April 2005 - Darwin-kernel - lists.apple.com

Re: Interface filtering
by Justin Walker 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Apr 11, 2005, at 16:23, Carl Smith wrote: I have my Ethernet interface filtering in place and am trapping the packets as they come through the interface filter, I was just wondering if there was some way to tell which packets from the interface may be from a wireless connection or not? In my filter I am passed a struct ifnet and the mbuf. I see that in the struct ifnet it gives me the interface name, i.e. 'en', 'lo' and so on, and with this I was just wondering if there is some variable in the struct that might also tell me if it is wireless or not. Anyone else? Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large Institute for General Semantics -------- "Weaseling out of things is what separates us from the animals. Well, except the weasel." - Homer J Simpson -------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Since you are using an interface filter, then the packets you get from a specific interface are either all from a wireless connection, or none are. Perhaps I am missing the point of your question. There is nothing in the name that will give you a hint, and all will identified as ethernet, at the "BSD network device" layer. There is probably a mechanism available to distinguish wireless devices from others, at the IOKit layer, but I don't know what it is (perhaps the archives will tell). There is provision for maintaining this info at the BSD/network layer (the if_data substructure of the ifnet structure), but I don't know that this is ever filled in, and in any case, this would be done by the driver, so I can't say you can count on it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: String Compare
by Dean Reece 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com For example: nm -m <SomePseudoKextBinary> ... (undefined) external _KPISymbol1 (indirect) external _KPISymbol2 (for _KernelSymbol2) ... Enjoy, - Dean On Apr 11, 2005, at 10:06, Dean Reece wrote: On Apr 11, 2005, at 08:55, Andrew Gallatin wrote: Carl Smith writes: Ah I see, said the blind man. Thanks Quinn, understand the concept a little more. and I get back: U _strcmp U _strcmp U _strcmp How does this tell me which KPI exports the symbol, I thought I was looking for something like, "com.apple.kernel.libkern" and so on? Try adding -o to nm. Eg: Thats way better than my grep -r suggestion. Note the "U", which means it is importing the symbol... >From some discussions I had off-list, these files generally contain Cheers, - Dean _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 11, 2005, at 10:06, Dean Reece wrote: There presently isn't an easy way to determine what the export name is without examining the .exports files in the kernel project (xnu). I've just learned a new trick, and I thought I would share... If you run "nm -m" on one of our pseudo-kexts, it lists both the name that a symbol goes by in the kernel, as well as the name it is exported under. This shows two symbols, the first of which is kernel symbols exported under it's original name "KPISymbol1 ". The second line shows the kernel symbol "KernelSymbol2 " being exported under the name "KPISymbol2 ". Ok so I ran the % find /System/Library/Extensions/System.kext/ PlugIns \ -type f -a ! -name "*.plist" | xargs nm | grep strcmp % find /System/Library/Extensions/System.kext/PlugIns -type f -a ! -name "*.plist" | xargs nm -o | grep strncmp /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/ Libkern: U _strncmp /System/Library/Extensions/System.kext/PlugIns/Mach.kext/ Mach: U _strncmp /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/ kernel.6.0: U _strncmp imported symbols which they also re-export. But not always, and there isn't a 100% bullet proof way to figure out which "fake" kext supplies which symbols. The way this all works, any symbol which is imported by a fake kext is also exported by it, but it may be exported under a different name. So, if you see the symbol you want in a fake kext, then you know it is available, but possibly under a different name. There presently isn't an easy way to determine what the export name is without examining the .exports files in the kernel project (xnu). The good news is that this symbol renaming is very rarely done - it is primarily used so that we can provide two versions of the same function in the kernel, say foo_v1() and foo_v2(), which then both get exported as foo() in the appropriately versioned pseduo-kexts. In most cases where you would encounter the renaming, you'd still find the symbol you were looking for, but with a suffix. This email sent to site_archiver(a)lists.apple.com

1 0

Interface filtering
by Carl Smith 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thread-index: AcU+7YWkySs695BISNq0yXclyXenUg== Thread-topic: Interface filtering _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: statfs on link
by Justin Walker 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Apr 11, 2005, at 5:58, Hervé Kergourlay wrote: but how to get information on the FS of the link itself ?? Regards, Justin -- Justin C. Walker, Curmudgeon at Large Institute for General Semantics ----------- My wife 'n kids 'n dog are gone, I can't get Jesus on the phone, But Ol' Milwaukee's Best is my best friend. ----------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… on a symbolic link, statfs return information on the FS of the target of the link I need something as "lstat" for the "stat" API An off-the-top-of-my-still-in-a-coma head solution (AFAIK, there is no direct one) is: stat/lstat the name you want to check with statfs; if it is not a symbolic link, statfs it; if it is a symbolic link, statfs the name with the last component stripped (e.g., if /path/to/sym/link lstats as a sym link, then statfs /path/to/sym). This is roughly how lstat() works. This email sent to site_archiver(a)lists.apple.com

1 0

Re: String Compare
by Andrew Gallatin 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dean Reece writes: > > The way this all works, any symbol which is imported by a fake kext > is also exported by it, but it may be exported under a different > name. So, if you see the symbol you want in a fake kext, then you > know it is available, but possibly under a different name. There > presently isn't an easy way to determine what the export name is > without examining the .exports files in the kernel project (xnu). I think there must be some way to do it, but it wouldn't be easy. After all, kextload manages to figure it out, somehow. I suppose it would be just a matter of slogging through the kextload code path, looking to see who (kernel, userspace) finds the symbols and writing a tool based on that info.. > The good news is that this symbol renaming is very rarely done - it > is primarily used so that we can provide two versions of the same > function in the kernel, say foo_v1() and foo_v2(), which then both > get exported as foo() in the appropriately versioned pseduo-kexts. > In most cases where you would encounter the renaming, you'd still > find the symbol you were looking for, but with a suffix. Ah, backwards compat wrappers. Very cool. Thanks for the info, Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: String Compare
by Dean Reece 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Carl Smith writes: Ah I see, said the blind man. Thanks Quinn, understand the concept a little more. and I get back: U _strcmp U _strcmp U _strcmp How does this tell me which KPI exports the symbol, I thought I was looking for something like, "com.apple.kernel.libkern" and so on? Thats way better than my grep -r suggestion. Note the "U", which means it is importing the symbol... Cheers, - Dean _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 11, 2005, at 08:55, Andrew Gallatin wrote: Ok so I ran the % find /System/Library/Extensions/System.kext/ PlugIns \ -type f -a ! -name "*.plist" | xargs nm | grep strcmp Try adding -o to nm. Eg: % find /System/Library/Extensions/System.kext/PlugIns -type f -a ! - name "*.plist" | xargs nm -o | grep strncmp /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/ Libkern: U _strncmp /System/Library/Extensions/System.kext/PlugIns/Mach.kext/ Mach: U _strncmp /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/ kernel.6.0: U _strncmp >From some discussions I had off-list, these files generally contain imported symbols which they also re-export. But not always, and there isn't a 100% bullet proof way to figure out which "fake" kext supplies which symbols. The way this all works, any symbol which is imported by a fake kext is also exported by it, but it may be exported under a different name. So, if you see the symbol you want in a fake kext, then you know it is available, but possibly under a different name. There presently isn't an easy way to determine what the export name is without examining the .exports files in the kernel project (xnu). The good news is that this symbol renaming is very rarely done - it is primarily used so that we can provide two versions of the same function in the kernel, say foo_v1() and foo_v2(), which then both get exported as foo() in the appropriately versioned pseduo-kexts. In most cases where you would encounter the renaming, you'd still find the symbol you were looking for, but with a suffix. This email sent to site_archiver(a)lists.apple.com

1 0

Re: String Compare
by Dean Reece 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

re: String Compare
by Andrew Gallatin 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Carl Smith writes: > Ah I see, said the blind man. Thanks Quinn, understand the concept a > little more. > > Ok so I ran the % find /System/Library/Extensions/System.kext/PlugIns \ > -type f -a ! -name "*.plist" | xargs nm | grep strcmp > > and I get back: > U _strcmp > U _strcmp > U _strcmp > > How does this tell me which KPI exports the symbol, I thought I was > looking for something like, "com.apple.kernel.libkern" and so on? Try adding -o to nm. Eg: % find /System/Library/Extensions/System.kext/PlugIns -type f -a ! -name "*.plist" | xargs nm -o | grep strncmp /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/Libkern: U _strncmp /System/Library/Extensions/System.kext/PlugIns/Mach.kext/Mach: U _strncmp /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel.6.0: U _strncmp Note the "U", which means it is importing the symbol... >From some discussions I had off-list, these files generally contain imported symbols which they also re-export. But not always, and there isn't a 100% bullet proof way to figure out which "fake" kext supplies which symbols. > Also when I use strcmp, as my code is now, I get a warning of "implicit > declaration of function 'strcmp'". Do I have to add the "#include > string.h" to my file or does this have to do with adding the correct > bundle identifier? Compilation warnings like that refer to missing headers, so yes, add string.h. Problems with your info.plist file are usually linking errors and module load time. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

re: String Compare
by Carl Smith 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thread-index: AcU+qc2vPlIOGMJJTuOzh3Ty5sbDuA== Thread-topic: re: String Compare _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

statfs on link
by Hervé Kergourlay 11 Apr '05

11 Apr '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Mozilla Thunderbird 1.0 (Windows/20041206) but how to get information on the FS of the link itself ?? I need something as "lstat" for the "stat" API thanks hervé begin:vcard fn;quoted-printable:Herv=C3=A9 Kergourlay n;quoted-printable:;Herv=C3=A9 Kergourlay org:Atempo;Engineering email;internet:herve.kergourlay@atempo.com title:Vos group Manager tel;work:02 97 42 41 76 note:Only those who attempt the absurd can achieve the impossible url:http://www.atempo.com version:2.1 end:vcard _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com on a symbolic link, statfs return information on the FS of the target of the link

1 0