Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

websocket: Add Spicy parser version, too.

Browse source 
The Spicy analyzer is added as a child analyzer when enabled and the
WebSocket.cc logic dispatches between the BinPac and Spicy version.

It substantially slower when tested against a somewhat artificial
2.4GB PCAP. The first flamegraph indicates that the unmask() function
stands out with 35% of all samples, and above it shared_ptr samples.
This commit is contained in:
Arne Welzel 2024-01-24 20:00:40 +01:00
parent 160ccda45f
commit c1a685a05d
9 changed files with 280 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/init-bare.zeek
View file

@ -470,6 +470,12 @@ export {
## Whether to enable DPD on WebSocket frame payload by default.
const use_dpd_default = T &redef;
## Whether to use the Spicy WebSocket protocol analyzer.
##
## As of now, the BinPac version has better performance, but
## we may change the default in the future.
const use_spicy_analyzer = F &redef;
## Record type that is passed to :zeek:see:`WebSocket::configure_analyzer`.
##
## This record allows to configure the WebSocket analyzer given