From f4424b42049950731a0a0a43b2eb4af1d94c11c2 Mon Sep 17 00:00:00 2001
From: may <63159454+m4rch3n1ng@users.noreply.github.com>
Date: Thu, 5 Sep 2024 04:35:29 +0200
Subject: [PATCH] Uptime (Linux): fix linux bootTime (#1249)

the previous implementation was adding the elapsed time since
boot to the current time instead of subtracting it
---
 src/detection/uptime/uptime_linux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/detection/uptime/uptime_linux.c b/src/detection/uptime/uptime_linux.c
index ab85dd87a..0e4532492 100644
--- a/src/detection/uptime/uptime_linux.c
+++ b/src/detection/uptime/uptime_linux.c
@@ -20,7 +20,7 @@ const char* ffDetectUptime(FFUptimeResult* result)
         if(err != buf)
         {
             result->uptime = (uint64_t) (sec * 1000);
-            result->bootTime = ffTimeGetNow() + result->uptime;
+            result->bootTime = ffTimeGetNow() - result->uptime;
             return NULL;
         }
     }
@@ -32,7 +32,7 @@ const char* ffDetectUptime(FFUptimeResult* result)
         return "clock_gettime(CLOCK_BOOTTIME) failed";
 
     result->uptime = (uint64_t) uptime.tv_sec * 1000 + (uint64_t) uptime.tv_nsec / 1000000;
-    result->bootTime = ffTimeGetNow() + result->uptime;
+    result->bootTime = ffTimeGetNow() - result->uptime;
 
     return NULL;
 }