Принципы построения Firewalls в операционных системах Windows NT и Linux

struct completion completion;

memset(&completion, 0, sizeof(completion));

// Analyze MajorFunction

switch (irps->MajorFunction) {

case IRP_MJ_CREATE: /* create fileobject */

result = tdi_create(irp, irps, &completion);

status = tdi_dispatch_complete(DeviceObject, irp, result,

completion.routine, completion.context);

break;

case IRP_MJ_DEVICE_CONTROL:

KdPrint(("[tdi_fw] DeviceDispatch: IRP_MJ_DEVICE_CONTROL, control 0x%x for 0x%08X\n",

irps->Parameters.DeviceIoControl.IoControlCode, irps->FileObject));

if (KeGetCurrentIrql() == PASSIVE_LEVEL) {

/*

* try to convert it to IRP_MJ_INTERNAL_DEVICE_CONTROL

* (works on PASSIVE_LEVEL only!)

*/

status = TdiMapUserRequest(DeviceObject, irp, irps);

} else

status = STATUS_NOT_IMPLEMENTED; // set fake status

if (status!= STATUS_SUCCESS) {

void *buf = (irps->Parameters.DeviceIoControl.IoControlCode == IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER) ?

irps->Parameters.DeviceIoControl.Type3InputBuffer: NULL;

// send IRP to original driver

status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW, NULL, NULL);

if (buf!= NULL && status == STATUS_SUCCESS) {

g_TCPSendData = *(TCPSendData_t **)buf;

KdPrint(("[tdi_fw] DeviceDispatch: IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER: TCPSendData = 0x%x\n",

g_TCPSendData));

*(TCPSendData_t **)buf = new_TCPSendData;

}

break;

}

// don't break! go to internal device control!

case IRP_MJ_INTERNAL_DEVICE_CONTROL: {

/*

* Analyze ioctl for TDI driver

*/

int i;

for (i = 0; g_tdi_ioctls[i].MinorFunction!= 0; i++)

if (g_tdi_ioctls[i].MinorFunction == irps->MinorFunction) {

#if DBG

// print description

KdPrint(("[tdi_fw] DeviceDispatch: %s (0x%x) for 0x%x\n",

g_tdi_ioctls[i].desc,

irps->MinorFunction,

irps->FileObject));

#endif

if (g_tdi_ioctls[i].fn == NULL) {

// send IRP to original driver

status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW,

NULL, NULL);

break;

}

// call dispatch function

result = g_tdi_ioctls[i].fn(irp, irps, &completion);

// complete request

status = tdi_dispatch_complete(DeviceObject, irp, result,

completion.routine, completion.context);

break;

}

// if dispatch function hasn't been found

if (g_tdi_ioctls[i].MinorFunction == 0) {

// send IRP to original driver

status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW, NULL, NULL);

}

break;

}

result = tdi_cleanup(irp, irps, &completion);

status = tdi_dispatch_complete(DeviceObject, irp, result,

completion.routine, completion.context);

break;

case IRP_MJ_CLOSE:

KdPrint(("[tdi_fw] DeviceDispatch: IRP_MJ_CLOSE fileobj 0x%x\n", irps->FileObject));

// passthrough IRP

status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW,

completion.routine, completion.context);

break;

default:

KdPrint(("[tdi_fw] DeviceDispatch: major 0x%x, minor 0x%x for 0x%x\n",

irps->MajorFunction, irps->MinorFunction, irps->FileObject));

// passthrough IRP

status = tdi_dispatch_complete(DeviceObject, irp, FILTER_ALLOW,

completion.routine, completion.context);

}

} else if (DeviceObject == g_devcontrol) {

/*

* this IRP is for control device

*/

// set default status

status = STATUS_SUCCESS;

if (irps->MajorFunction == IRP_MJ_CREATE) {

// initialize for user-mode part (exclusive access - 1 user-mode logging part)

filter_init_2();

g_got_log = TRUE;

// cleanup for user-mode logging part

filter_free_2();

g_got_log = FALSE;

} if (irps->MajorFunction == IRP_MJ_DEVICE_CONTROL) {

/*

* control request

*/

/* get original device object by filtered */

PDEVICE_OBJECT

get_original_devobj(PDEVICE_OBJECT flt_devobj, int *proto)

{

#ifndef USE_TDI_HOOKING

PDEVICE_OBJECT result;

int ipproto;

if (flt_devobj == g_tcpfltobj) {

result = g_tcpoldobj;

ipproto = IPPROTO_TCP;

} else if (flt_devobj == g_udpfltobj) {

result = g_udpoldobj;

ipproto = IPPROTO_UDP;

} else if (flt_devobj == g_ipfltobj) {

result = g_ipoldobj;

ipproto = IPPROTO_IP;

} else {

KdPrint(("[tdi_fw] get_original_devobj: Unknown DeviceObject 0x%x!\n",

flt_devobj));

ipproto = IPPROTO_IP; // what else?

result = NULL;

}

if (result!= NULL && proto!= NULL)

*proto = ipproto;

return result;

#else /* USE_TDI_HOOKING */

// just stub for original devobj; return proto by devobj

int ipproto;

if (flt_devobj == g_tcpfltobj)

ipproto = IPPROTO_TCP;

else if (flt_devobj == g_udpfltobj)

ipproto = IPPROTO_UDP;

else if (flt_devobj == g_ipfltobj)

ipproto = IPPROTO_IP;

else {

KdPrint(("[tdi_fw] get_original_devobj: Unknown DeviceObject 0x%x!\n",

flt_devobj));

ipproto = IPPROTO_IP; // what else?

flt_devobj = NULL;

}

if (proto!= NULL)

*proto = ipproto;

return flt_devobj;

#endif

}

/*

* Completion routines must call this function at the end of their execution

*/

NTSTATUS

tdi_generic_complete(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)

{

KdPrint(("[tdi_fw] tdi_generic_complete: STATUS = 0x%x\n", Irp->IoStatus.Status));

if (Irp->PendingReturned) {

KdPrint(("[tdi_fw] tdi_generic_complete: PENDING\n"));

IoMarkIrpPending(Irp);

}

return STATUS_SUCCESS;

}

/*

* for IOCTL_TDI_QUERY_DIRECT_SEND_HANDLER

*/

NTSTATUS

new_TCPSendData(IN PIRP Irp, IN PIO_STACK_LOCATION IrpSp)

{

struct completion completion;

int result;

KdPrint(("[tdi_fw] new_TCPSendData\n"));

#if 1

memset(&completion, 0, sizeof(completion));

result = tdi_send(Irp, IrpSp, &completion);

// complete request

return tdi_dispatch_complete(IrpSp->DeviceObject, Irp, result,

completion.routine, completion.context);

#else

return g_TCPSendData(Irp, IrpSp);

#endif

}

/*

* deny stub for dispatch table

*/

int

tdi_deny_stub(PIRP irp, PIO_STACK_LOCATION irps, struct completion *completion)

{

KdPrint(("[tdi_fw] tdi_deny_stub!\n"));

return FILTER_DENY;

}

Размещено на Allbest.ru