diff --git a/src/Timer.cc b/src/Timer.cc index b6d6100e7f..77d74fcdbb 100644 --- a/src/Timer.cc +++ b/src/Timer.cc @@ -93,7 +93,7 @@ void TimerMgr::Process() // pseudo-realtime), advance the timer here to the current time since otherwise it won't // move forward and the timers won't fire correctly. iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc(); - if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live ) + if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live || net_is_processing_suspended() ) net_update_time(current_time()); // Just advance the timer manager based on the current network time. This won't actually diff --git a/src/iosource/Manager.cc b/src/iosource/Manager.cc index 57f3caecdf..6ffc924ab8 100644 --- a/src/iosource/Manager.cc +++ b/src/iosource/Manager.cc @@ -167,7 +167,7 @@ void Manager::FindReadySources(std::vector* ready) else { if ( ! pseudo_realtime ) - // A pcap file is always ready to process. + // A pcap file is always ready to process unless it's suspended ready->push_back(pkt_src); } } diff --git a/testing/btest/Baseline/core.pcap.suspend-processing/.stderr b/testing/btest/Baseline/core.pcap.suspend-processing/.stderr new file mode 100644 index 0000000000..7998283271 --- /dev/null +++ b/testing/btest/Baseline/core.pcap.suspend-processing/.stderr @@ -0,0 +1,3 @@ +1300475167.096535 processing suspended +1588361692.527039 processing continued +1588361692.527039 received termination signal diff --git a/testing/btest/Baseline/core.pcap.suspend-processing/output b/testing/btest/Baseline/core.pcap.suspend-processing/output new file mode 100644 index 0000000000..a83400f0e7 --- /dev/null +++ b/testing/btest/Baseline/core.pcap.suspend-processing/output @@ -0,0 +1,22 @@ +network_time: 1300475167.096535 +Processing packet 1 at 1300475167.096535 +network_time: 1588361692.527039 +Processing packet 2 at 1588361692.527039 +Processing packet 3 at 1588361692.527039 +Processing packet 4 at 1588361692.527039 +Processing packet 5 at 1588361692.527039 +Processing packet 6 at 1588361692.527039 +Processing packet 7 at 1588361692.527039 +Processing packet 8 at 1588361692.527039 +Processing packet 9 at 1588361692.527039 +Processing packet 10 at 1588361692.527039 +Processing packet 11 at 1588361692.527039 +Processing packet 12 at 1588361692.527039 +Processing packet 13 at 1588361692.527039 +Processing packet 14 at 1588361692.527039 +Processing packet 15 at 1588361692.527039 +Processing packet 16 at 1588361692.527039 +Processing packet 17 at 1588361692.527039 +Processing packet 18 at 1588361692.527039 +Processing packet 19 at 1588361692.527039 +Processing packet 20 at 1588361692.527039 diff --git a/testing/btest/core/pcap/suspend-processing.zeek b/testing/btest/core/pcap/suspend-processing.zeek new file mode 100644 index 0000000000..fb56bbb75e --- /dev/null +++ b/testing/btest/core/pcap/suspend-processing.zeek @@ -0,0 +1,34 @@ +# @TEST-EXEC: zeek -C -r $TRACES/wikipedia.trace %INPUT >output +# @TEST-EXEC: btest-diff output +# @TEST-EXEC: btest-diff .stderr + +redef exit_only_after_terminate = T; + +event go_on() + { + continue_processing(); + print fmt("network_time: %f", network_time()); + } + +event pcap_init() + { + print fmt("network_time: %f", network_time()); + suspend_processing(); + # Some asynchronous work + schedule 5sec { go_on() }; + } + +event zeek_init() + { + schedule 0sec { pcap_init() }; + } + +global pkt_cnt: count = 0; + +event new_packet(c: connection, p: pkt_hdr) + { + pkt_cnt += 1; + print fmt("Processing packet %s at %f", pkt_cnt, network_time()); + if ( pkt_cnt >= 20 ) + terminate(); + }