Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Event: Deprecate default network timestamp metadata

Browse source 
This deprecates the Event constructor and the ``ts`` parameter of Enqueue()
Instead, versions are introduced that take a detail::MetadataVectorPtr which
can hold the network timestamp metadata and is meant to be allocated by the
caller instead of automatically during Enqueue() or within the Event
constructor.

This also introduces a BifConst ``EventMetadata::add_network_timestamp`` to
opt-in adding network timestamps to events globally. It's disabled by
default as there are not a lot of known use cases that need this.
This commit is contained in:
Arne Welzel 2025-05-21 16:20:31 +02:00
parent 12c523f3f7
commit 53b0f0ad64
13 changed files with 167 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/broker/remote_event_auto_ts.zeek
View file

@ -17,6 +17,7 @@
# @TEST-START-FILE send.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global runs = 0;
global ping: event(msg: string, intended_ts: time);
@ -58,6 +59,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
# @TEST-START-FILE recv.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global msg_count = 0;

2
testing/btest/broker/remote_event_schedule_ts.zeek
View file

@ -17,6 +17,7 @@
# @TEST-START-FILE send.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global runs = 0;
global ping: event(msg: string, intended_ts: time, publish_ts: time);
@ -64,6 +65,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
# @TEST-START-FILE recv.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global msg_count = 0;

2
testing/btest/broker/remote_event_ts.zeek
View file

@ -15,6 +15,7 @@
# @TEST-START-FILE send.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global runs = 0;
global ping: event(msg: string, intended_ts: time);
@ -54,6 +55,7 @@ event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)
# @TEST-START-FILE recv.zeek
redef exit_only_after_terminate = T;
redef EventMetadata::add_network_timestamp = T;
global msg_count = 0;

1
testing/btest/broker/remote_event_ts_compat.zeek
View file

@ -17,6 +17,7 @@
redef exit_only_after_terminate = T;
redef allow_network_time_forward = F;
redef EventMetadata::add_network_timestamp = T;
event zeek_init()
{

1
testing/btest/broker/web-socket-events-metadata.zeek
View file

@ -16,6 +16,7 @@
redef allow_network_time_forward = F;
redef exit_only_after_terminate = T;
redef Broker::disable_ssl = T;
redef EventMetadata::add_network_timestamp = T;
global event_count = 0;

2
testing/btest/language/event-ts-scheduled.zeek
View file

@ -1,6 +1,8 @@
# @TEST-EXEC: zeek -b -r $TRACES/ticks-dns-1hr.pcap %INPUT > out
# @TEST-EXEC: btest-diff out
redef EventMetadata::add_network_timestamp = T;
global runs = 0;
event test(schedule_time: time)

2
testing/btest/language/event-ts.zeek
View file

@ -4,6 +4,8 @@
# Note: We use a PCAP with DNS queries only so that we have a single packet per
# time step. Thus the run loop will be executed only once per time step.
redef EventMetadata::add_network_timestamp = T;
global runs = -1;
event test(depth: count)