From 8baef60d600c5254662633d8275f321a6dafb82c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 1 Feb 2021 22:23:47 +0100 Subject: [PATCH 1/2] app-layer: fix transaction cleanup Fix a 'skipped' transaction early in the list leading to all further transactions getting skipped, even if they were fully processed and ready to be cleaned up. --- src/app-layer-parser.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c index f94c81ddebb1..a80ac9484e9f 100644 --- a/src/app-layer-parser.c +++ b/src/app-layer-parser.c @@ -922,6 +922,7 @@ void AppLayerParserTransactionsCleanup(Flow *f) if (ires.tx_ptr == NULL) break; + bool tx_skipped = false; void *tx = ires.tx_ptr; i = ires.tx_id; // actual tx id for the tx the IterFunc returned @@ -950,7 +951,7 @@ void AppLayerParserTransactionsCleanup(Flow *f) if (!(detect_flags_ts & APP_LAYER_TX_INSPECTED_FLAG)) { SCLogDebug("%p/%"PRIu64" skipping: TS inspect not done: ts:%"PRIx64, tx, i, detect_flags_ts); - skipped = true; + tx_skipped = skipped = true; } else { inspected = true; } @@ -960,7 +961,7 @@ void AppLayerParserTransactionsCleanup(Flow *f) if (!(detect_flags_tc & APP_LAYER_TX_INSPECTED_FLAG)) { SCLogDebug("%p/%"PRIu64" skipping: TC inspect not done: tc:%"PRIx64, tx, i, detect_flags_tc); - skipped = true; + tx_skipped = skipped = true; } else { inspected = true; } @@ -969,7 +970,8 @@ void AppLayerParserTransactionsCleanup(Flow *f) // If not a unidirectional transaction both sides are required to have // been inspected. - if (!is_unidir && skipped) { + if (!is_unidir && tx_skipped) { + SCLogDebug("%p/%" PRIu64 " !is_unidir && tx_skipped", tx, i); goto next; } @@ -977,7 +979,8 @@ void AppLayerParserTransactionsCleanup(Flow *f) // inspected, which the inspected flag tells us. This is also guarded // with skip to limit this check to transactions that actually had the // tx inspected flag checked. - if (is_unidir && skipped && !inspected) { + if (is_unidir && tx_skipped && !inspected) { + SCLogDebug("%p/%" PRIu64 " is_unidir && tx_skipped && !inspected", tx, i); goto next; } From 17a38f1823adeb9eb059f666686e35509f3a13d2 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 3 Feb 2021 12:00:51 +0100 Subject: [PATCH 2/2] flow/manager: (u)sleep slightly longer Sleep 250 microseconds instead of 100 as running in KVM cause the old value to use 100% CPU for these threads. Perf testing suggests no measurable impact for the non-KVM case. Ticket: #4096 --- src/flow-manager.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/flow-manager.c b/src/flow-manager.c index cb430ec74da4..d58a49637d6a 100644 --- a/src/flow-manager.c +++ b/src/flow-manager.c @@ -1011,7 +1011,7 @@ static TmEcode FlowManager(ThreadVars *th_v, void *thread_data) memset(&sleep_startts, 0, sizeof(sleep_startts)); gettimeofday(&sleep_startts, NULL); #endif - usleep(100); + usleep(250); #ifdef FM_PROFILE struct timeval sleep_endts; @@ -1207,7 +1207,7 @@ static TmEcode FlowRecycler(ThreadVars *th_v, void *thread_data) memset(&sleep_startts, 0, sizeof(sleep_startts)); gettimeofday(&sleep_startts, NULL); #endif - usleep(100); + usleep(250); #ifdef FM_PROFILE struct timeval sleep_endts; memset(&sleep_endts, 0, sizeof(sleep_endts));