site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=PiF72bTVCTvauB2hDPfHu+Q7/HVSuQcqVgHu7kudJTcHsmdCb8kQ6s4jOLEvUeo+U2EtHeRN/yuAD+urBaYGCNfNiu8I6Qzc1AjmUyzllRzcBwD71s2TmLNldG1WFjySISClPFe8qVpL1vjQiWjv+/Z742/OEHmYF05tIoUye08= On 7/28/05, Allan Hoeltje <ahoeltje@lmi.net> wrote:
Being a newbie at kernel extensions myself, I am reluctant to suggest that I may have an answer but, what they hey, I'll take a chance at it.
I also am doing a KEXT that inspects IP packets and converses with a daemon (a launch agent) via sockets. I do not have everything in place yet but mostly it is working.
If you need to have a user app or daemon process a packet before it is sent up/down the IP stack then you will need to remove the packet from the IP stack in your kext input/output function (swallow the packet with a "return EJUSTRETURN") and send it to your user app via ctl_enqueuedata. Have your user app do it's thing at user speed and then send it back to your kext. The kext repackages it into an mbuf and injects it (ipf_inject_input or ipf_inject_output) back into the IP stack.
This assumes that the packet is not a vital part of some important stream of packets and can be processed on its own. If it is part of a stream and order is important to the remote host then you will need to swallow all of them and inject them later to keep them in order.
It is probably not a good idea to put the kernel to sleep. :-)
Hope this is mostly correct and helps!
-Allan
Allan, Thanks for your response, we half expected to get this as our first response. We actually had tried this...it was done before the sleep. But we found it added a significant latency to the connection. We were doing almost exactly what you indicated. Take an HTTP stream for example. Say we removed the "GET" packet from the stream. This would hold the browser. We would do our user space stuff and send it back down to demon on the sys_prot socket. When the request was recv'd at the kernel we would re_inject the approiate packet. However, it would add about a second delay to the request. For each request including all images on the page etc this would really add up to a very noticable delay. We felt like we were back on dialup. Have you seen anythhing like that? While the sleep might not be the best way to handle the delay it gave us a noticable boost is speed for the most part, only on occasion where we have to prompt userland do we have a problem becuase the delay could be pretty long. - Frank _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com