locked
IP Header in FWPM_LAYER_INBOUND_IPPACKET_V4 RRS feed

  • Question

  • Hi,

    this problem I have seems to be closely related to another mine here:
    http://social.msdn.microsoft.com/Forums/en-US/wfp/thread/65c34860-6d8d-4475-9b9b-b06541158875

    Anyway, I have a callout registered in the INBOUND_IPPACKET layer and I'd like to access to the IP Header.

    I'm able to access to the TCP Header just reading from the current pointer:
    ----------------------------

    tcp_header = (TCP_HEADER*)NdisGetDataBuffer(
    	nb,
    	sizeof(TCP_HEADER),
    	NULL,
    	sizeof(UINT16),
    	0);
    

    ----------------------------
    but trying to read the ip header with this code:
    ----------------------------

    status2 = NdisRetreatNetBufferDataStart(
    	nb,
    	inMetaValues->ipHeaderSize,
    	0,
    	NULL);
    
    if (status2 != NDIS_STATUS_SUCCESS)
    {
    	...; goto Exit;
    }
    
    ip_header = (IP_HEADER*)NdisGetDataBuffer(
    	nb,
    	sizeof(IP_HEADER),
    	NULL,
    	sizeof(UINT16),
    	0);
    
    if (ip_header == NULL)
    {
    	...; goto Exit;
    }
    

    ----------------------------
    I found dirty data in the IP_HEADER structure...

    I'm sure there is something wrong but I totally don't understand or imagine where!!
    Anyone have an idea?

    Thanks,
    Marco

    Wednesday, August 4, 2010 7:09 PM

Answers

  • Found it!

    My mistake was retreating the cloned buffer... and the buffer was cloned from the pointer after the IP header. So I was reading dirty stuff because I was already at the beginning of the cloned buffer.

    So, for the records, the correct way is to call NdisRetreatNetBufferListDataStart to (NET_BUFFER_LIST*)layerData and not to nb !

    For the records:
    ----------------------------

    status2 = NdisRetreatNetBufferListDataStart(
    	(NET_BUFFER_LIST*)layerData,
    	inMetaValues->ipHeaderSize,
    	0,
    	NULL,
    	NULL);
    
    if (status2 != NDIS_STATUS_SUCCESS)
    {
    	...; goto Exit;
    }
    
    status = FwpsAllocateCloneNetBufferList0(
    	(NET_BUFFER_LIST*)layerData,
    	NULL,
    	NULL,
    	0,
    	&nbl);
    
    if (!NT_SUCCESS(status))
    {
    	...; goto Exit;
    }
    
    nb = NET_BUFFER_LIST_FIRST_NB(nbl);
    
    ip_header = (IP_HEADER*)NdisGetDataBuffer(
    	nb,
    	sizeof(IP_HEADER),
    	NULL,
    	sizeof(UINT16),
    	0);
    
    if (ip_header == NULL)
    {
    	...; goto Exit;
    }
    
    protocol = ip_header->Protocol;
    ...;
    
    NdisAdvanceNetBufferListDataStart(
    	(NET_BUFFER_LIST*)layerData,
    	inMetaValues->ipHeaderSize,
    	FALSE,
    	NULL);
    

    ----------------------------

    Thanks,
    Marco

    • Marked as answer by Marco Mura Thursday, August 5, 2010 12:10 AM
    Thursday, August 5, 2010 12:10 AM