From: Jeff Lucovsky Date: Mon, 16 Jan 2023 15:57:46 +0000 (-0500) Subject: time: Rework SCTime_t into a struct X-Git-Tag: suricata-7.0.0-rc1~104 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9fbe68364259ea71fcd0d22521afcaddefdc744d;p=thirdparty%2Fsuricata.git time: Rework SCTime_t into a struct Issue: 5718 This commit changes SCTime_t to a struct with members setup as bitfields. --- diff --git a/src/defrag.c b/src/defrag.c index f4b664a948..69fec69fd1 100644 --- a/src/defrag.c +++ b/src/defrag.c @@ -628,7 +628,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker, } /* Update timeout. */ - tracker->timeout = SCTIME_SECS(p->ts) + tracker->host_timeout; + tracker->timeout = SCTIME_FROM_SECS(SCTIME_SECS(p->ts) + tracker->host_timeout); Frag *prev = NULL, *next = NULL; bool overlap = false; @@ -2108,7 +2108,7 @@ static int DefragTimeoutTest(void) Packet *p = BuildTestPacket(IPPROTO_ICMP, 99, 0, 1, 'A' + i, 16); FAIL_IF_NULL(p); - p->ts += SCTIME_FROM_SECS(defrag_context->timeout + 1); + p->ts = SCTIME_ADD_SECS(p->ts, defrag_context->timeout + 1); Packet *tp = Defrag(NULL, NULL, p); FAIL_IF_NOT_NULL(tp); diff --git a/src/detect-engine-tag.c b/src/detect-engine-tag.c index 88f3872bdb..3f2bc173b8 100644 --- a/src/detect-engine-tag.c +++ b/src/detect-engine-tag.c @@ -556,7 +556,7 @@ int TagTimeoutCheck(Host *host, SCTime_t ts) prev = NULL; while (tmp != NULL) { SCTime_t timeout_at = SCTIME_FROM_SECS(tmp->last_ts + TAG_MAX_LAST_TIME_SEEN); - if (timeout_at >= ts) { + if (SCTIME_CMP_GTE(timeout_at, ts)) { prev = tmp; tmp = tmp->next; retval = 0; diff --git a/src/detect-engine-threshold.c b/src/detect-engine-threshold.c index 6f8a9ff111..b6101c752c 100644 --- a/src/detect-engine-threshold.c +++ b/src/detect-engine-threshold.c @@ -166,8 +166,8 @@ static DetectThresholdEntry *ThresholdTimeoutCheck(DetectThresholdEntry *head, S /* check if the 'check' timestamp is not before the creation ts. * This can happen due to the async nature of the host timeout * code that also calls this code from a management thread. */ - SCTime_t entry = tmp->tv1 + SCTIME_FROM_SECS((time_t)tmp->seconds); - if (ts <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(tmp->tv1, (time_t)tmp->seconds); + if (SCTIME_CMP_LTE(ts, entry)) { prev = tmp; tmp = tmp->next; continue; @@ -343,8 +343,8 @@ static int IsThresholdReached( } else { /* Update the matching state with the timeout interval */ - SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds); - if (packet_time <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds); + if (SCTIME_CMP_LTE(packet_time, entry)) { lookup_tsh->current_count++; if (lookup_tsh->current_count > td->count) { /* Then we must enable the new action by setting a @@ -403,8 +403,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh, SCLogDebug("limit"); if (lookup_tsh != NULL) { - SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds); - if (p->ts <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds); + if (SCTIME_CMP_LTE(p->ts, entry)) { lookup_tsh->current_count++; if (lookup_tsh->current_count <= td->count) { @@ -430,8 +430,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh, SCLogDebug("threshold"); if (lookup_tsh != NULL) { - SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds); - if (p->ts <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds); + if (SCTIME_CMP_LTE(p->ts, entry)) { lookup_tsh->current_count++; if (lookup_tsh->current_count >= td->count) { @@ -456,8 +456,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh, SCLogDebug("both"); if (lookup_tsh != NULL) { - SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds); - if (p->ts <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds); + if (SCTIME_CMP_LTE(p->ts, entry)) { /* within time limit */ lookup_tsh->current_count++; @@ -494,8 +494,8 @@ static int ThresholdHandlePacket(Packet *p, DetectThresholdEntry *lookup_tsh, SCLogDebug("detection_filter"); if (lookup_tsh != NULL) { - SCTime_t entry = lookup_tsh->tv1 + SCTIME_FROM_SECS(td->seconds); - if (p->ts <= entry) { + SCTime_t entry = SCTIME_ADD_SECS(lookup_tsh->tv1, td->seconds); + if (SCTIME_CMP_LTE(p->ts, entry)) { /* within timeout */ lookup_tsh->current_count++; if (lookup_tsh->current_count > td->count) { diff --git a/src/detect-threshold.c b/src/detect-threshold.c index 61cce98c2d..06d64fb441 100644 --- a/src/detect-threshold.c +++ b/src/detect-threshold.c @@ -1672,6 +1672,7 @@ static int DetectThresholdTestSig14(void) FAIL_IF(alerts1 != 2); FAIL_IF(alerts2 != 2); + TimeSetIncrementTime(70); p1->ts = TimeGet(); p2->ts = TimeGet(); diff --git a/src/flow-util.h b/src/flow-util.h index fa532a9d20..52ffe1d61d 100644 --- a/src/flow-util.h +++ b/src/flow-util.h @@ -56,7 +56,7 @@ (f)->flags = 0; \ (f)->file_flags = 0; \ (f)->protodetect_dp = 0; \ - (f)->lastts = 0; \ + SCTIME_INIT((f)->lastts); \ FLOWLOCK_INIT((f)); \ (f)->protoctx = NULL; \ (f)->flow_end_flags = 0; \ @@ -102,7 +102,7 @@ (f)->flags = 0; \ (f)->file_flags = 0; \ (f)->protodetect_dp = 0; \ - (f)->lastts = 0; \ + SCTIME_INIT((f)->lastts); \ (f)->protoctx = NULL; \ (f)->flow_end_flags = 0; \ (f)->alparser = NULL; \ diff --git a/src/flow.h b/src/flow.h index 8e1d2255c0..7c7d757448 100644 --- a/src/flow.h +++ b/src/flow.h @@ -703,7 +703,7 @@ static inline void FlowDeReference(Flow **d) static inline int64_t FlowGetId(const Flow *f) { int64_t id = (uint64_t)(SCTIME_SECS(f->startts) & 0x0000FFFF) << 48 | - (uint64_t)(f->startts & 0x0000FFFF) << 32 | (int64_t)f->flow_hash; + (uint64_t)(SCTIME_USECS(f->startts) & 0x0000FFFF) << 32 | (int64_t)f->flow_hash; /* reduce to 51 bits as Javascript and even JSON often seem to * max out there. */ id &= 0x7ffffffffffffLL; diff --git a/src/packet.c b/src/packet.c index d6c2219211..4bc2c4d898 100644 --- a/src/packet.c +++ b/src/packet.c @@ -102,7 +102,7 @@ void PacketReinit(Packet *p) p->vlan_id[0] = 0; p->vlan_id[1] = 0; p->vlan_idx = 0; - p->ts = 0; + SCTIME_INIT(p->ts); p->datalink = 0; p->drop_reason = 0; #define PACKET_RESET_ACTION(p) (p)->action = 0 diff --git a/src/source-af-packet.c b/src/source-af-packet.c index 091cf07839..6449809e89 100644 --- a/src/source-af-packet.c +++ b/src/source-af-packet.c @@ -796,8 +796,7 @@ static void AFPReadFromRingSetupPacket( p->afp_v.peer = (p->afp_v.copy_mode == AFP_COPY_MODE_NONE) ? NULL : ptv->mpeer->peer; /* Timestamp */ - p->ts = SCTIME_FROM_SECS(h.h2->tp_sec); - p->ts += SCTIME_FROM_USECS(h.h2->tp_nsec / 1000); + p->ts = (SCTime_t){ .secs = h.h2->tp_sec, .usecs = h.h2->tp_nsec / 1000 }; SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); /* We only check for checksum disable */ @@ -958,8 +957,7 @@ static inline int AFPParsePacketV3(AFPThreadVars *ptv, struct tpacket_block_desc p->afp_v.peer = (p->afp_v.copy_mode == AFP_COPY_MODE_NONE) ? NULL : ptv->mpeer->peer; /* Timestamp */ - p->ts = SCTIME_FROM_SECS(ppd->tp_sec); - p->ts += SCTIME_FROM_USECS(ppd->tp_nsec / 1000); + p->ts = (SCTime_t){ .secs = ppd->tp_sec, .usecs = ppd->tp_nsec / 1000 }; SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p)); diff --git a/src/source-erf-file.c b/src/source-erf-file.c index 824380654b..fcbc304d36 100644 --- a/src/source-erf-file.c +++ b/src/source-erf-file.c @@ -203,10 +203,10 @@ static inline TmEcode ReadErfRecord(ThreadVars *tv, Packet *p, void *data) uint64_t usecs = (ts >> 32); if (usecs >= 1000000) { usecs -= 1000000; - p->ts += SCTIME_FROM_SECS(1); + p->ts = SCTIME_ADD_SECS(p->ts, 1); usecs++; } - p->ts += SCTIME_FROM_USECS(usecs); + p->ts = SCTIME_ADD_USECS(p->ts, usecs); etv->pkts++; etv->bytes += wlen; diff --git a/src/source-pcap.c b/src/source-pcap.c index 5d5d3141de..c21f6d6364 100644 --- a/src/source-pcap.c +++ b/src/source-pcap.c @@ -246,7 +246,7 @@ static void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) PKT_SET_SRC(p, PKT_SRC_WIRE); p->ts = SCTIME_FROM_TIMEVAL(&h->ts); - SCLogDebug("p->ts.tv_sec %" PRIuMAX "", SCTIME_SECS((uintmax_t)p->ts)); + SCLogDebug("p->ts.tv_sec %" PRIuMAX "", (uintmax_t)SCTIME_SECS(p->ts)); p->datalink = ptv->datalink; ptv->pkts++; diff --git a/src/util-time.c b/src/util-time.c index c111879182..446210b2e9 100644 --- a/src/util-time.c +++ b/src/util-time.c @@ -181,7 +181,7 @@ void TimeSetIncrementTime(uint32_t tv_sec) { SCTime_t ts = TimeGet(); - ts += SCTIME_FROM_SECS(tv_sec); + ts = SCTIME_ADD_SECS(ts, tv_sec); TimeSet(ts); } diff --git a/src/util-time.h b/src/util-time.h index e1cccaf46f..81a2e943b7 100644 --- a/src/util-time.h +++ b/src/util-time.h @@ -24,8 +24,6 @@ #ifndef __UTIL_TIME_H__ #define __UTIL_TIME_H__ -typedef uint64_t SCTime_t; - /* * The SCTime_t member is broken up as * seconds: 44 @@ -38,25 +36,53 @@ typedef uint64_t SCTime_t; * 2^20 * 1048576 */ -#define USECS_BITS 20 -#define USEC_BITMASK 0xfffff -#define SCTIME_USECS(t) (SCTime_t)((t)&USEC_BITMASK) -#define SCTIME_SECS(t) (SCTime_t)((time_t)((t) >> USECS_BITS)) -#define SCTIME_MSECS(t) (SCTime_t)(SCTIME_SECS(t) * 1000 + SCTIME_USECS(t) / 1000) -#define SCTIME_FROM_SECS(secs) (SCTime_t)((((SCTime_t)(secs)) << USECS_BITS)) -#define SCTIME_FROM_USECS(usecs) (SCTime_t) SCTIME_USECS((usecs)) + +typedef struct { + uint64_t secs : 44; + uint64_t usecs : 20; +} SCTime_t; + +#define SCTIME_INIT(t) \ + { \ + (t).secs = 0; \ + (t).usecs = 0; \ + } +#define SCTIME_USECS(t) ((uint64_t)(t).usecs) +#define SCTIME_SECS(t) ((uint64_t)(t).secs) +#define SCTIME_MSECS(t) (SCTIME_SECS(t) * 1000 + SCTIME_USECS(t) / 1000) +#define SCTIME_ADD_SECS(ts, s) SCTIME_FROM_SECS((ts).secs + (s)) +#define SCTIME_ADD_USECS(ts, us) SCTIME_FROM_USECS((ts).usecs + (us)) +#define SCTIME_FROM_SECS(s) \ + (SCTime_t) \ + { \ + .secs = (s), .usecs = 0 \ + } +#define SCTIME_FROM_USECS(us) \ + (SCTime_t) \ + { \ + .secs = 0, .usecs = (us) \ + } #define SCTIME_FROM_TIMEVAL(tv) \ - (SCTime_t)((SCTIME_FROM_SECS((tv)->tv_sec) + SCTIME_FROM_USECS((tv)->tv_usec))) + (SCTime_t) \ + { \ + .secs = (tv)->tv_sec, .usecs = (tv)->tv_usec \ + } #define SCTIME_FROM_TIMESPEC(ts) \ - (SCTime_t)((SCTIME_FROM_SECS((ts)->tv_sec) + SCTIME_FROM_USECS((ts)->tv_nsec * 1000))) + (SCTime_t) \ + { \ + .secs = (ts)->tv_sec, .usecs = (ts)->tv_nsec * 1000 \ + } + #define SCTIME_TO_TIMEVAL(tv, t) \ (tv)->tv_sec = SCTIME_SECS((t)); \ (tv)->tv_usec = SCTIME_USECS((t)); #define SCTIME_CMP(a, b, CMP) \ ((SCTIME_SECS(a) == SCTIME_SECS(b)) ? (SCTIME_USECS(a) CMP SCTIME_USECS(b)) \ : (SCTIME_SECS(a) CMP SCTIME_SECS(b))) -#define SCTIME_CMP_GT(a, b) SCTIME_CMP((a), (b), >) -#define SCTIME_CMP_LT(a, b) SCTIME_CMP((a), (b), <) +#define SCTIME_CMP_GTE(a, b) SCTIME_CMP((a), (b), >=) +#define SCTIME_CMP_GT(a, b) SCTIME_CMP((a), (b), >) +#define SCTIME_CMP_LT(a, b) SCTIME_CMP((a), (b), <) +#define SCTIME_CMP_LTE(a, b) SCTIME_CMP((a), (b), <=) void TimeInit(void); void TimeDeinit(void);