[Oisf-devel] [PATCH 1/2] Modify Packet structure and prepare accessor.

[Victor Julien]

Eric Leblond wrote:
>> Why is MAX_PAYLOAD_SIZE alloc'd here? We know what size we want, right?
>> And the ext_pkt is freed when the packet is returned to the packet pool,
>> so it's not for the next data read.
> 
> My idea was the following: suricata has to deal with weird packet and
> some frag may change the size of the global packet. I thus take the
> decision to allocate full length to avoid doing some reallocation in
> case of such behaviour. I may be wrong and in this case, I fully agree
> to use the provided packet length.

We only acquire a packet from the packet pool once we are certain about
it's full size, so there will be no resizing later.

>> Whats the purpose of having this here? The only place I see this
>> function in use is in the defrag engine. There the decoding will run
>> after this function has run. If any of the unittests depend on these
>> pointers being set here the tests are broken and need fixing :)
> 
> These modifications have been made for the same reason. If a frag
> announce a new length, we may need to move the data from static array to
> the allocated part. By the way, it make me think that almost the same
> should be done to PacketCopyData. I've wrongly assume that it will only
> be called from the source package.

In defrag, once we reassemble the full packet, we acquire a packet from
the pool. At that point the size is known and will remain the same. So
no resizing here either.

Cheers,
Victor

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------