There are some performance issues with the source code

Developers
1

Reference trunk code
file: util-var.c
func: GenericVarAppend

This is a singly linked list. Why do we choose tail insertion when inserting nodes? I think there is no order requirement for nodes such as flowbits. Why not just use head insertion?

2

Hi,

Are you seeing performance issues that indicate there’s a problem with the way the list is maintained or is this a general concern?

3

I just think that for linked lists without order requirements, when inserting nodes into a singly linked list, you can just use the head insertion method. This is not a performance test supported by actual data, I just don’t understand the reason for doing this. When a flow hits multiple rules with ‘flowbits:set;’, then each insertion of ‘flowbits’ will traverse to the end of the linked list, or is there something wrong with my understanding?

4

Thanks. We don’t have any reports of performance issues related to this but we are open to suggestions.

One way we receive suggestions – the preferred way – is through feature requests at our Redmine site – https://redmine.openinfosecfoundation.org/

We prefer feature requests for things like this. We are also open to community contributions to Suricata. We can’t make any guarantees on whether a contribution will be accepted but it will be given consideration.

5

Thank you for your patient reply
This question may not be a suggestion yet. Because I think that the designer may have considered that ‘xbis’ or ‘threshold’ will most likely follow the first-in-last-out scenario? So that it can be removed more quickly. Of course, this is just my guess. I will try to raise it on Redmine. Thank you