NKE。无法处理文件上传和其他高负载连接

Question

我在使用过滤网络流量的内核扩展时遇到问题。我的代码是根据Apple的tcplognke例子写的。

一切正常，但当我尝试上传大于 500 kb 的文件时 - 连接断开。

这是简化的kext代码:

errno_t tl_data_fn(void *cookie, socket_t so, const struct sockaddr *addr, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags, FilterSocketDataDirection direction) {
    errno_t result = 0;

    if (check_tag(data, gidtag, FILTER_TAG_TYPE, direction == FilterSocketDataDirectionIn ? IN_DONE : OUT_DONE)) {
        return result;
    }

    if (!cookie) return result;

    filter_cookie *f_cookie = get_filter_cookie(cookie);

    uint32_t data_size = (uint32_t)mbuf_pkthdr_len(*data);
    uint32_t offset = 0;

    printf("tl_data_ft: %d", data_size);

    while (offset < data_size) {
        FilterNotification notification;

        if (direction == FilterSocketDataDirectionIn) {
            notification.event = FilterEventDataIn;
        } else {
            notification.event = FilterEventDataOut;
        }
        notification.socketId = (uint64_t)so;
        notification.inputoutput.dataSize = min(data_size - offset, sizeof(notification.inputoutput.data));

        mbuf_copydata(*data, offset, notification.inputoutput.dataSize, notification.inputoutput.data);
        offset += notification.inputoutput.dataSize;

        send_notification(f_cookie, &notification);
    }

    result = EJUSTRETURN;

    if (result == EJUSTRETURN) {
        mbuf_freem(*data);

        if (control != NULL && *control != NULL)
            mbuf_freem(*control);
    }

    return result;
}

errno_t tl_data_in_fn(void *cookie, socket_t so, const struct sockaddr *from, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags) {
    return tl_data_fn(cookie, so, from, data, control, flags, FilterSocketDataDirectionIn);
}

errno_t tl_data_out_fn(void *cookie, socket_t so, const struct sockaddr *to, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags) {
    return tl_data_fn(cookie, so, to, data, control, flags, FilterSocketDataDirectionOut);
}

并且用户space代码:

int s = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);  

//connect to driver  

FilterNotification notification;  
while (recv(s, &notification, sizeof(FilterNotification), 0) == sizeof(FilterNotification)) {  
    FilterClientResponse response;  
    response.socketId = notification.socketId;  
    response.direction = (notification.event == FilterEventDataIn) ? FilterSocketDataDirectionIn : FilterSocketDataDirectionOut;  
    response.dataSize = notification.inputoutput.dataSize;  
    memcpy(response.data, notification.inputoutput.data, notification.inputoutput.dataSize);  
    send(s, &response, sizeof(response), 0);  
}

当我在apple develper forum上询问时，开发者说"I don’t see any attempt to handle send-side flow control here. Without that a file upload can easily eat up all of the available mbufs, and things will go badly from there"但是根本没有例子。有人能帮我吗？谢谢。

Answer 1

问题出在套接字缓冲区中。当我非常快速地注入大量数据时，缓冲区变满并且 inject_data_in/inject_data_out 函数 returns 错误。解决方法是将挂起的数据包存储在内核 space 中（例如，您可以使用 TAILQ），然后，当套接字可用于写入时（要获取此事件，您可以在 OS X 上使用 kqueue）继续注入

NKE。无法处理文件上传和其他高负载连接

NKE. Can't handle file uploads and other high load connections

macos

networking

kernel

driver

kernel-extension