suricata
source-pcap-file-directory-helper.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Danny Browning <danny.browning@protectwise.com>
22  *
23  * Helper methods for directory based packet acquisition
24  */
25 
27 #include "suricata.h"
28 #include "runmode-unix-socket.h"
29 #include "util-mem.h"
30 #include "util-time.h"
31 #include "source-pcap-file.h"
32 
33 static void GetTime(struct timespec *tm);
34 static void CopyTime(struct timespec *from, struct timespec *to);
35 static int CompareTimes(struct timespec *left, struct timespec *right);
36 static TmEcode PcapRunStatus(PcapFileDirectoryVars *);
37 static TmEcode PcapDirectoryFailure(PcapFileDirectoryVars *ptv);
38 static TmEcode PcapDirectoryDone(PcapFileDirectoryVars *ptv);
39 static int PcapDirectoryGetModifiedTime(char const * file, struct timespec * out);
40 static TmEcode PcapDirectoryInsertFile(PcapFileDirectoryVars *pv,
41  PendingFile *file_to_add);
42 static TmEcode PcapDirectoryPopulateBuffer(PcapFileDirectoryVars *ptv,
43  struct timespec * older_than);
44 static TmEcode PcapDirectoryDispatchForTimeRange(PcapFileDirectoryVars *pv,
45  struct timespec *older_than);
46 
47 void GetTime(struct timespec *tm)
48 {
49  struct timeval now;
50  if(gettimeofday(&now, NULL) == 0) {
51  tm->tv_sec = now.tv_sec;
52  tm->tv_nsec = now.tv_usec * 1000L;
53  }
54 }
55 
56 void CopyTime(struct timespec *from, struct timespec *to)
57 {
58  to->tv_sec = from->tv_sec;
59  to->tv_nsec = from->tv_nsec;
60 }
61 
62 int CompareTimes(struct timespec *left, struct timespec *right)
63 {
64  if (left->tv_sec < right->tv_sec) {
65  return -1;
66  } else if (left->tv_sec > right->tv_sec) {
67  return 1;
68  } else {
69  if (left->tv_nsec < right->tv_nsec) {
70  return -1;
71  } else if (left->tv_nsec > right->tv_nsec) {
72  return 1;
73  } else {
74  return 0;
75  }
76  }
77 }
78 
79 /**
80  * Pcap Folder Utilities
81  */
82 TmEcode PcapRunStatus(PcapFileDirectoryVars *ptv)
83 {
86  if ( (suricata_ctl_flags & SURICATA_STOP) || done != TM_ECODE_OK) {
88  }
89  } else {
92  }
93  }
95 }
96 
98  if (pending != NULL) {
99  if (pending->filename != NULL) {
100  SCFree(pending->filename);
101  }
102  SCFree(pending);
103  }
104 }
105 
107 {
108  if (ptv != NULL) {
109  if (ptv->current_file != NULL) {
111  ptv->current_file = NULL;
112  }
113  if (ptv->directory != NULL) {
114  closedir(ptv->directory);
115  ptv->directory = NULL;
116  }
117  if (ptv->filename != NULL) {
118  SCFree(ptv->filename);
119  }
120  ptv->shared = NULL;
121  PendingFile *current_file = NULL;
122  while (!TAILQ_EMPTY(&ptv->directory_content)) {
123  current_file = TAILQ_FIRST(&ptv->directory_content);
124  TAILQ_REMOVE(&ptv->directory_content, current_file, next);
125  CleanupPendingFile(current_file);
126  }
127  SCFree(ptv);
128  }
129 }
130 
131 TmEcode PcapDirectoryFailure(PcapFileDirectoryVars *ptv)
132 {
133  TmEcode status = TM_ECODE_FAILED;
134 
135  if (unlikely(ptv == NULL)) {
136  SCLogError(SC_ERR_INVALID_ARGUMENT, "Directory vars was null");
138  }
139  if (unlikely(ptv->shared == NULL)) {
140  SCLogError(SC_ERR_INVALID_ARGUMENT, "Directory shared vars was null");
142  }
143 
145  status = UnixSocketPcapFile(status, &ptv->shared->last_processed);
146  }
147 
148  SCReturnInt(status);
149 }
150 
151 TmEcode PcapDirectoryDone(PcapFileDirectoryVars *ptv)
152 {
153  TmEcode status = TM_ECODE_DONE;
154 
155  if (unlikely(ptv == NULL)) {
156  SCLogError(SC_ERR_INVALID_ARGUMENT, "Directory vars was null");
158  }
159  if (unlikely(ptv->shared == NULL)) {
160  SCLogError(SC_ERR_INVALID_ARGUMENT, "Directory shared vars was null");
162  }
163 
165  status = UnixSocketPcapFile(status, &ptv->shared->last_processed);
166  }
167 
168  SCReturnInt(status);
169 }
170 
171 TmEcode PcapDetermineDirectoryOrFile(char *filename, DIR **directory)
172 {
173  DIR *temp_dir = NULL;
174  TmEcode return_code = TM_ECODE_FAILED;
175 
176  temp_dir = opendir(filename);
177 
178  if (temp_dir == NULL) {//if null, our filename may just be a normal file
179  switch (errno) {
180  case EACCES:
181  SCLogError(SC_ERR_FOPEN, "%s: Permission denied", filename);
182  break;
183 
184  case EBADF:
186  "%s: Not a valid file descriptor opened for reading",
187  filename);
188  break;
189 
190  case EMFILE:
192  "%s: Per process open file descriptor limit reached",
193  filename);
194  break;
195 
196  case ENFILE:
198  "%s: System wide open file descriptor limit reached",
199  filename);
200  break;
201 
202  case ENOENT:
204  "%s: Does not exist, or name is an empty string",
205  filename);
206  break;
207  case ENOMEM:
209  "%s: Insufficient memory to complete the operation",
210  filename);
211  break;
212 
213  case ENOTDIR: //no error checking the directory, just is a plain file
214  SCLogDebug("%s: plain file, not a directory", filename);
215  return_code = TM_ECODE_OK;
216  break;
217 
218  default:
219  SCLogError(SC_ERR_FOPEN, "%s: %" PRId32, filename, errno);
220  }
221  } else {
222  //no error, filename references a directory
223  *directory = temp_dir;
224  return_code = TM_ECODE_OK;
225  }
226 
227  return return_code;
228 }
229 
230 int PcapDirectoryGetModifiedTime(char const *file, struct timespec *out)
231 {
232 #ifdef OS_WIN32
233  struct _stat buf;
234 #else
235  struct stat buf;
236 #endif /* OS_WIN32 */
237  int ret;
238 
239  if (file == NULL)
240  return -1;
241 
242 #ifdef OS_WIN32
243  if((ret = _stat(file, &buf)) != 0)
244  return ret;
245 #else
246  if ((ret = stat(file, &buf)) != 0)
247  return ret;
248 #endif
249 
250 #ifdef OS_DARWIN
251  out->tv_sec = buf.st_mtimespec.tv_sec;
252  out->tv_nsec = buf.st_mtimespec.tv_nsec;
253 #elif OS_WIN32
254  out->tv_sec = buf.st_mtime;
255 #else
256  out->tv_sec = buf.st_mtim.tv_sec;
257  out->tv_nsec = buf.st_mtim.tv_nsec;
258 #endif
259 
260  return ret;
261 }
262 
263 TmEcode PcapDirectoryInsertFile(PcapFileDirectoryVars *pv,
264  PendingFile *file_to_add
265 ) {
266  PendingFile *file_to_compare = NULL;
267  PendingFile *next_file_to_compare = NULL;
268 
269  if (unlikely(pv == NULL)) {
270  SCLogError(SC_ERR_INVALID_ARGUMENT, "No directory vars passed");
272  }
273 
274  if (unlikely(file_to_add == NULL)) {
275  SCLogError(SC_ERR_INVALID_ARGUMENT, "File passed was null");
277  }
278 
279  if (unlikely(file_to_add->filename == NULL)) {
280  SCLogError(SC_ERR_INVALID_ARGUMENT, "File was passed with null filename");
282  }
283 
284  SCLogDebug("Inserting %s into directory buffer", file_to_add->filename);
285 
286  if (TAILQ_EMPTY(&pv->directory_content)) {
287  TAILQ_INSERT_TAIL(&pv->directory_content, file_to_add, next);
288  } else {
289  file_to_compare = TAILQ_FIRST(&pv->directory_content);
290  while(file_to_compare != NULL) {
291  if (CompareTimes(&file_to_add->modified_time, &file_to_compare->modified_time) < 0) {
292  TAILQ_INSERT_BEFORE(file_to_compare, file_to_add, next);
293  file_to_compare = NULL;
294  } else {
295  next_file_to_compare = TAILQ_NEXT(file_to_compare, next);
296  if (next_file_to_compare == NULL) {
297  TAILQ_INSERT_AFTER(&pv->directory_content, file_to_compare,
298  file_to_add, next);
299  }
300  file_to_compare = next_file_to_compare;
301  }
302  }
303  }
304 
306 }
307 
308 TmEcode PcapDirectoryPopulateBuffer(PcapFileDirectoryVars *pv,
309  struct timespec *older_than
310 ) {
311  if (unlikely(pv == NULL)) {
312  SCLogError(SC_ERR_INVALID_ARGUMENT, "No directory vars passed");
314  }
315  if (unlikely(pv->filename == NULL)) {
316  SCLogError(SC_ERR_INVALID_ARGUMENT, "No directory filename was passed");
318  }
319  struct dirent * dir = NULL;
320  PendingFile *file_to_add = NULL;
321 
322  while ((dir = readdir(pv->directory)) != NULL) {
323 #ifndef OS_WIN32
324  if (dir->d_type != DT_REG) {
325  continue;
326  }
327 #endif
328  if (strcmp(dir->d_name, ".") == 0 ||
329  strcmp(dir->d_name, "..") == 0) {
330  continue;
331  }
332 
333  char pathbuff[PATH_MAX] = {0};
334 
335  int written = 0;
336 
337  written = snprintf(pathbuff, PATH_MAX, "%s/%s", pv->filename, dir->d_name);
338 
339  if (written <= 0 || written >= PATH_MAX) {
340  SCLogError(SC_ERR_SPRINTF, "Could not write path");
341 
343  } else {
344  struct timespec temp_time;
345  memset(&temp_time, 0, sizeof(struct timespec));
346 
347  if (PcapDirectoryGetModifiedTime(pathbuff, &temp_time) == 0) {
348  SCLogDebug("%" PRIuMAX " < %" PRIuMAX "(%s) < %" PRIuMAX ")",
350  (uintmax_t)SCTimespecAsEpochMillis(&temp_time),
351  pathbuff,
352  (uintmax_t)SCTimespecAsEpochMillis(older_than));
353 
354  // Skip files outside of our time range
355  if (CompareTimes(&temp_time, &pv->shared->last_processed) <= 0) {
356  SCLogDebug("Skipping old file %s", pathbuff);
357  continue;
358  }
359  else if (CompareTimes(&temp_time, older_than) >= 0) {
360  SCLogDebug("Skipping new file %s", pathbuff);
361  continue;
362  }
363  } else {
364  SCLogDebug("Unable to get modified time on %s, skipping", pathbuff);
365  continue;
366  }
367 
368  file_to_add = SCCalloc(1, sizeof(PendingFile));
369  if (unlikely(file_to_add == NULL)) {
370  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate pending file");
371 
373  }
374 
375  file_to_add->filename = SCStrdup(pathbuff);
376  if (unlikely(file_to_add->filename == NULL)) {
377  SCLogError(SC_ERR_MEM_ALLOC, "Failed to copy filename");
378  CleanupPendingFile(file_to_add);
379 
381  }
382 
383  memset(&file_to_add->modified_time, 0, sizeof(struct timespec));
384  CopyTime(&temp_time, &file_to_add->modified_time);
385 
386  SCLogInfo("Found \"%s\" at %" PRIuMAX, file_to_add->filename,
387  (uintmax_t)SCTimespecAsEpochMillis(&file_to_add->modified_time));
388 
389  if (PcapDirectoryInsertFile(pv, file_to_add) == TM_ECODE_FAILED) {
390  SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to add file");
391  CleanupPendingFile(file_to_add);
392 
394  }
395  }
396  }
397 
399 }
400 
401 
402 TmEcode PcapDirectoryDispatchForTimeRange(PcapFileDirectoryVars *pv,
403  struct timespec *older_than)
404 {
405  if (PcapDirectoryPopulateBuffer(pv, older_than) == TM_ECODE_FAILED) {
406  SCLogError(SC_ERR_INVALID_ARGUMENT, "Failed to populate directory buffer");
408  }
409 
410  TmEcode status = TM_ECODE_OK;
411 
412  if (TAILQ_EMPTY(&pv->directory_content)) {
413  SCLogDebug("Directory %s has no files to process", pv->filename);
414  GetTime(older_than);
415  older_than->tv_sec = older_than->tv_sec - pv->delay;
416  rewinddir(pv->directory);
417  status = TM_ECODE_OK;
418  } else {
419  PendingFile *current_file = NULL;
420 
421  struct timespec last_time_seen;
422  memset(&last_time_seen, 0, sizeof(struct timespec));
423 
424  while (status == TM_ECODE_OK && !TAILQ_EMPTY(&pv->directory_content)) {
425  current_file = TAILQ_FIRST(&pv->directory_content);
426  TAILQ_REMOVE(&pv->directory_content, current_file, next);
427 
428  if (unlikely(current_file == NULL)) {
429  SCLogWarning(SC_ERR_PCAP_DISPATCH, "Current file was null");
430  } else if (unlikely(current_file->filename == NULL)) {
431  SCLogWarning(SC_ERR_PCAP_DISPATCH, "Current file filename was null");
432  } else {
433  SCLogDebug("Processing file %s", current_file->filename);
434 
435  PcapFileFileVars *pftv = SCMalloc(sizeof(PcapFileFileVars));
436  if (unlikely(pftv == NULL)) {
437  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate PcapFileFileVars");
439  }
440  memset(pftv, 0, sizeof(PcapFileFileVars));
441 
442  pftv->filename = SCStrdup(current_file->filename);
443  if (unlikely(pftv->filename == NULL)) {
444  SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate filename");
447  }
448  pftv->shared = pv->shared;
449 
450  if (InitPcapFile(pftv) == TM_ECODE_FAILED) {
452  "Failed to init pcap file %s, skipping",
453  current_file->filename);
454  CleanupPendingFile(current_file);
456  status = TM_ECODE_OK;
457  } else {
458  pv->current_file = pftv;
459 
460  status = PcapFileDispatch(pftv);
461 
463 
464  if (status == TM_ECODE_FAILED) {
465  CleanupPendingFile(current_file);
466  SCReturnInt(status);
467  }
468 
469  SCLogInfo("Processed file %s, processed up to %" PRIuMAX,
470  current_file->filename,
471  (uintmax_t)SCTimespecAsEpochMillis(&current_file->modified_time));
472 
473  if(CompareTimes(&current_file->modified_time, &last_time_seen) > 0) {
474  CopyTime(&current_file->modified_time, &last_time_seen);
475  }
476 
477  CleanupPendingFile(current_file);
478  pv->current_file = NULL;
479 
480  status = PcapRunStatus(pv);
481  }
482  }
483  }
484 
485  if(CompareTimes(&last_time_seen, &pv->shared->last_processed) > 0) {
486  SCLogInfo("Updating processed to %" PRIuMAX,
487  (uintmax_t)SCTimespecAsEpochMillis(&last_time_seen));
488  CopyTime(&last_time_seen, &pv->shared->last_processed);
489  status = PcapRunStatus(pv);
490  }
491  }
492  GetTime(older_than);
493  older_than->tv_sec = older_than->tv_sec - pv->delay;
494 
495  SCReturnInt(status);
496 }
497 
499 {
500  SCEnter();
501 
502  DIR *directory_check = NULL;
503 
504  struct timespec older_than;
505  memset(&older_than, 0, sizeof(struct timespec));
506  older_than.tv_sec = LONG_MAX;
507  uint32_t poll_seconds = (uint32_t)localtime(&ptv->poll_interval)->tm_sec;
508 
509  if (ptv->should_loop) {
510  GetTime(&older_than);
511  older_than.tv_sec = older_than.tv_sec - ptv->delay;
512  }
513  TmEcode status = TM_ECODE_OK;
514 
515  while (status == TM_ECODE_OK) {
516  //loop while directory is ok
517  SCLogInfo("Processing pcaps directory %s, files must be newer than %" PRIuMAX " and older than %" PRIuMAX,
518  ptv->filename, (uintmax_t)SCTimespecAsEpochMillis(&ptv->shared->last_processed),
519  (uintmax_t)SCTimespecAsEpochMillis(&older_than));
520  status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
521  if (ptv->should_loop && status == TM_ECODE_OK) {
522  sleep(poll_seconds);
523  //update our status based on suricata control flags or unix command socket
524  status = PcapRunStatus(ptv);
525  if (status == TM_ECODE_OK) {
526  SCLogDebug("Checking if directory %s still exists", ptv->filename);
527  //check directory
529  &directory_check) == TM_ECODE_FAILED) {
530  SCLogInfo("Directory %s no longer exists, stopping",
531  ptv->filename);
532  status = TM_ECODE_DONE;
533  } else if(directory_check != NULL) {
534  closedir(directory_check);
535  directory_check = NULL;
536  }
537  }
538  } else if (status == TM_ECODE_OK) { //not looping, mark done
539  SCLogDebug("Not looping, stopping directory mode");
540  status = TM_ECODE_DONE;
541  }
542  }
543 
545 
546  if (status == TM_ECODE_FAILED) {
547  SCLogError(SC_ERR_PCAP_DISPATCH, "Directory %s run mode failed", ptv->filename);
548  status = PcapDirectoryFailure(ptv);
549  } else {
550  SCLogInfo("Directory run mode complete");
551  status = PcapDirectoryDone(ptv);
552  }
553 
554  SCReturnInt(status);
555 }
556 
557 /* eof */
PcapFileDispatch
TmEcode PcapFileDispatch(PcapFileFileVars *ptv)
Main PCAP file reading Loop function.
Definition: source-pcap-file-helper.c:128
PcapFileFileVars_::filename
char * filename
Definition: source-pcap-file-helper.h:70
source-pcap-file.h
PcapFileFileVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-helper.h:76
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
TM_ECODE_DONE
@ TM_ECODE_DONE
Definition: tm-threads-common.h:84
TAILQ_EMPTY
#define TAILQ_EMPTY(head)
Definition: queue.h:248
SURICATA_STOP
#define SURICATA_STOP
Definition: suricata.h:89
StatsSyncCountersIfSignalled
#define StatsSyncCountersIfSignalled(tv)
Definition: counters.h:138
TAILQ_INSERT_AFTER
#define TAILQ_INSERT_AFTER(head, listelm, elm, field)
Definition: queue.h:267
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
PcapFileDirectoryVars_::poll_interval
time_t poll_interval
Definition: source-pcap-file-directory-helper.h:49
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
runmode-unix-socket.h
PcapDetermineDirectoryOrFile
TmEcode PcapDetermineDirectoryOrFile(char *filename, DIR **directory)
Definition: source-pcap-file-directory-helper.c:171
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
PendingFile_::modified_time
struct timespec modified_time
Definition: source-pcap-file-directory-helper.h:34
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
PcapFileDirectoryVars_
Definition: source-pcap-file-directory-helper.h:41
SCTimespecAsEpochMillis
uint64_t SCTimespecAsEpochMillis(const struct timespec *ts)
Definition: util-time.c:648
CleanupPendingFile
void CleanupPendingFile(PendingFile *pending)
Definition: source-pcap-file-directory-helper.c:97
SCEnter
#define SCEnter(...)
Definition: util-debug.h:298
InitPcapFile
TmEcode InitPcapFile(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:200
util-time.h
source-pcap-file-directory-helper.h
RunModeUnixSocketIsActive
int RunModeUnixSocketIsActive(void)
Definition: runmode-unix-socket.c:1585
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
SC_ERR_FOPEN
@ SC_ERR_FOPEN
Definition: util-error.h:74
SC_ERR_SPRINTF
@ SC_ERR_SPRINTF
Definition: util-error.h:42
PcapFileFileVars_
Definition: source-pcap-file-helper.h:69
TmEcode
TmEcode
Definition: tm-threads-common.h:81
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:215
util-mem.h
PcapFileDirectoryVars_::directory
DIR * directory
Definition: source-pcap-file-directory-helper.h:43
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
CleanupPcapFileDirectoryVars
void CleanupPcapFileDirectoryVars(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:106
SC_ERR_PCAP_DISPATCH
@ SC_ERR_PCAP_DISPATCH
Definition: util-error.h:50
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:255
PcapDirectoryDispatch
TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
Definition: source-pcap-file-directory-helper.c:498
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
PcapFileDirectoryVars_::current_file
PcapFileFileVars * current_file
Definition: source-pcap-file-directory-helper.h:44
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
PcapFileSharedVars_::last_processed
struct timespec last_processed
Definition: source-pcap-file-helper.h:46
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
SCFree
#define SCFree(p)
Definition: util-mem.h:61
PcapFileDirectoryVars_::delay
time_t delay
Definition: source-pcap-file-directory-helper.h:48
PendingFile_
Definition: source-pcap-file-directory-helper.h:32
PcapFileDirectoryVars_::shared
PcapFileSharedVars * shared
Definition: source-pcap-file-directory-helper.h:53
PcapFileDirectoryVars_::should_loop
bool should_loop
Definition: source-pcap-file-directory-helper.h:45
UnixSocketPcapFile
TmEcode UnixSocketPcapFile(TmEcode tm, struct timespec *last_processed)
Definition: runmode-unix-socket.c:618
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
suricata.h
PcapFileDirectoryVars_::filename
char * filename
Definition: source-pcap-file-directory-helper.h:42
CleanupPcapFileFileVars
void CleanupPcapFileFileVars(PcapFileFileVars *pfv)
Definition: source-pcap-file-helper.c:39
PcapFileSharedVars_::tv
ThreadVars * tv
Definition: source-pcap-file-helper.h:50
TAILQ_INSERT_BEFORE
#define TAILQ_INSERT_BEFORE(listelm, elm, field)
Definition: queue.h:277
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:302
PendingFile_::filename
char * filename
Definition: source-pcap-file-directory-helper.h:33
suricata_ctl_flags
volatile uint8_t suricata_ctl_flags
Definition: suricata.c:206