Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1119: add base/protcols/conn/removal-hooks.zeek

Browse source 
This adds two new functions: `Conn::register_removal_hook()` and
`Conn::unregister_removal_hook()` for registering a hook function to be
called back during `connection_state_remove`.  The benefit of using hook
callback approach is better scalability: the overhead of unrelated
protocols having to dispatch no-op `connection_state_remove` handlers is
avoided.
This commit is contained in:
Jon Siwek 2020-09-10 21:19:14 -07:00
parent 49e2047da0
commit 05cf511f18
31 changed files with 659 additions and 386 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/base/protocols/mysql/main.zeek
View file

@ -1,8 +1,9 @@
##! Implements base functionality for MySQL analysis. Generates the mysql.log file.
module MySQL;
@load ./consts
@load base/protocols/conn/removal-hooks
module MySQL;
export {
redef enum Log::ID += { mysql::LOG };
@ -29,6 +30,9 @@ export {
## Event that can be handled to access the MySQL record as it is sent on
## to the logging framework.
global log_mysql: event(rec: Info);
## MySQL finalization hook. Remaining MySQL info may get logged when it's called.
global finalize_mysql: Conn::RemovalHook;
}
redef record connection += {
@ -54,6 +58,7 @@ event mysql_handshake(c: connection, username: string)
info$cmd = "login";
info$arg = username;
c$mysql = info;
Conn::register_removal_hook(c, finalize_mysql);
}
}
@ -74,6 +79,7 @@ event mysql_command_request(c: connection, command: count, arg: string) &priorit
info$cmd = commands[command];
info$arg = sub(arg, /\0$/, "");
c$mysql = info;
Conn::register_removal_hook(c, finalize_mysql);
}
event mysql_command_request(c: connection, command: count, arg: string) &priority=-5
@ -122,7 +128,7 @@ event mysql_ok(c: connection, affected_rows: count) &priority=-5
}
}
event connection_state_remove(c: connection) &priority=-5
hook finalize_mysql(c: connection)
{
if ( c?$mysql )
{