February 2012 - Darwin-kernel

Capture first IP packet with NKE
by Mike C. 24 Feb '12

24 Feb '12

Hello, I have written a Network Kernel Extension (NKE) with an IP filter. How can I make sure that the filter sees the very first IP packet processed by the operating system right after the system starts up? I tried to launch the NKE with launchd, but it sometimes misses the very first IP packet (it's a IPv6 Router Advertisement). The operating system processes it without my IP filter seeing it. Any suggestions on how to launch a NKE before the operating system starts to process IP packets? Thanks a lot! _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

dtrace profiling in 11.0
by Andrew Gallatin 23 Feb '12

23 Feb '12

I'm having some troubles getting scripts that use the profile:: stuff to work in 11.0. They seem to do exactly nothing: <1:02pm>macpro03/gallatin:darwin>sudo /usr/bin/cpuwalk.d Sampling... Hit Ctrl-C to end. <wait 60 seconds> ^C <1:03pm>macpro03/gallatin:darwin> Whereas on a different mac running 10.x, it works: <DING!>macpro02/gallatin:~> sudo /usr/bin/cpuwalk.d Sampling... Hit Ctrl-C to end. ^C PID: 18 CMD: notifyd value ------------- Distribution ------------- count < 0 | 0 0 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ 3 1 | 0 <....> Is there some trick to getting dtrace profiling to work in Lion? Thanks, Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

"Designing custom routing technologies." - How would I do that?
by Markus Hanauska 23 Feb '12

23 Feb '12

This document is primarily of interest to developers who need to extend or modify the Mac OS X networking infrastructure. > This includes: * Adding support for new, non-ethernet interface types. * Designing custom routing technologies. * Creating link-layer encryption technologies. It's the second example I'm interested in: "Designing custom routing technologies" Regards, Markus _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com I just reread the documentation document named "Introduction to Network Kernel Extensions Programming Guide". In the section "Technology Overview" of the "Introduction" I found the following interesting statement: I have already written network kernel extensions in the past, one of the type interface filters (in the very early days of OS X, since there was no better way available) and later on several ones of the type IP filter (which are much more convenient when dealing with IP traffic). So I can assure you that I have quite some knowledge about this topic, however I have absolutely no idea how I could implement my own custom routing technology in any kind of network extension. At the moment all routing related topics are handled by a user space process, that manipulates the routing table as appropriate by adding, removing and altering routes. This approach has two big drawbacks: 1) I'm in a constant race condition with the rest of the system, that tries to manage the routing table as well. E.g. plugging in an Ethernet cable modifies the routing table; a new default route might be set and if I have a router for the same network as the interface is been told via DHCP, my route is just overwritten (changed) from some indirect to a direct interface route. If my app is going to delete the routes it has created (and thinks its still in place), it would accidentally delete the interface route and that way "kill" the Ethernet interface or even worse, delete the default route. As there is no way to "lock" the routing table, it's also not possible to look up a route and only change/delete it if I get the expected look up result. Between the look up and my change request the table may have been altered again. 2) I'm limited to the routing capabilities of the system. E.g. I cannot set routing rules depending on service, as this is not support by Darwin. I can set a rule how to route 192.168.1.50, but I cannot have a different route depending if this is SMTP (port 21) or HTTP (port 80) traffic or possibly no TCP/UDP traffic at all. Of course I can create an IP filter, catch IP packets according to a set of "rules" and forward these directly to interfaces as I wish, but this approach has other issues. I can name at least 3: I) If the interface does not fragment IP packets on its own, I have to fragment them myself in my code. I might even have to caculate checksums myself, though I believe there is a function I can use to force the system to calculate all missing checksums immediately. II) If an application connects a socket to a remote address, even if this is just an UDP socket, and then calls getsockname() to find out the local address of this socket, it will retrieve the address according to the routing table; however, this may not be the right address, since my code may route this traffic to a different interface with a different IP address. If the app is using some protocol that includes the local IP address somewhere in the payload, this has a huge potential for all kind of problems. III) Similar to (II), if an application queries the routing table for a specific destination address, it might being told a wrong interface, including wrong interface parameters (e.g. think of MTU). I don't see any way a network kernel extension, or any other kernel extension for that matter, could register a callback for routing decisions of the system. Ideally there would be a way my code can tell the system how to route certain kind of traffic without having to ever touch the routing table at all. Is there a way an IP filter can influence how the packet is routed once it allowed it to pass on? If such a functionality exists, I have not been able to find it so far.

1 0

Re: sending messages from kernel space/ kexts to user space
by Phil Jordan 23 Feb '12

23 Feb '12

On Mon, Feb 20, 2012 at 2:56 AM, me <kernelkangaroo(a)gmail.com> wrote: > Thanks, Eric! I purchased Amit Singh's book. The review on Halvorsen's book said that it mainly covered device drivers. Is this correct? Singh's book is a bit dated at this point, and most of it isn't about practical kernel programming as such - it's more of a description of the whole system, going well beyond just the kernel, and with just one chapter on making your own kexts. Having said that, I still look things up in it with some regularity, as some things haven't changed (much) since OSX 10.4. It's around 1200 pages, so even if most of it isn't of much interest to you, there will undoubtedly be some useful stuff in there. Halvorsen's book is rather more practical and focused on kext programming. Things like memory management, user/kernelspace communication, synchronisation and threading, debugging, etc. are generally applicable to all kinds of kernel extension. As you say there are quite a few chapters for various different types of device drivers, but IIRC there's also a chapter specifically about non-device-driver network kexts. Contrary to what the title of the book suggests, there's no practical info about iOS in there, by the way, I can only assume that's a marketing gimmick. Amazon's "look inside" feature is probably your best bet for deciding what to go for. (disclosure: I was one of the tech reviewers for the Halvorsen book - I don't get any incentives, financial or otherwise for recommending it; note also that I only read an early draft of the book, but as far as I know the structure stayed the same) Hope that helps, phil _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: sending messages from kernel space/ kexts to user space
by me 20 Feb '12

20 Feb '12

Thanks, Eric! I purchased Amit Singh's book. The review on Halvorsen's book said that it mainly covered device drivers. Is this correct? Trip On Feb 18, 2012, at 9:32 PM, Eric Gorr wrote: > > On Feb 18, 2012, at 9:50 PM, me wrote: > >> I have been examining the kauthORama code on the apple web site. I am interested in monitoring file_open requests. Can anyone direct me to suitable documentation or examples whch explain the way or mechanisms to send messages or strings to user land applications? Would this involve the creation of ports? Can this done in a kext? Can you /should you send messages from a kext? > > > I might recommend picking up a copy of: > > OS X and iOS Kernel Programming [Paperback] > Ole Henry Halvorsen (Author), Douglas Clarke (Author) > • ISBN-10: 1430235365 > • ISBN-13: 978-1430235361 > > also, do a search for Apple's documentation 'Kernel Extension Programming Topics.' It is quite good, but can be a bit dense in some places. > > https://developer.apple.com/library/mac/#documentation/Darwin/Conceptual/KE… > > > And, yes, it is certainly possible to send data between user land and a kext. > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: sending messages from kernel space/ kexts to user space
by Eric Gorr 19 Feb '12

19 Feb '12

On Feb 18, 2012, at 9:50 PM, me wrote: > I have been examining the kauthORama code on the apple web site. I am interested in monitoring file_open requests. Can anyone direct me to suitable documentation or examples whch explain the way or mechanisms to send messages or strings to user land applications? Would this involve the creation of ports? Can this done in a kext? Can you /should you send messages from a kext? I might recommend picking up a copy of: OS X and iOS Kernel Programming [Paperback] Ole Henry Halvorsen (Author), Douglas Clarke (Author) • ISBN-10: 1430235365 • ISBN-13: 978-1430235361 also, do a search for Apple's documentation 'Kernel Extension Programming Topics.' It is quite good, but can be a bit dense in some places. https://developer.apple.com/library/mac/#documentation/Darwin/Conceptual/KE… And, yes, it is certainly possible to send data between user land and a kext. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

sending messages from kernel space/ kexts to user space
by me 19 Feb '12

19 Feb '12

I have been examining the kauthORama code on the apple web site. I am interested in monitoring file_open requests. Can anyone direct me to suitable documentation or examples whch explain the way or mechanisms to send messages or strings to user land applications? Would this involve the creation of ports? Can this done in a kext? Can you /should you send messages from a kext? Thanks, Trip _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: vfs: is there any way to distinguish read() for different file descriptors
by Anatol Pomozov 06 Feb '12

06 Feb '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

How to rebuild kernel cache for Recovery HD system ?
by Alexander Klyuev 02 Feb '12

02 Feb '12

Hi everybody, Is there any way to rebuild kernelcache file for "Recovery HD" system ? Meaning where to get corresponding "mach_kernel" image to build prelinked system kernel ? mach_kernel from main system may definitely be used when "Recovery HD" system is of same version. But what to do if main and "Recovery HD" system versions are different ? Any ideas would be highly appreciated. Thanks, Alexander _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0