November 2006 - Darwin-kernel

Re: DNS from a Kernel Extension
by Andrei Tchijov 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com or am I missing something? On Nov 10, 2006, at 9:30 PM, Curtis Jones wrote: WHY? This is just wrong on so many levels... Thankfully in this case I'm not so masochistic as to want to do network communication from within the kernel. A fun exercise perhaps, but definitely not practical. In this case I have a network kernel extension that is evaluating some criteria ("rules") for each new socket connection (among other things)*. One aspect of a rule is a remote endpoint address (or dns name). So, this is where my need comes from to do the resolution. So while I understand that I should do DNS resolution in the user space, I would prefer to block as little as possible when within the data path of a socket. Add a trip to user space and back is minor in comparison with actually performing the DNS resolution, I know. I was looking at each step and considering which could possibly be removed for the sake of that aforementioned data path. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Unless you are implementing some sort of "proxy" and/or analyzing actual data sent via sockets, "... remote endpoint address ..." is going to be address (not a host name) On 11/10/06, William Kucharski <kucharsk(a)mac.com> wrote: If you ever need to do this type of thing, you need to take a step back and figure out why you're trying to this from the KERNEL. I can't even really think of one. The right way to do this is to have a user space process do the DNS resolution and pass the information to your kernel extension; better yet would be for a user space daemon to do both the DNS resolution AND all network communication. * Sounds like a firewall, I know. Similar concept; different application. -Curtis _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/andrei% 40tchijov.com This email sent to andrei(a)tchijov.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: DNS from a Kernel Extension
by Josh Graessley 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -josh On Nov 10, 2006, at 6:23 PM, William Kucharski wrote: WHY? This is just wrong on so many levels... William Kucharski kucharsk(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com Actually, there are some arguments for doing DNS resolution in the kernel. One problem we have right now is a number of people write lame networking code. They perform some sort of dns resolution and try to connect to the first address they get back. Most applications want to connect to some name, they don't care what the address is or even whether it's IPv4 or IPv6. An application should get back a list of all addresses the name resolves to and attempt to connect to each of those addresses until it finds one that works. Most applications just try the first one, or they wait for the first one to fail before attempting the second one. The kernel, if it was given a name or a list of addresses could do some intelligent stuff. In user space, you would need to open a new socket for each connection attempt. In the kernel, if there was a connect to name or connect to list, the kernel could start by sending the first syn to the the first address, wait for some time, then send the next syn and so on. The kernel could accept the first syn-ack to come back from any of those initial syns it sent. Once it got a syn- ack back, it would reject packets from any other addresses and finish up the three way handshake. The kernel could apply some smarts to try the best addresses first. An application wouldn't have to worry about the nitty gritty stuff and we wouldn't have to waste time creating lots of sockets or writing complicated code to have multiple sockets attempting simultaneous asynchronous connects. Doing DNS in the kernel would present a number of challenges. DNS is sort of one level above arp and we do arp in the kernel, so DNS is too much of a stretch. The problem is that people pollute their name resolution with all kinds of other crap from the /etc/hosts file to a variety of directory services plug-ins. Getting access to that stuff in the kernel is not feasible. On Friday, November 10, 2006, at 06:42PM, Curtis Jones <curtis.jones(a)gmail.com> wrote: I have a need for performing DNS resolution (name to address) for the use by a kernel extension, and it would be incredibly convenient if it could be performed within the kernel. I've looked around endless header files but haven't found anything helpful. If you ever need to do this type of thing, you need to take a step back and figure out why you're trying to this from the KERNEL. I can't even really think of one. The right way to do this is to have a user space process do the DNS resolution and pass the information to your kernel extension; better yet would be for a user space daemon to do both the DNS resolution AND all network communication. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com This email sent to jgraessley(a)apple.com smime.p7s

1 0

Re: DNS from a Kernel Extension
by Curtis Jones 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=btQWJsCA/Tze/0IZU7t3yMDmJvdL9Q/k/DhrC5E74W+qY03YKwNJ7boivQb6J+n/exjcHxE7Z8wDfLXtEhI81wkbIB6CbW7pgFVcB0OrualS3eUtWkmyQNNcVmrRJsOKER9fpYXOM9k+E+N1c1UpXwt4WLlrOQ9stBdvXv1Lm/Y= WHY? This is just wrong on so many levels... If you ever need to do this type of thing, you need to take a step back and figure out why you're trying to this from the KERNEL. I can't even really think of one. The right way to do this is to have a user space process do the DNS resolution and pass the information to your kernel extension; better yet would be for a user space daemon to do both the DNS resolution AND all network communication. Thankfully in this case I'm not so masochistic as to want to do network communication from within the kernel. A fun exercise perhaps, but definitely not practical. In this case I have a network kernel extension that is evaluating some criteria ("rules") for each new socket connection (among other things)*. One aspect of a rule is a remote endpoint address (or dns name). So, this is where my need comes from to do the resolution. So while I understand that I should do DNS resolution in the user space, I would prefer to block as little as possible when within the data path of a socket. Add a trip to user space and back is minor in comparison with actually performing the DNS resolution, I know. I was looking at each step and considering which could possibly be removed for the sake of that aforementioned data path. * Sounds like a firewall, I know. Similar concept; different application. -Curtis _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On 11/10/06, William Kucharski <kucharsk(a)mac.com> wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Re: DNS from a Kernel Extension
by William Kucharski 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Friday, November 10, 2006, at 06:42PM, Curtis Jones <curtis.jones(a)gmail.com> wrote: >I have a need for performing DNS resolution (name to address) for the >use by a kernel extension, and it would be incredibly convenient if it >could be performed within the kernel. I've looked around endless >header files but haven't found anything helpful. WHY? This is just wrong on so many levels... If you ever need to do this type of thing, you need to take a step back and figure out why you're trying to this from the KERNEL. I can't even really think of one. The right way to do this is to have a user space process do the DNS resolution and pass the information to your kernel extension; better yet would be for a user space daemon to do both the DNS resolution AND all network communication. William Kucharski kucharsk(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: DNS from a Kernel Extension
by Josh Graessley 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -josh On Nov 10, 2006, at 5:41 PM, Curtis Jones wrote: I have a need for performing DNS resolution (name to address) for the use by a kernel extension, and it would be incredibly convenient if it could be performed within the kernel. I've looked around endless header files but haven't found anything helpful. I suspect that the "correct" approach would be to perform the dns resolution in a user process and send the result back to the kernel extension - but I thought I'd check first and see if there was anything I had missed. Suggestions appreciated. Thanks. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com The only way to do DNS in the kernel is to write code to format and parse the packets yourself using an in kernel UDP socket. You will also need to get a DNS server address. For this, you will probably need something running in user space to push the current DNS server address in to the kernel. You may want to consider the "correct" approach of doing the resolution in userspace and pushing the result in to the kernel. -Curtis _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com This email sent to jgraessley(a)apple.com smime.p7s

1 0

DNS from a Kernel Extension
by Curtis Jones 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=D4fPdNdzmh3AoCAb6TRSvd3HgusVj7pEhJ3MYS/JMu8Q2B/jBRDe/RoY+UNTKusn/BmSanKI8dFUoOMC+trR6pvox00ELgvbXVM0EzyjFU6c23zCoo3qdCifGAxu2WpPqq3Lu/4q+j96DmTqd7mUUkudFJNn55LQhNEhvwhnhnk= I have a need for performing DNS resolution (name to address) for the use by a kernel extension, and it would be incredibly convenient if it could be performed within the kernel. I've looked around endless header files but haven't found anything helpful. I suspect that the "correct" approach would be to perform the dns resolution in a user process and send the result back to the kernel extension - but I thought I'd check first and see if there was anything I had missed. Suggestions appreciated. Thanks. -Curtis _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Administrator password
by Dan Shoop 11 Nov '06

11 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Is there a way to check if the user has given us the correct administrator password? -dhan ------------------------------------------------------------------------ Dan Shoop AIM: iWiring Systems & Networks Architect http://www.ustsvs.com/ shoop(a)iwiring.net http://www.iwiring.net/ 1-714-363-1174 "The wise man doesn't give the right answers, he poses the right questions." -- Claude Levi-Strauss ------------------------------------------------------------------------ iWiring provides systems and networks support for Mac OS X, unix, and Open Source application technologies at affordable rates. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 12:08 PM -0800 11/10/06, Jeffrey Ellis wrote: There isn't necessarily a singular administrator account, and of course then there's also root. First you might check to verify that they gave you a admin user by checking to see if it's a member of the admin group. Next you can check that the password they gave you is correct with `chkpasswd`; see it's man page. -- This email sent to site_archiver(a)lists.apple.com

1 0

Re: Administrator password
by Andrei E. Warkentin 10 Nov '06

10 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:in-reply-to:references:mime-version:content-type:message-id:cc:from:subject:date:to:x-mailer; b=HVO1njUv9EYsZghcMzqcZaKZuYq+BPh6fP5jPESdQ6oONL05aE9V7TTdEXDty5UHMil+KMsBeIZGUZIzxcfW+xvdRJO4ikM3zA5F74iTwcv5zgYI45r5geYBjb0q2kYQsBLQYQEpxlpwdqLi6O7GAS1EMcZD2VwlK/IMcuJhlEQ= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Administrator password
by Jeffrey Ellis 10 Nov '06

10 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thread-index: AccFA/lcN+UlyHD3EduK4QANk0QgEg== Thread-topic: Administrator password User-agent: Microsoft-Entourage/11.2.5.060620 Is there a way to check if the user has given us the correct administrator password? Thanks :) All My Best, Jeffrey _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Registering a tty device?
by Terry Lambert 09 Nov '06

09 Nov '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Nov 8, 2006, at 10:07 PM, sanjay yaragatti wrote: Hi, I have written a Virtual COM PORT driver(kernel).I have regestered it as character device.Now want to support PPP in it.When I initiate a connection by giving the command >pppd "MyPort0" it connects, opens the MyPort0 , calls some ioctls in my driver (TIOCEXCL,TIOCGETA_64,TIOCSCTTY,TIOCMBIC) and disconnects.After doing some reading, I came to know that you have to register your device as tty device so that it can support PPP.Is it correct or its just enough to implement the ioctls that the pppd calls (TIOCEXCL,TIOCGETA_64,TIOCSCTTY,TIOCMBIC).Can anyone help me in this regard. Look at the source code for the pty driver: xnu bsd/kern/tty_pty.c The ttioctl() called there is implemented in: xnu bsd/kern/tty.c -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I strongly recommend utilizing it to implement the tty line discipline, rather than trying to "roll your won", since you are unlikely to get things like controlling tty's correct on your own. PS: TIOCGETA_64 indicates that your test program is a 64 bit rather than a 32 bit program; you will likely want to use a 32 bit test program, since I can't guarantee all aspects of the tty driver have been made 64-bit happy in whatever version of the OS you're running. This email sent to site_archiver(a)lists.apple.com

1 0