Esempio n. 1
0
void cap_http::exit()
{
	nids_exit();
	_quit=1;
	_reactor.end_reactor_event_loop();
	_interactons.disabled();
	get_capContents_fifo()->disabled();
	_httpsession.fini();
}
Esempio n. 2
0
void				sessions_exit(void)
{
  struct session		*elt;
  struct session		*elt_next;
  time_t			one_minute_later = 0;

  /*
   * Last pass to close timeout'd session... It is needed
   * because the last packet of a session marked for
   * deletion can be followed only by non-IP packets, so
   * it won't be deleted by ip_callback and would otherwise
   * appear as unclosed in the report generated below.
   * We jump forward one minute in order to timeout TCP
   * sessions that were opened during the last minute
   * of capture, which were given 60 seconds to complete
   * handshake but failed to do so.
   *
   * Also close SIP sessions that did not result in a call:
   * it happens often and the resulting spam in the report
   * generated below can be really annoying.
   */
  if (NULL != nids_last_pcap_header)
    one_minute_later = nids_last_pcap_header->ts.tv_sec + 60;
  for (elt = first_session; NULL != elt; elt = elt_next) {
    elt_next = elt->next;
    if (elt->timeout && (one_minute_later >= elt->timeout)) {
      sessions_del(elt);
      continue;
    }
# ifdef HAVE_LIBOSIPPARSER2
    if ((elt->type & TYPE_SIP) && !elt->u.sip_params.picked_up)
      sessions_del(elt);
# endif
  }

  /*
   * Print a report about unclosed sessions.
   */
  if (sessions_count) {
    fprintf(stderr,
	    "%d unclosed %s (id, type, last, source, destination, bytes):\n",
	    sessions_count, sessions_count > 1 ? "sessions" : "session");
    while (NULL != first_session) {
      fprintf(stderr, "#%d\t", first_session->id);
      fprintf(stderr, "%s\t", type2string(first_session->type, 1));
      fprintf(stderr, "%s\t", timestamp_to_string(&first_session->lastseen));
      fprintf(stderr, "%15s:%-5d\t",
	  inet_ntoa(*((struct in_addr *)&first_session->addr.saddr)),
	  first_session->addr.source);
      fprintf(stderr, "%15s:%-5d\t",
	  inet_ntoa(*((struct in_addr *)&first_session->addr.daddr)),
	  first_session->addr.dest);
      fprintf(stderr, "%12d\n", first_session->bytes);
      dumper_close(first_session->dumper);
      if (NULL != first_session->next) {
	first_session = first_session->next;
	free(first_session->prev);
	first_session->prev = NULL;
      } else {
	free(first_session);
	first_session = NULL;
      }
      --sessions_count;
    }
  }
  track_sessions = 0;
  nids_exit();
}