[Bro-Dev] [JIRA] (BIT-1125) topic/jsiwek/http-file-id-caching

[Jon Siwek (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1125?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15313#comment-15313 ] 

Jon Siwek commented on BIT-1125:
--------------------------------

{quote}
For the case that the core can compute the file id itself without needing the script-land, is the idea that it then just passes it in as the cached_id?
{quote}

Yes, and it can ignore the return value from those methods and just always supply its own file ID if that's what it wants to do.

{quote}
I've been thinking about this and I'm not sure how I feel about analyzers computing their own identifiers. That actually causes inconsistent behavior because a user would have to know that a certain analyzer does that or that it does that in certain cases. i.e. the user would have no control over how file chunks are tied together to form complete files.
{quote}

Probably few users are going to want change how file IDs are calculated in the first place and the cases where an analyzer directly calculated a file ID are probably going to be the ones where there's not really any other sane way to do it.  I do agree it's somewhat inconsistent, though.

{quote}
Is this something that is already implemented?
{quote}

Yes, it comes free w/ the new support for caching a file ID returned from script-land due to the way the code is structured (just in this case the return value from file analysis API functions is whatever was passed in instead of something calculated in script-land).

> topic/jsiwek/http-file-id-caching
> ---------------------------------
>
>                 Key: BIT-1125
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1125
>             Project: Bro Issue Tracker
>          Issue Type: Improvement
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: Jon Siwek
>             Fix For: 2.3
>
>         Attachments: signature.asc
>
>
> This branch is in bro and bro-testing repos.  It adds a file ID caching / "fast path" mechanism to the file analysis API and adapts HTTP to use it for performance improvement.



--
This message was sent by Atlassian JIRA
(v6.2-OD-07-028#6211)