Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: optimize get_file_handle event queueing.

Browse source 
When a file handle is needed and the last event in the queue is also
a get_file_handle event with the same arguments, instead of queueing
a new event, just remember to cache/re-use the resulting handle from
the previous event.  This depends on get_file_handle handlers not
changing global state that is also used to derive the file handle
string.
This commit is contained in:
Jon Siwek 2013-04-02 16:21:51 -05:00
parent 390358b70c
commit fc267d010d
10 changed files with 88 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

55
src/file_analysis/Manager.cc
View file

@ -34,11 +34,17 @@ void Manager::ReceiveHandle(const string& handle)
if ( pending.empty() )
reporter->InternalError("File analysis underflow");
PendingFile* pf = pending.front();
if ( ! handle.empty() )
pf->Finish(handle);
delete pf;
pending.pop();
int use_count = cache.front();
cache.pop();
for ( int i = 0; i < use_count; ++i )
{
PendingFile* pf = pending.front();
if ( ! handle.empty() )
pf->Finish(handle);
delete pf;
pending.pop();
}
}
void Manager::EventDrainDone()
@ -330,11 +336,50 @@ bool Manager::IsDisabled(AnalyzerTag::Tag tag)
return rval;
}
static bool CheckArgEquality(AnalyzerTag::Tag tag, Connection* conn,
bool is_orig, val_list* other_args)
{
if ( ! other_args ) return false;
if ( (*other_args)[0]->AsCount() != (bro_uint_t) tag ) return false;
if ( (*other_args)[2]->AsBool() != is_orig ) return false;
RecordVal* id = (*other_args)[1]->AsRecordVal()->Lookup(
connection_type->FieldOffset("id"))->AsRecordVal();
PortVal* orig_p = id->Lookup(
conn_id->FieldOffset("orig_p"))->AsPortVal();
if ( orig_p->Port() != ntohs(conn->OrigPort()) ) return false;
if ( orig_p->PortType() != conn->ConnTransport() ) return false;
PortVal* resp_p = id->Lookup(
conn_id->FieldOffset("resp_p"))->AsPortVal();
if ( resp_p->Port() != ntohs(conn->RespPort()) ) return false;
if ( id->Lookup(conn_id->FieldOffset("orig_h"))->AsAddr() !=
conn->OrigAddr() ) return false;
if ( id->Lookup(conn_id->FieldOffset("resp_h"))->AsAddr() !=
conn->RespAddr() ) return false;
return true;
}
bool Manager::QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
bool is_orig)
{
if ( ! get_file_handle ) return false;
if ( mgr.Tail() == get_file_handle &&
CheckArgEquality(tag, conn, is_orig, mgr.TailArgs()) )
{
cache.front()++;
return true;
}
cache.push(1);
val_list* vl = new val_list();
vl->append(new Val(tag, TYPE_COUNT));
vl->append(conn->BuildConnVal());