IP Header in FWPM_LAYER_INBOUND_IPPACKET_V4

•  

• 2

  Sign in to vote

  Hi,

  this problem I have seems to be closely related to another mine here:
  http://social.msdn.microsoft.com/Forums/en-US/wfp/thread/65c34860-6d8d-4475-9b9b-b06541158875

  Anyway, I have a callout registered in the INBOUND_IPPACKET layer and I'd like to access to the IP Header.

  I'm able to access to the TCP Header just reading from the current pointer:
  ----------------------------

  tcp_header = (TCP_HEADER*)NdisGetDataBuffer(
  	nb,
  	sizeof(TCP_HEADER),
  	NULL,
  	sizeof(UINT16),
  	0);

  ----------------------------
  but trying to read the ip header with this code:
  ----------------------------

  status2 = NdisRetreatNetBufferDataStart(
  	nb,
  	inMetaValues->ipHeaderSize,
  	0,
  	NULL);
  
  if (status2 != NDIS_STATUS_SUCCESS)
  {
  	...; goto Exit;
  }
  
  ip_header = (IP_HEADER*)NdisGetDataBuffer(
  	nb,
  	sizeof(IP_HEADER),
  	NULL,
  	sizeof(UINT16),
  	0);
  
  if (ip_header == NULL)
  {
  	...; goto Exit;
  }

  ----------------------------
  I found dirty data in the IP_HEADER structure...

  I'm sure there is something wrong but I totally don't understand or imagine where!!
  Anyone have an idea?

  Thanks,
  Marco

  Wednesday, August 4, 2010 7:09 PM

   

  Marco Mura

   

  2,280 Points

   

Answers

• 1

  Sign in to vote

  Found it!

  My mistake was retreating the cloned buffer... and the buffer was cloned from the pointer after the IP header. So I was reading dirty stuff because I was already at the beginning of the cloned buffer.

  So, for the records, the correct way is to call NdisRetreatNetBufferListDataStart to (NET_BUFFER_LIST*)layerData and not to nb !

  For the records:
  ----------------------------

  status2 = NdisRetreatNetBufferListDataStart(
  	(NET_BUFFER_LIST*)layerData,
  	inMetaValues->ipHeaderSize,
  	0,
  	NULL,
  	NULL);
  
  if (status2 != NDIS_STATUS_SUCCESS)
  {
  	...; goto Exit;
  }
  
  status = FwpsAllocateCloneNetBufferList0(
  	(NET_BUFFER_LIST*)layerData,
  	NULL,
  	NULL,
  	0,
  	&nbl);
  
  if (!NT_SUCCESS(status))
  {
  	...; goto Exit;
  }
  
  nb = NET_BUFFER_LIST_FIRST_NB(nbl);
  
  ip_header = (IP_HEADER*)NdisGetDataBuffer(
  	nb,
  	sizeof(IP_HEADER),
  	NULL,
  	sizeof(UINT16),
  	0);
  
  if (ip_header == NULL)
  {
  	...; goto Exit;
  }
  
  protocol = ip_header->Protocol;
  ...;
  
  NdisAdvanceNetBufferListDataStart(
  	(NET_BUFFER_LIST*)layerData,
  	inMetaValues->ipHeaderSize,
  	FALSE,
  	NULL);

  ----------------------------

  Thanks,
  Marco