ifnet_attach/detach notifications in kext

[Gary Kratkin]

Hello,

How can I get notifications in my kext of network interfaces attaching and detaching? I'm specifically interesting in utun interfaces, which aren't picked up by listening on IONetworkInterface matching notifications. It seems I should be able to listen on the associated kernel event, but I don't see any examples of doing that from kernel space.

Thanks for any help,
Gary _______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (Darwin...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/darwin-kernel/darwin-kernel-garchive-95844%40googlegroups.com

This email sent to darwin-kernel-...@googlegroups.com

[Josh Graessley]

On Jan 18, 2012, at 12:48 PM, Gary Kratkin wrote:

> Hello,
>
> How can I get notifications in my kext of network interfaces attaching and detaching? I'm specifically interesting in utun interfaces, which aren't picked up by listening on IONetworkInterface matching notifications. It seems I should be able to listen on the associated kernel event, but I don't see any examples of doing that from kernel space.

I believe you can do that in the kernel using a kernel event socket. You'll need to use the socket kpis to create the in-kernel kernel event socket to listen for notifications (sock_socket, etc... from sys/kpi_socket.h). See:
http://developer.apple.com/library/mac/#documentation/Darwin/Reference/KernelIOKitFramework/kpi_socket_h/

I'm not aware of a good example.

-josh

[Justin C. Walker]

On Jan 18, 2012, at 14:21 , Josh Graessley wrote:
>
> On Jan 18, 2012, at 12:48 PM, Gary Kratkin wrote:
>>
>> How can I get notifications in my kext of network interfaces attaching and detaching? I'm specifically interesting in utun interfaces, which aren't picked up by listening on IONetworkInterface matching notifications. It seems I should be able to listen on the associated kernel event, but I don't see any examples of doing that from kernel space.
>
> I believe you can do that in the kernel using a kernel event socket. You'll need to use the socket kpis to create the in-kernel kernel event socket to listen for notifications (sock_socket, etc... from sys/kpi_socket.h). See:
> http://developer.apple.com/library/mac/#documentation/Darwin/Reference/KernelIOKitFramework/kpi_socket_h/
>
> I'm not aware of a good example.

I'm just guessing, but doesn't 'scutil' provide notifications (so might have an example of how to code such)? Its code is available.

Justin

--
Justin C. Walker, Curmudgeon at Large
Institute for the Absorption of Federal Funds
-----------
If it weren't for carbon-14, I wouldn't date at all.
-----------