mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
Remove other simple uses of PDict
This commit is contained in:
parent
8beb710a5e
commit
e6558d1f19
9 changed files with 84 additions and 75 deletions
|
@ -141,8 +141,6 @@ protected:
|
||||||
|
|
||||||
DNS_MgrMode mode;
|
DNS_MgrMode mode;
|
||||||
|
|
||||||
PDict<ListVal> services;
|
|
||||||
|
|
||||||
HostMap host_mappings;
|
HostMap host_mappings;
|
||||||
AddrMap addr_mappings;
|
AddrMap addr_mappings;
|
||||||
TextMap text_mappings;
|
TextMap text_mappings;
|
||||||
|
|
20
src/RE.cc
20
src/RE.cc
|
@ -194,9 +194,13 @@ int Specific_RE_Matcher::CompileSet(const string_list& set, const int_list& idx)
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
const char* Specific_RE_Matcher::LookupDef(const char* def)
|
string Specific_RE_Matcher::LookupDef(const string& def)
|
||||||
{
|
{
|
||||||
return defs.Lookup(def);
|
const auto& iter = defs.find(def);
|
||||||
|
if ( iter != defs.end() )
|
||||||
|
return iter->first;
|
||||||
|
|
||||||
|
return string();
|
||||||
}
|
}
|
||||||
|
|
||||||
int Specific_RE_Matcher::MatchAll(const char* s)
|
int Specific_RE_Matcher::MatchAll(const char* s)
|
||||||
|
@ -412,10 +416,18 @@ unsigned int Specific_RE_Matcher::MemoryAllocation() const
|
||||||
for ( int i = 0; i < ccl_list.length(); ++i )
|
for ( int i = 0; i < ccl_list.length(); ++i )
|
||||||
size += ccl_list[i]->MemoryAllocation();
|
size += ccl_list[i]->MemoryAllocation();
|
||||||
|
|
||||||
|
size += pad_size(sizeof(CCL*) * ccl_dict.size());
|
||||||
|
for ( const auto& entry : ccl_dict )
|
||||||
|
size += padded_sizeof(std::string) + pad_size(sizeof(std::string::value_type) * entry.first.size());
|
||||||
|
|
||||||
|
for ( const auto& entry : defs )
|
||||||
|
{
|
||||||
|
size += padded_sizeof(std::string) + pad_size(sizeof(std::string::value_type) * entry.first.size());
|
||||||
|
size += padded_sizeof(std::string) + pad_size(sizeof(std::string::value_type) * entry.second.size());
|
||||||
|
}
|
||||||
|
|
||||||
return size + padded_sizeof(*this)
|
return size + padded_sizeof(*this)
|
||||||
+ (pattern_text ? pad_size(strlen(pattern_text) + 1) : 0)
|
+ (pattern_text ? pad_size(strlen(pattern_text) + 1) : 0)
|
||||||
+ defs.MemoryAllocation() - padded_sizeof(defs) // FIXME: count content
|
|
||||||
+ ccl_dict.MemoryAllocation() - padded_sizeof(ccl_dict) // FIXME: count content
|
|
||||||
+ ccl_list.MemoryAllocation() - padded_sizeof(ccl_list)
|
+ ccl_list.MemoryAllocation() - padded_sizeof(ccl_list)
|
||||||
+ equiv_class.Size() - padded_sizeof(EquivClass)
|
+ equiv_class.Size() - padded_sizeof(EquivClass)
|
||||||
+ (dfa ? dfa->MemoryAllocation() : 0) // this is ref counted; consider the bytes here?
|
+ (dfa ? dfa->MemoryAllocation() : 0) // this is ref counted; consider the bytes here?
|
||||||
|
|
17
src/RE.h
17
src/RE.h
|
@ -59,15 +59,22 @@ public:
|
||||||
// The following is vestigial from flex's use of "{name}" definitions.
|
// The following is vestigial from flex's use of "{name}" definitions.
|
||||||
// It's here because at some point we may want to support such
|
// It's here because at some point we may want to support such
|
||||||
// functionality.
|
// functionality.
|
||||||
const char* LookupDef(const char* def);
|
std::string LookupDef(const std::string& def);
|
||||||
|
|
||||||
void InsertCCL(const char* txt, CCL* ccl) { ccl_dict.Insert(txt, ccl); }
|
void InsertCCL(const char* txt, CCL* ccl) { ccl_dict[string(txt)] = ccl; }
|
||||||
int InsertCCL(CCL* ccl)
|
int InsertCCL(CCL* ccl)
|
||||||
{
|
{
|
||||||
ccl_list.push_back(ccl);
|
ccl_list.push_back(ccl);
|
||||||
return ccl_list.length() - 1;
|
return ccl_list.length() - 1;
|
||||||
}
|
}
|
||||||
CCL* LookupCCL(const char* txt) { return ccl_dict.Lookup(txt); }
|
CCL* LookupCCL(const char* txt)
|
||||||
|
{
|
||||||
|
const auto& iter = ccl_dict.find(string(txt));
|
||||||
|
if ( iter != ccl_dict.end() )
|
||||||
|
return iter->second;
|
||||||
|
|
||||||
|
return nullptr;
|
||||||
|
}
|
||||||
CCL* LookupCCL(int index) { return ccl_list[index]; }
|
CCL* LookupCCL(int index) { return ccl_list[index]; }
|
||||||
CCL* AnyCCL();
|
CCL* AnyCCL();
|
||||||
|
|
||||||
|
@ -119,8 +126,8 @@ protected:
|
||||||
int multiline;
|
int multiline;
|
||||||
char* pattern_text;
|
char* pattern_text;
|
||||||
|
|
||||||
PDict<char> defs;
|
std::map<string,string> defs;
|
||||||
PDict<CCL> ccl_dict;
|
std::map<string,CCL*> ccl_dict;
|
||||||
PList<CCL> ccl_list;
|
PList<CCL> ccl_list;
|
||||||
EquivClass equiv_class;
|
EquivClass equiv_class;
|
||||||
int* ecs;
|
int* ecs;
|
||||||
|
|
|
@ -2,6 +2,7 @@
|
||||||
#define rule_h
|
#define rule_h
|
||||||
|
|
||||||
#include <limits.h>
|
#include <limits.h>
|
||||||
|
#include <map>
|
||||||
|
|
||||||
#include "Obj.h"
|
#include "Obj.h"
|
||||||
#include "List.h"
|
#include "List.h"
|
||||||
|
@ -15,7 +16,7 @@ class RuleHdrTest;
|
||||||
class Rule;
|
class Rule;
|
||||||
|
|
||||||
typedef PList<Rule> rule_list;
|
typedef PList<Rule> rule_list;
|
||||||
typedef PDict<Rule> rule_dict;
|
typedef std::map<string, Rule*> rule_dict;
|
||||||
|
|
||||||
class Rule {
|
class Rule {
|
||||||
public:
|
public:
|
||||||
|
|
|
@ -267,14 +267,14 @@ bool RuleMatcher::ReadFiles(const name_list& files)
|
||||||
|
|
||||||
void RuleMatcher::AddRule(Rule* rule)
|
void RuleMatcher::AddRule(Rule* rule)
|
||||||
{
|
{
|
||||||
if ( rules_by_id.Lookup(rule->ID()) )
|
if ( rules_by_id.find(rule->ID()) != rules_by_id.end() )
|
||||||
{
|
{
|
||||||
rules_error("rule defined twice");
|
rules_error("rule defined twice");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
rules.push_back(rule);
|
rules.push_back(rule);
|
||||||
rules_by_id.Insert(rule->ID(), rule);
|
rules_by_id[rule->ID()] = rule;
|
||||||
}
|
}
|
||||||
|
|
||||||
void RuleMatcher::BuildRulesTree()
|
void RuleMatcher::BuildRulesTree()
|
||||||
|
@ -295,15 +295,15 @@ void RuleMatcher::InsertRuleIntoTree(Rule* r, int testnr,
|
||||||
// Initiliaze the preconditions
|
// Initiliaze the preconditions
|
||||||
for ( const auto& pc : r->preconds )
|
for ( const auto& pc : r->preconds )
|
||||||
{
|
{
|
||||||
Rule* pc_rule = rules_by_id.Lookup(pc->id);
|
auto entry = rules_by_id.find(pc->id);
|
||||||
if ( ! pc_rule )
|
if ( entry == rules_by_id.end() )
|
||||||
{
|
{
|
||||||
rules_error(r, "unknown rule referenced");
|
rules_error(r, "unknown rule referenced");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
pc->rule = pc_rule;
|
pc->rule = entry->second;
|
||||||
pc_rule->dependents.push_back(r);
|
entry->second->dependents.push_back(r);
|
||||||
}
|
}
|
||||||
|
|
||||||
// All tests in tree already?
|
// All tests in tree already?
|
||||||
|
|
|
@ -24,7 +24,7 @@ string Manager::salt;
|
||||||
Manager::Manager()
|
Manager::Manager()
|
||||||
: plugin::ComponentManager<file_analysis::Tag,
|
: plugin::ComponentManager<file_analysis::Tag,
|
||||||
file_analysis::Component>("Files", "Tag"),
|
file_analysis::Component>("Files", "Tag"),
|
||||||
id_map(), ignored(), current_file_id(), magic_state()
|
current_file_id(), magic_state(), cumulative_files(0), max_files(0)
|
||||||
{
|
{
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -35,19 +35,8 @@ Manager::~Manager()
|
||||||
|
|
||||||
// Have to assume that too much of Bro has been shutdown by this point
|
// Have to assume that too much of Bro has been shutdown by this point
|
||||||
// to do anything more than reclaim memory.
|
// to do anything more than reclaim memory.
|
||||||
|
for ( const auto& entry : id_map )
|
||||||
File* f;
|
delete entry.second;
|
||||||
bool* b;
|
|
||||||
|
|
||||||
IterCookie* it = id_map.InitForIteration();
|
|
||||||
|
|
||||||
while ( (f = id_map.NextEntry(it)) )
|
|
||||||
delete f;
|
|
||||||
|
|
||||||
it = ignored.InitForIteration();
|
|
||||||
|
|
||||||
while( (b = ignored.NextEntry(it)) )
|
|
||||||
delete b;
|
|
||||||
|
|
||||||
delete magic_state;
|
delete magic_state;
|
||||||
}
|
}
|
||||||
|
@ -69,19 +58,11 @@ void Manager::InitMagic()
|
||||||
void Manager::Terminate()
|
void Manager::Terminate()
|
||||||
{
|
{
|
||||||
vector<string> keys;
|
vector<string> keys;
|
||||||
|
for ( const auto& entry : id_map )
|
||||||
|
keys.push_back(entry.first);
|
||||||
|
|
||||||
IterCookie* it = id_map.InitForIteration();
|
for ( const string& key : keys )
|
||||||
HashKey* key;
|
Timeout(key, true);
|
||||||
|
|
||||||
while ( id_map.NextEntry(key, it) )
|
|
||||||
{
|
|
||||||
keys.push_back(string(static_cast<const char*>(key->Key()),
|
|
||||||
key->Size()));
|
|
||||||
delete key;
|
|
||||||
}
|
|
||||||
|
|
||||||
for ( size_t i = 0; i < keys.size(); ++i )
|
|
||||||
Timeout(keys[i], true);
|
|
||||||
|
|
||||||
mgr.Drain();
|
mgr.Drain();
|
||||||
}
|
}
|
||||||
|
@ -329,7 +310,7 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
|
||||||
if ( IsIgnored(file_id) )
|
if ( IsIgnored(file_id) )
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
File* rval = id_map.Lookup(file_id.c_str());
|
File* rval = LookupFile(file_id);
|
||||||
|
|
||||||
if ( ! rval )
|
if ( ! rval )
|
||||||
{
|
{
|
||||||
|
@ -337,7 +318,12 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
|
||||||
source_name ? source_name
|
source_name ? source_name
|
||||||
: analyzer_mgr->GetComponentName(tag),
|
: analyzer_mgr->GetComponentName(tag),
|
||||||
conn, tag, is_orig);
|
conn, tag, is_orig);
|
||||||
id_map.Insert(file_id.c_str(), rval);
|
id_map[file_id] = rval;
|
||||||
|
|
||||||
|
++cumulative_files;
|
||||||
|
if ( id_map.size() > max_files )
|
||||||
|
max_files = id_map.size();
|
||||||
|
|
||||||
rval->ScheduleInactivityTimer();
|
rval->ScheduleInactivityTimer();
|
||||||
|
|
||||||
// Generate file_new after inserting it into manager's mapping
|
// Generate file_new after inserting it into manager's mapping
|
||||||
|
@ -362,7 +348,11 @@ File* Manager::GetFile(const string& file_id, Connection* conn,
|
||||||
|
|
||||||
File* Manager::LookupFile(const string& file_id) const
|
File* Manager::LookupFile(const string& file_id) const
|
||||||
{
|
{
|
||||||
return id_map.Lookup(file_id.c_str());
|
const auto& entry = id_map.find(file_id);
|
||||||
|
if ( entry == id_map.end() )
|
||||||
|
return nullptr;
|
||||||
|
|
||||||
|
return entry->second;
|
||||||
}
|
}
|
||||||
|
|
||||||
void Manager::Timeout(const string& file_id, bool is_terminating)
|
void Manager::Timeout(const string& file_id, bool is_terminating)
|
||||||
|
@ -393,22 +383,21 @@ void Manager::Timeout(const string& file_id, bool is_terminating)
|
||||||
|
|
||||||
bool Manager::IgnoreFile(const string& file_id)
|
bool Manager::IgnoreFile(const string& file_id)
|
||||||
{
|
{
|
||||||
if ( ! id_map.Lookup(file_id.c_str()) )
|
if ( ! LookupFile(file_id) )
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
DBG_LOG(DBG_FILE_ANALYSIS, "Ignore FileID %s", file_id.c_str());
|
DBG_LOG(DBG_FILE_ANALYSIS, "Ignore FileID %s", file_id.c_str());
|
||||||
|
|
||||||
delete ignored.Insert(file_id.c_str(), new bool);
|
ignored.insert(file_id);
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool Manager::RemoveFile(const string& file_id)
|
bool Manager::RemoveFile(const string& file_id)
|
||||||
{
|
{
|
||||||
HashKey key(file_id.c_str());
|
|
||||||
// Can't remove from the dictionary/map right away as invoking EndOfFile
|
// Can't remove from the dictionary/map right away as invoking EndOfFile
|
||||||
// may cause some events to be executed which actually depend on the file
|
// may cause some events to be executed which actually depend on the file
|
||||||
// still being in the dictionary/map.
|
// still being in the dictionary/map.
|
||||||
File* f = static_cast<File*>(id_map.Lookup(&key));
|
File* f = LookupFile(file_id);
|
||||||
|
|
||||||
if ( ! f )
|
if ( ! f )
|
||||||
return false;
|
return false;
|
||||||
|
@ -417,14 +406,15 @@ bool Manager::RemoveFile(const string& file_id)
|
||||||
|
|
||||||
f->EndOfFile();
|
f->EndOfFile();
|
||||||
delete f;
|
delete f;
|
||||||
id_map.Remove(&key);
|
id_map.erase(file_id);
|
||||||
delete static_cast<bool*>(ignored.Remove(&key));
|
|
||||||
|
ignored.erase(file_id);
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
bool Manager::IsIgnored(const string& file_id)
|
bool Manager::IsIgnored(const string& file_id)
|
||||||
{
|
{
|
||||||
return ignored.Lookup(file_id.c_str()) != 0;
|
return ignored.find(file_id) != ignored.end();
|
||||||
}
|
}
|
||||||
|
|
||||||
string Manager::GetFileID(analyzer::Tag tag, Connection* c, bool is_orig)
|
string Manager::GetFileID(analyzer::Tag tag, Connection* c, bool is_orig)
|
||||||
|
|
|
@ -5,6 +5,7 @@
|
||||||
|
|
||||||
#include <string>
|
#include <string>
|
||||||
#include <queue>
|
#include <queue>
|
||||||
|
#include <unordered_set>
|
||||||
|
|
||||||
#include "Dict.h"
|
#include "Dict.h"
|
||||||
#include "Net.h"
|
#include "Net.h"
|
||||||
|
@ -325,20 +326,17 @@ public:
|
||||||
std::string DetectMIME(const u_char* data, uint64 len) const;
|
std::string DetectMIME(const u_char* data, uint64 len) const;
|
||||||
|
|
||||||
uint64 CurrentFiles()
|
uint64 CurrentFiles()
|
||||||
{ return id_map.Length(); }
|
{ return id_map.size(); }
|
||||||
|
|
||||||
uint64 MaxFiles()
|
uint64 MaxFiles()
|
||||||
{ return id_map.MaxLength(); }
|
{ return max_files; }
|
||||||
|
|
||||||
uint64 CumulativeFiles()
|
uint64 CumulativeFiles()
|
||||||
{ return id_map.NumCumulativeInserts(); }
|
{ return cumulative_files; }
|
||||||
|
|
||||||
protected:
|
protected:
|
||||||
friend class FileTimer;
|
friend class FileTimer;
|
||||||
|
|
||||||
typedef PDict<bool> IDSet;
|
|
||||||
typedef PDict<File> IDMap;
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Create a new file to be analyzed or retrieve an existing one.
|
* Create a new file to be analyzed or retrieve an existing one.
|
||||||
* @param file_id the file identifier/hash.
|
* @param file_id the file identifier/hash.
|
||||||
|
@ -407,8 +405,8 @@ private:
|
||||||
|
|
||||||
TagSet* LookupMIMEType(const string& mtype, bool add_if_not_found);
|
TagSet* LookupMIMEType(const string& mtype, bool add_if_not_found);
|
||||||
|
|
||||||
PDict<File> id_map; /**< Map file ID to file_analysis::File records. */
|
std::map<string, File*> id_map; /**< Map file ID to file_analysis::File records. */
|
||||||
PDict<bool> ignored; /**< Ignored files. Will be finally removed on EOF. */
|
std::unordered_set<string> ignored; /**< Ignored files. Will be finally removed on EOF. */
|
||||||
string current_file_id; /**< Hash of what get_file_handle event sets. */
|
string current_file_id; /**< Hash of what get_file_handle event sets. */
|
||||||
RuleFileMagicState* magic_state; /**< File magic signature match state. */
|
RuleFileMagicState* magic_state; /**< File magic signature match state. */
|
||||||
MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */
|
MIMEMap mime_types;/**< Mapping of MIME types to analyzers. */
|
||||||
|
@ -416,6 +414,9 @@ private:
|
||||||
static TableVal* disabled; /**< Table of disabled analyzers. */
|
static TableVal* disabled; /**< Table of disabled analyzers. */
|
||||||
static TableType* tag_set_type; /**< Type for set[tag]. */
|
static TableType* tag_set_type; /**< Type for set[tag]. */
|
||||||
static string salt; /**< A salt added to file handles before hashing. */
|
static string salt; /**< A salt added to file handles before hashing. */
|
||||||
|
|
||||||
|
size_t cumulative_files;
|
||||||
|
size_t max_files;
|
||||||
};
|
};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
|
@ -153,31 +153,31 @@ Manager::EventStream::EventStream()
|
||||||
|
|
||||||
Manager::EventStream::~EventStream()
|
Manager::EventStream::~EventStream()
|
||||||
{
|
{
|
||||||
if ( fields )
|
if ( fields )
|
||||||
Unref(fields);
|
Unref(fields);
|
||||||
}
|
}
|
||||||
|
|
||||||
Manager::TableStream::~TableStream()
|
Manager::TableStream::~TableStream()
|
||||||
{
|
{
|
||||||
if ( tab )
|
if ( tab )
|
||||||
Unref(tab);
|
Unref(tab);
|
||||||
|
|
||||||
if ( itype )
|
if ( itype )
|
||||||
Unref(itype);
|
Unref(itype);
|
||||||
|
|
||||||
if ( rtype ) // can be 0 for sets
|
if ( rtype ) // can be 0 for sets
|
||||||
Unref(rtype);
|
Unref(rtype);
|
||||||
|
|
||||||
if ( currDict != 0 )
|
if ( currDict != 0 )
|
||||||
{
|
{
|
||||||
currDict->Clear();
|
currDict->Clear();
|
||||||
delete currDict;
|
delete currDict;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ( lastDict != 0 )
|
if ( lastDict != 0 )
|
||||||
{
|
{
|
||||||
lastDict->Clear();;
|
lastDict->Clear();;
|
||||||
delete lastDict;
|
delete lastDict;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -85,14 +85,14 @@ CCL_EXPR ("[:"[[:alpha:]]+":]")
|
||||||
char* nmstr = copy_string(yytext+1);
|
char* nmstr = copy_string(yytext+1);
|
||||||
nmstr[yyleng - 2] = '\0'; // chop trailing brace
|
nmstr[yyleng - 2] = '\0'; // chop trailing brace
|
||||||
|
|
||||||
const char* namedef = rem->LookupDef(nmstr);
|
std::string namedef = rem->LookupDef(nmstr);
|
||||||
delete nmstr;
|
delete nmstr;
|
||||||
|
|
||||||
if ( ! namedef )
|
if ( namedef.empty() )
|
||||||
synerr("undefined definition");
|
synerr("undefined definition");
|
||||||
else
|
else
|
||||||
{ // push back name surrounded by ()'s
|
{ // push back name surrounded by ()'s
|
||||||
int len = strlen(namedef);
|
int len = namedef.size();
|
||||||
|
|
||||||
if ( namedef[0] == '^' ||
|
if ( namedef[0] == '^' ||
|
||||||
(len > 0 && namedef[len - 1] == '$') )
|
(len > 0 && namedef[len - 1] == '$') )
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue