suricata
util-time.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Ken Steele <suricata@tilera.com>
23  *
24  * Time keeping for offline (non-live) packet handling (pcap files).
25  * And time string generation for alerts.
26  */
27 
28 /* Real time vs offline time
29  *
30  * When we run on live traffic, time handling is simple. Packets have a
31  * timestamp set by the capture method. Management threads can simply
32  * use 'gettimeofday' to know the current time. There should never be
33  * any serious gap between the two.
34  *
35  * In offline mode, things are dramatically different. Here we try to keep
36  * the time from the pcap, which means that if the packets are in 2011 the
37  * log output should also reflect this. Multiple issues:
38  * 1. merged pcaps might have huge time jumps or time going backward
39  * 2. slowly recorded pcaps may be processed much faster than their 'realtime'
40  * 3. management threads need a concept of what the 'current' time is for
41  * enforcing timeouts
42  * 4. due to (1) individual threads may have very different views on what
43  * the current time is. E.g. T1 processed packet 1 with TS X, while T2
44  * at the very same time processes packet 2 with TS X+100000s.
45  *
46  * In offline mode we keep the timestamp per thread. If a management thread
47  * needs current time, it will get the minimum of the threads' values. This
48  * is to avoid the problem that T2s time value might already trigger a flow
49  * timeout as the flow lastts + 100000s is almost certainly meaning the flow
50  * would be considered timed out.
51  */
52 
53 #ifdef OS_WIN32
54 /* for MinGW we need to set _POSIX_C_SOURCE before including
55  * sys/time.h. */
56 #ifndef _POSIX_C_SOURCE
57 #define _POSIX_C_SOURCE 200809L
58 #endif
59 #endif
60 
61 #include "suricata-common.h"
62 #include "detect.h"
63 #include "threads.h"
64 #include "tm-threads.h"
65 #include "util-debug.h"
66 
67 #ifdef UNITTESTS
68 static struct timeval current_time = { 0, 0 };
69 #endif
70 //static SCMutex current_time_mutex = SCMUTEX_INITIALIZER;
71 static SCSpinlock current_time_spinlock;
72 static char live = TRUE;
73 
74 struct tm *SCLocalTime(time_t timep, struct tm *result);
75 struct tm *SCUtcTime(time_t timep, struct tm *result);
76 
77 void TimeInit(void)
78 {
79  SCSpinInit(&current_time_spinlock, 0);
80 
81  /* Initialize Time Zone settings. */
82  tzset();
83 }
84 
85 void TimeDeinit(void)
86 {
87  SCSpinDestroy(&current_time_spinlock);
88 }
89 
90 void TimeModeSetLive(void)
91 {
92  live = TRUE;
93  SCLogDebug("live time mode enabled");
94 }
95 
96 void TimeModeSetOffline (void)
97 {
98  live = FALSE;
99  SCLogDebug("offline time mode enabled");
100 }
101 
102 int TimeModeIsLive(void)
103 {
104  return live;
105 }
106 
107 void TimeSetByThread(const int thread_id, const struct timeval *tv)
108 {
109  if (live == TRUE)
110  return;
111 
112  TmThreadsSetThreadTimestamp(thread_id, tv);
113 }
114 
115 #ifdef UNITTESTS
116 void TimeSet(struct timeval *tv)
117 {
118  if (live == TRUE)
119  return;
120 
121  if (tv == NULL)
122  return;
123 
124  SCSpinLock(&current_time_spinlock);
125  current_time.tv_sec = tv->tv_sec;
126  current_time.tv_usec = tv->tv_usec;
127 
128  SCLogDebug("time set to %" PRIuMAX " sec, %" PRIuMAX " usec",
129  (uintmax_t)current_time.tv_sec, (uintmax_t)current_time.tv_usec);
130 
131  SCSpinUnlock(&current_time_spinlock);
132 }
133 
134 /** \brief set the time to "gettimeofday" meant for testing */
136 {
137  struct timeval tv;
138  memset(&tv, 0x00, sizeof(tv));
139 
140  gettimeofday(&tv, NULL);
141 
142  TimeSet(&tv);
143 }
144 #endif
145 
146 void TimeGet(struct timeval *tv)
147 {
148  if (tv == NULL)
149  return;
150 
151  if (live == TRUE) {
152  gettimeofday(tv, NULL);
153  } else {
154 #ifdef UNITTESTS
155  if (unlikely(RunmodeIsUnittests())) {
156  SCSpinLock(&current_time_spinlock);
157  tv->tv_sec = current_time.tv_sec;
158  tv->tv_usec = current_time.tv_usec;
159  SCSpinUnlock(&current_time_spinlock);
160  } else {
161 #endif
163 #ifdef UNITTESTS
164  }
165 #endif
166  }
167 
168  SCLogDebug("time we got is %" PRIuMAX " sec, %" PRIuMAX " usec",
169  (uintmax_t)tv->tv_sec, (uintmax_t)tv->tv_usec);
170 }
171 
172 #ifdef UNITTESTS
173 /** \brief increment the time in the engine
174  * \param tv_sec seconds to increment the time with */
175 void TimeSetIncrementTime(uint32_t tv_sec)
176 {
177  struct timeval tv;
178  memset(&tv, 0x00, sizeof(tv));
179  TimeGet(&tv);
180 
181  tv.tv_sec += tv_sec;
182 
183  TimeSet(&tv);
184 }
185 #endif
186 
187 void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size)
188 {
189  time_t time = ts->tv_sec;
190  struct tm local_tm;
191  memset(&local_tm, 0, sizeof(local_tm));
192  struct tm *t = (struct tm*)SCLocalTime(time, &local_tm);
193  char time_fmt[64] = { 0 };
194 
195  if (likely(t != NULL)) {
196  strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S.%%06u%z", t);
197  snprintf(str, size, time_fmt, ts->tv_usec);
198  } else {
199  snprintf(str, size, "ts-error");
200  }
201 }
202 
203 void CreateUtcIsoTimeString (const struct timeval *ts, char *str, size_t size)
204 {
205  time_t time = ts->tv_sec;
206  struct tm local_tm;
207  memset(&local_tm, 0, sizeof(local_tm));
208  struct tm *t = (struct tm*)SCUtcTime(time, &local_tm);
209  char time_fmt[64] = { 0 };
210 
211  if (likely(t != NULL)) {
212  strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S", t);
213  snprintf(str, size, time_fmt, ts->tv_usec);
214  } else {
215  snprintf(str, size, "ts-error");
216  }
217 }
218 
219 void CreateFormattedTimeString (const struct tm *t, const char *fmt, char *str, size_t size)
220 {
221  if (likely(t != NULL && fmt != NULL && str != NULL)) {
222  strftime(str, size, fmt, t);
223  } else {
224  snprintf(str, size, "ts-error");
225  }
226 }
227 
228 struct tm *SCUtcTime(time_t timep, struct tm *result)
229 {
230  return gmtime_r(&timep, result);
231 }
232 
233 /*
234  * Time Caching code
235  */
236 
237 #ifndef TLS
238 /* OpenBSD does not support __thread, so don't use time caching on BSD
239  */
240 struct tm *SCLocalTime(time_t timep, struct tm *result)
241 {
242  return localtime_r(&timep, result);
243 }
244 
245 void CreateTimeString (const struct timeval *ts, char *str, size_t size)
246 {
247  time_t time = ts->tv_sec;
248  struct tm local_tm;
249  struct tm *t = (struct tm*)SCLocalTime(time, &local_tm);
250 
251  if (likely(t != NULL)) {
252  snprintf(str, size, "%02d/%02d/%02d-%02d:%02d:%02d.%06u",
253  t->tm_mon + 1, t->tm_mday, t->tm_year + 1900, t->tm_hour,
254  t->tm_min, t->tm_sec, (uint32_t) ts->tv_usec);
255  } else {
256  snprintf(str, size, "ts-error");
257  }
258 }
259 
260 #else
261 
262 /* On systems supporting __thread, use Per-thread values for caching
263  * in CreateTimeString */
264 
265 /* The maximum possible length of the time string.
266  * "%02d/%02d/%02d-%02d:%02d:%02d.%06u"
267  * Or "01/01/2013-15:42:21.123456", which is 26, so round up to 32. */
268 #define MAX_LOCAL_TIME_STRING 32
269 
270 static __thread int mru_time_slot; /* Most recently used cached value */
271 static __thread time_t last_local_time[2];
272 static __thread short int cached_local_time_len[2];
273 static __thread char cached_local_time[2][MAX_LOCAL_TIME_STRING];
274 
275 /* Per-thread values for caching SCLocalTime() These cached values are
276  * independent from the CreateTimeString cached values. */
277 static __thread int mru_tm_slot; /* Most recently used local tm */
278 static __thread time_t cached_minute_start[2];
279 static __thread struct tm cached_local_tm[2];
280 
281 /** \brief Convert time_t into Year, month, day, hour and minutes.
282  * \param timep Time in seconds since defined date.
283  * \param result The structure into which the broken down time it put.
284  *
285  * To convert a time in seconds into year, month, day, hours, minutes
286  * and seconds, call localtime_r(), which uses the current time zone
287  * to compute these values. Note, glibc's localtime_r() aquires a lock
288  * each time it is called, which limits parallelism. To call
289  * localtime_r() less often, the values returned are cached for the
290  * current and previous minute and then seconds are adjusted to
291  * compute the returned result. This is valid as long as the
292  * difference between the start of the current minute and the current
293  * time is less than 60 seconds. Once the minute value changes, all
294  * the other values could change.
295  *
296  * Two values are cached to prevent thrashing when changing from one
297  * minute to the next. The two cached minutes are independent and are
298  * not required to be M and M+1. If more than two minutes are
299  * requested, the least-recently-used cached value is updated more
300  * often, the results are still correct, but performance will be closer
301  * to previous performance.
302  */
303 struct tm *SCLocalTime(time_t timep, struct tm *result)
304 {
305  /* Only get a new local time when the time crosses into a new
306  * minute. */
307  int mru = mru_tm_slot;
308  int lru = 1 - mru;
309  int mru_seconds = timep - cached_minute_start[mru];
310  int lru_seconds = timep - cached_minute_start[lru];
311  int new_seconds;
312  if (cached_minute_start[mru]==0 && cached_minute_start[lru]==0) {
313  localtime_r(&timep, &cached_local_tm[lru]);
314  /* Subtract seconds to get back to the start of the minute. */
315  new_seconds = cached_local_tm[lru].tm_sec;
316  cached_minute_start[lru] = timep - new_seconds;
317  mru = lru;
318  mru_tm_slot = mru;
319  } else if (lru_seconds > 0 && (mru_seconds >= 0 && mru_seconds <= 59)) {
320  /* Use most-recently cached time, adjusting the seconds. */
321  new_seconds = mru_seconds;
322  } else if (mru_seconds > 0 && (lru_seconds >= 0 && lru_seconds <= 59)) {
323  /* Use least-recently cached time, update to most recently used. */
324  new_seconds = lru_seconds;
325  mru = lru;
326  mru_tm_slot = mru;
327  } else {
328  /* Update least-recent cached time. */
329  if (localtime_r(&timep, &cached_local_tm[lru]) == NULL)
330  return NULL;
331  /* Subtract seconds to get back to the start of the minute. */
332  new_seconds = cached_local_tm[lru].tm_sec;
333  cached_minute_start[lru] = timep - new_seconds;
334  mru = lru;
335  mru_tm_slot = mru;
336  }
337  memcpy(result, &cached_local_tm[mru], sizeof(struct tm));
338  result->tm_sec = new_seconds;
339 
340  return result;
341 }
342 
343 /* Update the cached time string in cache index N, for the current minute. */
344 static int UpdateCachedTime(int n, time_t time)
345 {
346  struct tm local_tm;
347  struct tm *t = (struct tm *)SCLocalTime(time, &local_tm);
348  int cached_len = snprintf(cached_local_time[n], MAX_LOCAL_TIME_STRING,
349  "%02d/%02d/%02d-%02d:%02d:",
350  t->tm_mon + 1, t->tm_mday, t->tm_year + 1900,
351  t->tm_hour, t->tm_min);
352  cached_local_time_len[n] = cached_len;
353  /* Store the time of the beginning of the minute. */
354  last_local_time[n] = time - t->tm_sec;
355  mru_time_slot = n;
356 
357  return t->tm_sec;
358 }
359 
360 /** \brief Return a formatted string for the provided time.
361  *
362  * Cache the Month/Day/Year - Hours:Min part of the time string for
363  * the current minute. Copy that result into the the return string and
364  * then only print the seconds for each call.
365  */
366 void CreateTimeString (const struct timeval *ts, char *str, size_t size)
367 {
368  time_t time = ts->tv_sec;
369  int seconds;
370 
371  /* Only get a new local time when the time crosses into a new
372  * minute */
373  int mru = mru_time_slot;
374  int lru = 1 - mru;
375  int mru_seconds = time - last_local_time[mru];
376  int lru_seconds = time - last_local_time[lru];
377  if (last_local_time[mru]==0 && last_local_time[lru]==0) {
378  /* First time here, update both caches */
379  UpdateCachedTime(mru, time);
380  seconds = UpdateCachedTime(lru, time);
381  } else if (mru_seconds >= 0 && mru_seconds <= 59) {
382  /* Use most-recently cached time. */
383  seconds = mru_seconds;
384  } else if (lru_seconds >= 0 && lru_seconds <= 59) {
385  /* Use least-recently cached time. Change this slot to Most-recent */
386  seconds = lru_seconds;
387  mru_time_slot = lru;
388  } else {
389  /* Update least-recent cached time. Lock accessing local time
390  * function because it keeps any internal non-spin lock. */
391  seconds = UpdateCachedTime(lru, time);
392  }
393 
394  /* Copy the string up to the current minute then print the seconds
395  into the return string buffer. */
396  char *cached_str = cached_local_time[mru_time_slot];
397  int cached_len = cached_local_time_len[mru_time_slot];
398  if (cached_len >= (int)size)
399  cached_len = size;
400  memcpy(str, cached_str, cached_len);
401  snprintf(str + cached_len, size - cached_len,
402  "%02d.%06u",
403  seconds, (uint32_t) ts->tv_usec);
404 }
405 
406 #endif /* defined(__OpenBSD__) */
407 
408 /**
409  * \brief Convert broken-down time to seconds since Unix epoch.
410  *
411  * This function is based on: http://www.catb.org/esr/time-programming
412  * (released to the public domain).
413  *
414  * \param tp Pointer to broken-down time.
415  *
416  * \retval Seconds since Unix epoch.
417  */
418 time_t SCMkTimeUtc (struct tm *tp)
419 {
420  time_t result;
421  long year;
422 #define MONTHSPERYEAR 12
423  static const int mdays[MONTHSPERYEAR] =
424  { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 };
425 
426  year = 1900 + tp->tm_year + tp->tm_mon / MONTHSPERYEAR;
427  result = (year - 1970) * 365 + mdays[tp->tm_mon % MONTHSPERYEAR];
428  result += (year - 1968) / 4;
429  result -= (year - 1900) / 100;
430  result += (year - 1600) / 400;
431  if ((year % 4) == 0 && ((year % 100) != 0 || (year % 400) == 0) &&
432  (tp->tm_mon % MONTHSPERYEAR) < 2)
433  result--;
434  result += tp->tm_mday - 1;
435  result *= 24;
436  result += tp->tm_hour;
437  result *= 60;
438  result += tp->tm_min;
439  result *= 60;
440  result += tp->tm_sec;
441 #ifndef OS_WIN32
442  if (tp->tm_gmtoff)
443  result -= tp->tm_gmtoff;
444 #endif
445  return result;
446 }
447 
448 /**
449  * \brief Parse a date string based on specified patterns.
450  *
451  * This function is based on GNU C library getdate.
452  *
453  * \param string Date string to parse.
454  * \param patterns String array containing patterns.
455  * \param num_patterns Number of patterns to check.
456  * \param tp Pointer to broken-down time.
457  *
458  * \retval 0 on success.
459  * \retval 1 on failure.
460  */
461 int SCStringPatternToTime (char *string, const char **patterns, int num_patterns,
462  struct tm *tp)
463 {
464  char *result = NULL;
465  int i = 0;
466 
467  /* Do the pattern matching */
468  for (i = 0; i < num_patterns; i++)
469  {
470  if (patterns[i] == NULL)
471  continue;
472 
473  tp->tm_hour = tp->tm_min = tp->tm_sec = 0;
474  tp->tm_year = tp->tm_mon = tp->tm_mday = tp->tm_wday = INT_MIN;
475  tp->tm_isdst = -1;
476 #ifndef OS_WIN32
477  tp->tm_gmtoff = 0;
478  tp->tm_zone = NULL;
479 #endif
480  result = strptime(string, patterns[i], tp);
481 
482  if (result && *result == '\0')
483  break;
484  }
485 
486  /* Return if no patterns matched */
487  if (result == NULL || *result != '\0')
488  return 1;
489 
490  /* Return if no date is given */
491  if (tp->tm_year == INT_MIN && tp->tm_mon == INT_MIN &&
492  tp->tm_mday == INT_MIN)
493  return 1;
494 
495  /* The first of the month is assumed, if only year and
496  month is given */
497  if (tp->tm_year != INT_MIN && tp->tm_mon != INT_MIN &&
498  tp->tm_mday <= 0)
499  tp->tm_mday = 1;
500 
501  return 0;
502 }
503 
504 /**
505  * \brief Convert epoch time to string pattern.
506  *
507  * This function converts epoch time to a string based on a pattern.
508  *
509  * \param epoch Epoch time.
510  * \param pattern String pattern.
511  * \param str Formated string.
512  * \param size Size of allocated string.
513  *
514  * \retval 0 on success.
515  * \retval 1 on failure.
516  */
517 int SCTimeToStringPattern (time_t epoch, const char *pattern, char *str, size_t size)
518 {
519  struct tm tm;
520  memset(&tm, 0, sizeof(tm));
521  struct tm *tp = (struct tm *)SCLocalTime(epoch, &tm);
522  char buffer[PATH_MAX] = { 0 };
523 
524  if (unlikely(tp == NULL)) {
525  return 1;
526  }
527 
528  int r = strftime(buffer, sizeof(buffer), pattern, tp);
529  if (r == 0) {
530  return 1;
531  }
532 
533  strlcpy(str, buffer, size);
534 
535  return 0;
536 }
537 
538 /**
539  * \brief Parse string containing time size (1m, 1h, etc).
540  *
541  * \param str String to parse.
542  *
543  * \retval size on success.
544  * \retval 0 on failure.
545  */
546 uint64_t SCParseTimeSizeString (const char *str)
547 {
548  uint64_t size = 0;
549  uint64_t modifier = 1;
550  char last = str[strlen(str)-1];
551 
552  switch (last)
553  {
554  case '0' ... '9':
555  break;
556  /* seconds */
557  case 's':
558  break;
559  /* minutes */
560  case 'm':
561  modifier = 60;
562  break;
563  /* hours */
564  case 'h':
565  modifier = 60 * 60;
566  break;
567  /* days */
568  case 'd':
569  modifier = 60 * 60 * 24;
570  break;
571  /* weeks */
572  case 'w':
573  modifier = 60 * 60 * 24 * 7;
574  break;
575  /* invalid */
576  default:
577  return 0;
578  }
579 
580  errno = 0;
581  size = strtoumax(str, NULL, 10);
582  if (errno) {
583  return 0;
584  }
585 
586  return (size * modifier);
587 }
588 
589 /**
590  * \brief Get seconds until a time unit changes.
591  *
592  * \param str String containing time type (minute, hour, etc).
593  * \param epoch Epoch time.
594  *
595  * \retval seconds.
596  */
597 uint64_t SCGetSecondsUntil (const char *str, time_t epoch)
598 {
599  uint64_t seconds = 0;
600  struct tm tm;
601  memset(&tm, 0, sizeof(tm));
602  struct tm *tp = (struct tm *)SCLocalTime(epoch, &tm);
603 
604  if (strcmp(str, "minute") == 0)
605  seconds = 60 - tp->tm_sec;
606  else if (strcmp(str, "hour") == 0)
607  seconds = (60 * (60 - tp->tm_min)) + (60 - tp->tm_sec);
608  else if (strcmp(str, "day") == 0)
609  seconds = (3600 * (24 - tp->tm_hour)) + (60 * (60 - tp->tm_min)) +
610  (60 - tp->tm_sec);
611 
612  return seconds;
613 }
614 
615 uint64_t SCTimespecAsEpochMillis(const struct timespec* ts)
616 {
617  return ts->tv_sec * 1000L + ts->tv_nsec / 1000000L;
618 }
void TimeSetToCurrentTime(void)
set the time to "gettimeofday" meant for testing
Definition: util-time.c:135
#define SCLogDebug(...)
Definition: util-debug.h:335
#define SCSpinDestroy
void TimeInit(void)
Definition: util-time.c:77
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
#define FALSE
#define unlikely(expr)
Definition: util-optimize.h:35
void TimeSetByThread(const int thread_id, const struct timeval *tv)
Definition: util-time.c:107
uint64_t SCGetSecondsUntil(const char *str, time_t epoch)
Get seconds until a time unit changes.
Definition: util-time.c:597
char * strptime(const char *__restrict, const char *__restrict, struct tm *__restrict)
Definition: util-strptime.c:97
void TimeModeSetLive(void)
Definition: util-time.c:90
struct tm * SCUtcTime(time_t timep, struct tm *result)
Definition: util-time.c:228
void TmThreadsSetThreadTimestamp(const int id, const struct timeval *ts)
Definition: tm-threads.c:2386
int TimeModeIsLive(void)
Definition: util-time.c:102
void TimeModeSetOffline(void)
Definition: util-time.c:96
void CreateUtcIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:203
#define TRUE
int SCTimeToStringPattern(time_t epoch, const char *pattern, char *str, size_t size)
Convert epoch time to string pattern.
Definition: util-time.c:517
time_t SCMkTimeUtc(struct tm *tp)
Convert broken-down time to seconds since Unix epoch.
Definition: util-time.c:418
#define str(s)
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:187
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:240
#define SCSpinLock
#define MONTHSPERYEAR
void TimeGet(struct timeval *tv)
Definition: util-time.c:146
#define SCSpinUnlock
int RunmodeIsUnittests(void)
Definition: suricata.c:267
uint64_t SCTimespecAsEpochMillis(const struct timespec *ts)
Definition: util-time.c:615
void TimeSet(struct timeval *tv)
Definition: util-time.c:116
void TmreadsGetMinimalTimestamp(struct timeval *ts)
Definition: tm-threads.c:2402
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:175
void TimeDeinit(void)
Definition: util-time.c:85
void CreateFormattedTimeString(const struct tm *t, const char *fmt, char *str, size_t size)
Definition: util-time.c:219
int SCStringPatternToTime(char *string, const char **patterns, int num_patterns, struct tm *tp)
Parse a date string based on specified patterns.
Definition: util-time.c:461
uint64_t ts
#define SCSpinlock
#define SCSpinInit
#define likely(expr)
Definition: util-optimize.h:32
uint64_t SCParseTimeSizeString(const char *str)
Parse string containing time size (1m, 1h, etc).
Definition: util-time.c:546
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:245