Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1321: Prevent compounding of connection_status_update event timers

Browse source 
Particularly for ICMP connections, a new timer got added every time a
`connection` record was updated even if there was still a pending timer
for that connection.
This commit is contained in:
Jon Siwek 2020-12-08 11:20:02 -08:00
parent 07c4662dc4
commit a35cd2a726
4 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/Conn.cc
View file

@ -322,6 +322,9 @@ void Connection::SetInactivityTimeout(double timeout)
void Connection::EnableStatusUpdateTimer()
{
if ( installed_status_timer )
return;
if ( connection_status_update && zeek::detail::connection_status_update_interval )
{
ADD_TIMER(&Connection::StatusUpdateTimer,

6
testing/btest/Baseline/core.connection_status_update/out Normal file
View file

@ -0,0 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
new_connection, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp]
connection_status_update, 1, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp]
connection_status_update, 2, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp]
connection_status_update, 3, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp]
connection_status_update, 4, [orig_h=172.16.133.2, orig_p=8/icmp, resp_h=172.217.11.78, resp_p=0/icmp]

BIN
testing/btest/Traces/icmp/5-pings.pcap Normal file
View file

Binary file not shown.

11
testing/btest/core/connection_status_update.zeek Normal file
View file

@ -0,0 +1,11 @@
# @TEST-EXEC: zeek -b -C -r $TRACES/icmp/5-pings.pcap %INPUT >out
# @TEST-EXEC: btest-diff out
global update_count = 0;
global connection_status_update_interval = 1sec;
event new_connection(c: connection)
{ print "new_connection", c$id; }
event connection_status_update(c: connection)
{ print "connection_status_update", ++update_count, c$id; }