Hello again, dear reader!
Another part of the research I'm doing entails capturing, processing, and storing network packet attributes. This is done in a nifty application that invol... oh, but that is a post on its own! What I'd like to share today is an interesting little way of sharing data between the packet capture process and another running process.
So here's the skinny: my application uses
libpcap to do packet capture. Pcap has a couple ways to process the packets it grabs off the wire, both of which are blocking. My code also has to answer queries from a single other process on the same machine. But, even if my while loop (if using
pcap_next()) or callback (if using
pcap_loop() or
pcap_dispatch()) checks
somehow for pending queries, the querying process has to wait until the pcap process gets another packet for that check to occur. The question arises: how can this application respond immediately to a query, regardless if packets are currently being captured?
Shared memory and multithreading is an option, as is pushing data to a separate database. But we want simple (my entire application is under 300 lines of code, counting the solution I describe here), and the machines I want to run this code on may not be able to support a database server. Besides, what's the fun in doing this if there isn't an opportunity for a bit of hackery?
It turns out that a combination of sockets and signals does just the trick. We're going to give the pcap process a listening Unix socket and and a function to handle signals, and let the OS do the rest of the work for us.
Before we jump into the code, let's making life simpler and take all this packet capture business out of the picture - that's complicated enough on its own, and may be the subject of another post in the future. Instead, let's say we have a table (2-D array) of students and the classes they must take. Each spot in the table is a struct with the quarter in which they took the class and the grade they received. That way we get a struct for the query (student and class) and another for the response (quarter and grade). And to keep things easy on ourselves, we'll make everything a number except for the grade, which will be a single character ('A', 'B', 'C', and so on).
Let's look at the code that processes a query (all error-checking has been removed for simplicity):
void handle_query(int sig) {
char buffer[BUF_SIZE];
int sd = accept(sock, NULL, NULL);
int len = recv(sd, buffer, BUF_SIZE, 0);
struct query *q = (struct query *)buffer;
struct record *r = &records[q->student][q->class];
send(sd, (char *)r, sizeof(struct record), 0);
close(sd);
}
Wow, that was easy! Looks a lot like the standard TCP server from a network programming 101 class, doesn't it? Accept a connection from a listening socket, receive a query, typecast it into a struct, do a lookup, send the result typecast as a byte array, and close the connection. If you haven't seen something similar before,
check this out or do a quick Google search for "Linux TCP server in C". I'll provide the definitions of
struct query and
struct record at the end; for now, just know that
sock and
records are global variables.
So what's with this funky-looking function declaration? It's a
void; that's okay, but what's this
int sig that never gets used in the function body? Well, this function isn't actually called by any code in the program per se; it's a signal handler. "A signal what?" you ask...
