]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
detect: optimize prefilter result handling
authorVictor Julien <victor@inliniac.net>
Wed, 25 Nov 2020 08:22:44 +0000 (09:22 +0100)
committerVictor Julien <victor@inliniac.net>
Wed, 25 Nov 2020 13:43:28 +0000 (14:43 +0100)
src/detect.c

index 519ae9ea26501aedae7cd151fdd990d43c92346c..8a71fc8f1d65a7afdd5686ae202a9d41294f8e57 100644 (file)
@@ -345,8 +345,8 @@ static inline void DetectPrefilterMergeSort(DetectEngineCtx *de_ctx,
     }
 
     det_ctx->match_array_cnt = match_array - det_ctx->match_array;
-
     DEBUG_VALIDATE_BUG_ON((det_ctx->pmq.rule_id_array_cnt + det_ctx->non_pf_id_cnt) < det_ctx->match_array_cnt);
+    PMQ_RESET(&det_ctx->pmq);
 }
 
 /** \internal
@@ -684,6 +684,11 @@ static inline void DetectRunPrefilterPkt(
     Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags);
     /* create match list if we have non-pf and/or pf */
     if (det_ctx->non_pf_store_cnt || det_ctx->pmq.rule_id_array_cnt) {
+#ifdef PROFILING
+        if (tv) {
+            StatsAddUI64(tv, det_ctx->counter_mpm_list, (uint64_t)det_ctx->pmq.rule_id_array_cnt);
+        }
+#endif
         PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
         DetectPrefilterMergeSort(de_ctx, det_ctx);
         PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
@@ -691,8 +696,6 @@ static inline void DetectRunPrefilterPkt(
 
 #ifdef PROFILING
     if (tv) {
-        StatsAddUI64(tv, det_ctx->counter_mpm_list,
-                             (uint64_t)det_ctx->pmq.rule_id_array_cnt);
         StatsAddUI64(tv, det_ctx->counter_nonmpm_list,
                              (uint64_t)det_ctx->non_pf_store_cnt);
         /* non mpm sigs after mask prefilter */
@@ -944,8 +947,6 @@ static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
         Packet *p, Flow * const pflow)
 {
     PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
-    /* cleanup pkt specific part of the patternmatcher */
-    PacketPatternCleanup(det_ctx);
     InspectionBufferClean(det_ctx);
 
     if (pflow != NULL) {
@@ -1345,6 +1346,7 @@ static void DetectRunTx(ThreadVars *tv,
                 det_ctx->tx_candidates[array_idx].stream_reset = 0;
                 array_idx++;
             }
+            PMQ_RESET(&det_ctx->pmq);
         } else {
             if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
                 RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);