Manipulation of TCP packets from user-mode RRS feed

  • Question

  • Hello,

    I am developing a FWPM_LAYER_STREAM_V4 callout driver to intercept TCP packets on the local IPV4 loopback address.

    My implementation is sending packets to a user-mode application through IOCTLs. These are copied, from the FWPS_STREAM_DATA queued upon reception in the callout classifyFn callback, to a flat buffer using FwpsCopyStreamDataToBuffer.

    But when the user-mode wants to inject packets (to replay a sequence) through another IO control (not only data that has been received previously), I can't seem to find a way to create a NET_BUFFER_LIST or FWPS_STREAM_DATA from the user buffer in order to inject the data using FwpsStreamInjectAsync.



    Tuesday, April 17, 2012 2:05 AM


  • The function you are looking for is probably FwpsAllocateNetBufferAndNetBufferList, for it's usage you can take a look at the stmedit sample.
    • Marked as answer by Patrick Samy Monday, April 23, 2012 11:36 PM
    Thursday, April 19, 2012 2:27 PM