-
-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Add column optimization support to allow processing IN constraints all at once in xFilter
#8263
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add column optimization support to allow processing IN constraints all at once in xFilter
#8263
Conversation
directionless
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
|
Do we think there are any table implementations that rely on this behavior? Any thoughts on a strategy to determine that? |
Feels unlikely. When I've brought this up previously, people thought (a) didn't work this way or (b) was inherent to the implementation and unfixable. |
|
Yeah definitely it wasn't possible to do before, they added The question here is if the The problem I see here is that if the tables do not account for this (multiple constraints values for the same constraint), then the result is wrong, because they will filter only with the first value, while with the old method, the table logic would've been called multiple times, each with one of the values in the If Here is a case, in the Also I think due to this, none of the table logic inside the loop has been tested with a loop count > 1. So I suspect we will encounter bugs. |
|
We talked about this briefly at Office Hours today. @Smjert suggest that incorrect loops should be relatively to audit for -- we can examine tables that have |
Just to clarify, there are 2 potential issues:
For 1., the code will use |
|
Sorry that I've been silent on this thread, I've been testing/fixing the various table generations this would affect. This was a big oversight I made on my part for the initial push. For now I'm restricting this to only apply to indexed columns and not columns where |
bf05a19 to
c2edd50
Compare
66f7878 to
c5baea5
Compare
|
I believe I've pushed all of the changes needed for safely utilizing this sqlite optimization. I'm still doing testing and will update the pr once I complete that. |
27b723c to
de1aa46
Compare
|
I had realized what I was trying to do with the I found there was an old artifact in the ColumnOptions enum for an |
|
I've removed all of the places where I modified the table generate's use of query context. I'll put those changes into another PR if this one goes through. I figured it'd be more trackable this way and less to review for this PR. |
394b989 to
5180c98
Compare
28dfe2d to
8c8cc36
Compare
8c8cc36 to
cd11317
Compare
|
I removed the optimized changes from all of the tables except for |
directionless
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure I can follow all of the virtual table code, but I'm willing to approve. We should be prepared to iterate if there's an issue.
| description("Inspect TLS certificates by connecting to input hostnames.") | ||
| schema([ | ||
| Column("hostname", TEXT, "Hostname to CURL (domain[:port], e.g. osquery.io)", required=True), | ||
| Column("hostname", TEXT, "Hostname to CURL (domain[:port], e.g. osquery.io)", required=True, optimized=True), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The generate function looks like it should handle this optimization. Yes.
IN constraints all at once in xFilter
Currently when processing the IN constraint in
xFilter, sqlite core likes to callxFilteronce per value. This PR tells sqlite core to hand off all values on an IN constraint toxFilterto reduce the amount of calls toxFilter.Example: