Packet.h

Go to the documentation of this file.

/*
 * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
 * Copyright (c) 2005 - 2007 CACE Technologies, Davis (California)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 3. Neither the name of the Politecnico di Torino, CACE Technologies 
 * nor the names of its contributors may be used to endorse or promote 
 * products derived from this software without specific prior written 
 * permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 */

#ifndef __PACKET_INCLUDE______
#define __PACKET_INCLUDE______

#ifdef _X86_
#define NTKERNEL    
#include "jitter.h"
#endif

#ifdef HAVE_BUGGY_TME_SUPPORT
#ifndef _X86_
#error TME support is available only on x86 architectures
#endif // _X86_
#endif //HAVE_BUGGY_TME_SUPPORT


//
// Needed to disable a warning due to the #pragma prefast directives,
// that are ignored by the normal DDK compiler
//
#ifndef _PREFAST_
#pragma warning(disable:4068)
#endif

#include "win_bpf.h"

#define  MAX_REQUESTS   32 

#define Packet_ALIGNMENT sizeof(int) 
#define Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1))  


#define KERNEL_EVENT_NAMESPACE L"\\BaseNamedObjects\\"


// Working modes
#define MODE_CAPT 0x0       
#define MODE_STAT 0x1       
#define MODE_MON  0x2       
#define MODE_DUMP 0x10      


#define IMMEDIATE 1         

#define NDIS_FLAGS_SKIP_LOOPBACK_W2K    0x400 

// The following definitions are used to provide compatibility 
// of the dump files with the ones of libpcap
#define TCPDUMP_MAGIC 0xa1b2c3d4    
#define PCAP_VERSION_MAJOR 2        
#define PCAP_VERSION_MINOR 4        

// Loopback behaviour definitions
#define NPF_DISABLE_LOOPBACK    1   
#define NPF_ENABLE_LOOPBACK     2   


struct packet_file_header 
{
    UINT magic;             
    USHORT version_major;   
    USHORT version_minor;   
    UINT thiszone;          
    UINT sigfigs;           
    UINT snaplen;           
    UINT linktype;          
};

struct sf_pkthdr {
    struct timeval  ts;         
    UINT            caplen;     


    UINT            len;        
};

//
// NT4 DDK doesn't have C_ASSERT
//
#ifndef C_ASSERT
#define C_ASSERT(a)
#endif

typedef struct _PACKET_OID_DATA {
    ULONG Oid;                  

    ULONG Length;               
    UCHAR Data[1];              

}
    PACKET_OID_DATA, *PPACKET_OID_DATA;

C_ASSERT(sizeof(PACKET_OID_DATA) == 12);

typedef struct _INTERNAL_REQUEST {
    LIST_ENTRY      ListElement;        
//    PIRP          Irp;                ///< Irp that performed the request
//  BOOLEAN         Internal;           ///< True if the request is for internal use of npf.sys. False if the request is performed by the user through an IOCTL.
    NDIS_EVENT      InternalRequestCompletedEvent;
    NDIS_REQUEST    Request;            
    NDIS_STATUS     RequestStatus;

} INTERNAL_REQUEST, *PINTERNAL_REQUEST;

typedef struct _PACKET_RESERVED {
    LIST_ENTRY      ListElement;        
    PIRP            Irp;                
    PMDL            pMdl;               
    BOOLEAN         FreeBufAfterWrite;  

    ULONG           Cpu;                
}  PACKET_RESERVED, *PPACKET_RESERVED;

#define RESERVED(_p) ((PPACKET_RESERVED)((_p)->ProtocolReserved)) 


typedef struct _DEVICE_EXTENSION {
    NDIS_STRING    AdapterName;         
    PWSTR          ExportString;        

} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

typedef struct __CPU_Private_Data
{
    ULONG   P;                  
    ULONG   C;                  
    ULONG   Free;               
    PUCHAR  Buffer;             
    ULONG   Accepted;           



    ULONG   Received;           



    ULONG   Dropped;            



    NDIS_SPIN_LOCK BufferLock;  
    PMDL    TransferMdl1;       
    PMDL    TransferMdl2;       
    ULONG   NewP;               
}
    CpuPrivateData;


typedef struct _OPEN_INSTANCE
{
    PDEVICE_EXTENSION   DeviceExtension;    

    NDIS_HANDLE         AdapterHandle;      
    UINT                Medium;             

    NDIS_HANDLE         PacketPool;         
    KSPIN_LOCK          RequestSpinLock;    
    LIST_ENTRY          RequestList;        
    LIST_ENTRY          ResetIrpList;       
    INTERNAL_REQUEST    Requests[MAX_REQUESTS]; 
    PMDL                BufferMdl;          
    PKEVENT             ReadEvent;          
    PUCHAR              bpfprogram;         




#ifdef _X86_
    JIT_BPF_Filter      *Filter;            

#endif //_X86_
    UINT                MinToCopy;          

    LARGE_INTEGER       TimeOut;            

                                            
    int                 mode;               
    LARGE_INTEGER       Nbytes;             
    LARGE_INTEGER       Npackets;           
    NDIS_SPIN_LOCK      CountersLock;       
    UINT                Nwrites;            

    ULONG               Multiple_Write_Counter; 
    NDIS_EVENT          WriteEvent;         
    BOOLEAN             WriteInProgress;    

    NDIS_SPIN_LOCK      WriteLock;          
    NDIS_EVENT          NdisRequestEvent;   
    BOOLEAN             SkipSentPackets;    
    NDIS_STATUS         IOStatus;           
    HANDLE              DumpFileHandle;     
    PFILE_OBJECT        DumpFileObject;     
    PKTHREAD            DumpThreadObject;   
    HANDLE              DumpThreadHandle;   
    NDIS_EVENT          DumpEvent;          
    LARGE_INTEGER       DumpOffset;         
    UNICODE_STRING      DumpFileName;       
    UINT                MaxDumpBytes;       

    UINT                MaxDumpPacks;       


    BOOLEAN             DumpLimitReached;   

#ifdef HAVE_BUGGY_TME_SUPPORT
    MEM_TYPE            mem_ex;             
    TME_CORE            tme;                
#endif //HAVE_BUGGY_TME_SUPPORT

    NDIS_SPIN_LOCK      MachineLock;        
    UINT                MaxFrameSize;       

    //
    // KAFFINITY is used as a bit mask for the affinity in the system. So on every supported OS is big enough for all the CPUs on the system (32 bits on x86, 64 on x64?).
    // We use its size to compute the max number of CPUs.
    //
    CpuPrivateData      CpuData[sizeof(KAFFINITY) * 8];     
    ULONG               ReaderSN;           
    ULONG               WriterSN;           

    ULONG               Size;               
    ULONG              AdapterHandleUsageCounter;
    NDIS_SPIN_LOCK     AdapterHandleLock;
    ULONG              AdapterBindingStatus;    

    NDIS_EVENT         NdisOpenCloseCompleteEvent;
    NDIS_EVENT         NdisWriteCompleteEvent;  
    NTSTATUS           OpenCloseStatus;
    ULONG              TransmitPendingPackets;  
}
OPEN_INSTANCE, *POPEN_INSTANCE;

enum ADAPTER_BINDING_STATUS
{
    ADAPTER_UNBOUND,
    ADAPTER_BOUND,
    ADAPTER_UNBINDING,
};

struct PacketHeader
{
    ULONG SN;                               
    struct bpf_hdr header;                  
};

extern ULONG        g_NCpu;
extern NDIS_HANDLE  g_NdisProtocolHandle;
extern struct time_conv G_Start_Time; // from openclos.c
extern UINT         g_SendPacketFlags;

#define TRANSMIT_PACKETS 256    



#define EXIT_SUCCESS(quantity) Irp->IoStatus.Information=quantity;\
    Irp->IoStatus.Status = STATUS_SUCCESS;\
    IoCompleteRequest(Irp, IO_NO_INCREMENT);\
    return STATUS_SUCCESS;\

#define EXIT_FAILURE(quantity) Irp->IoStatus.Information=quantity;\
    Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\
    IoCompleteRequest(Irp, IO_NO_INCREMENT);\
    return STATUS_UNSUCCESSFUL;\


/***************************/
/*       Prototypes        */
/***************************/

NTSTATUS
DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    );

PWCHAR getAdaptersList(VOID);

PKEY_VALUE_PARTIAL_INFORMATION getTcpBindings(VOID);

BOOLEAN NPF_CreateDevice(
    IN OUT PDRIVER_OBJECT adriverObjectP,
    IN PUNICODE_STRING amacNameP
    );
NTSTATUS
NPF_Open(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );

VOID
NPF_OpenAdapterComplete(
    IN NDIS_HANDLE  ProtocolBindingContext,
    IN NDIS_STATUS  Status,
    IN NDIS_STATUS  OpenErrorStatus
    );

NTSTATUS
NPF_Cleanup(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );

NTSTATUS
NPF_Close(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );



VOID
NPF_CloseAdapterComplete(
    IN NDIS_HANDLE  ProtocolBindingContext,
    IN NDIS_STATUS  Status
    );

NDIS_STATUS
NPF_tap(
    IN NDIS_HANDLE ProtocolBindingContext,
    IN NDIS_HANDLE MacReceiveContext,
    IN PVOID HeaderBuffer,
    IN UINT HeaderBufferSize,
    IN PVOID LookAheadBuffer,
    IN UINT LookaheadBufferSize,
    IN UINT PacketSize
    );

VOID
NPF_TransferDataComplete(
    IN NDIS_HANDLE ProtocolBindingContext,
    IN PNDIS_PACKET Packet,
    IN NDIS_STATUS Status,
    IN UINT BytesTransferred
    );

VOID
NPF_ReceiveComplete(IN NDIS_HANDLE  ProtocolBindingContext);

NTSTATUS
NPF_IoControl(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );

VOID

NPF_RequestComplete(
    IN NDIS_HANDLE   ProtocolBindingContext,
    IN PNDIS_REQUEST pRequest,
    IN NDIS_STATUS   Status
    );

NTSTATUS
NPF_Write(
            IN PDEVICE_OBJECT DeviceObject,
            IN PIRP Irp
            );


INT NPF_BufferedWrite(IN PIRP Irp, 
                        IN PCHAR UserBuff, 
                        IN ULONG UserBuffSize,
                        BOOLEAN sync);

VOID NPF_WaitEndOfBufferedWrite(POPEN_INSTANCE Open);

VOID
NPF_SendComplete(
    IN NDIS_HANDLE   ProtocolBindingContext,
    IN PNDIS_PACKET  pPacket,
    IN NDIS_STATUS   Status
    );

VOID
NPF_ResetComplete(
    IN NDIS_HANDLE  ProtocolBindingContext,
    IN NDIS_STATUS  Status
    );

VOID
NPF_Status(
    IN NDIS_HANDLE   ProtocolBindingContext,
    IN NDIS_STATUS   Status,
    IN PVOID         StatusBuffer,
    IN UINT          StatusBufferSize
    );


VOID
NPF_StatusComplete(IN NDIS_HANDLE  ProtocolBindingContext);

VOID
NPF_Unload(IN PDRIVER_OBJECT DriverObject);


NTSTATUS
NPF_Read(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    );

NTSTATUS
NPF_ReadRegistry(
    IN  PWSTR              *MacDriverName,
    IN  PWSTR              *PacketDriverName,
    IN  PUNICODE_STRING     RegistryPath
    );

NTSTATUS
NPF_QueryRegistryRoutine(
    IN PWSTR     ValueName,
    IN ULONG     ValueType,
    IN PVOID     ValueData,
    IN ULONG     ValueLength,
    IN PVOID     Context,
    IN PVOID     EntryContext
    );

VOID NPF_BindAdapter(
    OUT PNDIS_STATUS            Status,
    IN  NDIS_HANDLE             BindContext,
    IN  PNDIS_STRING            DeviceName,
    IN  PVOID                   SystemSpecific1,
    IN  PVOID                   SystemSpecific2
    );

VOID
NPF_UnbindAdapter(
    OUT PNDIS_STATUS        Status,
    IN  NDIS_HANDLE         ProtocolBindingContext,
    IN  NDIS_HANDLE         UnbindContext
    );


NTSTATUS NPF_OpenDumpFile(POPEN_INSTANCE Open , PUNICODE_STRING fileName, BOOLEAN append);

NTSTATUS NPF_StartDump(POPEN_INSTANCE Open);

VOID NPF_DumpThread(PVOID Open);

NTSTATUS NPF_SaveCurrentBuffer(POPEN_INSTANCE Open);

VOID NPF_WriteDumpFile(PFILE_OBJECT FileObject,
                                PLARGE_INTEGER Offset,
                                ULONG Length,
                                PMDL Mdl,
                                PIO_STATUS_BLOCK IoStatusBlock);



NTSTATUS NPF_CloseDumpFile(POPEN_INSTANCE Open);

VOID
NPF_CloseOpenInstance(POPEN_INSTANCE pOpen);

BOOLEAN
NPF_StartUsingBinding(
    IN POPEN_INSTANCE pOpen);

VOID
NPF_StopUsingBinding(
    IN POPEN_INSTANCE pOpen);

VOID
NPF_CloseBinding(
    IN POPEN_INSTANCE pOpen);

NTSTATUS
NPF_GetDeviceMTU(
             IN POPEN_INSTANCE pOpen,
             IN PIRP    pIrp,
             OUT PUINT  pMtu);

UINT GetBuffOccupation(POPEN_INSTANCE Open);

#ifdef NDIS50
NDIS_STATUS NPF_PowerChange(IN NDIS_HANDLE ProtocolBindingContext, IN PNET_PNP_EVENT pNetPnPEvent);
#endif

//  
//  Old registry based WinPcap names
//
//  \brief Helper function to query a value from the global WinPcap registry key
//*/
//VOID NPF_QueryWinpcapRegistryString(PWSTR SubKeyName,
//                               WCHAR *Value,
//                               UINT ValueLen, 
//                               WCHAR *DefaultValue);
//


#endif  /*main ifndef/define*/

---

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2008 CACE Technologies. All rights reserved.