diff --git a/src/Conn.cc b/src/Conn.cc index 9781fb175d..965edd1ccb 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -413,9 +413,9 @@ RecordVal* Connection::BuildConnVal() id_val->Assign(3, port_mgr->Get(ntohs(resp_port), prot_type)); RecordVal* orig_endp = new RecordVal(endpoint); - orig_endp->Assign(0, new Val(0, TYPE_COUNT)); - orig_endp->Assign(1, new Val(0, TYPE_COUNT)); - orig_endp->Assign(4, new Val(orig_flow_label, TYPE_COUNT)); + orig_endp->Assign(0, val_mgr->GetCount(0)); + orig_endp->Assign(1, val_mgr->GetCount(0)); + orig_endp->Assign(4, val_mgr->GetCount(orig_flow_label)); const int l2_len = sizeof(orig_l2_addr); char null[l2_len]{}; @@ -424,9 +424,9 @@ RecordVal* Connection::BuildConnVal() orig_endp->Assign(5, new StringVal(fmt_mac(orig_l2_addr, l2_len))); RecordVal* resp_endp = new RecordVal(endpoint); - resp_endp->Assign(0, new Val(0, TYPE_COUNT)); - resp_endp->Assign(1, new Val(0, TYPE_COUNT)); - resp_endp->Assign(4, new Val(resp_flow_label, TYPE_COUNT)); + resp_endp->Assign(0, val_mgr->GetCount(0)); + resp_endp->Assign(1, val_mgr->GetCount(0)); + resp_endp->Assign(4, val_mgr->GetCount(orig_flow_label)); if ( memcmp(&resp_l2_addr, &null, l2_len) != 0 ) resp_endp->Assign(5, new StringVal(fmt_mac(resp_l2_addr, l2_len))); diff --git a/src/Val.cc b/src/Val.cc index 059ce24f4a..0ffd39a634 100644 --- a/src/Val.cc +++ b/src/Val.cc @@ -3710,3 +3710,71 @@ bool can_cast_value_to_type(const BroType* s, BroType* t) return false; } + +ValManager::ValManager() + { + b_false = new Val(0, TYPE_BOOL); + b_true = new Val(1, TYPE_BOOL); + + for(auto i=0; i < 4096; i++) { + int32s[i] = new Val((int32) i, TYPE_COUNT); + uint32s[i] = new Val((uint32) i, TYPE_COUNT); + int64s[i] = new Val((int64) i, TYPE_COUNT); + uint64s[i] = new Val((uint64) i, TYPE_COUNT); + } + } + +ValManager::~ValManager() + { + //?? + Unref(b_true); + Unref(b_false); + } + + +Val* ValManager::GetBool(bool val) const + { + auto rval = val ? b_true : b_false; + ::Ref(rval); + return rval; + } + +Val* ValManager::GetCount(int32 i) const + { + if (i < 4096) { + auto rval = int32s[i]; + ::Ref(rval); + return rval; + } + return new Val(i, TYPE_COUNT); + } + +Val* ValManager::GetCount(uint32 i) const + { + if (i < 4096) { + auto rval = uint32s[i]; + ::Ref(rval); + return rval; + } + return new Val(i, TYPE_COUNT); + } + +Val* ValManager::GetCount(int64 i) const + { + if (i < 4096) { + auto rval = int64s[i]; + ::Ref(rval); + return rval; + } + return new Val(i, TYPE_COUNT); + } + +Val* ValManager::GetCount(uint64 i) const + { + if (i < 4096) { + auto rval = uint64s[i]; + ::Ref(rval); + return rval; + } + return new Val(i, TYPE_COUNT); + } diff --git a/src/Val.h b/src/Val.h index f189668b28..c1a7910190 100644 --- a/src/Val.h +++ b/src/Val.h @@ -75,6 +75,30 @@ typedef union { } BroValUnion; +class ValManager { +public: + ValManager(); + ~ValManager(); + + Val* GetBool(bool b) const; + Val* GetCount(int32 i) const; + Val* GetCount(uint32 u) const; + + Val* GetCount(int64 i) const; + Val* GetCount(uint64 u) const; + +private: + Val* b_true; + Val* b_false; + std::array int32s; + std::array uint32s; + + std::array int64s; + std::array uint64s; +}; + +extern ValManager* val_mgr; + class Val : public BroObj { public: Val(bool b, TypeTag t) diff --git a/src/analyzer/protocol/conn-size/ConnSize.cc b/src/analyzer/protocol/conn-size/ConnSize.cc index 4fd4154c05..8ed38a1546 100644 --- a/src/analyzer/protocol/conn-size/ConnSize.cc +++ b/src/analyzer/protocol/conn-size/ConnSize.cc @@ -159,10 +159,10 @@ void ConnSize_Analyzer::UpdateConnVal(RecordVal *conn_val) if ( bytesidx < 0 ) reporter->InternalError("'endpoint' record missing 'num_bytes_ip' field"); - orig_endp->Assign(pktidx, new Val(orig_pkts, TYPE_COUNT)); - orig_endp->Assign(bytesidx, new Val(orig_bytes, TYPE_COUNT)); - resp_endp->Assign(pktidx, new Val(resp_pkts, TYPE_COUNT)); - resp_endp->Assign(bytesidx, new Val(resp_bytes, TYPE_COUNT)); + orig_endp->Assign(pktidx, val_mgr->GetCount(orig_pkts)); + orig_endp->Assign(bytesidx, val_mgr->GetCount(orig_bytes)); + resp_endp->Assign(pktidx, val_mgr->GetCount(resp_pkts)); + resp_endp->Assign(bytesidx, val_mgr->GetCount(resp_bytes)); Analyzer::UpdateConnVal(conn_val); } diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc index d0b7940cee..6f44791951 100644 --- a/src/analyzer/protocol/dns/DNS.cc +++ b/src/analyzer/protocol/dns/DNS.cc @@ -48,9 +48,9 @@ int DNS_Interpreter::ParseMessage(const u_char* data, int len, int is_query) { val_list* vl = new val_list(); vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_query, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_query)); vl->append(msg.BuildHdrVal()); - vl->append(new Val(len, TYPE_COUNT)); + vl->append(val_mgr->GetCount(len)); analyzer->ConnectionEvent(dns_message, vl); } @@ -1428,19 +1428,19 @@ Val* DNS_MsgInfo::BuildHdrVal() { RecordVal* r = new RecordVal(dns_msg); - r->Assign(0, new Val(id, TYPE_COUNT)); - r->Assign(1, new Val(opcode, TYPE_COUNT)); - r->Assign(2, new Val(rcode, TYPE_COUNT)); - r->Assign(3, new Val(QR, TYPE_BOOL)); - r->Assign(4, new Val(AA, TYPE_BOOL)); - r->Assign(5, new Val(TC, TYPE_BOOL)); - r->Assign(6, new Val(RD, TYPE_BOOL)); - r->Assign(7, new Val(RA, TYPE_BOOL)); - r->Assign(8, new Val(Z, TYPE_COUNT)); - r->Assign(9, new Val(qdcount, TYPE_COUNT)); - r->Assign(10, new Val(ancount, TYPE_COUNT)); - r->Assign(11, new Val(nscount, TYPE_COUNT)); - r->Assign(12, new Val(arcount, TYPE_COUNT)); + r->Assign(0, val_mgr->GetCount(id)); + r->Assign(1, val_mgr->GetCount(opcode)); + r->Assign(2, val_mgr->GetCount(rcode)); + r->Assign(3, val_mgr->GetBool(QR)); + r->Assign(4, val_mgr->GetBool(AA)); + r->Assign(5, val_mgr->GetBool(TC)); + r->Assign(6, val_mgr->GetBool(RD)); + r->Assign(7, val_mgr->GetBool(RA)); + r->Assign(8, val_mgr->GetCount(Z)); + r->Assign(9, val_mgr->GetCount(qdcount)); + r->Assign(10, val_mgr->GetCount(ancount)); + r->Assign(11, val_mgr->GetCount(nscount)); + r->Assign(12, val_mgr->GetCount(arcount)); return r; } @@ -1450,10 +1450,10 @@ Val* DNS_MsgInfo::BuildAnswerVal() RecordVal* r = new RecordVal(dns_answer); Ref(query_name); - r->Assign(0, new Val(int(answer_type), TYPE_COUNT)); + r->Assign(0, val_mgr->GetCount(int(answer_type))); r->Assign(1, query_name); - r->Assign(2, new Val(atype, TYPE_COUNT)); - r->Assign(3, new Val(aclass, TYPE_COUNT)); + r->Assign(2, val_mgr->GetCount(atype)); + r->Assign(3, val_mgr->GetCount(aclass)); r->Assign(4, new IntervalVal(double(ttl), Seconds)); return r; diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 4e1e5a2218..82e0c99ab8 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -648,7 +648,7 @@ void HTTP_Message::Done(const int interrupted, const char* detail) { val_list* vl = new val_list; vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); vl->append(BuildMessageStat(interrupted, detail)); GetAnalyzer()->ConnectionEvent(http_message_done, vl); } @@ -681,7 +681,7 @@ void HTTP_Message::BeginEntity(mime::MIME_Entity* entity) { val_list* vl = new val_list(); vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); analyzer->ConnectionEvent(http_begin_entity, vl); } } @@ -698,7 +698,7 @@ void HTTP_Message::EndEntity(mime::MIME_Entity* entity) { val_list* vl = new val_list(); vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); analyzer->ConnectionEvent(http_end_entity, vl); } @@ -739,7 +739,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist) { val_list* vl = new val_list(); vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); vl->append(BuildHeaderTable(hlist)); analyzer->ConnectionEvent(http_all_headers, vl); } @@ -753,7 +753,7 @@ void HTTP_Message::SubmitAllHeaders(mime::MIME_HeaderList& hlist) val_list* vl = new val_list(); vl->append(analyzer->BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); vl->append(ty); vl->append(subty); analyzer->ConnectionEvent(http_content_type, vl); @@ -1447,7 +1447,7 @@ void HTTP_Analyzer::HTTP_Reply() val_list* vl = new val_list; vl->append(BuildConnVal()); vl->append(new StringVal(fmt("%.1f", reply_version))); - vl->append(new Val(reply_code, TYPE_COUNT)); + vl->append(val_mgr->GetCount(reply_code)); if ( reply_reason_phrase ) vl->append(reply_reason_phrase->Ref()); else @@ -1699,7 +1699,7 @@ void HTTP_Analyzer::HTTP_Header(int is_orig, mime::MIME_Header* h) val_list* vl = new val_list(); vl->append(BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); + vl->append(val_mgr->GetBool(is_orig)); vl->append(mime::new_string_val(h->get_name())->ToUpper()); vl->append(mime::new_string_val(h->get_value())); if ( DEBUG_http ) @@ -1835,8 +1835,8 @@ void HTTP_Analyzer::HTTP_EntityData(int is_orig, BroString* entity_data) { val_list* vl = new val_list(); vl->append(BuildConnVal()); - vl->append(new Val(is_orig, TYPE_BOOL)); - vl->append(new Val(entity_data->Len(), TYPE_COUNT)); + vl->append(val_mgr->GetBool(is_orig)); + vl->append(val_mgr->GetCount(entity_data->Len())); vl->append(new StringVal(entity_data)); ConnectionEvent(http_entity_data, vl); } diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc index 08dd56190c..9a615d7058 100644 --- a/src/analyzer/protocol/tcp/TCP.cc +++ b/src/analyzer/protocol/tcp/TCP.cc @@ -1437,10 +1437,10 @@ void TCP_Analyzer::UpdateConnVal(RecordVal *conn_val) RecordVal *orig_endp_val = conn_val->Lookup("orig")->AsRecordVal(); RecordVal *resp_endp_val = conn_val->Lookup("resp")->AsRecordVal(); - orig_endp_val->Assign(0, new Val(orig->Size(), TYPE_COUNT)); - orig_endp_val->Assign(1, new Val(int(orig->state), TYPE_COUNT)); - resp_endp_val->Assign(0, new Val(resp->Size(), TYPE_COUNT)); - resp_endp_val->Assign(1, new Val(int(resp->state), TYPE_COUNT)); + orig_endp_val->Assign(0, val_mgr->GetCount(orig->Size())); + orig_endp_val->Assign(1, val_mgr->GetCount(int(orig->state))); + resp_endp_val->Assign(0, val_mgr->GetCount(resp->Size())); + resp_endp_val->Assign(1, val_mgr->GetCount(int(resp->state))); // Call children's UpdateConnVal Analyzer::UpdateConnVal(conn_val); diff --git a/src/main.cc b/src/main.cc index 742773bf73..b2035e2ad7 100644 --- a/src/main.cc +++ b/src/main.cc @@ -83,6 +83,7 @@ int perftools_profile = 0; DNS_Mgr* dns_mgr; TimerMgr* timer_mgr; +ValManager* val_mgr = 0; PortManager* port_mgr = 0; logging::Manager* log_mgr = 0; threading::Manager* thread_mgr = 0; @@ -382,6 +383,7 @@ void terminate_bro() delete reporter; // broker_mgr is deleted via iosource_mgr delete iosource_mgr; + delete val_mgr; delete port_mgr; reporter = 0; @@ -774,6 +776,7 @@ int main(int argc, char** argv) bro_start_time = current_time(true); + val_mgr = new ValManager(); port_mgr = new PortManager(); reporter = new Reporter(); thread_mgr = new threading::Manager();