diff options
Diffstat (limited to 'network/trans/WFPSampler/sys/ClassifyFunctions_BasicActionCallouts.cpp')
| -rw-r--r-- | network/trans/WFPSampler/sys/ClassifyFunctions_BasicActionCallouts.cpp | 655 |
1 files changed, 655 insertions, 0 deletions
diff --git a/network/trans/WFPSampler/sys/ClassifyFunctions_BasicActionCallouts.cpp b/network/trans/WFPSampler/sys/ClassifyFunctions_BasicActionCallouts.cpp new file mode 100644 index 00000000..375dab93 --- /dev/null +++ b/network/trans/WFPSampler/sys/ClassifyFunctions_BasicActionCallouts.cpp @@ -0,0 +1,655 @@ +//////////////////////////////////////////////////////////////////////////////////////////////////// +// +// Copyright (c) 2014 Microsoft Corporation. All Rights Reserved. +// +// Module Name: +// ClassifyFunctions_BasicActionCallouts.cpp +// +// Abstract: +// This module contains WFP Classify functions for returning the simple actions +// FWP_ACTION_BLOCK and FWP_ACTION_PERMIT. +// +// Naming Convention: +// +// <Module><Scenario><Action> +// +// i.e. +// +// ClassifyBasicActionBlock +// +// <Module> +// Classify - Function is an FWPS_CALLOUT_CLASSIFY_FN. +// <Scenario> +// BasicAction - Function demonstates use of the simple action types. +// <Action> +// { +// Block - Function returns FWP_ACTION_BLOCK, thus blocking the traffic. +// Continue - Function returns FWP_ACTION_CONTINUE thus allowing the traffic for another +// filter (if any) to make a final decision. +// Permit - Function returns FWP_ACTION_PERMIT, thus allowing the traffic. +// Random - Function randomly returns either FWP_ACTION_BLOCK or FWP_ACTION_PERMIT. +// } +// +// Private Functions: +// PerformBasicAction(), +// +// Public Functions: +// ClassifyBasicActionBlock(), +// ClassifyBasicActionContinue(), +// ClassifyBasicActionPermit(), +// ClassifyBasicActionRandom(), +// +// Author: +// Dusty Harper (DHarper) +// +// Revision History: +// +// [ Month ][Day] [Year] - [Revision]-[ Comments ] +// May 01, 2010 - 1.0 - Creation +// December 13, 2013 - 1.1 - Enhance function declaration for IntelliSense and +// enhance traces +// +//////////////////////////////////////////////////////////////////////////////////////////////////// + +#include "Framework_WFPSamplerCalloutDriver.h" /// . +#include "ClassifyFunctions_BasicActionCallouts.tmh" /// $(OBJ_PATH)\$(O)\ + +/** + @private_function="PerformBasicAction" + + Purpose: Sets the pClassifyOut->actionType to the basic action specified. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID PerformBasicAction(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_opt_ const VOID* pClassifyContext, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut, + _In_ FWP_ACTION_TYPE basicAction) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> PerformBasicAction()\n"); +#endif /// DBG + + + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + UNREFERENCED_PARAMETER(pMetadata); + UNREFERENCED_PARAMETER(pClassifyContext); + UNREFERENCED_PARAMETER(pFilter); + UNREFERENCED_PARAMETER(flowContext); + + if(pClassifyValues->layerId == FWPS_LAYER_STREAM_V4 || + pClassifyValues->layerId == FWPS_LAYER_STREAM_V6) + { + FWPS_STREAM_CALLOUT_IO_PACKET0* pIOPacket = (FWPS_STREAM_CALLOUT_IO_PACKET*)pLayerData; + + if(pIOPacket) + { + pIOPacket->streamAction = FWPS_STREAM_ACTION_NONE; + pIOPacket->countBytesEnforced = pIOPacket->streamData->dataLength; + } + } + + if(pClassifyOut) + { + pClassifyOut->actionType = basicAction; + + /// Clear the right to mark as the definitive answer. + if(basicAction == FWP_ACTION_BLOCK || + (basicAction == FWP_ACTION_PERMIT && + pFilter->flags & FWPS_FILTER_FLAG_CLEAR_ACTION_RIGHT)) + pClassifyOut->rights ^= FWPS_RIGHT_ACTION_WRITE; + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- PerformBasicAction()\n"); + +#endif /// DBG + + return; +} + +#if(NTDDI_VERSION >= NTDDI_WIN7) + +/** + @classify_function="ClassifyBasicActionBlock" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_BLOCK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544893.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionBlock(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_opt_ const VOID* pClassifyContext, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionBlock() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + pClassifyContext, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_BLOCK); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionBlock() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +/** + @classify_function="ClassifyBasicActionContinue" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_CONTINUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544893.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionContinue(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_opt_ const VOID* pClassifyContext, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionContinue() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + pClassifyContext, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_CONTINUE); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionContinue() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +/** + @classify_function="ClassifyBasicActionPermit" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_PERMIT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544893.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionPermit(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_opt_ const VOID* pClassifyContext, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionPermit() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + pClassifyContext, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_PERMIT); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionPermit() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +/** + @classify_function="ClassifyBasicActionRandom" + + Purpose: Sets the pClassifyOut->actionType to either FWP_ACTION_BLOCK or FWP_ACTION_PERMIT. <br> + <br> + Notes: Specifying -rab at the command line will allow one to determine how randomly + FWP_ACTION_BLOCK is returned. <br> + Specifying -rac at the command line will allow one to determine how randomly + FWP_ACTION_CONTINUE is returned. <br> + Specifying -rap at the command line will allow one to determine how randomly + FWP_ACTION_PERMIT is returned. <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544893.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionRandom(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_opt_ const VOID* pClassifyContext, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionRandom() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + FWPM_PROVIDER_CONTEXT* pProviderContext = pFilter->providerContext; + + if(pProviderContext && + pProviderContext->type == FWPM_GENERAL_CONTEXT && + pProviderContext->dataBuffer && + pProviderContext->dataBuffer->data && + pProviderContext->dataBuffer->size == sizeof(PC_BASIC_ACTION_DATA)) + { + PC_BASIC_ACTION_DATA* pPCBasicActionData = (PC_BASIC_ACTION_DATA*)(pProviderContext->dataBuffer->data); + UINT32 randomizer = 1; + FWP_ACTION_TYPE actionType = FWP_ACTION_CONTINUE; + UINT32 blockCap = pPCBasicActionData->percentBlock; + UINT32 permitCap = pPCBasicActionData->percentPermit + blockCap; + LARGE_INTEGER largeInteger; + + RtlZeroMemory(&largeInteger, + sizeof(LARGE_INTEGER)); + + KeQueryTickCount(&largeInteger); + + srand(largeInteger.u.LowPart); + + randomizer += (rand() % 100); + + if(randomizer <= blockCap) + actionType = FWP_ACTION_BLOCK; + else if(randomizer <= permitCap) + actionType = FWP_ACTION_PERMIT; + + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + pClassifyContext, + pFilter, + flowContext, + pClassifyOut, + actionType); + } + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionRandom() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +#else + +/** + @classify_function="ClassifyBasicActionBlock" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_BLOCK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544890.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionBlock(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionBlock() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + 0, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_BLOCK); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionBlock() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +/** + @classify_function="ClassifyBasicActionContinue" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_CONTINUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544890.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionContinue(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionContinue() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + 0, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_CONTINUE); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionContinue() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +/** + @classify_function="ClassifyBasicActionPermit" + + Purpose: Sets the pClassifyOut->actionType to FWP_ACTION_PERMIT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544890.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionPermit(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionPermit() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + 0, + pFilter, + flowContext, + pClassifyOut, + FWP_ACTION_PERMIT); + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionPermit() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + +#endif /// DBG + + return; +} + +/** + @classify_function="ClassifyBasicActionRandom" + + Purpose: Sets the pClassifyOut->actionType to either FWP_ACTION_BLOCK or FWP_ACTION_PERMIT. <br> + <br> + Notes: Specifying -rab at the command line will allow one to determine how randomly + FWP_ACTION_BLOCK is returned. <br> + Specifying -rac at the command line will allow one to determine how randomly + FWP_ACTION_CONTINUE is returned. <br> + Specifying -rap at the command line will allow one to determine how randomly + FWP_ACTION_PERMIT is returned. <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF544890.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +VOID NTAPI ClassifyBasicActionRandom(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const FWPS_INCOMING_METADATA_VALUES* pMetadata, + _Inout_opt_ VOID* pLayerData, + _In_ const FWPS_FILTER* pFilter, + _In_ UINT64 flowContext, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ + NT_ASSERT(pClassifyValues); + NT_ASSERT(pMetadata); + NT_ASSERT(pFilter); + NT_ASSERT(pClassifyOut); + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> ClassifyBasicActionRandom() [Layer: %s][FilterID: %#I64x][Rights: %#x]", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->rights); + + if(pClassifyOut->rights & FWPS_RIGHT_ACTION_WRITE) + { + NT_ASSERT(pFilter->providerContext); + NT_ASSERT(pFilter->providerContext->type == FWPM_GENERAL_CONTEXT); + NT_ASSERT(pFilter->providerContext->dataBuffer); + NT_ASSERT(pFilter->providerContext->dataBuffer->data); + NT_ASSERT(pFilter->providerContext->dataBuffer->size == sizeof(PC_BASIC_ACTION_DATA)); + + FWPM_PROVIDER_CONTEXT* pProviderContext = pFilter->providerContext; + PC_BASIC_ACTION_DATA* pPCBasicActionData = (PC_BASIC_ACTION_DATA*)(pProviderContext->dataBuffer->data); + UINT32 randomizer = 1; + FWP_ACTION_TYPE actionType = FWP_ACTION_CONTINUE; + UINT32 blockCap = pPCBasicActionData->percentBlock; + UINT32 permitCap = pPCBasicActionData->percentPermit + blockCap; + LARGE_INTEGER largeInteger = {0}; + + KeQueryTickCount(&largeInteger); + + srand(largeInteger.u.LowPart); + + randomizer += (rand() % 100); + + if(randomizer <= blockCap) + actionType = FWP_ACTION_BLOCK; + else if(randomizer <= permitCap) + actionType = FWP_ACTION_PERMIT; + + PerformBasicAction(pClassifyValues, + pMetadata, + pLayerData, + 0, + pFilter, + flowContext, + pClassifyOut, + actionType); + } + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- ClassifyBasicActionRandom() [Layer: %s][FilterID: %#I64x][Action: %#x][Rights: %#x][Absorb: %s]\n", + KrnlHlprFwpsLayerIDToString(pClassifyValues->layerId), + pFilter->filterId, + pClassifyOut->actionType, + pClassifyOut->rights, + (pClassifyOut->flags & FWPS_CLASSIFY_OUT_FLAG_ABSORB) ? "TRUE" : "FALSE"); + + return; +} + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) |