mitrecnd / libnids Goto Github PK

Commit cd888d8 changed SONAME but at a quick check, it doesn't seem like this was necessary. This breaks compatibility with applications already linked against older libnids and forces them to be rebuilt.

Did the ABI of libnids actually change since the last release or was the SONAME just accidentally changed (here)?

[root@centos65 home]# g++ test.cpp -lpcap -lnet -lnids -lgthread-2.0
test.cpp: 在函数‘int main()’中:
test.cpp:195:44: 错误：从类型‘void ()(tcp_stream, void**)’到类型‘void*’的转换无效 [-fpermissive]
nids_register_tcp(tcp_protocol_callback);
^
In file included from test.cpp:1:0:
/usr/local/include/nids.h:149:6: 附注：initializing argument 1 of ‘void nids_register_tcp(void*)’
void nids_register_tcp (void (*));

#include
#include
#include <stdio.h>

extern "C" {
#include <nids.h>
}

void tcp_callback(struct tcp_stream * s, void ** x)
{
// never print
std::cout << "tcp callback 1" << std::endl;

// ok
printf("tcp callback 2\n");

}

int main()
{
if (!nids_init ())
{
std::cout << "nids init error: " << nids_errbuf << std::endl;
return 1;
}
std::cout << "init ok" << std::endl;
nids_register_tcp ((void *)tcp_callback);
nids_run ();
return 0;
}

why std::cout never print,but printf works in tcp_callback.

I was wondering why packets' payload is stored as a char pointer, Would not that corrupt data because of the special characters which could not be represented as a char? I tried to print data or write it to file, and part of the data is corrupted.

Libnids有多线程的模式，我看源码是通过一个异步的线程安全队列来实现的，libpcap 捕获到的流量存入异步队列，然后有另外的线程从异步队列中进行流量获取进行流量的还原，但是我发现源码中流量捕获与流量还原都是在单线程中完成的，难道Libnids的多线程说的只是流量捕获和流量还原不在同一个线程吗？

Using this issue to brainstorm packet processing library test cases