Closed timwoj closed 3 years ago
Any thoughts on this? Or maybe pointers on where I can start looking into it myself? Zeek has a new release coming in the next few months and I'd love to get this fixed before then so I can make sure it works over there.
There's no reason it shouldn't work. linux_get_descriptor_type
is a Linux specific function use to determine what type of file descriptor was passed in by the caller (file, socket, other exotic resource type...). We need to know this so we can use resource specific eventing facilities for retrieving events.
The issue is that the FD returned by eventfd() doesn't have an st_mode type flag we recognise.
Could you try with 6095fad38ed43383f7499b6a079598d7e7cf3c33 and let me know the st_mode value that gets printed in the debug output.
Here's that output:
KQ [13932]: linux_get_descriptor_type(): fd=10 unknown fd type, st_mode=0x0: Bad file descriptor (errno=9)
Great, thank you!
The Zeek project had a user report that libkqueue returns an error when used with a load-balanced pf-ring zero-copy interface. The pf_ring-zc system uses eventfd for load balanced interfaces. A call to
kevent()
returns a "Bad Address" error when adding the interface.Does libkqueue support eventfd descriptors? I haven't tried to reduce it down to a simple example where I just open an eventfd manually, but opening the load-balanced interface via libpcap and then trying to pass that FD into libkqueue definitely fails. I have a pf_ring interface all set up here for testing so I can definitely provide any information you need. For starters, here's a debug log:
We do know that libpcap supports these interfaces correctly. Earlier versions of our software worked with them, prior to our change over to use libkqueue.