refactor: engine/tcp/worker perf improvements

ruleset/expr.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"reflect"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/expr-lang/expr/builtin"
@@ -67,6 +68,19 @@ type compiledExprRule struct {
 
 var _ Ruleset = (*exprRuleset)(nil)
 
+var (
+	envPool = sync.Pool{
+		New: func() any {
+			return make(map[string]any, 16)
+		},
+	}
+	subMapPool = sync.Pool{
+		New: func() any {
+			return make(map[string]any, 8)
+		},
+	}
+)
+
 type exprRuleset struct {
 	Rules      []compiledExprRule
 	Ans        []analyzer.Analyzer
@@ -79,7 +93,9 @@ func (r *exprRuleset) Analyzers(info StreamInfo) []analyzer.Analyzer {
 }
 
 func (r *exprRuleset) Match(info StreamInfo) MatchResult {
-	env := streamInfoToExprEnv(info)
+	env := envPool.Get().(map[string]any)
+	clear(env)
+	populateExprEnv(env, info)
 	now := time.Now()
 	for _, rule := range r.Rules {
 		if !matchTime(now, rule.StartTimeSecs, rule.StopTimeSecs, rule.Weekdays, rule.WeekdaysNegated) {
@@ -99,6 +115,7 @@ func (r *exprRuleset) Match(info StreamInfo) MatchResult {
 				r.Logger.Log(logInfo, rule.Name)
 			}
 			if rule.Action != nil {
+				envPool.Put(env)
 				return MatchResult{
 					Action:      *rule.Action,
 					ModInstance: rule.ModInstance,
@@ -106,7 +123,7 @@ func (r *exprRuleset) Match(info StreamInfo) MatchResult {
 			}
 		}
 	}
-	// No match
+	envPool.Put(env)
 	return MatchResult{
 		Action: ActionMaybe,
 	}
@@ -228,30 +245,26 @@ func CompileExprRules(rules []ExprRule, ans []analyzer.Analyzer, mods []modifier
 	}, nil
 }
 
-func streamInfoToExprEnv(info StreamInfo) map[string]interface{} {
-	m := map[string]interface{}{
-		"id":    info.ID,
-		"proto": info.Protocol.String(),
-		"mac": map[string]string{
-			"src": info.SrcMAC.String(),
-			"dst": info.DstMAC.String(),
-		},
-		"ip": map[string]string{
-			"src": info.SrcIP.String(),
-			"dst": info.DstIP.String(),
-		},
-		"port": map[string]uint16{
-			"src": info.SrcPort,
-			"dst": info.DstPort,
-		},
+func populateExprEnv(m map[string]any, info StreamInfo) {
+	m["id"] = info.ID
+	m["proto"] = info.Protocol.String()
+	m["mac"] = map[string]string{
+		"src": info.SrcMAC.String(),
+		"dst": info.DstMAC.String(),
+	}
+	m["ip"] = map[string]string{
+		"src": info.SrcIP.String(),
+		"dst": info.DstIP.String(),
+	}
+	m["port"] = map[string]uint16{
+		"src": info.SrcPort,
+		"dst": info.DstPort,
 	}
 	for anName, anProps := range info.Props {
 		if len(anProps) != 0 {
-			// Ignore analyzers with empty properties
 			m[anName] = anProps
 		}
 	}
-	return m
 }
 
 func isBuiltInAnalyzer(name string) bool {