Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Optimize Connection::RemovalEvent() for bare-mode usage

Browse source 
It was creating RecordVals even if they wouldn't be used by any event
handler and that situation is common/expected for `zeek -b` mode.
Normally, there's at least the tunnel scripts with a `new_connection`
handler causing the connection RecordVals to be built.
This commit is contained in:
Jon Siwek 2020-06-10 16:30:56 -07:00
parent e924370876
commit 0bc1d73c84
3 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
CHANGES
View file

@ -1,4 +1,13 @@
3.2.0-dev.763 | 2020-06-10 16:34:31 -0700
* Optimize Connection::RemovalEvent() for bare-mode usage (Jon Siwek, Corelight)
It was creating RecordVals even if they wouldn't be used by any event
handler and that situation is common/expected for `zeek -b` mode.
Normally, there's at least the tunnel scripts with a `new_connection`
handler causing the connection RecordVals to be built.
3.2.0-dev.762 | 2020-06-09 15:19:15 -0700
* Restrict Cirrus CI to only zeek repo's branches (Jon Siwek, Corelight)

2
VERSION
View file

@ -1 +1 @@
3.2.0-dev.762
3.2.0-dev.763

6
src/Conn.cc
View file

@ -457,13 +457,11 @@ void Connection::Match(Rule::PatternType type, const u_char* data, int len, bool
void Connection::RemovalEvent()
{
auto cv = ConnVal();
if ( connection_state_remove )
EnqueueEvent(connection_state_remove, nullptr, cv);
EnqueueEvent(connection_state_remove, nullptr, ConnVal());
if ( is_successful && successful_connection_remove )
EnqueueEvent(successful_connection_remove, nullptr, cv);
EnqueueEvent(successful_connection_remove, nullptr, ConnVal());
}
void Connection::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const char* name)