Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

EventRegistry/Func: Disable events when all bodies are disabled

Browse source 
This is just a small optimization on top of what is there.

Add state to Func for tracking if any enabled bodies exist which
allows us to propagate it up to the EventHandler::bool() operator.
In turn, when all bodies of an event's Func have been runtime disabled,
the event itself will not be invoked anymore.

Experiments have shown that this allows runtime toggling of new_event()
without performance impact when disabled. This could enable use-cases
where new_packet() handlers are enabled for a split second once in a
while to either dump or sample raw packet data at runtime.
This commit is contained in:
Arne Welzel 2022-12-08 12:55:47 +01:00
parent 92e4c11914
commit 21cc5f9132
6 changed files with 163 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/EventHandler.cc
View file

@ -24,7 +24,8 @@ EventHandler::EventHandler(std::string arg_name)
EventHandler::operator bool() const EventHandler::operator bool() const
{ {
return enabled && ((local && local->HasBodies()) || generate_always || ! auto_publish.empty()); return enabled &&
((local && local->HasEnabledBodies()) || generate_always || ! auto_publish.empty());
} }
const FuncTypePtr& EventHandler::GetType(bool check_export) const FuncTypePtr& EventHandler::GetType(bool check_export)

22
src/EventRegistry.cc
View file

@ -1,5 +1,7 @@
#include "zeek/EventRegistry.h" #include "zeek/EventRegistry.h"
#include <algorithm>
#include "zeek/EventHandler.h" #include "zeek/EventHandler.h"
#include "zeek/Func.h" #include "zeek/Func.h"
#include "zeek/RE.h" #include "zeek/RE.h"
@ -171,19 +173,31 @@ EventGroup::~EventGroup() noexcept { }
// Run through all ScriptFunc instances associated with this group and // Run through all ScriptFunc instances associated with this group and
// update their bodies after a group's enable/disable state has changed. // update their bodies after a group's enable/disable state has changed.
// Once that has completed, also update the Func's has_enabled_bodies
// setting based on the new state of its bodies.
// //
// EventGroup is private friend with Func, so fiddling with the bodies // EventGroup is private friend with Func, so fiddling with the bodies
// directly works and keeps the logic away from Func for now. // and private members works and keeps the logic out of Func and away
// from the public zeek:: namespace.
void EventGroup::UpdateFuncBodies() void EventGroup::UpdateFuncBodies()
{ {
static auto is_disabled = [](const auto& g) static auto is_group_disabled = [](const auto& g)
{ {
return g->IsDisabled(); return g->IsDisabled();
}; };
for ( const auto& func : funcs ) for ( auto& func : funcs )
{
for ( auto& b : func->bodies ) for ( auto& b : func->bodies )
b.disabled = std::any_of(b.groups.cbegin(), b.groups.cend(), is_disabled); b.disabled = std::any_of(b.groups.cbegin(), b.groups.cend(), is_group_disabled);
static auto is_body_enabled = [](const auto& b)
{
return ! b.disabled;
};
func->has_enabled_bodies = std::any_of(func->bodies.cbegin(), func->bodies.cend(),
is_body_enabled);
}
} }
void EventGroup::Enable() void EventGroup::Enable()

14
src/Func.h
View file

@ -85,7 +85,14 @@ public:
}; };
const std::vector<Body>& GetBodies() const { return bodies; } const std::vector<Body>& GetBodies() const { return bodies; }
bool HasBodies() const { return bodies.size(); } bool HasBodies() const { return ! bodies.empty(); }
/**
* Are there bodies and is any one of them enabled?
*
* @return true if bodies exist and at least one is enabled.
*/
bool HasEnabledBodies() const { return ! bodies.empty() && has_enabled_bodies; };
/** /**
* Calls a Zeek function. * Calls a Zeek function.
@ -149,8 +156,11 @@ protected:
std::string name; std::string name;
private: private:
// EventGroup updates Func::Body.disabled // EventGroup updates Func::Body.disabled and has_enabled_bodies.
// This is friend/private with EventGroup here so that we do not
// expose accessors in the zeek:: public interface.
friend class EventGroup; friend class EventGroup;
bool has_enabled_bodies = true;
}; };
namespace detail namespace detail

7
testing/btest/Baseline/broker.event-group-interaction/recv.recv.out Normal file
View file

@ -0,0 +1,7 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
receiver added peer: endpoint=127.0.0.1 msg=handshake successful
receiver got ping: my-message, 1
receiver got ping: my-message, 2
receiver got ping: my-message, 3
receiver got ping: my-message, 4
receiver got ping: my-message, 5

7
testing/btest/Baseline/broker.event-group-interaction/send.send.out Normal file
View file

@ -0,0 +1,7 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
sender added peer: endpoint=127.0.0.1 msg=handshake successful
sender got pong: my-message, 1
sender got pong: my-message, 2
sender got pong: my-message, 3
sender got pong: my-message, 4
sender lost peer: endpoint=127.0.0.1 msg=lost connection to remote peer

117
testing/btest/broker/event-group-interaction.zeek Normal file
View file

@ -0,0 +1,117 @@
# @TEST-DOC: Disabling an unrelated event group caused auto-publish to break because the remote event had no bodies and got disabled. This is a regression test it's not being done again.
#
# @TEST-GROUP: broker
#
# @TEST-PORT: BROKER_PORT
#
# @TEST-EXEC: btest-bg-run recv "zeek -b ../recv.zeek >recv.out"
# @TEST-EXEC: btest-bg-run send "zeek -b ../send.zeek >send.out"
#
# @TEST-EXEC: btest-bg-wait 10
# @TEST-EXEC: btest-diff recv/recv.out
# @TEST-EXEC: btest-diff send/send.out
@TEST-START-FILE send.zeek
global event_count = 0;
global ping: event(msg: string, c: count);
event zeek_init()
{
Broker::subscribe("zeek/event/my_topic");
Broker::auto_publish("zeek/event/my_topic", ping);
Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT")));
}
function send_event()
{
event ping("my-message", ++event_count);
}
event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
{
print fmt("sender added peer: endpoint=%s msg=%s", endpoint$network$address, msg);
send_event();
}
event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
{
print fmt("sender lost peer: endpoint=%s msg=%s", endpoint$network$address, msg);
terminate();
}
event pong(msg: string, n: count) &is_used
{
print fmt("sender got pong: %s, %s", msg, n);
send_event();
}
module TestDumpEvents;
event pong(msg: string, n: count) &is_used
{
print fmt("ERROR: This should not be visible: %s, %s", msg, n);
}
event zeek_init()
{
disable_module_events("TestDumpEvents");
}
@TEST-END-FILE
@TEST-START-FILE recv.zeek
redef exit_only_after_terminate = T;
const events_to_recv = 5;
global pong: event(msg: string, c: count);
event zeek_init()
{
Broker::subscribe("zeek/event/my_topic");
Broker::auto_publish("zeek/event/my_topic", pong);
Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT")));
}
event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
{
print fmt("receiver added peer: endpoint=%s msg=%s",
endpoint$network$address, msg);
}
event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
{
print fmt("receiver lost peer: endpoint=%s msg=%s",
endpoint$network$address, msg);
}
event ping(msg: string, n: count) &is_used
{
print fmt("receiver got ping: %s, %s", msg, n);
if ( n == events_to_recv )
{
terminate();
return;
}
event pong(msg, n);
}
module TestDumpEvents;
event ping(msg: string, n: count) &is_used
{
print fmt("ERROR: This should not be visible: %s, %s", msg, n);
}
event zeek_init()
{
disable_module_events("TestDumpEvents");
}
@TEST-END-FILE