Pull request #4569: flow: Use timeout set on flow rather than using configured timeout

Merge in SNORT/snort3 from ~NIRMVENK/snort3:flow_tmout_master to master

Squashed commit of the following:

commit 13f9d7786694a8ac58ce50ac65769993e03635b3
Author: Nirmala Subbaiah <nirmvenk@cisco.com>
Date:   Wed Jan 8 15:55:23 2025 -0500

    flow: Use timeout set on flow rather than using configured timeout

diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc
index e459af2f38d5026f0582b089a072d5848b1e44a0..255a021c8260d41ca22c6278b0eb9c3ae4a4b28e 100644 (file)
--- a/src/flow/flow_cache.cc
+++ b/src/flow/flow_cache.cc
@@ -907,13 +907,15 @@ void FlowCache::output_flow(std::fstream& stream, const Flow& flow, const struct
         default:
             assert(false);
     }
+    int remaining_time = (flow.last_data_seen + flow.idle_timeout) - now.tv_sec;
+    std::string display_str = ( remaining_time < 0 ) ?  "s, timed out for " : "s, timeout in ";
     out << " pkts/bytes client " << flow.flowstats.client_pkts << "/" << flow.flowstats.client_bytes
         << " server " << flow.flowstats.server_pkts << "/" << flow.flowstats.server_bytes
         << " idle " << (now.tv_sec - flow.last_data_seen) << "s, uptime "
-        << (now.tv_sec - flow.flowstats.start_time.tv_sec) << "s, timeout ";
+        << (now.tv_sec - flow.flowstats.start_time.tv_sec) << display_str;
     std::string t = flow.is_hard_expiration() ?
-        timeout_to_str(flow.expire_time - now.tv_sec) :
-        timeout_to_str((flow.last_data_seen + config.proto[to_utype(flow.key->pkt_type)].nominal_timeout) - now.tv_sec);
+        timeout_to_str(abs((int)(flow.expire_time - now.tv_sec))) :
+        timeout_to_str(abs(remaining_time));
     out << t;
     stream << out.str() << proto.str() << (flow.flags.in_allowlist ? " (allowlist)" : "") << std::endl;
 }