33 static void GetTime(
struct timespec *tm);
34 static void CopyTime(
struct timespec *from,
struct timespec *to);
35 static int CompareTimes(
struct timespec *left,
struct timespec *right);
39 static int PcapDirectoryGetModifiedTime(
char const * file,
struct timespec * out);
43 struct timespec * older_than);
45 struct timespec *older_than);
47 void GetTime(
struct timespec *tm)
50 if(gettimeofday(&now, NULL) == 0) {
51 tm->tv_sec = now.tv_sec;
52 tm->tv_nsec = now.tv_usec * 1000L;
56 void CopyTime(
struct timespec *from,
struct timespec *to)
58 to->tv_sec = from->tv_sec;
59 to->tv_nsec = from->tv_nsec;
62 int CompareTimes(
struct timespec *left,
struct timespec *right)
64 if (left->tv_sec < right->tv_sec) {
66 }
else if (left->tv_sec > right->tv_sec) {
69 if (left->tv_nsec < right->tv_nsec) {
71 }
else if (left->tv_nsec > right->tv_nsec) {
98 if (pending != NULL) {
123 current_file =
TAILQ_FIRST(&ptv->directory_content);
173 DIR *temp_dir = NULL;
176 temp_dir = opendir(filename);
178 if (temp_dir == NULL) {
181 SCLogError(
"%s: Permission denied", filename);
185 SCLogError(
"%s: Not a valid file descriptor opened for reading", filename);
189 SCLogError(
"%s: Per process open file descriptor limit reached", filename);
193 SCLogError(
"%s: System wide open file descriptor limit reached", filename);
197 SCLogError(
"%s: Does not exist, or name is an empty string", filename);
200 SCLogError(
"%s: Insufficient memory to complete the operation", filename);
204 SCLogDebug(
"%s: plain file, not a directory", filename);
213 *directory = temp_dir;
220 int PcapDirectoryGetModifiedTime(
char const *file,
struct timespec *out)
233 if((ret = _stat(file, &buf)) != 0)
236 if ((ret = stat(file, &buf)) != 0)
241 out->tv_sec = buf.st_mtimespec.tv_sec;
242 out->tv_nsec = buf.st_mtimespec.tv_nsec;
244 out->tv_sec = buf.st_mtime;
246 out->tv_sec = buf.st_mtim.tv_sec;
247 out->tv_nsec = buf.st_mtim.tv_nsec;
264 if (
unlikely(file_to_add == NULL)) {
270 SCLogError(
"File was passed with null filename");
279 file_to_compare =
TAILQ_FIRST(&pv->directory_content);
280 while(file_to_compare != NULL) {
283 file_to_compare = NULL;
286 if (next_file_to_compare == NULL) {
290 file_to_compare = next_file_to_compare;
299 struct timespec *older_than
306 SCLogError(
"No directory filename was passed");
309 struct dirent * dir = NULL;
312 while ((dir = readdir(pv->
directory)) != NULL) {
314 if (dir->d_type != DT_REG) {
318 if (strcmp(dir->d_name,
".") == 0 ||
319 strcmp(dir->d_name,
"..") == 0) {
323 char pathbuff[PATH_MAX] = {0};
327 written = snprintf(pathbuff, PATH_MAX,
"%s/%s", pv->
filename, dir->d_name);
329 if (written <= 0 || written >= PATH_MAX) {
334 struct timespec temp_time;
335 memset(&temp_time, 0,
sizeof(
struct timespec));
337 if (PcapDirectoryGetModifiedTime(pathbuff, &temp_time) == 0) {
338 SCLogDebug(
"%" PRIuMAX
" < %" PRIuMAX
"(%s) < %" PRIuMAX
")",
349 else if (CompareTimes(&temp_time, older_than) >= 0) {
354 SCLogDebug(
"Unable to get modified time on %s, skipping", pathbuff);
359 if (
unlikely(file_to_add == NULL)) {
360 SCLogError(
"Failed to allocate pending file");
373 memset(&file_to_add->
modified_time, 0,
sizeof(
struct timespec));
393 struct timespec *older_than)
396 SCLogError(
"Failed to populate directory buffer");
405 older_than->tv_sec = older_than->tv_sec - pv->
delay;
411 struct timespec last_time_seen;
412 memset(&last_time_seen, 0,
sizeof(
struct timespec));
415 current_file =
TAILQ_FIRST(&pv->directory_content);
418 if (
unlikely(current_file == NULL)) {
427 SCLogError(
"Failed to allocate PcapFileFileVars");
457 SCLogInfo(
"Processed file %s, processed up to %" PRIuMAX,
461 if(CompareTimes(¤t_file->
modified_time, &last_time_seen) > 0) {
468 status = PcapRunStatus(pv);
474 SCLogInfo(
"Updating processed to %" PRIuMAX,
477 status = PcapRunStatus(pv);
481 older_than->tv_sec = older_than->tv_sec - pv->
delay;
490 DIR *directory_check = NULL;
492 struct timespec older_than;
493 memset(&older_than, 0,
sizeof(
struct timespec));
494 older_than.tv_sec = LONG_MAX;
495 uint32_t poll_seconds = (uint32_t)localtime(&ptv->
poll_interval)->tm_sec;
498 GetTime(&older_than);
499 older_than.tv_sec = older_than.tv_sec - ptv->
delay;
505 SCLogInfo(
"Processing pcaps directory %s, files must be newer than %" PRIuMAX
" and older than %" PRIuMAX,
508 status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
512 status = PcapRunStatus(ptv);
518 SCLogInfo(
"Directory %s no longer exists, stopping",
521 }
else if(directory_check != NULL) {
522 closedir(directory_check);
523 directory_check = NULL;
527 SCLogDebug(
"Not looping, stopping directory mode");
536 status = PcapDirectoryFailure(ptv);
538 SCLogInfo(
"Directory run mode complete");
539 status = PcapDirectoryDone(ptv);