[Snort-devel] [PATCH 1/2] daq_nfq: snort defines its timeout in milliseconds, not seconds

Russ Combs rcombs at ...402...
Fri Apr 29 14:38:23 EDT 2011


Thanks Florian.  Bugged for the 2.9.1 release.

On Fri, Apr 29, 2011 at 8:36 AM, Florian Westphal <fwestphal at ...2119...>wrote:

> cfg->timeout is assigned to tv_sec. This turned the default of 1000ms
> in snort into a 16 minute timeout. Fix this by converting it
> into seconds/usecs.
> ---
>  both patches are against daq 0.5.
>
>  os-daq-modules/daq_nfq.c |   11 +++++++----
>  1 files changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/os-daq-modules/daq_nfq.c b/os-daq-modules/daq_nfq.c
> index 87cbf6d..d55e9d6 100644
> --- a/os-daq-modules/daq_nfq.c
> +++ b/os-daq-modules/daq_nfq.c
> @@ -74,7 +74,7 @@ typedef struct
>     volatile int count;
>     int passive;
>     uint32_t snaplen;
> -    unsigned timeout;
> +    struct timeval timeout;
>
>     char error[DAQ_ERRBUF_SIZE];
>     DAQ_State state;
> @@ -183,7 +183,11 @@ static int nfq_daq_get_setup (
>     }
>
>     impl->snaplen = cfg->snaplen ? cfg->snaplen : IP_MAXPACKET;
> -    impl->timeout = cfg->timeout;
> +
> +    /* cfg->timeout is in milliseconds */
> +    impl->timeout.tv_sec = cfg->timeout / 1000;
> +    impl->timeout.tv_usec = (cfg->timeout % 1000) * 1000;
> +
>     impl->passive = ( cfg->mode == DAQ_MODE_PASSIVE );
>
>     return DAQ_SUCCESS;
> @@ -485,8 +489,7 @@ static int nfq_daq_acquire (
>         FD_SET(impl->sock, &fdset);
>
>         // set this per call
> -        tv.tv_sec = impl->timeout;
> -        tv.tv_usec = 0;
> +        tv = impl->timeout;
>
>         // at least ipq had a timeout!
>         if ( select(impl->sock+1, &fdset, NULL, NULL, &tv) < 0 )
> --
> 1.7.3.4
>
>
>
> ------------------------------------------------------------------------------
> WhatsUp Gold - Download Free Network Management Software
> The most intuitive, comprehensive, and cost-effective network
> management toolset available today.  Delivers lowest initial
> acquisition cost and overall TCO of any competing solution.
> http://p.sf.net/sfu/whatsupgold-sd
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20110429/1a66b238/attachment.html>


More information about the Snort-devel mailing list