When an analyzer is being removed from a connection's analyzer tree,
it's at first only marked as removed, but not yet actually deleted.
The problem was that until destruction happens, the analyzer methods
checking presence of an analyzer would continue to indicate that it's
there, even though semantically one wouldn't expect to find it anymore
after that removal operation. That in turn then prevented one from
adding a new analyzer of the same type during that time until
destruction (because we don't allow more than one of each kind at the
same time).
This fix changes the logic searching for analyzers to ignore any
existing ones scheduled for removal. I believe this shouldn't have any
further side effects.
Closes#2801.
Merging this will flush the caches once by changing the fingerprint.
Also increase the limit to 1GB to strike a balance between fast
down/uploads and suboptimal ccache pruning:
After #2802, depending on the task/platform, a mostly cached build on Cirrus CI
is taking 30-60seconds. Eye balling a few tasks, it is now taking longer to
download and unpack as well as check and re-upload the accumulated cache in
the beginning and end of a task.
For Debian 11, this was ~1:20 and 1:10 with a cache size of ~4.2GB. The
default size limit for ccache is 5GB, there's no limit to the number of files.
Running a fresh build on Debian 11, ccache -s indicates the actual
required cache size is ~100MB and the number of files in cache is ~2.7k.
Lower cache size to 500M and number of files to 20000, such that we don't
unnecessarily accumulate the cache and spend resources on downloading,
checking and re-uploading the cache.
root@cirrus-ci-task-4907974120964096# ccache -s | grep -E 'files|size'
files in cache 2736
cache size 96.7 MB
max cache size 5.0 GB
PRs have their own cache namespace, so they won't thrash the main's
branch cache. I think main and release share their branch, so we should
not be super aggressive. Though we're probably okay with cache misses on
release once in a while.
* origin/topic/timw/2574-windows-build-warnings:
Include stdint.h early in flex files to prevent redefinition of int type macros
Update bifcl submodule [nomail]
Update binpac submodule [nomail]
SMB: clarify a confusing line in one of the pac files
module_util: Change streq helper method to just return bool
NTLM analyzer: Don't bother checking boolean values for > 0
FTP analyzer: Remove unnecessary lines from constructor
IP_Hdr: take length value as uint64_t instead of int
EventTrace: take size_t as a constructor argument instead of int
Change argument to Tempvar constructor to size_t, avoids conversion warning in template construction
The py39-pip package is sometimes not available on FreeBSD, and using
ensurepip is the recommended way to install pip according to the pip
documentation. ensurepip should be available in every python
installation.
The OBS builds run in an environment where no git is installed and
release tarballs assembled manually.
Drop the hard-requirement on git from ci/collect-repo-info.json.
When bumping the VERSION file, everything that includes the auto-generated
zeek/zeek-config.h needs to rebuild and ccache usage is voided due the file
changing. Split the mutable version information into a new zeek-version.h
file to avoid this.
Further, do not include zeek-version.h within Plugin.h and avoid the reference
to ZEEK_VERSION_FUNCTION unless we're building an external plugin.
Closes#2776.
* origin/topic/awelzel/2572-event-handler-stats:
Bump external baselines
external/testing-setup: Less telemetry.log volume
EventHandler: Use telemetry framework for EventHandler.call_count
For traces spanning a long time period, don't produce immense
amounts of logs. Also filter down the event handler invocation
entries to connection related events in telemetry.log.
Put the IntCounter into a std::optional rather than initializing
it at EventHandler construction time as that will currently expose
a time series per event handler through the Prometheus API.
The user and password fields are replicated to each of the ftp.log
entries. Using a very large username (100s of KBs) allows to bloat
the log without actually sending much traffic. Further, limit the
arg and reply_msg columns to large, but not unbounded values.
This fixes a potential memory leak when getting responses for asnyc DNS requests
where the TTL value on the response is zero. We were immediately considering the
request as expired and never removing it from the map of requests. This lead to
the DNS_Mgr eventually stopping processing of async requests.
It's happening regularly to me that I forget the type specifier when redef'ing
records or enums and usually it takes me a while to figure out what's going
on as the errors are not descriptive. Improve the error reporting and just
bail as there's no sensible way to continue.
Closes#2777
* ekoyle/add-protocol-pbb:
Update seemingly-unrelated btests
Use a default analyzer
Simplify PBB analyzer by using Ethernet analyzer
Add btest for PBB and update baselines
Use constexpr instead of #define
Cleanup and add customer MAC addresses
Add PBB (802.1ah) support
