Project

General

Profile

Actions
Copy link

Optimization #4141

closed
VJ JL

Task #4143: tracking: file.data improvements

file.data: inspect File objects for HTTP

Optimization #4141: file.data: inspect File objects for HTTP

Added by Victor Julien over 5 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jeff Lucovsky
Target version:
7.0.0
Effort:
Difficulty:
Label:

Description

file.data for HTTP currently inspects the HtpBody instead of File(s). These will usually contain the same data, except for the multipart case.

Switching to File(s) would make the implementation simpler and make the implementation more correct.

David Wharton and Jae Williams have offered to run test runs for their rule collections to validate that this change won't break anything.

Related issues 3 (2 open — 1 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Suricata - Bug #5868: filestore: not saving files when filestore enabled by rule matching on file_data (instead saves 0 bytes)ClosedJeff LucovskyActions
Related to Suricata - Task #6217: research: increased tcp.overlap after file data changesAssignedVictor JulienActions

VJ Updated by Victor Julien over 5 years ago Actions
Copy link
 #1

  • Related to Task #4097: Suricon 2020 brainstorm added

VJ Updated by Victor Julien over 5 years ago Actions
Copy link
 #2

  • Parent task set to #4143

VJ Updated by Victor Julien over 5 years ago Actions
Copy link
 #3

A possible optimization after this has been done, is that in most cases we might not need to track the HtpBody separately anymore.

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #4

  • Priority changed from Normal to High
  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1

VJ Updated by Victor Julien about 3 years ago Actions
Copy link
 #5

  • Priority changed from High to Normal
  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1

JL Updated by Jeff Lucovsky almost 3 years ago Actions
Copy link
 #6

  • Status changed from Assigned to In Review

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #7

  • Related to Bug #5868: filestore: not saving files when filestore enabled by rule matching on file_data (instead saves 0 bytes) added

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #8

  • Target version changed from 8.0.0-beta1 to 7.0.0

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #9

  • Status changed from In Review to In Progress
  • Target version changed from 7.0.0 to 8.0.0-beta1

Still too much to do, so moving to 8.

Current draft https://github.com/OISF/suricata/pull/9207

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #10

  • Status changed from In Progress to Closed
  • Target version changed from 8.0.0-beta1 to 7.0.0

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #11

  • Related to Task #6217: research: increased tcp.overlap after file data changes added
Actions
Copy link

Also available in: PDF Atom