From 82ee17be8dd3c706c4bca4e1d30fa449c34279fb Mon Sep 17 00:00:00 2001 From: Annie Bryan Date: Wed, 3 Aug 2022 16:30:57 +0200 Subject: [PATCH 1/2] Fix notice suppression atomicity bug --- scripts/base/frameworks/notice/main.zeek | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/base/frameworks/notice/main.zeek b/scripts/base/frameworks/notice/main.zeek index b5d3ec4a32..d34a22923a 100644 --- a/scripts/base/frameworks/notice/main.zeek +++ b/scripts/base/frameworks/notice/main.zeek @@ -538,6 +538,7 @@ hook Notice::notice(n: Notice::Info) &priority=-5 n$suppress_for != 0secs ) { event Notice::begin_suppression(n$ts, n$suppress_for, n$note, n$identifier); + suppressing[n$note, n$identifier] = n$ts + n$suppress_for; @if ( Cluster::is_enabled() && Cluster::local_node_type() != Cluster::MANAGER ) event Notice::manager_begin_suppression(n$ts, n$suppress_for, n$note, n$identifier); @endif From d91646951046a08e8a902df92c7b7dc30f25eef1 Mon Sep 17 00:00:00 2001 From: Annie Bryan Date: Thu, 4 Aug 2022 11:25:20 +0200 Subject: [PATCH 2/2] Added test case with back-to-back notices --- .../btest/scripts/base/frameworks/notice/suppression.zeek | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/testing/btest/scripts/base/frameworks/notice/suppression.zeek b/testing/btest/scripts/base/frameworks/notice/suppression.zeek index f284bb4600..5356cb0bd3 100644 --- a/testing/btest/scripts/base/frameworks/notice/suppression.zeek +++ b/testing/btest/scripts/base/frameworks/notice/suppression.zeek @@ -10,7 +10,7 @@ redef enum Notice::Type += { # The second notice needs to be scheduled due to how the notice framework # uses the event queue. -event second_notice() +event third_notice() { NOTICE([$note=Test_Notice, $msg="another test", $identifier="static"]); } @@ -18,6 +18,7 @@ event second_notice() event zeek_init() { NOTICE([$note=Test_Notice, $msg="test", $identifier="static"]); - schedule 1msec { second_notice() }; + NOTICE([$note=Test_Notice, $msg="test again", $identifier="static"]); + schedule 1msec { third_notice() }; }