http: improve body pruning

Take inspect window into account.

diff --git a/src/app-layer-htp-body.c b/src/app-layer-htp-body.c
index 393336a40de36463c0e56a42cc0da772bcc2b0ef..0ee1f72bf45920edf0042ac9573f1c0ff6fe8ff0 100644 (file)
--- a/src/app-layer-htp-body.c
+++ b/src/app-layer-htp-body.c
@@ -199,7 +199,7 @@ void HtpBodyFree(HtpBody *body)
  *
  * \retval none
  */
-void HtpBodyPrune(HtpBody *body)
+void HtpBodyPrune(HtpState *state, HtpBody *body)
 {
     SCEnter();
 
@@ -211,6 +211,10 @@ void HtpBodyPrune(HtpBody *body)
         SCReturn;
     }
 
+    if (body->body_inspected < state->cfg->response_inspect_min_size) {
+        SCReturn;
+    }
+
     SCLogDebug("Pruning chunks of Body %p; data %p, len %"PRIu32, body,
             body->last->data, (uint32_t)body->last->len);
 
@@ -222,7 +226,12 @@ void HtpBodyPrune(HtpBody *body)
                 "body->body_parsed %"PRIu64, cur->stream_offset, cur->len,
                 cur->stream_offset + cur->len, body->body_parsed);
 
-        if (cur->stream_offset >= body->body_inspected) {
+        uint64_t left_edge = 0;
+        if (state->cfg->response_inspect_window < body->body_inspected) {
+            left_edge = body->body_inspected - state->cfg->response_inspect_window;
+        }
+
+        if (cur->stream_offset >= left_edge) {
             break;
         }
 

diff --git a/src/app-layer-htp-body.h b/src/app-layer-htp-body.h
index 82d92a486042fb3db7bb219ec2f661274c444240..950b520e5f21ceac5fec2d6999b615aedfe333b2 100644 (file)
--- a/src/app-layer-htp-body.h
+++ b/src/app-layer-htp-body.h
@@ -31,6 +31,6 @@
 int HtpBodyAppendChunk(HtpTxUserData *, HtpBody *, uint8_t *, uint32_t);
 void HtpBodyPrint(HtpBody *);
 void HtpBodyFree(HtpBody *);
-void HtpBodyPrune(HtpBody *);
+void HtpBodyPrune(HtpState *, HtpBody *);
 
 #endif /* __APP_LAYER_HTP_BODY_H__ */

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index ac97d408b66c41f196fef62637c8c918a61d79cf..2817332551322c090d9be893aff3ea5e049d2bc2 100644 (file)
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1848,7 +1848,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
 
 end:
     /* see if we can get rid of htp body chunks */
-    HtpBodyPrune(&tx_ud->request_body);
+    HtpBodyPrune(hstate, &tx_ud->request_body);
 
     /* set the new chunk flag */
     hstate->flags |= HTP_FLAG_NEW_BODY_SET;
@@ -1917,7 +1917,7 @@ int HTPCallbackResponseBodyData(htp_tx_data_t *d)
     }
 
     /* see if we can get rid of htp body chunks */
-    HtpBodyPrune(&tx_ud->response_body);
+    HtpBodyPrune(hstate, &tx_ud->response_body);
 
     /* set the new chunk flag */
     hstate->flags |= HTP_FLAG_NEW_BODY_SET;