[
https://bro-tracker.atlassian.net/browse/BIT-1125?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15313#comment-15313
]
Jon Siwek commented on BIT-1125:
--------------------------------
{quote}
For the case that the core can compute the file id itself without needing the
script-land, is the idea that it then just passes it in as the cached_id?
{quote}
Yes, and it can ignore the return value from those methods and just always
supply its own file ID if that's what it wants to do.
{quote}
I've been thinking about this and I'm not sure how I feel about analyzers
computing their own identifiers. That actually causes inconsistent behavior
because a user would have to know that a certain analyzer does that or that it
does that in certain cases. i.e. the user would have no control over how file
chunks are tied together to form complete files.
{quote}
Probably few users are going to want change how file IDs are calculated in the
first place and the cases where an analyzer directly calculated a file ID are
probably going to be the ones where there's not really any other sane way to do
it. I do agree it's somewhat inconsistent, though.
{quote}
Is this something that is already implemented?
{quote}
Yes, it comes free w/ the new support for caching a file ID returned from
script-land due to the way the code is structured (just in this case the return
value from file analysis API functions is whatever was passed in instead of
something calculated in script-land).
> topic/jsiwek/http-file-id-caching
> ---------------------------------
>
> Key: BIT-1125
> URL: https://bro-tracker.atlassian.net/browse/BIT-1125
> Project: Bro Issue Tracker
> Issue Type: Improvement
> Components: Bro
> Affects Versions: git/master
> Reporter: Jon Siwek
> Fix For: 2.3
>
> Attachments: signature.asc
>
>
> This branch is in bro and bro-testing repos. It adds a file ID caching /
> "fast path" mechanism to the file analysis API and adapts HTTP to use it for
> performance improvement.
--
This message was sent by Atlassian JIRA
(v6.2-OD-07-028#6211)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
