Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-01 22:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Conn: Lazily initialize weird_state when needed

Browse source 
A std::unordered_map takes 56 bytes on my system. Switch to a unique_ptr
an initialize weird_state lazily. That saves ~48 bytes per connection.
Particularly for scan or non-weird traffic, this should allow some
memory savings.
This commit is contained in:
Arne Welzel 2025-09-29 15:09:55 +02:00
parent 3abc1116a1
commit 4a15328ba9
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/Conn.cc
View file

@ -4,6 +4,7 @@
#include <binpac.h>
#include <cctype>
#include <memory>
#include "zeek/Desc.h"
#include "zeek/ID.h"
@ -12,6 +13,7 @@
#include "zeek/RunState.h"
#include "zeek/Timer.h"
#include "zeek/TunnelEncapsulation.h"
#include "zeek/WeirdState.h"
#include "zeek/analyzer/Analyzer.h"
#include "zeek/analyzer/Manager.h"
#include "zeek/analyzer/protocol/pia/PIA.h"
@ -399,7 +401,10 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) {
}
bool Connection::PermitWeird(const char* name, uint64_t threshold, uint64_t rate, double duration) {
return detail::PermitWeird(weird_state, name, threshold, rate, duration);
if ( ! weird_state )
weird_state = std::make_unique<detail::WeirdStateMap>();
return detail::PermitWeird(*weird_state, name, threshold, rate, duration);
}
} // namespace zeek

2
src/Conn.h
View file

@ -220,7 +220,7 @@ private:
analyzer::pia::PIA* primary_PIA;
UID uid; // Globally unique connection ID.
detail::WeirdStateMap weird_state;
std::unique_ptr<detail::WeirdStateMap> weird_state;
// Count number of connections.
static uint64_t total_connections;