NKE。无法处理文件上传和其他高负载连接

Question

使用内核扩展来过滤网络流量时出现问题。我的代码是根据Apple的tcplognke示例编写的。

一切顺利但是当我尝试上传大于500 kb的文件时 - 连接断开。

这是简化的kext代码：

errno_t tl_data_fn(void *cookie, socket_t so, const struct sockaddr *addr, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags, FilterSocketDataDirection direction) {
    errno_t result = 0;

    if (check_tag(data, gidtag, FILTER_TAG_TYPE, direction == FilterSocketDataDirectionIn ? IN_DONE : OUT_DONE)) {
        return result;
    }

    if (!cookie) return result;

    filter_cookie *f_cookie = get_filter_cookie(cookie);

    uint32_t data_size = (uint32_t)mbuf_pkthdr_len(*data);
    uint32_t offset = 0;

    printf("tl_data_ft: %d", data_size);

    while (offset < data_size) {
        FilterNotification notification;

        if (direction == FilterSocketDataDirectionIn) {
            notification.event = FilterEventDataIn;
        } else {
            notification.event = FilterEventDataOut;
        }
        notification.socketId = (uint64_t)so;
        notification.inputoutput.dataSize = min(data_size - offset, sizeof(notification.inputoutput.data));

        mbuf_copydata(*data, offset, notification.inputoutput.dataSize, notification.inputoutput.data);
        offset += notification.inputoutput.dataSize;

        send_notification(f_cookie, &notification);
    }

    result = EJUSTRETURN;

    if (result == EJUSTRETURN) {
        mbuf_freem(*data);

        if (control != NULL && *control != NULL)
            mbuf_freem(*control);
    }

    return result;
}

errno_t tl_data_in_fn(void *cookie, socket_t so, const struct sockaddr *from, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags) {
    return tl_data_fn(cookie, so, from, data, control, flags, FilterSocketDataDirectionIn);
}

errno_t tl_data_out_fn(void *cookie, socket_t so, const struct sockaddr *to, mbuf_t *data, mbuf_t *control, sflt_data_flag_t flags) {
    return tl_data_fn(cookie, so, to, data, control, flags, FilterSocketDataDirectionOut);
}

和用户空间代码：

int s = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);  

//connect to driver  

FilterNotification notification;  
while (recv(s, &notification, sizeof(FilterNotification), 0) == sizeof(FilterNotification)) {  
    FilterClientResponse response;  
    response.socketId = notification.socketId;  
    response.direction = (notification.event == FilterEventDataIn) ? FilterSocketDataDirectionIn : FilterSocketDataDirectionOut;  
    response.dataSize = notification.inputoutput.dataSize;  
    memcpy(response.data, notification.inputoutput.data, notification.inputoutput.dataSize);  
    send(s, &response, sizeof(response), 0);  
}  

当我在apple develper论坛上询问时，开发人员说：“我没有看到任何处理发送端流量控制的尝试。如果没有这个，文件上传很容易就会占用所有可用的mbuf，而且事情会很糟糕“但根本没有例子。有人能帮我吗？谢谢。

Answer 1

问题出在套接字缓冲区。当我非常快速地注入大量数据时，缓冲区变满，inject_data_in / inject_data_out函数返回错误。解决方法是在内核空间中存储挂起的数据包（例如，您可以使用TAILQ），然后，当socket可用于写入时（要获取此事件，您可以在OS X上使用kqueue）继续注入