34 static void GetTime(
struct timespec *tm);
35 static void CopyTime(
struct timespec *from,
struct timespec *to);
36 static int CompareTimes(
struct timespec *left,
struct timespec *right);
40 static int PcapDirectoryGetModifiedTime(
char const * file,
struct timespec * out);
44 struct timespec * older_than);
46 struct timespec *older_than);
48 void GetTime(
struct timespec *tm)
51 if(gettimeofday(&now, NULL) == 0) {
52 tm->tv_sec = now.tv_sec;
53 tm->tv_nsec = now.tv_usec * 1000L;
57 void CopyTime(
struct timespec *from,
struct timespec *to)
59 to->tv_sec = from->tv_sec;
60 to->tv_nsec = from->tv_nsec;
63 int CompareTimes(
struct timespec *left,
struct timespec *right)
65 if (left->tv_sec < right->tv_sec) {
67 }
else if (left->tv_sec > right->tv_sec) {
70 if (left->tv_nsec < right->tv_nsec) {
72 }
else if (left->tv_nsec > right->tv_nsec) {
99 if (pending != NULL) {
124 current_file =
TAILQ_FIRST(&ptv->directory_content);
174 DIR *temp_dir = NULL;
177 temp_dir = opendir(filename);
179 if (temp_dir == NULL) {
182 SCLogError(
"%s: Permission denied", filename);
186 SCLogError(
"%s: Not a valid file descriptor opened for reading", filename);
190 SCLogError(
"%s: Per process open file descriptor limit reached", filename);
194 SCLogError(
"%s: System wide open file descriptor limit reached", filename);
198 SCLogError(
"%s: Does not exist, or name is an empty string", filename);
201 SCLogError(
"%s: Insufficient memory to complete the operation", filename);
205 SCLogDebug(
"%s: plain file, not a directory", filename);
214 *directory = temp_dir;
221 int PcapDirectoryGetModifiedTime(
char const *file,
struct timespec *out)
229 if ((ret =
SCStatFn(file, &buf)) != 0)
233 out->tv_sec = buf.st_mtimespec.tv_sec;
234 out->tv_nsec = buf.st_mtimespec.tv_nsec;
236 out->tv_sec = buf.st_mtime;
238 out->tv_sec = buf.st_mtim.tv_sec;
239 out->tv_nsec = buf.st_mtim.tv_nsec;
256 if (
unlikely(file_to_add == NULL)) {
262 SCLogError(
"File was passed with null filename");
271 file_to_compare =
TAILQ_FIRST(&pv->directory_content);
272 while(file_to_compare != NULL) {
275 file_to_compare = NULL;
278 if (next_file_to_compare == NULL) {
282 file_to_compare = next_file_to_compare;
291 struct timespec *older_than
298 SCLogError(
"No directory filename was passed");
301 struct dirent * dir = NULL;
304 while ((dir = readdir(pv->
directory)) != NULL) {
306 if (dir->d_type != DT_REG) {
310 if (strcmp(dir->d_name,
".") == 0 ||
311 strcmp(dir->d_name,
"..") == 0) {
315 char pathbuff[PATH_MAX] = {0};
319 written = snprintf(pathbuff, PATH_MAX,
"%s/%s", pv->
filename, dir->d_name);
321 if (written <= 0 || written >= PATH_MAX) {
326 struct timespec temp_time;
327 memset(&temp_time, 0,
sizeof(
struct timespec));
329 if (PcapDirectoryGetModifiedTime(pathbuff, &temp_time) == 0) {
330 SCLogDebug(
"%" PRIuMAX
" < %" PRIuMAX
"(%s) < %" PRIuMAX
")",
341 else if (CompareTimes(&temp_time, older_than) >= 0) {
346 SCLogDebug(
"Unable to get modified time on %s, skipping", pathbuff);
351 if (
unlikely(file_to_add == NULL)) {
352 SCLogError(
"Failed to allocate pending file");
365 memset(&file_to_add->
modified_time, 0,
sizeof(
struct timespec));
385 struct timespec *older_than)
388 SCLogError(
"Failed to populate directory buffer");
397 older_than->tv_sec = older_than->tv_sec - pv->
delay;
403 struct timespec last_time_seen;
404 memset(&last_time_seen, 0,
sizeof(
struct timespec));
407 current_file =
TAILQ_FIRST(&pv->directory_content);
410 if (
unlikely(current_file == NULL)) {
419 SCLogError(
"Failed to allocate PcapFileFileVars");
449 SCLogInfo(
"Processed file %s, processed up to %" PRIuMAX,
453 if(CompareTimes(¤t_file->
modified_time, &last_time_seen) > 0) {
460 status = PcapRunStatus(pv);
466 SCLogInfo(
"Updating processed to %" PRIuMAX,
469 status = PcapRunStatus(pv);
473 older_than->tv_sec = older_than->tv_sec - pv->
delay;
482 DIR *directory_check = NULL;
484 struct timespec older_than;
485 memset(&older_than, 0,
sizeof(
struct timespec));
486 older_than.tv_sec = LONG_MAX;
487 uint32_t poll_seconds = (uint32_t)localtime(&ptv->
poll_interval)->tm_sec;
490 GetTime(&older_than);
491 older_than.tv_sec = older_than.tv_sec - ptv->
delay;
497 SCLogInfo(
"Processing pcaps directory %s, files must be newer than %" PRIuMAX
" and older than %" PRIuMAX,
500 status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
504 status = PcapRunStatus(ptv);
510 SCLogInfo(
"Directory %s no longer exists, stopping",
513 }
else if(directory_check != NULL) {
514 closedir(directory_check);
515 directory_check = NULL;
519 SCLogDebug(
"Not looping, stopping directory mode");
528 status = PcapDirectoryFailure(ptv);
530 SCLogInfo(
"Directory run mode complete");
531 status = PcapDirectoryDone(ptv);