read.c

Windows XP下的抓包程序实现

		if(PacketSize+HeaderBufferSize<60)
			Open->Nbytes.QuadPart+=60;
		else
			Open->Nbytes.QuadPart+=PacketSize+HeaderBufferSize;
		// add preamble+SFD+FCS to the packet
		// these values must be considered because are not part of the packet received from NDIS
		Open->Nbytes.QuadPart+=12;

		NdisReleaseSpinLock( &Open->CountersLock );
		
		if(!(Open->mode & MODE_DUMP))
		{
 			return NDIS_STATUS_NOT_ACCEPTED;
		}
	}

	if(Open->Size == 0)
	{
		LocalData->Dropped++;
		return NDIS_STATUS_NOT_ACCEPTED;
	}

	if(Open->mode & MODE_DUMP && Open->MaxDumpPacks)
	{
		ULONG Accepted=0;
		for(i=0;i<NCpu;i++)
			Accepted+=Open->CpuData[i].Accepted;
		
		if(  Accepted > Open->MaxDumpPacks)
		{
			// Reached the max number of packets to save in the dump file. Discard the packet and stop the dump thread.
			Open->DumpLimitReached = TRUE; // This stops the thread
			// Awake the dump thread
			NdisSetEvent(&Open->DumpEvent);

			// Awake the application
			if (Open->ReadEvent != NULL)
				KeSetEvent(Open->ReadEvent,0,FALSE);

			return NDIS_STATUS_NOT_ACCEPTED;
		}
	}

	//////////////////////////////COPIA.C//////////////////////////////////////////77

	ShouldReleaseBufferLock = TRUE;
	NdisDprAcquireSpinLock(&LocalData->BufferLock);

	do
	{

		if (fres + sizeof(struct PacketHeader) > LocalData->Free)
		{
			LocalData->Dropped++;
			break;
		}

		if (LocalData->TransferMdl1 != NULL)
		{
			//
			//if TransferMdl is not NULL, there is some TransferData pending (i.e. not having called TransferDataComplete, yet)
			//in order to avoid buffer corruption, we drop the packet
			//
			LocalData->Dropped++;
			break;
		}


		if (LookaheadBufferSize + HeaderBufferSize >= fres)
		{

			//
			// we do not need to call NdisTransferData, either because we need only the HeaderBuffer, or because the LookaheadBuffer
			// contains what we need
			//

			Header = (struct PacketHeader*)(LocalData->Buffer + LocalData->P);
			LocalData->Accepted++;
			GET_TIME(&Header->header.bh_tstamp,&G_Start_Time);
			Header->SN = InterlockedIncrement(&Open->WriterSN) - 1;

			Header->header.bh_caplen = fres;
			Header->header.bh_datalen = PacketSize + HeaderBufferSize;
			Header->header.bh_hdrlen=sizeof(struct bpf_hdr);

			LocalData->P +=sizeof(struct PacketHeader);
			if (LocalData->P == Open->Size)
				LocalData->P = 0;

			if ( fres <= HeaderBufferSize || (UINT)( (PUCHAR)LookaheadBuffer - (PUCHAR)HeaderBuffer ) == HeaderBufferSize )
			{
				//
				//we can consider the buffer contiguous, either because we use only the data 
				//present in the HeaderBuffer, or because HeaderBuffer and LookaheadBuffer are contiguous
				// ;-))))))
				//
				if (Open->Size - LocalData->P < fres)
				{
					//the packet will be fragmented in the buffer (aka, it will skip the buffer boundary)
					//two copies!!
					ToCopy = Open->Size - LocalData->P;
					NdisMoveMappedMemory(LocalData->Buffer + LocalData->P,HeaderBuffer, ToCopy);
					NdisMoveMappedMemory(LocalData->Buffer + 0 , (PUCHAR)HeaderBuffer + ToCopy, fres - ToCopy);
					LocalData->P = fres-ToCopy;
				}
				else
				{
					//the packet does not need to be fragmented in the buffer (aka, it doesn't skip the buffer boundary)
					// ;-)))))) only ONE copy
					NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, fres);
					LocalData->P += fres;
				}
			}
			else
			{
				//HeaderBuffer and LookAhead buffer are NOT contiguous,
				//AND, we need some bytes from the LookaheadBuffer, too
				if (Open->Size - LocalData->P < fres)
				{
					//the packet will be fragmented in the buffer (aka, it will skip the buffer boundary)
					if (Open->Size - LocalData->P >= HeaderBufferSize)
					{
						//HeaderBuffer is NOT fragmented
						NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, HeaderBufferSize);
						LocalData->P += HeaderBufferSize;

						if (LocalData->P == Open->Size)
						{
							//the fragmentation of the packet in the buffer is the same fragmentation
							//in HeaderBuffer+LookaheadBuffer
							LocalData->P=0;	
							NdisMoveMappedMemory(LocalData->Buffer + 0, LookaheadBuffer, fres - HeaderBufferSize);
							LocalData->P += (fres - HeaderBufferSize);
						}
						else
						{
							//LookAheadBuffer is fragmented, two copies
							ToCopy = Open->Size - LocalData->P;
							NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, ToCopy);
							LocalData->P=0;
							NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)LookaheadBuffer+ ToCopy, fres - HeaderBufferSize - ToCopy);
							LocalData->P = fres - HeaderBufferSize - ToCopy;
						}
					}
					else
					{
						//HeaderBuffer is fragmented in the buffer (aka, it will skip the buffer boundary)
						//two copies to copy the HeaderBuffer
						ToCopy = Open->Size - LocalData->P;
						NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, ToCopy);
						LocalData->P = 0;
						NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)HeaderBuffer + ToCopy, HeaderBufferSize - ToCopy);
						LocalData->P = HeaderBufferSize - ToCopy;

						//only one copy to copy the LookaheadBuffer
						NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, fres- HeaderBufferSize);
						LocalData->P += (fres - HeaderBufferSize);
					}
				}
				else
				{	
					//the packet won't be fragmented in the destination buffer (aka, it won't skip the buffer boundary)
					//two copies, the former to copy the HeaderBuffer, the latter to copy the LookaheadBuffer
					NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, HeaderBufferSize);
					LocalData->P += HeaderBufferSize;
					NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, fres - HeaderBufferSize);
					LocalData->P += (fres - HeaderBufferSize);
				}		 
			}		

			increment = fres + sizeof(struct PacketHeader);
			if (Open->Size - LocalData->P < sizeof(struct PacketHeader))  //we check that the available, AND contiguous, space in the buffer will fit
			{														   //the NewHeader structure, at least, otherwise we skip the producer
				increment += Open->Size-LocalData->P;				   //at the beginning of the buffer (p = 0), and decrement the free bytes appropriately
				LocalData->P = 0;
			}

			InterlockedExchangeAdd(&LocalData->Free, (ULONG)(-(LONG)increment));
			if(Open->Size - LocalData->Free >= Open->MinToCopy)
			{
				if(Open->mode & MODE_DUMP)
					NdisSetEvent(&Open->DumpEvent);
				else
				{		
					if (Open->ReadEvent != NULL)
					{
						KeSetEvent(Open->ReadEvent,0,FALSE);	
					}
				}
			}

			break;
		}
		else
		{
			IF_LOUD(DbgPrint("TransferData!!\n");)
				//ndisTransferData required
				LocalData->NewP = LocalData->P;

			LocalData->NewP +=sizeof(struct PacketHeader);
			if (LocalData->NewP == Open->Size)
				LocalData->NewP = 0;

			//first of all, surely the header must be copied
			if (Open->Size-LocalData->NewP >= HeaderBufferSize)
			{
				//1 copy!
				NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, HeaderBuffer, HeaderBufferSize);
				LocalData->NewP += HeaderBufferSize;
				if (LocalData->NewP == Open->Size)
					LocalData->NewP = 0;
			}
			else
			{
				ToCopy = Open->Size - LocalData->NewP;
				NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, HeaderBuffer, ToCopy);
				NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)HeaderBuffer + ToCopy, HeaderBufferSize - ToCopy);
				LocalData->NewP = HeaderBufferSize - ToCopy;
			}

			//then we copy the Lookahead buffer

			if (Open->Size-LocalData->NewP >= LookaheadBufferSize)
			{
				//1 copy!
				NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, LookaheadBuffer, LookaheadBufferSize);
				LocalData->NewP += LookaheadBufferSize;
				if (LocalData->NewP == Open->Size)
					LocalData->NewP = 0;
			}
			else
			{
				ToCopy = Open->Size - LocalData->NewP;
				NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, LookaheadBuffer, ToCopy);
				NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)LookaheadBuffer + ToCopy, LookaheadBufferSize - ToCopy);
				LocalData->NewP = LookaheadBufferSize - ToCopy;
			}

			//Now we must prepare the buffer(s) for the NdisTransferData
			if ((Open->Size - LocalData->NewP) >= (fres - HeaderBufferSize - LookaheadBufferSize))
			{
				//only 1 buffer
				pMdl1 = IoAllocateMdl(
					LocalData->Buffer + LocalData->NewP, 
					fres - HeaderBufferSize - LookaheadBufferSize,
					FALSE,
					FALSE,
					NULL);

				if (pMdl1 == NULL)
				{
					IF_LOUD(DbgPrint("Error allocating Mdl1\n");)
						LocalData->Dropped++;
					break;
				}

				MmBuildMdlForNonPagedPool(pMdl1);
				pMdl2=NULL;
				LocalData->NewP += fres - HeaderBufferSize - LookaheadBufferSize;


			}
			else
			{
				//2 buffers
				pMdl1 = IoAllocateMdl(
					LocalData->Buffer + LocalData->NewP, 
					Open->Size - LocalData->NewP,
					FALSE,
					FALSE,
					NULL);

				if (pMdl1 == NULL)
				{
					IF_LOUD(DbgPrint("Error allocating Mdl1\n");)
						LocalData->Dropped++;
					break;
				}

				pMdl2 = IoAllocateMdl(
					LocalData->Buffer + 0, 
					fres - HeaderBufferSize - LookaheadBufferSize - (Open->Size - LocalData->NewP),
					FALSE,
					FALSE,
					NULL);

				if (pMdl2 == NULL)
				{
					IF_LOUD(DbgPrint("Error allocating Mdl2\n");)
						IoFreeMdl(pMdl1);
					LocalData->Dropped++;
					break;
				}

				LocalData->NewP = fres - HeaderBufferSize - LookaheadBufferSize - (Open->Size - LocalData->NewP);

				MmBuildMdlForNonPagedPool(pMdl1);
				MmBuildMdlForNonPagedPool(pMdl2);
			}


			NdisAllocatePacket(&Status, &pPacket, Open->PacketPool);

			if (Status != NDIS_STATUS_SUCCESS)
			{
				IF_LOUD(DbgPrint("NPF: Tap - No free packets\n");)
					IoFreeMdl(pMdl1);
				if (pMdl2 != NULL)
					IoFreeMdl(pMdl2);
				LocalData->Dropped++;
				break;
			}

			if (pMdl2 != NULL)
				NdisChainBufferAtFront(pPacket,pMdl2);

			NdisChainBufferAtFront(pPacket,pMdl1);

			RESERVED(pPacket)->Cpu = Cpu;

			LocalData->TransferMdl1 = pMdl1;	
			LocalData->TransferMdl2 = pMdl2;	


			Header = (struct PacketHeader*)(LocalData->Buffer + LocalData->P);
			Header->header.bh_caplen = fres;
			Header->header.bh_datalen = PacketSize + HeaderBufferSize;
			Header->header.bh_hdrlen=sizeof(struct bpf_hdr);

			NdisTransferData(
				&Status,
				Open->AdapterHandle,
				MacReceiveContext,
				LookaheadBufferSize,
				fres - HeaderBufferSize - LookaheadBufferSize,
				pPacket,
				&BytesTransfered);

			if (Status != NDIS_STATUS_PENDING)
			{
				IF_LOUD(DbgPrint("NdisTransferData, not pending!\n");)	
					LocalData->TransferMdl1 = NULL;
				LocalData->TransferMdl2 = NULL;

				IoFreeMdl(pMdl1);
				if ( pMdl2 != NULL )
					IoFreeMdl(pMdl2);

				NdisReinitializePacket(pPacket);
				// Put the packet on the free queue
				NdisFreePacket(pPacket);

				LocalData->P = LocalData->NewP;

				LocalData->Accepted++;
				GET_TIME(&Header->header.bh_tstamp,&G_Start_Time);
				Header->SN = InterlockedIncrement(&Open->WriterSN) - 1;

				increment = fres + sizeof(struct PacketHeader);
				if (Open->Size - LocalData->P < sizeof(struct PacketHeader))
				{
					increment += Open->Size-LocalData->P;
					LocalData->P = 0;
				}

				InterlockedExchangeAdd(&LocalData->Free, (ULONG)(-(LONG)increment));

				if(Open->Size - LocalData->Free >= Open->MinToCopy)
				{
					if(Open->mode & MODE_DUMP)
						NdisSetEvent(&Open->DumpEvent);
					else
					{
						if (Open->ReadEvent != NULL)
						{
							KeSetEvent(Open->ReadEvent,0,FALSE);	
						}
					}
				}

				break;
			}
			else
			{
				IF_LOUD(DbgPrint("NdisTransferData, pending!\n");)
					ShouldReleaseBufferLock = FALSE;
			}
		}
	}
	while(FALSE);

	if (ShouldReleaseBufferLock)
	{
		NdisDprReleaseSpinLock(&LocalData->BufferLock);
	}

	return NDIS_STATUS_NOT_ACCEPTED;

}

//-------------------------------------------------------------------

VOID NPF_TransferDataComplete (IN NDIS_HANDLE ProtocolBindingContext,IN PNDIS_PACKET pPacket,
                                 IN NDIS_STATUS Status,IN UINT BytesTransfered)
{
    POPEN_INSTANCE      Open;
	ULONG				Cpu;
    CpuPrivateData		*LocalData;
	struct PacketHeader*	Header;
	ULONG				increment;

	IF_LOUD(DbgPrint("NPF: TransferDataComplete\n");)
    
	Open = (POPEN_INSTANCE)ProtocolBindingContext;

	Cpu = RESERVED(pPacket)->Cpu;

	LocalData = &Open->CpuData[Cpu];

	IoFreeMdl(LocalData->TransferMdl1);
	if ( LocalData->TransferMdl2 != NULL )
		IoFreeMdl(LocalData->TransferMdl2);

	NdisReinitializePacket(pPacket);
	// Put the packet on the free queue
	NdisFreePacket(pPacket);

	//the packet has been successfully copied to the kernel buffer, we can prepend it with the PacketHeader,
	//and obtain the sequence number and the timestamp

	LocalData->Accepted++;
	Header = (struct PacketHeader*)(LocalData->Buffer + LocalData->P);
	GET_TIME(&Header->header.bh_tstamp,&G_Start_Time);
	Header->SN = InterlockedIncrement(&Open->WriterSN) - 1;

	LocalData->P = LocalData->NewP;
	
	increment = Header->header.bh_caplen + sizeof(struct PacketHeader);
	if (Open->Size - LocalData->P < sizeof(struct PacketHeader))
	{
		increment += Open->Size-LocalData->P;
		LocalData->P = 0;
	}

	InterlockedExchangeAdd(&LocalData->Free, (ULONG)(-(LONG)increment));

	if(Open->Size - LocalData->Free >= Open->MinToCopy)
	{
		if(Open->mode & MODE_DUMP)
			NdisSetEvent(&Open->DumpEvent);
		else
		{
			if (Open->ReadEvent != NULL)
			{
				KeSetEvent(Open->ReadEvent,0,FALSE);	
			}
		}
	}

	LocalData->TransferMdl1 = NULL;
	LocalData->TransferMdl2 = NULL;

//
// NOTE: this is really bad practice.
// a better approach would be performing the entire copy here.
//
#pragma prefast(suppress:8107, "There's no Spinlock leak here, as it's acquired by the tap.")
	NdisDprReleaseSpinLock(&LocalData->BufferLock);

// Unfreeze the consumer
	if(Open->Size - LocalData->Free > Open->MinToCopy)
	{
 		if(Open->mode & MODE_DUMP)
 			NdisSetEvent(&Open->DumpEvent);
 		else
		{
			if (Open->ReadEvent != NULL)
			{
				KeSetEvent(Open->ReadEvent,0,FALSE);	
			}
		}
	}
	return;
}

//-------------------------------------------------------------------

VOID NPF_ReceiveComplete(IN NDIS_HANDLE ProtocolBindingContext)
{
    IF_VERY_LOUD(DbgPrint("NPF: NPF_ReceiveComplete\n");)
    return;
}