September 2018 - Darwin-kernel

Re: IOSharedDataQueue Bug
by Quinn "The Eskimo!" 20 Sep '18

20 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 20 Sep 2018, at 11:24, Ricardo Ungureanu <ricardoungureanu(a)gmail.com> wrote: > Could you please review it and speed up the fixing process? Thanks for taking the time to investigate and fix this. Alas, darwin-kernel’s role isn’t to support bug fix integration. The best way to get this fix to the folks who can review and integrate it is to file a bug report using Apple Bug Reporter. <https://developer.apple.com/bug-reporting/> Please post your bug number, just for the record. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

IOSharedDataQueue Bug
by Ricardo Ungureanu 20 Sep '18

20 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=o2ADJY45w85Z1RN13wvqpJGOu8skQDHxGzUE9Lmash4=; b=CWWxCbO/Jc9mMtrvqyMrlB+y50B9zKtBG0R8hyGuoe1wfGLuYglAOe6ux/uIRb1cyE QPOsmKZcKjDk1ANGpf5wzUyWZDdzsW0U0A1tH/e7dWCufzO0QGv2qqtphmULxR/b7F7S A5toOUjuDEyUEY11jhsbGmjHilgsY/70pXWhReVHB2JDn8e/U6sawkrCAvnfW/+G5PGe IRTJlG6DSQujzrV65NVGIEy6JdnEDWG0mOVW/2MG6+HECXDo9fXSmfAphHezLd1du/10 rp8TvhdYy1MqPu4ZGA8lZnrKCFsJKoFDUcC/7tTxQWFU6qjXbERRx8zJ8QXRkfrDbI5K 1aaQ== Hi, I found a bug in IOSharedDataQueue where the peek function fails although the queue is not empty. Could you please review it and speed up the fixing process?. Here [1] is my detailed explanation alongside with the pull request. Thanks, Ricardo [1] https://github.com/apple/darwin-xnu/pull/15 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Chaining socket filters
by Quinn "The Eskimo!" 20 Sep '18

20 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 19 Sep 2018, at 21:31, Prokash Sinha <prokash(a)garlic.com> wrote: > So there are two returns to indicate, if the kernel continue thru the chain > or not. It’s based on the function result: * 0 sends the request down the chain * `EJUSTRETURN` prevents the request going down the chain but doesn’t signal an error to the caller * any other error prevents the request going down the chain and signals that error to the caller You can see this in action in Darwin. For example, consider your `sf_data_out` function. It’s called by `sflt_data_out`, which iterates through the filters call the `sf_data_out` on each filter. That returns if it gets any error. The caller, `sosend`, specifically looks for `EJUSTRETURN` and… well… just returns <https://opensource.apple.com/source/xnu/xnu-4570.1.46/bsd/kern/kpi_socketfi…> <https://opensource.apple.com/source/xnu/xnu-4570.1.46/bsd/kern/uipc_socket.c> ps You might want to post your socket filter questions to the MacNetworkProg mailing list. While I’m happy to answer them here, that list has other members with direct experience with this stuff. <https://lists.apple.com/mailman/listinfo/macnetworkprog> Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Chaining socket filters
by Prokash Sinha 19 Sep '18

19 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Folks, I’ve a question about the possibility of chaining socket filter. So assume I have two socket filters, and I want to register them ( let’s say globally ). Now I would assume they would be chained along with the existing ones ( if any ). Now what is the mechanism of hand-off ( For example, a shared ISR vector can have multiple interrupts registered thru a chain. Or like multiple exception handling registered in some stack fashion ). So there are two returns to indicate, if the kernel continue thru the chain or not. Is it possible ? If so, then what would be the return indicator/value so that the Network BF module can pass it along the chain. And what would be the value to cut short ( of course without error, something like EJUSTRETURN ??? ). Thanks, Prokash _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Hello, need some help about socket filter (NKE) development
by Derek Fawcus 17 Sep '18

17 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Mutt/1.10.1 (2018-07-13) On Fri, Sep 14, 2018 at 02:40:43PM +0800, Haohao Lee wrote: > typedef errno_t (*sf_connect_out_func)(void *cookie, socket_t so, const > struct sockaddr *to); > Only remote address is provided. > > How can I get the local address in sf_connect_out_func or is there another > way to achieve this? I've not checked the darwin source for this, but generally connect seems to do an internal bind first if not already called by the user. So maybe there will be an initial form of bind callback from where you can stash the source address? DF _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Hello, need some help about socket filter (NKE) development
by Quinn "The Eskimo!" 17 Sep '18

17 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 15 Sep 2018, at 08:53, Haohao Lee <hayatelee(a)gmail.com> wrote: > If I call `sock_getsockname` in `sf_connect_out_func`, an empty address will > be returned. Yeah, I suspect that might be the case. One option is to defer your call to `sock_getsockname` until you get the first data in or out. I’d expect it to be set up by that. However, that introduces its own problems, in that you can no longer block a connection. Rather, the program will see the connection go through and then, if you decide to block it, immediately disconnect. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Hello, need some help about socket filter (NKE) development
by Haohao Lee 15 Sep '18

15 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qTKvZMjwxmLOsu3u6guUg0Z49UvXZOv6jCrPsdjRF2M=; b=JgHDOJocaRUiJ4DQDi138/Wpq//ng8LaLCVpOkQexqmpBTTc+UqQvxcYKYmV8WPSWe hfTQI80CF+pceI8A6sL/BUS7sERDHwQc0p1tMXGsEfTTo7HK0JFqCgnbAOHSPVz0TJDz E+SYb/iD+fp7rA11OppNr2TLplzBGwkeffusIOsJDLsXYp1wFazgVKvCg4ZsRQf50HHM Z+yiryrseDSuIvvxqzLODb+kk6hpIc3SePd8lvxji6tdopEmOSbe2UvYE4KT8P086Af7 NOIoGu0g2Adt9nX5E1SCqaM0rW2W7vQLSFrFEXwyOpXejTKC9eRJdaHwnURgq41LWrZC ytJw== On Fri, Sep 14, 2018 at 4:13 PM Quinn "The Eskimo!" <eskimo1(a)apple.com> wrote: > > On 14 Sep 2018, at 07:40, Haohao Lee <hayatelee(a)gmail.com> wrote: > > > How can I get the local address in sf_connect_out_func or is there > another way to achieve this? > > Have you tried calling `sock_getsockname`? If anything is going to work, > that’d be it. > Yes. If I call `sock_getsockname` in `sf_connect_out_func`, an empty address will be returned. I think it is still in the early stage of a connection, there is no local address allocated. One more thing I found, I can get local address by `sock_getsockname` in `sf_notify_fn` for some event. BUT, in `sf_notify_fn` I cannot filter the trafiic since it is a void function. > > Share and Enjoy > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/hayatelee%40gmail.com > > This email sent to hayatelee(a)gmail.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Hello, need some help about socket filter (NKE) development
by Quinn "The Eskimo!" 14 Sep '18

14 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 14 Sep 2018, at 07:40, Haohao Lee <hayatelee(a)gmail.com> wrote: > How can I get the local address in sf_connect_out_func or is there another > way to achieve this? Have you tried calling `sock_getsockname`? If anything is going to work, that’d be it. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Spindump manages to bypass kauth protected dylib file, and read it's contents.
by Quinn "The Eskimo!" 14 Sep '18

14 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 9 Aug 2018, at 12:57, Irad K <iradization(a)gmail.com> wrote: > To achieve that, I use driver that listen to kauth vnode scope with callback > that prevent any access to this file by other processes but my own. I’m confused about your requirements here. The kernel has a long history of being able to access a file’s contents without actually opening the file (I first encountered this exec, many years ago). A user space process is not going to be able to protect itself from the kernel. With regards `spindump` specifically, it’s recording stack frames and symbols, none of which should be especially private. And if you don’t want your symbols showing up in the dump, strip them from your executable. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Hello, need some help about socket filter (NKE) development
by Haohao Lee 14 Sep '18

14 Sep '18

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=Kd8nAs50AoO/wXq5vhUZR4JEI2Y9ORPosLPUJEA0N/o=; b=DSBcBqCAVTCPbYdrbG0e4uMR2bMH6kunUoNtKf4NeW6SmCHEP37qS4tOLmiyOQD/4r Qo2UZT9d2nFroq9Ro/OmlemKxxM/vvrY+hqGOOaon0nJpK+sOSms5c0RoVFWHlPS/Gfl Ezf8PQvRF6l16lIJjQ3vhcDCWsbA68tnp0Y4CTEgENOn5wugfZyuwmHQh4v05aZ0rfy0 HX+eN7hFnO+VX6avj+LjcY6DCrpBEZvy5c0jk56Ms10d7QK51riZknpUSW5dVoEdMb+Z cIswBfUjHB+0zEDgP7yJ9OzRBqdxqGRdzEfYRHsBVKslDHH0VokAnXZEjjCp7IVF2IDV /36g== Hi folks, We are developing a network kernel extension which can be used to filter the traffic in and out. The sf_connect_out_func are used to do the filtering. However, what we want is to match the traffic by the local address and remote address, in sf_connect_out_func we cannot get the local address since the function signature is like typedef errno_t (*sf_connect_out_func)(void *cookie, socket_t so, const struct sockaddr *to); Only remote address is provided. How can I get the local address in sf_connect_out_func or is there another way to achieve this? Thanks. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0