
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -531,10 +531,13 @@ typedef struct PrefilterMpmFilemagic {
  *  \param pectx inspection context
  */
 static void PrefilterTxFilemagic(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
-        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
+        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
 {
     SCEnter();
 
+    if (!AppLayerParserHasFilesInDir(txd, flags))
+        return;
+
     const PrefilterMpmFilemagic *ctx = (const PrefilterMpmFilemagic *)pectx;
     const MpmCtx *mpm_ctx = ctx->mpm_ctx;
     const int list_id = ctx->list_id;

diff --git a/src/detect-filename.c b/src/detect-filename.c
index 35b568234a04b5b4998c81717cc69a5a7ee1ef52..11c8b692311b18ce2ecac962fbdb216efc6b0466 100644 (file)
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -427,10 +427,13 @@ typedef struct PrefilterMpmFilename {
  *  \param pectx inspection context
  */
 static void PrefilterTxFilename(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
-        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
+        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *txd, const uint8_t flags)
 {
     SCEnter();
 
+    if (!AppLayerParserHasFilesInDir(txd, flags))
+        return;
+
     const PrefilterMpmFilename *ctx = (const PrefilterMpmFilename *)pectx;
     const MpmCtx *mpm_ctx = ctx->mpm_ctx;
     const int list_id = ctx->list_id;