diff -rupN como-1.5//base/export.c como-1.5-new//base/export.c --- como-1.5//base/export.c 2006-11-09 17:21:55.000000000 +0100 +++ como-1.5-new//base/export.c 2011-04-12 00:11:50.626449001 +0200 @@ -101,81 +101,6 @@ create_record(module_t * mdl, uint32_t h } -/** - * -- export_record - * - * Invoked by process_tables for each individual record that - * is received by CAPTURE. It stores persistent state in the EXPORT - * flow table. - * - * Using the hash value in the flow_hdr, this block scans the hash - * table to determine the bucket and store the info. - * - */ -static int -export_record(module_t * mdl, rec_t * rp) -{ - etable_t *et; - rec_t *cand; - uint32_t hash; - int isnew; - - start_tsctimer(map.stats->ex_export_timer); - - /* - * get the right bucket in the hash table. we do not need to - * compute a new hash but we use the same that was used in CAPTURE, - * just a different number of bit, given the new size of the table. - */ - et = mdl->ex_hashtable; - hash = rp->hash % et->size; - - /* - * browse thru the elements in the bucket to - * find the right one (with ematch()) - */ - for (cand = et->bucket[hash]; cand != NULL; cand = cand->next) { - int ret; - - /* If there's no ematch() callback, any record matches */ - if (mdl->callbacks.ematch == NULL) - break; - - ret = mdl->callbacks.ematch(mdl, cand, rp); - if (ret) - break; - } - - isnew = 0; - if (cand == NULL) { - cand = create_record(mdl, hash); - isnew = 1; /* new record */ - cand->hash = rp->hash; - } - - /* - * update the export record. - */ - mdl->callbacks.export(mdl, cand, rp, isnew); - - /* - * move the record to the front of the bucket in the - * hash table to speed up successive accesses - */ - if (cand->prev) - cand->prev->next = cand->next; - if (cand->next) - cand->next->prev = cand->prev; - if (cand != et->bucket[hash]) - cand->next = et->bucket[hash]; - if (cand->next) - cand->next->prev = cand; - cand->prev = NULL; - et->bucket[hash] = cand; - - end_tsctimer(map.stats->ex_export_timer); - return 0; // XXX just to have same prototype of call_store -} /** @@ -256,20 +181,98 @@ call_store(module_t * mdl, rec_t *rp) /* print this record */ if (module_db_record_print(mdl, p, NULL, map.inline_fd) < 0) handle_print_fail(mdl); - /* move to next */ p += sz; left -= sz; } } } while (done == 0); - end_tsctimer(map.stats->ex_mapping_timer); + return ret; } /** + * -- export_record + * + * Invoked by process_tables for each individual record that + * is received by CAPTURE. It stores persistent state in the EXPORT + * flow table. + * + * Using the hash value in the flow_hdr, this block scans the hash + * table to determine the bucket and store the info. + * + */ +static int +export_record(module_t * mdl, rec_t * rp) +{ + etable_t *et; + rec_t *cand; + uint32_t hash; + int isnew; + + start_tsctimer(map.stats->ex_export_timer); + + /* + * get the right bucket in the hash table. we do not need to + * compute a new hash but we use the same that was used in CAPTURE, + * just a different number of bit, given the new size of the table. + */ + et = mdl->ex_hashtable; + hash = rp->hash % et->size; + + /* + * browse thru the elements in the bucket to + * find the right one (with ematch()) + */ + for (cand = et->bucket[hash]; cand != NULL; cand = cand->next) { + int ret; + + /* If there's no ematch() callback, any record matches */ + if (mdl->callbacks.ematch == NULL) + break; + + ret = mdl->callbacks.ematch(mdl, cand, rp); + if (ret) + break; + } + + isnew = 0; + if (cand == NULL) { + cand = create_record(mdl, hash); + isnew = 1; /* new record */ + cand->hash = rp->hash; + } + + /* + * update the export record and check if is time to store + */ + if(mdl->callbacks.export(mdl, cand, rp, isnew)==1) + call_store(mdl, cand); + + /* + * move the record to the front of the bucket in the + * hash table to speed up successive accesses + */ + if (cand->prev) + cand->prev->next = cand->next; + if (cand->next) + cand->next->prev = cand->prev; + if (cand != et->bucket[hash]) + cand->next = et->bucket[hash]; + if (cand->next) + cand->next->prev = cand; + cand->prev = NULL; + et->bucket[hash] = cand; + + end_tsctimer(map.stats->ex_export_timer); + return 0; // XXX just to have same prototype of call_store +} + + + +/** * -- process_table * * Process a table from the expired list (ct). It will go through the buckets @@ -293,6 +296,7 @@ process_table(ctable_t * ct, module_t * * call export() if available, otherwise just store() and * bypass the rest of the export code (see above) */ + record_fn = mdl->callbacks.export? export_record : call_store; /* @@ -624,6 +628,10 @@ ex_ipc_flush(procname_t sender, void *bu if (mdl->status != MDL_ACTIVE) continue; + /*call one time the function action to perform operations on the entire table*/ + if (mdl->callbacks.action != NULL) + mdl->callbacks.action(mdl, NULL, em->ct->ivl, em->ct->ts, 0); + if (em->ct->records) { /* process capture table and update export table */ start_tsctimer(map.stats->ex_table_timer); @@ -644,6 +652,7 @@ ex_ipc_flush(procname_t sender, void *bu * so it can merge and reuse the memory. */ ipc_send(sender, IPC_FLUSH, buf, len); + } diff -rupN como-1.5//sniffers/sniffer-pcap.c como-1.5-new//sniffers/sniffer-pcap.c --- como-1.5//sniffers/sniffer-pcap.c 2007-03-31 00:25:21.000000000 +0200 +++ como-1.5-new//sniffers/sniffer-pcap.c 2011-04-12 00:11:39.182449002 +0200 @@ -88,11 +88,20 @@ struct pcap_me { /* libpcap magic */ #define PCAP_MAGIC 0xa1b2c3d4 + +//timeval definition 64bit-compatible +typedef struct _timeval +{ + uint32_t tv_sec; /* Seconds. */ + uint32_t tv_usec; /* Microseconds. */ +}timeval_t; + + /* * PCAP header. It precedes every packet in the file. */ typedef struct pcap_hdr { - struct timeval ts; /* time stamp */ + struct _timeval ts; /* time stamp */ int caplen; /* length of portion present */ int len; /* length this packet (on the wire) */ } pcap_hdr_t;