March 2004 - Darwin-kernel - lists.apple.com

Re: Error codes
by Justin Walker 22 Mar '04

22 Mar '04

On Mar 22, 2004, at 15:34, Matt Jaffa wrote: So do OT/Classic developers or experts usually watch this list, or is there some other way of contacting them? There are a number of them that watch both this list and the MacNetworkProg list (see <http://lists.apple.com>). Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Error codes
by Matt Jaffa 22 Mar '04

22 Mar '04

So do OT/Classic developers or experts usually watch this list, or is there some other way of contacting them? Thanks, Matt On Mar 22, 2004, at 10:08 AM, Justin Walker wrote: On Mar 22, 2004, at 7:59, Matt Jaffa wrote: I was wondering what error code I should throw. You may not be alone :-} I am intercepting TCP traffic through my KEXT, after the result comes back from the daemon and I want to block the traffic, What is the best error to throw that will let internet explorer in classic not try the URL again. It works for Safari and IE(non classic version) if I use ENETDOWN, EACCES, and they don't try it again. But when I am using those errors for Classic's IE it blocks but keeps trying the URL over and over again. There could be many reasons for this behavior, and you'll need an OT expert to unravel them... - Classic, and OT in particular, was not built with Unix-style errno codes in mind. The deeper recesses of OT do use the same error code names, though, but they use a different version of the header <sys/errno.h>. In particular, it's possible that EACCES (on Mac OS X) and EAGAIN (on Classic/OT/Mentat) (for example) share the same numeric code. That would be a bummer, of course. An OT expert will have to share his understanding of this one. - The Classic version of IE doesn't know what to do with EACCES. Again, an OT expert may have the answer. - The error code returned by your NKE gets lost somewhere between your NKE and IE; if it doesn't get lost, it gets translated; see the previous two comments. I think you get the drift. It's not a problem that can easily be solved, since the two systems (Mac OS X and Classic/OT) were never intended to merge smoothly together. Hope that helps clarify things (and, perhaps, prompts someone with Knowledge to pipe up). Cheers, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | If you're not confused, | You're not paying attention *-------------------------------------- *-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Protocol filter vs. Socket filter
by Joshua Graessley 22 Mar '04

22 Mar '04

By using a PF_NDRV socket, classic is sending using using the PF_NDRV protocol, not PF_INET. If you wanted to capture packets from classic, you would need to install a protocol filter for PF_NDRV. You would still need the PF_INET filter to capture inbound packets in addition to any packets that the X stack was sending. I would recommend using an interface filter. You will receive every packet on the interface regardless of which protocol attachment was used. If the packet is not an IP packet, return 0 immediately. There is a bit more overhead since you have to inspect every packet, and you have to know more about how to identify the packets. -josh On Mar 20, 2004, at 11:55 AM, Matt Jaffa wrote: > Hi, > > I did some reading into the archives and it seems others had this > issue, > where the PF_NDRV socket didn't send the packets through the DLIL , so > no wonder my > program is not picking up the packets. > > Well the posts said they were trying to get it into way back in 10.1.x, > > Is this still not fixed, and if not I guess I must use a socket filter > on the Classic related stuff. > > Or unless I am not filtering the DLIL right to get the classic traffic. > > Anyone know what is up with this issue? > > Thanks [demime 0.98b removed an attachment of type application/pkcs7-signature which had a name of smime.p7s] _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Error codes
by Justin Walker 22 Mar '04

22 Mar '04

On Mar 22, 2004, at 7:59, Matt Jaffa wrote: I was wondering what error code I should throw. You may not be alone :-} I am intercepting TCP traffic through my KEXT, after the result comes back from the daemon and I want to block the traffic, What is the best error to throw that will let internet explorer in classic not try the URL again. It works for Safari and IE(non classic version) if I use ENETDOWN, EACCES, and they don't try it again. But when I am using those errors for Classic's IE it blocks but keeps trying the URL over and over again. There could be many reasons for this behavior, and you'll need an OT expert to unravel them... - Classic, and OT in particular, was not built with Unix-style errno codes in mind. The deeper recesses of OT do use the same error code names, though, but they use a different version of the header <sys/errno.h>. In particular, it's possible that EACCES (on Mac OS X) and EAGAIN (on Classic/OT/Mentat) (for example) share the same numeric code. That would be a bummer, of course. An OT expert will have to share his understanding of this one. - The Classic version of IE doesn't know what to do with EACCES. Again, an OT expert may have the answer. - The error code returned by your NKE gets lost somewhere between your NKE and IE; if it doesn't get lost, it gets translated; see the previous two comments. I think you get the drift. It's not a problem that can easily be solved, since the two systems (Mac OS X and Classic/OT) were never intended to merge smoothly together. Hope that helps clarify things (and, perhaps, prompts someone with Knowledge to pipe up). Cheers, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | If you're not confused, | You're not paying attention *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Error codes
by Matt Jaffa 22 Mar '04

22 Mar '04

Hi, I was wondering what error code I should throw. I am intercepting TCP traffic through my KEXT, after the result comes back from the daemon and I want to block the traffic, What is the best error to throw that will let internet explorer in classic not try the URL again. It works for Safari and IE(non classic version) if I use ENETDOWN, EACCES, and they don't try it again. But when I am using those errors for Classic's IE it blocks but keeps trying the URL over and over again. Any suggestions which one to use for classic? Thanks, Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Protocol filter vs. Socket filter
by Matt Jaffa 20 Mar '04

20 Mar '04

Hi, I did some reading into the archives and it seems others had this issue, where the PF_NDRV socket didn't send the packets through the DLIL , so no wonder my program is not picking up the packets. Well the posts said they were trying to get it into way back in 10.1.x, Is this still not fixed, and if not I guess I must use a socket filter on the Classic related stuff. Or unless I am not filtering the DLIL right to get the classic traffic. Anyone know what is up with this issue? Thanks On Mar 20, 2004, at 12:30 PM, Matt Jaffa wrote: Hi, I am using a protocol filter over a Socket Filter. I was using a socket filter, but decided to switch to a protocol filter. It picks up all outgoing traffic just fine, except for Classic traffic. I was trying to look at the SharedIP.KEXT to know where the packets go after being intercepted by the RAW socket filter, it looks like it is injecting the packet into a protocol, So why doesn't my Protocol filter below pick it up? here is some code: TAILQ_FOREACH(ifp, &ifnet, if_link) { printf("This is the name: %s, This is the number: %d \n",ifp->if_name, ifp->if_unit); if(( bcmp(ifp->if_name,"en",strlen(ifp->if_name))== 0) && (ifp->if_unit == 1) ) { sprintf(bsdName, "%s%d", ifp->if_name, ifp->if_unit); printf("Install filter on bsdname = %s\n", bsdName); if ((retval = dlil_find_dltag(ifp->if_family, ifp->if_unit, PF_INET, &ip_dltag)) == 0) { //newIPv4Filter = _MALLOC(sizeof(struct dlil_pr_flt_str),M_TEMP,M_WAITOK); // add this filter to the list so that you can free the mem later. ipv4Filter = (struct dlil_pr_flt_str) { bsdName,NULL, dlil_v4_outfltr, 0, 0, dlil_v4_detach }; retval = dlil_attach_protocol_filter(ip_dltag, &ipv4Filter, &ipv4ID, DLIL_LAST_FILTER); } } } Thanks _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Protocol filter vs. Socket filter
by Matt Jaffa 20 Mar '04

20 Mar '04

Hi, I am using a protocol filter over a Socket Filter. I was using a socket filter, but decided to switch to a protocol filter. It picks up all outgoing traffic just fine, except for Classic traffic. I was trying to look at the SharedIP.KEXT to know where the packets go after being intercepted by the RAW socket filter, it looks like it is injecting the packet into a protocol, So why doesn't my Protocol filter below pick it up? here is some code: TAILQ_FOREACH(ifp, &ifnet, if_link) { printf("This is the name: %s, This is the number: %d \n",ifp->if_name, ifp->if_unit); if(( bcmp(ifp->if_name,"en",strlen(ifp->if_name))== 0) && (ifp->if_unit == 1) ) { sprintf(bsdName, "%s%d", ifp->if_name, ifp->if_unit); printf("Install filter on bsdname = %s\n", bsdName); if ((retval = dlil_find_dltag(ifp->if_family, ifp->if_unit, PF_INET, &ip_dltag)) == 0) { //newIPv4Filter = _MALLOC(sizeof(struct dlil_pr_flt_str),M_TEMP,M_WAITOK); // add this filter to the list so that you can free the mem later. ipv4Filter = (struct dlil_pr_flt_str) { bsdName,NULL, dlil_v4_outfltr, 0, 0, dlil_v4_detach }; retval = dlil_attach_protocol_filter(ip_dltag, &ipv4Filter, &ipv4ID, DLIL_LAST_FILTER); } } } Thanks _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: LOCAL_PEERCRED and getpeereid
by Etsushi Kato 19 Mar '04

19 Mar '04

On 2004/03/15, at 7:18 PM, Quinn wrote: At 0:02 +0900 6/3/04, Etsushi Kato wrote: P.S. Is it the proper list for sending patches? No. You can get patches in Darwin in two different ways. 1. OpenDarwin -- Look at the information on <http://www.opendarwin.org>. 2. Apple Bug Report -- If you file a bug against Mac OS X, you can include your code along with the report. One of our engineers will then look at your bug report and potentially fix the bug using your code. <http://developer.apple.com/bugreporter/> OK. I've filed this on the Bug Report system. I hope getpeereid() will be included in the future version of Darwin. Cheers, -- Etsushi Kato ekato(a)ees.hokudai.ac.jp _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Getting the right data out of mbuf
by Justin Walker 19 Mar '04

19 Mar '04

On Thursday, March 18, 2004, at 05:35 PM, Matt Jaffa wrote: Hi, I have a dlil filter, dynamic link layer nke. I am interested in getting the data out of the mbuf. The m_data field points to the beginning of valid data, and m_len tells you how much data from that point, *for this mbuf*, is valid. Note that I am using the "m_" fields, not the "mh_" fields. Always use the former, unless you have a *very* good reason not to. I have isolated it down to a TCP header with flags SYN and ACK set, I What is "it" that you have isolated? am getting the header alright, but need to get the data of the TCP. What is "the TCP"? in the mbuf m_next is not NULL so I go to that mbuf, Why don't you look in the current mbuf? Why go directly to the next one? and when I check the m_len of that mbuf, it says that it is > 256 which means it is in an external storage place. And according to the message header: NO! the value of the m_len field is *not* the indicator of "external" storage. If you make this assumption, you are making a critical error. The *only* valid indicator of external storage is the M_EXT bit in the m_flags field. mh_data contains the location of the data, Do *not* use 'mh_data' in your code. Use 'm_data'. how do I use this variable to extract the data, and what do I store it in? char * ? If you want to look at the data beginning at 'm_data', you need to use the 'mtod' macro. For example, assuming that the packet begins with a tcp header, you would use something like struct mbuf *mb = ...; struct tcphdr *tp = mtod(mb, struct tcphdr *); Be aware that this is only useful when the structure (or, in general, data) you want is at the beginning of the mbuf's data area. I have been reading the TCP/IP vol. 2 book, it only says that is where the data is stored, but not how to extract it. I am pretty sure that Stevens discusses this (say, at p. 46). In any case, since you have the address of the data, I don't understand how you can not know how to access it. What do you mean by "extract"? Regards, Justin -- /~\ The ASCII Justin C. Walker, Curmudgeon-at-Large \ / Ribbon Campaign X Help cure HTML Email / \ _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Getting the right data out of mbuf
by Matt Jaffa 19 Mar '04

19 Mar '04

Hi, I have a dlil filter, dynamic link layer nke. I am interested in getting the data out of the mbuf. I have isolated it down to a TCP header with flags SYN and ACK set, I am getting the header alright, but need to get the data of the TCP. in the mbuf m_next is not NULL so I go to that mbuf, and when I check the m_len of that mbuf, it says that it is > 256 which means it is in an external storage place. And according to the message header: struct m_hdr { struct mbuf *mh_next; /* next buffer in chain */ struct mbuf *mh_nextpkt; /* next chain in queue/record */ long mh_len; /* amount of data in this mbuf */ caddr_t mh_data; /* location of data */ short mh_type; /* type of data in this mbuf */ short mh_flags; /* flags; see below */ }; mh_data contains the location of the data, how do I use this variable to extract the data, and what do I store it in? char * ? I have been reading the TCP/IP vol. 2 book, it only says that is where the data is stored, but not how to extract it. Any help would be appreciated, Thanks, Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0