Hello Christian,
> - modify util.cc and util.h in order to use bpf_timeval as structure for the
> double_to_timeval() function. (just used #ifdef HAVE_OPENBSD)
Wow, this is so weird. I could swear we've fixed this before -- this is
due to OpenBSD's pcap using bpf_timeval instead of just timeval like
everyone else, correct?
Rater than #ifdeffing different functions, it'd be nicer to make the
type difference transparent by typedefing the bpf_timeval to a timeval
in the OpenBSD case.
The problem we get into is "struct timeval" because it's defined in OpenBSD's system
(sys/time.h) but not in the way we need it :
/*
* Structure returned by gettimeofday(2) system call,
* and used in other calls.
*/
struct timeval {
long tv_sec; /* seconds */
long tv_usec; /* and microseconds */
};
And Bro complains in "TCP_Rewriter.cc" on the following line :
"pcap_hdr.ts = double_to_timeval(timestamp);"
I see your point. I still don't think there's a need to #ifdef different
functions though -- if we use struct timeval consistently throughout the
code (as we are), then you'll probably only need to add assignment
operators for the two different types (that'd fix the compiler error
you're pointing out) and maybe casts to struct timeval* in other places.
Let me know if there are other problems I'm missing.
Cheers,
Christian.
Hello Christian,
> I don't see (yet) how using just a "#typedef" will solve the problem.
> I may be wrong but i can't use a "typedef struct bpf_timeval timeval;"
> "struct timeval" exists and is used elsewhere.
I see your point. I still don't think there's a need to #ifdef different
functions though -- if we use struct timeval consistently throughout the
Sure, you're right but i tried to follow the suggestion and ran into
"trouble" so i prefered to switch to the "easy way" (to make Bro
working)... 
code (as we are), then you'll probably only need to add assignment
operators for the two different types (that'd fix the compiler error
you're pointing out) and maybe casts to struct timeval* in other places.
Let me know if there are other problems I'm missing.
No, the problem with "timeval" is the biggest one i think, the others are
managed :
- ARP.(h/cc)
- bro.rc (i still have a litlle error with a "SIGHUP" but the script works).
It's not a bug (but a feature) so as soon as i have a correct "timeval" solution, i'll play with the DNS.
Best regards.