From f3ec60a0618e9d6ca7835917a628a03169de9487 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Tue, 12 Sep 2023 14:50:38 +0800
Subject: [PATCH] Uptime: add `ffTimeGetNow()` and use it

---
 src/common/time.h                     | 14 ++++++++++++
 src/detection/uptime/uptime_bsd.c     | 32 +++++++++------------------
 src/detection/uptime/uptime_linux.c   |  9 ++------
 src/detection/uptime/uptime_windows.c | 11 ++-------
 4 files changed, 29 insertions(+), 37 deletions(-)

diff --git a/src/common/time.h b/src/common/time.h
index 797461cbd..8da249448 100644
--- a/src/common/time.h
+++ b/src/common/time.h
@@ -7,6 +7,7 @@
 #ifdef _WIN32
     #include <synchapi.h>
     #include <profileapi.h>
+    #include <sysinfoapi.h>
 #else
     #include <time.h>
 #endif
@@ -26,6 +27,19 @@ static inline uint64_t ffTimeGetTick() //In msec
     #endif
 }
 
+static inline uint64_t ffTimeGetNow()
+{
+    #ifdef _WIN32
+        uint64_t timeNow;
+        GetSystemTimeAsFileTime((FILETIME*) &timeNow);
+        return (timeNow - 116444736000000000ull) / 10000ull;
+    #else
+        struct timespec timeNow;
+        clock_gettime(CLOCK_REALTIME, &timeNow);
+        return (uint64_t)((timeNow.tv_sec * 1000) + (timeNow.tv_nsec / 1000000));
+    #endif
+}
+
 static inline void ffTimeSleep(uint32_t msec)
 {
     #ifdef _WIN32
diff --git a/src/detection/uptime/uptime_bsd.c b/src/detection/uptime/uptime_bsd.c
index 0b1bf00c7..90b986da7 100644
--- a/src/detection/uptime/uptime_bsd.c
+++ b/src/detection/uptime/uptime_bsd.c
@@ -1,31 +1,21 @@
 #include "uptime.h"
+#include "common/time.h"
 
-#include <time.h>
 #include <sys/sysctl.h>
-#include <sys/time.h>
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
-    {
-        struct timeval bootTime;
-        size_t bootTimeSize = sizeof(bootTime);
-        if(sysctl(
-            (int[]) {CTL_KERN, KERN_BOOTTIME}, 2,
-            &bootTime, &bootTimeSize,
-            NULL, 0
-        ) != 0)
-            return "sysctl({CTL_KERN, KERN_BOOTTIME}) failed";
+    struct timeval bootTime;
+    size_t bootTimeSize = sizeof(bootTime);
+    if(sysctl(
+        (int[]) {CTL_KERN, KERN_BOOTTIME}, 2,
+        &bootTime, &bootTimeSize,
+        NULL, 0
+    ) != 0)
+        return "sysctl({CTL_KERN, KERN_BOOTTIME}) failed";
 
-        result->bootTime = (uint64_t) bootTime.tv_sec * 1000 + (uint64_t) bootTime.tv_usec / 1000;
-    }
-
-    {
-        struct timespec realTime;
-        if(clock_gettime(CLOCK_REALTIME, &realTime) != 0)
-            return "clock_gettime(CLOCK_REALTIME) failed";
-        uint64_t now = (uint64_t) realTime.tv_sec * 1000 + (uint64_t) realTime.tv_nsec / 1000000;
-        result->uptime = now - result->bootTime;
-    }
+    result->bootTime = (uint64_t) bootTime.tv_sec * 1000 + (uint64_t) bootTime.tv_usec / 1000;
+    result->uptime = ffTimeGetNow() - result->bootTime;
 
     return NULL;
 }
diff --git a/src/detection/uptime/uptime_linux.c b/src/detection/uptime/uptime_linux.c
index 039d550da..bfa67215b 100644
--- a/src/detection/uptime/uptime_linux.c
+++ b/src/detection/uptime/uptime_linux.c
@@ -1,6 +1,5 @@
 #include "uptime.h"
-
-#include <time.h>
+#include "common/time.h"
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
@@ -10,11 +9,7 @@ const char* ffDetectUptime(FFUptimeResult* result)
 
     result->uptime = (uint64_t) uptime.tv_sec * 1000 + (uint64_t) uptime.tv_nsec / 1000000;
 
-    struct timespec realTime;
-    if(clock_gettime(CLOCK_REALTIME, &realTime) != 0)
-        return "clock_gettime(CLOCK_REALTIME) failed";
-
-    result->bootTime = (uint64_t) realTime.tv_sec * 1000 + (uint64_t) realTime.tv_nsec / 1000000 + result->uptime;
+    result->bootTime = ffTimeGetNow() + result->uptime;
 
     return NULL;
 }
diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c
index 10f7157bb..6978a1163 100644
--- a/src/detection/uptime/uptime_windows.c
+++ b/src/detection/uptime/uptime_windows.c
@@ -1,18 +1,11 @@
 #include "uptime.h"
+#include "common/time.h"
 
 #include <sysinfoapi.h>
 
-static inline uint64_t to_ms(uint64_t ret)
-{
-    ret -= 116444736000000000ull;
-    return ret / 10000ull;
-}
-
 const char* ffDetectUptime(FFUptimeResult* result)
 {
     result->uptime = GetTickCount64();
-    FILETIME fileTime;
-    GetSystemTimeAsFileTime(&fileTime);
-    result->bootTime = to_ms(*(uint64_t*) &fileTime) - result->uptime;
+    result->bootTime = ffTimeGetNow() - result->uptime;
     return NULL;
 }