Actions
Optimization #4378
closedTask #4143: tracking: file.data improvements
file.data: split mpm per app_proto
Effort:
Difficulty:
Label:
Description
Suricata considers all file.data rule uses to use the same higher level buffer type, independent of the protocol the rules apply to. In practice a file.data can apply to either a specific protocol like smb or http, or it applies to all protocols that support file.data.
Looking at existing rulesets we see very many HTTP file.data rules and relatively few for other protocols. Due to how the mpm/fast_pattern handles file.data as a single buffer, this means that the scanning for file.data patterns in SMB will include the patterns for HTTP. This is obviously inefficient, as this means Suricata is doing expensive work that can never lead to a rule match.
Updated by Victor Julien almost 2 years ago
- Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Updated by Victor Julien over 1 year ago
- Status changed from Assigned to In Progress
- Target version changed from 8.0.0-beta1 to 7.0.0-rc2
Updated by Victor Julien over 1 year ago
- Related to Task #5682: tracking: smb performance issues added
Updated by Victor Julien over 1 year ago
- Status changed from In Progress to Closed
Actions