detect: bypass merge sort call if possible

8 years ago · 5e65d79be0
parent 11cb84ad35
commit 5e65d79be0
1 changed files with 6 additions and 3 deletions
--- a/src/detect.c
+++ b/src/detect.c
@ -729,9 +729,12 @@ static inline void DetectRunPrefilterPkt(

    /* run the prefilter engines */
    Prefilter(det_ctx, scratch->sgh, p, scratch->flow_flags);
-    PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
-    DetectPrefilterMergeSort(de_ctx, det_ctx);
-    PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
+    /* create match list if we have non-pf and/or pf */
+    if (det_ctx->non_pf_store_cnt || det_ctx->pmq.rule_id_array_cnt) {
+        PACKET_PROFILING_DETECT_START(p, PROF_DETECT_PF_SORT2);
+        DetectPrefilterMergeSort(de_ctx, det_ctx);
+        PACKET_PROFILING_DETECT_END(p, PROF_DETECT_PF_SORT2);
+    }

 #ifdef PROFILING
    if (tv) {