Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

UpdateConnVal: Avoid FieldOffset() calls

Browse source 
These can be significant if a lot of new connections and or events
are created for which an existing conn val needs updating and otherwise
things are very fast.
This commit is contained in:
Arne Welzel 2023-12-02 23:21:09 +01:00
parent c3762ba9d3
commit 01e305edd8
2 changed files with 13 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/analyzer/protocol/conn-size/ConnSize.cc
View file

@ -139,20 +139,15 @@ void ConnSize_Analyzer::SetDurationThreshold(double duration) {
} }
void ConnSize_Analyzer::UpdateConnVal(RecordVal* conn_val) { void ConnSize_Analyzer::UpdateConnVal(RecordVal* conn_val) {
// RecordType *connection_type is declared in NetVar.h static const auto& conn_type = zeek::id::find_type<zeek::RecordType>("connection");
RecordVal* orig_endp = conn_val->GetFieldAs<RecordVal>("orig"); static const int origidx = conn_type->FieldOffset("orig");
RecordVal* resp_endp = conn_val->GetFieldAs<RecordVal>("resp"); static const int respidx = conn_type->FieldOffset("resp");
static const auto& endpoint_type = zeek::id::find_type<zeek::RecordType>("endpoint");
// endpoint is the RecordType from NetVar.h static const int pktidx = endpoint_type->FieldOffset("num_pkts");
int pktidx = id::endpoint->FieldOffset("num_pkts"); static const int bytesidx = endpoint_type->FieldOffset("num_bytes_ip");
int bytesidx = id::endpoint->FieldOffset("num_bytes_ip");
if ( pktidx < 0 )
reporter->InternalError("'endpoint' record missing 'num_pkts' field");
if ( bytesidx < 0 )
reporter->InternalError("'endpoint' record missing 'num_bytes_ip' field");
auto* orig_endp = conn_val->GetFieldAs<RecordVal>(origidx);
auto* resp_endp = conn_val->GetFieldAs<RecordVal>(respidx);
orig_endp->Assign(pktidx, orig_pkts); orig_endp->Assign(pktidx, orig_pkts);
orig_endp->Assign(bytesidx, orig_bytes); orig_endp->Assign(bytesidx, orig_bytes);
resp_endp->Assign(pktidx, resp_pkts); resp_endp->Assign(pktidx, resp_pkts);

7
src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
View file

@ -1027,8 +1027,11 @@ void TCPSessionAdapter::FlipRoles() {
} }
void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val) { void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val) {
auto orig_endp_val = conn_val->GetFieldAs<RecordVal>("orig"); static const auto& conn_type = zeek::id::find_type<zeek::RecordType>("connection");
auto resp_endp_val = conn_val->GetFieldAs<RecordVal>("resp"); static const int origidx = conn_type->FieldOffset("orig");
static const int respidx = conn_type->FieldOffset("resp");
auto* orig_endp_val = conn_val->GetFieldAs<RecordVal>(origidx);
auto* resp_endp_val = conn_val->GetFieldAs<RecordVal>(respidx);
orig_endp_val->Assign(0, orig->Size()); orig_endp_val->Assign(0, orig->Size());
orig_endp_val->Assign(1, orig->state); orig_endp_val->Assign(1, orig->state);