December 2008 - Darwin-kernel

NKE programming: ipf_input filter arguments
by John D. 14 Dec '08

14 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=rE54a/0Zsp2VLEja9gfDOtCnkNMhCdoRZxqZLrVOHgk=; b=A0xi18rTekMT9GkmknyAprTQMSvy8X5Q60rd02FaMJ/yNSXCt1vhJEHTRryGA9Ab+c ndIhJEFi6D6//DmZQp3QWyM88p82CtRTiYaKqlfcyy7ZC9hrJLn/76hFCAImMmrEwLhD QfMPoweA++haKMX3DCr0BTAb19GOHDgA1VkiE= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=pq/dHne5NNI1PhGBFZCaa+if4LOizADs5CbKV8bkoSfyZbNT34f/kaNMqKz0rMr1FE pr7wUHOS36mlTzUpzaDkh23TG0KRNfZ50iGczCAqZa+KF4Z9otej5f0yG7S73QoMxOJP rDQLYdhfH3UKiRnNy/s4yiaIVaiWdf+kzPBIs= Hi, I'm having trouble with my IP (v4) ipf_input_func. It registers properly and works fine through my initialization code, but the data argument is confusing, as well as the offset one. The documentation says data (which is a mbuf_t pointer, aka struct __mbuf **) points at start of data with the IP header. My code only inspects TCP packets, checking the protocol argument and ignoring the packet (returning zero immediately) if it's not IPPROTO_TCP. The problem arises when I try to read the tcphdr structure from the data argument. The documentation again says that I should read data+offset, and doing so yields unconsistent results. Source and destination ports are incorrect after converting them back to host native endianness (little endian here, thus using ntohs()) and the whole structure seems to be incorrect, which makes me think I'm reading a wrong location. I tested with UDP packets and it's the same situation. What information is contained in reality within the data argument? Does the offset argument count the IP header itself too? For example: struct udphdr *udphdr = (struct udphdr *) (data + offset); struct tcphdr *tcphdr = (struct tcphdr *) (data + offset); The IP filter function arguments: (void *cookie, mbuf_t *data, int offset, u_int8_t protocol) Thanks in advance. John. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by Michael Smith 13 Dec '08

13 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Dec 12, 2008, at 8:15 PM, John D. wrote: I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). You will need to build your own kernel. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Obtaining non-exported symbol from kernel on runtime (without the debug symbols)
by John D. 13 Dec '08

13 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=wxN9hvX1x5a1koY/v0ymM0URLSAPFfzWdPBhzAjbMOo=; b=SM7oJ/l5FA7usELRi9w0tETz/hzc14hHW1GAHoGD+gfInE5qiHx6Uu9O94sT0hPXbG z8oxonfh+k7tj0ch9xX8SSlO36HVgNbNDGr1DxaloFMMg/Y4gD51oKGlA1LV1/8y8T+H r/t7lfs8rZ2AzDQQVu+KnUtiVoUm/ZkmBcvxQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=UUQYIH7rJjr/zrpH3CsbZ7fVpjHb7j/ko3eWXZQTiPdY0+tJ/SvqHWUg7sYWWCmwk/ mgGqhi06qA5ylVIWkY5uuFlH8dUFxbs4jqqKjO528h8W2J3wQlgDRMJ3Ynqv+p4NtZCa Ij/oB/J27b9PZJqVKZM8tjjoOeoX5mXfbVgBw= Hi, I'm working on a college project and I would like to access some non-exported API. For example chgproccnt and kld_file_lookupsymbol. I want to be able to obtain a symbol address from a kernel extension, say, of the mach_kernel file. This could come handy but apparently none of the useful API is available to extensions. Has anyone done anything similar or can provide a suggestion to access kld_file_lookupsymbol() without using static addresses (to avoid version-specific builds, since Apple can change it anytime). Thanks! John. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: ACL handling for NFSv4
by Terry Lambert 04 Dec '08

04 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Mon, 1 Dec 2008, Terry Lambert wrote: [good stuff snipped] I agree with this, but you need to be very careful here. For NFSv4, the enforcement is done on the server. Would you mind if I cut/paste some of the above into the man page, attributing it to you as the author? Can you paraphrase? -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Dec 3, 2008, at 1:12 PM, Rick Macklem wrote: A lot of client/server enforcement is predicated on the idea that the client and server will be members of the same security association, and being members of the same SA, you will get the same answer for both ends. In most of these cases, the enforcement is intended to be done server-side, while (potentially) being originated client-side or via inheritance. For GUID translations for unknown GUIDs, which are "unknown" because you have disconnected your laptop from the corporate network and happened to be using ACLs on it, or you have disconnected your laptop from one of maybe three SAs it's normally a member of (e.g. you are in your home office talking to your home office server(SA 1), your Internet connection is up(SA 2), but your VPN connection into work is currently down(SA 3)), then DS will make up a transient answer for you. This will boil down to you being likely to get an answer to the first question you ask in this situation, i.e. "please give me a transient GID for this GUID" or "please give me a transient UID for this GUID", but not both. The ACL support will only me enabled when a mount option is set and that allows me to document the above in the man page for that option. Be aware that I can't guarantee that we're not going to change behaviour in the future, if we see some way of making this less fuzzy. This email sent to site_archiver(a)lists.apple.com

1 0

Re: select() problems
by Terry Lambert 04 Dec '08

04 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -- Terry On Dec 3, 2008, at 6:53 PM, Steve Checkoway <s(a)pahtak.org> wrote: On Dec 3, 2008, at 2:46 PM, Jamil Weatherbee wrote: Glad I could help. -- Steve Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… No system calls interrupted by signals restart _by default_ on modern UNIX systems. I think the original problem in the posted pseudo-code was either the bits in the FD_SET being cleared, or the use of a non-volatile global flag variable, which the compiler then optimized into a register load after which the contents were not changed in the loop control by the signal handler. As an historical note on signals, FreeBSD adopted (sorta) POSIX signal handler behavior around release 2.0, and this was picked up by CSRG for the BSD4.4-Lite release, and everyone who picked up much of that also picked up the non-restart behavior. The only exceptions to this are signal handlers established with sigaction() instead of signal(), and specifying the SA_RESTART flag to force historical 4.2/4.3BSD behaviour. Some implementations also support a bsdsignal() system call to support restart behaviour as a porting aid, if it is used in place of signal() (SVR4.2 is one such sytem). This is why you'll see a lot of very old BSD code (e.g. comp.unix.sources archives, etc.) use longjmp() in a signal handler in order to abort the signal restart behaviour (sometimes it is actually #ifdef BSD) that used to be default for BSD systems prior to the mid 1990s. On the minus side, it was infinitely easier to implement user space threads packages like sigsched and the original MIT pthreads, if you could be guaranteed system calls would restart after a non-terminal signal was delivered. Adoption of the SVR2/POSIX instead of the old BSD behaviour as the new default for everyone made a lot of jobs harder. Thanks so much Steve for sending that test code. Anyway, select() DOES NOT restart which is the key point here. Good to know. I don't think I've ever actually looked up which system calls get restarted before. This email sent to tlambert(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: select() problems
by Steve Checkoway 04 Dec '08

04 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Dec 3, 2008, at 2:46 PM, Jamil Weatherbee wrote: Glad I could help. -- Steve Checkoway _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks so much Steve for sending that test code. Anyway, select() DOES NOT restart which is the key point here. Good to know. I don't think I've ever actually looked up which system calls get restarted before. This email sent to site_archiver(a)lists.apple.com

1 0

Re: select() problems
by Jamil Weatherbee 03 Dec '08

03 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Anyway, select() DOES NOT restart which is the key point here. -Jamil _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks so much Steve for sending that test code. While I was using the signal() interface instead of the sigaction() interface I made changes to the code you sent along and it seemed to work in comparing and carefully rereading the following man page excerpt: If a signal is caught during the system calls listed below, the call may be forced to terminate with the error EINTR, the call may return with a data transfer shorter than requested, or the call may be restarted. Restart of pending calls is requested by setting the SA_RESTART bit in sa_flags. The affected system calls include open(2), read(2), write(2), sendto(2), recvfrom(2), sendmsg(2) and recvmsg(2) on a communications channel or a slow device (such as a terminal, but not a regular file) and during a wait(2) or ioctl(2). However, calls that have already committed are not restarted, but instead return a partial success (for example, a short read count). I realized I was getting hung up because I was expecting select() to restart on a signal delivery Select DOES NOT restart but rather exits with an EINTR (which you catch). I had bypassed the error return in the case that a shutdown signal was sent and was not expecting an EINTR. This email sent to site_archiver(a)lists.apple.com

1 0

Re: OSX 10.5 (Leopard) on a slow Dual G4
by Al Ciplickas 03 Dec '08

03 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=dk20050327; d=earthlink.net; b=U81iDJM83aFp6HGqs9tPVOMXfRjaFHIoEatZyMv1rxyDnQKnQdTrKvDUfSGrY+RK; h=Received:In-Reply-To:References:Mime-Version:Content-Type:Message-Id:Cc:From:Subject:Date:To:X-Mailer:X-ELNK-Trace:X-Originating-IP; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: ACL handling for NFSv4
by Rick Macklem 03 Dec '08

03 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Mon, 1 Dec 2008, Terry Lambert wrote: I agree with this, but you need to be very careful here. For NFSv4, the enforcement is done on the server. The ACL support will only me enabled when a mount option is set and that allows me to document the above in the man page for that option. Would you mind if I cut/paste some of the above into the man page, attributing it to you as the author? Thanks again, rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… [good stuff snipped] A lot of client/server enforcement is predicated on the idea that the client and server will be members of the same security association, and being members of the same SA, you will get the same answer for both ends. In most of these cases, the enforcement is intended to be done server-side, while (potentially) being originated client-side or via inheritance. For GUID translations for unknown GUIDs, which are "unknown" because you have disconnected your laptop from the corporate network and happened to be using ACLs on it, or you have disconnected your laptop from one of maybe three SAs it's normally a member of (e.g. you are in your home office talking to your home office server(SA 1), your Internet connection is up(SA 2), but your VPN connection into work is currently down(SA 3)), then DS will make up a transient answer for you. This will boil down to you being likely to get an answer to the first question you ask in this situation, i.e. "please give me a transient GID for this GUID" or "please give me a transient UID for this GUID", but not both. This email sent to site_archiver(a)lists.apple.com

1 0

Re: OSX 10.5 (Leopard) on a slow Dual G4
by Shantonu Sen 03 Dec '08

03 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0