mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
53b0f0ad64
This deprecates the Event constructor and the ``ts`` parameter of Enqueue() Instead, versions are introduced that take a detail::MetadataVectorPtr which can hold the network timestamp metadata and is meant to be allocated by the caller instead of automatically during Enqueue() or within the Event constructor. This also introduces a BifConst ``EventMetadata::add_network_timestamp`` to opt-in adding network timestamps to events globally. It's disabled by default as there are not a lot of known use cases that need this.
30 lines
1 KiB
Text
30 lines
1 KiB
Text
# @TEST-EXEC: zeek -b -r $TRACES/ticks-dns.pcap %INPUT > out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
# Note: We use a PCAP with DNS queries only so that we have a single packet per
|
|
# time step. Thus the run loop will be executed only once per time step.
|
|
|
|
redef EventMetadata::add_network_timestamp = T;
|
|
|
|
global runs = -1;
|
|
|
|
event test(depth: count)
|
|
{
|
|
if ( depth == 0 )
|
|
return;
|
|
|
|
print fmt("[%D] Test %s was scheduled at %D", network_time(), depth, current_event_time());
|
|
event test(--depth);
|
|
}
|
|
|
|
event new_connection(c: connection)
|
|
{
|
|
print fmt(">> Run %s (%D):", ++runs, network_time());
|
|
# Descend into recursion to enqueue events until we add an event that will
|
|
# be handled in the next run loop iteration, i.e. at a different timestamp
|
|
# than it was enqueued. Use four levels of recursion as every drain of the
|
|
# event queue handles two layers and the event queue is drained two times.
|
|
# First after processing a packet and second in the run loop. Finally, we
|
|
# expect an event so that network_time() > current_event_time().
|
|
event test(4);
|
|
}
|