Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Optimzie software framework version parsing

Browse source 
Add a small cache in front of the parse method.  This cache should
reduce most of the calls to parse, and ultimately save memory because
redundant versions of the parsed strings will not be created in memory.

Move the parsing itself to the proxies where the caching can be more
efficient.
This commit is contained in:
Justin Azoff 2021-09-05 13:16:53 -04:00
parent 0746ef7ecc
commit 3bf8c8ceb6
1 changed files with 22 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/base/frameworks/software/main.zeek
View file

@ -238,6 +238,18 @@ function parse(unparsed_version: string): Description
return [$version=v, $unparsed_version=unparsed_version, $name=alternate_names[software_name]]; return [$version=v, $unparsed_version=unparsed_version, $name=alternate_names[software_name]];
} }
global parse_cache: table[string] of Description &read_expire=65secs;
# Call parse, but cache results in the parse_cache table
function parse_with_cache(unparsed_version: string): Description
{
if (unparsed_version in parse_cache)
return parse_cache[unparsed_version];
local res = parse(unparsed_version);
parse_cache[unparsed_version] = res;
return res;
}
function parse_mozilla(unparsed_version: string): Description function parse_mozilla(unparsed_version: string): Description
{ {
@ -466,6 +478,15 @@ function software_fmt(i: Info): string
event Software::register(info: Info) event Software::register(info: Info)
{ {
if ( ! info?$version )
{
local sw = parse_with_cache(info$unparsed_version);
info$unparsed_version = sw$unparsed_version;
info$name = sw$name;
info$version = sw$version;
}
local ts: SoftwareSet; local ts: SoftwareSet;
if ( info$host in tracked ) if ( info$host in tracked )
@ -514,17 +535,8 @@ function found(id: conn_id, info: Info): bool
return F; return F;
} }
if ( ! info?$version )
{
local sw = parse(info$unparsed_version);
info$unparsed_version = sw$unparsed_version;
info$name = sw$name;
info$version = sw$version;
}
@if ( Cluster::is_enabled() ) @if ( Cluster::is_enabled() )
Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::register, Cluster::publish_hrw(Cluster::proxy_pool, info$host, Software::register, info);
info);
@else @else
event Software::register(info); event Software::register(info);
@endif @endif