[Ntop-dev] pf_ring in a mixed 64-/32-bit environment

[Phil Sutter]

Dear list,

the pf_ring interface to the kernel seems to be broken when wordlengths
differ between userspace and kernel. In our case we're using a 64-bit
kernel with 32-bit userland (x86_64 architecture).

The culprit is the 'ts' field in struct pfring_pkthdr, which is of type
struct timeval. The latter's two fields tv_sec and tv_usec are both
defined to long on x86 and therefore depend on wordlength.

Fixing the problem seems non-trivial, since though there is a struct
compat_timeval, detecting 32-bit users is not as easy as with ioctl
callbacks. And even if this was known, adding conditionals to all places
in pf_ring.c where struct pfring_pkthdr is being used would make it all
a bit messy. Using struct compat_timeval for all cases is neither an
option, since that should break pcap compatibility with 64-bit
userlands.

Please advise.

Best wishes,

Phil Sutter
Software Engineer

-- 
Viprinet GmbH
Mainzer Str. 43
55411 Bingen am Rhein
Germany

Phone/Zentrale:         +49-6721-49030-0
Direct line/Durchwahl:  +49-6721-49030-134
Fax:                    +49-6721-49030-209

phil.sutter at viprinet.com
http://www.viprinet.com

Registered office/Sitz der Gesellschaft: Bingen am Rhein
Commercial register/Handelsregister: Amtsgericht Mainz HRB40380
CEO/Geschäftsführer: Simon Kissel