- Skip all '.' files in file listing process. Skip 1.8.x bookkeeping file

- Improve robustness of netflow v9 time overflow handling

Author: phaag

src/include/exporter.h

@@ -210,14 +210,15 @@ typedef struct exporter_v5_s {
 typedef struct templateList_s templateList_t;
 typedef struct exporter_v9_s {
     // exporter parameters
-    uint64_t boot_time;
+    uint32_t SysUptime;
+    uint32_t unix_secs;
 
     // statistics
     uint64_t TemplateRecords;  // stat counter
     uint64_t DataRecords;      // stat counter
 
     // SysUptime if sent with #160
-    uint64_t SysUpTime;  // in msec
+    uint64_t msecSysUpTime;  // in msec
 
     // in order to prevent search through all lists keep
     // the last template we processed as a cache

src/libnffile/flist.c

@@ -799,11 +799,9 @@ static int GetFileList(stringlist_t *source_dirs, flist_t *flist) {
             case FTS_F:
                 // file entry
 
-                // skip stat file
-                if (strcmp(ftsent->fts_name, ".nfstat") == 0 || strncmp(ftsent->fts_name, NF_TMPFILE, strlen(NF_TMPFILE)) == 0) continue;
-                if (strstr(ftsent->fts_name, ".stat") != NULL) continue;
-                // skip OSX DS_Store files
-                if (strstr(ftsent->fts_name, ".DS_Store") != NULL) continue;
+                // skip all . files
+                if (ftsent->fts_name[0] == '.') continue;
+                if (strncmp(ftsent->fts_name, NF_TMPFILE, strlen(NF_TMPFILE)) == 0) continue;
                 // skip pcap file
                 if (strstr(ftsent->fts_name, "pcap") != NULL) continue;
 

src/netflow/netflow_v9.c

@@ -1173,13 +1173,18 @@ static inline void Process_v9_data(exporter_entry_t *exporter_entry, void *data_
                 uint64_t First = stack[STACK_MSECFIRST];
                 uint64_t Last = stack[STACK_MSECLAST];
 
-                if (First > Last) /* First in msec, in case of msec overflow, between start and end */
-                    genericFlow->msecFirst = exporter_v9->boot_time - 0x100000000LL + First;
-                else
-                    genericFlow->msecFirst = First + exporter_v9->boot_time;
+                uint64_t export_time_ms = (uint64_t)exporter_v9->unix_secs * 1000;
+                dbg_printf("SysupTime: %u, Unix_sec: %u\n", exporter_v9->SysUptime, exporter_v9->unix_secs);
+                dbg_printf("First: %llu, Last: %llu, exportTimeMS: %llu\n", First, Last, export_time_ms);
+
+                uint32_t offset = (uint32_t)exporter_v9->SysUptime - (uint32_t)First;
+                dbg_printf("Offset first: %u\n", offset);
+                genericFlow->msecFirst = export_time_ms - (uint64_t)offset;
+
+                offset = (uint32_t)exporter_v9->SysUptime - (uint32_t)Last;
+                dbg_printf("Offset last: %u\n", offset);
+                genericFlow->msecLast = export_time_ms - (uint64_t)offset;
 
-                // end time in msecs
-                genericFlow->msecLast = (uint64_t)Last + exporter_v9->boot_time;
             } else if (stack[STACK_SECFIRST]) {
                 genericFlow->msecFirst = stack[STACK_SECFIRST] * (uint64_t)1000;
                 genericFlow->msecLast = stack[STACK_SECLAST] * (uint64_t)1000;
@@ -1652,8 +1657,8 @@ static void Process_v9_SysUpTime_option_data(exporter_entry_t *exporter_entry, t
     // map input buffer as a byte array
     uint8_t *in = (uint8_t *)(data_flowset + 4);  // skip flowset header
     if (CHECK_OPTION_DATA(size_left, optionTemplate->SysUpOption)) {
-        exporter_v9->SysUpTime = Get_val(in, optionTemplate->SysUpOption.offset, optionTemplate->SysUpOption.length);
-        dbg_printf("Extracted SysUpTime : %" PRIu64 "\n", exporter_v9->SysUpTime);
+        exporter_v9->msecSysUpTime = Get_val(in, optionTemplate->SysUpOption.offset, optionTemplate->SysUpOption.length);
+        dbg_printf("Extracted SysUpTime : %" PRIu64 "\n", exporter_v9->msecSysUpTime);
     } else {
         LogError("Process_v9_option: %s line %d: Not enough data for option data", __FILE__, __LINE__);
         return;
@@ -1712,17 +1717,16 @@ void Process_v9(void *in_buff, ssize_t in_buff_cnt, FlowSource_t *fs) {
     exporter_v9_t *exporter_v9 = &exporter_entry->version.v9;
 
     /* calculate boot time in msec */
-    v9_header->SysUptime = ntohl(v9_header->SysUptime);
-    v9_header->unix_secs = ntohl(v9_header->unix_secs);
-    exporter_v9->boot_time = (uint64_t)1000 * (uint64_t)(v9_header->unix_secs) - (uint64_t)v9_header->SysUptime;
+    exporter_v9->SysUptime = ntohl(v9_header->SysUptime);
+    exporter_v9->unix_secs = ntohl(v9_header->unix_secs);
 
     void *flowset_header = (void *)v9_header + V9_HEADER_LENGTH;
     size_left -= V9_HEADER_LENGTH;
 
 #ifdef DEVEL
     uint32_t expected_records = ntohs(v9_header->count);
     printf("[%u] records: %u, buffer: %zd \n", exporter_id, expected_records, size_left);
-    printf("SourceID: %u, Sysuptime: %u.%u\n", v9_header->source_id, v9_header->SysUptime, v9_header->unix_secs);
+    printf("SourceID: %u, Sysuptime: %u.%u\n", exporter_id, exporter_v9->SysUptime, exporter_v9->unix_secs);
 #endif
 
     // sequence check