-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Description
Stemming from discussion here: https://sourceforge.net/p/mod-security/mailman/message/36285420/
v3/master code currently uses a large number of dynamic memory allocations in hot code paths. Consider the following flamegraphs, the first generated from bt samples taken while running the simple_example_using_c program and loading the full OWASP 3 CRS, and the second generated with the same program but using a dummy ruleset (https://gist.github.com/p0pr0ck5/e0c73606f0be8ab93edb729e6cb56c5d):
https://s3.amazonaws.com/p0pr0ck5-data/modsec-simple-crs.svg
https://s3.amazonaws.com/p0pr0ck5-data/modsec-simple-mock.svg
By far, the largest samples are collected inside of a given Rule::evaluate call. Within this call there are several expensive children calls (such as getFinalVars) that each perform a number of dynamic memory allocations. This leads to a significant overhead that reduces libmodsecurity performance considerably (see the thread linked above for numbers in various use cases).
I suspect the large number of allocations can be reduced either by refactoring these functions to re-use object allocations, or by implementing a memory pool such that libc's malloc no longer needs to be aggressively called in hot code paths. In either case this is a likely no small undertaking, so I am opening this issue to track discussion on this work.