July 2010 - Darwin-kernel - lists.apple.com

Re: copyfile(3) copies the posix "owner" for *some* files only
by Michael Smith 25 Jul '10

25 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

copyfile(3) copies the posix "owner" for *some* files only
by Jerry Krinock 25 Jul '10

25 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello, I'm using copyfile(3) in a privileged helper tool to copy files between Mac user accounts. Regarding the posix file "owner", i.e. the "jk 501" in this ls output: -rw-r--r-- 1 jk 501 0 Sep 11 2008 Hello.txt I see that, for some files, the copied file's owner is consistently that of its version in the source, and for others, it is consistently the user ID of the helper tool. I haven't figured out a pattern yet. The man page copyfile(3) does not mention the file's owner, although it does say there is a flag to copy the "POSIX information (mode, modification time, etc.)", which I have set. Is the POSIX owner included in "etc."? Has anyone ever seen this not work? Jerry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Sources of PF in SL
by Platon Fomichev 21 Jul '10

21 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha1; c=relaxed; d=elverils.com; h=message-id :from:to:in-reply-to:content-type:content-transfer-encoding :mime-version:subject:date:references; s=elverils.com; bh=1ol6pH cq2s6YuB9BFyNkhumH/Qg=; b=SHYAilJt06OnCD9iC4mcEyCzi7dvf9uR8mnDuk lun4m1jRC4G1Bkt/A1XdxVSdd4VaqEY1MyINmq/J0DUhhYm5Xr5mdFlg1emymSgZ l6T9TFeLz9kR90AkRGDhvmPrJGZsizLPyBsNkz10B4QayPo1be4Rg6js5Eax4yY5 WafpQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=elverils.com; h=message-id:from :to:in-reply-to:content-type:content-transfer-encoding :mime-version:subject:date:references; q=dns; s=elverils.com; b= 3SvwYpgEs6G77tFbQuqOtAkZRjD9S23YMx8dsCYaCs3dRkoz1YDvRi11VjueBLEV 66jc27dd2PQC8JKs0EbMO0oXlJL9cOVf8c2qElNSotlvf8RGeblOaMLkTI5GtT8y 1rMgJqxucJi5RB+6ePeAnAtC2kebPGsrFgZtXrkZ9dg= Hey-ho everyone! So - any ideas on future of PF in XNU? Best regards, Platon Fomichev _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks to generous community help I was able to access all unexported xnu symbols and thus PF development is going fine. But even more a gigantic leap is the presence of PF sources in SL XNU! I've tried to understand whether PF is a part of SL server or something in that way but it does not seem to be used anywhere in SL at all. Can anyone shed any light on PF presence in SL - it does not look to be present in kernel (no sysctl entries), there are no sources of pfctl (can anyone point me to them)? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing a socket fd from user mode to a kernel module
by Joe Lowe 18 Jul '10

18 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.16 (Windows/20080708) Terry, Joe L. I have a file system kernel module that exposes a remote file system via a file system protocol over a socket. Creating/connecting the socket and performing initial authentication to the server is done in user mode. The socket is then handed to the kernel module via an ioctl to a control device. I have worked out what seem to be the correct kernel calls for this. converting the fd to a socket reference in the kernel module: file_socket sock_retain file_drop using the socket from a dedicated kernel thread: sock_send sock_receive cleanup: sock_shutdown sock_release The primary problem is that the sock_retain and sock_release kernel calls are private exports and are not defined in the public kernel headers. Without these calls the socket will get torn down when the user mode process exits or closes the fd. You could write most of the FS code itself in user space; this is typically what happens for e.g. WebDAVFS for FTPFS. Alternately, you could take a reference on the proc in user space, which would block it from exiting in proc_refdrain() (someone here recently had a problem with this) until you did the proc_rele() on the reference. This would keep the socket around, and you would be, by proxy, using the processes socket. If you can get the socket information out, however, then you don't need to do this, so long as you respect the user space process taking the socket away out from under you. Another alternative is to have a control socket in user space, but have the connection socket set up and torn in kernel space. You could proxy the authentication conversation to user space by reading from the control and writing to the connection, and vice versa, until the conversation was complete, allowing the user space process to exit at that time (and tearing down the control socket). In general, resource tracking is scoped on a per-process basis. While under the covers, it's possible that the implementation details are that the reference scoping is system wide, you generally cannot depend so heavily on the implementation details not changing that you would be able to take something like a socket from process to kernel reference scope, and be assured that this would be sustainable in future releases. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… > You could write most of the FS code itself in user space; this is typically what happens for e.g. WebDAVFS for FTPFS. Most of the FS code is already in user mode, either in a local file server process on the other end of a domain socket, or on a remote system on the other end of a network socket or some other type of comm channel. Adding a user mode pump to tie the socket to some other comm mechanism will limit performance and will not get a significant amount of additional logic out of the kernel. > Alternately, you could take a reference on the proc in user space, which would block it from exiting in proc_refdrain() (someone here ... The arbitrary process that creates the socket needs to be able to exit on its own terms. My main concern is that I do things in the most stable and supportable way. Using a helper daemon to hold an fd open in user mode as a way to keep the kernel socket object referenced is something that had occurred to me, I just consider it convoluted and fragile. Terry Lambert wrote: On Jul 16, 2010, at 6:54 PM, Joe Lowe wrote: Am I missing something? -- Terry This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing a socket fd from user mode to a kernel module
by Terry Lambert 17 Jul '10

17 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 16, 2010, at 6:54 PM, Joe Lowe wrote: > I have a file system kernel module that exposes a remote file system via a file system protocol over a socket. Creating/connecting the socket and performing initial authentication to the server is done in user mode. The socket is then handed to the kernel module via an ioctl to a control device. > > I have worked out what seem to be the correct kernel calls for this. > > converting the fd to a socket reference in the kernel module: > file_socket > sock_retain > file_drop > > using the socket from a dedicated kernel thread: > sock_send > sock_receive > > cleanup: > sock_shutdown > sock_release > > The primary problem is that the sock_retain and sock_release kernel calls are private exports and are not defined in the public kernel headers. Without these calls the socket will get torn down when the user mode process exits or closes the fd. > > Am I missing something? You could write most of the FS code itself in user space; this is typically what happens for e.g. WebDAVFS for FTPFS. Alternately, you could take a reference on the proc in user space, which would block it from exiting in proc_refdrain() (someone here recently had a problem with this) until you did the proc_rele() on the reference. This would keep the socket around, and you would be, by proxy, using the processes socket. If you can get the socket information out, however, then you don't need to do this, so long as you respect the user space process taking the socket away out from under you. Another alternative is to have a control socket in user space, but have the connection socket set up and torn in kernel space. You could proxy the authentication conversation to user space by reading from the control and writing to the connection, and vice versa, until the conversation was complete, allowing the user space process to exit at that time (and tearing down the control socket). In general, resource tracking is scoped on a per-process basis. While under the covers, it's possible that the implementation details are that the reference scoping is system wide, you generally cannot depend so heavily on the implementation details not changing that you would be able to take something like a socket from process to kernel reference scope, and be assured that this would be sustainable in future releases. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing a socket fd from user mode to a kernel module
by Joe Lowe 17 Jul '10

17 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.16 (Windows/20080708) Bogdan, > Since you already have a control device, how about having the kernel > create the socket and connect to the server, then forward data from > the server into the control socket and from the control socket to the > server ? When the auth is complete, user process closes the control > socket and exits. Joe L. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Creating the socket in kernel mode is something I have considered, but this would reduce supportability and flexibility of the kernel module and break compatibility with the established design. In addition to the application handling authentication, it also controls what type of connection is being used to the server: domain socket, or network socket and which protocol and security options, or custom communication device. The kernel module is not necessarily customized for each application. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Passing a socket fd from user mode to a kernel module
by Bogdan Harjoc 17 Jul '10

17 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=/D0zrQ2OShr/crrnpPlkLlmAiLq1V0n7Nk8Sg8AKYIo=; b=tOOS6ZzEnEE0pPKgNtOpUaXEEphX0UeufPJgc3Tt2mKldNbkRAz8FdvFH0MuSox1aP ZqPMuXWhGgBapZco8obZQkPgmhvsEccfMo9YIBN4h55hgpExVuELD3lCy0wJmnhSHlN9 bO7wVzoscohK0VXD/EfmLesZ+9BFpvVax1jxo= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=uO1yVaBlBEPPuGT8WL0Ji85j+algGzHdp5U2wB1iUozJItiiSyEo2yZTnfR+rKmqIi jXPtwZRh4UsTL2pzVLqBxPUcm9qVG7IyoFoadfCssyPcodaHHBTCaZot47hTv8w0yBdx kXzGoX2VdNn2l3b8pz6YHIpv3t722T5/sn9Ug= Since you already have a control device, how about having the kernel create the socket and connect to the server, then forward data from the server into the control socket and from the control socket to the server ? When the auth is complete, user process closes the control socket and exits. Bogdan Harjoc On Sat, Jul 17, 2010 at 4:54 AM, Joe Lowe <joe.lowe(a)pismotechnic.com> wrote: > I have a file system kernel module that exposes a remote file system via a > file system protocol over a socket. Creating/connecting the socket and > performing initial authentication to the server is done in user mode. The > socket is then handed to the kernel module via an ioctl to a control device. [...] > The primary problem is that the sock_retain and sock_release kernel calls > are private exports and are not defined in the public kernel headers. > Without these calls the socket will get torn down when the user mode process > exits or closes the fd. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Passing a socket fd from user mode to a kernel module
by Joe Lowe 17 Jul '10

17 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.16 (Windows/20080708) I have worked out what seem to be the correct kernel calls for this. converting the fd to a socket reference in the kernel module: file_socket sock_retain file_drop using the socket from a dedicated kernel thread: sock_send sock_receive cleanup: sock_shutdown sock_release Am I missing something? Joe Lowe _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have a file system kernel module that exposes a remote file system via a file system protocol over a socket. Creating/connecting the socket and performing initial authentication to the server is done in user mode. The socket is then handed to the kernel module via an ioctl to a control device. The primary problem is that the sock_retain and sock_release kernel calls are private exports and are not defined in the public kernel headers. Without these calls the socket will get torn down when the user mode process exits or closes the fd. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Need to gain access to unexported symbols
by Terry Lambert 16 Jul '10

16 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 16, 2010, at 4:09 AM, Antoine Missout wrote: > I've created <rdar://8199262> regarding the issue of new loaders, to help the chances this get added for both Wine & XBinary. Thanks! > > - Antoine > > ps: Terry: is it voluntary I get radio silence offlist ? Sorry, just incredibly busy. I have to pick a limited set of things to respond to, since these lists are not a support channel and participation is effectively extracurricular. I generally try to pick things where the response is going to be useful to the largest number of people, usually on my own time (for example, it's lunch time here right now). I try top get to everything eventually, but it doesn't happen immediately. -- Terry > > > On 2010-07-14, at 2:22 PM, Terry Lambert wrote: > >> Hi, I'm the one who rewrote the exec code several times since Panther, including implementing the posix_spawn() code, and adding the execsw[] table, as well as dealing with many of the issues of multithreaded [v]fork() and exec() introduced by GCD. >> >> No data table is likely to become KPI, for the simple reason that data interfaces can't be as easily revised as procedural interfaces, and locking it into a specific data structure design is simply bad engineering practice. >> >> Likewise, any procedural KPI for adding your own entries is unlikely to permit overriding existing entries, which would, in my preference, be in read-only pages whose mappings are not under kernel control, and not accessible by physical address. This would be for security reasons. New entries, if permitted, would most likely go at the end of the table. This would accommodate Evan's PELoader code for the modified COFF executables used for Windows .EXE files, since they don't match the "magic numbers" for existing entries, and things like Amit Singh's ELF loader code, but *NOT* accommodate interposition, for which other KPI would be preferred. >> >> I'm aware of how the execsw[] hacks work in both cases, and the use is, as I've explained before, unsupported, although no one has gone out of their way to explicitly break it, and probably no one will unless there's a compelling reason to change the data structure. But people should be aware of the issues surrounding the use of this type of hack. >> >> If you have a specific request for KPI for this sort of thing, or for other reasons, please file a bug report including your rationale and the problem(s) you are trying to solve. >> >> Without a bug report to hang the code changes off of, we have to arrive at it ourselves as desired feature work, and without a customer, it's not likely to make a product schedule unless it's a blindingly brilliant idea. >> >> -- Terry >> >> On Jul 14, 2010, at 9:46 AM, Antoine Missout wrote: >>> I hope Apple will provide an API to add/remove entries in execsw. They could at least leave a few blank entries :P >>> We also modify the table for other reasons in a product we'll soon release, and we might conflict if our kext and yours are not unloaded in reverse order of loading. >>> Not sure how we can avoid this without official KPIs. >>> - Antoine >>> >>> >>> On 2010-07-14, at 10:12 AM, Evan Lojewski wrote: >>> >>>> I neglected to mention that I've only used this approach on Snow >>>> Leopard. When using it on Leopard, I did run into one or two issues. >>>> I'll setup a Leopard machine tonight to verify if it works or not. >>>> >>>> I'd suggest placing the symbol kext inside of your real kext >>>> (Contents/PlugIns/MissyingSymbols.kext) rather than placing it in >>>> System.kext. I'd also suggest that you don't use com.apple.kpi for the >>>> bundle identifier, use your own identifier for this. >>>> >>>> On Snow Leopard (not sure about leopard), kextstat does report the >>>> com.apple.kpi.* and com.apple.kernel.* kexts. When I load the symbol >>>> kext it also shows up. >>>> >>>> If you want to test a kext on Leopard that I know works perfectly on >>>> Snow Leopard using this method, this >>>> (http://dl.dropbox.com/u/863180/wineHelper.kext.zip) should work, >>>> however I haven't tested it on Leopard. This kext just modifies the >>>> _execsw variable to cause the kernel to load wine when an .exe file is >>>> run. >>>> >>>> Evan Lojewski >>>> >>>> On Wed, Jul 14, 2010 at 6:21 AM, Platon Fomichev <pfomichev(a)elverils.com> wrote: >>>>> Dear Evan >>>>> >>>>> I tried your approach (Leopard 10.5.8) and indeed it sounds like a >>>>> salvation. Alas it does not work. I will show my progress: >>>>> >>>>> 1) Created a 'symbol' kext that has several exports. Placed it into PlugIns, >>>>> touched the 'Extensions' and tried to load it. >>>>> >>>>> iMac:Development stauff$ sudo kextload >>>>> /System/Library/Extensions/System.kext/PlugIns/MissingSymbols.kext/ >>>>> extension >>>>> /System/Library/Extensions/System.kext/PlugIns/MissingSymbols.kext/ is a >>>>> kernel component >>>>> >>>>> After reboot it does not show up in kextstat, and probably won't as I >>>>> haven't found any traces of system loading PlugIns module, they are >>>>> hardcoded into KernelConfigTables.cpp >>>>> >>>>> 2) Created a 'real' kext that links against 'symbol' kext. Tried loading it. >>>>> Here is a log: >>>>> >>>>> kextload: mapping module file >>>>> /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel.6.0 >>>>> kextload: module file >>>>> /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel.6.0 is >>>>> already mapped >>>>> kextload: mapping module file >>>>> /System/Library/Extensions/System.kext/PlugIns/MissingSymbols.kext/MissingSymbols >>>>> <-------- Here is symbol kext >>>>> kextload: module file >>>>> /System/Library/Extensions/System.kext/PlugIns/MissingSymbols.kext/MissingSymbols >>>>> is already mapped >>>>> kextload: mapping module file >>>>> /System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext/BSDKernel >>>>> kextload: module file >>>>> /System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext/BSDKernel is >>>>> already mapped >>>>> kextload: mapping module file >>>>> /System/Library/Extensions/System.kext/PlugIns/Unsupported.kext/Unsupported >>>>> kextload: module file >>>>> /System/Library/Extensions/System.kext/PlugIns/Unsupported.kext/Unsupported >>>>> is already mapped >>>>> kextload: mapping module file >>>>> /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/Libkern >>>>> kextload: module file >>>>> /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/Libkern is >>>>> already mapped >>>>> kextload: mapping module file >>>>> /Users/stauff/cvs/wm/client/osx/build/Development/testnke.kext/Contents/MacOS/testnke >>>>> kextload: module file >>>>> /Users/stauff/cvs/wm/client/osx/build/Development/testnke.kext/Contents/MacOS/testnke >>>>> is already mapped >>>>> kextload: patching C++ code in module >>>>> /Users/stauff/cvs/wm/client/osx/build/Development/testnke.kext/Contents/MacOS/testnke >>>>> kextload: link/loading file >>>>> /System/Library/Extensions/System.kext/PlugIns/System6.0.kext/kernel.6.0 >>>>> kextload: link/loading file >>>>> /System/Library/Extensions/System.kext/PlugIns/MissingSymbols.kext/MissingSymbols >>>>> <--- It is even loading >>>>> kextload: link/loading file >>>>> /System/Library/Extensions/System.kext/PlugIns/BSDKernel.kext/BSDKernel >>>>> kextload: link/loading file >>>>> /System/Library/Extensions/System.kext/PlugIns/Unsupported.kext/Unsupported >>>>> kextload: link/loading file >>>>> /System/Library/Extensions/System.kext/PlugIns/Libkern.kext/Libkern >>>>> kextload: opaque link for >>>>> /Users/stauff/cvs/wm/client/osx/build/Development/testnke.kext/Contents/MacOS/testnke >>>>> kextload: link/loading file >>>>> /Users/stauff/cvs/wm/client/osx/build/Development/testnke.kext/Contents/MacOS/testnke >>>>> kextload: allocated 28672 bytes in kernel space at 0x41679000 >>>>> kextload: using load address of 0x41679000 >>>>> kextload: kmod name: com.aep.kext.idprint >>>>> kextload: kmod start @ 0x4167eeee (offset 0x52ae) >>>>> kextload: kmod stop @ 0x4167ef02 (offset 0x52c2) >>>>> kextload: module com.aep.kext.idprint created as # 114 at address >>>>> 0x41679000, size 28672 >>>>> kextload: adding reference from com.aep.kext.idprint (114) to >>>>> com.apple.kpi.libkern (5) >>>>> kextload: adding reference from com.aep.kext.idprint (114) to >>>>> com.apple.kpi.unsupported (7) >>>>> kextload: adding reference from com.aep.kext.idprint (114) to >>>>> com.apple.kpi.bsd (2) >>>>> kextload: adding reference from com.aep.kext.idprint (114) to >>>>> com.apple.kpi.missingsymbols (0) <--- bad sign?? ID of missing symbols is >>>>> zero >>>>> kextload: kmod retain failed for com.aep.kext.idprint; destroying kmod >>>>> kextload: a link/load error occured for kernel extension testnke.kext/ >>>>> kextload: clearing all version/dependency relationships among kernel >>>>> extensions >>>>> link/load failed for extension testnke.kext/ >>>>> (run kextload with -t for diagnostic output) >>>>> >>>>> What am I doing wrong, please advise. >>>>> >>>>> Best regards, >>>>> Platon >>>>> >>>>> _______________________________________________ >>>>> Do not post admin requests to the list. They will be ignored. >>>>> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >>>>> Help/Unsubscribe/Update your Subscription: >>>>> http://lists.apple.com/mailman/options/darwin-kernel/meklort%40gmail.com >>>>> >>>>> This email sent to meklort(a)gmail.com >>>>> >>>> _______________________________________________ >>>> Do not post admin requests to the list. They will be ignored. >>>> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >>>> Help/Unsubscribe/Update your Subscription: >>>> http://lists.apple.com/mailman/options/darwin-kernel/antoine.missout%40meta… >>>> >>>> This email sent to antoine.missout(a)metakine.com >>> >>> _______________________________________________ >>> Do not post admin requests to the list. They will be ignored. >>> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >>> Help/Unsubscribe/Update your Subscription: >>> http://lists.apple.com/mailman/options/darwin-kernel/tlambert%40apple.com >>> >>> This email sent to tlambert(a)apple.com >> > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

IP filter: dropped packets sent to filter again
by Bogdan Harjoc 16 Jul '10

16 Jul '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:content-type; bh=j5maG4SNsn+rPw3Lu4VrO7aYxtcO6+w+tuXLKGfSN3I=; b=CvsckxQ5rBD3puAx2AecHYksPngkQgLUoqjqaczN1X3jwhBK0rCncZnHH3smt62lUw Mr7swfS6Xie6zf+FbLyO1gin0bvCYp5MCIyl6WUBgLyMOweItG7FFbRdb5umAQCxW7BI nHHceRRD485WHB3Nc3g5Yc2jEvYg6EZ0Uft4Q= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=Dyd0nkThyboqK835DW8KHMAD+12odVdGv+0FxjuRdEUmZJDXdbNMpBK2RimmyW1rMK mqy6QE4Ty/UM5ThEbYM5xS0Oc7fElkbbO0BRxvdQl5AjkNsbYBpIAdRz1Ga5DHsfh0No ZPD+MBUOcDrZuI7U8T3WefuuZAd09BpiGA1BQ= Hi, I'm using the ipf_filter KPI for delaying some TCP packets, by returning EJUSTRETURN or some other non-zero value from the ipf_input callback. Apparently the callback receives the same mbuf (20 times in less than a second) unless I reinject the packet in the next 100msecs or so. I am clearly misunderstanding the way packets should be dropped, so I'd appreciate a hint. Minimal 1-page source code that shows what I'm doing is attached. Thanks, Bogdan Harjoc #include <mach/mach_types.h> #include <libkern/libkern.h> #include <sys/systm.h> #include <sys/kpi_mbuf.h> #include <netinet/in.h> #include <netinet/ip.h> #include <netinet/tcp.h> #include <netinet/kpi_ipfilter.h> static ipfilter_t ip_filter_ipv4_ref = NULL; static errno_t pr_ip_input(void* cookie, mbuf_t *data, int offset, u_int8_t protocol) { struct ip *ih; struct tcphdr *th; if (! (data && *data)) return 0; if (protocol != IPPROTO_TCP) return 0; ih = mbuf_data(*data); th = (struct tcphdr *)(((char *)ih) + offset); #define F(v) !!(th->th_flags & v) printf("in: %p syn=%d ack=%d fin=%d rst=%d\n", *data, F(TH_SYN), F(TH_ACK), F(TH_FIN), F(TH_RST)); if (th->th_flags & TH_FIN) return EINVAL; else return 0; } static errno_t pr_ip_output(void* cookie, mbuf_t *data, ipf_pktopts_t options) { return 0; } static void pr_ip_detach(void* cookie) { } static struct ipf_filter ip_filter_ipv4 = { .name = "ipftest", .ipf_input = pr_ip_input, .ipf_output = pr_ip_output, .ipf_detach = pr_ip_detach, }; kern_return_t ipftest_start(kmod_info_t * ki, void * d) { printf("=== start\n"); return ipf_addv4(&ip_filter_ipv4, &ip_filter_ipv4_ref); } kern_return_t ipftest_stop(kmod_info_t * ki, void * d) { printf("=== stop\n"); return ipf_remove(ip_filter_ipv4_ref); } extern kern_return_t _start(kmod_info_t *ki, void *data); extern kern_return_t _stop(kmod_info_t *ki, void *data); __private_extern__ kern_return_t ipftest_start(kmod_info_t *ki, void *data); __private_extern__ kern_return_t ipftest_stop(kmod_info_t *ki, void *data); KMOD_EXPLICIT_DECL(dsd.kext.ipftest, "1.0.0d1", _start, _stop) __private_extern__ kmod_start_func_t *_realmain = ipftest_start; __private_extern__ kmod_stop_func_t *_antimain = ipftest_stop; __private_extern__ int _kext_apple_cc = __APPLE_CC__; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0