From 68bfe54ea8e531aee380dd43ae137769b8ebb9e5 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Tue, 21 Jan 2025 11:08:53 +0100
Subject: [PATCH] tag_cache

---
 src/analyzer/Manager.cc | 18 ++++++++++++++++--
 src/analyzer/Manager.h  |  2 ++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index cf63c18717..af78638394 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -51,7 +51,8 @@ bool Manager::ConnIndex::operator<(const ConnIndex& other) const {
     return false;
 }
 
-Manager::Manager() : plugin::ComponentManager<analyzer::Component>("Analyzer", "Tag", "AllAnalyzers") {}
+Manager::Manager()
+    : plugin::ComponentManager<analyzer::Component>("Analyzer", "Tag", "AllAnalyzers"), tag_cache(2048, nullptr) {}
 
 Manager::~Manager() {
     // Clean up expected-connection table.
@@ -259,7 +260,20 @@ bool Manager::UnregisterAnalyzerForPort(const zeek::Tag& tag, TransportProto pro
 }
 
 Analyzer* Manager::InstantiateAnalyzer(const zeek::Tag& tag, Connection* conn) {
-    Component* c = Lookup(tag);
+    // std::fprintf(stderr, "Instantiate %d %d\n", tag.Type(), tag.Subtype());
+
+    Component* c = nullptr;
+
+    // Check for the tag in the tag cache
+    if ( c = tag_cache[tag.Type()]; c ) {
+        if ( c->Tag().Subtype() != tag.Subtype() )
+            reporter->InternalWarning("tag caching problem");
+    }
+    else {
+        // Slow lookup path
+        c = Lookup(tag);
+        tag_cache[tag.Type()] = c;
+    }
 
     if ( ! c ) {
         reporter->InternalWarning("request to instantiate unknown analyzer");
diff --git a/src/analyzer/Manager.h b/src/analyzer/Manager.h
index 6657b5f2d9..a122860c65 100644
--- a/src/analyzer/Manager.h
+++ b/src/analyzer/Manager.h
@@ -376,6 +376,8 @@ private:
     conns_map conns;
     conns_queue conns_by_timeout;
     std::vector<uint16_t> vxlan_ports;
+
+    std::vector<Component*> tag_cache;
 };
 
 } // namespace analyzer