[Winpcap-users] pcap_fopen_offline not exported?

[Gianluca Varenni]

I'm not surprised about that.

The reason is that on Unix systems, a file descriptor is a "native" concept 
of the OS, i.e. the system calls (like read or write) work with file 
descriptors.

On Windows, file descriptors (and the related functions read/write and such) 
are just a shim over the native Win32 file handles i.e. HANDLE and the 
system calls like ReadFile/WriteFile.
The CRT maintains a table of some sort managing the correspondence between 
the "unix-like" file descriptors and HANDLEs. If you use the same file 
descriptor with two different versions of the CRT in your process, you are 
in trouble.

Even without this limitation, the transformation file descriptor <--> FILE* 
is dangerous. Usually the functions working on FILE handles provide some 
sort of internal buffering (unless you disable it), so what you have written 
with fwrite is not what got written on disk or with the file descriptor and 
write(). Same for read operations.

Hope it helps
GV

----- Original Message ----- 
From: "Okraszewski, Marcin" <Marcin.Okraszewski at pl.compuware.com>
To: <winpcap-users at winpcap.org>
Sent: Wednesday, July 23, 2008 7:48 AM
Subject: RE: [Winpcap-users] pcap_fopen_offline not exported?


> Seems it was naive assumption that the incompatibility is in real FILE
> structure. Passing file descriptor seems to expose the same problem.
>
> Marcin
>
>
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Okraszewski,
> Marcin
> Sent: Wednesday, July 23, 2008 11:08 AM
> To: winpcap-users at winpcap.org
> Subject: RE: [Winpcap-users] pcap_fopen_offline not exported?
>
> Right ... this might be a problem in deed :( But if I recompile winpcap
> with the same compiler as rest of the project it seems it should work.
>
> Maybe Winpcap could export an alternative function which would work on
> file descriptor? This shouldn't have the CRT compatibility issues. It
> could look like this:
>
> pcap_t* pcap_fdopen_offline(int fd, char *errorbuf) {
>    FILE *file = _fdopen(fd, "rb");
>    if ( file == NULL ) {
>        strerror_s(errorbuf, PCAP_ERRBUF_SIZE, errno);
>        return NULL;
>    }
>    return pcap_fopen_offline(file, errorbuf);
> }
>
> Then also it could override pcap_fopen_offline calls with a macro:
>
> #define pcap_fopen_offline(file, errorbuf) \
>    pcap_fdopen_offline(_fileno(file), errorbuf)
>
> This together would make it compatible with libpcap.
>
> Thanks a lot for answers!
> Marcin
>
>
> The contents of this e-mail are intended for the named addressee only.
> It contains information that may be confidential. Unless you are the
> named addressee or an authorized designee, you may not copy or use it,
> or disclose it to anyone else. If you received it in error please notify
> us immediately and then destroy it.
>
>
> Compuware sp. z o.o. (registration number KRS 595) is a company
> registered in Poland whose registered office is at Ul. Dmowskiego
> 12,80-264 Gdansk Rejestr handlowy KRS 0000000595 Sadu Rejonowego
> Gdansk-Polnoc w Gdansku VII Wydzial Gospodarczy Kapital zakladowy
> 1.140.000 zl oplacony gotowka; NIP: 584-20-88-050; REGON: 191352920
>
>
> From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
> Sent: Wednesday, July 23, 2008 7:44 AM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] pcap_fopen_offline not exported?
>
> Actually, the function has not been exported because as far as I
> remember it
> doesn't work on Windows. The reason is the usual one with MS C RunTimes
> (CRTs): you cannot pass FILE* handlers between modules compiled with
> different versions of the CRT.
>
> Have a nice day
> GV
>
>
> ----- Original Message ----- 
> From: "Guy Harris" <guy at alum.mit.edu>
> To: <winpcap-users at winpcap.org>
> Sent: Tuesday, July 22, 2008 6:54 PM
> Subject: Re: [Winpcap-users] pcap_fopen_offline not exported?
>
>
>>
>> On Jul 22, 2008, at 8:36 AM, Okraszewski, Marcin wrote:
>>
>>> I wanted to use pcap_fopen_offline which is mentioned in
> documentation
>>> as well as available in pcap.h. Unfortunately this  function is not
>>> exported by both 4.0.2 and 4.1 beta 4. Is it on  purpose or some
>>> oversight?
>>
>> Probably an oversight.  The .def files weren't updated when the
> libpcap
>> base of WinPcap was updated to a version that includes
>> pcap_fopen_offline(); the release notes for libpcap release that first
>
>> included them might not have mentioned that routine.
>>
>> (So what exactly *are* the benefits of requiring a .def file when you
>> build a dynamically-linked library?  No UN*X that I know of requires
> that
>> the exported functions be explicitly declared when you build a
>> dynamically-linked shared library....)
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users