Hi,
I'm working on a statefull NIDS, and wanted to avoid copying the
PCAP buffer each time a packet was received. This implyed to use
a recycler that allocate a predefined number of memory chunks of
a defined size and have pcap use theses.
I attach a simple patch (note that it doesn't break the pcap API),
that had a single function : pcap_set_alloc_func() to be called
after pcap_open_live().
Would you consider to integrate this in the main pcap distribution ?
Index: CHANGES
===================================================================
RCS file: /tcpdump/master/libpcap/CHANGES,v
retrieving revision 1.55
diff -u -r1.55 CHANGES
--- CHANGES 2001/01/10 04:10:33 1.55
+++ CHANGES 2001/05/02 14:42:49
@@ -1,4 +1,12 @@
+
@(#) $Header: /tcpdump/master/libpcap/CHANGES,v 1.55 2001/01/10 04:10:33 guy Exp $
(LBL)
+
+Yoann Vandoorselaere <[EMAIL PROTECTED]>
+- Allow application using libpcap to make their own memory managment,
+ After pcap_open_live() is called, just call pcap_set_alloc_func()
+ providing it an allocation function (malloc style) as argument.
+ This is especially usefull for application using recycler that
+ do not want to copy captured data before using it.
Tuesday January 9, 2001. [EMAIL PROTECTED] Summary for 0.6 release
Index: pcap-int.h
===================================================================
RCS file: /tcpdump/master/libpcap/pcap-int.h,v
retrieving revision 1.32
diff -u -r1.32 pcap-int.h
--- pcap-int.h 2000/12/21 10:29:23 1.32
+++ pcap-int.h 2001/05/02 14:42:49
@@ -105,6 +105,8 @@
struct bpf_program fcode;
char errbuf[PCAP_ERRBUF_SIZE];
+
+ void *(*alloc)(size_t size);
};
/*
Index: pcap.c
===================================================================
RCS file: /tcpdump/master/libpcap/pcap.c,v
retrieving revision 1.36
diff -u -r1.36 pcap.c
--- pcap.c 2000/12/16 10:43:31 1.36
+++ pcap.c 2001/05/02 14:42:49
@@ -46,6 +46,7 @@
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <errno.h>
#ifdef HAVE_OS_PROTO_H
#include "os-proto.h"
@@ -57,6 +58,11 @@
pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
+ if ( p->alloc && ! (p->buffer = p->alloc(p->bufsize)) ) {
+ snprintf(p->errbuf, sizeof(p->errbuf), "malloc: %s",
+pcap_strerror(errno));
+ return -1;
+ }
+
if (p->sf.rfile != NULL)
return (pcap_offline_read(p, cnt, callback, user));
return (pcap_read(p, cnt, callback, user));
@@ -67,6 +73,11 @@
{
register int n;
+ if ( p->alloc && ! (p->buffer = p->alloc(p->bufsize)) ) {
+ snprintf(p->errbuf, sizeof(p->errbuf), "malloc: %s",
+pcap_strerror(errno));
+ return -1;
+ }
+
for (;;) {
if (p->sf.rfile != NULL)
n = pcap_offline_read(p, cnt, callback, user);
@@ -203,6 +214,13 @@
return p;
}
+
+void pcap_set_alloc_func(pcap_t *p, void *(*alloc)(size_t size))
+{
+ free(p->buffer);
+ p->alloc = alloc;
+}
+
void
pcap_close(pcap_t *p)
{
@@ -218,9 +236,14 @@
(void)fclose(p->sf.rfile);
if (p->sf.base != NULL)
free(p->sf.base);
- } else if (p->buffer != NULL)
+ } else if (p->buffer != NULL && ! p->alloc )
free(p->buffer);
pcap_freecode(&p->fcode);
free(p);
}
+
+
+
+
+
Index: pcap.h
===================================================================
RCS file: /tcpdump/master/libpcap/pcap.h,v
retrieving revision 1.31
diff -u -r1.31 pcap.h
--- pcap.h 2000/10/28 00:01:31 1.31
+++ pcap.h 2001/05/02 14:42:49
@@ -157,6 +157,12 @@
int pcap_major_version(pcap_t *);
int pcap_minor_version(pcap_t *);
+/*
+ * Set allocation function,
+ * this allow application to have their own buffer managment.
+ */
+ void pcap_set_alloc_func(pcap_t *p, void *(*alloc)(size_t size));
+
/* XXX */
FILE *pcap_file(pcap_t *);
int pcap_fileno(pcap_t *);
--
Yoann Vandoorselaere | I worry about my child and the Internet all the time,
MandrakeSoft | even though she's too young to have logged on yet.
| Here's what I worry about. I worry that 10 or 15 years
| from now, she will come to me and say 'Daddy, where were
| you when they took freedom of the press away from the
| Internet?' -- Mike Godwin
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
