your suggestion sounds good. I implemented the changes and tested them with my ssl analyzer. Everything worked as expected. :-)
Attached you can find the patch for these changes (to be applied with -p0 in the bro directory, after applying all of the other binpac patches that I provided before). Could you test this further with whatever binpac analyzers you have got?
Anyone else any comments on this issue (Ruoming)?
On 5/30/07, email@example.com <firstname.lastname@example.org> wrote:
On Tue, 29 May 2007, Tobias Kiesling wrote:
> On 5/29/07, email@example.com
>> Patch 6: I think there is another issue here: if some buffering request
>> has been sent to the flow buffer, and the flow buffer is not ready with
>> partial data, we will end up with entering the loop - a waste of CPU
> Maybe you are right, but what would you suggest as change? Do you want to
> check whether the buffer is ready before entering the loop? But then it has
> to be ensured that the buffer is properly initialized in any case. At the
> moment I cannot see all the consequences of such a change. And do you think
> that the impact on performance is really relevant?
The cost can be a little bit expensive if there are many layers of parsing.
You end up with many unnecessary calls to parsing functions and condition
jumps. One possible approach is like this:
. add a new boolean member have_pending_request to FlowBuffer, initialized
. set have_pending_request to true in call NewFrame and NewLine.
. reset have_pending_request to false in call DiscardData.
. change the while loop condition to:
while (flow_buffer->data_available() &&
(!flow_buffer->have_pending_request() || flow_buffer->ready()))
1. The first time, data_available = true, !have_pending_request = true,
we enter into the loop. Good.
2. All data are consumed, data_available = false, we do not enter into
the loop. Good.
3. A request is not satisfied because of partial data: data_available =
true, !have_pending_request = false, ready = false, we do not enter into
the loop. Good.
4. Parsing is forced to stop because of exception. data_available = false.
We do not enter into the loop. Good.
5. Parsing current dataunit has finished, we still have residual data -
wrong data? data_available = true, !have_pending_request = false, ready =
true (from last parsing). We enter into the loop, and start a new round of
parsing. As expected. Good.
So far so good. :-)
The future is not set. There is no fate but what we make
for ourselves. - Terminator II, Judgment Day