/*++ Copyright (c) Microsoft Corporation. All rights reserved Abstract: Stream Edit Callout Driver Sample. This sample demonstrates finding and replacing a string pattern from a live TCP stream via the WFP stream API. The driver demonstrates the two modes of stream editing/inspection -- o Inline Editing where all modification is carried out within the WFP ClassifyFn callout function. o Out-of-band (OOB) Editing where all modification is done by a worker thread. (this is the default) The mode setting, along with other inspection parameters are configurable via the following registry values HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\StmEdit\Parameters o StringToFind (REG_SZ, default = "rainy") o StringX (REG_SZ, default = "cloudy") o StringToReplace (REG_SZ, default = "sunny") o InspectionLocalPort (REG_DWORD, default = 8888) o InspectionRemotePort (REG_DWORD, default = 0) Note: for this sample, a local or remote port is mandatory. Both cannot be zero. o InspectioDirection (REG_DWORD, default = 2) possible values : 2 (inbound + outbound), 0 (FWP_DIRECTION_OUTBOUND), 1 (FWP_DIRECTION_INBOUND) o MultipleCallouts (REG_DWORD, default = true/1) controls registration of multiple callouts. Set 0 for false, other for TRUE o BusyThreshold (REG_DWORD, default = 16KB) BusyThreshold value is in KBs (e.g. a value of 5 means 5KB) The sample is IP version agnostic. It is capable of performing inspections on both IPv4 and IPv6 data streams Before experimenting with the sample, please be sure to add an exception for the InspectionPort configured to the firewall. Environment: Kernel mode --*/ #include "Trace.h" #include "StreamEdit.h" #include "StreamEdit.tmh" STMEDIT_GLOBALS Globals; DRIVER_INITIALIZE DriverEntry; EVT_WDF_DRIVER_UNLOAD StreamEditEvtDriverUnload; #if defined _MODULE_ID #undef _MODULE_ID #endif #define _MODULE_ID 'S' VOID StmEditReferenceFlow( _Inout_ PSTREAM_FLOW_CONTEXT FlowContext, _In_ char Module, _In_ UINT Line ) { LONG Count = InterlockedIncrement((LONG *)&FlowContext->RefCount); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_REFCOUNT, "FlowCtx %p RefCount++ @ %c/%lu = %lu", FlowContext, Module, Line, Count); } VOID StmEditDeReferenceFlow( _Inout_ PSTREAM_FLOW_CONTEXT FlowContext, _In_ char Module, _In_ UINT Line ) { LONG Count; KLOCK_QUEUE_HANDLE LockHandle; NT_ASSERT(FlowContext->RefCount > 0); Count = InterlockedDecrement((LONG *)&FlowContext->RefCount); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_REFCOUNT, "FlowCtx %p RefCount-- @ %c/%lu = %lu", FlowContext, Module, Line, Count); if (Count == 0) { NT_ASSERT( ! FlowContext->bFlowActive); // Remove the context from global context list // KeAcquireInStackQueuedSpinLock(&Globals.FlowContextListLock, &LockHandle); if (!FlowContext->bEntryRemoved) { RemoveEntryList(&FlowContext->Link); FlowContext->bEntryRemoved = TRUE; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p, -- Link removed", FlowContext); } Count = --Globals.FlowContextCount; if (Globals.FlowContextCount == 0) { NT_ASSERT(IsListEmpty(&Globals.FlowContextList)); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Setting ZeroFlowCountEvent."); KeSetEvent(&Globals.ZeroFlowCountEvent, IO_NO_INCREMENT, FALSE); } KeReleaseInStackQueuedSpinLock(&LockHandle); if (!FlowContext->bEditInline) { NT_ASSERT(IsListEmpty(&FlowContext->OobInfo.OutgoingDataQueue)); } if (FlowContext->ScratchBuffer) { ExFreePoolWithTag(FlowContext->ScratchBuffer, STMEDIT_TAG_FLAT_BUFFER); } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p is being freed., %lu remain @--", FlowContext, Count); ExFreePoolWithTag(FlowContext, STMEDIT_TAG_FLOWCTX); } } NTSTATUS StreamEditNotifyFunction( _In_ FWPS_CALLOUT_NOTIFY_TYPE NotifyType, _In_ const GUID* FilterKey, _In_ const FWPS_FILTER* Filter ) { /* Notify Function. */ UNREFERENCED_PARAMETER(FilterKey); #if 0 UNREFERENCED_PARAMETER(notifyType); UNREFERENCED_PARAMETER(filter); #else NT_ASSERT(Filter != NULL); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "-><- %!FUNC! invoked with %I64u for Filter ID %I64u", NotifyType, Filter->filterId); #endif return STATUS_SUCCESS; } void NTAPI StreamEditInjectCompletionFn( _In_ VOID* Context, _Inout_ NET_BUFFER_LIST* NetBufferList, _In_ BOOLEAN DispatchLevel ) /* Injection completion function for injecting an NBL created using FwpsAllocateNetBufferAndNetBufferList. */ { MDL* mdl = (MDL*)Context; UNREFERENCED_PARAMETER(DispatchLevel); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "-><- %!FUNC!: NBL %p (%!STATUS!), MDL %p", NetBufferList, NetBufferList->Status, mdl); // Supress warning 28922: Redundant test against NULL. Pointer is already guaranteed to be non-NULL. // Rationale : mdl is not guaranteed to be non-NULL here. #pragma prefast(push) #pragma prefast(disable:28922) if (mdl != NULL) { // // The MDL mapped over a pool alloc which we need to free here. // ExFreePoolWithTag(mdl->MappedSystemVa, STMEDIT_TAG_MDL_DATA); IoFreeMdl(mdl); } #pragma prefast(pop) NT_ASSERT(NetBufferList != NULL); FwpsFreeNetBufferList(NetBufferList); } NTSTATUS StreamEditRemoveFlowCtx( _In_ PSTREAM_FLOW_CONTEXT Context ) /* Function to disassociate a previously associated context from a data flow. This will cause flowDelete function to be invoked (either synchronously or asynchronously). Remarks @ http://msdn.microsoft.com/en-us/library/windows/hardware/ff551169.aspx If the FwpsFlowRemoveContext0 function returns STATUS_SUCCESS, FwpsFlowRemoveContext0 calls the flowDeleteFn callout function synchronously.If FwpsFlowRemoveContext0 returns STATUS_PENDING, FwpsFlowRemoveContext0 calls flowDeleteFn asynchronously because an active callout classification is in progress. */ { NTSTATUS Status = STATUS_SUCCESS; // // Possible synchronization problem for accessing bFlowActive... // while we are flushing the data, FlowDeleteFn can get invoked. // DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!: FlowCtx %p", Context); NT_ASSERT(Context); if (Context->bEditInline) { (VOID) InlineEditFlushData(Context, 0, Context->PartialSFlags); } else { (VOID) StreamOobFlushOutgoingData(Context); } if (Context->bFlowActive) { Status = FwpsFlowRemoveContext( Context->FlowHandle, Context->LayerId, Context->CalloutId); } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!: FlowCtx %p, %!STATUS!", Context, Status); return Status; } VOID StreamEditSignalShutdown( ) /* This function attempts to Disassociate all active FlowContexts so that a shutdown can be performed. */ { KLOCK_QUEUE_HANDLE LockHandle; PSTREAM_FLOW_CONTEXT FlowContext; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!"); KeAcquireInStackQueuedSpinLock(&Globals.FlowContextListLock, &LockHandle); while ( ! IsListEmpty(&Globals.FlowContextList) ) { PLIST_ENTRY Entry = RemoveHeadList(&Globals.FlowContextList); FlowContext = CONTAINING_RECORD(Entry, STREAM_FLOW_CONTEXT, Link); FlowContext->bEntryRemoved = TRUE; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p, -- Link removed at shutdown", FlowContext); if (FlowContext->bFlowActive) { KeReleaseInStackQueuedSpinLock(&LockHandle); (VOID)StreamEditRemoveFlowCtx(FlowContext); KeAcquireInStackQueuedSpinLock(&Globals.FlowContextListLock, &LockHandle); } } KeReleaseInStackQueuedSpinLock(&LockHandle); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!"); } VOID StreamEditFlowDeleteFunction( _In_ UINT16 LayerId, _In_ UINT32 CalloutId, _In_ UINT64 Context ) /* This is the flowDeleteFn function. This callback is invoked when a flow is terminated or due to call to FwpsFlowRemoveContext0. We removes the FlowContext from the global FlowcCntextList and releases resources. IRQL <= DISPATCH_LEVEL */ { PSTREAM_FLOW_CONTEXT FlowCtx = (PSTREAM_FLOW_CONTEXT)(ULONG_PTR)Context; NT_ASSERT(NULL != FlowCtx); NT_ASSERT(TRUE == FlowCtx->bFlowActive); InterlockedExchange8(&FlowCtx->bFlowActive, FALSE); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!: FlowCtx %p, LayerId %hu, CalloutId %u, FlowId %I64u (RefCt = %lu)", FlowCtx, LayerId, CalloutId, FlowCtx->FlowHandle, FlowCtx->RefCount ); // Deref the reference taken in Flow-established when the FlowCtx was allocated // StmEditDeReferenceFlow(FlowCtx, _MODULE_ID, __LINE__); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!: FlowCtx %p", FlowCtx); } VOID NTAPI StreamEditCommonStreamClassify( _In_ const FWPS_INCOMING_VALUES* InFixedValues, _In_ const FWPS_INCOMING_METADATA_VALUES* InMetaValues, _In_ PVOID LayerData, #if(NTDDI_VERSION >= NTDDI_WIN7) _In_ const VOID* ClassifyContext, #endif _In_ const FWPS_FILTER* Filter, _In_ UINT64 InFlowContext, _Inout_ FWPS_CLASSIFY_OUT* ClassifyOut ) /* Common classifyFn for both Inline and Out-of-band Stream layer callouts. Invokes corresponding classify-function based on FlowContext->bEditInline flag. */ { PSTREAM_FLOW_CONTEXT FlowContext = (PSTREAM_FLOW_CONTEXT)(ULONG_PTR)InFlowContext; #if(NTDDI_VERSION >= NTDDI_WIN7) UNREFERENCED_PARAMETER(ClassifyContext); #endif NT_ASSERT(FlowContext); // Reference the flow to keep around while we are in classifyFn // StmEditReferenceFlow(FlowContext, _MODULE_ID, __LINE__); if (FlowContext->bEditInline) { InlineEditClassify( InFixedValues, InMetaValues, LayerData, Filter, InFlowContext, ClassifyOut ); } else { OobEditClassify ( InFixedValues, InMetaValues, LayerData, Filter, InFlowContext, ClassifyOut ); } StmEditDeReferenceFlow(FlowContext, _MODULE_ID, __LINE__); } VOID StreamEditFlowEstablishedClassify( _In_ const FWPS_INCOMING_VALUES* InFixedValues, _In_ const FWPS_INCOMING_METADATA_VALUES* InMetaValues, _In_ PVOID Packet, #if(NTDDI_VERSION >= NTDDI_WIN7) _In_ const void* ClassifyContext, #endif _In_ const FWPS_FILTER* Filter, _In_ UINT64 InFlowContext, _Inout_ FWPS_CLASSIFY_OUT* ClassifyOut ) /* Flow-established call out for IPV4 and IPV6 traffic. Allocates and sets up a flow-context, and associate it with the flow. */ { NTSTATUS Status; PSTREAM_FLOW_CONTEXT StreamFlowContext; UINT32 StreamCalloutId; UINT16 StreamLayerId; KLOCK_QUEUE_HANDLE lockHandle; USHORT ipProtIndex; int CalloutSet = 0; #if(NTDDI_VERSION >= NTDDI_WIN7) UNREFERENCED_PARAMETER(ClassifyContext); #endif UNREFERENCED_PARAMETER(InFlowContext); UNREFERENCED_PARAMETER(Packet); if ((Filter->action.calloutId == Globals.FlowEstablishedV4Callout1) || (Filter->action.calloutId == Globals.FlowEstablishedV6Callout1)) { CalloutSet = 1; } else if ((Filter->action.calloutId == Globals.FlowEstablishedV4Callout2) || (Filter->action.calloutId == Globals.FlowEstablishedV6Callout2)) { CalloutSet = 2; NT_ASSERT(TRUE == Globals.MultipleCallouts); } else { NT_ASSERT(FALSE); } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!%d: LayerId %hu, CalloutId %u, FlowId %I64u", CalloutSet, InFixedValues->layerId, Filter->action.calloutId, InMetaValues->flowHandle); ClassifyOut->actionType = FWP_ACTION_CONTINUE; // Lets not entertain any new flows if the driver is unloading! // if (Globals.DriverUnloading) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT,"<-- %!FUNC!: -- Driver unloading, flow not being associated with"); return; } // // Setup the flow context for IPV4 Flows // if (FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4 == InFixedValues->layerId) { ipProtIndex = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_PROTOCOL; StreamLayerId = FWPS_LAYER_STREAM_V4; StreamCalloutId = CalloutSet == 1 ? Globals.StreamLayerV4Callout1 : Globals.StreamLayerV4Callout2; } // // Setup the flow context for IPV6 Flows // else if (FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6 == InFixedValues->layerId) { ipProtIndex = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_PROTOCOL; StreamLayerId = FWPS_LAYER_STREAM_V6; StreamCalloutId = CalloutSet == 1 ? Globals.StreamLayerV6Callout1 : Globals.StreamLayerV6Callout2; } else { // We should not be here. // NT_ASSERT(FALSE); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!: -- Invalid layer."); return; } // // Creates a flow context and associate it with the current flow // FlowContext gets deleted via flowDeleteFn // do { StreamFlowContext = ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(STREAM_FLOW_CONTEXT), STMEDIT_TAG_FLOWCTX); if (StreamFlowContext == NULL) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Unable to allocate flow context"); Status = STATUS_INSUFFICIENT_RESOURCES; break; } // Initialize the flow-context // StreamFlowContext->IpProto = InFixedValues->incomingValue[ipProtIndex].value.uint16; StreamFlowContext->bFlowActive = TRUE; StreamFlowContext->FlowHandle = InMetaValues->flowHandle; StreamFlowContext->LayerId = StreamLayerId; StreamFlowContext->CalloutId = StreamCalloutId; // Reference to take ownership! StmEditReferenceFlow(StreamFlowContext, _MODULE_ID, __LINE__); // Callout Set #1 is for Out of Band editing // if (CalloutSet == 1) { // Initialize OOB editing specific flow context structure fields // this includes, creating a worker thread to handle KeInitializeSpinLock(&StreamFlowContext->OobInfo.EditLock); InitializeListHead(&StreamFlowContext->OobInfo.OutgoingDataQueue); StreamFlowContext->OobInfo.EditState = OOB_EDIT_IDLE; StreamFlowContext->OobInfo.QueueNumber = InterlockedIncrement((LONG *)&Globals.QueueIndex) % NUM_WORKITEM_QUEUES; } // Callout Set #2 is for InLine editing // else { // Initialize inline editing specific flow context structure areas // StreamFlowContext->InlineEditState = INLINE_EDIT_IDLE; StreamFlowContext->bEditInline = TRUE; StreamFlowContext->CurrentProcessor = INVALID_PROC_NUMBER; } // Add the newly created context on global context list KeAcquireInStackQueuedSpinLock(&Globals.FlowContextListLock, &lockHandle); InsertTailList(&Globals.FlowContextList, &StreamFlowContext->Link); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p, ++ Link inserted into global list", StreamFlowContext); ++Globals.FlowContextCount; if (Globals.FlowContextCount == 1) { // Reset the shut-down event in case it was set due to no active flows // DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Clearing ZeroFlowCountEvent."); KeClearEvent(&Globals.ZeroFlowCountEvent); } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p is allocated., Total %lu @++", StreamFlowContext, Globals.FlowContextCount); KeReleaseInStackQueuedSpinLock(&lockHandle); Status = FwpsFlowAssociateContext( StreamFlowContext->FlowHandle, StreamLayerId, StreamCalloutId, (UINT64)StreamFlowContext); // // If not able to associate a flow context, free the memory and return. // if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_ERROR, CO_GENERAL, "FlowContext association to FlowId %I64u failed with %!STATUS!", InMetaValues->flowHandle, Status); break; } } while (FALSE); if (!NT_SUCCESS(Status) && StreamFlowContext) { StmEditDeReferenceFlow(StreamFlowContext, _MODULE_ID, __LINE__); } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!%d: FlowCtx %p, cOut->Action %#x, %!STATUS!", CalloutSet, StreamFlowContext, ClassifyOut->actionType, Status); return; } NTSTATUS StreamEditRegisterFlowEstablishedCallouts( _In_ PVOID DeviceObject, _In_ const GUID* LayerKey, _In_ const GUID* CalloutKey, _In_ FWPM_DISPLAY_DATA* DisplayData, _Out_ UINT32* CalloutId, _In_ int CalloutNum ) /* This function registers callouts and filters that intercept TCP traffic at WFP FWPM_LAYER_STREAM_V4 or FWPM_LAYER_STREAM_V6 layer. */ { NTSTATUS Status = STATUS_SUCCESS; USHORT condIndex = 0; BOOLEAN calloutRegistered = FALSE; FWPS_CALLOUT sCallout = { 0 }; FWPM_CALLOUT mCallout = { 0 }; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!%d", CalloutNum); sCallout.calloutKey = *CalloutKey; // STREAM_EDITOR_FLOW_ESTABLISHED_CALLOUT_V4 / V6; sCallout.notifyFn = StreamEditNotifyFunction; sCallout.classifyFn = StreamEditFlowEstablishedClassify; Status = FwpsCalloutRegister(DeviceObject, &sCallout, CalloutId); if (NT_SUCCESS(Status)) { calloutRegistered = TRUE; mCallout.calloutKey = *CalloutKey; mCallout.displayData = *DisplayData; mCallout.applicableLayer = *LayerKey; // FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 / V6 Status = FwpmCalloutAdd(Globals.EngineHandle, &mCallout, NULL, NULL); if (NT_SUCCESS(Status)) { FWPM_FILTER filter = { 0 }; FWPM_FILTER_CONDITION filterConditions[4] = { 0 }; // Add Filters for StreamEditFlowEstablishedClassify // filter.layerKey = *LayerKey; filter.displayData.name = L"Stream Edit Sample Filter"; filter.displayData.description = L"Filter that finds and replaces a token from a TCP stream (@ Flow Established)"; filter.action.type = FWP_ACTION_CALLOUT_INSPECTION; // FWP_ACTION_CALLOUT_TERMINATING; filter.action.calloutKey = *CalloutKey; filter.filterCondition = filterConditions; // In this sample, we edit TCP streams only // filterConditions[condIndex].fieldKey = FWPM_CONDITION_IP_PROTOCOL; filterConditions[condIndex].matchType = FWP_MATCH_EQUAL; filterConditions[condIndex].conditionValue.type = FWP_UINT8; filterConditions[condIndex].conditionValue.uint8 = IPPROTO_TCP; filter.numFilterConditions++; condIndex++; // Filter according to the direction of the flow we are interested in // // @ http://msdn.microsoft.com/en-us/library/windows/desktop/aa364005.aspx // // For stream layers (FWPM_LAYER_STREAM_*) and flow established layers // ( FWPM_LAYER_ALE_FLOW_ESTABLISHED_* ), the value will be the same as // direction of the connection. // // For example, when a local application initiates the connection, an // inbound packet has FWPM_CONDITION_DIRECTION set to FWP_DIRECTION_OUTBOUND. // if (Globals.InspectionDirection != FWP_DIRECTION_MAX) { filterConditions[condIndex].fieldKey = FWPM_CONDITION_DIRECTION; filterConditions[condIndex].matchType = FWP_MATCH_EQUAL; filterConditions[condIndex].conditionValue.type = FWP_UINT32; filterConditions[condIndex].conditionValue.uint32 = Globals.InspectionDirection; filter.numFilterConditions++; condIndex++; } // Make sure that either the remote or the local port is specified... // i.e. both ports are not zero // if (Globals.InspectionLocalPort > 0) { filterConditions[condIndex].fieldKey = FWPM_CONDITION_IP_LOCAL_PORT; filterConditions[condIndex].matchType = FWP_MATCH_EQUAL; filterConditions[condIndex].conditionValue.type = FWP_UINT16; filterConditions[condIndex].conditionValue.uint16 = Globals.InspectionLocalPort; filter.numFilterConditions++; condIndex++; } if (Globals.InspectionRemotePort > 0) { filterConditions[condIndex].fieldKey = FWPM_CONDITION_IP_REMOTE_PORT; filterConditions[condIndex].matchType = FWP_MATCH_EQUAL; filterConditions[condIndex].conditionValue.type = FWP_UINT16; filterConditions[condIndex].conditionValue.uint16 = Globals.InspectionRemotePort; filter.numFilterConditions++; } filter.subLayerKey = CalloutNum == 1 ? STREAM_EDITOR_SUBLAYER_1 : STREAM_EDITOR_SUBLAYER_2; filter.weight.type = FWP_EMPTY; Status = FwpmFilterAdd(Globals.EngineHandle, &filter, NULL, NULL); } //FwpmCalloutAdd } //FwpsCalloutRegister if (!NT_SUCCESS(Status)) { if (calloutRegistered) { FwpsCalloutUnregisterById(*CalloutId); } } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!, %!STATUS!", Status); return Status; } NTSTATUS StreamEditRegisterStreamLayerCallouts( _In_ PVOID DeviceObject, _In_ const GUID* LayerKey, _In_ const GUID* CalloutKey, _In_ FWPM_DISPLAY_DATA* DisplayData, _Out_ UINT32* CalloutId, _In_ const int CalloutNum ) /* This function registers callouts that intercept TCP traffic at WFP FWPM_LAYER_STREAM_V4 or FWPM_LAYER_STREAM_V6 layer. */ { NTSTATUS Status = STATUS_SUCCESS; FWPS_CALLOUT sCallout = {0}; FWPM_CALLOUT mCallout = {0}; BOOLEAN calloutRegistered = FALSE; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!%d", CalloutNum); sCallout.calloutKey = *CalloutKey; sCallout.classifyFn = StreamEditCommonStreamClassify; sCallout.notifyFn = StreamEditNotifyFunction; sCallout.flowDeleteFn = StreamEditFlowDeleteFunction; // http://msdn.microsoft.com/en-us/library/windows/hardware/ff551224.aspx // // FWPS_CALLOUT0 structure // // FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW // If this flag is specified, the filter engine calls the callout driver's // classifyFn callout function only if there is a context associated with // the data flow. // sCallout.flags = FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW; Status = FwpsCalloutRegister( DeviceObject, &sCallout, CalloutId ); if (NT_SUCCESS(Status)) { calloutRegistered = TRUE; mCallout.calloutKey = *CalloutKey; mCallout.displayData = *DisplayData; mCallout.applicableLayer = *LayerKey; // FWPM_LAYER_STREAM_V4 / V6 Status = FwpmCalloutAdd( Globals.EngineHandle, &mCallout, NULL, NULL ); if (NT_SUCCESS(Status)) { // // Add Filters for Stream Classify // // Note : we are adding a filter with no filter conditions -- i.e. this classifyFn callout // will be classified for ALL streams/flows. // However, due to FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW set above, // the classifyFn will be classified only for flows that have a context associated. // FWPM_FILTER filter = { 0 }; filter.layerKey = *LayerKey; filter.displayData.name = L"Stream Edit Sample Filter"; filter.displayData.description = L"Filter that finds and replaces a token from a TCP stream (@ Stream Layer)"; filter.action.type = FWP_ACTION_CALLOUT_TERMINATING; filter.action.calloutKey = *CalloutKey; filter.numFilterConditions = 0; filter.filterCondition = 0; filter.subLayerKey = CalloutNum == 1 ? STREAM_EDITOR_SUBLAYER_1 : STREAM_EDITOR_SUBLAYER_2; filter.weight.type = FWP_EMPTY; // auto-weight Status = FwpmFilterAdd(Globals.EngineHandle, &filter, NULL, NULL); } } if (!NT_SUCCESS(Status)) { if (calloutRegistered) { FwpsCalloutUnregisterById(*CalloutId); } } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!, %!STATUS!", Status); return Status; } NTSTATUS StreamEditRegisterCallouts( _In_ PVOID DeviceObject ) /* This function registers dynamic callouts and filters that intercept TCP traffic at WFP FWPM_LAYER_STREAM_V4 and FWPM_LAYER_STREAM_V6 layer. Callouts and filters will be removed during DriverUnload. */ { NTSTATUS Status = STATUS_SUCCESS; BOOLEAN EngineOpened = FALSE; BOOLEAN InTransaction = FALSE; FWPM_SESSION session = {0}; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT,"--> %!FUNC!"); session.flags = FWPM_SESSION_FLAG_DYNAMIC; Status = FwpmEngineOpen( NULL, RPC_C_AUTHN_WINNT, NULL, &session, &Globals.EngineHandle ); if (NT_SUCCESS(Status)) { EngineOpened = TRUE; Status = FwpmTransactionBegin(Globals.EngineHandle, 0); if (NT_SUCCESS(Status)) { FWPM_SUBLAYER0 StreamEditSubLayer = { 0 }; FWPM_DISPLAY_DATA DisplayData; NTSTATUS StatusV6; InTransaction = TRUE; // Add SubLayer for Callout Set 1 (OoB V4/V6 callouts) // Register the first set of callouts at Flow-established V4 and V6 layers // StreamEditSubLayer.subLayerKey = STREAM_EDITOR_SUBLAYER_1; StreamEditSubLayer.displayData.name = L"Stream Edit Sample Sub-Layer 1"; StreamEditSubLayer.displayData.description = L"Sub-Layer for use by Stream Edit Sample callouts"; StreamEditSubLayer.weight = 0x40; Status = FwpmSubLayerAdd(Globals.EngineHandle, &StreamEditSubLayer, NULL); if (NT_SUCCESS(Status)) { DisplayData.name = L"Stream Editor Sample ALE Flow Established V4 Callout #1"; DisplayData.description = L"Flow Established V4 Callout to associate flow-contexts with flows"; Status = StreamEditRegisterFlowEstablishedCallouts( DeviceObject, &FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4, &STREAM_EDITOR_FLOW_ESTABLISHED_CALLOUT_V4, &DisplayData, &Globals.FlowEstablishedV4Callout1, 1); DisplayData.name = L"Stream Editor Sample ALE Flow Established V6 Callout #1"; DisplayData.description = L"Flow Established V6 Callout to associate flow-contexts with flows"; StatusV6 = StreamEditRegisterFlowEstablishedCallouts( DeviceObject, &FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6, &STREAM_EDITOR_FLOW_ESTABLISHED_CALLOUT_V6, &DisplayData, &Globals.FlowEstablishedV6Callout1, 1); if (NT_SUCCESS(Status) || NT_SUCCESS(StatusV6)) { DisplayData.name = L"Stream Editor Sample Stream Layer V4 Callout #1"; DisplayData.description = L"Stream-Layer V4 Callout finds and replaces token(s) from a TCP stream"; Status = StreamEditRegisterStreamLayerCallouts( DeviceObject, &FWPM_LAYER_STREAM_V4, &STREAM_EDITOR_STREAM_CALLOUT_V4, &DisplayData, &Globals.StreamLayerV4Callout1, 1); DisplayData.name = L"Stream Editor Sample Stream Layer V6 Callout #1"; DisplayData.description = L"Stream-Layer V6 Callout finds and replaces token(s) from a TCP stream"; StatusV6 = StreamEditRegisterStreamLayerCallouts( DeviceObject, &FWPM_LAYER_STREAM_V6, &STREAM_EDITOR_STREAM_CALLOUT_V6, &DisplayData, &Globals.StreamLayerV6Callout1, 1); if (!(NT_SUCCESS(Status) || NT_SUCCESS(StatusV6))) { NT_ASSERT(FALSE); } } // RegisterStreamLayerCallouts }//FwpmSubLayerAdd if (Globals.MultipleCallouts) { // Add SubLayer for Callout Set 2 (OoB V4/V6 callouts) // Register the second set of callouts at Flow-established V4 and V6 layers // StreamEditSubLayer.subLayerKey = STREAM_EDITOR_SUBLAYER_2; StreamEditSubLayer.displayData.name = L"Stream Edit Sample Sub-Layer 2"; StreamEditSubLayer.displayData.description = L"Sub-Layer for use by Stream Edit Sample callouts"; StreamEditSubLayer.flags = 0; StreamEditSubLayer.weight = 0x20; Status = FwpmSubLayerAdd(Globals.EngineHandle, &StreamEditSubLayer, NULL); if (NT_SUCCESS(Status)) { // Register second set of callouts at Flow-established V4 and V6 layers // DisplayData.name = L"Stream Editor Sample ALE Flow Established V4 Callout #2"; DisplayData.description = L"Flow Established V4 Callout to associate flow-contexts with flows"; Status = StreamEditRegisterFlowEstablishedCallouts( DeviceObject, &FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4, &STREAM_EDITOR_FLOW_ESTABLISHED_CALLOUT_V4_2, &DisplayData, &Globals.FlowEstablishedV4Callout2, 2); DisplayData.name = L"Stream Editor Sample ALE Flow Established V6 Callout #2"; DisplayData.description = L"Flow Established V6 Callout to associate flow-contexts with flows"; StatusV6 = StreamEditRegisterFlowEstablishedCallouts( DeviceObject, &FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6, &STREAM_EDITOR_FLOW_ESTABLISHED_CALLOUT_V6_2, &DisplayData, &Globals.FlowEstablishedV6Callout2, 2); if (NT_SUCCESS(Status) || NT_SUCCESS(StatusV6)) { DisplayData.name = L"Stream Editor Sample Stream Layer V4 Callout #2"; DisplayData.description = L"Stream-Layer V4 Callout finds and replaces token(s) from a TCP stream"; Status = StreamEditRegisterStreamLayerCallouts( DeviceObject, &FWPM_LAYER_STREAM_V4, &STREAM_EDITOR_STREAM_CALLOUT_V4_2, &DisplayData, &Globals.StreamLayerV4Callout2, 2); DisplayData.name = L"Stream Editor Sample Stream Layer V6 Callout #2"; DisplayData.description = L"Stream-Layer V6 Callout finds and replaces token(s) from a TCP stream"; StatusV6 = StreamEditRegisterStreamLayerCallouts( DeviceObject, &FWPM_LAYER_STREAM_V6, &STREAM_EDITOR_STREAM_CALLOUT_V6_2, &DisplayData, &Globals.StreamLayerV6Callout2, 2); if (!(NT_SUCCESS(Status) || NT_SUCCESS(StatusV6))) { NT_ASSERT(FALSE); } } } } // MultiCallout. Status = FwpmTransactionCommit(Globals.EngineHandle); if (NT_SUCCESS(Status)) { InTransaction = FALSE; } } // FwpmTransactionBegin } // FwpmEngineOpen if (!NT_SUCCESS(Status)) { if (InTransaction) { NTSTATUS AbortStatus; AbortStatus = FwpmTransactionAbort(Globals.EngineHandle); _Analysis_assume_(NT_SUCCESS(AbortStatus)); } if (EngineOpened) { FwpmEngineClose(Globals.EngineHandle); Globals.EngineHandle = NULL; } } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!, %!STATUS!", Status); return Status; } VOID StreamEditUnregisterCallout(VOID) { // Unregister the callouts for Callout #1 // FwpsCalloutUnregisterById(Globals.FlowEstablishedV4Callout1); FwpsCalloutUnregisterById(Globals.StreamLayerV4Callout1); FwpsCalloutUnregisterById(Globals.FlowEstablishedV6Callout1); FwpsCalloutUnregisterById(Globals.StreamLayerV6Callout1); FwpmSubLayerDeleteByKey(Globals.EngineHandle, &STREAM_EDITOR_SUBLAYER_1); // Unregister the callouts for Callout #2 // if (Globals.MultipleCallouts) { FwpsCalloutUnregisterById(Globals.FlowEstablishedV4Callout2); FwpsCalloutUnregisterById(Globals.StreamLayerV4Callout2); FwpsCalloutUnregisterById(Globals.FlowEstablishedV6Callout2); FwpsCalloutUnregisterById(Globals.StreamLayerV6Callout2); FwpmSubLayerDeleteByKey(Globals.EngineHandle, &STREAM_EDITOR_SUBLAYER_2); } NT_ASSERT(Globals.EngineHandle != NULL); FwpmEngineClose(Globals.EngineHandle); Globals.EngineHandle = NULL; } _Function_class_(EVT_WDF_DRIVER_UNLOAD) _IRQL_requires_same_ _IRQL_requires_max_(PASSIVE_LEVEL) VOID StreamEditEvtDriverUnload( _In_ WDFDRIVER DriverObject ) { ULONG nCount; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!: (DrvObj %p)", DriverObject); InterlockedExchange8( &Globals.DriverUnloading, TRUE); StreamEditSignalShutdown(); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "DriverUnload -- Waiting for all the flows to terminate"); KeWaitForSingleObject(&Globals.ZeroFlowCountEvent, Executive, KernelMode, FALSE, NULL); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "DriverUnload -- Calling FwpsInjectionHandleDestroy"); // FwpsInjectionHandleDestroy will _not_ return to the // caller until all pending injections are completed. // if (Globals.InjectionHandle != NULL) FwpsInjectionHandleDestroy(Globals.InjectionHandle); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "DriverUnload -- Now, uninitializing LW Queues"); for (nCount = 0; nCount < NUM_WORKITEM_QUEUES; ++nCount) { LwUninitializeQueue(&Globals.ProcessingQueues[nCount]); } if (Globals.LookasideCreated) ExDeleteLookasideListEx(&Globals.LookasideList); if (Globals.EngineHandle != NULL) StreamEditUnregisterCallout(); if (Globals.NetBufferListPool != NULL) NdisFreeNetBufferListPool(Globals.NetBufferListPool); if (Globals.NdisGenericObj != NULL) NdisFreeGenericObject(Globals.NdisGenericObj); if (Globals.StringToReplaceMdl != NULL) IoFreeMdl(Globals.StringToReplaceMdl); if (Globals.StringXMdl != NULL) IoFreeMdl(Globals.StringXMdl); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!"); WPP_CLEANUP(DriverObject); } VOID StreamEditInitConfig( _In_ const WDFDRIVER driver ) /* This function loads the default StreamEditor configuration values, then overrides any values specified in the registry. */ { NTSTATUS Status = STATUS_SUCCESS; DECLARE_CONST_UNICODE_STRING(stringToFindKey, L"StringToFind"); DECLARE_CONST_UNICODE_STRING(stringInMiddleKey, L"StringX"); DECLARE_CONST_UNICODE_STRING(stringToReplaceKey, L"StringToReplace"); DECLARE_CONST_UNICODE_STRING(inspectionLocalPortKey, L"InspectionLocalPort"); DECLARE_CONST_UNICODE_STRING(inspectionRemotePortKey, L"InspectionRemotePort"); DECLARE_CONST_UNICODE_STRING(multiCalloutKey, L"MultipleCallouts"); DECLARE_CONST_UNICODE_STRING(inspectionDirectionKey, L"InspectionDirection"); DECLARE_CONST_UNICODE_STRING(thresholdKey, L"BusyThreshold"); UNICODE_STRING stringValue; WCHAR buffer[STR_MAX_SIZE]; USHORT requiredSize; ULONG valueSize; ULONG ulongValue; WDFKEY hKey; // Initialize with default values. // String lengths will be initialized later (below). // Globals.InspectionLocalPort = CFG_LOCAL_PORT; Globals.InspectionRemotePort = 0; Globals.InspectionDirection = FWP_DIRECTION_MAX; // Inbound + outbound Globals.BusyThreshold = 0x4000; // == 16K; Globals.MultipleCallouts = TRUE; Globals.StringToFind[0] = Globals.StringX[0] = Globals.StringToReplace[0] = '\0'; Status = WdfDriverOpenParametersRegistryKey(driver, KEY_READ, WDF_NO_OBJECT_ATTRIBUTES, &hKey); if (NT_SUCCESS(Status)) { if (NT_SUCCESS(WdfRegistryQueryULong(hKey, &inspectionLocalPortKey, &ulongValue))) { Globals.InspectionLocalPort = (USHORT)ulongValue; } if (NT_SUCCESS(WdfRegistryQueryULong(hKey, &inspectionRemotePortKey, &ulongValue))) { Globals.InspectionRemotePort = (USHORT)ulongValue; } if (NT_SUCCESS(WdfRegistryQueryULong(hKey, &inspectionDirectionKey, &ulongValue))) { Globals.InspectionDirection = (UCHAR)ulongValue; NT_ASSERT((Globals.InspectionDirection >= 0 && Globals.InspectionDirection <= FWP_DIRECTION_MAX)); if (Globals.InspectionDirection > FWP_DIRECTION_MAX) Globals.InspectionDirection = FWP_DIRECTION_MAX; } if (NT_SUCCESS(WdfRegistryQueryULong(hKey, &multiCalloutKey, &ulongValue))) { Globals.MultipleCallouts = !(ulongValue == 0); } // Attempt to read StringToFind value from registry // stringValue.Buffer = buffer; stringValue.Length = 0; stringValue.MaximumLength = sizeof(buffer); Status = WdfRegistryQueryUnicodeString(hKey, &stringToFindKey, &requiredSize, &stringValue); if (NT_SUCCESS(Status)) { // stringValue is NULL terminated. // Translate Unicode string Status = RtlUnicodeToMultiByteN( Globals.StringToFind, sizeof(Globals.StringToFind), &valueSize, stringValue.Buffer, (ULONG)requiredSize); if (NT_SUCCESS(Status)) { valueSize -= sizeof(char); Globals.StringToFindLength = valueSize; NT_ASSERT(Globals.StringToFind[valueSize] == '\0'); } } stringValue.MaximumLength = sizeof(buffer); //Attempt to read StringX value from registry // Status = WdfRegistryQueryUnicodeString(hKey, &stringInMiddleKey, &requiredSize, &stringValue); if (NT_SUCCESS(Status)) { // Translate Unicode string Status = RtlUnicodeToMultiByteN( Globals.StringX, sizeof(Globals.StringX), &valueSize, stringValue.Buffer, (ULONG)requiredSize); if (NT_SUCCESS(Status)) { valueSize -= sizeof(char); // NULL terminator. Globals.StringXLength = valueSize; NT_ASSERT(Globals.StringX[valueSize] == '\0'); } } stringValue.MaximumLength = sizeof(buffer); // Attempt to read StringToReplace value from registry // Status = WdfRegistryQueryUnicodeString(hKey, &stringToReplaceKey, &requiredSize, &stringValue); if (NT_SUCCESS(Status)) { // Translate Unicode string Status = RtlUnicodeToMultiByteN( Globals.StringToReplace, sizeof(Globals.StringToReplace), &valueSize, stringValue.Buffer, (ULONG)requiredSize); if (NT_SUCCESS(Status)) { valueSize -= sizeof(char); Globals.StringToReplaceLength = valueSize; NT_ASSERT(Globals.StringToReplace[valueSize] == '\0'); } } if (NT_SUCCESS(WdfRegistryQueryULong(hKey, &thresholdKey, &ulongValue))) { Globals.BusyThreshold = (size_t)ulongValue << 10; NT_ASSERT(Globals.BusyThreshold != 0); } WdfRegistryClose(hKey); } else { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "WdfDriverOpenParametersRegistryKey failed with %!STATUS!", Status); } // Calculate the length of tokens to be found/replaced. // if (Globals.StringToFindLength == 0) { NT_ASSERT(Globals.StringToFind[0] == 0); RtlStringCchCopyA(Globals.StringToFind, STR_MAX_SIZE, "rainy"); Status = RtlStringCchLengthA(Globals.StringToFind, STR_MAX_SIZE, &Globals.StringToFindLength); //Handle Error. NT_ASSERT(NT_SUCCESS(Status)); } if (Globals.StringXLength == 0) { NT_ASSERT(Globals.StringX[0] == 0); RtlStringCchCopyA(Globals.StringX, STR_MAX_SIZE, "cloudy"); Status = RtlStringCchLengthA(Globals.StringX, STR_MAX_SIZE, &Globals.StringXLength); //Handle Error. NT_ASSERT(NT_SUCCESS(Status)); } if (Globals.StringToReplaceLength == 0) { NT_ASSERT(Globals.StringToReplace[0] == 0); RtlStringCchCopyA(Globals.StringToReplace, STR_MAX_SIZE, "sunny"); Status = RtlStringCchLengthA(Globals.StringToReplace, STR_MAX_SIZE, &Globals.StringToReplaceLength); //Handle Error. NT_ASSERT(NT_SUCCESS(Status)); } NT_ASSERT(Globals.StringToFindLength != 0); NT_ASSERT(Globals.StringXLength != 0); NT_ASSERT(Globals.StringToReplaceLength != 0); // In this sample, we want to make sure that at least one port (either local or remote) is non-zero. // if ((Globals.InspectionLocalPort == 0) && (Globals.InspectionRemotePort == 0)) { Globals.InspectionLocalPort = CFG_LOCAL_PORT; } DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL,"StreamEdit Configuration\r" "\tStringToFind: %s\r\tStringToReplace: %s\r\tStringX: %s\r" "\tInspectionLocalPort: %hu\r\tInspectionRemotePort: %hu\r" "\tInspectionDirection: %!FWP_DIRECTION!\r\tBusyThreshold: 0x%IX\r\tMultiple Callouts: %!bool!", Globals.StringToFind, Globals.StringToReplace, Globals.StringX, Globals.InspectionLocalPort, Globals.InspectionRemotePort, Globals.InspectionDirection, Globals.BusyThreshold, Globals.MultipleCallouts ); } NTSTATUS StreamEditInitDriverObjects( _Inout_ DRIVER_OBJECT* driverObject, _In_ const UNICODE_STRING* registryPath, _Out_ WDFDRIVER* pDriver, _Out_ WDFDEVICE* pDevice ) { NTSTATUS Status; WDF_DRIVER_CONFIG config; PWDFDEVICE_INIT pInit = NULL; WDF_DRIVER_CONFIG_INIT(&config, WDF_NO_EVENT_CALLBACK); config.DriverInitFlags |= WdfDriverInitNonPnpDriver; config.EvtDriverUnload = StreamEditEvtDriverUnload; Status = WdfDriverCreate( driverObject, registryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, pDriver ); if (NT_SUCCESS(Status)) { Status = STATUS_INSUFFICIENT_RESOURCES; pInit = WdfControlDeviceInitAllocate(*pDriver, &SDDL_DEVOBJ_KERNEL_ONLY); if (pInit) { WdfDeviceInitSetCharacteristics(pInit, FILE_AUTOGENERATED_DEVICE_NAME, TRUE); //WdfDeviceInitSetDeviceType(pInit, FILE_DEVICE_NETWORK); WdfDeviceInitSetDeviceClass(pInit, &WFP_DRIVER_CLASS_GUID); WdfDeviceInitSetCharacteristics(pInit, FILE_DEVICE_SECURE_OPEN, TRUE); Status = WdfDeviceCreate(&pInit, WDF_NO_OBJECT_ATTRIBUTES, pDevice); if (NT_SUCCESS(Status)) { WdfControlFinishInitializing(*pDevice); } } } if (!NT_SUCCESS(Status)) { if ( pInit) WdfDeviceInitFree(pInit); } return Status; } NTSTATUS DriverEntry( _In_ DRIVER_OBJECT* DriverObject, _In_ UNICODE_STRING* RegistryPath ) { NTSTATUS Status; WDFDEVICE WdfDevice; WDFDRIVER WdfDriver; NET_BUFFER_LIST_POOL_PARAMETERS nblPoolParams = {0}; WPP_INIT_TRACING(DriverObject, RegistryPath); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT,"--> %!FUNC!: DrvObj %p, Regpath %wZ", DriverObject, RegistryPath); do { // Request NX Non-Paged Pool when available ExInitializeDriverRuntime(DrvRtPoolNxOptIn); // // Initialize globals and Configuration structures. // RtlZeroMemory(&Globals, sizeof(Globals)); Globals.QueueIndex = (ULONG)-1; InitializeListHead(&Globals.FlowContextList); KeInitializeSpinLock(&Globals.FlowContextListLock); // Initialize DriverUnload/Shutdown Event (to a signalled state) // KeInitializeEvent(&Globals.ZeroFlowCountEvent, NotificationEvent, TRUE); Status = StreamEditInitDriverObjects( DriverObject, RegistryPath, &WdfDriver, &WdfDevice); if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "StreamEditInitDriverObjects failed with 0x%X", Status); break; } Globals.WdmDevice = WdfDeviceWdmGetDeviceObject(WdfDevice); // Initialize and read driver configuration overrides. // StreamEditInitConfig(WdfDriver); Globals.StringToReplaceMdl = IoAllocateMdl( Globals.StringToReplace, (ULONG)Globals.StringToReplaceLength, FALSE, FALSE, NULL); if (Globals.StringToReplaceMdl == NULL) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Unable to allocate StringToReplace Mdl"); Status = STATUS_INSUFFICIENT_RESOURCES; break; } MmBuildMdlForNonPagedPool(Globals.StringToReplaceMdl); Globals.StringXMdl = IoAllocateMdl( Globals.StringX, (ULONG)Globals.StringXLength, FALSE, FALSE, NULL); if (Globals.StringXMdl == NULL) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Unable to allocate Mdl#2"); Status = STATUS_INSUFFICIENT_RESOURCES; break; } MmBuildMdlForNonPagedPool(Globals.StringXMdl); Globals.NdisGenericObj = NdisAllocateGenericObject(DriverObject, STMEDIT_TAG_NDIS_OBJ, 0); if (Globals.NdisGenericObj == NULL) { DoTraceLevelMessage(TRACE_LEVEL_ERROR, CO_GENERAL, "NdisAllocateGenericObject failed."); Status = STATUS_INSUFFICIENT_RESOURCES; break; } // // Allocate a NDIS/NBL Pool nblPoolParams.Header.Type = NDIS_OBJECT_TYPE_DEFAULT; nblPoolParams.Header.Revision = NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1; nblPoolParams.Header.Size = NDIS_SIZEOF_NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1; nblPoolParams.fAllocateNetBuffer = TRUE; nblPoolParams.DataSize = 0; nblPoolParams.PoolTag = STMEDIT_TAG_NBL_POOL; Globals.NetBufferListPool = NdisAllocateNetBufferListPool( Globals.NdisGenericObj, &nblPoolParams); if (Globals.NetBufferListPool == NULL) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "NdisAllocateNetBufferListPool failed."); Status = STATUS_INSUFFICIENT_RESOURCES; break; } Status = ExInitializeLookasideListEx( &Globals.LookasideList, NULL, NULL, NonPagedPool, // POOL_NX_OPTIN_AUTO ==> NonPagedPool := NonPagedPoolNx 0, max(sizeof(TASK_ENTRY), sizeof(OUTGOING_STREAM_DATA)), STMEDIT_TAG_TASK_ENTRY, 0); if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "Task LookasideList Creation failed with %!STATUS!", Status); break; } Globals.LookasideCreated = TRUE; Status = StreamEditInitializeWorkitemPool(); if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "InitializeWorkerPool failed with %!STATUS!", Status); break; } // Create WFP Injection handle // Status = FwpsInjectionHandleCreate(AF_UNSPEC, FWPS_INJECTION_TYPE_STREAM, &Globals.InjectionHandle); if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FwpsInjectionHandleCreate failed with %!STATUS!", Status); break; } // // Finally, register the sublayer(s) and callouts with WFP // Status = StreamEditRegisterCallouts(Globals.WdmDevice); if (!NT_SUCCESS(Status)) { DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "StreamEditRegisterCallouts failed with %!STATUS!", Status); break; } } while (FALSE); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!, %!STATUS!", Status); if (!NT_SUCCESS(Status)) { StreamEditEvtDriverUnload(WdfDriver); } return Status; } BOOLEAN StreamEditCopyDataForInspection( _In_ STREAM_FLOW_CONTEXT *FlowContext, _In_ const FWPS_STREAM_DATA* StreamData, _In_ SIZE_T BytesToCopy ) /* This function copies stream data described by the FWPS_STREAM_DATA structure into a flat buffer. Return : TRUE if able to copy stream-data to a flat buffer successfully, FALSE otherwise. */ { SIZE_T BytesCopied; size_t ExistingDataLength = FlowContext->ScratchDataLength; NT_ASSERT(BytesToCopy > 0); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "--> %!FUNC!: FlowCtx %p, streamData %p, copy %Iu of %Iu, old ScratchLength %Iu", FlowContext, StreamData, BytesToCopy, StreamData->dataLength, ExistingDataLength); NT_ASSERT(FlowContext->ScratchDataOffset == 0); // If the existing scratch buffer is not sufficient to accommodate the new data // try to allocate a bigger buffer (so that we don't have to keep allocating // these for some time. // if (FlowContext->ScratchBufferSize - ExistingDataLength < BytesToCopy) { size_t NewBufferSize = BytesToCopy + ExistingDataLength; PVOID NewBuffer = ExAllocatePool2( POOL_FLAG_NON_PAGED, (NewBufferSize + (NewBufferSize >> 1) ), // 1.5 times the needed size. STMEDIT_TAG_FLAT_BUFFER); if (NewBuffer == NULL) { // We are not able to allocate a much bigger buffer ... lets try an exact fit. // NewBuffer = ExAllocatePool2(POOL_FLAG_NON_PAGED, NewBufferSize, STMEDIT_TAG_FLAT_BUFFER); } if (NewBuffer != NULL) { // Move the existing contents of scratch buffer over to newly allocated buffer // if (ExistingDataLength > 0) { NT_ASSERT(FlowContext->ScratchBuffer != NULL); RtlCopyMemory(NewBuffer, FlowContext->ScratchBuffer, ExistingDataLength); } } // Free the old scratch buffer... // if (FlowContext->ScratchBuffer) { ExFreePoolWithTag(FlowContext->ScratchBuffer, STMEDIT_TAG_FLAT_BUFFER); FlowContext->ScratchBuffer = NULL; FlowContext->ScratchBufferSize = 0; FlowContext->ScratchDataLength = 0; } if (NewBuffer) { FlowContext->ScratchBuffer = NewBuffer; FlowContext->ScratchBufferSize = NewBufferSize; FlowContext->ScratchDataLength = ExistingDataLength; } else { DoTraceLevelMessage(TRACE_LEVEL_ERROR, CO_ENTER_EXIT, "<-- %!FUNC!: FlowCtx %p, Failed to allocate flat buffer for NBL %p", FlowContext, StreamData->netBufferListChain); return FALSE; } } // Append the NBL chain data on to (any) existing data in scratch buffer // FwpsCopyStreamDataToBuffer( StreamData, (BYTE*)FlowContext->ScratchBuffer + FlowContext->ScratchDataLength, BytesToCopy, &BytesCopied ); DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_GENERAL, "FlowCtx %p, FwpsCopyStreamDataToBuffer flattened %Iu of %Iu bytes", FlowContext, BytesCopied, StreamData->dataLength); NT_ASSERT(BytesCopied == BytesToCopy); FlowContext->ScratchDataLength += BytesCopied; DoTraceLevelMessage(TRACE_LEVEL_INFORMATION, CO_ENTER_EXIT, "<-- %!FUNC!: FlowCtx %p, new ScratchLength %Iu, return TRUE", FlowContext, FlowContext->ScratchDataLength); return TRUE; }