Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix a case where PktSrc gets processed twice in one runloop iteration

Browse source 
For a non-live PktSrc, it had a special-case to be considered "ready"
every iteration, but additionally every 1 in 100 iterations (the polling
frequency), if there were no other "ready" IOSources, it would get added
to the "ready" set a 2nd time.

This commit completely excludes PktSrc from being processed during the
1/100 runloop iteration where a Poll() happens.  That exclusion is
desirable for a second reason: if reading a pcap happens to do its final
Process() during that 1/100 polling-iteration and there's other
IOSources ready to process like EventMgr/TimerMgr, those sources have
logic to advance network-time to current-time if a PktSrc is no longer
open.  So in such a case, PktSrc::Process() closes, then
EventMgr::Process() sees there's no longer an active PktSrc and advances
to current-time, then EventMgr::Drain() happens and may dispatch
various events that were previous scheduled, with those events now
unexpectedly seeing a network_time() returning current-time.
This commit is contained in:
Jon Siwek 2020-08-21 10:18:52 -07:00
parent c322bc249d
commit bcef1fc871
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/iosource/Manager.cc
View file

@ -166,7 +166,7 @@ void Manager::FindReadySources(std::vector<IOSource*>* ready)
} }
else else
{ {
if ( ! zeek::run_state::pseudo_realtime ) if ( ! zeek::run_state::pseudo_realtime && ! time_to_poll )
// A pcap file is always ready to process unless it's suspended // A pcap file is always ready to process unless it's suspended
ready->push_back(pkt_src); ready->push_back(pkt_src);
} }