From bcef1fc871579b3d17a948d826671fcbee48675c Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 21 Aug 2020 10:18:52 -0700 Subject: [PATCH] Fix a case where PktSrc gets processed twice in one runloop iteration For a non-live PktSrc, it had a special-case to be considered "ready" every iteration, but additionally every 1 in 100 iterations (the polling frequency), if there were no other "ready" IOSources, it would get added to the "ready" set a 2nd time. This commit completely excludes PktSrc from being processed during the 1/100 runloop iteration where a Poll() happens. That exclusion is desirable for a second reason: if reading a pcap happens to do its final Process() during that 1/100 polling-iteration and there's other IOSources ready to process like EventMgr/TimerMgr, those sources have logic to advance network-time to current-time if a PktSrc is no longer open. So in such a case, PktSrc::Process() closes, then EventMgr::Process() sees there's no longer an active PktSrc and advances to current-time, then EventMgr::Drain() happens and may dispatch various events that were previous scheduled, with those events now unexpectedly seeing a network_time() returning current-time. --- src/iosource/Manager.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/iosource/Manager.cc b/src/iosource/Manager.cc index 50e831f868..4c006ca77b 100644 --- a/src/iosource/Manager.cc +++ b/src/iosource/Manager.cc @@ -166,7 +166,7 @@ void Manager::FindReadySources(std::vector* ready) } else { - if ( ! zeek::run_state::pseudo_realtime ) + if ( ! zeek::run_state::pseudo_realtime && ! time_to_poll ) // A pcap file is always ready to process unless it's suspended ready->push_back(pkt_src); }