removal-hooks.zeek

Conn

Adds a framework for registering “connection removal hooks”. All registered hooks for a given connection get run within the connection_state_remove event for that connection. This functionality is useful from a performance/scaling concern: if every new protocol-analysis script uses connection_state_remove to implement its finalization/cleanup logic, then all connections take the performance hit of dispatching that event, even if they aren’t related to that specific protocol.

Namespace:: Conn

Summary

Types

Conn::RemovalHook: hook

A hook function for use with either Conn::register_removal_hook or Conn::unregister_removal_hook.

Redefinitions

connection: record

New Fields:

connection

removal_hooks: set [Conn::RemovalHook] &optional

Functions

`Conn::register_removal_hook`: `function`	Register a hook that will later be called during a connection’s `connection_state_remove` event.
`Conn::unregister_removal_hook`: `function`	Unregister a hook that would have been called during a connection’s `connection_state_remove` event such that it will no longer be called.

Detailed Interface

Types

Conn::RemovalHook 

Type:: hook (c: connection) : bool

A hook function for use with either Conn::register_removal_hook or Conn::unregister_removal_hook. The connection argument refers to the connection currently being removed within a connection_state_remove event.

Functions

Conn::register_removal_hook 

Type:: function (c: connection, hk: Conn::RemovalHook) : bool

Register a hook that will later be called during a connection’s connection_state_remove event.

Parameters:

c – The associated connection whose connection_state_remove event should trigger a callback to hk.
hk – The hook function to use as a callback.

Returns:

false if the provided hook was previously registered, else true.

Conn::unregister_removal_hook 

Type:: function (c: connection, hk: Conn::RemovalHook) : bool

Unregister a hook that would have been called during a connection’s connection_state_remove event such that it will no longer be called.

Parameters:

c – The associated connection whose connection_state_remove event could have triggered a callback to hk.
hk – The hook function that would have been used as a callback.

Returns:

true if the provided hook was previously registered, else false.