From 6289eb8e1544abc5781f086541662153ceeb0a53 Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Fri, 20 Dec 2024 15:20:12 -0700
Subject: [PATCH] SQLite: Fix some issues with expiration, including in the
 btest

---
 src/storage/backend/sqlite/SQLite.cc          |  5 ++++-
 .../.stderr                                   |  4 ++--
 .../base/frameworks/storage/expiration.zeek   | 19 +++++++++++++------
 3 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/src/storage/backend/sqlite/SQLite.cc b/src/storage/backend/sqlite/SQLite.cc
index db43201a1d..ece7eb1aff 100644
--- a/src/storage/backend/sqlite/SQLite.cc
+++ b/src/storage/backend/sqlite/SQLite.cc
@@ -155,6 +155,9 @@ ErrorResult SQLite::DoPut(ValPtr key, ValPtr value, bool overwrite, double expir
         return res;
     }
 
+    if ( expiration_time != 0 )
+        expiration_time += run_state::network_time;
+
     if ( auto res = checkError(sqlite3_bind_double(stmt, 3, expiration_time)); res.has_value() ) {
         sqlite3_reset(stmt);
         return res;
@@ -244,7 +247,7 @@ ErrorResult SQLite::DoErase(ValPtr key, ErrorResultCallback* cb) {
 void SQLite::Expire() {
     auto stmt = prepared_stmts["expire"];
 
-    if ( auto res = checkError(sqlite3_bind_double(stmt, 1, util::current_time())); res.has_value() ) {
+    if ( auto res = checkError(sqlite3_bind_double(stmt, 1, run_state::network_time)); res.has_value() ) {
         sqlite3_reset(stmt);
         // TODO: do something with the error here?
     }
diff --git a/testing/btest/Baseline/scripts.base.frameworks.storage.expiration/.stderr b/testing/btest/Baseline/scripts.base.frameworks.storage.expiration/.stderr
index 0494e4d891..65a0a4d3ed 100644
--- a/testing/btest/Baseline/scripts.base.frameworks.storage.expiration/.stderr
+++ b/testing/btest/Baseline/scripts.base.frameworks.storage.expiration/.stderr
@@ -1,3 +1,3 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-error in /Users/tim/Desktop/projects/storage-framework/testing/btest/.tmp/scripts.base.frameworks.storage.expiration/expiration.zeek, line 20: Failed to retrieve data: Failed to find row for key: no more rows available (Storage::get(backend, to_any_coerce key, F))
-received termination signal
+1627225025.686472 error in <...>/expiration.zeek, line 20: Failed to retrieve data: Failed to find row for key: no more rows available (Storage::get(backend, to_any_coerce key, F))
+1627225025.686472 received termination signal
diff --git a/testing/btest/scripts/base/frameworks/storage/expiration.zeek b/testing/btest/scripts/base/frameworks/storage/expiration.zeek
index 30caade463..46fb2be5a8 100644
--- a/testing/btest/scripts/base/frameworks/storage/expiration.zeek
+++ b/testing/btest/scripts/base/frameworks/storage/expiration.zeek
@@ -1,12 +1,12 @@
 # @TEST-DOC: Automatic expiration of stored data
-# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b %INPUT > out
-# @TEST-EXEC: btest-diff out
-# @TEST-EXEC: btest-diff .stderr
+# @TEST-EXEC: zcat <$TRACES/echo-connections.pcap.gz | zeek -b -Cr - %INPUT > out
+# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff out
+# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff .stderr
 
 @load base/frameworks/storage
 @load policy/frameworks/storage/backend/sqlite
 
-redef Storage::expire_interval = 5 secs;
+redef Storage::expire_interval = 2 secs;
 redef exit_only_after_terminate = T;
 
 # Create a typename here that can be passed down into get().
@@ -24,14 +24,14 @@ event check_removed() {
 	terminate();
 }
 
-event zeek_init() {
+event setup_test() {
 	local opts : Storage::Backend::SQLite::Options;
 	opts$database_path = "storage-test.sqlite";
 	opts$table_name = "testing";
 
 	backend = Storage::open_backend(Storage::SQLITE, opts, str, str);
 
-	local res = Storage::put(backend, [$key=key, $value=value, $overwrite=T, $expire_time=2 secs, $async_mode=F]);
+	local res = Storage::put(backend, [$key=key, $value=value, $expire_time=2 secs, $async_mode=F]);
 	print "put result", res;
 
 	local res2 = Storage::get(backend, key, F);
@@ -40,3 +40,10 @@ event zeek_init() {
 
 	schedule 5 secs { check_removed() };
 }
+
+event zeek_init() {
+	# We need network time to be set to something other than zero for the
+	# expiration time to be set correctly. Schedule an event on a short
+	# timer so packets start getting read and do the setup there.
+	schedule 100 msecs { setup_test() };
+}