September 2004 - Darwin-kernel

Re: dlil_inject_if_input
by Justin Walker 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Sep 17, 2004, at 13:32, Matthew Jaffa wrote: Cheers, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have interecepted an outgoing HTTP request using a dlil interface filter. I return EJUSTRETURN in the dlil_if_output function to let it know to not let this packet go out, but to still think it sent it out. The connection has been successfully set up with a SYN/SYN-ACK/ACK exchange, correct? Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. [snip] I am doing the checksumming correct now for the ipheader and tcpheader, If you literally mean you checksummed the tcpheader, then you have a problem: the TCP checksum covers all the TCP data. but still no results. When I call dlil_inject_if_input am I supposed to have a ethernet header on the mbuf I am injecting??? That might be the problem, but don't know. One way to determine what the IP stack is seeing is to review the IP statistics before and after trying out a connection that should be blocked (see, e.g., the lines "discarded for bad checksums", "bad header checksums"; there are other counters that might shed light as well. This is seen with "netstat -s"). It will help if your test network is lightly loaded so you can more easily isolate the counters that are changing due to problems in your implementation. Also, check to see whether you see any RST packets being generated or received by your stack (apropos of Josh's comments). -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | It's not whether you win or lose... | It's whether *I* win or lose. *--------------------------------------*-------------------------------* This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Matt Jaffa 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Matt On Sep 17, 2004, at 3:05 PM, Joshua Graessley wrote: Are you doing the right thing with the TCP sequence and ack numbers? -josh On Sep 17, 2004, at 1:32 PM, Matthew Jaffa wrote: Hi, thanks, Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I don't think I am doing the right thing with Sequence numbers and acknowledgement numbers, any help with that would be appreciated. But also wouldn't I be able to see it in my interface infilter function, before it gets discarded by the TCP/IP stack if the seq and ack fields are wrong ? I have asked this question before, but didn't really get a response or maybe worded it horribly. I'll give it another shot. I have interecepted an outgoing HTTP request using a dlil interface filter. I return EJUSTRETURN in the dlil_if_output function to let it know to not let this packet go out, but to still think it sent it out. Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. What I am doing so far is taking the ip header and tcp header of the outgoing packet that was going to go out, and make my own tcp header and ip header, and switch the outgoing ipaddress with the source and also the tcp port numbers in the same way. then I add my data to the end off my tcp header, put that all in an mbuf and use dlil_inject_if_input to insert my packet to go up the protocol stacks so the web browser will now display my block page instead. However it seems to not be working, dlil_inject_if_input returns 0 like it should but nothing is happening, no block page. Not even the packet that I inserted in the dlil_inject_if_input is showing up in my interface infilter function, anybody ever do this and have success of injecting there own page into the input stream for the browser to see. I am doing the checksumming correct now for the ipheader and tcpheader, but still no results. When I call dlil_inject_if_input am I supposed to have a ethernet header on the mbuf I am injecting??? That might be the problem, but don't know. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ jgraessley%40apple.com This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/ matt%40knowligent.com This email sent to matt(a)knowligent.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Marc Manthey 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 17.09.2004, at 22:32, Matthew Jaffa wrote: Hi, Maybee you change you e-mail or try another list ;) *SCNR* regards marc -- "Reality is what, when you stop believing in it, doesn't go away. Failure is not an option. It is a privilege reserved for those who try." Marc Manthey (C.V.O.) Hildeboldplatz 1a D – 50672 KÖLN web: //www.let.de mail:marc@let.de -- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have asked this question before, but didn't really get a response or maybe worded it horribly. This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_inject_if_input
by Joshua Graessley 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Are you doing the right thing with the TCP sequence and ack numbers? -josh On Sep 17, 2004, at 1:32 PM, Matthew Jaffa wrote: Hi, thanks, Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com I have asked this question before, but didn't really get a response or maybe worded it horribly. I'll give it another shot. I have interecepted an outgoing HTTP request using a dlil interface filter. I return EJUSTRETURN in the dlil_if_output function to let it know to not let this packet go out, but to still think it sent it out. Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. What I am doing so far is taking the ip header and tcp header of the outgoing packet that was going to go out, and make my own tcp header and ip header, and switch the outgoing ipaddress with the source and also the tcp port numbers in the same way. then I add my data to the end off my tcp header, put that all in an mbuf and use dlil_inject_if_input to insert my packet to go up the protocol stacks so the web browser will now display my block page instead. However it seems to not be working, dlil_inject_if_input returns 0 like it should but nothing is happening, no block page. Not even the packet that I inserted in the dlil_inject_if_input is showing up in my interface infilter function, anybody ever do this and have success of injecting there own page into the input stream for the browser to see. I am doing the checksumming correct now for the ipheader and tcpheader, but still no results. When I call dlil_inject_if_input am I supposed to have a ethernet header on the mbuf I am injecting??? That might be the problem, but don't know. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com This email sent to jgraessley(a)apple.com smime.p7s

1 0

dlil_inject_if_input
by Matthew Jaffa 17 Sep '04

17 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, thanks, Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have asked this question before, but didn't really get a response or maybe worded it horribly. I'll give it another shot. I have interecepted an outgoing HTTP request using a dlil interface filter. I return EJUSTRETURN in the dlil_if_output function to let it know to not let this packet go out, but to still think it sent it out. Now the problem is, is inserting my own HTTP/1.1 response into the input stream of the machine that made the request. What I am doing so far is taking the ip header and tcp header of the outgoing packet that was going to go out, and make my own tcp header and ip header, and switch the outgoing ipaddress with the source and also the tcp port numbers in the same way. then I add my data to the end off my tcp header, put that all in an mbuf and use dlil_inject_if_input to insert my packet to go up the protocol stacks so the web browser will now display my block page instead. However it seems to not be working, dlil_inject_if_input returns 0 like it should but nothing is happening, no block page. Not even the packet that I inserted in the dlil_inject_if_input is showing up in my interface infilter function, anybody ever do this and have success of injecting there own page into the input stream for the browser to see. I am doing the checksumming correct now for the ipheader and tcpheader, but still no results. When I call dlil_inject_if_input am I supposed to have a ethernet header on the mbuf I am injecting??? That might be the problem, but don't know. This email sent to site_archiver(a)lists.apple.com

1 0

Re: A Question on MAC's Power Management
by Garth Cummings 14 Sep '04

14 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com smime.p7s

1 0

A Question on MAC's Power Management
by Jason Geng 14 Sep '04

14 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: New list servers
by Benjamin Herrenschmidt 13 Sep '04

13 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com > And third, it makes bounce processing more reliable, since we can > better figure out who in fact that message was sent to (after it being > forwarded six times and the headers stripped, and returned from an > email address on a different continent than we sent it to). That will > allow us to better parse off dead addresses, reducing the number of > messages sent back and forth saying "he's dead! stop it!" "but you > don't tell me who died! I can't!" -- therefore cutting the overall > bandwidth we waste a lot more than we'll add by adding the new > features. Well, the reason why having myself in the "To" header is really very painful here is that I have all sorts of filters, one of them beeing a vfolder in evolution that stores a view of all messages addressed to me (To: or CC:) regardless on what mailing list they are on. It's extremely handy to follow up on replies to your own posts for example. With the new system on Apple lists, all messages posted to those lists now appear in that vfolder, which makes it totally useless... At this point, I'll have no choice but unsubscribe unless I manage to sort it out using a separate email address for those lists (and provided I can still post from my main one). Ben. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: New list servers
by Wade Tregaskis 12 Sep '04

12 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I'm using Mail.app, too, and it works excellent. To set up a mail rule, 1) view a message coming from the list, 2) hit cmd-shift-H to view message headers, 3) look up the line beginning with "List-Id", 4) copy the mail address in this line to the clipboard 5) set up a rule a la "List-Id contains darwin-kernel.lists.apple.com". List-Id is even one of the headers the rule editor suggests. Yes, I've filed bug reports. :P _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Works always, distinguishes mails going to the list from their duplicate sent directly to you and list software developers promised to never change the List Id header due to software upgrades. The problem is, I have a rule that highlights all mail addressed to me (via To:, so, obviously List-ID is useless for this). Now, I tried adding a condition to that that List-ID is not present, but of course Mail can't do that. So I tried saying "doesn't contain '@'" on the Delivered-To header, but that matches everything (evaluates to true if there's no Delivered-To tag). So I tried a separate rule that says "does contain '@'", and then stops evaluating rules. That matches, but the "Stop Evaluating Rules" bit doesn't work - it always keeps going. So then I try to just reverse the changes of my highlight rule, only you can't set the highlight text colour back to black, because Mail for some reason can't handle loading such a condition from it's MessageSorting plist, so it has to be almost-black... The story goes on and on. Ultimately, Mail's filters are way too buggy and weak to handle even this trivial case... (sure, there might be another way to do what I want that I haven't considered, but I'm not going to spend hours on a few stupid mail filters). Wade Tregaskis (aim & yahoo: wadetregaskis, icq: 40056898, msn & email: wjtregaskis(a)students.latrobe.edu.au, jabber: wadetregaskis(a)jabber.org) -- Sed quis custodiet ipsos custodes? This email sent to site_archiver(a)lists.apple.com

1 0

Re: New list servers
by Justin Walker 12 Sep '04

12 Sep '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Chuq, On Sep 12, 2004, at 9:41, Chuq Von Rospach wrote: - What's with getting mail apparently addressed directly to me, even though the sender sent to the list? - I think you replyed to someone about a "NOMAIL" option - I don't know what this is, and I don't think I set it in the past. Need I worry? - The archives (e.g., for darwin-kernel) seem alarmingly sparse. Have we lost history? Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for the Absorption of | Some people have got a Federal Funds | mental horizon of radius zero | and call it their point of view | - David Hilbert *--------------------------------------*-------------------------------* _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… filtering on List-ID is what we've told people to do for years. Your old setup would fail anyway any time someone Bcc:ed the list, if you think about it. Can you (in your spare time) update the FAQ with a few of these tid-bits? - Filter on 'List-id:' (what [exactly] does it contain, anyway?) The new organization looks good, and will be nice (once we get past the potholes :-}). This email sent to site_archiver(a)lists.apple.com

1 0