]> git.ipfire.org Git - thirdparty/suricata.git/commit
app-layer: track modified/processed txs 12678/head
authorPhilippe Antoine <pantoine@oisf.net>
Fri, 31 May 2024 08:39:16 +0000 (10:39 +0200)
committerVictor Julien <victor@inliniac.net>
Wed, 26 Feb 2025 06:56:28 +0000 (07:56 +0100)
commit782f35c5cf8fb6375ae98f62ffb5a0e0ab0021c7
tree45088464d1741f6e32d559a9737f766d4635082e
parent05bf4a8dece772495c815866d395ea2ac103d9cd
app-layer: track modified/processed txs

To optimize detection, and logging, to avoid going through
all the live transactions when only a few were modified.

Two boolean fields are added to the tx data: updated_tc and ts
The app-layer parsers are now responsible to set these when
needed, and the logging and detection uses them to skip
transactions that were not updated.

There may some more optimization remaining by when we set
both updated_tc and updated_ts in functions returning
a mutable transaction, by checking if all the callers
are called in one direction only (request or response)

Ticket: 7087
(cherry picked from commit b02557ac7dd6b55187309cee93f849ee2917d0cb)
23 files changed:
rust/src/applayer.rs
rust/src/applayertemplate/template.rs
rust/src/dcerpc/dcerpc.rs
rust/src/dcerpc/dcerpc_udp.rs
rust/src/http2/http2.rs
rust/src/modbus/modbus.rs
rust/src/mqtt/mqtt.rs
rust/src/nfs/nfs.rs
rust/src/pgsql/pgsql.rs
rust/src/rfb/rfb.rs
rust/src/smb/dcerpc.rs
rust/src/smb/files.rs
rust/src/smb/session.rs
rust/src/smb/smb.rs
rust/src/ssh/ssh.rs
src/app-layer-dnp3.c
src/app-layer-ftp.c
src/app-layer-htp.c
src/app-layer-parser.c
src/app-layer-smtp.c
src/app-layer-ssl.c
src/detect.c
src/output-tx.c