Apple

I implemented an iff_event_func callback in my interface filter NKE specifically to detect KEV_DL_IF_DETACHING and KEV_DL_IF_DETACHED events.

On both 10.8.5 and 10.9.1, I see that my function is called when I surprise-remove an interface, such as a USB-tethered phone. However, the event_code member of the kev_msg data has a value of 13 (KEV_DL_LINK_ON) instead of 10 (KEV_DL_IF_DETACHING).

I verified that the iff_event_func callback with event_code == 13 is made before the call to my iff_detached_func function, so the iff_event_func call appears to notifying my NKE about an upcoming detachment. However, I can't see why I'm getting KEV_DL_LINK_ON instead of KEV_DL_IF_DETACHING.

Here's a snippet of my iff_event_func callback:

void filter_event(

void *cookie,

ifnet_t interface,

protocol_family_t protocol,

const struct kev_msg *event_msg)

{

PFILTER_CONTEXT pFilter = (PFILTER_CONTEXT)cookie;

if ((event_msg->vendor_code == KEV_VENDOR_APPLE) &&

(event_msg->kev_class == KEV_NETWORK_CLASS) &&

(event_msg->kev_subclass == KEV_DL_SUBCLASS))

{

switch (event_msg->event_code)

{

case KEV_DL_IF_DETACHING:

So, why am I getting event_code == 13 and not event_code == 10 before my filter’s detach function is called? Under what conditions would I get KEV_DL_IF_DETACHING since I do not get that event now?

Thanks!