Mac OS X Internals: A Systems Approach

2.16. Networking

Most of the Mac OS X networking subsystem is derived from that of 4.4BSD, although there are some important differences, such as in the handling of timers and the interaction of network devices with the higher layers of the networking stack.

The I/O Kit's Network family provides various classes that together constitute the low-level layers of the Mac OS X networking subsystem. For example, if you wish to create a network controller driver, you use the framework defined by the Network family. Moreover, the networking subsystem has a data link interface layer (DLIL) that connects the Network family with the BSD networking code. Specifically, the DLIL is used for communication between the Network family's IONetworkInterface class and higher-level components such as the protocols.

A notable feature of the Mac OS X implementation is the Network Kernel Extensions (NKE) mechanism, which provides ways to extend the system's networking architecture through loadable kernel modules that interact with the networking stack. Examples of applications of NKEs include implementation of new protocols, modification of existing protocols, creation of link-layer encryption mechanisms, and attachment of filters at various layers of the stack.

Before Mac OS X 10.4, a kernel extension had to be explicitly designated as an NKE. Beginning with version 10.4, the kernel exports several kernel programming interfaces (KPIs) that make NKE functionality available to kernel extensions. The following are examples of header files that correspond to these KPIs:

• kpi_interface.h for interacting with network interfaces

• kpi_mbuf.h for interacting with mbufs

• kpi_protocol.h for interacting with network protocols

• kpi_socket.h for manipulating and using sockets in the kernel

• kpi_socketfilter.h for implementing filters at the socket layer

• kpi_ipfilter.h for implementing filters at the IP layer

• kpi_interfacefilter.h for implementing filters at the interface layer