diff --git a/CHANGES b/CHANGES index 50fb7c976f..535fca2f97 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,18 @@ +3.3.0-dev.634 | 2020-12-09 10:51:49 -0800 + + * GH-1321: Prevent compounding of `connection_status_update` event timers (Jon Siwek, Corelight) + + Particularly for ICMP connections, a new timer got added every time a + `connection` record was updated even if there was still a pending timer + for that connection. + + * Update Debug.cc to use setsignal() wrapper (Jon Siwek, Corelight) + + So as to prefer sigaction() over either sigset() or signal(), which are + less favorable due to underspecification issues and some treating them + as obsolete/deprecated. + 3.3.0-dev.630 | 2020-12-07 16:52:52 -0800 * Fix narrowing conversion compiler error in SMB error-response logic (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index bf24e512cb..ec762935e0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.3.0-dev.630 +3.3.0-dev.634 diff --git a/src/Conn.cc b/src/Conn.cc index 8baf383cfb..1a27863f94 100644 --- a/src/Conn.cc +++ b/src/Conn.cc @@ -322,6 +322,9 @@ void Connection::SetInactivityTimeout(double timeout) void Connection::EnableStatusUpdateTimer() { + if ( installed_status_timer ) + return; + if ( connection_status_update && zeek::detail::connection_status_update_interval ) { ADD_TIMER(&Connection::StatusUpdateTimer, diff --git a/testing/btest/Baseline/core.connection_status_update/out b/testing/btest/Baseline/core.connection_status_update/out new file mode 100644 index 0000000000..8488912f19 --- /dev/null +++ b/testing/btest/Baseline/core.connection_status_update/out @@ -0,0 +1,6 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +new_connection, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp] +connection_status_update, 1, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp] +connection_status_update, 2, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp] +connection_status_update, 3, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp] +connection_status_update, 4, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp] diff --git a/testing/btest/Traces/icmp/5-pings.pcap b/testing/btest/Traces/icmp/5-pings.pcap new file mode 100644 index 0000000000..61e32c996e Binary files /dev/null and b/testing/btest/Traces/icmp/5-pings.pcap differ diff --git a/testing/btest/core/connection_status_update.zeek b/testing/btest/core/connection_status_update.zeek new file mode 100644 index 0000000000..6716113fab --- /dev/null +++ b/testing/btest/core/connection_status_update.zeek @@ -0,0 +1,11 @@ +# @TEST-EXEC: zeek -b -C -r $TRACES/icmp/5-pings.pcap %INPUT >out +# @TEST-EXEC: btest-diff out + +global update_count = 0; +global connection_status_update_interval = 1sec; + +event new_connection(c: connection) + { print "new_connection", c$id; } + +event connection_status_update(c: connection) + { print "connection_status_update", ++update_count, c$id; }