detect/file.data: ips mode optimization

Reduce rescanning for smaller files after they are truncated/closed.
1 year ago · 92267b33c2
parent edba518af5
commit 92267b33c2
1 changed files with 1 additions and 1 deletions
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@ -344,7 +344,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
    /* update inspected tracker */
    buffer->inspect_offset = offset;

-    if (ips && file_size < cur_file->inspect_min_size) {
+    if (ips && file_size < cur_file->inspect_min_size && cur_file->state == FILE_STATE_OPENED) {
        // don't update content_inspected yet
    } else {
        SCLogDebug("content inspected: %" PRIu64, cur_file->content_inspected);