Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 04:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Rework Session/Connection tracking to use a std::map instead of PDict

Browse source
This commit is contained in:
Tim Wojtulewicz 2019-07-29 11:14:58 -07:00
parent 8ab0650c1e
commit 57f29f3e7c
7 changed files with 183 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

43
src/Sessions.h
View file

@ -3,6 +3,9 @@
#ifndef sessions_h
#define sessions_h
#include <map>
#include <utility>
#include "Dict.h"
#include "CompHash.h"
#include "IP.h"
@ -13,8 +16,6 @@
#include "TunnelEncapsulation.h"
#include "analyzer/protocol/tcp/Stats.h"
#include <utility>
class EncapsulationStack;
class Connection;
class ConnCompressor;
@ -27,20 +28,20 @@ namespace analyzer { namespace stepping_stone { class SteppingStoneManager; } }
namespace analyzer { namespace arp { class ARP_Analyzer; } }
struct SessionStats {
int num_TCP_conns;
int max_TCP_conns;
size_t num_TCP_conns;
size_t max_TCP_conns;
uint64_t cumulative_TCP_conns;
int num_UDP_conns;
int max_UDP_conns;
size_t num_UDP_conns;
size_t max_UDP_conns;
uint64_t cumulative_UDP_conns;
int num_ICMP_conns;
int max_ICMP_conns;
size_t num_ICMP_conns;
size_t max_ICMP_conns;
uint64_t cumulative_ICMP_conns;
int num_fragments;
int max_fragments;
size_t num_fragments;
size_t max_fragments;
uint64_t num_packets;
};
@ -112,8 +113,7 @@ public:
unsigned int CurrentConnections()
{
return tcp_conns.Length() + udp_conns.Length() +
icmp_conns.Length();
return tcp_conns.size() + udp_conns.size() + icmp_conns.size();
}
void DoNextPacket(double t, const Packet *pkt, const IP_Hdr* ip_hdr,
@ -172,10 +172,14 @@ protected:
friend class TimerMgrExpireTimer;
friend class IPTunnelTimer;
Connection* NewConn(HashKey* k, double t, const ConnID* id,
using ConnectionMap = std::map<ConnIDKey, Connection*>;
Connection* NewConn(const ConnIDKey& k, double t, const ConnID* id,
const u_char* data, int proto, uint32_t flow_label,
const Packet* pkt, const EncapsulationStack* encapsulation);
Connection* LookupConn(const ConnectionMap& conns, const ConnIDKey& key);
// Check whether the tag of the current packet is consistent with
// the given connection. Returns:
// -1 if current packet is to be completely ignored.
@ -212,12 +216,19 @@ protected:
bool CheckHeaderTrunc(int proto, uint32_t len, uint32_t caplen,
const Packet *pkt, const EncapsulationStack* encap);
// Inserts a new connection into the sessions map. If a connection with
// the same key already exists in the map, it will be overwritten by
// the new one.
void InsertConnection(ConnectionMap* m, const ConnIDKey& key, Connection* conn);
CompositeHash* ch;
PDict<Connection> tcp_conns;
PDict<Connection> udp_conns;
PDict<Connection> icmp_conns;
ConnectionMap tcp_conns;
ConnectionMap udp_conns;
ConnectionMap icmp_conns;
PDict<FragReassembler> fragments;
SessionStats stats;
typedef pair<IPAddr, IPAddr> IPPair;
typedef pair<EncapsulatingConn, double> TunnelActivity;
typedef std::map<IPPair, TunnelActivity> IPTunnelMap;