Skip to content

[3.0.0 prep] New pcap_* bindings - #403

Open
cicku wants to merge 7 commits into
rust-pcap:mainfrom
cicku:2-new-bindings
Open

[3.0.0 prep] New pcap_* bindings#403
cicku wants to merge 7 commits into
rust-pcap:mainfrom
cicku:2-new-bindings

Conversation

@cicku

@cicku cicku commented Aug 24, 2026

Copy link
Copy Markdown
Contributor
  • pcap_init
  • pcap_dump_ftell
  • pcap_dump_ftell64
  • pcap_dump_file
  • pcap_snapshot

pcap_init fixes #383 and supersedes #384.

Must be merged after #400, and a rebase will be done then.

@cicku
cicku force-pushed the 2-new-bindings branch 2 times, most recently from 506212a to acd0254 Compare September 2, 2026 16:51
@cicku
cicku marked this pull request as ready for review September 4, 2026 14:48
@cicku

cicku commented Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Ready:

Reason of additions:

  • pcap_init: Non-ASCII handling
  • pcap_dump_ftell64/ftell: Size-based file rotation needs
  • pcap_snapshot: For Capture<Offline> the snapshot length comes from the file header and is otherwise unknowable

I'm open to drop pcap_dump_file if you feel like certain low level functions are not needed. Instead one can always flush() and offset().

@Wojtek242 Wojtek242 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. One minor comment to update a comment.

Comment thread src/lib.rs
};
// libpcap has no entry points taking wide strings. It reads the path in the local code page,
// or in UTF-8 once pcap_init has been asked for that, so give it the UTF-8 form. A path that
// is not valid UTF-8 holds an unpaired surrogate, which has no form libpcap would accept.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not familiar with the term "unpaired surrogate". Is this a standard term in Windows or your term? If it's standard in Windows it can stay. If not, can you rephrase to rephrase this to make it a bit clearer?

@cicku cicku Sep 6, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is Unicode stuff. From U+D800 to U+DFFF are called (1x low + 1x high) surrogates and used for UTF-16. High and low surrogates must be in a pair to present anything higher than 2^16.

https://learn.microsoft.com/en-us/windows/win32/intl/surrogates-and-supplementary-characters

https://www.rfc-editor.org/info/rfc2781/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] reading pcap files on non UTF-8 Windows system fails due to convert path to str fails

2 participants