suricata
util-time.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Ken Steele <suricata@tilera.com>
23  *
24  * Time keeping for offline (non-live) packet handling (pcap files).
25  * And time string generation for alerts.
26  */
27 
28 /* Real time vs offline time
29  *
30  * When we run on live traffic, time handling is simple. Packets have a
31  * timestamp set by the capture method. Management threads can simply
32  * use 'gettimeofday' to know the current time. There should never be
33  * any serious gap between the two.
34  *
35  * In offline mode, things are dramatically different. Here we try to keep
36  * the time from the pcap, which means that if the packets are in 2011 the
37  * log output should also reflect this. Multiple issues:
38  * 1. merged pcaps might have huge time jumps or time going backward
39  * 2. slowly recorded pcaps may be processed much faster than their 'realtime'
40  * 3. management threads need a concept of what the 'current' time is for
41  * enforcing timeouts
42  * 4. due to (1) individual threads may have very different views on what
43  * the current time is. E.g. T1 processed packet 1 with TS X, while T2
44  * at the very same time processes packet 2 with TS X+100000s.
45  *
46  * In offline mode we keep the timestamp per thread. If a management thread
47  * needs current time, it will get the minimum of the threads' values. This
48  * is to avoid the problem that T2s time value might already trigger a flow
49  * timeout as the flow lastts + 100000s is almost certainly meaning the flow
50  * would be considered timed out.
51  */
52 
53 #include "suricata-common.h"
54 #include "detect.h"
55 #include "threads.h"
56 #include "tm-threads.h"
57 #include "util-debug.h"
58 
59 #ifdef UNITTESTS
60 static struct timeval current_time = { 0, 0 };
61 #endif
62 //static SCMutex current_time_mutex = SCMUTEX_INITIALIZER;
63 static SCSpinlock current_time_spinlock;
64 static char live = TRUE;
65 
66 struct tm *SCLocalTime(time_t timep, struct tm *result);
67 struct tm *SCUtcTime(time_t timep, struct tm *result);
68 
69 void TimeInit(void)
70 {
71  SCSpinInit(&current_time_spinlock, 0);
72 
73  /* Initialize Time Zone settings. */
74  tzset();
75 }
76 
77 void TimeDeinit(void)
78 {
79  SCSpinDestroy(&current_time_spinlock);
80 }
81 
82 void TimeModeSetLive(void)
83 {
84  live = TRUE;
85  SCLogDebug("live time mode enabled");
86 }
87 
88 void TimeModeSetOffline (void)
89 {
90  live = FALSE;
91  SCLogDebug("offline time mode enabled");
92 }
93 
94 int TimeModeIsLive(void)
95 {
96  return live;
97 }
98 
99 void TimeSetByThread(const int thread_id, const struct timeval *tv)
100 {
101  if (live == TRUE)
102  return;
103 
104  TmThreadsSetThreadTimestamp(thread_id, tv);
105 }
106 
107 #ifdef UNITTESTS
108 void TimeSet(struct timeval *tv)
109 {
110  if (live == TRUE)
111  return;
112 
113  if (tv == NULL)
114  return;
115 
116  SCSpinLock(&current_time_spinlock);
117  current_time.tv_sec = tv->tv_sec;
118  current_time.tv_usec = tv->tv_usec;
119 
120  SCLogDebug("time set to %" PRIuMAX " sec, %" PRIuMAX " usec",
121  (uintmax_t)current_time.tv_sec, (uintmax_t)current_time.tv_usec);
122 
123  SCSpinUnlock(&current_time_spinlock);
124 }
125 
126 /** \brief set the time to "gettimeofday" meant for testing */
128 {
129  struct timeval tv;
130  memset(&tv, 0x00, sizeof(tv));
131 
132  gettimeofday(&tv, NULL);
133 
134  TimeSet(&tv);
135 }
136 #endif
137 
138 void TimeGet(struct timeval *tv)
139 {
140  if (tv == NULL)
141  return;
142 
143  if (live == TRUE) {
144  gettimeofday(tv, NULL);
145  } else {
146 #ifdef UNITTESTS
147  if (unlikely(RunmodeIsUnittests())) {
148  SCSpinLock(&current_time_spinlock);
149  tv->tv_sec = current_time.tv_sec;
150  tv->tv_usec = current_time.tv_usec;
151  SCSpinUnlock(&current_time_spinlock);
152  } else {
153 #endif
155 #ifdef UNITTESTS
156  }
157 #endif
158  }
159 
160  SCLogDebug("time we got is %" PRIuMAX " sec, %" PRIuMAX " usec",
161  (uintmax_t)tv->tv_sec, (uintmax_t)tv->tv_usec);
162 }
163 
164 #ifdef UNITTESTS
165 /** \brief increment the time in the engine
166  * \param tv_sec seconds to increment the time with */
167 void TimeSetIncrementTime(uint32_t tv_sec)
168 {
169  struct timeval tv;
170  memset(&tv, 0x00, sizeof(tv));
171  TimeGet(&tv);
172 
173  tv.tv_sec += tv_sec;
174 
175  TimeSet(&tv);
176 }
177 #endif
178 
179 void CreateIsoTimeString (const struct timeval *ts, char *str, size_t size)
180 {
181  time_t time = ts->tv_sec;
182  struct tm local_tm;
183  memset(&local_tm, 0, sizeof(local_tm));
184  struct tm *t = (struct tm*)SCLocalTime(time, &local_tm);
185  char time_fmt[64] = { 0 };
186 
187  if (likely(t != NULL)) {
188  strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S.%%06u%z", t);
189  snprintf(str, size, time_fmt, ts->tv_usec);
190  } else {
191  snprintf(str, size, "ts-error");
192  }
193 }
194 
195 void CreateUtcIsoTimeString (const struct timeval *ts, char *str, size_t size)
196 {
197  time_t time = ts->tv_sec;
198  struct tm local_tm;
199  memset(&local_tm, 0, sizeof(local_tm));
200  struct tm *t = (struct tm*)SCUtcTime(time, &local_tm);
201  char time_fmt[64] = { 0 };
202 
203  if (likely(t != NULL)) {
204  strftime(time_fmt, sizeof(time_fmt), "%Y-%m-%dT%H:%M:%S", t);
205  snprintf(str, size, time_fmt, ts->tv_usec);
206  } else {
207  snprintf(str, size, "ts-error");
208  }
209 }
210 
211 void CreateFormattedTimeString (const struct tm *t, const char *fmt, char *str, size_t size)
212 {
213  if (likely(t != NULL && fmt != NULL && str != NULL)) {
214  strftime(str, size, fmt, t);
215  } else {
216  snprintf(str, size, "ts-error");
217  }
218 }
219 
220 struct tm *SCUtcTime(time_t timep, struct tm *result)
221 {
222  return gmtime_r(&timep, result);
223 }
224 
225 /*
226  * Time Caching code
227  */
228 
229 #ifndef TLS
230 /* OpenBSD does not support __thread, so don't use time caching on BSD
231  */
232 struct tm *SCLocalTime(time_t timep, struct tm *result)
233 {
234  return localtime_r(&timep, result);
235 }
236 
237 void CreateTimeString (const struct timeval *ts, char *str, size_t size)
238 {
239  time_t time = ts->tv_sec;
240  struct tm local_tm;
241  struct tm *t = (struct tm*)SCLocalTime(time, &local_tm);
242 
243  if (likely(t != NULL)) {
244  snprintf(str, size, "%02d/%02d/%02d-%02d:%02d:%02d.%06u",
245  t->tm_mon + 1, t->tm_mday, t->tm_year + 1900, t->tm_hour,
246  t->tm_min, t->tm_sec, (uint32_t) ts->tv_usec);
247  } else {
248  snprintf(str, size, "ts-error");
249  }
250 }
251 
252 #else
253 
254 /* On systems supporting __thread, use Per-thread values for caching
255  * in CreateTimeString */
256 
257 /* The maximum possible length of the time string.
258  * "%02d/%02d/%02d-%02d:%02d:%02d.%06u"
259  * Or "01/01/2013-15:42:21.123456", which is 26, so round up to 32. */
260 #define MAX_LOCAL_TIME_STRING 32
261 
262 static __thread int mru_time_slot; /* Most recently used cached value */
263 static __thread time_t last_local_time[2];
264 static __thread short int cached_local_time_len[2];
265 static __thread char cached_local_time[2][MAX_LOCAL_TIME_STRING];
266 
267 /* Per-thread values for caching SCLocalTime() These cached values are
268  * independent from the CreateTimeString cached values. */
269 static __thread int mru_tm_slot; /* Most recently used local tm */
270 static __thread time_t cached_minute_start[2];
271 static __thread struct tm cached_local_tm[2];
272 
273 /** \brief Convert time_t into Year, month, day, hour and minutes.
274  * \param timep Time in seconds since defined date.
275  * \param result The structure into which the broken down time it put.
276  *
277  * To convert a time in seconds into year, month, day, hours, minutes
278  * and seconds, call localtime_r(), which uses the current time zone
279  * to compute these values. Note, glibc's localtime_r() aquires a lock
280  * each time it is called, which limits parallelism. To call
281  * localtime_r() less often, the values returned are cached for the
282  * current and previous minute and then seconds are adjusted to
283  * compute the returned result. This is valid as long as the
284  * difference between the start of the current minute and the current
285  * time is less than 60 seconds. Once the minute value changes, all
286  * the other values could change.
287  *
288  * Two values are cached to prevent thrashing when changing from one
289  * minute to the next. The two cached minutes are independent and are
290  * not required to be M and M+1. If more than two minutes are
291  * requested, the least-recently-used cached value is updated more
292  * often, the results are still correct, but performance will be closer
293  * to previous performance.
294  */
295 struct tm *SCLocalTime(time_t timep, struct tm *result)
296 {
297  /* Only get a new local time when the time crosses into a new
298  * minute. */
299  int mru = mru_tm_slot;
300  int lru = 1 - mru;
301  int mru_seconds = timep - cached_minute_start[mru];
302  int lru_seconds = timep - cached_minute_start[lru];
303  int new_seconds;
304  if (cached_minute_start[mru]==0 && cached_minute_start[lru]==0) {
305  localtime_r(&timep, &cached_local_tm[lru]);
306  /* Subtract seconds to get back to the start of the minute. */
307  new_seconds = cached_local_tm[lru].tm_sec;
308  cached_minute_start[lru] = timep - new_seconds;
309  mru = lru;
310  mru_tm_slot = mru;
311  } else if (lru_seconds > 0 && (mru_seconds >= 0 && mru_seconds <= 59)) {
312  /* Use most-recently cached time, adjusting the seconds. */
313  new_seconds = mru_seconds;
314  } else if (mru_seconds > 0 && (lru_seconds >= 0 && lru_seconds <= 59)) {
315  /* Use least-recently cached time, update to most recently used. */
316  new_seconds = lru_seconds;
317  mru = lru;
318  mru_tm_slot = mru;
319  } else {
320  /* Update least-recent cached time. */
321  if (localtime_r(&timep, &cached_local_tm[lru]) == NULL)
322  return NULL;
323  /* Subtract seconds to get back to the start of the minute. */
324  new_seconds = cached_local_tm[lru].tm_sec;
325  cached_minute_start[lru] = timep - new_seconds;
326  mru = lru;
327  mru_tm_slot = mru;
328  }
329  memcpy(result, &cached_local_tm[mru], sizeof(struct tm));
330  result->tm_sec = new_seconds;
331 
332  return result;
333 }
334 
335 /* Update the cached time string in cache index N, for the current minute. */
336 static int UpdateCachedTime(int n, time_t time)
337 {
338  struct tm local_tm;
339  struct tm *t = (struct tm *)SCLocalTime(time, &local_tm);
340  int cached_len = snprintf(cached_local_time[n], MAX_LOCAL_TIME_STRING,
341  "%02d/%02d/%02d-%02d:%02d:",
342  t->tm_mon + 1, t->tm_mday, t->tm_year + 1900,
343  t->tm_hour, t->tm_min);
344  cached_local_time_len[n] = cached_len;
345  /* Store the time of the beginning of the minute. */
346  last_local_time[n] = time - t->tm_sec;
347  mru_time_slot = n;
348 
349  return t->tm_sec;
350 }
351 
352 /** \brief Return a formatted string for the provided time.
353  *
354  * Cache the Month/Day/Year - Hours:Min part of the time string for
355  * the current minute. Copy that result into the the return string and
356  * then only print the seconds for each call.
357  */
358 void CreateTimeString (const struct timeval *ts, char *str, size_t size)
359 {
360  time_t time = ts->tv_sec;
361  int seconds;
362 
363  /* Only get a new local time when the time crosses into a new
364  * minute */
365  int mru = mru_time_slot;
366  int lru = 1 - mru;
367  int mru_seconds = time - last_local_time[mru];
368  int lru_seconds = time - last_local_time[lru];
369  if (last_local_time[mru]==0 && last_local_time[lru]==0) {
370  /* First time here, update both caches */
371  UpdateCachedTime(mru, time);
372  seconds = UpdateCachedTime(lru, time);
373  } else if (mru_seconds >= 0 && mru_seconds <= 59) {
374  /* Use most-recently cached time. */
375  seconds = mru_seconds;
376  } else if (lru_seconds >= 0 && lru_seconds <= 59) {
377  /* Use least-recently cached time. Change this slot to Most-recent */
378  seconds = lru_seconds;
379  mru_time_slot = lru;
380  } else {
381  /* Update least-recent cached time. Lock accessing local time
382  * function because it keeps any internal non-spin lock. */
383  seconds = UpdateCachedTime(lru, time);
384  }
385 
386  /* Copy the string up to the current minute then print the seconds
387  into the return string buffer. */
388  char *cached_str = cached_local_time[mru_time_slot];
389  int cached_len = cached_local_time_len[mru_time_slot];
390  if (cached_len >= (int)size)
391  cached_len = size;
392  memcpy(str, cached_str, cached_len);
393  snprintf(str + cached_len, size - cached_len,
394  "%02d.%06u",
395  seconds, (uint32_t) ts->tv_usec);
396 }
397 
398 #endif /* defined(__OpenBSD__) */
399 
400 /**
401  * \brief Convert broken-down time to seconds since Unix epoch.
402  *
403  * This function is based on: http://www.catb.org/esr/time-programming
404  * (released to the public domain).
405  *
406  * \param tp Pointer to broken-down time.
407  *
408  * \retval Seconds since Unix epoch.
409  */
410 time_t SCMkTimeUtc (struct tm *tp)
411 {
412  time_t result;
413  long year;
414 #define MONTHSPERYEAR 12
415  static const int mdays[MONTHSPERYEAR] =
416  { 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 };
417 
418  year = 1900 + tp->tm_year + tp->tm_mon / MONTHSPERYEAR;
419  result = (year - 1970) * 365 + mdays[tp->tm_mon % MONTHSPERYEAR];
420  result += (year - 1968) / 4;
421  result -= (year - 1900) / 100;
422  result += (year - 1600) / 400;
423  if ((year % 4) == 0 && ((year % 100) != 0 || (year % 400) == 0) &&
424  (tp->tm_mon % MONTHSPERYEAR) < 2)
425  result--;
426  result += tp->tm_mday - 1;
427  result *= 24;
428  result += tp->tm_hour;
429  result *= 60;
430  result += tp->tm_min;
431  result *= 60;
432  result += tp->tm_sec;
433 #ifndef OS_WIN32
434  if (tp->tm_gmtoff)
435  result -= tp->tm_gmtoff;
436 #endif
437  return result;
438 }
439 
440 /**
441  * \brief Parse a date string based on specified patterns.
442  *
443  * This function is based on GNU C library getdate.
444  *
445  * \param string Date string to parse.
446  * \param patterns String array containing patterns.
447  * \param num_patterns Number of patterns to check.
448  * \param tp Pointer to broken-down time.
449  *
450  * \retval 0 on success.
451  * \retval 1 on failure.
452  */
453 int SCStringPatternToTime (char *string, const char **patterns, int num_patterns,
454  struct tm *tp)
455 {
456  char *result = NULL;
457  int i = 0;
458 
459  /* Do the pattern matching */
460  for (i = 0; i < num_patterns; i++)
461  {
462  if (patterns[i] == NULL)
463  continue;
464 
465  tp->tm_hour = tp->tm_min = tp->tm_sec = 0;
466  tp->tm_year = tp->tm_mon = tp->tm_mday = tp->tm_wday = INT_MIN;
467  tp->tm_isdst = -1;
468 #ifndef OS_WIN32
469  tp->tm_gmtoff = 0;
470  tp->tm_zone = NULL;
471 #endif
472  result = strptime(string, patterns[i], tp);
473 
474  if (result && *result == '\0')
475  break;
476  }
477 
478  /* Return if no patterns matched */
479  if (result == NULL || *result != '\0')
480  return 1;
481 
482  /* Return if no date is given */
483  if (tp->tm_year == INT_MIN && tp->tm_mon == INT_MIN &&
484  tp->tm_mday == INT_MIN)
485  return 1;
486 
487  /* The first of the month is assumed, if only year and
488  month is given */
489  if (tp->tm_year != INT_MIN && tp->tm_mon != INT_MIN &&
490  tp->tm_mday <= 0)
491  tp->tm_mday = 1;
492 
493  return 0;
494 }
495 
496 /**
497  * \brief Convert epoch time to string pattern.
498  *
499  * This function converts epoch time to a string based on a pattern.
500  *
501  * \param epoch Epoch time.
502  * \param pattern String pattern.
503  * \param str Formated string.
504  * \param size Size of allocated string.
505  *
506  * \retval 0 on success.
507  * \retval 1 on failure.
508  */
509 int SCTimeToStringPattern (time_t epoch, const char *pattern, char *str, size_t size)
510 {
511  struct tm tm;
512  memset(&tm, 0, sizeof(tm));
513  struct tm *tp = (struct tm *)SCLocalTime(epoch, &tm);
514  char buffer[PATH_MAX] = { 0 };
515 
516  if (unlikely(tp == NULL)) {
517  return 1;
518  }
519 
520  int r = strftime(buffer, sizeof(buffer), pattern, tp);
521  if (r == 0) {
522  return 1;
523  }
524 
525  strlcpy(str, buffer, size);
526 
527  return 0;
528 }
529 
530 /**
531  * \brief Parse string containing time size (1m, 1h, etc).
532  *
533  * \param str String to parse.
534  *
535  * \retval size on success.
536  * \retval 0 on failure.
537  */
538 uint64_t SCParseTimeSizeString (const char *str)
539 {
540  uint64_t size = 0;
541  uint64_t modifier = 1;
542  char last = str[strlen(str)-1];
543 
544  switch (last)
545  {
546  case '0' ... '9':
547  break;
548  /* seconds */
549  case 's':
550  break;
551  /* minutes */
552  case 'm':
553  modifier = 60;
554  break;
555  /* hours */
556  case 'h':
557  modifier = 60 * 60;
558  break;
559  /* days */
560  case 'd':
561  modifier = 60 * 60 * 24;
562  break;
563  /* weeks */
564  case 'w':
565  modifier = 60 * 60 * 24 * 7;
566  break;
567  /* invalid */
568  default:
569  return 0;
570  }
571 
572  errno = 0;
573  size = strtoumax(str, NULL, 10);
574  if (errno) {
575  return 0;
576  }
577 
578  return (size * modifier);
579 }
580 
581 /**
582  * \brief Get seconds until a time unit changes.
583  *
584  * \param str String containing time type (minute, hour, etc).
585  * \param epoch Epoch time.
586  *
587  * \retval seconds.
588  */
589 uint64_t SCGetSecondsUntil (const char *str, time_t epoch)
590 {
591  uint64_t seconds = 0;
592  struct tm tm;
593  memset(&tm, 0, sizeof(tm));
594  struct tm *tp = (struct tm *)SCLocalTime(epoch, &tm);
595 
596  if (strcmp(str, "minute") == 0)
597  seconds = 60 - tp->tm_sec;
598  else if (strcmp(str, "hour") == 0)
599  seconds = (60 * (60 - tp->tm_min)) + (60 - tp->tm_sec);
600  else if (strcmp(str, "day") == 0)
601  seconds = (3600 * (24 - tp->tm_hour)) + (60 * (60 - tp->tm_min)) +
602  (60 - tp->tm_sec);
603 
604  return seconds;
605 }
606 
607 uint64_t SCTimespecAsEpochMillis(const struct timespec* ts)
608 {
609  return ts->tv_sec * 1000L + ts->tv_nsec / 1000000L;
610 }
void TimeSetToCurrentTime(void)
set the time to "gettimeofday" meant for testing
Definition: util-time.c:127
#define SCLogDebug(...)
Definition: util-debug.h:335
#define SCSpinDestroy
void TimeInit(void)
Definition: util-time.c:69
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
#define FALSE
#define unlikely(expr)
Definition: util-optimize.h:35
void TimeSetByThread(const int thread_id, const struct timeval *tv)
Definition: util-time.c:99
uint64_t SCGetSecondsUntil(const char *str, time_t epoch)
Get seconds until a time unit changes.
Definition: util-time.c:589
char * strptime(const char *__restrict, const char *__restrict, struct tm *__restrict)
Definition: util-strptime.c:97
void TimeModeSetLive(void)
Definition: util-time.c:82
struct tm * SCUtcTime(time_t timep, struct tm *result)
Definition: util-time.c:220
void TmThreadsSetThreadTimestamp(const int id, const struct timeval *ts)
Definition: tm-threads.c:2330
int TimeModeIsLive(void)
Definition: util-time.c:94
void TimeModeSetOffline(void)
Definition: util-time.c:88
void CreateUtcIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:195
#define TRUE
int SCTimeToStringPattern(time_t epoch, const char *pattern, char *str, size_t size)
Convert epoch time to string pattern.
Definition: util-time.c:509
time_t SCMkTimeUtc(struct tm *tp)
Convert broken-down time to seconds since Unix epoch.
Definition: util-time.c:410
#define str(s)
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:179
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:232
#define SCSpinLock
#define MONTHSPERYEAR
void TimeGet(struct timeval *tv)
Definition: util-time.c:138
#define SCSpinUnlock
int RunmodeIsUnittests(void)
Definition: suricata.c:261
uint64_t SCTimespecAsEpochMillis(const struct timespec *ts)
Definition: util-time.c:607
void TimeSet(struct timeval *tv)
Definition: util-time.c:108
void TmreadsGetMinimalTimestamp(struct timeval *ts)
Definition: tm-threads.c:2346
void TimeSetIncrementTime(uint32_t tv_sec)
increment the time in the engine
Definition: util-time.c:167
void TimeDeinit(void)
Definition: util-time.c:77
void CreateFormattedTimeString(const struct tm *t, const char *fmt, char *str, size_t size)
Definition: util-time.c:211
int SCStringPatternToTime(char *string, const char **patterns, int num_patterns, struct tm *tp)
Parse a date string based on specified patterns.
Definition: util-time.c:453
uint64_t ts
#define SCSpinlock
#define SCSpinInit
#define likely(expr)
Definition: util-optimize.h:32
uint64_t SCParseTimeSizeString(const char *str)
Parse string containing time size (1m, 1h, etc).
Definition: util-time.c:538
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:237