Re: Is pcap thread-safe?

[Guy Harris <guy () alum mit edu>]

On Fri, Apr 23, 2004 at 11:05:23AM +1000, Darren Reed wrote:
> The only part that wasn't thread safe (last time I checked)
> was pcap_compile().

On Linux 2.0[.x] kernels, opening and closing a device isn't
thread-safe, either, as, if the device is opened in promiscuous mode,
it's added to a global list of promiscuous devices, and is removed from
that list when closed (promiscuous mode has to be turned off by libpcap
in 2.0[.x] kernels); there's no locking done on the list, so there's a
potential risk of one thread stepping on another's toes.

However, with versions of libpcap built with PF_PACKET support (which
most modern ones should be) and running on 2.2 or later kernels, that
list isn't necessary and thus isn't modified.

There are also global variables manipulated without locks on opens and
closes on AIX (for loading the BPF driver), DAG cards (similar to Linux
2.0[.x], as libpcap has to shut down DAG cards), and on systems with
DLPI (Solaris and HP-UX, for example), there are some static buffers
used when reading packets, but libpcap doesn't use the stuff in those
buffers, so it might still be thread-safe (but we should perhaps make
them local to "pcap_read_dlpi()" anyway).
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.