pcap-file: fix poll-interval being misinterpreted as a timestamp

The passed poll-interval should determine how many seconds to wait
in-between polls. The previous code passed the value through localtime
function which understood the input integer as an epoch time and
converted it to time structure, of which only seconds were kept.

This kind of worked for sub-60 values but wrapped for values 60+ to
the usual seconds range 0-59. Additionally, setting poll-interval to
60 made it a busy loop with no sleep between polls.

With intervals of 60+ seconds now honored, a single sleep blocked the
shutdown (or a unix socket pcap-interrupt) until the interval elapsed,
and the engine was killed after the 60 second receive thread shutdown
timeout. The wait is now done in one second steps, checking the run
status in-between.

Ticket: 9129
pull/16497/head
Lukas Sismis 1 month ago committed by Victor Julien
parent fc96a9f69e
commit 4488424129

@ -475,6 +475,18 @@ TmEcode PcapDirectoryDispatchForTimeRange(PcapFileDirectoryVars *pv,
SCReturnInt(status);
}
static TmEcode PcapDirectoryWaitPollInterval(PcapFileDirectoryVars *ptv)
{
for (time_t waited = 0; waited < ptv->poll_interval; waited++) {
TmEcode status = PcapRunStatus(ptv);
if (status != TM_ECODE_OK) {
return status;
}
sleep(1);
}
return PcapRunStatus(ptv);
}
TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
{
SCEnter();
@ -484,15 +496,6 @@ TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
struct timespec older_than;
memset(&older_than, 0, sizeof(struct timespec));
older_than.tv_sec = LONG_MAX;
uint32_t poll_seconds;
#ifndef OS_WIN32
struct tm safe_tm;
memset(&safe_tm, 0, sizeof(safe_tm));
poll_seconds = (uint32_t)localtime_r(&ptv->poll_interval, &safe_tm)->tm_sec;
#else
/* windows localtime is threadsafe */
poll_seconds = (uint32_t)localtime(&ptv->poll_interval)->tm_sec;
#endif
if (ptv->should_loop) {
GetTime(&older_than);
@ -507,9 +510,7 @@ TmEcode PcapDirectoryDispatch(PcapFileDirectoryVars *ptv)
(uintmax_t)SCTimespecAsEpochMillis(&older_than));
status = PcapDirectoryDispatchForTimeRange(ptv, &older_than);
if (ptv->should_loop && status == TM_ECODE_OK) {
sleep(poll_seconds);
//update our status based on suricata control flags or unix command socket
status = PcapRunStatus(ptv);
status = PcapDirectoryWaitPollInterval(ptv);
if (status == TM_ECODE_OK) {
SCLogDebug("Checking if directory %s still exists", ptv->filename);
//check directory

Loading…
Cancel
Save