From ebefb21c53bc5596faf3dee10de8ca9da853c0fa Mon Sep 17 00:00:00 2001
From: Tim Wojtulewicz <tim@corelight.com>
Date: Sun, 9 Mar 2025 21:04:21 -0700
Subject: [PATCH] Pass network time down to Expire()

---
 src/storage/Backend.h                | 7 +++++--
 src/storage/Manager.cc               | 3 ++-
 src/storage/backend/redis/Redis.cc   | 6 +++---
 src/storage/backend/redis/Redis.h    | 2 +-
 src/storage/backend/sqlite/SQLite.cc | 5 ++---
 src/storage/backend/sqlite/SQLite.h  | 2 +-
 6 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/storage/Backend.h b/src/storage/Backend.h
index a038d04b95..80810cd97f 100644
--- a/src/storage/Backend.h
+++ b/src/storage/Backend.h
@@ -160,8 +160,11 @@ protected:
     /**
      * Removes any entries in the backend that have expired. Can be overridden by
      * derived classes.
+     *
+     * @param current_network_time The network time as of the start of the
+     * expiration operation.
      */
-    void Expire() { DoExpire(); }
+    void Expire(double current_network_time) { DoExpire(current_network_time); }
 
     /**
      * Enqueues the Storage::backend_opened event. This is called automatically
@@ -192,7 +195,7 @@ private:
     virtual OperationResult DoGet(ValPtr key, OperationResultCallback* cb = nullptr) = 0;
     virtual OperationResult DoErase(ValPtr key, OperationResultCallback* cb = nullptr) = 0;
     virtual void DoPoll() {}
-    virtual void DoExpire() {}
+    virtual void DoExpire(double current_network_time) {}
 
     uint8_t modes;
 };
diff --git a/src/storage/Manager.cc b/src/storage/Manager.cc
index 0e1bf86ca4..a9cf0bf7ff 100644
--- a/src/storage/Manager.cc
+++ b/src/storage/Manager.cc
@@ -113,9 +113,10 @@ void Manager::Expire() {
 
     DBG_LOG(DBG_STORAGE, "Expiration running, have %zu backends to check", backends.size());
 
+    double current_network_time = run_state::network_time;
     for ( auto it = backends.begin(); it != backends.end() && ! run_state::terminating; ++it ) {
         if ( (*it)->IsOpen() )
-            (*it)->Expire();
+            (*it)->Expire(current_network_time);
     }
 
     expire_running.clear();
diff --git a/src/storage/backend/redis/Redis.cc b/src/storage/backend/redis/Redis.cc
index 5ec512b3f7..4990502e63 100644
--- a/src/storage/backend/redis/Redis.cc
+++ b/src/storage/backend/redis/Redis.cc
@@ -351,7 +351,7 @@ OperationResult Redis::DoErase(ValPtr key, OperationResultCallback* cb) {
     return {ReturnCode::IN_PROGRESS};
 }
 
-void Redis::DoExpire() {
+void Redis::DoExpire(double current_network_time) {
     // Expiration is handled natively by Redis if not reading traces.
     if ( ! connected || ! zeek::run_state::reading_traces )
         return;
@@ -361,7 +361,7 @@ void Redis::DoExpire() {
     during_expire = true;
 
     int status = redisAsyncCommand(async_ctx, redisGeneric, NULL, "ZRANGEBYSCORE %s_expire -inf %f", key_prefix.data(),
-                                   run_state::network_time);
+                                   current_network_time);
 
     if ( status == REDIS_ERR ) {
         // TODO: do something with the error?
@@ -407,7 +407,7 @@ void Redis::DoExpire() {
 
     // Remove all of the elements from the range-set that match the time range.
     redisAsyncCommand(async_ctx, redisGeneric, NULL, "ZREMRANGEBYSCORE %s_expire -inf %f", key_prefix.data(),
-                      run_state::network_time);
+                      current_network_time);
 
     ++active_ops;
     Poll();
diff --git a/src/storage/backend/redis/Redis.h b/src/storage/backend/redis/Redis.h
index ae7238308d..1be442b82d 100644
--- a/src/storage/backend/redis/Redis.h
+++ b/src/storage/backend/redis/Redis.h
@@ -54,7 +54,7 @@ private:
                           OperationResultCallback* cb = nullptr) override;
     OperationResult DoGet(ValPtr key, OperationResultCallback* cb = nullptr) override;
     OperationResult DoErase(ValPtr key, OperationResultCallback* cb = nullptr) override;
-    void DoExpire() override;
+    void DoExpire(double current_network_time) override;
     void DoPoll() override;
 
     OperationResult ParseGetReply(redisReply* reply) const;
diff --git a/src/storage/backend/sqlite/SQLite.cc b/src/storage/backend/sqlite/SQLite.cc
index 18f96870ab..53678f68ab 100644
--- a/src/storage/backend/sqlite/SQLite.cc
+++ b/src/storage/backend/sqlite/SQLite.cc
@@ -234,11 +234,10 @@ OperationResult SQLite::DoErase(ValPtr key, OperationResultCallback* cb) {
  * Removes any entries in the backend that have expired. Can be overridden by
  * derived classes.
  */
-void SQLite::DoExpire() {
+void SQLite::DoExpire(double current_network_time) {
     auto stmt = expire_stmt.get();
 
-    if ( auto res = CheckError(sqlite3_bind_double(stmt, 1, run_state::network_time));
-         res.code != ReturnCode::SUCCESS ) {
+    if ( auto res = CheckError(sqlite3_bind_double(stmt, 1, current_network_time)); res.code != ReturnCode::SUCCESS ) {
         sqlite3_reset(stmt);
         // TODO: do something with the error here?
     }
diff --git a/src/storage/backend/sqlite/SQLite.h b/src/storage/backend/sqlite/SQLite.h
index bbef996215..3fc7bcfcf7 100644
--- a/src/storage/backend/sqlite/SQLite.h
+++ b/src/storage/backend/sqlite/SQLite.h
@@ -29,7 +29,7 @@ private:
                           OperationResultCallback* cb = nullptr) override;
     OperationResult DoGet(ValPtr key, OperationResultCallback* cb = nullptr) override;
     OperationResult DoErase(ValPtr key, OperationResultCallback* cb = nullptr) override;
-    void DoExpire() override;
+    void DoExpire(double current_network_time) override;
 
     /**
      * Checks whether a status code returned by an sqlite call is a success.