Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Ensure time continues moving forward if a pcap source is suspended

Browse source
This commit is contained in:
Tim Wojtulewicz 2020-05-01 11:28:26 -07:00
parent 5377dd446d
commit 2c8d0f60da
5 changed files with 61 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/Timer.cc
View file

@ -93,7 +93,7 @@ void TimerMgr::Process()
// pseudo-realtime), advance the timer here to the current time since otherwise it won't // pseudo-realtime), advance the timer here to the current time since otherwise it won't
// move forward and the timers won't fire correctly. // move forward and the timers won't fire correctly.
iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc(); iosource::PktSrc* pkt_src = iosource_mgr->GetPktSrc();
if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live ) if ( ! pkt_src || ! pkt_src->IsOpen() || reading_live || net_is_processing_suspended() )
net_update_time(current_time()); net_update_time(current_time());
// Just advance the timer manager based on the current network time. This won't actually // Just advance the timer manager based on the current network time. This won't actually

2
src/iosource/Manager.cc
View file

@ -167,7 +167,7 @@ void Manager::FindReadySources(std::vector<IOSource*>* ready)
else else
{ {
if ( ! pseudo_realtime ) if ( ! pseudo_realtime )
// A pcap file is always ready to process. // A pcap file is always ready to process unless it's suspended
ready->push_back(pkt_src); ready->push_back(pkt_src);
} }
} }

3
testing/btest/Baseline/core.pcap.suspend-processing/.stderr Normal file
View file

@ -0,0 +1,3 @@
1300475167.096535 processing suspended
1588361692.527039 processing continued
1588361692.527039 received termination signal

22
testing/btest/Baseline/core.pcap.suspend-processing/output Normal file
View file

@ -0,0 +1,22 @@
network_time: 1300475167.096535
Processing packet 1 at 1300475167.096535
network_time: 1588361692.527039
Processing packet 2 at 1588361692.527039
Processing packet 3 at 1588361692.527039
Processing packet 4 at 1588361692.527039
Processing packet 5 at 1588361692.527039
Processing packet 6 at 1588361692.527039
Processing packet 7 at 1588361692.527039
Processing packet 8 at 1588361692.527039
Processing packet 9 at 1588361692.527039
Processing packet 10 at 1588361692.527039
Processing packet 11 at 1588361692.527039
Processing packet 12 at 1588361692.527039
Processing packet 13 at 1588361692.527039
Processing packet 14 at 1588361692.527039
Processing packet 15 at 1588361692.527039
Processing packet 16 at 1588361692.527039
Processing packet 17 at 1588361692.527039
Processing packet 18 at 1588361692.527039
Processing packet 19 at 1588361692.527039
Processing packet 20 at 1588361692.527039

34
testing/btest/core/pcap/suspend-processing.zeek Normal file
View file

@ -0,0 +1,34 @@
# @TEST-EXEC: zeek -C -r $TRACES/wikipedia.trace %INPUT >output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff .stderr
redef exit_only_after_terminate = T;
event go_on()
{
continue_processing();
print fmt("network_time: %f", network_time());
}
event pcap_init()
{
print fmt("network_time: %f", network_time());
suspend_processing();
# Some asynchronous work
schedule 5sec { go_on() };
}
event zeek_init()
{
schedule 0sec { pcap_init() };
}
global pkt_cnt: count = 0;
event new_packet(c: connection, p: pkt_hdr)
{
pkt_cnt += 1;
print fmt("Processing packet %s at %f", pkt_cnt, network_time());
if ( pkt_cnt >= 20 )
terminate();
}