/
cache.go
71 lines (61 loc) · 1.57 KB
/
cache.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
package pcaps
import (
lru "github.com/hashicorp/golang-lru/v2"
"github.com/aquasecurity/tracee/pkg/errfmt"
"github.com/aquasecurity/tracee/pkg/logger"
"github.com/aquasecurity/tracee/types/trace"
)
// PcapCache is an intermediate LRU cache in between Pcap and Pcaps
type PcapCache struct {
itemCache *lru.Cache[string, *Pcap]
itemType PcapType
}
func newPcapCache(itemType PcapType) (*PcapCache, error) {
cache, err := lru.NewWithEvict(
pcapsToCache,
func(_ string, item *Pcap,
) {
if err := item.pcapWriter.Flush(); err != nil {
logger.Errorw("Flushing pcap", "error", err)
}
if err := item.pcapFile.Close(); err != nil {
logger.Errorw("Closing file", "error", err)
}
})
return &PcapCache{
itemCache: cache,
itemType: itemType,
}, errfmt.WrapError(err)
}
func (p *PcapCache) get(event *trace.Event) (*Pcap, error) {
var ok bool
var item *Pcap
var i interface{}
i, ok = p.itemCache.Get(getItemIndexFromEvent(event, p.itemType))
if !ok {
// create an item and return it
n, err := NewPcap(event, p.itemType)
if err != nil {
return nil, errfmt.WrapError(err)
}
p.itemCache.Add(getItemIndexFromEvent(event, p.itemType), n)
item = n
} else {
// return the cached item
item, ok = i.(*Pcap)
if !ok {
return nil, errfmt.Errorf("unexpected item type in pcap cache")
}
}
return item, nil
}
func (p *PcapCache) destroy() error {
for _, key := range p.itemCache.Keys() {
item, _ := p.itemCache.Get(key)
if err := item.close(); err != nil {
logger.Errorw("Closing file", "error", err)
}
}
p.itemCache.Purge()
return nil
}