September 2004 - Darwin-kernel

Disappearing Driver
by Brent Marykuca 21 Sep '04

21 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Questions: Many thanks if you can shed any light on what's just happened here. Cheers, Brent Marykuca _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm not working in the kernel, but I just experienced some behavior that I hope that someone can explain for me, because I'm totally at a loss. The scenario is that I have an application which talks to a serial device using POSIX serial commands. The device connection is USB and the vendor of the USB chip has provided a kernel driver which lets us use the POSIX interfaces. Earlier today, I ran the application a few times. I have logs that show connections to the device. This evening when I ran the app, it reported there was no device. I checked kextstat and the driver was no longer loaded. I checked /System/Library/Extensions and the kext was no longer even there. (I didn't delete it or unload the kext). I haven't restarted my machine in three days. I check the system log and see this: ... Sep 20 16:06:36 Gemini kernel: jnl: close: flushing the buffer cache (start 0x73e000 end 0x742400) Sep 20 16:07:58 Gemini kernel: UniNEnet::monitorLinkStatus - Link is up at 100 Mbps - Full Duplex Sep 20 16:47:22 Gemini kextd[4363]: error mapping module file /System/Library/Extensions/WalkAndTalkSerial.kext/Contents/MacOS/ FTDIUSBSerialDriver Sep 20 16:47:22 Gemini kextd[4363]: can't map module files Sep 20 16:47:22 Gemini kextd[4363]: can't check load addresses of modules Sep 20 16:47:22 Gemini kextd[4363]: a link/load error occured for kernel extension /System/Library/Extensions/WalkAndTalkSerial.kext Sep 20 16:48:54 Gemini kernel: jnl: journal start/end pointers reset! (jnl 0x2696c88; s 0x742400 e 0x742400) Sep 20 16:48:54 Gemini diskarbitrationd[136]: disk1s6 hfs 0409E0E9-6206-3610-AB17-9287A2E688C5 Extra /Volumes/Extra So, it looks like at 16:47:22 something happened to cause a kextd error. Based on the messages, it looks like the kext got deleted and kextd got an error. 1. I thought kexts were kept in wired memory and remained loaded even if you deleted the executable. Am I wrong about this? I think my experience with previous versions of Mac OS gave me this impression. Why would kextd be running on my driver if it had been loaded for three days? 2. Where did my kext go? I certainly didn't touch it. Do the messages from the journal have any significance? This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Jeff Nathan 20 Sep '04

20 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 HI Matt, Justin, I've been watching this silently. #define IP_V(ip) (((ip)->ip_vhl & 0xf0) >> 4) #define IP_HL(ip) ((ip)->ip_vhl & 0x0f) - -Jeff On Sep 18, 2004, at 11:26 PM, Matt Jaffa wrote: this helps a lot, Is my mbuf set up wrong?? Matt On Sep 17, 2004, at 11:39 PM, Justin Walker wrote: On Sep 17, 2004, at 21:55, Matt Jaffa wrote: Here is how I am formulating my IP header: newip->ip_hl = 5; newip->ip_v = ipHeader->ip_v; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip->ip_v); printf("newipheader: %d\n", newip->ip_hl); BTW, I would set ip_off to zero. newip->ip_ttl = 35; newip->ip_p = ipHeader->ip_p; newip->ip_sum = 0; You compute the checksum later, right? Regards, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jeff%40snort.org - -- http://cerberus.sourcefire.com/~jeff (gpg/pgp key id 6923D3FD) "Common sense is the collection of prejudices acquired by age eighteen." - Albert Einstein -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFBTxw8Eqr8+Gkj0/0RAsMxAJoDyLtbbeJRDWeT3OIX1SAF86EfGwCeI7rv nR26y0WGZHzhPv5cMEa2yi4= =CN6I -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I wouldn't use the nibbles for IP version and header length. To avoid alignment problems tcpdump uses these macros: you could these macros to achieve the opposite result: #define SET_IP_V(ip, value) ((ip)->ip_vhl = (((ip)->ip_vhl & 0x0f) | (value << 4))) #define SET_IP_HL(ip, value) ((ip)->ip_vhl = (((ip)->ip_vhl & 0xf0) | (value & 0x0f))) I am using MGET now, and not using MALLOC for the mbuf to save myself the trouble of later problems. Now when I print out the hex values of the whole mbuf, they are all printing out correct. But now when I inject this mbuf into the input, the system crashes. But if I comment out the dlil_inject_if_input, it doesn't crash. char * httpresponse = (char*)_MALLOC(180,M_FREE,M_NOWAIT); sprintf(httpresponse,"HTTP/1.1 200 OK\r\nCache-Control: no-store, no-cache\r\nContent-Type: text/html\r\n\r\n <HTML><BODY>This is the block page</BODY></HTML>"); struct mbuf * testin; MGET(testin,M_NOWAIT,M_MBUF); struct ip newip;// = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); u_char vhl = 0x45; memcpy(&newip, &vhl,1); newip.ip_hl = 5; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip.ip_v); printf("newipheader: %d\n", newip.ip_hl); newip.ip_v = 4;//ipHeader->ip_v; newip.ip_tos = 0;//ipHeader->ip_tos; int data_len = strlen(httpresponse); newip.ip_len = sizeof(struct ip) + sizeof(struct tcphdr) + data_len; newip.ip_id = 34234; newip.ip_off = 0x0000; newip.ip_ttl = 35; newip.ip_p = ipHeader->ip_p; newip.ip_sum = 0; memcpy(&(newip.ip_src), &(ipHeader->ip_dst), sizeof(struct in_addr)); memcpy(&(newip.ip_dst), &(ipHeader->ip_src), sizeof(struct in_addr)); struct tcphdr newtcp;// = (struct tcphdr*)_MALLOC(sizeof(struct tcphdr),M_FREE,M_NOWAIT); newtcp.th_sport = tester->th_dport; newtcp.th_dport = tester->th_sport; newtcp.th_ack = tester->th_seq; newtcp.th_seq = htons(tester->th_seq +1); newtcp.th_flags = (TH_ACK|TH_FIN|TH_PUSH); newtcp.th_off = sizeof(struct tcphdr); newtcp.th_x2 = 0; newtcp.th_win = 65535; newtcp.th_sum = 0; newtcp.th_urp = 0; testin->m_data += 20; memcpy(testin->m_data,&newip,sizeof(struct ip)); testin->m_len = sizeof(struct ip); testin->m_pkthdr.len = sizeof(struct ip); testin->m_data += sizeof(struct ip); memcpy(testin->m_data,&newtcp,sizeof(struct tcphdr)); testin->m_data += sizeof(struct tcphdr); memcpy(testin->m_data,httpresponse,data_len); testin->m_len = (sizeof(struct ip) + sizeof(struct tcphdr) + data_len); testin->m_pkthdr.len = (sizeof(struct ip) + sizeof(struct tcphdr) + data_len); testin->m_data -= (sizeof(struct ip) + sizeof(struct tcphdr)); unsigned char * test = mtod(testin, unsigned char*); int i = 0; while(i < testin->m_pkthdr.len) { printf("%x ",test[i]); i++; } printf("\n"); int testing = dlil_inject_if_input(testin,frame_type,ipv4ID); printf("Here is the result: %d\n", testing); So I have a IP header 20 bytes, and a TCP header 20 bytes, no options, and data for the TCP, not shown is the checksum calculating, but that is not crashing, it is the dlil_inject_if_input, it doesn't like my mbuf. Anyone notice anything bad? Sequence and Ack I know is wrong but don't know how to fix it. Any help on the mbuf injecting and the Seq and Ack would be great thanks. ipHeader is the ip header pulled out from the mbuf that I am not letting out into the internet. struct ip* newip = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); Why are you using _MALLOC instead of (say) MGET? You may be asking for trouble here, unless you are taking care of properly releasing this storage. Well, what do the printf's say? FWIW, the kernel code defines _IP_VHL, and refers to the two fields as the combined field 'ip_vhl'. Why not print a hex dump of the first few bytes of the two IP headers? That may provide a clue (and it avoids any funky behavior based on bit-field operations). newip->ip_tos = 0; int data_len = strlen(httpresponse); // this is the HTTP/1.1 response length of the tcp data I will inject into the input I assume the length of this canned response is small enough that you don't have to worry about overflowing whatever you are using for buffers. newip->ip_len = sizeof(struct ip) + sizeof(struct tcphdr) + data_len; newip->ip_id = 34234; newip->ip_off = 0x4000; memcpy(&(newip->ip_src), &(ipHeader->ip_dst), sizeof(struct in_addr)); memcpy(&(newip->ip_dst), &(ipHeader->ip_src), sizeof(struct in_addr)); For correctness, you might want to assure that the values you are copying are in network order (since the IP stack has set it up that way on output). For PowerPC, host order and network order are the same, but it pays to keep this straight in your code. despite the fact that some of the other stuff might be wrong, why wouldn't the ip_v be the right version? The output does print out 4 like it should be. Any number of things could be wrong. One obvious possibility is that when you finally cons up the frame you inject, you aren't matching the assumptions of the input processing, so that when that code looks looks at the IP header, it's not seeing your IP header (e.g., there should be an ethernet header, but isn't; or there is an ethernet header, but there should not be one). To emphasize a point above, do *not* allocate mbufs other than by MGET (or similar call) unless you are actually obeying all the rules for supplying your own buffers (and freeing same). -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *-------------------------------------- *-------------------------------* This email sent to jeff(a)snort.org This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matthew Jaffa 20 Sep '04

20 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Matt From: Matt Jaffa <matt(a)knowligent.com> To: Justin Walker <justin(a)mac.com> CC: darwin-kernel Dev <darwin-kernel(a)lists.apple.com> Subject: Re: dlil_inject_if_input Date: Sat, 18 Sep 2004 21:26:40 -0600 this helps a lot, Is my mbuf set up wrong?? struct mbuf * testin; MGET(testin,M_NOWAIT,M_MBUF); newip.ip_hl = 5; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip.ip_v); printf("newipheader: %d\n", newip.ip_hl); newip.ip_v = 4;//ipHeader->ip_v; newip.ip_tos = 0;//ipHeader->ip_tos; int data_len = strlen(httpresponse); newip.ip_len = sizeof(struct ip) + sizeof(struct tcphdr) + data_len; newip.ip_id = 34234; newip.ip_off = 0x0000; newip.ip_ttl = 35; newip.ip_p = ipHeader->ip_p; newip.ip_sum = 0; memcpy(&(newip.ip_src), &(ipHeader->ip_dst), sizeof(struct in_addr)); memcpy(&(newip.ip_dst), &(ipHeader->ip_src), sizeof(struct in_addr)); newtcp.th_ack = tester->th_seq; newtcp.th_seq = htons(tester->th_seq +1); newtcp.th_flags = (TH_ACK|TH_FIN|TH_PUSH); newtcp.th_off = sizeof(struct tcphdr); newtcp.th_x2 = 0; newtcp.th_win = 65535; newtcp.th_sum = 0; newtcp.th_urp = 0; testin->m_data += 20; memcpy(testin->m_data,&newip,sizeof(struct ip)); testin->m_len = sizeof(struct ip); testin->m_pkthdr.len = sizeof(struct ip); testin->m_data += sizeof(struct ip); memcpy(testin->m_data,&newtcp,sizeof(struct tcphdr)); testin->m_data += sizeof(struct tcphdr); memcpy(testin->m_data,httpresponse,data_len); unsigned char * test = mtod(testin, unsigned char*); int i = 0; while(i < testin->m_pkthdr.len) { printf("%x ",test[i]); i++; } printf("\n"); int testing = dlil_inject_if_input(testin,frame_type,ipv4ID); printf("Here is the result: %d\n", testing); Matt On Sep 17, 2004, at 11:39 PM, Justin Walker wrote: On Sep 17, 2004, at 21:55, Matt Jaffa wrote: Here is how I am formulating my IP header: newip->ip_hl = 5; newip->ip_v = ipHeader->ip_v; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip->ip_v); printf("newipheader: %d\n", newip->ip_hl); newip->ip_len = sizeof(struct ip) + sizeof(struct tcphdr) + data_len; newip->ip_id = 34234; newip->ip_off = 0x4000; BTW, I would set ip_off to zero. newip->ip_ttl = 35; newip->ip_p = ipHeader->ip_p; newip->ip_sum = 0; You compute the checksum later, right? Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *-------------------------------------- *-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/mtjaffa%40msn.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Disregard this, Justin has already replied on this. Apparently the list server just approved of this going through since it was oversized at the time of posting it. I am using MGET now, and not using MALLOC for the mbuf to save myself the trouble of later problems. Now when I print out the hex values of the whole mbuf, they are all printing out correct. But now when I inject this mbuf into the input, the system crashes. But if I comment out the dlil_inject_if_input, it doesn't crash. char * httpresponse = (char*)_MALLOC(180,M_FREE,M_NOWAIT); sprintf(httpresponse,"HTTP/1.1 200 OK\r\nCache-Control: no-store, no-cache\r\nContent-Type: text/html\r\n\r\n <HTML><BODY>This is the block page</BODY></HTML>"); struct ip newip;// = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); u_char vhl = 0x45; memcpy(&newip, &vhl,1); struct tcphdr newtcp;// = (struct tcphdr*)_MALLOC(sizeof(struct tcphdr),M_FREE,M_NOWAIT); newtcp.th_sport = tester->th_dport; newtcp.th_dport = tester->th_sport; testin->m_len = (sizeof(struct ip) + sizeof(struct tcphdr) + data_len); testin->m_pkthdr.len = (sizeof(struct ip) + sizeof(struct tcphdr) + data_len); testin->m_data -= (sizeof(struct ip) + sizeof(struct tcphdr)); So I have a IP header 20 bytes, and a TCP header 20 bytes, no options, and data for the TCP, not shown is the checksum calculating, but that is not crashing, it is the dlil_inject_if_input, it doesn't like my mbuf. Anyone notice anything bad? Sequence and Ack I know is wrong but don't know how to fix it. Any help on the mbuf injecting and the Seq and Ack would be great thanks. ipHeader is the ip header pulled out from the mbuf that I am not letting out into the internet. struct ip* newip = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); Why are you using _MALLOC instead of (say) MGET? You may be asking for trouble here, unless you are taking care of properly releasing this storage. Well, what do the printf's say? FWIW, the kernel code defines _IP_VHL, and refers to the two fields as the combined field 'ip_vhl'. Why not print a hex dump of the first few bytes of the two IP headers? That may provide a clue (and it avoids any funky behavior based on bit-field operations). newip->ip_tos = 0; int data_len = strlen(httpresponse); // this is the HTTP/1.1 response length of the tcp data I will inject into the input I assume the length of this canned response is small enough that you don't have to worry about overflowing whatever you are using for buffers. memcpy(&(newip->ip_src), &(ipHeader->ip_dst), sizeof(struct in_addr)); memcpy(&(newip->ip_dst), &(ipHeader->ip_src), sizeof(struct in_addr)); For correctness, you might want to assure that the values you are copying are in network order (since the IP stack has set it up that way on output). For PowerPC, host order and network order are the same, but it pays to keep this straight in your code. despite the fact that some of the other stuff might be wrong, why wouldn't the ip_v be the right version? The output does print out 4 like it should be. Any number of things could be wrong. One obvious possibility is that when you finally cons up the frame you inject, you aren't matching the assumptions of the input processing, so that when that code looks looks at the IP header, it's not seeing your IP header (e.g., there should be an ethernet header, but isn't; or there is an ethernet header, but there should not be one). To emphasize a point above, do *not* allocate mbufs other than by MGET (or similar call) unless you are actually obeying all the rules for supplying your own buffers (and freeing same). This email sent to mtjaffa(a)msn.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: which darwin project has ...... in it? (was "handling the stack?")
by Shawn Erickson 20 Sep '04

20 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 20, 2004, at 6:04 AM, Ben Dougall wrote: On Sunday, September 19, 2004, at 10:00 pm, Shawn Erickson wrote: XNU is the project that contains the core kernel code (static linked). For VM code... <http://www.opensource.apple.com/darwinsource/Current/xnu/osfmk/vm> thanks v. much. -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… one more: which darwin project contains mmap's implementation? If you do a man on mmap you see it is part of "sys" and in user mode that is likely bunched in the libc project under its "sys" directory. In this case mmap is a syscall (note the contents of SYSCALL_LIST). So that brings you back to xnu... the header is in bsd/sys/mman.h and implementation is in bsd/kern/kern_mman.h [1]. (i've got a slight feeling i might have asked that before, but i can't see how to search the archives at the moment -- is there really no way to search the list archives? that's a temporary situation right?) Yes they will be searchable by Google and others once they index the new Apple lists archive website (at least that is Apple's plan). [1] <http://www.opensource.apple.com/darwinsource/Current/xnu/bsd/kern/ kern_mman.c> This email sent to site_archiver(a)lists.apple.com

1 0

Re: which darwin project has ...... in it? (was "handling the stack?")
by Ben Dougall 20 Sep '04

20 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sunday, September 19, 2004, at 10:00 pm, Shawn Erickson wrote: XNU is the project that contains the core kernel code (static linked). For VM code... <http://www.opensource.apple.com/darwinsource/Current/xnu/osfmk/vm> thanks v. much. one more: which darwin project contains mmap's implementation? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… (i've got a slight feeling i might have asked that before, but i can't see how to search the archives at the moment -- is there really no way to search the list archives? that's a temporary situation right?) This email sent to site_archiver(a)lists.apple.com

1 0

dlil_inject_if_input problems
by Matt Jaffa 20 Sep '04

20 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com char * httpresponse = (*)_MALLOC(0000,0000,FFF7">180,M_FREE,M_NOWAIT); sprintf(httpresponse,"HTTP/1.1 200 OK\r\nCache-Control: no-store, no-cache\r\nContent-Type: text/html\r\n\r\n <HTML><BODY>This is the block page</BODY></HTML>"); struct mbuf * testin; MGETHDR(testin,M_NOWAIT,MT_HEADER); M_COPY_PKTHDR(testin, temp->m_orig); struct ip newip; u_char vhl = 0x45; memcpy(&newip, &vhl,1); newip.ip_hl = 5; newip.ip_v = 4; newip.ip_tos = 0; int data_len = strlen(httpresponse); newip.ip_len = (766E,0F07,5048">struct ip) + (766E,0F07,5048">struct tcphdr) + data_len; newip.ip_id = 34234; newip.ip_off = 0x0000; newip.ip_ttl = 35; newip.ip_p = ipHeader->ip_p; newip.ip_sum = 0; memcpy(&(newip.ip_src), &(ipHeader->ip_dst), (766E,0F07,5048">struct in_addr)); memcpy(&(newip.ip_dst), &(ipHeader->ip_src), (766E,0F07,5048">struct in_addr)); struct tcphdr newtcp; newtcp.th_sport = tester->th_dport; newtcp.th_dport = tester->th_sport; newtcp.th_ack = tester->th_seq; newtcp.th_seq = htons(tester->th_seq +1); newtcp.th_flags = (TH_ACK|TH_FIN|TH_PUSH); newtcp.th_off = 5; newtcp.th_x2 = 0; newtcp.th_win = 65535; newtcp.th_sum = 0; newtcp.th_urp = 0; struct pseudo_hdr test_hdr; test_hdr.ip_src = newip.ip_src; test_hdr.ip_dst = newip.ip_dst; test_hdr.protocol = newip.ip_p; test_hdr.reserved = 0; test_hdr.length = (766E,0F07,5048">struct tcphdr) + data_len; memcpy(testin->m_data,&newip,(766E,0F07,5048">struct ip)); testin->m_len = (766E,0F07,5048">struct ip); testin->m_pkthdr.len = (766E,0F07,5048">struct ip); unsigned short asum = in_cksum(testin, (766E,0F07,5048">struct ip)); printf("asum = %u\n", asum); newip.ip_sum = asum; memcpy(testin->m_data,&newip,(766E,0F07,5048">struct ip)); testin->m_data += (766E,0F07,5048">struct ip); memcpy(testin->m_data,&newtcp,(766E,0F07,5048">struct tcphdr)); testin->m_data += (766E,0F07,5048">struct tcphdr); memcpy(testin->m_data,httpresponse,data_len); testin->m_data += data_len; memcpy(testin->m_data,&test_hdr,(766E,0F07,5048">struct pseudo_hdr)); testin->m_data -= ((766E,0F07,5048">struct tcphdr) + data_len); testin->m_len = ((766E,0F07,5048">struct ip) + (766E,0F07,5048">struct tcphdr) + data_len); testin->m_pkthdr.len = ((766E,0F07,5048">struct ip) + (766E,0F07,5048">struct tcphdr) + data_len); unsigned short dsum = in_cksum(testin, ((766E,0F07,5048">struct tcphdr) + data_len + (766E,0F07,5048">struct pseudo_hdr))); newtcp.th_sum = dsum; memcpy(testin->m_data,&newtcp,(766E,0F07,5048">struct tcphdr)); testin->m_data -= (766E,0F07,5048">struct tcphdr); unsigned char * test = mtod(testin, unsigned char*); int i = 0; while(i < testin->m_pkthdr.len) { printf("%x ",test[i]); i++; } printf("\n"); unsigned short xsum = in_cksum(testin, (766E,0F07,5048">struct ip)); printf("xsum == %x(%d)\n", xsum,xsum); printf("Block Packet flags: %x\n", testin->m_flags); int testing = dlil_inject_if_input(testin,frame_type,ipv4ID); printf("Here is the result: %d\n", testing);

1 0

Re: which darwin project has ...... in it? (was "handling the stack?")
by Shawn Erickson 19 Sep '04

19 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 19, 2004, at 10:42 AM, Ben Dougall wrote: XNU is the project that contains the core kernel code (static linked). For VM code... <http://www.opensource.apple.com/darwinsource/Current/xnu/osfmk/vm> -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Saturday, September 18, 2004, at 09:10 pm, Mauricio David Cerda Villablanca wrote: Where in darwin can I see the code for the memory stack handling?, there is some library, or file where i can find the assembler code, for something like that (handle memory stack), for adapt a version using the PPC processor registers, and any hardware specific code?, I guest just need a simplify version, but the mac os x version should be similar to the code i'm looking for... i'd like to ask a more general version of the above question: is there a list of darwin projects with a brief description of each project's contents anywhere? or, how do you go about finding out which darwin project contains something that you'd like to see? or if there's not an easy way to do that, could someone tell me which darwin project contains mach virtual memory stuff please? This email sent to site_archiver(a)lists.apple.com

1 0

which darwin project has ...... in it? (was "handling the stack?")
by Ben Dougall 19 Sep '04

19 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com thanks, ben _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Saturday, September 18, 2004, at 09:10 pm, Mauricio David Cerda Villablanca wrote: Where in darwin can I see the code for the memory stack handling?, there is some library, or file where i can find the assembler code, for something like that (handle memory stack), for adapt a version using the PPC processor registers, and any hardware specific code?, I guest just need a simplify version, but the mac os x version should be similar to the code i'm looking for... i'd like to ask a more general version of the above question: is there a list of darwin projects with a brief description of each project's contents anywhere? or, how do you go about finding out which darwin project contains something that you'd like to see? or if there's not an easy way to do that, could someone tell me which darwin project contains mach virtual memory stuff please? This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matt Jaffa 19 Sep '04

19 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I will try and look at the mbuf needing a packet hdr type. And then study up Stevens TCP/IP book on the Seq/Ack stuff. Thanks for all the help you have been. Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I totally agree, I am in a networks class at college right now that is sort of teaching this stuff to me. But to get this project done I am skipping ahead and trying to learn it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Justin Walker 19 Sep '04

19 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Matt, On Sep 18, 2004, at 20:26, Matt Jaffa wrote: That's the way to bet. Don't forget to free this. struct mbuf * testin; MGET(testin,M_NOWAIT,M_MBUF); newip.ip_hl = 5; printf("ipHeader version: %d\n", ipHeader->ip_v); printf("ipHeader hdrleng: %d\n", ipHeader->ip_hl); printf("newipheader: %d\n", newip.ip_v); printf("newipheader: %d\n", newip.ip_hl); newip.ip_v = 4;//ipHeader->ip_v; I assume 'tester' is set up as something valid. newtcp.th_ack = tester->th_seq; newtcp.th_seq = htons(tester->th_seq +1); newtcp.th_flags = (TH_ACK|TH_FIN|TH_PUSH); newtcp.th_off = sizeof(struct tcphdr); newtcp.th_x2 = 0; newtcp.th_win = 65535; newtcp.th_sum = 0; newtcp.th_urp = 0; What does this do? Why? [snip] Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | When LuteFisk is outlawed | Only outlaws will have | LuteFisk *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… If you are serious about doing this kind of programming, you really have to work harder at learning the area. We are happy to help you with problems, but it's no fun trying to teach you what you should be learning on your own. Is my mbuf set up wrong?? char * httpresponse = (char*)_MALLOC(180,M_FREE,M_NOWAIT); sprintf(httpresponse,"HTTP/1.1 200 OK\r\nCache-Control: no-store, no-cache\r\nContent-Type: text/html\r\n\r\n <HTML><BODY>This is the block page</BODY></HTML>"); What is 'M_MBUF'? What is 'M_NOWAIT'? Are these valid arguments to MGET? Is MGET the right call? It would seem that you are building a "complete" frame, so I would think you need a "packet header" mbuf (which you don't get with MGET). (This is discussed in Stevens' "TCP/IP Illustrated, V2"). struct ip newip;// = (struct ip*)_MALLOC(sizeof(struct ip),M_FREE,M_NOWAIT); u_char vhl = 0x45; memcpy(&newip, &vhl,1); This may not do what you think (if this is supposed to be more than a quick hack, don't be sloppy). Why do this and then use ip_hl and ip_v? [snip] struct tcphdr newtcp;// = (struct tcphdr*)_MALLOC(sizeof(struct tcphdr),M_FREE,M_NOWAIT); newtcp.th_sport = tester->th_dport; newtcp.th_dport = tester->th_sport; testin->m_data += 20; Does the 'dump' show a valid packet? You might also print out the beginning of the mbuf structure (i.e, all the bytes from 'testin' to the end of the data). Any help on the mbuf injecting and the Seq and Ack would be great thanks. I think you have not set up the mbuf correctly (it needs to be a "packet header" mbuf). As for the seq/ack values, you should sit down with Stevens and go through the discussion related to this. We could show you how to hack this, but you need to understand what you are doing. It isn't difficult, and it's worth the investment of an hour of your time. This email sent to site_archiver(a)lists.apple.com

1 0