Event: Deprecate default network timestamp metadata

This deprecates the Event constructor and the ``ts`` parameter of Enqueue()
Instead, versions are introduced that take a detail::MetadataVectorPtr which
can hold the network timestamp metadata and is meant to be allocated by the
caller instead of automatically during Enqueue() or within the Event
constructor.

This also introduces a BifConst ``EventMetadata::add_network_timestamp`` to
opt-in adding network timestamps to events globally. It's disabled by
default as there are not a lot of known use cases that need this.
This commit is contained in:
Arne Welzel 2025-05-21 16:20:31 +02:00
parent 12c523f3f7
commit 53b0f0ad64
13 changed files with 167 additions and 10 deletions

View file

@ -1,6 +1,8 @@
# @TEST-EXEC: zeek -b -r $TRACES/ticks-dns-1hr.pcap %INPUT > out
# @TEST-EXEC: btest-diff out
redef EventMetadata::add_network_timestamp = T;
global runs = 0;
event test(schedule_time: time)

View file

@ -4,6 +4,8 @@
# Note: We use a PCAP with DNS queries only so that we have a single packet per
# time step. Thus the run loop will be executed only once per time step.
redef EventMetadata::add_network_timestamp = T;
global runs = -1;
event test(depth: count)