ippackagefilter.c

IP数据包过滤

/*

  ippackagefilter.C

  Author: bernard
  Last Updated:2009.02.20

  This framework is generated by rational rose..

*/

#include <string.h>
#include <stdio.h>
#include <ntddk.h>
#include <ntddndis.h>
#include <pfhook.h>
#include "IPPackageFilter.h"

#if DBG
#define dprintf DbgPrint
#else
#define dprintf(x)
#endif

NTSTATUS DrvDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID DrvUnload(IN PDRIVER_OBJECT DriverObject);

NTSTATUS SetFilterFunction(PacketFilterExtensionPtr filterFunction);

NTSTATUS AddFilterToList(IPFilter *pf);
void ClearFilterList(void);
PF_FORWARD_ACTION cbFilterFunction(IN unsigned char *PacketHeader,IN unsigned char *Packet, IN unsigned int PacketLength, IN unsigned int RecvInterfaceIndex, IN unsigned int SendInterfaceIndex, IN unsigned long RecvLinkNextHop, IN unsigned long SendLinkNextHop);

#define NT_DEVICE_NAME L"\\Device\\IPPackageFilter"
#define DOS_DEVICE_NAME L"\\DosDevices\\IPPackageFilter"


struct filterList *first = NULL;
struct filterList *last = NULL;

BOOLEAN my_log(
           IN PUNICODE_STRING    logFile,
           IN char *buff)
{
	HANDLE   hLogFile;
    
    ULONG    length = 0;
    LARGE_INTEGER    offset = {0};
    IO_STATUS_BLOCK Io_Status_Block = {0};
    OBJECT_ATTRIBUTES obj_attrib;
    NTSTATUS status;
    BOOLEAN  bRet = FALSE;

    InitializeObjectAttributes(    &obj_attrib, 
                            logFile,
                            OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                            NULL,
                            NULL);
    status = ZwCreateFile(    &hLogFile,
        GENERIC_WRITE,
        &obj_attrib,
        &Io_Status_Block,
        NULL,
        FILE_ATTRIBUTE_NORMAL,
        FILE_SHARE_READ,
        FILE_OPEN_IF,
        FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
        NULL,
        0 );
    if (!NT_SUCCESS(status))
    {
        bRet = FALSE;
        goto END;
    } 
	//在末尾写入
	length = strlen(buff)+1;
	offset.QuadPart += Io_Status_Block.Information;
	// 写入到目标文件
    status = ZwWriteFile(    logFile,
                                NULL,
                                NULL,
                                NULL,
                                &Io_Status_Block,
                                buff,
                                length,
                                &offset,
                                NULL);
    if (!NT_SUCCESS(status))
    {
        bRet = FALSE;
        goto END;
    }
            

END:

    if (hLogFile)
    {
        ZwClose(hLogFile);
    }
    

    return bRet;
}

/**
BOOLEAN MyCopyFile(
           IN PUNICODE_STRING    ustrDestFile,
           IN char * buff
            )
{
    HANDLE   hDestFile;
    PVOID    buffer = NULL;
    ULONG    length = 0;
    LARGE_INTEGER    offset = {0};
    IO_STATUS_BLOCK Io_Status_Block = {0};
    OBJECT_ATTRIBUTES obj_attrib;
    NTSTATUS status;
    BOOLEAN  bRet = FALSE;
    do 
    {

        // 打开目标文件
        InitializeObjectAttributes(    &obj_attrib, 
                                ustrDestFile,
                                OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                                NULL,
                                NULL);
        status = ZwCreateFile(    &hDestFile,
            GENERIC_WRITE,
            &obj_attrib,
            &Io_Status_Block,
            NULL,
            FILE_ATTRIBUTE_NORMAL,
            FILE_SHARE_READ,
            FILE_OPEN_IF,
            FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT,
            NULL,
            0 );
        if (!NT_SUCCESS(status))
        {
            bRet = FALSE;
            goto END;
        }
        // 为buffer分配4KB空间
        buffer = ExAllocatePool(NonPagedPool, 1024 * 4);
        if (buffer == NULL)
        {
            bRet = FALSE;
            goto END;
        }
        // 复制文件
        while (1)
        {
            length = 4 * 1024;
            // 读取源文件
            status = ZwReadFile(hSrcFile,
                            NULL,
                            NULL,
                            NULL,
                            &Io_Status_Block,
                            buffer,
                            length,
                            &offset,
                            NULL);
            if (!NT_SUCCESS(status))
            {
                // 如果状态为STATUS_END_OF_FILE，说明文件已经读取到末尾
                if (status == STATUS_END_OF_FILE)
                {
                    bRet = TRUE;
                    goto END;
                }
            }
            // 获得实际读取的长度
            length = Io_Status_Block.Information;
            // 写入到目标文件
            status = ZwWriteFile(    hDestFile,
                                NULL,
                                NULL,
                                NULL,
                                &Io_Status_Block,
                                buffer,
                                length,
                                &offset,
                                NULL);
            if (!NT_SUCCESS(status))
            {
                bRet = FALSE;
                goto END;
            }
            
            // 移动文件指针
            offset.QuadPart += length;
        }
    } while (0);
END:
    if (hSrcFile)
    {
        ZwClose(hSrcFile);
    }
    if (hDestFile)
    {
        ZwClose(hDestFile);
    }
    if (buffer = NULL)
    {
        ExFreePool(buffer);
    }
    return bRet;
}

**/



NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{

    PDEVICE_OBJECT         deviceObject = NULL;
    NTSTATUS               ntStatus;
    UNICODE_STRING         deviceNameUnicodeString;
    UNICODE_STRING         deviceLinkUnicodeString;
	
	dprintf("ippackagefilter.sys: entering DriverEntry\n");


	//we have to create the device
	RtlInitUnicodeString(&deviceNameUnicodeString, NT_DEVICE_NAME);

	ntStatus = IoCreateDevice(DriverObject, 
								0,
								&deviceNameUnicodeString, 
								FILE_DEVICE_DRVFLTIP,
								0,
								FALSE,
								&deviceObject);


    if ( NT_SUCCESS(ntStatus) )
    {
    
        // Create a symbolic link that Win32 apps can specify to gain access
        // to this driver/device
        RtlInitUnicodeString(&deviceLinkUnicodeString, DOS_DEVICE_NAME);

        ntStatus = IoCreateSymbolicLink(&deviceLinkUnicodeString, &deviceNameUnicodeString);

        if ( !NT_SUCCESS(ntStatus) )
        {
            dprintf("ippackagefilter.sys: IoCreateSymbolicLink failed\n");
        }

        //
        // Create dispatch points for device control, create, close.
        //

        DriverObject->MajorFunction[IRP_MJ_CREATE]         =
        DriverObject->MajorFunction[IRP_MJ_CLOSE]          =
        DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DrvDispatch;
        DriverObject->DriverUnload                         = DrvUnload;
    }

    if ( !NT_SUCCESS(ntStatus) )
    {
        dprintf("Error in initialization. Unloading...");

		DrvUnload(DriverObject);
    }

    return ntStatus;
}



NTSTATUS DrvDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{

    PIO_STACK_LOCATION  irpStack;
    PVOID               ioBuffer;
    ULONG               inputBufferLength;
    ULONG               outputBufferLength;
    ULONG               ioControlCode;
    NTSTATUS            ntStatus;

    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;


 
    // Get a pointer to the current location in the Irp. This is where
    //     the function codes and parameters are located.
    irpStack = IoGetCurrentIrpStackLocation(Irp);


    // Get the pointer to the input/output buffer and it's length
    ioBuffer           = Irp->AssociatedIrp.SystemBuffer;
    inputBufferLength  = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    outputBufferLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength;

    switch (irpStack->MajorFunction)
    {
    case IRP_MJ_CREATE:

        dprintf("ippackagefilter.sys: IRP_MJ_CREATE\n");

        break;

    case IRP_MJ_CLOSE:

        dprintf("ippackagefilter.sys: IRP_MJ_CLOSE\n");

        break;

    case IRP_MJ_DEVICE_CONTROL:

        dprintf("ippackagefilter.sys: IRP_MJ_DEVICE_CONTROL\n");

        ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

        switch (ioControlCode)
        {
			// ioctl code to start filtering
			case START_IP_HOOK:
			{
           		SetFilterFunction(cbFilterFunction);

				break;
			}

			// ioctl to stop filtering
			case STOP_IP_HOOK:
			{
				SetFilterFunction(NULL);
	            
				break;
			}

            // ioctl to add a filter rule
			case ADD_FILTER:
			{
				if(inputBufferLength == sizeof(IPFilter))
				{
					IPFilter *nf;

					nf = (IPFilter *)ioBuffer;
					
					AddFilterToList(nf);
				}

				break;
			}

			// ioctl to free filter rule list
			case CLEAR_FILTER:
			{
				ClearFilterList();

				break;
			}

			default:
				Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;

				dprintf("ippackagefilter.sys: unknown IRP_MJ_DEVICE_CONTROL\n");

				break;
        }

        break;
    }


    //
    // DON'T get cute and try to use the status field of
    // the irp in the return status.  That IRP IS GONE as
    // soon as you call IoCompleteRequest.
    //

    ntStatus = Irp->IoStatus.Status;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);


    //
    // We never have pending operation so always return the status code.
    //

    return ntStatus;
}


VOID DrvUnload(IN PDRIVER_OBJECT DriverObject)
{
    UNICODE_STRING         deviceLinkUnicodeString;

	dprintf("ippackagefilter.sys: Unloading\n");

    SetFilterFunction(NULL);

	// Free any resources
	ClearFilterList();
   
    // Delete the symbolic link
    RtlInitUnicodeString(&deviceLinkUnicodeString, DOS_DEVICE_NAME);
    IoDeleteSymbolicLink(&deviceLinkUnicodeString);

    
	// Delete the device object
    IoDeleteDevice(DriverObject->DeviceObject);
}




NTSTATUS SetFilterFunction(PacketFilterExtensionPtr filterFunction)
{
	NTSTATUS status = STATUS_SUCCESS, waitStatus=STATUS_SUCCESS;
	UNICODE_STRING filterName;
	PDEVICE_OBJECT ipDeviceObject=NULL;
	PFILE_OBJECT ipFileObject=NULL;

	PF_SET_EXTENSION_HOOK_INFO filterData;

	KEVENT event;
	IO_STATUS_BLOCK ioStatus;
	PIRP irp;

	dprintf("Getting pointer to IpFilterDriver\n");
	
	//first of all, we have to get a pointer to IpFilterDriver Device
	RtlInitUnicodeString(&filterName, DD_IPFLTRDRVR_DEVICE_NAME);
	status = IoGetDeviceObjectPointer(&filterName,STANDARD_RIGHTS_ALL, &ipFileObject, &ipDeviceObject);
	
	if(NT_SUCCESS(status))
	{
		//initialize the struct with functions parameters