netdev - Re: can multi app capture on same NIC?(use packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20100622183141.GQ11110@cel.leo>
Date:	Tue, 22 Jun 2010 19:31:41 +0100
From:	Paul LeoNerd Evans <leonerd@...nerd.org.uk>
To:	Jon Zhou <Jon.Zhou@...u.com>, netdev@...r.kernel.org
Subject: Re: can multi app capture on same NIC?(use packet_mmap)

On Tue, Jun 22, 2010 at 02:40:13AM -0700, Jon Zhou wrote:
> I'd like to know multi-app can work with packet_mmap (or traditional AF_PACKET system call)?
> i.e.
> app1 & app2 capture on the same NIC
> 
> will both of them receive the same packet? 
> 
> Or this situation will happen?
> 
> 1.app1 start to receive a packet#1
> 2.app1 complete receiving, then set the packet_status->TP_STATUS_KERNEL
> 3.how about app2 at this time? Will it see packet_status=KERNEL, then packet#1 got lost?

Sure; each PF_PACKET socket gets its own memory buffer.

> I tried to find the relevant code in af_packet.c, seems it doesn't guarantee multi-app capture on same NIC?
> Can someone help to point it out?

That's because af_packet.c doesn't need to care. All the relevant code
is found in net/core/dev.c

PF_PACKET sockets get installed into the ptype_all list:

  void dev_add_pack(struct packet_type *pt)
  {
          int hash;

          spin_lock_bh(&ptype_lock);
          if (pt->type == htons(ETH_P_ALL))
                  list_add_rcu(&pt->list, &ptype_all);
  ...

Thereafter, every packet that's received is delivered, individually, to
every handler in that list:

  int netif_receive_skb(struct sk_buff *skb)
  {
  ...
          list_for_each_entry_rcu(ptype, &ptype_all, list) {
                  if (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
                      ptype->dev == orig_dev) {
                          if (pt_prev)
                                  ret = deliver_skb(skb, pt_prev, orig_dev);
  ...

Finally, in net/packet/af_packet.c, each PF_PACKET socket gets a copy of
this skb anyway; look for the call to skb_copy_bits() in the function
tpacket_rcv()

Hope that helps,

-- 
Paul "LeoNerd" Evans

leonerd@...nerd.org.uk
ICQ# 4135350       |  Registered Linux# 179460
http://www.leonerd.org.uk/

Download attachment "signature.asc" of type "application/pgp-signature" (191 bytes)