There are some performance issues with the source code

Reference trunk code
file: util-var.c
func: GenericVarAppend

This is a singly linked list. Why do we choose tail insertion when inserting nodes? I think there is no order requirement for nodes such as flowbits. Why not just use head insertion?

Hi,

Are you seeing performance issues that indicate there’s a problem with the way the list is maintained or is this a general concern?

I just think that for linked lists without order requirements, when inserting nodes into a singly linked list, you can just use the head insertion method. This is not a performance test supported by actual data, I just don’t understand the reason for doing this. When a flow hits multiple rules with ‘flowbits:set;’, then each insertion of ‘flowbits’ will traverse to the end of the linked list, or is there something wrong with my understanding?

Thanks. We don’t have any reports of performance issues related to this but we are open to suggestions.

One way we receive suggestions – the preferred way – is through feature requests at our Redmine site – https://redmine.openinfosecfoundation.org/

We prefer feature requests for things like this. We are also open to community contributions to Suricata. We can’t make any guarantees on whether a contribution will be accepted but it will be given consideration.

Thank you for your patient reply
This question may not be a suggestion yet. Because I think that the designer may have considered that ‘xbis’ or ‘threshold’ will most likely follow the first-in-last-out scenario? So that it can be removed more quickly. Of course, this is just my guess. I will try to raise it on Redmine. Thank you