Merge remote-tracking branch 'origin/topic/timw/continue-processing-math'

* origin/topic/timw/continue-processing-math:
  Fix a long-standing bug in the math around continue_processing
  Add is_processing_suspended BIF

CHANGES

@@ -1,3 +1,9 @@
+6.0.0-dev.327 | 2023-04-08 11:22:57 -0700
+
+  * Fix a long-standing bug in the math around continue_processing (Tim Wojtulewicz, Corelight)
+
+  * Add is_processing_suspended BIF (Tim Wojtulewicz, Corelight)
+
 6.0.0-dev.323 | 2023-04-06 13:46:28 -0700
 
   * Add NEWS entries for filtered packet statistics and telemetry (Tim Wojtulewicz, Corelight)

VERSION

@@ -1 +1 @@
-6.0.0-dev.323
+6.0.0-dev.327

src/RunState.cc

@@ -541,12 +541,13 @@ void continue_processing()
 		detail::current_wallclock = util::current_time(true);
 		}
 
-	--_processing_suspended;
+	if ( _processing_suspended > 0 )
+		--_processing_suspended;
 	}
 
 bool is_processing_suspended()
 	{
-	return _processing_suspended;
+	return _processing_suspended > 0;
 	}
 
 	} // namespace zeek::run_state

src/zeek.bif

@@ -5387,6 +5387,7 @@ function is_remote_event%(%) : bool
 ## (*pseudo-realtime* mode).
 ##
 ## .. zeek:see:: continue_processing
+##               is_processing_suspended
 function suspend_processing%(%) : any
 	%{
 	zeek::run_state::suspend_processing();
@@ -5396,12 +5397,22 @@ function suspend_processing%(%) : any
 ## Resumes Zeek's packet processing.
 ##
 ## .. zeek:see:: suspend_processing
+##               is_processing_suspended
 function continue_processing%(%) : any
 	%{
 	zeek::run_state::continue_processing();
 	return nullptr;
 	%}
 
+## Returns whether or not processing is currently suspended.
+##
+## .. zeek:see:: suspend_processing
+##               continue_processing
+function is_processing_suspended%(%): bool
+	%{
+	return zeek::val_mgr->Bool(zeek::run_state::is_processing_suspended());
+	%}
+
 # ===========================================================================
 #
 #                             Internal Functions
@@ -5738,4 +5749,3 @@ function have_spicy_analyzers%(%) : bool
 	%{
 	return zeek::val_mgr->Bool(USE_SPICY_ANALYZERS);
 	%}
-

testing/btest/Baseline/core.suspend_processing.suspension-stack/output

@@ -0,0 +1,6 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+F
+F
+T
+F
+F

testing/btest/core/suspend_processing/suspension-stack.zeek

@@ -0,0 +1,31 @@
+# @TEST-DOC: Test that chains of suspend_processing/continue_processing report the correct suspension status
+# @TEST-EXEC: zeek %INPUT >output
+# @TEST-EXEC: btest-diff output
+
+event zeek_init()
+{
+# Paired suspend/continue should unsuspend.
+suspend_processing();
+continue_processing();
+print is_processing_suspended(); # F
+
+# Another continue after unsuspending shouldn't cause it to be suspended.
+continue_processing();
+print is_processing_suspended(); # F
+
+# Test suspend "stack" by suspending twice
+suspend_processing();
+suspend_processing();
+
+# First continue should still be suspended
+continue_processing();
+print is_processing_suspended(); # T
+
+# Second continue should break the suspension
+continue_processing();
+print is_processing_suspended(); # F
+
+# Third continue should still be marked as not suspended.
+continue_processing();
+print is_processing_suspended(); # F
+}