diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c index 4d3aac4538..f356e5beff 100644 --- a/src/detect-engine-build.c +++ b/src/detect-engine-build.c @@ -176,25 +176,6 @@ int SignatureIsFileSha256Inspecting(const Signature *s) return 0; } -/** - * \brief Check if a signature contains the filesize keyword. - * - * \param s signature - * - * \retval 0 no - * \retval 1 yes - */ -int SignatureIsFilesizeInspecting(const Signature *s) -{ - if (s == NULL) - return 0; - - if (s->file_flags & FILE_SIG_NEED_SIZE) - return 1; - - return 0; -} - static bool SignatureInspectsBuffers(const Signature *s) { return (s->init_data->buffer_index > 0); diff --git a/src/detect-engine-build.h b/src/detect-engine-build.h index a61a930f9a..bb83682c70 100644 --- a/src/detect-engine-build.h +++ b/src/detect-engine-build.h @@ -26,7 +26,6 @@ int SignatureIsFilemagicInspecting(const Signature *); int SignatureIsFileMd5Inspecting(const Signature *); int SignatureIsFileSha1Inspecting(const Signature *s); int SignatureIsFileSha256Inspecting(const Signature *s); -int SignatureIsFilesizeInspecting(const Signature *); void SignatureSetType(DetectEngineCtx *de_ctx, Signature *s); int SigPrepareStage1(DetectEngineCtx *de_ctx); diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 2163010e58..a852e241e0 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -580,9 +580,6 @@ void SigGroupHeadSetupFiles(const DetectEngineCtx *de_ctx, SigGroupHead *sgh) if (s == NULL) continue; - if (SignatureIsFilesizeInspecting(s)) { - sgh->flags |= SIG_GROUP_HEAD_HAVEFILESIZE; - } if (SignatureIsFileMd5Inspecting(s)) { sgh->flags |= SIG_GROUP_HEAD_HAVEFILEMD5; SCLogDebug("sgh %p has filemd5", sgh); diff --git a/src/detect.c b/src/detect.c index e6e297ca73..a86d99973a 100644 --- a/src/detect.c +++ b/src/detect.c @@ -386,10 +386,6 @@ DetectPostInspectFileFlagsUpdate(Flow *f, const SigGroupHead *sgh, uint8_t direc SCLogDebug("requesting disabling sha256 for flow"); flow_file_flags |= (FLOWFILE_NO_SHA256_TS|FLOWFILE_NO_SHA256_TC); } - if (!(sgh->flags & SIG_GROUP_HEAD_HAVEFILESIZE)) { - SCLogDebug("requesting disabling filesize for flow"); - flow_file_flags |= (FLOWFILE_NO_SIZE_TS|FLOWFILE_NO_SIZE_TC); - } } if (flow_file_flags != 0) { FileUpdateFlowFileFlags(f, flow_file_flags, direction); diff --git a/src/detect.h b/src/detect.h index 5d06bd0937..c7c709b4ca 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1490,7 +1490,7 @@ enum { #define SIG_GROUP_HEAD_HAVEFILEMAGIC BIT_U16(1) #endif #define SIG_GROUP_HEAD_HAVEFILEMD5 BIT_U16(2) -#define SIG_GROUP_HEAD_HAVEFILESIZE BIT_U16(3) +// vacancy #define SIG_GROUP_HEAD_HAVEFILESHA1 BIT_U16(4) #define SIG_GROUP_HEAD_HAVEFILESHA256 BIT_U16(5) diff --git a/src/flow.c b/src/flow.c index ef10da305e..70777a1ecd 100644 --- a/src/flow.c +++ b/src/flow.c @@ -222,7 +222,6 @@ static inline void FlowSwapFileFlags(Flow *f) SWAP_FLAGS(f->file_flags, FLOWFILE_NO_MD5_TS, FLOWFILE_NO_MD5_TC); SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SHA1_TS, FLOWFILE_NO_SHA1_TC); SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SHA256_TS, FLOWFILE_NO_SHA256_TC); - SWAP_FLAGS(f->file_flags, FLOWFILE_NO_SIZE_TS, FLOWFILE_NO_SIZE_TC); } static inline void TcpStreamFlowSwap(Flow *f) diff --git a/src/flow.h b/src/flow.h index 43e438207c..1a72fce49f 100644 --- a/src/flow.h +++ b/src/flow.h @@ -145,26 +145,18 @@ typedef struct AppLayerParserState_ AppLayerParserState; #define FLOWFILE_NO_SHA256_TS BIT_U16(8) #define FLOWFILE_NO_SHA256_TC BIT_U16(9) -/** no size tracking of files in this flow */ -#define FLOWFILE_NO_SIZE_TS BIT_U16(10) -#define FLOWFILE_NO_SIZE_TC BIT_U16(11) +// vacancy(2) /** store files in the flow */ #define FLOWFILE_STORE_TS BIT_U16(12) #define FLOWFILE_STORE_TC BIT_U16(13) -#define FLOWFILE_NONE_TS (FLOWFILE_NO_MAGIC_TS | \ - FLOWFILE_NO_STORE_TS | \ - FLOWFILE_NO_MD5_TS | \ - FLOWFILE_NO_SHA1_TS | \ - FLOWFILE_NO_SHA256_TS| \ - FLOWFILE_NO_SIZE_TS) -#define FLOWFILE_NONE_TC (FLOWFILE_NO_MAGIC_TC | \ - FLOWFILE_NO_STORE_TC | \ - FLOWFILE_NO_MD5_TC | \ - FLOWFILE_NO_SHA1_TC | \ - FLOWFILE_NO_SHA256_TC| \ - FLOWFILE_NO_SIZE_TC) +#define FLOWFILE_NONE_TS \ + (FLOWFILE_NO_MAGIC_TS | FLOWFILE_NO_STORE_TS | FLOWFILE_NO_MD5_TS | FLOWFILE_NO_SHA1_TS | \ + FLOWFILE_NO_SHA256_TS) +#define FLOWFILE_NONE_TC \ + (FLOWFILE_NO_MAGIC_TC | FLOWFILE_NO_STORE_TC | FLOWFILE_NO_MD5_TC | FLOWFILE_NO_SHA1_TC | \ + FLOWFILE_NO_SHA256_TC) #define FLOWFILE_NONE (FLOWFILE_NONE_TS|FLOWFILE_NONE_TC) #define FLOW_IS_IPV4(f) \ diff --git a/src/util-file.c b/src/util-file.c index e7b71e7070..d90b566b6e 100644 --- a/src/util-file.c +++ b/src/util-file.c @@ -161,7 +161,6 @@ int FileForceSha256(void) void FileForceTrackingEnable(void) { g_file_force_tracking = 1; - g_file_flow_mask |= (FLOWFILE_NO_SIZE_TS|FLOWFILE_NO_SIZE_TC); } /**