rsmmr / hilti

**NOTE**: This is outdated and no longer maintained. There's a new version at https://github.com/zeek/spicy.
Other
40 stars 22 forks source link

[Bro] Simple fix for caching system in Bro-Hilti Plugin. #19

Closed FrozenCaribou closed 7 years ago

FrozenCaribou commented 8 years ago

This patch corrects 2 bugs :

Enable cache

It was not possible to enable caching in a Bro script with :

## Use on-disk cache for compiled modules.
redef Hilti::use_cache = T;

It is because _paccontext options are set in InitPreScripts() and options are set with BifConst in InitPostScript(). However, BifConst::Hilti options are not available in InitPreScripts (because reading of *.bro is done after) so I have corrected that by re-setting options in InitPostScript and updated hilti_context) This seems to be enough to fix the problem.

Register cached Analyzer

When no cache exists and compilation is done the pac2 analyzer is well registered but when a cache is available, analyzer is not registered regarding .evt configuration. It is due to the following code https://github.com/FrozenCaribou/hilti/blob/fix_cache/bro/src/Manager.cc#L900-L925 , registering analyzer part is not executed when using cache. I have just added a big "if" to use the same RunJIT(llvm_module) and registering analyzer commands for caching and compiling.

auto llvm_module = CheckCacheForLinkedModule();
if ( !llvm_module )
   {
         ....
    }
auto result = RunJIT(llvm_module);
PLUGIN_DBG_LOG(HiltiPlugin, "Done with compilation");

PLUGIN_DBG_LOG(HiltiPlugin, "Registering analyzers through events");
FrozenCaribou commented 8 years ago

If an bro event is implemented after the analyzer was cached and if compile_all=F;, the bro event will not be executed because it need an update of the cache (remove manualy .cache) If compile_all=T; it will work because code is already generated for the event.

## Generate code for all events no matter if they have a handler
## defined or not.
redef Hilti::compile_all = T ;
rsmmr commented 7 years ago

This PR has a number of conflicts since the recent code reorganization. I also believe that caching is pretty much broken at the moment, it's on the todo list to get that working, but I believe it needs a different approach to work reliably than what the current code does.