]> git.ipfire.org Git - thirdparty/suricata.git/commit
app-layer: track modified/processed txs
authorPhilippe Antoine <pantoine@oisf.net>
Fri, 31 May 2024 08:39:16 +0000 (10:39 +0200)
committerVictor Julien <victor@inliniac.net>
Tue, 10 Dec 2024 13:40:04 +0000 (14:40 +0100)
commitb02557ac7dd6b55187309cee93f849ee2917d0cb
treeae8df28f047fdebd71dc5cfd2ba99ce3dcd40130
parente62c7d733b94ca9380e24bd4c85825c1a2cef3c7
app-layer: track modified/processed txs

To optimize detection, and logging, to avoid going through
all the live transactions when only a few were modified.

Two boolean fields are added to the tx data: updated_tc and ts
The app-layer parsers are now responsible to set these when
needed, and the logging and detection uses them to skip
transactions that were not updated.

There may some more optimization remaining by when we set
both updated_tc and updated_ts in functions returning
a mutable transaction, by checking if all the callers
are called in one direction only (request or response)

Ticket: 7087
25 files changed:
rust/src/applayer.rs
rust/src/applayertemplate/template.rs
rust/src/dcerpc/dcerpc.rs
rust/src/dcerpc/dcerpc_udp.rs
rust/src/enip/enip.rs
rust/src/http2/http2.rs
rust/src/ldap/ldap.rs
rust/src/modbus/modbus.rs
rust/src/mqtt/mqtt.rs
rust/src/nfs/nfs.rs
rust/src/pgsql/pgsql.rs
rust/src/rfb/rfb.rs
rust/src/smb/dcerpc.rs
rust/src/smb/files.rs
rust/src/smb/session.rs
rust/src/smb/smb.rs
rust/src/ssh/ssh.rs
src/app-layer-dnp3.c
src/app-layer-ftp.c
src/app-layer-htp.c
src/app-layer-parser.c
src/app-layer-smtp.c
src/app-layer-ssl.c
src/detect.c
src/output-tx.c