aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

time: Rework SCTime_t into a struct

Browse Source 
Issue: 5718

This commit changes SCTime_t to a struct with members setup as
bitfields.
pull/8430/head
Jeff Lucovsky 4 years ago committed by Victor Julien
parent 31793aface
commit 9fbe683642
12 changed files with 65 additions and 40 deletions
Show Stats Download Patch File Download Diff File

4
src/defrag.c
Unescape Escape View File

@ -628,7 +628,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
}
/* Update timeout. */
tracker->timeout = SCTIME_SECS(p->ts) + tracker->host_timeout;
tracker->timeout = SCTIME_FROM_SECS(SCTIME_SECS(p->ts) + tracker->host_timeout);
Frag *prev = NULL, *next = NULL;
bool overlap = false;
@ -2108,7 +2108,7 @@ static int DefragTimeoutTest(void)
Packet *p = BuildTestPacket(IPPROTO_ICMP, 99, 0, 1, 'A' + i, 16);
FAIL_IF_NULL(p);
p->ts += SCTIME_FROM_SECS(defrag_context->timeout + 1);
p->ts = SCTIME_ADD_SECS(p->ts, defrag_context->timeout + 1);
Packet *tp = Defrag(NULL, NULL, p);
FAIL_IF_NOT_NULL(tp);

2
src/detect-engine-tag.c
Unescape Escape View File

@ -556,7 +556,7 @@ int TagTimeoutCheck(Host *host, SCTime_t ts)
prev = NULL;
while (tmp != NULL) {
SCTime_t timeout_at = SCTIME_FROM_SECS(tmp->last_ts + TAG_MAX_LAST_TIME_SEEN);
if (timeout_at >= ts) {
if (SCTIME_CMP_GTE(timeout_at, ts)) {
prev = tmp;
tmp = tmp->next;
retval = 0;

24
src/detect-engine-threshold.c
Unescape Escape View File

@ -166,8 +166,8 @@ static DetectThresholdEntry *ThresholdTimeoutCheck(DetectThresholdEntry *head, S
/* check if the 'check' timestamp is not before the creation ts.
* This can happen due to the async nature of the host timeout
* code that also calls this code from a management thread. */
SCTime_t entry = tmp->tv1 + SCTIME_FROM_SECS((time_t)tmp->seconds);
if (ts <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(tmp->tv1, (time_t)tmp->seconds);
if (SCTIME_CMP_LTE(ts, entry)) {
prev = tmp;
tmp = tmp->next;
continue;
@ -343,8 +343,8 @@ static int IsThresholdReached(
}
else {
/* Update the matching state with the timeout interval */
SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds);
if (packet_time <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds);
if (SCTIME_CMP_LTE(packet_time, entry)) {
lookup_tsh->current_count++;
if (lookup_tsh->current_count > td->count) {
/* Then we must enable the new action by setting a
@ -403,8 +403,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh,
SCLogDebug("limit");
if (lookup_tsh != NULL) {
SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds);
if (p->ts <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds);
if (SCTIME_CMP_LTE(p->ts, entry)) {
lookup_tsh->current_count++;
if (lookup_tsh->current_count <= td->count) {
@ -430,8 +430,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh,
SCLogDebug("threshold");
if (lookup_tsh != NULL) {
SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds);
if (p->ts <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds);
if (SCTIME_CMP_LTE(p->ts, entry)) {
lookup_tsh->current_count++;
if (lookup_tsh->current_count >= td->count) {
@ -456,8 +456,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh,
SCLogDebug("both");
if (lookup_tsh != NULL) {
SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds);
if (p->ts <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds);
if (SCTIME_CMP_LTE(p->ts, entry)) {
/* within time limit */
lookup_tsh->current_count++;
@ -494,8 +494,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh,
SCLogDebug("detection_filter");
if (lookup_tsh != NULL) {
SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds);
if (p->ts <= entry) {
SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds);
if (SCTIME_CMP_LTE(p->ts, entry)) {
/* within timeout */
lookup_tsh->current_count++;
if (lookup_tsh->current_count > td->count) {

1
src/detect-threshold.c
Unescape Escape View File

@ -1672,6 +1672,7 @@ static int DetectThresholdTestSig14(void)
FAIL_IF(alerts1 != 2);
FAIL_IF(alerts2 != 2);
TimeSetIncrementTime(70);
p1->ts = TimeGet();
p2->ts = TimeGet();

4
src/flow-util.h
Unescape Escape View File

@ -56,7 +56,7 @@
(f)->flags = 0; \
(f)->file_flags = 0; \
(f)->protodetect_dp = 0; \
(f)->lastts = 0; \
SCTIME_INIT((f)->lastts); \
FLOWLOCK_INIT((f)); \
(f)->protoctx = NULL; \
(f)->flow_end_flags = 0; \
@ -102,7 +102,7 @@
(f)->flags = 0; \
(f)->file_flags = 0; \
(f)->protodetect_dp = 0; \
(f)->lastts = 0; \
SCTIME_INIT((f)->lastts); \
(f)->protoctx = NULL; \
(f)->flow_end_flags = 0; \
(f)->alparser = NULL; \

2
src/flow.h
Unescape Escape View File

@ -703,7 +703,7 @@ static inline void FlowDeReference(Flow **d)
static inline int64_t FlowGetId(const Flow *f)
{
int64_t id = (uint64_t)(SCTIME_SECS(f->startts) & 0x0000FFFF) << 48 |
(uint64_t)(f->startts & 0x0000FFFF) << 32 | (int64_t)f->flow_hash;
(uint64_t)(SCTIME_USECS(f->startts) & 0x0000FFFF) << 32 | (int64_t)f->flow_hash;
/* reduce to 51 bits as Javascript and even JSON often seem to
* max out there. */
id &= 0x7ffffffffffffLL;

2
src/packet.c
Unescape Escape View File

@ -102,7 +102,7 @@ void PacketReinit(Packet *p)
p->vlan_id[0] = 0;
p->vlan_id[1] = 0;
p->vlan_idx = 0;
p->ts = 0;
SCTIME_INIT(p->ts);
p->datalink = 0;
p->drop_reason = 0;
#define PACKET_RESET_ACTION(p) (p)->action = 0

6
src/source-af-packet.c
Unescape Escape View File

@ -796,8 +796,7 @@ static void AFPReadFromRingSetupPacket(
p->afp_v.peer = (p->afp_v.copy_mode == AFP_COPY_MODE_NONE) ? NULL : ptv->mpeer->peer;
/* Timestamp */
p->ts = SCTIME_FROM_SECS(h.h2->tp_sec);
p->ts += SCTIME_FROM_USECS(h.h2->tp_nsec / 1000);
p->ts = (SCTime_t){ .secs = h.h2->tp_sec, .usecs = h.h2->tp_nsec / 1000 };
SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p));
/* We only check for checksum disable */
@ -958,8 +957,7 @@ static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc
p->afp_v.peer = (p->afp_v.copy_mode == AFP_COPY_MODE_NONE) ? NULL : ptv->mpeer->peer;
/* Timestamp */
p->ts = SCTIME_FROM_SECS(ppd->tp_sec);
p->ts += SCTIME_FROM_USECS(ppd->tp_nsec / 1000);
p->ts = (SCTime_t){ .secs = ppd->tp_sec, .usecs = ppd->tp_nsec / 1000 };
SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)",
GET_PKT_LEN(p), p, GET_PKT_DATA(p));

4
src/source-erf-file.c
Unescape Escape View File

@ -203,10 +203,10 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data)
uint64_t usecs = (ts >> 32);
if (usecs >= 1000000) {
usecs -= 1000000;
p->ts += SCTIME_FROM_SECS(1);
p->ts = SCTIME_ADD_SECS(p->ts, 1);
usecs++;
}
p->ts += SCTIME_FROM_USECS(usecs);
p->ts = SCTIME_ADD_USECS(p->ts, usecs);
etv->pkts++;
etv->bytes += wlen;

2
src/source-pcap.c
Unescape Escape View File

@ -246,7 +246,7 @@ static void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt)
PKT_SET_SRC(p, PKT_SRC_WIRE);
p->ts = SCTIME_FROM_TIMEVAL(&h->ts);
SCLogDebug("p->ts.tv_sec %" PRIuMAX "", SCTIME_SECS((uintmax_t)p->ts));
SCLogDebug("p->ts.tv_sec %" PRIuMAX "", (uintmax_t)SCTIME_SECS(p->ts));
p->datalink = ptv->datalink;
ptv->pkts++;

2
src/util-time.c
Unescape Escape View File

@ -181,7 +181,7 @@ void TimeSetIncrementTime(uint32_t tv_sec)
{
SCTime_t ts = TimeGet();
ts += SCTIME_FROM_SECS(tv_sec);
ts = SCTIME_ADD_SECS(ts, tv_sec);
TimeSet(ts);
}

52
src/util-time.h
Unescape Escape View File

@ -24,8 +24,6 @@
#ifndef __UTIL_TIME_H__
#define __UTIL_TIME_H__
typedef uint64_t SCTime_t;
/*
* The SCTime_t member is broken up as
* seconds: 44
@ -38,25 +36,53 @@ typedef uint64_t SCTime_t;
* 2^20
* 1048576
*/
#define USECS_BITS 20
#define USEC_BITMASK 0xfffff
#define SCTIME_USECS(t) (SCTime_t)((t)&USEC_BITMASK)
#define SCTIME_SECS(t) (SCTime_t)((time_t)((t) >> USECS_BITS))
#define SCTIME_MSECS(t) (SCTime_t)(SCTIME_SECS(t) * 1000 + SCTIME_USECS(t) / 1000)
#define SCTIME_FROM_SECS(secs) (SCTime_t)((((SCTime_t)(secs)) << USECS_BITS))
#define SCTIME_FROM_USECS(usecs) (SCTime_t) SCTIME_USECS((usecs))
typedef struct {
uint64_t secs : 44;
uint64_t usecs : 20;
} SCTime_t;
#define SCTIME_INIT(t) \
{ \
(t).secs = 0; \
(t).usecs = 0; \
}
#define SCTIME_USECS(t) ((uint64_t)(t).usecs)
#define SCTIME_SECS(t) ((uint64_t)(t).secs)
#define SCTIME_MSECS(t) (SCTIME_SECS(t) * 1000 + SCTIME_USECS(t) / 1000)
#define SCTIME_ADD_SECS(ts, s) SCTIME_FROM_SECS((ts).secs + (s))
#define SCTIME_ADD_USECS(ts, us) SCTIME_FROM_USECS((ts).usecs + (us))
#define SCTIME_FROM_SECS(s) \
(SCTime_t) \
{ \
.secs = (s), .usecs = 0 \
}
#define SCTIME_FROM_USECS(us) \
(SCTime_t) \
{ \
.secs = 0, .usecs = (us) \
}
#define SCTIME_FROM_TIMEVAL(tv) \
(SCTime_t)((SCTIME_FROM_SECS((tv)->tv_sec) + SCTIME_FROM_USECS((tv)->tv_usec)))
(SCTime_t) \
{ \
.secs = (tv)->tv_sec, .usecs = (tv)->tv_usec \
}
#define SCTIME_FROM_TIMESPEC(ts) \
(SCTime_t)((SCTIME_FROM_SECS((ts)->tv_sec) + SCTIME_FROM_USECS((ts)->tv_nsec * 1000)))
(SCTime_t) \
{ \
.secs = (ts)->tv_sec, .usecs = (ts)->tv_nsec * 1000 \
}
#define SCTIME_TO_TIMEVAL(tv, t) \
(tv)->tv_sec = SCTIME_SECS((t)); \
(tv)->tv_usec = SCTIME_USECS((t));
#define SCTIME_CMP(a, b, CMP) \
((SCTIME_SECS(a) == SCTIME_SECS(b)) ? (SCTIME_USECS(a) CMP SCTIME_USECS(b)) \
: (SCTIME_SECS(a) CMP SCTIME_SECS(b)))
#define SCTIME_CMP_GT(a, b) SCTIME_CMP((a), (b), >)
#define SCTIME_CMP_LT(a, b) SCTIME_CMP((a), (b), <)
#define SCTIME_CMP_GTE(a, b) SCTIME_CMP((a), (b), >=)
#define SCTIME_CMP_GT(a, b) SCTIME_CMP((a), (b), >)
#define SCTIME_CMP_LT(a, b) SCTIME_CMP((a), (b), <)
#define SCTIME_CMP_LTE(a, b) SCTIME_CMP((a), (b), <=)
void TimeInit(void);
void TimeDeinit(void);

Write Preview
Loading…
Cancel
Save