April 2009 - Darwin-kernel - lists.apple.com

Clarification: Re: ifnet_input problem
by Kevin Brock 23 Apr '09

23 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.21 (Macintosh/20090302) Kevin Brock _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Kevin Brock wrote: - Send works fine. If I call ifnet_output_raw() the packet makes it out onto the wire. Not sending the packet I got in the iff_input_func, but doing the same basic thing in the iff_output_func. I.e., create new mbuf, copy data, modify destination port, recalc checksum, call ifnet_output_raw. That works for send, not for receive. This email sent to site_archiver(a)lists.apple.com

1 0

ifnet_input problem
by Kevin Brock 23 Apr '09

23 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.21 (Macintosh/20090302) Anyone have any suggestions on this? Kevin Brock _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have an interface filter KEXT. It has to be able to do a number of things with packets, creating, modifying etc. I've run into a problem with ifnet_input which seems odd, and is probably something pretty basic. Using it to inject modified packets fails. I've reduced it to a pretty simple either/or... If I take each incoming mbuf, create a brand new mbuf chain and call ifnet_input on the new mbuf chain, and return -1 from my iff_input_func so the caller frees the original mbuf() it works fine. The new packet is received by the appropriate application. If I do the same thing, but modify the TCP destination port so that it is headed for a different application, it fails. - The *only* things changing in the packet are the destination port and the checksum. - I am recalculating the TCP checksum using mbuf_inet_cksum(), and I've verified that the value calculated is correct. - Send works fine. If I call ifnet_output_raw() the packet makes it out onto the wire. - I see the packet again in my iff_input_func--it's tagged, so I can tell it's one of mine. - The firewall is completely disabled at the moment. - If I send a packet from another host directly to the port on which the application is listening, the application receives the packet, so I know the socket is accessible, and that the application is running. This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Bill Janssen 14 Apr '09

14 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Terry Lambert <tlambert(a)apple.com> wrote: > On Apr 10, 2009, at 11:55 AM, Bill Janssen <janssen(a)parc.com> wrote: > > Terry Lambert <tlambert(a)apple.com> wrote: > > > >> On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: > >>> Michael Smith <drivers(a)mu.org> wrote: > >>>> On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: > >>>>> Michael Smith <drivers(a)mu.org> wrote: > >>>>>> It's usually straightforward for the daemon to vend the > >>>>>> appropriate > >>>>>> self-manipulation functionality; frequently you want to gate this > >>>>>> with > >>>>>> application-specific logic anyway. > >>>>> > >>>>> Well, the daemon does a lot of things, but what I'm concerned with > >>>>> is > >>>>> stop, start, and restart. > >>>> > >>>> Why do you need 'stop'? Why can't you just ask the daemon to > >>>> enter a > >>>> state where it refuses requests? > >>> > >>> Because I want to fix it with new code. > >> > >> So just fix it and tell it to exit. > >> > >> When a process exits and launchd restarts it, launchd doesn't know if > >> it's running old code or new code when it's relaunched, it just knows > >> its path. > > > > Sure, but the old code does bad things on exit (like saving state in > > an > > invalid format). I'm pretty sure I need, in the general case, to be > > able to stop it, fix things, and restart it. > > Support a command to exit without saving state before your first > deployment. > > Robust systems self-heal rather than requiring an external agency. Why > do you need it stopped while you fix things externally, rather than > having a check to see if things need to be fixed be the first thing > you do when you restart, and self-heal? > > If nothing else, instead of installing the binary for your process, > install the binary for the fix process instead, and have the last > thing it does as it fixes things is replace its binary and exit. > > We intentionally erected a protection domain barrier here, where > processes that do what your process wants to do have to ask permission > to perform privileged operations, or at least politely request those > privileged operations be performed on their behalf. > > Your code needs to either ask politely like everyone else, or run as root. Just to finish this off, here's what I did. My daemon is now a /Library/LaunchDaemon/foo.plist daemon, RunAtLoad and KeepAlive, with UserName set to the user it belongs to. So it gets run (and restarted) in the startup context. I've added prologue code (not Prolog code :-) to the daemon's initialization routine which checks for a blocking file in a certain place, and if it's there, just loops and waits for it to go away, which when it does the daemon process exits. This check happens before the daemon does any initialization. So "stop" is basically, "touch" the blocking file and "kill -TERM" the daemon; "start" just removes the blocking file; and "restart" is "kill -TERM" the daemon. Actions the user can perform without admin privileges. Still seems convoluted. Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Bill Janssen 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Terry Lambert <tlambert(a)apple.com> wrote: > On Apr 10, 2009, at 11:55 AM, Bill Janssen <janssen(a)parc.com> wrote: > > Terry Lambert <tlambert(a)apple.com> wrote: > > > >> On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: > >>> Michael Smith <drivers(a)mu.org> wrote: > >>>> On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: > >>>>> Michael Smith <drivers(a)mu.org> wrote: > >>>>>> It's usually straightforward for the daemon to vend the > >>>>>> appropriate > >>>>>> self-manipulation functionality; frequently you want to gate this > >>>>>> with > >>>>>> application-specific logic anyway. > >>>>> > >>>>> Well, the daemon does a lot of things, but what I'm concerned with > >>>>> is > >>>>> stop, start, and restart. > >>>> > >>>> Why do you need 'stop'? Why can't you just ask the daemon to > >>>> enter a > >>>> state where it refuses requests? > >>> > >>> Because I want to fix it with new code. > >> > >> So just fix it and tell it to exit. > >> > >> When a process exits and launchd restarts it, launchd doesn't know if > >> it's running old code or new code when it's relaunched, it just knows > >> its path. > > > > Sure, but the old code does bad things on exit (like saving state in > > an > > invalid format). I'm pretty sure I need, in the general case, to be > > able to stop it, fix things, and restart it. > > Support a command to exit without saving state before your first > deployment. Wow, this is getting tortuous. > Robust systems self-heal rather than requiring an external agency. Why > do you need it stopped while you fix things externally, rather than > having a check to see if things need to be fixed be the first thing > you do when you restart, and self-heal? Sure, we do that when we can. But my scenario is that I'm on the phone with a newbie user on the other side of the country, and something's going wrong. I ask them to stop their server, edit a config file that's written on shutdown by the server, and start their server again. > If nothing else, instead of installing the binary for your process, > install the binary for the fix process instead, and have the last > thing it does as it fixes things is replace its binary and exit. > > We intentionally erected a protection domain barrier here, where > processes that do what your process wants to do have to ask permission > to perform privileged operations, or at least politely request those > privileged operations be performed on their behalf. And, as an OS X user and developer, let me take this opportunity to thank you for it. But I wonder if you're not mischaracterizing one or two operations as "privileged". Stopping a daemon that runs as the user shouldn't be privileged (IMO), but I'd be happy to hear the security analysis that persuaded you guys otherwise. And I still wonder if setsid() shouldn't take care of this case (on OS X). > Your code needs to Roth ask politely like everyone else, or run as root. "Roth ask"? There's no need to run it as root, and I'm not going to do that. But I think there is a need to better support management of user daemons that run even when the user is logged out. Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Terry Lambert 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Grrr... ^Roth^either; sometimes I hate iPhone autocorrection. On Apr 10, 2009, at 12:17 PM, Terry Lambert <tlambert(a)apple.com> wrote: Terry Lambert <tlambert(a)apple.com> wrote: So just fix it and tell it to exit. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 10, 2009, at 11:55 AM, Bill Janssen <janssen(a)parc.com> wrote: On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: Michael Smith <drivers(a)mu.org> wrote: On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: Michael Smith <drivers(a)mu.org> wrote: It's usually straightforward for the daemon to vend the appropriate self-manipulation functionality; frequently you want to gate this with application-specific logic anyway. Well, the daemon does a lot of things, but what I'm concerned with is stop, start, and restart. Why do you need 'stop'? Why can't you just ask the daemon to enter a state where it refuses requests? Because I want to fix it with new code. When a process exits and launchd restarts it, launchd doesn't know if it's running old code or new code when it's relaunched, it just knows its path. Sure, but the old code does bad things on exit (like saving state in an invalid format). I'm pretty sure I need, in the general case, to be able to stop it, fix things, and restart it. Support a command to exit without saving state before your first deployment. Robust systems self-heal rather than requiring an external agency. Why do you need it stopped while you fix things externally, rather than having a check to see if things need to be fixed be the first thing you do when you restart, and self-heal? If nothing else, instead of installing the binary for your process, install the binary for the fix process instead, and have the last thing it does as it fixes things is replace its binary and exit. We intentionally erected a protection domain barrier here, where processes that do what your process wants to do have to ask permission to perform privileged operations, or at least politely request those privileged operations be performed on their behalf. Your code needs to Roth ask politely like everyone else, or run as root. -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Terry Lambert 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Terry Lambert <tlambert(a)apple.com> wrote: Well, the daemon does a lot of things, but what I'm concerned with is stop, start, and restart. So just fix it and tell it to exit. When a process exits and launchd restarts it, launchd doesn't know if it's running old code or new code when it's relaunched, it just knows its path. Your code needs to Roth ask politely like everyone else, or run as root. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 10, 2009, at 11:55 AM, Bill Janssen <janssen(a)parc.com> wrote: On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: Michael Smith <drivers(a)mu.org> wrote: On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: Michael Smith <drivers(a)mu.org> wrote: It's usually straightforward for the daemon to vend the appropriate self-manipulation functionality; frequently you want to gate this with application-specific logic anyway. Why do you need 'stop'? Why can't you just ask the daemon to enter a state where it refuses requests? Because I want to fix it with new code. Sure, but the old code does bad things on exit (like saving state in an invalid format). I'm pretty sure I need, in the general case, to be able to stop it, fix things, and restart it. Support a command to exit without saving state before your first deployment. Robust systems self-heal rather than requiring an external agency. Why do you need it stopped while you fix things externally, rather than having a check to see if things need to be fixed be the first thing you do when you restart, and self-heal? If nothing else, instead of installing the binary for your process, install the binary for the fix process instead, and have the last thing it does as it fixes things is replace its binary and exit. We intentionally erected a protection domain barrier here, where processes that do what your process wants to do have to ask permission to perform privileged operations, or at least politely request those privileged operations be performed on their behalf. This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Bill Janssen 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Terry Lambert <tlambert(a)apple.com> wrote: > On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: > > Michael Smith <drivers(a)mu.org> wrote: > >> On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: > >>> Michael Smith <drivers(a)mu.org> wrote: > >>>> It's usually straightforward for the daemon to vend the appropriate > >>>> self-manipulation functionality; frequently you want to gate this > >>>> with > >>>> application-specific logic anyway. > >>> > >>> Well, the daemon does a lot of things, but what I'm concerned with > >>> is > >>> stop, start, and restart. > >> > >> Why do you need 'stop'? Why can't you just ask the daemon to enter a > >> state where it refuses requests? > > > > Because I want to fix it with new code. > > So just fix it and tell it to exit. > > When a process exits and launchd restarts it, launchd doesn't know if > it's running old code or new code when it's relaunched, it just knows > its path. Sure, but the old code does bad things on exit (like saving state in an invalid format). I'm pretty sure I need, in the general case, to be able to stop it, fix things, and restart it. Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Terry Lambert 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com It's usually straightforward for the daemon to vend the appropriate self-manipulation functionality; frequently you want to gate this with application-specific logic anyway. Why do you need 'stop'? Why can't you just ask the daemon to enter a state where it refuses requests? So just fix it and tell it to exit. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 10, 2009, at 9:31 AM, Bill Janssen <janssen(a)parc.com> wrote: Michael Smith <drivers(a)mu.org> wrote: On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: Michael Smith <drivers(a)mu.org> wrote: Well, the daemon does a lot of things, but what I'm concerned with is stop, start, and restart. Because I want to fix it with new code. When a process exits and launchd restarts it, launchd doesn't know if it's running old code or new code when it's relaunched, it just knows its path. This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Bill Janssen 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Michael Smith <drivers(a)mu.org> wrote: > > On Apr 9, 2009, at 9:30 AM, Bill Janssen wrote: > > > Michael Smith <drivers(a)mu.org> wrote: > >> It's usually straightforward for the daemon to vend the appropriate > >> self-manipulation functionality; frequently you want to gate this > >> with > >> application-specific logic anyway. > > > > Well, the daemon does a lot of things, but what I'm concerned with is > > stop, start, and restart. > > Why do you need 'stop'? Why can't you just ask the daemon to enter a > state where it refuses requests? Because I want to fix it with new code. Bill _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: testing the current bootstrap context?
by Michael Smith 10 Apr '09

10 Apr '09

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0