[Bro-Dev] #574: More exessive memory usage

[Bro Tracker]

#574: More exessive memory usage
----------------------+------------------------
  Reporter:  gregor   |      Owner:
      Type:  Problem  |     Status:  new
  Priority:  High     |  Milestone:  Bro1.6
 Component:  Bro      |    Version:  git/master
Resolution:           |   Keywords:  beta
----------------------+------------------------

Comment (by robin):

 >  This solves (most of) the symptoms but not the root cause. Will open
 >  another ticket to address and track down the actual cause for 2.1

 I have a new piece for the puzzle. My guess is that this is causing
 the trouble:

 {{{
     type SSLPDU(is_orig: bool) = record {
         records : SSLRecord(is_orig)[] &until($element <= 0);
     } &byteorder = bigendian;
 }}}

 What I believe is happening is that binpac builds the complete array
 in memory and doesn't release anything before the connection
 terminates. For long-lived heavy-volume SSL connections, that's not
 good.

 Indeed, this patch for the *generated* code gives me stable memory
 usage with Gregor's trace and
 ``SSL::disable_analyzer_after_detection=F``:

 {{{
 --- build/src/ssl_pac.cc.org    2011-09-18 15:57:03.000000000 -0700
 +++ build/src/ssl_pac.cc        2011-09-18 15:57:41.000000000 -0700
 @@ -3098,7 +3098,9 @@
                                 }
                         if ( ! t_records__elem_parsing_complete )
                                 goto need_more_data;
 -                       records_->push_back(records__elem_);
 +
 +                       //records_->push_back(records__elem_);
 +
                         // Check &until( ( $element <= ((int) 0) ) )
                         if (  ( records__elem_ <= 0 )  )
                                 {
 @@ -3106,6 +3108,8 @@
                                 records__elem_ = 0;
                                 goto end_of_records;
                                 }
 +
 +                       delete records__elem_;
                         records__elem_ = 0;
                         }
         end_of_records: ;
 }}}

 Can you guys confirm that (1) this indeed fixes the problem, and (2)
 doesn't break anything else? If so, we should figure out how to teach
 binpac to generate the modified code.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/574#comment:15>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker