Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

cluster/Backend: Fallback to current network time when current event has not timestamp

Browse source 
When a WebSocket client sends an event to Zeek without explicit network
timestamp metadata, Zeek would use -1.0 as a timestamp for any events
published while handling this event. Instead, it seems far more sensible
to use the current network time in that scenario.
This commit is contained in:
Arne Welzel 2025-08-20 19:31:20 +02:00
parent 01fe022e07
commit 9a7678f15a
2 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/cluster/Backend.cc
View file

@ -132,10 +132,19 @@ std::optional<Event> Backend::MakeClusterEvent(FuncValPtr handler, ArgsSpan args
* *
* @J-Gras prefers the current behavior. @awelzel wonders if there should * @J-Gras prefers the current behavior. @awelzel wonders if there should
* be an opt-in/opt-out for this behavior. Procrastinating it for now. * be an opt-in/opt-out for this behavior. Procrastinating it for now.
*
* In any case, if the current event has no timestamp information
* (detail::NO_TIMESTAMP is -1.0), use the current network time for
* the outgoing event instead as network timestamp metadata.
*/ */
zeek::detail::EventMetadataVectorPtr meta; zeek::detail::EventMetadataVectorPtr meta;
if ( zeek::BifConst::EventMetadata::add_network_timestamp ) if ( zeek::BifConst::EventMetadata::add_network_timestamp ) {
meta = zeek::detail::MakeEventMetadataVector(zeek::event_mgr.CurrentEventTime()); auto ts = zeek::event_mgr.CurrentEventTime();
if ( ts == zeek::detail::NO_TIMESTAMP )
ts = run_state::network_time;
meta = zeek::detail::MakeEventMetadataVector(ts);
}
return Event{eh, std::move(*checked_args), std::move(meta)}; return Event{eh, std::move(*checked_args), std::move(meta)};
} }

2
testing/btest/Baseline/cluster.websocket.metadata/..client-metadata.out
View file

@ -2,4 +2,4 @@
Connected! Connected!
ack {'type': 'ack', 'endpoint': 'endpoint', 'version': 'endpoint'} ack {'type': 'ack', 'endpoint': 'endpoint', 'version': 'endpoint'}
ping {'type': 'data-message', 'topic': '/test/pings/', '@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'count', 'data': 1}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'ping'}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'fourty-two'}, {'@data-type': 'count', 'data': 42}]}]}]} ping {'type': 'data-message', 'topic': '/test/pings/', '@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'count', 'data': 1}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'ping'}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'fourty-two'}, {'@data-type': 'count', 'data': 42}]}]}]}
pong {'type': 'data-message', 'topic': '/test/pongs/', '@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'count', 'data': 1}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'pong'}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'fourty-two fourty-two'}, {'@data-type': 'count', 'data': 84}]}, {'@data-type': 'vector', 'data': [{'@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'timestamp', 'data': '1969-12-31T23:59:59.000'}]}]}]}]} pong {'type': 'data-message', 'topic': '/test/pongs/', '@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'count', 'data': 1}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'pong'}, {'@data-type': 'vector', 'data': [{'@data-type': 'string', 'data': 'fourty-two fourty-two'}, {'@data-type': 'count', 'data': 84}]}, {'@data-type': 'vector', 'data': [{'@data-type': 'vector', 'data': [{'@data-type': 'count', 'data': 1}, {'@data-type': 'timestamp', 'data': '1970-01-01T01:18:31.000'}]}]}]}]}