detect/alert: optimize context cleanup

Don't always loop over each alert, but only do so if context was used.

diff --git a/src/decode.h b/src/decode.h
index 397f4ca97003b9db7a9cf470493d9543166984cc..bd0fdb4cd9acaaee14824051bd64a74dea655ade 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -1248,7 +1248,9 @@ void DecodeUnregisterCounters(void);
 
 /** Flag to indicate that packet contents should not be inspected */
 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)
-// vacancy
+
+/** set if PacketAlerts may contain json context data */
+#define PKT_ALERT_CTX_USED BIT_U32(3)
 
 /** Packet has matched a tag */
 #define PKT_HAS_TAG BIT_U32(4)

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 4e697978a3f096654847caae962f5f25393cee44..709e41c2ef3d8a3f8c38923b944b2eabc997201c 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -570,6 +570,8 @@ void PacketAlertFinalize(const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *d
 
     if (det_ctx->alert_queue_size > 0) {
         PacketAlertFinalizeProcessQueue(de_ctx, det_ctx, p);
+        if (det_ctx->json_content_len)
+            p->flags |= PKT_ALERT_CTX_USED;
     }
 
     /* At this point, we should have all the new alerts. Now check the tag

diff --git a/src/packet.c b/src/packet.c
index 80ecfb166dd1dbc50f653196efc3a266fcd4ebe7..0be394d76d996d6183f6fef19ed6eb31bca59b70 100644 (file)
--- a/src/packet.c
+++ b/src/packet.c
@@ -99,6 +99,7 @@ void PacketReinit(Packet *p)
     p->app_update_direction = 0;
     p->sig_mask = 0;
     p->pkt_hooks = 0;
+    const uint32_t pflags = p->flags;
     p->flags = 0;
     p->flowflags = 0;
     p->pkt_src = 0;
@@ -127,7 +128,8 @@ void PacketReinit(Packet *p)
     p->alerts.suppressed = 0;
     p->alerts.drop.action = 0;
     if (p->alerts.cnt > 0) {
-        PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt);
+        if (pflags & PKT_ALERT_CTX_USED)
+            PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt);
         p->alerts.cnt = 0;
     }
     p->pcap_cnt = 0;