base/protocols/conn/removal-hooks.zeek

Conn

Adds a framework for registering “connection removal hooks”. All registered hooks for a given connection get run within the connection_state_remove event for that connection. This functionality is useful from a performance/scaling concern: if every new protocol-analysis script uses connection_state_remove to implement its finalization/cleanup logic, then all connections take the performance hit of dispatching that event, even if they aren’t related to that specific protocol.

Namespace

Conn

Summary

Types

Conn::RemovalHook: hook

A hook function for use with either Conn::register_removal_hook or Conn::unregister_removal_hook.

Redefinitions

connection: record

New Fields

connection

removal_hooks: set [Conn::RemovalHook] &optional

Functions

Conn::register_removal_hook: function

Register a hook that will later be called during a connection’s connection_state_remove event.

Conn::unregister_removal_hook: function

Unregister a hook that would have been called during a connection’s connection_state_remove event such that it will no longer be called.

Detailed Interface

Types

Conn::RemovalHook
Type

hook (c: connection) : bool

A hook function for use with either Conn::register_removal_hook or Conn::unregister_removal_hook. The connection argument refers to the connection currently being removed within a connection_state_remove event.

Functions

Conn::register_removal_hook
Type

function (c: connection, hk: Conn::RemovalHook) : bool

Register a hook that will later be called during a connection’s connection_state_remove event.

Parameters
  • c – The associated connection whose connection_state_remove event should trigger a callback to hk.

  • hk – The hook function to use as a callback.

Returns

false if the provided hook was previously registered, else true.

Conn::unregister_removal_hook
Type

function (c: connection, hk: Conn::RemovalHook) : bool

Unregister a hook that would have been called during a connection’s connection_state_remove event such that it will no longer be called.

Parameters
  • c – The associated connection whose connection_state_remove event could have triggered a callback to hk.

  • hk – The hook function that would have been used as a callback.

Returns

true if the provided hook was previously registered, else false.