packet_analysis: Avoid shared_ptr copying for analyzer lookups

For deeply encapsulated connections (think AWS traffic mirroring format
like IP,UDP,GENEVE,IP,UDP,VXLAN,ETH,IP,TCP), the Dispatcher::Lookup()
method is fairly visible in profiles when running in bare mode.

This changes the Analyzer::Lookup() and Dispatcher::Lookup() return value
breaking the API in favor of the performance improvement.

Relates to zeek/zeek#3379.
This commit is contained in:
Arne Welzel 2023-11-01 10:03:49 +01:00
parent a821604505
commit e56ef0fd9b
5 changed files with 56 additions and 33 deletions

4
NEWS
View file

@ -9,6 +9,10 @@ Zeek 6.2.0
Breaking Changes
----------------
- The methods ``Dispatcher::Lookup()`` and ``Analyzer::Lookup()`` in the packet_analysis
namespace were changed to return a reference to a std::shared_ptr instead of a copy
for performance reasons.
New Functionality
-----------------