From: Victor Julien <victor@inliniac.net>
Date: Wed, 25 Nov 2020 08:22:44 +0000 (+0100)
Subject: detect: optimize prefilter result handling
X-Git-Tag: suricata-6.0.1~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e799357d9fbadb295468466907ab1972564b9a8c;p=thirdparty%2Fsuricata.git

detect: optimize prefilter result handling
---

diff --git a/src/detect.c b/src/detect.c
index 519ae9ea26..8a71fc8f1d 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -345,8 +345,8 @@ static inline void DetectPrefilterMergeSort(DetectEngineCtx *de_ctx,
     }
 
     det_ctx->match_array_cnt = match_array - det_ctx->match_array;
-
     DEBUG_VALIDATE_BUG_ON((det_ctx->pmq.rule_id_array_cnt + det_ctx->non_pf_id_cnt) < det_ctx->match_array_cnt);
+    PMQ_RESET(&det_ctx->pmq);
 }
 
 /** \internal
@@ -684,6 +684,11 @@ static inline void DetectRunPrefilterPkt(
     Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags);
     /* create match list if we have non-pf and/or pf */
     if (det_ctx->non_pf_store_cnt || det_ctx->pmq.rule_id_array_cnt) {
+#ifdef PROFILING
+        if (tv) {
+            StatsAddUI64(tv, det_ctx->counter_mpm_list, (uint64_t)det_ctx->pmq.rule_id_array_cnt);
+        }
+#endif
         PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
         DetectPrefilterMergeSort(de_ctx, det_ctx);
         PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
@@ -691,8 +696,6 @@ static inline void DetectRunPrefilterPkt(
 
 #ifdef PROFILING
     if (tv) {
-        StatsAddUI64(tv, det_ctx->counter_mpm_list,
-                             (uint64_t)det_ctx->pmq.rule_id_array_cnt);
         StatsAddUI64(tv, det_ctx->counter_nonmpm_list,
                              (uint64_t)det_ctx->non_pf_store_cnt);
         /* non mpm sigs after mask prefilter */
@@ -944,8 +947,6 @@ static void DetectRunCleanup(DetectEngineThreadCtx *det_ctx,
         Packet *p, Flow * const pflow)
 {
     PACKET_PROFILING_DETECT_START(p, PROF_DETECT_CLEANUP);
-    /* cleanup pkt specific part of the patternmatcher */
-    PacketPatternCleanup(det_ctx);
     InspectionBufferClean(det_ctx);
 
     if (pflow != NULL) {
@@ -1345,6 +1346,7 @@ static void DetectRunTx(ThreadVars *tv,
                 det_ctx->tx_candidates[array_idx].stream_reset = 0;
                 array_idx++;
             }
+            PMQ_RESET(&det_ctx->pmq);
         } else {
             if (!(RuleMatchCandidateTxArrayHasSpace(det_ctx, total_rules))) {
                 RuleMatchCandidateTxArrayExpand(det_ctx, total_rules);