EventMgr: Do not cache current event attributes

Avoid proliferation of various members on EventMgr by storing the
pointer of the current event instead.

This subtly changes the behavior of some builtin functions as they would
have returned the prior event's data when executed outside of event
draining (e.g. C++ level hook invocations), but I think that's actually
for the better.

NEWS

@@ -9,6 +9,11 @@ Zeek 7.2.0
 Breaking Changes
 ----------------
 
+- The ``is_remote_event()``, ``current_analyzer()`` and ``current_event_time()``
+  builtin functions do not return the previous event's values anymore when event
+  draining has completed. The same applies to the corresponding C++ accessors on
+  the ``EventMgr`` class. The functions now return false, 0 or the zero time instead.
+
 New Functionality
 -----------------
 

src/Event.cc

@@ -64,14 +64,6 @@ void Event::Dispatch(bool no_remote) {
         reporter->EndErrorHandler();
 }
 
-EventMgr::EventMgr() {
-    head = tail = nullptr;
-    current_src = util::detail::SOURCE_LOCAL;
-    current_aid = 0;
-    current_ts = 0;
-    draining = false;
-}
-
 EventMgr::~EventMgr() {
     while ( head ) {
         Event* n = head->NextEvent();
@@ -103,10 +95,10 @@ void EventMgr::QueueEvent(Event* event) {
 }
 
 void EventMgr::Dispatch(Event* event, bool no_remote) {
-    current_src = event->Source();
+    Event* old_current = current;
-    current_aid = event->Analyzer();
+    current = event;
-    current_ts = event->Time();
     event->Dispatch(no_remote);
+    current = old_current;
     Unref(event);
 }
 
@@ -116,8 +108,6 @@ void EventMgr::Drain() {
 
     PLUGIN_HOOK_VOID(HOOK_DRAIN_EVENTS, HookDrainEvents());
 
-    draining = true;
-
     // Past Zeek versions drained as long as there events, including when
     // a handler queued new events during its execution. This could lead
     // to endless loops in case a handler kept triggering its own event.
@@ -126,27 +116,25 @@ void EventMgr::Drain() {
     // that expect the old behavior to trigger something quickly.
 
     for ( int round = 0; head && round < 2; round++ ) {
-        Event* current = head;
+        Event* event = head;
         head = nullptr;
         tail = nullptr;
 
-        while ( current ) {
+        while ( event ) {
-            Event* next = current->NextEvent();
+            Event* next = event->NextEvent();
 
-            current_src = current->Source();
+            current = event;
-            current_aid = current->Analyzer();
+            event->Dispatch();
-            current_ts = current->Time();
+            Unref(event);
-            current->Dispatch();
-            Unref(current);
 
             ++event_mgr.num_events_dispatched;
-            current = next;
+            event = next;
         }
     }
 
     // Note: we might eventually need a general way to specify things to
     // do after draining events.
-    draining = false;
+    current = nullptr;
 
     // Make sure all of the triggers get processed every time the events
     // drain.

src/Event.h

@@ -52,7 +52,6 @@ protected:
 
 class EventMgr final : public Obj, public iosource::IOSource {
 public:
-    EventMgr();
     ~EventMgr() override;
 
     /**
@@ -84,21 +83,23 @@ public:
     void Dispatch(Event* event, bool no_remote = false);
 
     void Drain();
-    bool IsDraining() const { return draining; }
+    bool IsDraining() const { return current != nullptr; }
 
     bool HasEvents() const { return head != nullptr; }
 
-    // Returns the source ID of last raised event.
+    // Returns the source ID of the current event.
-    util::detail::SourceID CurrentSource() const { return current_src; }
+    util::detail::SourceID CurrentSource() const { return current ? current->Source() : util::detail::SOURCE_LOCAL; }
 
-    // Returns the ID of the analyzer which raised the last event, or 0 if
+    // Returns the ID of the analyzer which raised the current event, or 0 if
     // non-analyzer event.
-    analyzer::ID CurrentAnalyzer() const { return current_aid; }
+    analyzer::ID CurrentAnalyzer() const { return current ? current->Analyzer() : 0; }
 
-    // Returns the timestamp of the last raised event. The timestamp reflects the network time
+    // Returns the timestamp of the current event. The timestamp reflects the network time
     // the event was intended to be executed. For scheduled events, this is the time the event
     // was scheduled to. For any other event, this is the time when the event was created.
-    double CurrentEventTime() const { return current_ts; }
+    //
+    // If no event is being processed, returns 0.0.
+    double CurrentEventTime() const { return current ? current->Time() : 0.0; }
 
     int Size() const { return num_events_queued - num_events_dispatched; }
 
@@ -118,12 +119,9 @@ public:
 protected:
     void QueueEvent(Event* event);
 
-    Event* head;
+    Event* current = nullptr;
-    Event* tail;
+    Event* head = nullptr;
-    util::detail::SourceID current_src;
+    Event* tail = nullptr;
-    analyzer::ID current_aid;
-    double current_ts;
-    bool draining;
 };
 
 extern EventMgr event_mgr;

src/zeek.bif

@@ -4973,9 +4973,9 @@ function uninstall_dst_net_filter%(snet: subnet%) : bool
 	return zeek::val_mgr->Bool(packet_mgr->GetPacketFilter()->RemoveDst(snet));
 	%}
 
-## Checks whether the last raised event came from a remote peer.
+## Checks whether the current event came from a remote peer.
 ##
-## Returns: True if the last raised event came from a remote peer.
+## Returns: True if the current event came from a remote peer.
 function is_remote_event%(%) : bool
 	%{
 	return zeek::val_mgr->Bool(zeek::event_mgr.CurrentSource() != zeek::util::detail::SOURCE_LOCAL);