diff --git a/NEWS b/NEWS index 8c606ea38b..7feedfb65c 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,11 @@ Zeek 7.2.0 Breaking Changes ---------------- +- The ``is_remote_event()``, ``current_analyzer()`` and ``current_event_time()`` + builtin functions do not return the previous event's values anymore when event + draining has completed. The same applies to the corresponding C++ accessors on + the ``EventMgr`` class. The functions now return false, 0 or the zero time instead. + New Functionality ----------------- diff --git a/src/Event.cc b/src/Event.cc index 678b81b47f..4525118de6 100644 --- a/src/Event.cc +++ b/src/Event.cc @@ -64,14 +64,6 @@ void Event::Dispatch(bool no_remote) { reporter->EndErrorHandler(); } -EventMgr::EventMgr() { - head = tail = nullptr; - current_src = util::detail::SOURCE_LOCAL; - current_aid = 0; - current_ts = 0; - draining = false; -} - EventMgr::~EventMgr() { while ( head ) { Event* n = head->NextEvent(); @@ -103,10 +95,10 @@ void EventMgr::QueueEvent(Event* event) { } void EventMgr::Dispatch(Event* event, bool no_remote) { - current_src = event->Source(); - current_aid = event->Analyzer(); - current_ts = event->Time(); + Event* old_current = current; + current = event; event->Dispatch(no_remote); + current = old_current; Unref(event); } @@ -116,8 +108,6 @@ void EventMgr::Drain() { PLUGIN_HOOK_VOID(HOOK_DRAIN_EVENTS, HookDrainEvents()); - draining = true; - // Past Zeek versions drained as long as there events, including when // a handler queued new events during its execution. This could lead // to endless loops in case a handler kept triggering its own event. @@ -126,27 +116,25 @@ void EventMgr::Drain() { // that expect the old behavior to trigger something quickly. for ( int round = 0; head && round < 2; round++ ) { - Event* current = head; + Event* event = head; head = nullptr; tail = nullptr; - while ( current ) { - Event* next = current->NextEvent(); + while ( event ) { + Event* next = event->NextEvent(); - current_src = current->Source(); - current_aid = current->Analyzer(); - current_ts = current->Time(); - current->Dispatch(); - Unref(current); + current = event; + event->Dispatch(); + Unref(event); ++event_mgr.num_events_dispatched; - current = next; + event = next; } } // Note: we might eventually need a general way to specify things to // do after draining events. - draining = false; + current = nullptr; // Make sure all of the triggers get processed every time the events // drain. diff --git a/src/Event.h b/src/Event.h index 44c47048e6..76c761945f 100644 --- a/src/Event.h +++ b/src/Event.h @@ -52,7 +52,6 @@ protected: class EventMgr final : public Obj, public iosource::IOSource { public: - EventMgr(); ~EventMgr() override; /** @@ -84,21 +83,23 @@ public: void Dispatch(Event* event, bool no_remote = false); void Drain(); - bool IsDraining() const { return draining; } + bool IsDraining() const { return current != nullptr; } bool HasEvents() const { return head != nullptr; } - // Returns the source ID of last raised event. - util::detail::SourceID CurrentSource() const { return current_src; } + // Returns the source ID of the current event. + util::detail::SourceID CurrentSource() const { return current ? current->Source() : util::detail::SOURCE_LOCAL; } - // Returns the ID of the analyzer which raised the last event, or 0 if + // Returns the ID of the analyzer which raised the current event, or 0 if // non-analyzer event. - analyzer::ID CurrentAnalyzer() const { return current_aid; } + analyzer::ID CurrentAnalyzer() const { return current ? current->Analyzer() : 0; } - // Returns the timestamp of the last raised event. The timestamp reflects the network time + // Returns the timestamp of the current event. The timestamp reflects the network time // the event was intended to be executed. For scheduled events, this is the time the event // was scheduled to. For any other event, this is the time when the event was created. - double CurrentEventTime() const { return current_ts; } + // + // If no event is being processed, returns 0.0. + double CurrentEventTime() const { return current ? current->Time() : 0.0; } int Size() const { return num_events_queued - num_events_dispatched; } @@ -118,12 +119,9 @@ public: protected: void QueueEvent(Event* event); - Event* head; - Event* tail; - util::detail::SourceID current_src; - analyzer::ID current_aid; - double current_ts; - bool draining; + Event* current = nullptr; + Event* head = nullptr; + Event* tail = nullptr; }; extern EventMgr event_mgr; diff --git a/src/zeek.bif b/src/zeek.bif index e97c988d39..7c5fac0f09 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -4973,9 +4973,9 @@ function uninstall_dst_net_filter%(snet: subnet%) : bool return zeek::val_mgr->Bool(packet_mgr->GetPacketFilter()->RemoveDst(snet)); %} -## Checks whether the last raised event came from a remote peer. +## Checks whether the current event came from a remote peer. ## -## Returns: True if the last raised event came from a remote peer. +## Returns: True if the current event came from a remote peer. function is_remote_event%(%) : bool %{ return zeek::val_mgr->Bool(zeek::event_mgr.CurrentSource() != zeek::util::detail::SOURCE_LOCAL);