Re: RFC: a loadable plugin framework for external capture backends

[Michael Richardson <mcr () sandelman ca>]

Robin Jarry via tcpdump-workers <tcpdump-workers () lists tcpdump org> wrote:
    > Michael Richardson, Oct 02, 2026 at 16:10:
    >> If the loader is off by default, and the end-user uas to recompile libpcap
    >> to enable plugins, (and the plugin has to be compiled), then why do we need
    >> it dynamic?
    >>
    >> If someone (redhat, ubuntu, ...) are shipping DPDK-enabled distros with
    >> some application (OVS, whatever), then you'd build libpcap that way
    >> there. It's what ships as libpcap in RHEL, U-server LTS 26, ... that
    >> concerns us. (and... it's not just the actual bugs anymore, it's the slop
    >> that might get triggered...)

    > For packaging purposes, you cannot know in advance which plugins will be
    > installed and you generally don't want to compile the plugins as part of
    > libpcap that is the whole point of our proposal. They wouldn't be real
    > "plugins" if that was necessary. We would go back to either a downstream
    > maintained fork/patch or a built-in backend disabled by default (like DPDK
    > was before I removed it for 0.11.0).

Yes, so, having libpcap "by default" with plugins off, but all the distros
compile with it on, then it is for most users, effectively, on.

    > However, the very fact that you *have* plugin support in libpcap could be
    > opt-out at build time, for any reason you might have (e.g. security). In that
    > case, plugins would not be discovered/loaded at all.

    > Am I making sense here?

If it's effectively enabled by default, then it's an attack surface that
maintainers have to pay attention to :-)
That's the point here.

One interesting possibility if current libpcap *is* just a plugin itself (as
I think Bill Fenner suggested) and the plugin ABI *is* _libpcap2_ (or another
name), then this offers a new way of doing pcap-write vs pcapng-write, and
also allows the usb and other things to also be split out.

Maybe there is a small number of helper functions that would remain in a libpcap.
(and maybe that's a .a file only, because it's ~five small functions)

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     mcr () sandelman ca  http://www.sandelman.ca/        |   ruby on rails    [

_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s