1 files changed, 296 insertions, 91 deletions

diff --git a/src/libserver/maps/map.c b/src/libserver/maps/map.c
index 43a9d5d86..6de694eb3 100644
--- a/src/libserver/maps/map.c
+++ b/src/libserver/maps/map.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2024 Vsevolod Stakhov
+ * Copyright 2025 Vsevolod Stakhov
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,8 @@
 #include "contrib/libev/ev.h"
 #include "contrib/uthash/utlist.h"
 
+#include <worker_util.h>
+
 #ifdef SYS_ZSTD
 #include "zstd.h"
 #else
@@ -84,7 +86,8 @@ RSPAMD_CONSTRUCTOR(rspamd_map_log_init)
 }
 
 /**
- * Write HTTP request
+ * Write HTTP request with proper cache validation headers
+ * Uses ETags (If-None-Match) and Last-Modified (If-Modified-Since) for conditional requests
  */
 static void
 write_http_request(struct http_callback_data *cbd)
@@ -109,7 +112,8 @@ write_http_request(struct http_callback_data *cbd)
 		}
 		if (cbd->data->etag) {
 			rspamd_http_message_add_header_len(msg, "If-None-Match",
-											   cbd->data->etag->str, cbd->data->etag->len);
+											   cbd->data->etag->str,
+											   cbd->data->etag->len);
 		}
 	}
 
@@ -295,6 +299,101 @@ rspamd_map_cache_cb(struct ev_loop *loop, ev_timer *w, int revents)
 	}
 }
 
+/**
+ * Calculate next check time with proper priority for different cache validation mechanisms
+ * Priority: ETags > Last-Modified > Cache expiration headers
+ * @param now current time
+ * @param expires time from cache expiration header
+ * @param map_check_interval base polling interval
+ * @param has_etag whether we have ETag for conditional requests
+ * @param has_last_modified whether we have Last-Modified for conditional requests
+ * @return next check time
+ */
+static inline time_t
+rspamd_http_map_process_next_check(struct rspamd_map *map,
+								   struct rspamd_map_backend *bk,
+								   time_t now,
+								   time_t expires,
+								   time_t map_check_interval,
+								   gboolean has_etag,
+								   gboolean has_last_modified)
+{
+	static const time_t interval_mult = 4; /* Reduced from 16 to be more responsive */
+	static const time_t min_respectful_interval = 5;
+	time_t next_check;
+	time_t effective_interval = map_check_interval;
+
+	/*
+	 * Priority order for cache validation:
+	 * 1. ETags (most reliable)
+	 * 2. Last-Modified dates
+	 * 3. Cache expiration headers (least reliable)
+	 */
+
+	if (has_etag || has_last_modified) {
+		/*
+		 * If we have ETags or Last-Modified, we can use conditional requests
+		 * to avoid unnecessary downloads. However, we still need to be respectful
+		 * to servers and not DoS them with overly aggressive polling.
+		 */
+		if (map_check_interval < min_respectful_interval) {
+			/*
+			 * User configured very aggressive polling, but server provides cache validation.
+			 * Enforce minimum respectful interval to avoid DoS'ing the server.
+			 */
+			effective_interval = min_respectful_interval * interval_mult;
+			msg_info_map("map polling interval %d too aggressive with server cache support for %s, "
+						 "using %d seconds minimum",
+						 (int) map_check_interval, bk->uri, (int) effective_interval);
+		}
+
+		if (expires > now && (expires - now) <= effective_interval * interval_mult) {
+			/* Use expires header if it's reasonable (within interval_mult x poll interval) */
+			next_check = expires;
+		}
+		else {
+			/* Use effective interval, don't extend too much */
+			next_check = now + effective_interval;
+		}
+	}
+	else if (expires > now) {
+		/*
+		 * No ETags or Last-Modified available, rely on cache expiration.
+		 * But still cap the interval to avoid too long delays.
+		 * No need for respectful interval protection here since no conditional requests.
+		 */
+		if (expires - now > map_check_interval * interval_mult) {
+			next_check = now + map_check_interval * interval_mult;
+		}
+		else {
+			next_check = expires;
+		}
+	}
+	else {
+		/* No valid cache information, check immediately */
+		next_check = now;
+	}
+
+	return next_check;
+}
+
+/**
+ * Calculate respectful polling interval to avoid DoS'ing servers with cache validation
+ * @param map_check_interval user configured interval
+ * @return effective interval that respects server resources
+ */
+static inline time_t
+rspamd_map_get_respectful_interval(time_t map_check_interval)
+{
+	static const time_t min_respectful_interval = 5; /* Minimum 5 seconds to be respectful */
+	static const time_t interval_mult = 4;           /* Multiplier for respectful minimum */
+
+	if (map_check_interval < min_respectful_interval) {
+		return min_respectful_interval * interval_mult;
+	}
+	return map_check_interval;
+}
+
 static int
 http_map_finish(struct rspamd_http_connection *conn,
 				struct rspamd_http_message *msg)
@@ -316,12 +415,15 @@ http_map_finish(struct rspamd_http_connection *conn,
 	if (msg->code == 200) {
 
 		if (cbd->check) {
-			msg_info_map("need to reread map from %s", cbd->bk->uri);
+			msg_info_map("need to reread map from %s (reply code 200); "
+						 "date timestamp: %z, last modified: %z",
+						 cbd->bk->uri, (size_t) msg->date, (size_t) msg->last_modified);
 			cbd->periodic->need_modify = TRUE;
 			/* Reset the whole chain */
 			cbd->periodic->cur_backend = 0;
 			/* Reset cache, old cached data will be cleaned on timeout */
 			g_atomic_int_set(&data->cache->available, 0);
+			g_atomic_int_set(&map->shared->loaded, 0);
 			data->cur_cache_cbd = NULL;
 
 			rspamd_map_process_periodic(cbd->periodic);
@@ -330,6 +432,7 @@ http_map_finish(struct rspamd_http_connection *conn,
 			return 0;
 		}
 
+		/* This code is executed when we are actually reading a map */
 		cbd->data->last_checked = msg->date;
 
 		if (msg->last_modified) {
@@ -360,10 +463,11 @@ http_map_finish(struct rspamd_http_connection *conn,
 			goto err;
 		}
 
-		/* Check for expires */
+		/* Check for expires + etag */
 		double cached_timeout = map->poll_timeout * 2;
 
 		expires_hdr = rspamd_http_message_find_header(msg, "Expires");
+		etag_hdr = rspamd_http_message_find_header(msg, "ETag");
 
 		if (expires_hdr) {
 			time_t hdate;
@@ -371,19 +475,27 @@ http_map_finish(struct rspamd_http_connection *conn,
 			hdate = rspamd_http_parse_date(expires_hdr->begin, expires_hdr->len);
 
 			if (hdate != (time_t) -1 && hdate > msg->date) {
-				cached_timeout = map->next_check - msg->date +
-								 map->poll_timeout * 2;
-
-				map->next_check = hdate;
+				map->next_check = rspamd_http_map_process_next_check(map, bk, msg->date, hdate,
+																	 (time_t) map->poll_timeout,
+																	 etag_hdr != NULL,
+																	 msg->last_modified != 0);
+				cached_timeout = map->next_check - msg->date;
 			}
 			else {
 				msg_info_map("invalid expires header: %T, ignore it", expires_hdr);
 				map->next_check = 0;
 			}
 		}
-
-		/* Check for etag */
-		etag_hdr = rspamd_http_message_find_header(msg, "ETag");
+		else if (etag_hdr != NULL || msg->last_modified != 0) {
+			/* No expires header, but we have ETag or Last-Modified - use respectful interval */
+			time_t effective_interval = rspamd_map_get_respectful_interval(map->poll_timeout);
+			if (effective_interval != map->poll_timeout) {
+				msg_info_map("map polling interval %d too aggressive with server cache support, "
+							 "using %d seconds minimum",
+							 (int) map->poll_timeout, (int) effective_interval);
+			}
+			map->next_check = msg->date + effective_interval;
+		}
 
 		if (etag_hdr) {
 			if (cbd->data->etag) {
@@ -404,10 +516,7 @@ http_map_finish(struct rspamd_http_connection *conn,
 
 		MAP_RETAIN(cbd->shmem_data, "shmem_data");
 		cbd->data->gen++;
-		/*
-		 * We know that a map is in the locked state
-		 */
-		g_atomic_int_set(&data->cache->available, 1);
+
 		/* Store cached data */
 		rspamd_strlcpy(data->cache->shmem_name, cbd->shmem_data->shm_name,
 					   sizeof(data->cache->shmem_name));
@@ -509,6 +618,12 @@ http_map_finish(struct rspamd_http_connection *conn,
 
 		cbd->periodic->cur_backend++;
 		munmap(in, dlen);
+
+		/* Announce for other processes */
+		g_atomic_int_set(&data->cache->available, 1);
+		g_atomic_int_set(&map->shared->loaded, 1);
+		g_atomic_int_set(&map->shared->cached, 1);
+
 		rspamd_map_process_periodic(cbd->periodic);
 	}
 	else if (msg->code == 304 && cbd->check) {
@@ -522,19 +637,34 @@ http_map_finish(struct rspamd_http_connection *conn,
 		}
 
 		expires_hdr = rspamd_http_message_find_header(msg, "Expires");
+		bool has_expires = (expires_hdr != NULL);
 
 		if (expires_hdr) {
 			time_t hdate;
 
 			hdate = rspamd_http_parse_date(expires_hdr->begin, expires_hdr->len);
 			if (hdate != (time_t) -1 && hdate > msg->date) {
-				map->next_check = hdate;
+				map->next_check = rspamd_http_map_process_next_check(map, bk, msg->date, hdate,
+																	 (time_t) map->poll_timeout,
+																	 cbd->data->etag != NULL,
+																	 msg->last_modified != 0);
 			}
 			else {
 				msg_info_map("invalid expires header: %T, ignore it", expires_hdr);
 				map->next_check = 0;
+				has_expires = false;
 			}
 		}
+		else if (cbd->data->etag != NULL || msg->last_modified != 0) {
+			/* No expires header, but we have ETag or Last-Modified - use respectful interval */
+			time_t effective_interval = rspamd_map_get_respectful_interval(map->poll_timeout);
+			if (effective_interval != map->poll_timeout) {
+				msg_info_map("map polling interval %d too aggressive with server cache support, "
+							 "using %d seconds minimum",
+							 (int) map->poll_timeout, (int) effective_interval);
+			}
+			map->next_check = msg->date + effective_interval;
+		}
 
 		etag_hdr = rspamd_http_message_find_header(msg, "ETag");
 
@@ -547,19 +677,24 @@ http_map_finish(struct rspamd_http_connection *conn,
 			}
 		}
 
-		if (map->next_check) {
+		if (has_expires) {
 			rspamd_http_date_format(next_check_date, sizeof(next_check_date),
 									map->next_check);
-			msg_info_map("data is not modified for server %s, next check at %s "
+			msg_info_map("data is not modified for server %s (%s), next check at %s "
 						 "(http cache based: %T)",
-						 cbd->data->host, next_check_date, expires_hdr);
+						 cbd->data->host,
+						 bk->uri,
+						 next_check_date,
+						 expires_hdr);
 		}
 		else {
 			rspamd_http_date_format(next_check_date, sizeof(next_check_date),
-									rspamd_get_calendar_ticks() + map->poll_timeout);
-			msg_info_map("data is not modified for server %s, next check at %s "
+									map->next_check);
+			msg_info_map("data is not modified for server %s (%s), next check at %s "
 						 "(timer based)",
-						 cbd->data->host, next_check_date);
+						 cbd->data->host,
+						 bk->uri,
+						 next_check_date);
 		}
 
 		rspamd_map_update_http_cached_file(map, bk, cbd->data);
@@ -902,6 +1037,8 @@ read_map_file(struct rspamd_map *map, struct file_map_data *data,
 		map->read_callback(NULL, 0, &periodic->cbdata, TRUE);
 	}
 
+	g_atomic_int_set(&map->shared->loaded, 1);
+
 	return TRUE;
 }
 
@@ -986,6 +1123,7 @@ read_map_static(struct rspamd_map *map, struct static_map_data *data,
 	}
 
 	data->processed = TRUE;
+	g_atomic_int_set(&map->shared->loaded, 1);
 
 	return TRUE;
 }
@@ -993,9 +1131,7 @@ read_map_static(struct rspamd_map *map, struct static_map_data *data,
 static void
 rspamd_map_periodic_dtor(struct map_periodic_cbdata *periodic)
 {
-	struct rspamd_map *map;
-
-	map = periodic->map;
+	struct rspamd_map *map = periodic->map;
 	msg_debug_map("periodic dtor %p; need_modify=%d", periodic, periodic->need_modify);
 
 	if (periodic->need_modify || periodic->cbdata.errored) {
@@ -1010,18 +1146,13 @@ rspamd_map_periodic_dtor(struct map_periodic_cbdata *periodic)
 		/* Not modified */
 	}
 
-	if (periodic->locked) {
-		g_atomic_int_set(periodic->map->locked, 0);
-		msg_debug_map("unlocked map %s", periodic->map->name);
-
-		if (periodic->map->wrk->state == rspamd_worker_state_running) {
-			rspamd_map_schedule_periodic(periodic->map,
-										 RSPAMD_SYMBOL_RESULT_NORMAL);
-		}
-		else {
-			msg_debug_map("stop scheduling periodics for %s; terminating state",
-						  periodic->map->name);
-		}
+	if (periodic->map->wrk->state == rspamd_worker_state_running) {
+		rspamd_map_schedule_periodic(periodic->map,
+									 RSPAMD_MAP_SCHEDULE_NORMAL);
+	}
+	else {
+		msg_debug_map("stop scheduling periodics for %s; terminating state",
+					  periodic->map->name);
 	}
 
 	g_free(periodic);
@@ -1458,7 +1589,7 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 								 const unsigned char *data,
 								 gsize len)
 {
-	char path[PATH_MAX];
+	char path[PATH_MAX], temp_path[PATH_MAX];
 	unsigned char digest[rspamd_cryptobox_HASHBYTES];
 	struct rspamd_config *cfg = map->cfg;
 	int fd;
@@ -1471,8 +1602,10 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 	rspamd_cryptobox_hash(digest, bk->uri, strlen(bk->uri), NULL, 0);
 	rspamd_snprintf(path, sizeof(path), "%s%c%*xs.map", cfg->maps_cache_dir,
 					G_DIR_SEPARATOR, 20, digest);
+	rspamd_snprintf(temp_path, sizeof(temp_path), "%s.tmp.%d.%d", path,
+					(int) getpid(), (int) rspamd_get_calendar_ticks());
 
-	fd = rspamd_file_xopen(path, O_WRONLY | O_TRUNC | O_CREAT,
+	fd = rspamd_file_xopen(temp_path, O_WRONLY | O_TRUNC | O_CREAT,
 						   00600, FALSE);
 
 	if (fd == -1) {
@@ -1480,8 +1613,9 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 	}
 
 	if (!rspamd_file_lock(fd, FALSE)) {
-		msg_err_map("cannot lock file %s: %s", path, strerror(errno));
+		msg_err_map("cannot lock file %s: %s", temp_path, strerror(errno));
 		close(fd);
+		unlink(temp_path);
 
 		return FALSE;
 	}
@@ -1500,9 +1634,10 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 	}
 
 	if (write(fd, &header, sizeof(header)) != sizeof(header)) {
-		msg_err_map("cannot write file %s (header stage): %s", path, strerror(errno));
+		msg_err_map("cannot write file %s (header stage): %s", temp_path, strerror(errno));
 		rspamd_file_unlock(fd, FALSE);
 		close(fd);
+		unlink(temp_path);
 
 		return FALSE;
 	}
@@ -1510,9 +1645,10 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 	if (header.etag_len > 0) {
 		if (write(fd, RSPAMD_FSTRING_DATA(htdata->etag), header.etag_len) !=
 			header.etag_len) {
-			msg_err_map("cannot write file %s (etag stage): %s", path, strerror(errno));
+			msg_err_map("cannot write file %s (etag stage): %s", temp_path, strerror(errno));
 			rspamd_file_unlock(fd, FALSE);
 			close(fd);
+			unlink(temp_path);
 
 			return FALSE;
 		}
@@ -1520,9 +1656,10 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 
 	/* Now write the rest */
 	if (write(fd, data, len) != len) {
-		msg_err_map("cannot write file %s (data stage): %s", path, strerror(errno));
+		msg_err_map("cannot write file %s (data stage): %s", temp_path, strerror(errno));
 		rspamd_file_unlock(fd, FALSE);
 		close(fd);
+		unlink(temp_path);
 
 		return FALSE;
 	}
@@ -1530,6 +1667,13 @@ rspamd_map_save_http_cached_file(struct rspamd_map *map,
 	rspamd_file_unlock(fd, FALSE);
 	close(fd);
 
+	/* Atomically move temp file to final location */
+	if (rename(temp_path, path) != 0) {
+		msg_err_map("cannot rename %s to %s: %s", temp_path, path, strerror(errno));
+		unlink(temp_path);
+		return FALSE;
+	}
+
 	msg_info_map("saved data from %s in %s, %uz bytes", bk->uri, path, len + sizeof(header) + header.etag_len);
 
 	return TRUE;
@@ -1663,7 +1807,11 @@ rspamd_map_read_http_cached_file(struct rspamd_map *map,
 	double now = rspamd_get_calendar_ticks();
 
 	if (header.next_check > now) {
-		map->next_check = header.next_check;
+		/* We assume that we have this data inside the cached file */
+		map->next_check = rspamd_http_map_process_next_check(map, bk, now, header.next_check,
+															 map->poll_timeout,
+															 header.etag_len > 0,
+															 true);
 	}
 	else {
 		map->next_check = now;
@@ -1710,6 +1858,9 @@ rspamd_map_read_http_cached_file(struct rspamd_map *map,
 	struct tm tm;
 	char ncheck_buf[32], lm_buf[32];
 
+	g_atomic_int_set(&map->shared->loaded, 1);
+	g_atomic_int_set(&map->shared->cached, 1);
+
 	rspamd_localtime(map->next_check, &tm);
 	strftime(ncheck_buf, sizeof(ncheck_buf) - 1, "%Y-%m-%d %H:%M:%S", &tm);
 	rspamd_localtime(htdata->last_modified, &tm);
@@ -1752,7 +1903,6 @@ rspamd_map_common_http_callback(struct rspamd_map *map,
 							 (int) data->last_modified,
 							 (int) data->cache->last_modified);
 				periodic->need_modify = TRUE;
-				/* Reset the whole chain */
 				periodic->cur_backend = 0;
 				rspamd_map_process_periodic(periodic);
 			}
@@ -2010,33 +2160,22 @@ rspamd_map_process_periodic(struct map_periodic_cbdata *cbd)
 	map = cbd->map;
 	map->scheduled_check = NULL;
 
-	if (!map->file_only && !cbd->locked) {
-		if (!g_atomic_int_compare_and_exchange(cbd->map->locked,
-											   0, 1)) {
-			msg_debug_map(
-				"don't try to reread map %s as it is locked by other process, "
-				"will reread it later",
-				cbd->map->name);
-			rspamd_map_schedule_periodic(map, RSPAMD_MAP_SCHEDULE_LOCKED);
-			MAP_RELEASE(cbd, "periodic");
+	/* For each backend we need to check for modifications */
+	if (cbd->cur_backend >= cbd->map->backends->len) {
+		/* Last backend */
+		msg_debug_map("finished map: %d of %d", cbd->cur_backend,
+					  cbd->map->backends->len);
+		MAP_RELEASE(cbd, "periodic");
 
-			return;
-		}
-		else {
-			msg_debug_map("locked map %s", cbd->map->name);
-			cbd->locked = TRUE;
-		}
+		return;
 	}
 
+	bk = g_ptr_array_index(map->backends, cbd->cur_backend);
+
 	if (cbd->errored) {
 		/* We should not check other backends if some backend has failed*/
 		rspamd_map_schedule_periodic(cbd->map, RSPAMD_MAP_SCHEDULE_ERROR);
 
-		if (cbd->locked) {
-			g_atomic_int_set(cbd->map->locked, 0);
-			cbd->locked = FALSE;
-		}
-
 		/* Also set error flag for the map consumer */
 		cbd->cbdata.errored = true;
 
@@ -2047,19 +2186,7 @@ rspamd_map_process_periodic(struct map_periodic_cbdata *cbd)
 		return;
 	}
 
-	/* For each backend we need to check for modifications */
-	if (cbd->cur_backend >= cbd->map->backends->len) {
-		/* Last backend */
-		msg_debug_map("finished map: %d of %d", cbd->cur_backend,
-					  cbd->map->backends->len);
-		MAP_RELEASE(cbd, "periodic");
-
-		return;
-	}
-
 	if (cbd->map->wrk && cbd->map->wrk->state == rspamd_worker_state_running) {
-		bk = g_ptr_array_index(cbd->map->backends, cbd->cur_backend);
-		g_assert(bk != NULL);
 
 		if (cbd->need_modify) {
 			/* Load data from the next backend */
@@ -2764,10 +2891,6 @@ rspamd_map_parse_backend(struct rspamd_config *cfg, const char *map_line)
 		bk->data.sd = sdata;
 	}
 
-	bk->id = rspamd_cryptobox_fast_hash_specific(RSPAMD_CRYPTOBOX_T1HA,
-												 bk->uri, strlen(bk->uri),
-												 0xdeadbabe);
-
 	return bk;
 
 err:
@@ -2798,6 +2921,13 @@ rspamd_map_calculate_hash(struct rspamd_map *map)
 
 	rspamd_cryptobox_hash_init(&st, NULL, 0);
 
+	if (map->name) {
+		rspamd_cryptobox_hash_update(&st, map->name, strlen(map->name));
+	}
+	if (map->description) {
+		rspamd_cryptobox_hash_update(&st, map->description, strlen(map->description));
+	}
+
 	for (i = 0; i < map->backends->len; i++) {
 		bk = g_ptr_array_index(map->backends, i);
 		rspamd_cryptobox_hash_update(&st, bk->uri, strlen(bk->uri));
@@ -2806,6 +2936,26 @@ rspamd_map_calculate_hash(struct rspamd_map *map)
 	rspamd_cryptobox_hash_final(&st, cksum);
 	cksum_encoded = rspamd_encode_base32(cksum, sizeof(cksum), RSPAMD_BASE32_DEFAULT);
 	rspamd_strlcpy(map->tag, cksum_encoded, sizeof(map->tag));
+
+	for (i = 0; i < map->backends->len; i++) {
+		bk = g_ptr_array_index(map->backends, i);
+
+		/* Also update each backend */
+		rspamd_cryptobox_fast_hash_state_t hst;
+		rspamd_cryptobox_fast_hash_init(&hst, 0);
+		rspamd_cryptobox_fast_hash_update(&hst, bk->uri, strlen(bk->uri));
+		rspamd_cryptobox_fast_hash_update(&hst, map->tag, sizeof(map->tag));
+
+		if (bk->protocol == MAP_PROTO_STATIC) {
+			/* Static maps content is pre-defined */
+			rspamd_cryptobox_fast_hash_update(&hst, bk->data.sd->data,
+											  bk->data.sd->len);
+		}
+
+		/* We use only 52 bits to be compatible with other numbers representation */
+		bk->id = rspamd_cryptobox_fast_hash_final(&hst) & ~(0xFFFULL << 52);
+	}
+
 	g_free(cksum_encoded);
 }
 
@@ -2871,8 +3021,8 @@ rspamd_map_add(struct rspamd_config *cfg,
 	map->user_data = user_data;
 	map->cfg = cfg;
 	map->id = rspamd_random_uint64_fast();
-	map->locked =
-		rspamd_mempool_alloc0_shared(cfg->cfg_pool, sizeof(int));
+	map->shared =
+		rspamd_mempool_alloc0_shared(cfg->cfg_pool, sizeof(struct rspamd_map_shared_data));
 	map->backends = g_ptr_array_sized_new(1);
 	map->wrk = worker;
 	rspamd_mempool_add_destructor(cfg->cfg_pool, rspamd_ptr_array_free_hard,
@@ -2971,8 +3121,8 @@ rspamd_map_add_from_ucl(struct rspamd_config *cfg,
 	map->user_data = user_data;
 	map->cfg = cfg;
 	map->id = rspamd_random_uint64_fast();
-	map->locked =
-		rspamd_mempool_alloc0_shared(cfg->cfg_pool, sizeof(int));
+	map->shared =
+		rspamd_mempool_alloc0_shared(cfg->cfg_pool, sizeof(struct rspamd_map_shared_data));
 	map->backends = g_ptr_array_new();
 	map->wrk = worker;
 	map->no_file_read = (flags & RSPAMD_MAP_FILE_NO_READ);
@@ -3091,7 +3241,7 @@ rspamd_map_add_from_ucl(struct rspamd_config *cfg,
 		goto err;
 	}
 
-	gboolean all_local = TRUE;
+	gboolean all_local = TRUE, all_loaded = TRUE;
 
 	PTR_ARRAY_FOREACH(map->backends, i, bk)
 	{
@@ -3110,9 +3260,8 @@ rspamd_map_add_from_ucl(struct rspamd_config *cfg,
 				map_data = g_string_sized_new(32);
 
 				if (rspamd_map_add_static_string(cfg, elt, map_data)) {
-					bk->data.sd->data = map_data->str;
 					bk->data.sd->len = map_data->len;
-					g_string_free(map_data, FALSE);
+					bk->data.sd->data = (unsigned char *) g_string_free(map_data, FALSE);
 				}
 				else {
 					g_string_free(map_data, TRUE);
@@ -3135,13 +3284,16 @@ rspamd_map_add_from_ucl(struct rspamd_config *cfg,
 				}
 
 				ucl_object_iterate_free(it);
-				bk->data.sd->data = map_data->str;
 				bk->data.sd->len = map_data->len;
-				g_string_free(map_data, FALSE);
+				bk->data.sd->data = (unsigned char *) g_string_free(map_data, FALSE);
 			}
 		}
 		else if (bk->protocol != MAP_PROTO_FILE) {
 			all_local = FALSE;
+			all_loaded = FALSE; /* Will be loaded later */
+		}
+		else {
+			all_loaded = FALSE; /* Will be loaded later (even for files) */
 		}
 	}
 
@@ -3150,6 +3302,11 @@ rspamd_map_add_from_ucl(struct rspamd_config *cfg,
 							 cfg->map_file_watch_multiplier);
 	}
 
+	if (all_loaded) {
+		/* Static map */
+		g_atomic_int_set(&map->shared->loaded, 1);
+	}
+
 	rspamd_map_calculate_hash(map);
 	msg_debug_map("added map from ucl");
 
@@ -3196,3 +3353,51 @@ void rspamd_map_set_on_load_function(struct rspamd_map *map, rspamd_map_on_load_
 		map->on_load_ud_dtor = dtor;
 	}
 }
+
+void rspamd_map_trigger_hyperscan_compilation(struct rspamd_map *map)
+{
+	/* Only trigger compilation in controller worker */
+	if (!map->cfg || !map->cfg->cur_worker) {
+		return;
+	}
+
+	struct rspamd_worker *worker = map->wrk;
+	if (!rspamd_worker_is_primary_controller(worker)) {
+		return;
+	}
+
+	/* Check if we have any scopes that need compilation */
+	if (!map->cfg->re_cache) {
+		return;
+	}
+
+	unsigned int scope_count = rspamd_re_cache_count_scopes(map->cfg->re_cache);
+	if (scope_count == 0) {
+		return;
+	}
+
+	/* Iterate through scopes and compile those that are loaded */
+	struct rspamd_re_cache *scope;
+
+	for (scope = rspamd_re_cache_scope_first(map->cfg->re_cache);
+		 scope != NULL;
+		 scope = rspamd_re_cache_scope_next(scope)) {
+		const char *scope_name = rspamd_re_cache_scope_name(scope);
+		const char *scope_for_check = (strcmp(scope_name, "default") == 0) ? NULL : scope_name;
+
+		/* Only compile loaded scopes */
+		if (rspamd_re_cache_is_loaded(map->cfg->re_cache, scope_for_check)) {
+			msg_info_map("triggering hyperscan compilation for scope: %s after map update",
+						 scope_name);
+
+			/* Use default settings for compilation */
+			rspamd_re_cache_compile_hyperscan_scoped_single(scope, scope_for_check,
+															map->cfg->hs_cache_dir ? map->cfg->hs_cache_dir : RSPAMD_DBDIR "/",
+															1.0,   /* max_time */
+															FALSE, /* silent */
+															worker->ctx ? ((struct rspamd_abstract_worker_ctx *) worker->ctx)->event_loop : NULL,
+															NULL,  /* callback */
+															NULL); /* cbdata */
+		}
+	}
+}