/*++ Copyright (c) 1995 Microsoft Corporation Module Name: Abstract: Revision History: Amritansh Raghav --*/ #include #include #include #include #include #include #include #include #include #include #include #include #include //#include #include #include "defs.h" #include #include #include "ipfltdrv.h" //#include "filter.h" #include #include #include #include #include #include #include #define is == #define isnot != #define and && #define or || DWORD InitializeFilter(); VOID DoAddInterface(); VOID DoSetFilters(); VOID DoFilterPacket(); VOID DoGetInfo(); VOID DoDeleteInterface(); VOID DoStopFilter(); VOID DoAddRoute(); VOID DoAddForwarderIf(); DWORD GetIpStatsFromStack(IPSNMPInfo *IPSnmpInfo); DWORD GetIpAddrTableFromStack(IPAddrEntry *lpipaeTable, LPDWORD lpdwNumEntries); VOID CloseHandles(); typedef struct _USER_IF { LIST_ENTRY ifLink; PVOID pvIfContext; CHAR pszName[80]; }USER_IF, *PUSER_IF; LIST_ENTRY g_ifList; HANDLE g_FilterDriverHandle; HANDLE g_IpDriverHandle; HANDLE g_TcpDriverHandle; INT _cdecl main() { NTSTATUS ntStatus; WORD wVersion = MAKEWORD(1,1); WSADATA wsaData; if(WSAStartup(wVersion,&wsaData) isnot NO_ERROR) { printf("WSAStartup failed\n"); return(1); } ntStatus = InitializeFilter(); if(ntStatus isnot STATUS_SUCCESS) { printf("Couldnt init filter - error %x\n",ntStatus); exit(1); } InitializeListHead(&g_ifList); while(TRUE) { CHAR cInput[10]; printf("\n----- USER MODE IP FILTER DRIVER TEST -----\n"); printf("1.\tAdd Interface\n"); printf("2.\tSet Filters\n"); printf("3.\tFilter Packet\n"); printf("4.\tGet Info\n"); printf("5.\tDelete Interface\n"); printf("6.\tStop Filter\n"); printf("7.\tAdd Route to Forwarder\n"); printf("8.\tAdd Interface to Forwarder\n"); printf("99.\tQuit\n"); printf("Selection:\t"); gets(cInput); printf("\n"); switch(atoi(cInput)) { case 1: { DoAddInterface(); break; } case 2: { DoSetFilters(); break; } case 3: { DoFilterPacket(); break; } case 4: { DoGetInfo(); break; } case 5: { DoDeleteInterface(); break; } case 6: { DoStopFilter(); break; } case 7: { DoAddRoute(); break; } case 8: { DoAddForwarderIf(); break; } case 99: { DoStopFilter(); WSACleanup(); return(0); } default: { continue; } } } return(0); } VOID DoAddInterface() { NTSTATUS ntStatus; IO_STATUS_BLOCK IoStatusBlock; CHAR cName[70]; FILTER_DRIVER_CREATE_INTERFACE inBuffer; DWORD dwInBufLen = sizeof(FILTER_DRIVER_CREATE_INTERFACE); PUSER_IF pIf; if((pIf = HeapAlloc(GetProcessHeap(),0,sizeof(USER_IF))) is NULL) { printf("Couldnt allocate memory\n"); } printf("Enter new interface name: "); gets(pIf->pszName); printf("\n"); InitializeListHead(&pIf->ifLink); inBuffer.dwIfIndex = 0; inBuffer.pvRtrMgrContext = NULL; ntStatus = NtDeviceIoControlFile(g_FilterDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_CREATE_INTERFACE, (PVOID)&inBuffer, dwInBufLen, (PVOID)&inBuffer, dwInBufLen); if (!NT_SUCCESS(ntStatus)) { printf("IOCTL failed - status %x \n", ntStatus); HeapFree(GetProcessHeap(),0,pIf); return; } printf("Added interface, context %x\n",(UINT_PTR)inBuffer.pvDriverContext); pIf->pvIfContext = inBuffer.pvDriverContext; InsertHeadList(&g_ifList,&(pIf->ifLink)); return; } VOID DoSetFilters() { NTSTATUS ntStatus; IO_STATUS_BLOCK IoStatusBlock; PFILTER_INFO pInfo; PFILTER_DRIVER_SET_FILTERS pIo; DWORD i,dwNumInFilters = 0,dwNumOutFilters = 0,dwInBufLen; PLIST_ENTRY currentList; BYTE cAddr[50]; PUSER_IF pIf; BOOL bSetInput,bSetOutput,bDelInput,bDelOutput; FORWARD_ACTION faOutAction,faInAction; DWORD dwInIndex,dwOutIndex; currentList = g_ifList.Flink; i = 1; printf("\nCurrent Interfaces\n"); while(currentList isnot &g_ifList) { pIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); printf("\t%d. %s\n",i++,pIf->pszName); currentList = currentList->Flink; } printf("Input Interface index: "); gets(cAddr); printf("\n"); currentList = g_ifList.Flink; i = 1; pIf = NULL; while(currentList isnot &g_ifList) { if(i is (DWORD)atoi(cAddr)) { pIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); break; } i++; currentList = currentList->Flink; } if(pIf is NULL) { printf("Couldnt find interface block\n"); return; } printf("Setting filters for %s with context %#08x\n",pIf->pszName, (UINT_PTR)pIf->pvIfContext); dwInBufLen = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY); printf("Do you want to modify input filters? (0/1): "); gets(cAddr); printf("\n"); if(atoi(cAddr) is 1) { dwInBufLen += sizeof(RTR_TOC_ENTRY); bSetInput = TRUE; } else { bSetInput = FALSE; } printf("Do you want to modify output filters? (0/1): "); gets(cAddr); printf("\n"); if(atoi(cAddr) is 1) { dwInBufLen += sizeof(RTR_TOC_ENTRY); bSetOutput = TRUE; } else { bSetOutput = FALSE; } if(bSetInput) { printf("Do you want to delete all in filters?(0/1): "); gets(cAddr); printf("\n"); if(atoi(cAddr) is 0) { printf("How many input filters (0 will remove filters but allow a default action)?: "); gets(cAddr); printf("\n"); dwNumInFilters = atoi(cAddr); printf("Default in action (0 - FORWARD, 1 - DROP): "); gets(cAddr); printf("\n"); faInAction = (FORWARD_ACTION)atoi(cAddr); dwInBufLen += sizeof(FILTER_DESCRIPTOR) - sizeof(FILTER_INFO); bDelInput = FALSE; } else { bDelInput = TRUE; } } if(bSetOutput) { printf("Do you want to delete all out filters?(0/1): "); gets(cAddr); printf("\n"); if(atoi(cAddr) is 0) { printf("How many out filters (0 will remove filters but allow a default action)?: "); gets(cAddr); printf("\n"); dwNumInFilters = atoi(cAddr); printf("Default in action (0 - FORWARD, 1 - DROP): "); gets(cAddr); printf("\n"); faOutAction = (FORWARD_ACTION)atoi(cAddr); dwInBufLen += sizeof(FILTER_DESCRIPTOR) - sizeof(FILTER_INFO); bDelOutput = FALSE; } else { bDelOutput = TRUE; } } if(!(bSetInput or bSetOutput) ) { return; } dwInBufLen += ((dwNumInFilters + dwNumOutFilters -1) * sizeof(FILTER_INFO)); pIo = HeapAlloc(GetProcessHeap(),0,dwInBufLen); if(pIo is NULL) { printf("Couldnt allocate memory\n"); return; } pIo->pvDriverContext = (PVOID)pIf; dwInIndex = 0; dwOutIndex = 1; if(!bSetInput) { dwOutIndex = 0; } pIo->ribhInfoBlock.Version = IP_FILTER_DRIVER_VERSION; pIo->ribhInfoBlock.Size = dwInBufLen - FIELD_OFFSET(FILTER_DRIVER_SET_FILTERS, ribhInfoBlock); pIo->ribhInfoBlock.TocEntriesCount = 0; if(bSetInput) { pIo->ribhInfoBlock.TocEntry[dwInIndex].InfoType = IP_FILTER_DRIVER_IN_FILTER_INFO; if(bDelInput) { pIo->ribhInfoBlock.TocEntry[dwInIndex].InfoSize = 0; pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset = 0; pIo->ribhInfoBlock.TocEntry[dwInIndex].Count = 0; } else { pIo->ribhInfoBlock.TocEntry[dwInIndex].InfoSize = sizeof(FILTER_DESCRIPTOR) - sizeof(FILTER_INFO) + (dwNumInFilters * sizeof(FILTER_INFO)); if(bSetOutput) { pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset = (ULONG) (((PBYTE)&pIo->ribhInfoBlock.TocEntry[2] - (PBYTE)&pIo->ribhInfoBlock)); } else { pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset = (ULONG) (((PBYTE)&pIo->ribhInfoBlock.TocEntry[1] - (PBYTE)&pIo->ribhInfoBlock)); } pIo->ribhInfoBlock.TocEntry[dwInIndex].Count = 1; } } if(bSetOutput) { pIo->ribhInfoBlock.TocEntry[dwOutIndex].InfoType = IP_FILTER_DRIVER_OUT_FILTER_INFO; if(bDelOutput) { pIo->ribhInfoBlock.TocEntry[dwOutIndex].InfoSize = 0; pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset = 0; pIo->ribhInfoBlock.TocEntry[dwOutIndex].Count = 0; } else { pIo->ribhInfoBlock.TocEntry[dwOutIndex].InfoSize = sizeof(FILTER_DESCRIPTOR) - sizeof(FILTER_INFO) + (dwNumOutFilters * sizeof(FILTER_INFO)); if(bSetInput) { pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset = (ULONG) (((PBYTE)&pIo->ribhInfoBlock.TocEntry[2] + pIo->ribhInfoBlock.TocEntry[1].InfoSize - (PBYTE)&pIo->ribhInfoBlock)); } else { pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset = (ULONG) (((PBYTE)&pIo->ribhInfoBlock.TocEntry[1] - (PBYTE)&pIo->ribhInfoBlock)); } pIo->ribhInfoBlock.TocEntry[dwOutIndex].Count = 1; } } if(bSetInput and !bDelInput) { pInfo = ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset))->fiFilter; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset))->dwVersion = IP_FILTER_DRIVER_VERSION; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset))->dwNumFilters = dwNumInFilters; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwInIndex].Offset))->faDefaultAction = faInAction; printf("Input Filters - addresses and mask in dotted decimal\n"); for(i = 0; i < dwNumInFilters; i++) { printf("Enter source addr: "); gets(cAddr); printf("\n"); pInfo[i].dwSrcAddr = inet_addr(cAddr); printf("Enter source mask: "); gets(cAddr); printf("\n"); pInfo[i].dwSrcMask = inet_addr(cAddr); printf("Enter dest addr: "); gets(cAddr); printf("\n"); pInfo[i].dwDstAddr = inet_addr(cAddr); printf("Enter dest mask: "); gets(cAddr); printf("\n"); pInfo[i].dwDstMask = inet_addr(cAddr); printf("Enter protocol id - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].dwProtocol = atoi(cAddr); pInfo[i].wSrcPort = pInfo[i].wDstPort = 0x00000000; switch(pInfo[i].dwProtocol) { case 1: { printf("Enter type - 255 for any"); gets(cAddr); printf("\n"); pInfo[i].wSrcPort = (BYTE)atoi(cAddr); printf("Enter code - 255 for any"); gets(cAddr); printf("\n"); pInfo[i].wDstPort = (BYTE)atoi(cAddr); break; } case 6: case 17: { printf("Enter source port - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].wSrcPort = htons((WORD)atoi(cAddr)); printf("Enter Dst Port - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].wDstPort = htons((WORD)atoi(cAddr)); break; } } } } if(bSetOutput and !bDelOutput) { pInfo = ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset))->fiFilter; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset))->dwVersion = IP_FILTER_DRIVER_VERSION; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset))->dwNumFilters = dwNumOutFilters; ((PFILTER_DESCRIPTOR)((PBYTE)&pIo->ribhInfoBlock + pIo->ribhInfoBlock.TocEntry[dwOutIndex].Offset))->faDefaultAction = faOutAction; printf("Output Filters - addresses and mask in dotted decimal\n"); for(i = 0; i < dwNumOutFilters; i++) { printf("Enter source addr: "); gets(cAddr); printf("\n"); pInfo[i].dwSrcAddr = inet_addr(cAddr); printf("Enter source mask: "); gets(cAddr); printf("\n"); pInfo[i].dwSrcMask = inet_addr(cAddr); printf("Enter dest addr: "); gets(cAddr); printf("\n"); pInfo[i].dwDstAddr = inet_addr(cAddr); printf("Enter dest mask: "); gets(cAddr); printf("\n"); pInfo[i].dwDstMask = inet_addr(cAddr); printf("Enter protocol id - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].dwProtocol = atoi(cAddr); pInfo[i].wSrcPort = pInfo[i].wDstPort = 0x00000000; switch(pInfo[i].dwProtocol) { case 1: { printf("Enter type - 255 for any"); gets(cAddr); printf("\n"); pInfo[i].wSrcPort = (BYTE)atoi(cAddr); printf("Enter code - 255 for any"); gets(cAddr); printf("\n"); pInfo[i].wDstPort = (BYTE)atoi(cAddr); break; } case 6: case 17: { printf("Enter source port - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].wSrcPort = htons((WORD)atoi(cAddr)); printf("Enter Dst Port - 0 for any: "); gets(cAddr); printf("\n"); pInfo[i].wDstPort = htons((WORD)atoi(cAddr)); } } } } ntStatus = NtDeviceIoControlFile(g_FilterDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_SET_INTERFACE_FILTERS, (PVOID)pIo, dwInBufLen, NULL, 0); if (!NT_SUCCESS(ntStatus)) { printf("IOCTL failed - status %x \n", ntStatus); } printf("Filters set\n"); HeapFree(GetProcessHeap(),0,pIo); return; } VOID DoFilterPacket() { NTSTATUS ntStatus; IO_STATUS_BLOCK IoStatusBlock; DWORD i,dwInBufLen; BYTE cAddr[40]; PFILTER_DRIVER_TEST_PACKET pTest; IPHeader *pIph; PWORD pwPort; PLIST_ENTRY currentList; PUSER_IF pInIf = NULL, pOutIf = NULL, pIf; dwInBufLen = sizeof(FILTER_DRIVER_TEST_PACKET) + sizeof(IPHeader) + 2*sizeof(DWORD); pTest = HeapAlloc(GetProcessHeap(),0,dwInBufLen); if(pTest is NULL) { printf("Couldnt allocate memory for the packet\n"); return; } pIph = (IPHeader*)(pTest->bIpPacket); pwPort = (PWORD)((PBYTE)pIph + sizeof(IPHeader)); currentList = g_ifList.Flink; i=1; printf("\nCurrent Interfaces\n"); while(currentList isnot &g_ifList) { pIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); printf("\t%d. %s\n",i++,pIf->pszName); currentList = currentList->Flink; } printf("Index of input Interface : "); gets(cAddr); printf("\n"); if(strlen(cAddr) isnot 0) { DWORD dwInIf = atoi(cAddr); currentList = g_ifList.Flink; i = 1; while(currentList isnot &g_ifList) { if(i is dwInIf) { pInIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); break; } i++; currentList = currentList->Flink; } } printf("Index of output Interface : "); gets(cAddr); printf("\n"); if(strlen(cAddr) isnot 0) { DWORD dwOutIf = atoi(cAddr); currentList = g_ifList.Flink; i = 1; while(currentList isnot &g_ifList) { if(i is dwOutIf) { pOutIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); break; } i++; currentList = currentList->Flink; } } printf("Input if is %s and output if is %s\n", (pInIf is NULL)? "NULL":pInIf->pszName, (pOutIf is NULL)?"NULL":pOutIf->pszName); pTest->pvInInterfaceContext = (pInIf is NULL)?NULL:pInIf->pvIfContext; pTest->pvOutInterfaceContext = (pOutIf is NULL)?NULL:pOutIf->pvIfContext; printf("Enter packet header\n\n"); printf("Enter source addr: "); gets(cAddr); printf("\n"); pIph->iph_src = (IPAddr)inet_addr(cAddr); printf("Enter dest addr: "); gets(cAddr); printf("\n"); pIph->iph_dest = (IPAddr)inet_addr(cAddr); printf("Enter Protocol id - 0 for any: "); gets(cAddr); printf("\n"); pIph->iph_protocol = (UCHAR)LOBYTE(atoi(cAddr)); printf("Is this a fragment? (1 - yes 0 - no): "); gets(cAddr); printf("\n"); if(atoi(cAddr) is 0) { printf("Enter source port - 0 for any: "); gets(cAddr); printf("\n"); pwPort[0] = htons((WORD)atoi(cAddr)); printf("Enter Dst Port - 0 for any: "); gets(cAddr); printf("\n"); pwPort[1] = htons((WORD)atoi(cAddr)); pIph->iph_offset = 0x0000; // no flags , no fragment } else { // Lets give it a frag offset of 100 - 64h pIph->iph_offset = 0x6400; } // // Fill up the rest of the packet with some meaningful info // pIph->iph_verlen = '\x45'; //Version = 4 Hdr Len = 5*4bytes pIph->iph_tos = '\x0f'; //TOS signature for mem dumps pIph->iph_length = htons((WORD)(sizeof(IPHeader)+2*sizeof(DWORD))); //Length in bytes pIph->iph_id = 0xcdab; //ID another signature pIph->iph_ttl = 0xef; // TTL pIph->iph_xsum = 0xcdab; //Checksum; ntStatus = NtDeviceIoControlFile(g_FilterDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_TEST_PACKET, (PVOID)pTest, dwInBufLen, (PVOID)pTest, dwInBufLen); if (!NT_SUCCESS(ntStatus)) { printf("IOCTL failed - status %x \n", ntStatus); return; } if(pTest->eaResult is DROP) { printf("Packet rejected\n"); } else { printf("Packet accepted\n"); } HeapFree(GetProcessHeap(),0,pTest); return; } VOID DoDeleteInterface() { } VOID DoStopFilter() { CloseHandles(); } VOID DoGetInfo() { } VOID DoAddRoute() { TDIObjectID *lpObject; IPRouteEntry *lpentry; NTSTATUS ntStatus; IO_STATUS_BLOCK IoStatusBlock; CHAR szIPAddr[20]; DWORD dwInBufLen; TCP_REQUEST_SET_INFORMATION_EX *lptrsiBuffer; BYTE buffer[sizeof(TCP_REQUEST_SET_INFORMATION_EX) + sizeof(IPRouteEntry)]; lptrsiBuffer = (TCP_REQUEST_SET_INFORMATION_EX *)buffer; lptrsiBuffer->BufferSize = sizeof(IPRouteEntry); lpObject = &lptrsiBuffer->ID; lpObject->toi_id = IP_MIB_RTTABLE_ENTRY_ID; lpObject->toi_type = INFO_TYPE_PROVIDER; lpObject->toi_class = INFO_CLASS_PROTOCOL; lpObject->toi_entity.tei_entity = CL_NL_ENTITY; lpObject->toi_entity.tei_instance = 0; lpentry = (IPRouteEntry *)lptrsiBuffer->Buffer; dwInBufLen = sizeof(TCP_REQUEST_SET_INFORMATION_EX) + sizeof(IPRouteEntry) - 1; printf("Enter Address (Dotted Decimal Form): "); gets(szIPAddr); printf("\n"); lpentry->ire_dest = inet_addr(szIPAddr); printf("Enter IF (numerical):"); gets(szIPAddr); printf("\n"); lpentry->ire_index = atoi(szIPAddr); printf("Enter Next Hop (Dotted Decimal Form): "); gets(szIPAddr); printf("\n"); lpentry->ire_nexthop = inet_addr(szIPAddr); printf("Enter Mask (Dotted Decimal Form): "); gets(szIPAddr); printf("\n"); lpentry->ire_mask = inet_addr(szIPAddr); printf("Enter Metric 1: "); gets(szIPAddr); printf("\n"); lpentry->ire_metric1 = atoi(szIPAddr); lpentry->ire_metric2 = lpentry->ire_metric3 = lpentry->ire_metric4 = lpentry->ire_metric5 = IRE_METRIC_UNUSED; lpentry->ire_age = 0; printf("Enter type 2 - invalid 3 - direct 4 - indirect: "); gets(szIPAddr); printf("\n"); lpentry->ire_type = atoi(szIPAddr); lpentry->ire_proto = IRE_PROTO_LOCAL; ntStatus = NtDeviceIoControlFile(g_TcpDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_TCP_SET_INFORMATION_EX, (PVOID)lptrsiBuffer, dwInBufLen, NULL, 0); if(ntStatus is STATUS_PENDING) { ntStatus = NtWaitForSingleObject(g_TcpDriverHandle, FALSE, NULL ); ntStatus = IoStatusBlock.Status; } if (!NT_SUCCESS(ntStatus)) { printf("IOCTL failed to get set route - error %x\n",ntStatus); } } VOID DoAddForwarderIf() { NTSTATUS ntStatus; IO_STATUS_BLOCK IoStatusBlock; DWORD dwResult; DWORD dwSpace,dwId,dwIf,i; IPSNMPInfo ipsiInfo; IPAddrEntry *pAddrTable; PLIST_ENTRY currentList; PUSER_IF pIf; IP_SET_IF_CONTEXT_INFO info; CHAR cAddr1[20],cAddr2[20]; dwResult = GetIpStatsFromStack(&ipsiInfo); if(dwResult isnot NO_ERROR) { printf("Couldnt get Ip Snmp info from stack for num addr error %x\n",dwResult); return; } dwSpace = ipsiInfo.ipsi_numaddr + 10; pAddrTable = HeapAlloc(GetProcessHeap(),0,dwSpace * sizeof(IPAddrEntry)); if(pAddrTable is NULL) { printf("Couldnt allocate space for ipAddr table\n"); return; } dwResult = GetIpAddrTableFromStack(pAddrTable,&dwSpace); if(dwResult isnot NO_ERROR) { printf("Couldnt get addr table from stack %x\n",dwResult); HeapFree(GetProcessHeap(),0,pAddrTable); return; } printf("\nForwarder Interfaces\n"); printf("Index\tAddress\t\tMask\n"); for(i = 0; i < dwSpace; i++) { struct in_addr addr; addr.s_addr = pAddrTable[i].iae_addr; strcpy(cAddr1,inet_ntoa(addr)); addr.s_addr = pAddrTable[i].iae_mask; strcpy(cAddr2,inet_ntoa(addr)); printf("%d.\t%s\t\t%s\n",pAddrTable[i].iae_index,cAddr1,cAddr2); } printf("\nFilter Interfaces\n"); currentList = g_ifList.Flink; i = 1; while(currentList isnot &g_ifList) { pIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); printf("\t%d. %s\n",i++,pIf->pszName); currentList = currentList->Flink; } while(TRUE) { printf("Enter Forwarder index (99 to exit): "); gets(cAddr1); printf("\n"); dwId = atoi(cAddr1); if(dwId is 99) break; printf("Enter Interface Index to associate with: "); gets(cAddr1); printf("\n"); dwIf = atoi(cAddr1); currentList = g_ifList.Flink; i = 1; pIf = NULL; while(currentList isnot &g_ifList) { if(i is dwIf) { pIf = CONTAINING_RECORD(currentList,USER_IF,ifLink); break; } i++; currentList = currentList->Flink; } if(pIf is NULL) { printf("Couldnt find filter interface\n"); continue; } info.Index = dwId; info.Context = pIf->pvIfContext; ntStatus = NtDeviceIoControlFile(g_IpDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_IP_SET_IF_CONTEXT, (PVOID)&info, sizeof(IP_SET_IF_CONTEXT_INFO), NULL, 0); if(!NT_SUCCESS(ntStatus)) { printf("Couldnt set context\n"); } else { printf("Set context successfully\n"); } } HeapFree(GetProcessHeap(),0,pAddrTable); return; } DWORD InitializeFilter() { NTSTATUS status; UNICODE_STRING nameString; IO_STATUS_BLOCK ioStatusBlock; OBJECT_ATTRIBUTES objectAttributes; RtlInitUnicodeString(&nameString,DD_IPFLTRDRVR_DEVICE_NAME); InitializeObjectAttributes(&objectAttributes, &nameString, OBJ_CASE_INSENSITIVE, NULL, NULL); status = NtCreateFile(&g_FilterDriverHandle, SYNCHRONIZE | FILE_READ_DATA | FILE_WRITE_DATA, &objectAttributes, &ioStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF, 0, NULL, 0); if(!NT_SUCCESS(status)) { printf("Couldnt create filter driver handle\n"); return(status); } RtlInitUnicodeString(&nameString, DD_IP_DEVICE_NAME); InitializeObjectAttributes(&objectAttributes, &nameString, OBJ_CASE_INSENSITIVE, NULL, NULL); status = NtCreateFile(&g_IpDriverHandle, SYNCHRONIZE | FILE_READ_DATA | FILE_WRITE_DATA, &objectAttributes, &ioStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF, 0, NULL, 0); if(!NT_SUCCESS(status)) { printf("Couldnt create ip driver handle\n"); return(status); } RtlInitUnicodeString(&nameString, DD_TCP_DEVICE_NAME); InitializeObjectAttributes(&objectAttributes, &nameString, OBJ_CASE_INSENSITIVE, NULL, NULL); status = NtCreateFile(&g_TcpDriverHandle, SYNCHRONIZE | FILE_READ_DATA | FILE_WRITE_DATA, &objectAttributes, &ioStatusBlock, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF, 0, NULL, 0); if(!NT_SUCCESS(status)) { printf("Couldnt create tcp driver handle\n"); } return (status); } //* CloseHandles() // // Function: Close TCPIP stack handle. // // Returns: 0 //* VOID CloseHandles () { CloseHandle(g_FilterDriverHandle); CloseHandle(g_IpDriverHandle); CloseHandle(g_TcpDriverHandle); } DWORD GetIpAddrTableFromStack(IPAddrEntry *lpipaeTable, LPDWORD lpdwNumEntries) { DWORD dwResult; DWORD dwInBufLen; DWORD dwOutBufLen; DWORD i,j; TCP_REQUEST_QUERY_INFORMATION_EX trqiInBuf; TDIObjectID *ID; BYTE *Context; NTSTATUS Status; IO_STATUS_BLOCK IoStatusBlock; dwInBufLen = sizeof(TCP_REQUEST_QUERY_INFORMATION_EX); dwOutBufLen = (*lpdwNumEntries) * sizeof( IPAddrEntry ); ID = &(trqiInBuf.ID); ID->toi_entity.tei_entity = CL_NL_ENTITY; ID->toi_entity.tei_instance = 0; ID->toi_class = INFO_CLASS_PROTOCOL; ID->toi_type = INFO_TYPE_PROVIDER; ID->toi_id = IP_MIB_ADDRTABLE_ENTRY_ID; Context = (BYTE *) &(trqiInBuf.Context[0]); ZeroMemory( Context, CONTEXT_SIZE ); Status = NtDeviceIoControlFile(g_TcpDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_TCP_QUERY_INFORMATION_EX, (PVOID)&trqiInBuf, dwInBufLen, lpipaeTable, dwOutBufLen); if(Status is STATUS_PENDING) { Status = NtWaitForSingleObject(g_TcpDriverHandle, FALSE, NULL ); Status = IoStatusBlock.Status; } if (!NT_SUCCESS( Status )) { printf("IOCTL failed to get address table\n"); *lpdwNumEntries = 0; return ( Status ); } *lpdwNumEntries = (ULONG)(((UINT_PTR)IoStatusBlock.Information / sizeof(IPAddrEntry))); return (NO_ERROR); } DWORD GetIpStatsFromStack(IPSNMPInfo *IPSnmpInfo) { DWORD dwResult; DWORD dwInBufLen; DWORD dwOutBufLen; TCP_REQUEST_QUERY_INFORMATION_EX trqiInBuf; TDIObjectID *ID; BYTE *Context; NTSTATUS Status; IO_STATUS_BLOCK IoStatusBlock; dwInBufLen = sizeof(TCP_REQUEST_QUERY_INFORMATION_EX); dwOutBufLen = sizeof(IPSNMPInfo); ID = &(trqiInBuf.ID); ID->toi_entity.tei_entity = CL_NL_ENTITY; ID->toi_entity.tei_instance = 0; ID->toi_class = INFO_CLASS_PROTOCOL; ID->toi_type = INFO_TYPE_PROVIDER; ID->toi_id = IP_MIB_STATS_ID; Context = (BYTE *) &(trqiInBuf.Context[0]); ZeroMemory(Context, CONTEXT_SIZE); Status = NtDeviceIoControlFile(g_TcpDriverHandle, NULL, NULL, NULL, &IoStatusBlock, IOCTL_TCP_QUERY_INFORMATION_EX, (PVOID)&trqiInBuf, sizeof(TCP_REQUEST_QUERY_INFORMATION_EX), IPSnmpInfo, dwOutBufLen); if(Status is STATUS_PENDING) { Status = NtWaitForSingleObject(g_TcpDriverHandle, FALSE, NULL); Status = IoStatusBlock.Status; } if (!NT_SUCCESS(Status)) { printf("IOCTL failed to get SNMP info\n"); return (Status); } return (NO_ERROR); }