Hello Christian,
On Fri, Dec 01, 2006 at 10:58:10AM -0800, Christian Kreibich wrote:
> > - modify util.cc and util.h in order to use bpf_timeval as structure for the
> > double_to_timeval() function. (just used #ifdef HAVE_OPENBSD)
>
> Wow, this is so weird. I could swear we've fixed this before -- this is
> due to OpenBSD's pcap using bpf_timeval instead of just timeval like
> everyone else, correct?
>
> Rater than #ifdeffing different functions, it'd be nicer to make the
> type difference transparent by typedefing the bpf_timeval to a timeval
> in the OpenBSD case.
The problem we get into is "struct timeval" because it's defined in OpenBSD's system
(sys/time.h) but not in the way we need it :
/*
* Structure returned by gettimeofday(2) system call,
* and used in other calls.
*/
struct timeval {
long tv_sec; /* seconds */
long tv_usec; /* and microseconds */
};
And Bro complains in "TCP_Rewriter.cc" on the following line :
"pcap_hdr.ts = double_to_timeval(timestamp);"
=======================
TCP_Rewriter.cc: In member function int TCP_TracePacket::Finish(pcap_pkthdr*&,const u_char*&,
int&, unsigned int, unsigned int)':
TCP_Rewriter.cc:328: error: no match for 'operator=' in ' this->TCP_TracePacket::pcap_hdr.pcap_pkthdr::ts =
double_to_timeval(double)()'
/usr/include/net/bpf.h:129: error: candidates are: bpf_timeval&
bpf_timeval::operator=(const bpf_timeval&)
*** Error code 1
=======================
so here's "struct bpf_timeval" i used which is defined in (net/bpf.h) as :
struct bpf_timeval {
u_int32_t tv_sec;
u_int32_t tv_usec;
};
I don't see (yet) how using just a "#typedef" will solve the problem.
I may be wrong but i can't use a "typedef struct bpf_timeval timeval;"
"struct timeval" exists and is used elsewhere.
Best regards.
PS : "struct timeval" is defined in linux as :
struct timeval {
time_t tv_sec; /* seconds */
suseconds_t tv_usec; /* microseconds */
};