Suricata

When the app-layer-event keyword matching code runs, it's called with both the tx ptr and the tx id. When matching it just uses the id to look up the events, so this in turn does a tx ptr look up. In some protocols/scenarios this can be quite an expensive operation. Since the tx ptr is already available, the code should be changed to use the tx ptr.