summaryrefslogtreecommitdiff
path: root/network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp
diff options
context:
space:
mode:
authorJ M Rossy <[email protected]>2015-07-29 15:40:09 -0700
committerJ M Rossy <[email protected]>2015-07-29 16:34:40 -0700
commit5d61a4a79a1e96dc5d9af1e5e712c84507307544 (patch)
tree49ed270893578cd18758b74ffcca16dc7ab948d6 /network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp
parent5d41613e26e147d2300c786bb2b34cb4b4067a25 (diff)
Samples update for public Windows 10 release
Fix #2 Enabling WPP Recorder in Sensors Samples causes errors Fix #4 Add back fixed KMDOD sample Add new BarcodeScanner sample in pos folder Add new MagneticStripeReader sample in pos folder Add new SynpaticsTouch sample in input folder Add new Power Engine Plugin sample in pofx folder Add new DeviceMft sample in avstream folder Add new AvsCamera sample in root Add new SimBatt sample in root Add other pre-existing samples not yet released for Win10
Diffstat (limited to 'network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp')
-rw-r--r--network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp403
1 files changed, 403 insertions, 0 deletions
diff --git a/network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp b/network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp
new file mode 100644
index 00000000..7a33beed
--- /dev/null
+++ b/network/trans/WFPSampler/svc/Scenarios_BasicPacketInjection.cpp
@@ -0,0 +1,403 @@
+////////////////////////////////////////////////////////////////////////////////////////////////////
+//
+// Copyright (c) 2014 Microsoft Corporation. All Rights Reserved.
+//
+// Module Name:
+// Scenarios_BasicPacketInjection.cpp
+//
+// Abstract:
+// This module contains functions which implements the BASIC_PACKET_INJECTION scenarios.
+//
+// Naming Convention:
+//
+// <Scope><Object><Action><Modifier>
+// <Scope><Object><Action>
+//
+// i.e.
+//
+// <Scope>
+// {
+// - Function is likely visible to other modules
+// Prv - Function is private to this module.
+// }
+// <Object>
+// {
+// ScenarioBasicPacketInjection - Function pertains to all of the Basic Packet Injection
+// Scenarios
+// RPC - Function is and RPC entry point.
+// }
+// <Action>
+// {
+// Add - Function adds objects
+// Remove - Function removes objects
+// Invoke - Function implements the scenario based on parameters
+// passed from the commandline interface
+// (WFPSampler.exe).
+// }
+// <Modifier>
+// {
+// FwpmObjects - Function acts on WFP objects.
+// ScenarioBasicPacketInjection - Function pertains to all of the Basic Packet Injection
+// Scenarios
+// }
+//
+// Private Functions:
+// PrvScenarioBasicPacketInjectionAddFwpmObjects(),
+// PrvScenarioBasicPacketInjectionDeleteFwpmObjects(),
+// ScenarioBasicStreamInjectionAdd(),
+// ScenarioBasicStreamInjectionRemove(),
+//
+// Public Functions:
+// RPCInvokeScenarioBasicPacketInjection(),
+//
+// Author:
+// Dusty Harper (DHarper)
+//
+// Revision History:
+//
+// [ Month ][Day] [Year] - [Revision]-[ Comments ]
+// May 01, 2010 - 1.0 - Creation
+// December 13, 2013 - 1.1 - Prune filters for enumeration and limit scenario to
+// only the supported layers
+//
+////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#include "Framework_WFPSamplerService.h" /// .
+
+/**
+ @private_function="PrvScenarioBasicPacketInjectionDeleteFwpmObjects"
+
+ Purpose: Function that disables the SCENARIO_BASIC_PACKET_INJECTION scenarios. <br>
+ <br>
+ Notes: Scenario removes the filters using specified filtering conditions at the specified
+ layer. Associated callouts are removed as well. <br>
+ <br>
+ MSDN_Ref: <br>
+*/
+_Success_(return == NO_ERROR)
+UINT32 PrvScenarioBasicPacketInjectionDeleteFwpmObjects(_In_ const FWPM_FILTER* pFilter)
+{
+ ASSERT(pFilter);
+
+ UINT32 status = NO_ERROR;
+ HANDLE engineHandle = 0;
+ HANDLE enumHandle = 0;
+ UINT32 entryCount = 0;
+ FWPM_FILTER** ppFilters = 0;
+ FWPM_FILTER_CONDITION* pFilterConditions = 0;
+ UINT32 numFilterConditions = 0;
+ FWPM_FILTER_ENUM_TEMPLATE filterEnumTemplate = {0};
+ FWPM_PROVIDER_CONTEXT_ENUM_TEMPLATE providerContextEnumTemplate = {0};
+ GUID calloutKey = {0};
+
+ HlprFwpmFilterConditionPrune(pFilter->filterCondition,
+ pFilter->numFilterConditions,
+ &pFilterConditions,
+ &numFilterConditions);
+
+ calloutKey = WFPSAMPLER_CALLOUT_BASIC_PACKET_INJECTION;
+ calloutKey.Data4[7] = HlprFwpmLayerGetIDByKey(&(pFilter->layerKey)); /// Uniquely identifies the callout used
+
+ providerContextEnumTemplate.providerContextType = FWPM_GENERAL_CONTEXT;
+
+ filterEnumTemplate.providerKey = (GUID*)&WFPSAMPLER_PROVIDER;
+ filterEnumTemplate.layerKey = pFilter->layerKey;
+ filterEnumTemplate.enumType = FWP_FILTER_ENUM_FULLY_CONTAINED;
+ filterEnumTemplate.flags = FWP_FILTER_ENUM_FLAG_INCLUDE_BOOTTIME |
+ FWP_FILTER_ENUM_FLAG_INCLUDE_DISABLED;
+ filterEnumTemplate.numFilterConditions = pFilterConditions ? numFilterConditions : pFilter->numFilterConditions;
+ filterEnumTemplate.filterCondition = pFilterConditions ? pFilterConditions : pFilter->filterCondition;
+ filterEnumTemplate.providerContextTemplate = &providerContextEnumTemplate;
+ filterEnumTemplate.actionMask = FWP_ACTION_FLAG_CALLOUT;
+ filterEnumTemplate.calloutKey = &calloutKey;
+
+ status = HlprFwpmEngineOpen(&engineHandle);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmFilterCreateEnumHandle(engineHandle,
+ &filterEnumTemplate,
+ &enumHandle);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmFilterEnum(engineHandle,
+ enumHandle,
+ 0xFFFFFFFF,
+ &ppFilters,
+ &entryCount);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ if(ppFilters)
+ {
+ for(UINT32 filterIndex = 0;
+ filterIndex < entryCount;
+ filterIndex++)
+ {
+ HlprFwpmFilterDeleteByKey(engineHandle,
+ &(ppFilters[filterIndex]->filterKey));
+
+ HlprFwpmCalloutDeleteByKey(engineHandle,
+ &(ppFilters[filterIndex]->action.calloutKey));
+
+ if(ppFilters[filterIndex]->flags & FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT)
+ HlprFwpmProviderContextDeleteByKey(engineHandle,
+ &(ppFilters[filterIndex]->providerContextKey));
+ }
+
+ FwpmFreeMemory((VOID**)&ppFilters);
+ }
+
+ HLPR_BAIL_LABEL:
+
+ if(engineHandle)
+ {
+ if(enumHandle)
+ HlprFwpmFilterDestroyEnumHandle(engineHandle,
+ &enumHandle);
+
+ HlprFwpmEngineClose(&engineHandle);
+ }
+
+ HLPR_DELETE_ARRAY(pFilterConditions);
+
+ return status;
+}
+
+/**
+ @private_function="PrvScenarioBasicPacketInjectionAddFwpmObjects"
+
+ Purpose: Function that enables the SCENARIO_BASIC_PACKET_INJECTION scenarios. <br>
+ <br>
+ Notes: Scenario adds a filter using specified filtering conditions to the specified layer.
+ This filter is associated with WFPSampler's default sublayer and provider. The
+ appropriate callout is then added and associated with the filter. <br>
+ <br>
+ MSDN_Ref: <br>
+*/
+_Success_(return == NO_ERROR)
+UINT32 PrvScenarioBasicPacketInjectionAddFwpmObjects(_In_ const FWPM_FILTER* pFilter,
+ _In_ const PC_BASIC_PACKET_INJECTION_DATA* pPCBasicPacketInjectionData)
+{
+ ASSERT(pFilter);
+ ASSERT(pPCBasicPacketInjectionData);
+
+ UINT32 status = NO_ERROR;
+
+ if(pFilter->layerKey == FWPM_LAYER_INBOUND_IPPACKET_V4 ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_IPPACKET_V6 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_IPPACKET_V4 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_IPPACKET_V6 ||
+ pFilter->layerKey == FWPM_LAYER_IPFORWARD_V4 ||
+ pFilter->layerKey == FWPM_LAYER_IPFORWARD_V6 ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_TRANSPORT_V4 ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_TRANSPORT_V6 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_TRANSPORT_V4 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_TRANSPORT_V6 ||
+ pFilter->layerKey == FWPM_LAYER_DATAGRAM_DATA_V4 ||
+ pFilter->layerKey == FWPM_LAYER_DATAGRAM_DATA_V6 ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_ICMP_ERROR_V4 ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_ICMP_ERROR_V6 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_AUTH_CONNECT_V4 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_AUTH_CONNECT_V6 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 ||
+ pFilter->layerKey == FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6
+
+#if(NTDDI_VERSION >= NTDDI_WIN7)
+
+ ||
+ pFilter->layerKey == FWPM_LAYER_STREAM_PACKET_V4 ||
+ pFilter->layerKey == FWPM_LAYER_STREAM_PACKET_V6
+
+#if(NTDDI_VERSION >= NTDDI_WIN8)
+
+ ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET ||
+ pFilter->layerKey == FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE ||
+ pFilter->layerKey == FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE ||
+ pFilter->layerKey == FWPM_LAYER_INGRESS_VSWITCH_ETHERNET ||
+ pFilter->layerKey == FWPM_LAYER_EGRESS_VSWITCH_ETHERNET
+
+#endif /// (NTDDI_VERSION >= NTDDI_WIN8)
+#endif /// (NTDDI_VERSION >= NTDDI_WIN7)
+
+ )
+ {
+ HANDLE engineHandle = 0;
+ FWP_BYTE_BLOB byteBlob = {0};
+ FWPM_PROVIDER_CONTEXT providerContext = {0};
+ FWPM_CALLOUT callout = {0};
+ FWPM_FILTER filter = {0};
+
+ RtlCopyMemory(&filter,
+ pFilter,
+ sizeof(FWPM_FILTER));
+
+ status = HlprGUIDPopulate(&(providerContext.providerContextKey));
+ HLPR_BAIL_ON_FAILURE(status);
+
+ providerContext.displayData.name = L"WFPSampler's Basic Packet Injection ProviderContext";
+ providerContext.providerKey = (GUID*)&WFPSAMPLER_PROVIDER;
+ providerContext.type = FWPM_GENERAL_CONTEXT;
+ providerContext.dataBuffer = &byteBlob;
+ providerContext.dataBuffer->size = sizeof(PC_BASIC_PACKET_INJECTION_DATA);
+ providerContext.dataBuffer->data = (UINT8*)pPCBasicPacketInjectionData;
+
+ callout.calloutKey = WFPSAMPLER_CALLOUT_BASIC_PACKET_INJECTION;
+ callout.calloutKey.Data4[7] = HlprFwpmLayerGetIDByKey(&(filter.layerKey)); /// Uniquely identifies the callout used
+ callout.displayData.name = L"WFPSampler's Basic Packet Injection Callout";
+ callout.displayData.description = L"Causes callout invocation which blindly injects traffic back";
+ callout.flags = FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT;
+ callout.providerKey = (GUID*)&WFPSAMPLER_PROVIDER;
+ callout.applicableLayer = filter.layerKey;
+
+ status = HlprGUIDPopulate(&(filter.filterKey));
+ HLPR_BAIL_ON_FAILURE(status);
+
+ filter.flags |= FWPM_FILTER_FLAG_HAS_PROVIDER_CONTEXT;
+ filter.providerKey = (GUID*)&WFPSAMPLER_PROVIDER;
+ filter.weight.type = FWP_UINT8;
+ filter.weight.uint8 = 0xF;
+ filter.action.type = FWP_ACTION_CALLOUT_TERMINATING;
+ filter.action.calloutKey = callout.calloutKey;
+ filter.providerContextKey = providerContext.providerContextKey;
+
+ if(filter.flags & FWPM_FILTER_FLAG_BOOTTIME ||
+ filter.flags & FWPM_FILTER_FLAG_PERSISTENT)
+ {
+ providerContext.flags |= FWPM_PROVIDER_CONTEXT_FLAG_PERSISTENT;
+
+ callout.flags |= FWPM_CALLOUT_FLAG_PERSISTENT;
+ }
+
+ status = HlprFwpmEngineOpen(&engineHandle);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmTransactionBegin(engineHandle);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmProviderContextAdd(engineHandle,
+ &providerContext);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmCalloutAdd(engineHandle,
+ &callout);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmFilterAdd(engineHandle,
+ &filter);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ status = HlprFwpmTransactionCommit(engineHandle);
+ HLPR_BAIL_ON_FAILURE(status);
+
+ HLPR_BAIL_LABEL:
+
+ if(engineHandle)
+ {
+ if(status != NO_ERROR)
+ HlprFwpmTransactionAbort(engineHandle);
+
+ HlprFwpmEngineClose(&engineHandle);
+ }
+ }
+ else
+ status = (UINT32)FWP_E_INCOMPATIBLE_LAYER;
+
+ return status;
+}
+
+/**
+ @scenario_function="ScenarioBasicPacketInjectionRemove"
+
+ Purpose: Function that removes corresponding objects for a previously added
+ SCENARIO_BASIC_PACKET_INJECTION. <br>
+ <br>
+ Notes: <br>
+ <br>
+ MSDN_Ref: <br>
+*/
+_Success_(return == NO_ERROR)
+UINT32 ScenarioBasicPacketInjectionRemove(_In_ const FWPM_FILTER* pFilter)
+{
+ ASSERT(pFilter);
+
+ return PrvScenarioBasicPacketInjectionDeleteFwpmObjects(pFilter);
+}
+
+/**
+ @scenario_function="ScenarioBasicPacketInjectionAdd"
+
+ Purpose: Scenario which will blindly reinject the classified traffic. <br>
+ <br>
+ Notes: Adds a filter which references one of the
+ WFPSAMPLER_CALLOUT_BASIC_PACKET_INJECTION callouts for the provided layer. <br>
+ <br>
+ No data modification is made to the traffic, and checks are in place to prevent
+ infinite reinjection of the traffic. <br>
+ <br>
+ Ideal usage is to implement in the presence of a 3rd party firewall to see how they
+ coexist with another provider performing injection. <br>
+ <br>
+ MSDN_Ref: <br>
+*/
+_Success_(return == NO_ERROR)
+UINT32 ScenarioBasicPacketInjectionAdd(_In_ const FWPM_FILTER* pFilter,
+ _In_ const PC_BASIC_PACKET_INJECTION_DATA* pPCBasicPacketInjectionData)
+{
+
+ ASSERT(pFilter);
+ ASSERT(pPCBasicPacketInjectionData);
+
+ return PrvScenarioBasicPacketInjectionAddFwpmObjects(pFilter,
+ pPCBasicPacketInjectionData);
+}
+
+/**
+ @rpc_function="RPCInvokeScenarioBasicPacketInjection"
+
+ Purpose: RPC exposed function used to dipatch the scenario routines for
+ SCENARIO_BASIC_PACKET_INJECTION. <br>
+ <br>
+ Notes: <br>
+ <br>
+ MSDN_Ref: <br>
+*/
+/* [fault_status][comm_status] */
+error_status_t RPCInvokeScenarioBasicPacketInjection(/* [in] */ handle_t rpcBindingHandle,
+ /* [in] */ WFPSAMPLER_SCENARIO scenario,
+ /* [in] */ FWPM_CHANGE_TYPE changeType,
+ /* [ref][in] */ __RPC__in const FWPM_FILTER0* pFilter,
+ /* [unique][in] */ __RPC__in_opt const PC_BASIC_PACKET_INJECTION_DATA* pPCBasicPacketInjectionData)
+{
+ UNREFERENCED_PARAMETER(rpcBindingHandle);
+ UNREFERENCED_PARAMETER(scenario);
+
+ ASSERT(pFilter);
+ ASSERT(scenario == SCENARIO_BASIC_PACKET_INJECTION);
+ ASSERT(changeType < FWPM_CHANGE_TYPE_MAX);
+
+ UINT32 status = NO_ERROR;
+
+ if(changeType == FWPM_CHANGE_ADD)
+ {
+ if(pPCBasicPacketInjectionData)
+ status = ScenarioBasicPacketInjectionAdd(pFilter,
+ pPCBasicPacketInjectionData);
+ else
+ {
+ status = ERROR_INVALID_PARAMETER;
+
+ HlprLogError(L"RpcInvokeScenarioBasicPacketInjection() [status: %#x][pPCBasicPacketInjectionData: %#x]",
+ status,
+ pPCBasicPacketInjectionData);
+ }
+ }
+ else
+ status = ScenarioBasicPacketInjectionRemove(pFilter);
+
+ return status;
+}