Rename some connection-specific methods in Session and SessionManager

This commit is contained in:
Tim Wojtulewicz 2021-04-09 11:22:45 -07:00
parent f92f2e6fd4
commit 63fd1611ca
17 changed files with 61 additions and 45 deletions

@ -1 +1 @@
Subproject commit 919416a0a3457c95f23b67b39ce8e4da0b84c00b Subproject commit 0bb0ebe8e056871a03cf965351c2b56ed8507de1

View file

@ -97,7 +97,7 @@ void Connection::CheckEncapsulation(const std::shared_ptr<EncapsulationStack>& a
if ( *encapsulation != *arg_encap ) if ( *encapsulation != *arg_encap )
{ {
if ( tunnel_changed ) if ( tunnel_changed )
EnqueueEvent(tunnel_changed, nullptr, ConnVal(), EnqueueEvent(tunnel_changed, nullptr, GetVal(),
arg_encap->ToVal()); arg_encap->ToVal());
encapsulation = std::make_shared<EncapsulationStack>(*arg_encap); encapsulation = std::make_shared<EncapsulationStack>(*arg_encap);
@ -109,7 +109,7 @@ void Connection::CheckEncapsulation(const std::shared_ptr<EncapsulationStack>& a
if ( tunnel_changed ) if ( tunnel_changed )
{ {
EncapsulationStack empty; EncapsulationStack empty;
EnqueueEvent(tunnel_changed, nullptr, ConnVal(), empty.ToVal()); EnqueueEvent(tunnel_changed, nullptr, GetVal(), empty.ToVal());
} }
encapsulation = nullptr; encapsulation = nullptr;
@ -118,7 +118,7 @@ void Connection::CheckEncapsulation(const std::shared_ptr<EncapsulationStack>& a
else if ( arg_encap ) else if ( arg_encap )
{ {
if ( tunnel_changed ) if ( tunnel_changed )
EnqueueEvent(tunnel_changed, nullptr, ConnVal(), arg_encap->ToVal()); EnqueueEvent(tunnel_changed, nullptr, GetVal(), arg_encap->ToVal());
encapsulation = std::make_shared<EncapsulationStack>(*arg_encap); encapsulation = std::make_shared<EncapsulationStack>(*arg_encap);
} }
@ -215,13 +215,13 @@ void Connection::HistoryThresholdEvent(EventHandlerPtr e, bool is_orig,
return; return;
EnqueueEvent(e, nullptr, EnqueueEvent(e, nullptr,
ConnVal(), GetVal(),
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
val_mgr->Count(threshold) val_mgr->Count(threshold)
); );
} }
const RecordValPtr& Connection::ConnVal() const RecordValPtr& Connection::GetVal()
{ {
if ( ! conn_val ) if ( ! conn_val )
{ {
@ -306,7 +306,7 @@ analyzer::Analyzer* Connection::FindAnalyzer(const char* name)
void Connection::AppendAddl(const char* str) void Connection::AppendAddl(const char* str)
{ {
const auto& cv = ConnVal(); const auto& cv = GetVal();
const char* old = cv->GetFieldAs<StringVal>(6)->CheckString(); const char* old = cv->GetFieldAs<StringVal>(6)->CheckString();
const char* format = *old ? "%s %s" : "%s%s"; const char* format = *old ? "%s %s" : "%s%s";
@ -337,7 +337,7 @@ void Connection::Match(detail::Rule::PatternType type, const u_char* data, int l
void Connection::RemovalEvent() void Connection::RemovalEvent()
{ {
if ( connection_state_remove ) if ( connection_state_remove )
EnqueueEvent(connection_state_remove, nullptr, ConnVal()); EnqueueEvent(connection_state_remove, nullptr, GetVal());
} }
void Connection::Weird(const char* name, const char* addl, const char* source) void Connection::Weird(const char* name, const char* addl, const char* source)
@ -390,7 +390,7 @@ unsigned int Connection::MemoryAllocation() const
; ;
} }
unsigned int Connection::MemoryAllocationConnVal() const unsigned int Connection::MemoryAllocationVal() const
{ {
return conn_val ? conn_val->MemoryAllocation() : 0; return conn_val ? conn_val->MemoryAllocation() : 0;
} }
@ -473,7 +473,7 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label)
(is_orig ? saw_first_orig_packet : saw_first_resp_packet) ) (is_orig ? saw_first_orig_packet : saw_first_resp_packet) )
{ {
EnqueueEvent(connection_flow_label_changed, nullptr, EnqueueEvent(connection_flow_label_changed, nullptr,
ConnVal(), GetVal(),
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
val_mgr->Count(my_flow_label), val_mgr->Count(my_flow_label),
val_mgr->Count(flow_label) val_mgr->Count(flow_label)

View file

@ -149,7 +149,7 @@ public:
/** /**
* Returns the associated "connection" record. * Returns the associated "connection" record.
*/ */
const RecordValPtr& ConnVal() override; const RecordValPtr& GetVal() override;
/** /**
* Append additional entries to the history field in the connection record. * Append additional entries to the history field in the connection record.
@ -186,7 +186,7 @@ public:
// Just a lower bound. // Just a lower bound.
unsigned int MemoryAllocation() const override; unsigned int MemoryAllocation() const override;
unsigned int MemoryAllocationConnVal() const override; unsigned int MemoryAllocationVal() const override;
static uint64_t TotalConnections() static uint64_t TotalConnections()
{ return total_connections; } { return total_connections; }

View file

@ -439,7 +439,7 @@ void Reporter::Weird(Connection* conn, const char* name, const char* addl, const
return; return;
} }
WeirdHelper(conn_weird, {conn->ConnVal()->Ref(), new StringVal(addl), new StringVal(source)}, WeirdHelper(conn_weird, {conn->GetVal()->Ref(), new StringVal(addl), new StringVal(source)},
"%s", name); "%s", name);
} }
@ -601,7 +601,7 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
vl.emplace_back(make_intrusive<StringVal>(loc_str.c_str())); vl.emplace_back(make_intrusive<StringVal>(loc_str.c_str()));
if ( conn ) if ( conn )
vl.emplace_back(conn->ConnVal()); vl.emplace_back(conn->GetVal());
if ( addl ) if ( addl )
for ( auto v : *addl ) for ( auto v : *addl )

View file

@ -137,9 +137,9 @@ void Session::Event(EventHandlerPtr f, analyzer::Analyzer* analyzer, const char*
return; return;
if ( name ) if ( name )
EnqueueEvent(f, analyzer, make_intrusive<StringVal>(name), ConnVal()); EnqueueEvent(f, analyzer, make_intrusive<StringVal>(name), GetVal());
else else
EnqueueEvent(f, analyzer, ConnVal()); EnqueueEvent(f, analyzer, GetVal());
} }
void Session::EnqueueEvent(EventHandlerPtr f, analyzer::Analyzer* a, Args args) void Session::EnqueueEvent(EventHandlerPtr f, analyzer::Analyzer* a, Args args)
@ -258,7 +258,7 @@ void Session::InactivityTimer(double t)
void Session::StatusUpdateTimer(double t) void Session::StatusUpdateTimer(double t)
{ {
EnqueueEvent(session_status_update_event, nullptr, ConnVal()); EnqueueEvent(session_status_update_event, nullptr, GetVal());
ADD_TIMER(&Session::StatusUpdateTimer, ADD_TIMER(&Session::StatusUpdateTimer,
run_state::network_time + session_status_update_interval, 0, run_state::network_time + session_status_update_interval, 0,
detail::TIMER_CONN_STATUS_UPDATE); detail::TIMER_CONN_STATUS_UPDATE);

View file

@ -95,15 +95,20 @@ public:
/** /**
* Returns the associated "session" record. * Returns the associated "session" record.
* TODO: rename this to SessionVal(). This requires a swath of other changes.
*/ */
virtual const RecordValPtr& ConnVal() = 0; virtual const RecordValPtr& GetVal() = 0;
[[deprecated("Remove in v5.1. Use GetVal().")]]
const RecordValPtr& ConnVal() { return GetVal(); }
/** /**
* Return the memory allocation required by the session record. This requires at * Return the memory allocation required by the session record. This requires at
* least one call to ConnVal() first in order to setup the record object. * least one call to Get() first in order to setup the record object.
*/ */
virtual unsigned int MemoryAllocationConnVal() const = 0; virtual unsigned int MemoryAllocationVal() const = 0;
[[deprecated("Remove in v5.1. Use MemoryAllocationVal().")]]
unsigned int MemoryAllocationConnVal() const { return MemoryAllocationVal(); }
/** /**
* A lower-bound calculation of how much memory a session object is using. * A lower-bound calculation of how much memory a session object is using.

View file

@ -183,12 +183,12 @@ void SessionManager::ProcessTransportLayer(double t, const Packet* pkt, size_t r
if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 ) if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 )
{ {
pkt_hdr_val = ip_hdr->ToPktHdrVal(); pkt_hdr_val = ip_hdr->ToPktHdrVal();
conn->EnqueueEvent(ipv6_ext_headers, nullptr, conn->ConnVal(), conn->EnqueueEvent(ipv6_ext_headers, nullptr, conn->GetVal(),
pkt_hdr_val); pkt_hdr_val);
} }
if ( new_packet ) if ( new_packet )
conn->EnqueueEvent(new_packet, nullptr, conn->ConnVal(), pkt_hdr_val ? conn->EnqueueEvent(new_packet, nullptr, conn->GetVal(), pkt_hdr_val ?
std::move(pkt_hdr_val) : ip_hdr->ToPktHdrVal()); std::move(pkt_hdr_val) : ip_hdr->ToPktHdrVal());
conn->NextPacket(t, is_orig, ip_hdr.get(), len, remaining, data, conn->NextPacket(t, is_orig, ip_hdr.get(), len, remaining, data,
@ -602,7 +602,7 @@ void SessionManager::Weird(const char* name, const IP_Hdr* ip, const char* addl)
reporter->Weird(ip->SrcAddr(), ip->DstAddr(), name, addl); reporter->Weird(ip->SrcAddr(), ip->DstAddr(), name, addl);
} }
unsigned int SessionManager::ConnectionMemoryUsage() unsigned int SessionManager::SessionMemoryUsage()
{ {
unsigned int mem = 0; unsigned int mem = 0;
@ -616,7 +616,7 @@ unsigned int SessionManager::ConnectionMemoryUsage()
return mem; return mem;
} }
unsigned int SessionManager::ConnectionMemoryUsageConnVals() unsigned int SessionManager::SessionMemoryUsageVals()
{ {
unsigned int mem = 0; unsigned int mem = 0;
@ -625,7 +625,7 @@ unsigned int SessionManager::ConnectionMemoryUsageConnVals()
return 0; return 0;
for ( const auto& entry : session_map ) for ( const auto& entry : session_map )
mem += entry.second->MemoryAllocationConnVal(); mem += entry.second->MemoryAllocationVal();
return mem; return mem;
} }
@ -636,7 +636,7 @@ unsigned int SessionManager::MemoryAllocation()
// Connections have been flushed already. // Connections have been flushed already.
return 0; return 0;
return ConnectionMemoryUsage() return SessionMemoryUsage()
+ padded_sizeof(*this) + padded_sizeof(*this)
+ (session_map.size() * (sizeof(SessionMap::key_type) + sizeof(SessionMap::value_type))) + (session_map.size() * (sizeof(SessionMap::key_type) + sizeof(SessionMap::value_type)))
+ detail::fragment_mgr->MemoryAllocation(); + detail::fragment_mgr->MemoryAllocation();

View file

@ -81,11 +81,14 @@ public:
[[deprecated("Remove in v5.1. Use packet_mgr->GetPacketFilter().")]] [[deprecated("Remove in v5.1. Use packet_mgr->GetPacketFilter().")]]
detail::PacketFilter* GetPacketFilter(bool init=true); detail::PacketFilter* GetPacketFilter(bool init=true);
unsigned int CurrentConnections() unsigned int CurrentSessions()
{ {
return session_map.size(); return session_map.size();
} }
[[deprecated("Remove in v5.1. Use CurrentSessions().")]]
unsigned int CurrentConnections() { return CurrentSessions(); }
/** /**
* Main entry point for processing packets destined for session analyzers. This * Main entry point for processing packets destined for session analyzers. This
* method is called by the packet analysis manager when after it has processed * method is called by the packet analysis manager when after it has processed
@ -123,8 +126,14 @@ public:
int ParseIPPacket(int caplen, const u_char* const pkt, int proto, int ParseIPPacket(int caplen, const u_char* const pkt, int proto,
IP_Hdr*& inner); IP_Hdr*& inner);
unsigned int ConnectionMemoryUsage(); unsigned int SessionMemoryUsage();
unsigned int ConnectionMemoryUsageConnVals(); unsigned int SessionMemoryUsageVals();
[[deprecated("Remove in v5.1. Use SessionMemoryUsage().")]]
unsigned int ConnectionMemoryUsage() { return SessionMemoryUsage(); }
[[deprecated("Remove in v5.1. Use SessionMemoryUsageVals().")]]
unsigned int ConnectionMemoryUsageConnVals() { return SessionMemoryUsageVals(); }
unsigned int MemoryAllocation(); unsigned int MemoryAllocation();
// TODO: should this move somewhere else? // TODO: should this move somewhere else?

View file

@ -126,21 +126,23 @@ void ProfileLogger::Log()
run_state::network_time, (utime + stime) - (first_utime + first_stime), run_state::network_time, (utime + stime) - (first_utime + first_stime),
utime - first_utime, stime - first_stime, rtime - first_rtime)); utime - first_utime, stime - first_stime, rtime - first_rtime));
int conn_mem_use = expensive ? session_mgr->ConnectionMemoryUsage() : 0; int conn_mem_use = expensive ? session_mgr->SessionMemoryUsage() : 0;
double avg_conn_mem_use = 0; double avg_conn_mem_use = 0;
if ( expensive && session_mgr->CurrentConnections() != 0 ) if ( expensive && session_mgr->CurrentSessions() != 0 )
avg_conn_mem_use = conn_mem_use / static_cast<double>(session_mgr->CurrentConnections()); avg_conn_mem_use = conn_mem_use / static_cast<double>(session_mgr->CurrentSessions());
// TODO: This previously output the number of connections, but now that we're storing sessions
// as well as connections, this might need to be renamed.
file->Write(util::fmt("%.06f Conns: total=%" PRIu64 " current=%" PRIu64 "/%" PRIi32 " mem=%" PRIi32 "K avg=%.1f table=%" PRIu32 "K connvals=%" PRIu32 "K\n", file->Write(util::fmt("%.06f Conns: total=%" PRIu64 " current=%" PRIu64 "/%" PRIi32 " mem=%" PRIi32 "K avg=%.1f table=%" PRIu32 "K connvals=%" PRIu32 "K\n",
run_state::network_time, run_state::network_time,
Connection::TotalConnections(), Connection::TotalConnections(),
Connection::CurrentConnections(), Connection::CurrentConnections(),
session_mgr->CurrentConnections(), session_mgr->CurrentSessions(),
conn_mem_use, conn_mem_use,
avg_conn_mem_use, avg_conn_mem_use,
expensive ? session_mgr->MemoryAllocation() / 1024 : 0, expensive ? session_mgr->MemoryAllocation() / 1024 : 0,
expensive ? session_mgr->ConnectionMemoryUsageConnVals() / 1024 : 0 expensive ? session_mgr->SessionMemoryUsageVals() / 1024 : 0
)); ));
SessionStats s; SessionStats s;

View file

@ -787,7 +787,7 @@ void Analyzer::UpdateConnVal(RecordVal *conn_val)
const RecordValPtr& Analyzer::ConnVal() const RecordValPtr& Analyzer::ConnVal()
{ {
return conn->ConnVal(); return conn->GetVal();
} }
void Analyzer::Event(EventHandlerPtr f, const char* name) void Analyzer::Event(EventHandlerPtr f, const char* name)

View file

@ -628,7 +628,7 @@ bool Manager::ApplyScheduledAnalyzers(Connection* conn, bool init, TransportLaye
if ( scheduled_analyzer_applied ) if ( scheduled_analyzer_applied )
conn->EnqueueEvent(scheduled_analyzer_applied, nullptr, conn->EnqueueEvent(scheduled_analyzer_applied, nullptr,
conn->ConnVal(), it->AsVal()); conn->GetVal(), it->AsVal());
DBG_ANALYZER_ARGS(conn, "activated %s analyzer as scheduled", DBG_ANALYZER_ARGS(conn, "activated %s analyzer as scheduled",
analyzer_mgr->GetComponentName(*it).c_str()); analyzer_mgr->GetComponentName(*it).c_str());

View file

@ -227,7 +227,7 @@ bool TCP_Endpoint::DataSent(double t, uint64_t seq, int len, int caplen,
if ( contents_file_write_failure ) if ( contents_file_write_failure )
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
Conn()->ConnVal(), Conn()->GetVal(),
val_mgr->Bool(IsOrig()), val_mgr->Bool(IsOrig()),
make_intrusive<StringVal>(buf) make_intrusive<StringVal>(buf)
); );

View file

@ -358,7 +358,7 @@ void TCP_Reassembler::RecordBlock(const DataBlock& b, const FilePtr& f)
if ( contents_file_write_failure ) if ( contents_file_write_failure )
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
Endpoint()->Conn()->ConnVal(), Endpoint()->Conn()->GetVal(),
val_mgr->Bool(IsOrig()), val_mgr->Bool(IsOrig()),
make_intrusive<StringVal>("TCP reassembler content write failure") make_intrusive<StringVal>("TCP reassembler content write failure")
); );
@ -373,7 +373,7 @@ void TCP_Reassembler::RecordGap(uint64_t start_seq, uint64_t upper_seq, const Fi
if ( contents_file_write_failure ) if ( contents_file_write_failure )
tcp_analyzer->EnqueueConnEvent(contents_file_write_failure, tcp_analyzer->EnqueueConnEvent(contents_file_write_failure,
Endpoint()->Conn()->ConnVal(), Endpoint()->Conn()->GetVal(),
val_mgr->Bool(IsOrig()), val_mgr->Bool(IsOrig()),
make_intrusive<StringVal>("TCP reassembler gap write failure") make_intrusive<StringVal>("TCP reassembler gap write failure")
); );

View file

@ -142,7 +142,7 @@ bool File::UpdateConnectionFields(Connection* conn, bool is_orig)
if ( conns->AsTableVal()->FindOrDefault(idx) ) if ( conns->AsTableVal()->FindOrDefault(idx) )
return false; return false;
conns->AsTableVal()->Assign(std::move(idx), conn->ConnVal()); conns->AsTableVal()->Assign(std::move(idx), conn->GetVal());
return true; return true;
} }
@ -152,7 +152,7 @@ void File::RaiseFileOverNewConnection(Connection* conn, bool is_orig)
{ {
FileEvent(file_over_new_connection, { FileEvent(file_over_new_connection, {
val, val,
conn->ConnVal(), conn->GetVal(),
val_mgr->Bool(is_orig), val_mgr->Bool(is_orig),
}); });
} }

View file

@ -425,7 +425,7 @@ string Manager::GetFileID(const analyzer::Tag& tag, Connection* c, bool is_orig)
const auto& tagval = tag.AsVal(); const auto& tagval = tag.AsVal();
event_mgr.Enqueue(get_file_handle, tagval, c->ConnVal(), val_mgr->Bool(is_orig)); event_mgr.Enqueue(get_file_handle, tagval, c->GetVal(), val_mgr->Bool(is_orig));
event_mgr.Drain(); // need file handle immediately so we don't have to buffer data event_mgr.Drain(); // need file handle immediately so we don't have to buffer data
return current_file_id; return current_file_id;
} }

View file

@ -88,7 +88,7 @@ function get_conn_stats%(%): ConnStats
r->Assign(n++, Connection::TotalConnections()); r->Assign(n++, Connection::TotalConnections());
r->Assign(n++, Connection::CurrentConnections()); r->Assign(n++, Connection::CurrentConnections());
r->Assign(n++, session_mgr->CurrentConnections()); r->Assign(n++, session_mgr->CurrentSessions());
SessionStats s; SessionStats s;
if ( session_mgr ) if ( session_mgr )

View file

@ -3404,7 +3404,7 @@ function lookup_connection%(cid: conn_id%): connection
%{ %{
Connection* conn = session_mgr->FindConnection(cid); Connection* conn = session_mgr->FindConnection(cid);
if ( conn ) if ( conn )
return conn->ConnVal(); return conn->GetVal();
zeek::emit_builtin_error("connection ID not a known connection", cid); zeek::emit_builtin_error("connection ID not a known connection", cid);