site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Hi, Raj Doshi On Jul 1, 2005, at 8:27 PM, Allan Hoeltje wrote: Second, I need some more pointers! Help! This email sent to admin@tacosw.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... I implemented an IP filter with injection like you are describing without ever modifying mbuf_pkthdr_header. Even when I made a copy of an mbuf and injected the copy instead of the original, I did not set the mbuf_pkthdr_header (although there are other fields that need to be set like checksum requested/performed in this case). So, I think the answer is no, you do not need to worry about mbuf_pkthdr_header in an IP filter. You should be able to inject a filtered mbuf, as is. First off, thank you Quinn and Josh for the pointers you have given me so far. I have been testing the enetlognke interface filter sample and mundged it into what I hope is the beginning of an IP filter. The problem I am running into is that the mbuf_t data passed to my ipf_input_func (and ipf_output_func) always has a NULL mbuf_pkthdr_header. For enetlognke this is OK since the interface filter enet_input_func is passed a reference to a frame header. There is even a comment that says: "Before we swallow the packet, we need to make sure that the very first mbuf has the pkthdr_header field set, else the system will panic when we inject the packet. The input routine is passed the frame_header pointer, so we can use this value to set as the pkthdr_header." Is there some api I can use to get the frame header in my ipf_input_func? Does any of this matter for an IP filter? Sorry if this is a dumb question but there is very little documentation and even less sample code for mbufs and kernel extensions. -Allan (Everybody starts out as a newbie and it is only through trial, error, and good documentation do they become experts. - ALH) _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/admin% 40tacosw.com This email sent to site_archiver@lists.apple.com