file-store.stream-depth not working as expected when configured to a specfic value (4.1.x)
Given the following config below -
outputs.14.file-store.stream-depth = 0 stream.reassembly.depth = 2mb
Suricata will file extract any file any size
Given this other config below -
outputs.14.file-store.stream-depth = 5mb stream.reassembly.depth = 2mb
Suricata will only extract files which are up to 2mb in size - aka the "stream.reassembly.depth" configured value. However the expected result is the files extracted to be up to 5Mb as configured by "outputs.14.file-store.stream-depth"
Observed on 4.0.1 and latest git master.