WinPcap  4.1.3
Packet.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
3  * Copyright (c) 2005 - 2010 CACE Technologies, Davis (California)
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the Politecnico di Torino, CACE Technologies
16  * nor the names of its contributors may be used to endorse or promote
17  * products derived from this software without specific prior written
18  * permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
42 #ifndef __PACKET_INCLUDE______
43 #define __PACKET_INCLUDE______
44 
45 #if !defined(NDIS30) && !defined(NDIS50)
46 #error NDIS30 or NDIS50 should be defined
47 #endif
48 
49 #ifdef _X86_
50 #define NTKERNEL
51 #include "jitter.h"
52 #endif
53 
54 #ifdef HAVE_BUGGY_TME_SUPPORT
55 #ifndef _X86_
56 #error TME support is available only on x86 architectures
57 #endif // _X86_
58 #endif //HAVE_BUGGY_TME_SUPPORT
59 
60 
61 //
62 // Needed to disable a warning due to the #pragma prefast directives,
63 // that are ignored by the normal DDK compiler
64 //
65 #ifndef _PREFAST_
66 #pragma warning(disable:4068)
67 #endif
68 
69 #include "win_bpf.h"
70 
71 #define MAX_REQUESTS 32
72 
73 #define Packet_ALIGNMENT sizeof(int)
74 #define Packet_WORDALIGN(x) (((x)+(Packet_ALIGNMENT-1))&~(Packet_ALIGNMENT-1))
75 
77 #define KERNEL_EVENT_NAMESPACE L"\\BaseNamedObjects\\"
78 
79 
80 // Working modes
81 #define MODE_CAPT 0x0
82 #define MODE_STAT 0x1
83 #define MODE_MON 0x2
84 #define MODE_DUMP 0x10
85 
86 
87 #define IMMEDIATE 1
88 
89 #define NDIS_FLAGS_SKIP_LOOPBACK_W2K 0x400
90 
91 // The following definitions are used to provide compatibility
92 // of the dump files with the ones of libpcap
93 #define TCPDUMP_MAGIC 0xa1b2c3d4
94 #define PCAP_VERSION_MAJOR 2
95 #define PCAP_VERSION_MINOR 4
96 
97 // Loopback behaviour definitions
98 #define NPF_DISABLE_LOOPBACK 1
99 #define NPF_ENABLE_LOOPBACK 2
100 
101 
107 {
108  UINT magic;
109  USHORT version_major;
110  USHORT version_minor;
111  UINT thiszone;
112  UINT sigfigs;
113  UINT snaplen;
114  UINT linktype;
115 };
116 
121 struct sf_pkthdr {
122  struct timeval ts;
123  UINT caplen;
124  UINT len;
127 };
128 
129 //
130 // NT4 DDK doesn't have C_ASSERT
131 //
132 #ifndef C_ASSERT
133 #define C_ASSERT(a)
134 #endif
135 
143 typedef struct _PACKET_OID_DATA {
144  ULONG Oid;
145  ULONG Length;
147  UCHAR Data[1];
148 }
151 
152 C_ASSERT(sizeof(PACKET_OID_DATA) == 12);
153 
163 typedef struct _INTERNAL_REQUEST {
164  LIST_ENTRY ListElement;
165 // PIRP Irp; ///< Irp that performed the request
166 // BOOLEAN Internal; ///< True if the request is for internal use of npf.sys. False if the request is performed by the user through an IOCTL.
168  NDIS_REQUEST Request;
169  NDIS_STATUS RequestStatus;
170 
172 
180 typedef struct _PACKET_RESERVED {
181  LIST_ENTRY ListElement;
182  PIRP Irp;
183  PMDL pMdl;
185  ULONG Cpu;
188 
189 #define RESERVED(_p) ((PPACKET_RESERVED)((_p)->ProtocolReserved))
190 
191 
196 typedef struct _DEVICE_EXTENSION {
197  NDIS_STRING AdapterName;
198  PWSTR ExportString;
201 
207 typedef struct __CPU_Private_Data
208 {
209  ULONG P;
210  ULONG C;
211  ULONG Free;
212  PUCHAR Buffer;
213  ULONG Accepted;
214  ULONG Received;
218  ULONG Dropped;
222  NDIS_SPIN_LOCK BufferLock;
228  ULONG NewP;
229 }
231 
232 
240 typedef struct _OPEN_INSTANCE
241 {
243  NDIS_HANDLE AdapterHandle;
245  UINT Medium;
246  NDIS_HANDLE PacketPool;
248  KSPIN_LOCK RequestSpinLock;
249  LIST_ENTRY RequestList;
250  LIST_ENTRY ResetIrpList;
252  PMDL BufferMdl;
253  PKEVENT ReadEvent;
254  PUCHAR bpfprogram;
255 #ifdef _X86_
260  JIT_BPF_Filter *Filter;
261 #endif //_X86_
263  UINT MinToCopy;
264  LARGE_INTEGER TimeOut;
266 
268  int mode;
269  LARGE_INTEGER Nbytes;
270  LARGE_INTEGER Npackets;
271  NDIS_SPIN_LOCK CountersLock;
272  UINT Nwrites;
273  ULONG Multiple_Write_Counter;
275  NDIS_EVENT WriteEvent;
276  BOOLEAN WriteInProgress;
277  NDIS_SPIN_LOCK WriteLock;
279  NDIS_EVENT NdisRequestEvent;
280  BOOLEAN SkipSentPackets;
281  NDIS_STATUS IOStatus;
282  HANDLE DumpFileHandle;
283  PFILE_OBJECT DumpFileObject;
284  PKTHREAD DumpThreadObject;
286  NDIS_EVENT DumpEvent;
287  LARGE_INTEGER DumpOffset;
288  UNICODE_STRING DumpFileName;
290  UINT MaxDumpPacks;
292  BOOLEAN DumpLimitReached;
295 #ifdef HAVE_BUGGY_TME_SUPPORT
297  MEM_TYPE mem_ex;
298  TME_CORE tme;
299 #endif //HAVE_BUGGY_TME_SUPPORT
300 
301  NDIS_SPIN_LOCK MachineLock;
303  //
305  // KAFFINITY is used as a bit mask for the affinity in the system. So on every supported OS is big enough for all the CPUs on the system (32 bits on x86, 64 on x64?).
306  // We use its size to compute the max number of CPUs.
307  //
308  CpuPrivateData CpuData[sizeof(KAFFINITY) * 8];
309  ULONG ReaderSN;
310  ULONG WriterSN;
311  ULONG Size;
314  NDIS_SPIN_LOCK AdapterHandleLock;
316 
319  NTSTATUS OpenCloseStatus;
322  BOOLEAN ClosePending;
323  NDIS_SPIN_LOCK OpenInUseLock;
324 }
326 
328 {
332 };
333 
342 {
343  ULONG SN;
344  struct bpf_hdr header;
345 };
346 
347 extern ULONG g_NCpu;
348 extern NDIS_HANDLE g_NdisProtocolHandle;
349 extern struct time_conv G_Start_Time; // from openclos.c
350 extern UINT g_SendPacketFlags;
351 
352 #define TRANSMIT_PACKETS 256
353 
355 
357 #define EXIT_SUCCESS(quantity) Irp->IoStatus.Information=quantity;\
358  Irp->IoStatus.Status = STATUS_SUCCESS;\
359  IoCompleteRequest(Irp, IO_NO_INCREMENT);\
360  return STATUS_SUCCESS;\
361 
362 #define EXIT_FAILURE(quantity) Irp->IoStatus.Information=quantity;\
364  Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;\
365  IoCompleteRequest(Irp, IO_NO_INCREMENT);\
366  return STATUS_UNSUCCESSFUL;\
367 
368 
373 /***************************/
374 /* Prototypes */
375 /***************************/
376 
393 NTSTATUS
395  IN PDRIVER_OBJECT DriverObject,
396  IN PUNICODE_STRING RegistryPath
397  );
398 
408 PWCHAR getAdaptersList(VOID);
409 
416 PKEY_VALUE_PARTIAL_INFORMATION getTcpBindings(VOID);
417 
428 BOOLEAN NPF_CreateDevice(
429  IN OUT PDRIVER_OBJECT adriverObjectP,
430  IN PUNICODE_STRING amacNameP
431  );
443 NTSTATUS
444 NPF_Open(
445  IN PDEVICE_OBJECT DeviceObject,
446  IN PIRP Irp
447  );
448 
458 VOID
460  IN NDIS_HANDLE ProtocolBindingContext,
461  IN NDIS_STATUS Status,
462  IN NDIS_STATUS OpenErrorStatus
463  );
464 
475 NTSTATUS
477  IN PDEVICE_OBJECT DeviceObject,
478  IN PIRP Irp
479  );
480 
481 NTSTATUS
482 NPF_Close(
483  IN PDEVICE_OBJECT DeviceObject,
484  IN PIRP Irp
485  );
486 
487 
488 
497 VOID
499  IN NDIS_HANDLE ProtocolBindingContext,
500  IN NDIS_STATUS Status
501  );
502 
525 NDIS_STATUS
526 NPF_tap(
527  IN NDIS_HANDLE ProtocolBindingContext,
528  IN NDIS_HANDLE MacReceiveContext,
529  IN PVOID HeaderBuffer,
530  IN UINT HeaderBufferSize,
531  IN PVOID LookAheadBuffer,
532  IN UINT LookaheadBufferSize,
533  IN UINT PacketSize
534  );
535 
546 VOID
548  IN NDIS_HANDLE ProtocolBindingContext,
549  IN PNDIS_PACKET Packet,
550  IN NDIS_STATUS Status,
551  IN UINT BytesTransferred
552  );
553 
560 VOID
561 NPF_ReceiveComplete(IN NDIS_HANDLE ProtocolBindingContext);
562 
586 NTSTATUS
588  IN PDEVICE_OBJECT DeviceObject,
589  IN PIRP Irp
590  );
591 
592 VOID
593 
604  IN NDIS_HANDLE ProtocolBindingContext,
605  IN PNDIS_REQUEST pRequest,
606  IN NDIS_STATUS Status
607  );
608 
621 NTSTATUS
622 NPF_Write(
623  IN PDEVICE_OBJECT DeviceObject,
624  IN PIRP Irp
625  );
626 
627 
647 INT NPF_BufferedWrite(IN PIRP Irp,
648  IN PCHAR UserBuff,
649  IN ULONG UserBuffSize,
650  BOOLEAN sync);
651 
660 
670 VOID
672  IN NDIS_HANDLE ProtocolBindingContext,
673  IN PNDIS_PACKET pPacket,
674  IN NDIS_STATUS Status
675  );
676 
686 VOID
688  IN NDIS_HANDLE ProtocolBindingContext,
689  IN NDIS_STATUS Status
690  );
691 
695 VOID
696 NPF_Status(
697  IN NDIS_HANDLE ProtocolBindingContext,
698  IN NDIS_STATUS Status,
699  IN PVOID StatusBuffer,
700  IN UINT StatusBufferSize
701  );
702 
703 
707 VOID
708 NPF_StatusComplete(IN NDIS_HANDLE ProtocolBindingContext);
709 
718 VOID
719 NPF_Unload(IN PDRIVER_OBJECT DriverObject);
720 
721 
740 NTSTATUS
741 NPF_Read(
742  IN PDEVICE_OBJECT DeviceObject,
743  IN PIRP Irp
744  );
745 
751 NTSTATUS
753  IN PWSTR *MacDriverName,
754  IN PWSTR *PacketDriverName,
755  IN PUNICODE_STRING RegistryPath
756  );
757 
764 NTSTATUS
766  IN PWSTR ValueName,
767  IN ULONG ValueType,
768  IN PVOID ValueData,
769  IN ULONG ValueLength,
770  IN PVOID Context,
771  IN PVOID EntryContext
772  );
773 
779 VOID NPF_BindAdapter(
780  OUT PNDIS_STATUS Status,
781  IN NDIS_HANDLE BindContext,
782  IN PNDIS_STRING DeviceName,
783  IN PVOID SystemSpecific1,
784  IN PVOID SystemSpecific2
785  );
786 
798 VOID
800  OUT PNDIS_STATUS Status,
801  IN NDIS_HANDLE ProtocolBindingContext,
802  IN NDIS_HANDLE UnbindContext
803  );
804 
805 
813 NTSTATUS NPF_OpenDumpFile(POPEN_INSTANCE Open , PUNICODE_STRING fileName, BOOLEAN append);
814 
823 NTSTATUS NPF_StartDump(POPEN_INSTANCE Open);
824 
832 VOID NPF_DumpThread(PVOID Open);
833 
841 
854 VOID NPF_WriteDumpFile(PFILE_OBJECT FileObject,
855  PLARGE_INTEGER Offset,
856  ULONG Length,
857  PMDL Mdl,
858  PIO_STATUS_BLOCK IoStatusBlock);
859 
860 
861 
867 NTSTATUS NPF_CloseDumpFile(POPEN_INSTANCE Open);
868 
869 BOOLEAN
871  IN POPEN_INSTANCE pOpen);
872 
873 VOID
875  IN POPEN_INSTANCE pOpen);
876 
877 VOID
879  IN POPEN_INSTANCE pOpen);
880 
881 BOOLEAN
883  IN POPEN_INSTANCE pOpen);
884 
885 VOID
887  IN POPEN_INSTANCE pOpen);
888 
889 VOID
891  IN POPEN_INSTANCE pOpen);
892 
893 NTSTATUS
895  IN POPEN_INSTANCE pOpen,
896  IN PIRP pIrp,
897  OUT PUINT pMtu);
898 
904 
916 #ifdef NDIS50
917 NDIS_STATUS NPF_PowerChange(IN NDIS_HANDLE ProtocolBindingContext, IN PNET_PNP_EVENT pNetPnPEvent);
918 #endif
919 
920 //
921 // Old registry based WinPcap names
922 //
924 // \brief Helper function to query a value from the global WinPcap registry key
925 //*/
926 //VOID NPF_QueryWinpcapRegistryString(PWSTR SubKeyName,
927 // WCHAR *Value,
928 // UINT ValueLen,
929 // WCHAR *DefaultValue);
930 //
931 
932 
941 #endif /*main ifndef/define*/
NPF_StopUsingBinding
VOID NPF_StopUsingBinding(IN POPEN_INSTANCE pOpen)
NPF_tap
NDIS_STATUS NPF_tap(IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE MacReceiveContext, IN PVOID HeaderBuffer, IN UINT HeaderBufferSize, IN PVOID LookAheadBuffer, IN UINT LookaheadBufferSize, IN UINT PacketSize)
Callback invoked by NDIS when a packet arrives from the network.
packet_file_header::thiszone
UINT thiszone
Gmt to local correction.
Definition: Packet.h:111
packet_file_header
Header of a libpcap dump file.
Definition: Packet.h:106
NPF_ReceiveComplete
VOID NPF_ReceiveComplete(IN NDIS_HANDLE ProtocolBindingContext)
Callback function that signals the end of a packet reception.
_OPEN_INSTANCE::Size
ULONG Size
Size of each kernel buffer contained in the CpuData field.
Definition: Packet.h:312
PacketHeader::header
struct bpf_hdr header
bpf header, created by the tap, and copied unmodified to user level programs.
Definition: Packet.h:344
packet_file_header::version_minor
USHORT version_minor
Libpcap minor version.
Definition: Packet.h:110
_PACKET_RESERVED::pMdl
PMDL pMdl
MDL mapping the buffer of the packet.
Definition: Packet.h:183
_OPEN_INSTANCE::OpenInUseLock
NDIS_SPIN_LOCK OpenInUseLock
Definition: Packet.h:323
_OPEN_INSTANCE::TimeOut
LARGE_INTEGER TimeOut
Definition: Packet.h:265
_DEVICE_EXTENSION::ExportString
PWSTR ExportString
Definition: Packet.h:198
_OPEN_INSTANCE::TransmitPendingPackets
ULONG TransmitPendingPackets
Specifies the number of packets that are pending to be transmitted, i.e. have been submitted to NdisS...
Definition: Packet.h:320
_OPEN_INSTANCE::MaxDumpPacks
UINT MaxDumpPacks
Definition: Packet.h:291
PPACKET_RESERVED
struct _PACKET_RESERVED * PPACKET_RESERVED
_PACKET_OID_DATA::Oid
ULONG Oid
Definition: Packet.h:144
ADAPTER_BOUND
@ ADAPTER_BOUND
Definition: Packet.h:330
NPF_OpenAdapterComplete
VOID NPF_OpenAdapterComplete(IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status, IN NDIS_STATUS OpenErrorStatus)
Ends the opening of an adapter.
g_NdisProtocolHandle
NDIS_HANDLE g_NdisProtocolHandle
NPF_GetDeviceMTU
NTSTATUS NPF_GetDeviceMTU(IN POPEN_INSTANCE pOpen, IN PIRP pIrp, OUT PUINT pMtu)
__CPU_Private_Data::NewP
ULONG NewP
Used by NdisTransferData() (when we call NdisTransferData, p index must be updated only in the Transf...
Definition: Packet.h:228
_PACKET_OID_DATA
Structure containing an OID request.
Definition: Packet.h:143
NPF_DumpThread
VOID NPF_DumpThread(PVOID Open)
The dump thread.
_OPEN_INSTANCE::AdapterHandleUsageCounter
ULONG AdapterHandleUsageCounter
Definition: Packet.h:313
_PACKET_RESERVED::Irp
PIRP Irp
Irp that performed the request.
Definition: Packet.h:182
_INTERNAL_REQUEST
Stores an OID request.
Definition: Packet.h:163
C_ASSERT
#define C_ASSERT(a)
Definition: Packet.h:133
_OPEN_INSTANCE::DeviceExtension
PDEVICE_EXTENSION DeviceExtension
Definition: Packet.h:242
NPF_Unload
VOID NPF_Unload(IN PDRIVER_OBJECT DriverObject)
Function called by the OS when NPF is unloaded.
PDEVICE_EXTENSION
struct _DEVICE_EXTENSION * PDEVICE_EXTENSION
NPF_WriteDumpFile
VOID NPF_WriteDumpFile(PFILE_OBJECT FileObject, PLARGE_INTEGER Offset, ULONG Length, PMDL Mdl, PIO_STATUS_BLOCK IoStatusBlock)
Writes a block of packets on the dump file.
NPF_CloseOpenInstance
VOID NPF_CloseOpenInstance(IN POPEN_INSTANCE pOpen)
sf_pkthdr::ts
struct timeval ts
time stamp
Definition: Packet.h:122
NPF_BufferedWrite
INT NPF_BufferedWrite(IN PIRP Irp, IN PCHAR UserBuff, IN ULONG UserBuffSize, BOOLEAN sync)
Writes a buffer of raw packets to the network.
_OPEN_INSTANCE::WriteInProgress
BOOLEAN WriteInProgress
Definition: Packet.h:276
NPF_TransferDataComplete
VOID NPF_TransferDataComplete(IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET Packet, IN NDIS_STATUS Status, IN UINT BytesTransferred)
Ends the transfer of a packet.
_OPEN_INSTANCE::RequestList
LIST_ENTRY RequestList
List of pending OID requests.
Definition: Packet.h:249
_PACKET_RESERVED::Cpu
ULONG Cpu
The CPU on which the packet was pulled out of the linked list of free packets.
Definition: Packet.h:186
MAX_REQUESTS
#define MAX_REQUESTS
Maximum number of simultaneous IOCTL requests.
Definition: Packet.h:71
_OPEN_INSTANCE::NdisOpenCloseCompleteEvent
NDIS_EVENT NdisOpenCloseCompleteEvent
Definition: Packet.h:317
_OPEN_INSTANCE::AdapterHandle
NDIS_HANDLE AdapterHandle
NDIS idetifier of the adapter used by this instance.
Definition: Packet.h:244
getAdaptersList
PWCHAR getAdaptersList(VOID)
Returns the list of the MACs available on the system.
PACKET_OID_DATA
struct _PACKET_OID_DATA PACKET_OID_DATA
Structure containing an OID request.
NPF_SendComplete
VOID NPF_SendComplete(IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET pPacket, IN NDIS_STATUS Status)
Ends a send operation.
_OPEN_INSTANCE::Requests
INTERNAL_REQUEST Requests[MAX_REQUESTS]
Array of structures that wrap every single OID request.
Definition: Packet.h:251
packet_file_header::linktype
UINT linktype
Data link type (DLT_*). See win_bpf.h for details.
Definition: Packet.h:114
_OPEN_INSTANCE::BufferMdl
PMDL BufferMdl
Pointer to a Memory descriptor list (MDL) that maps the circular buffer's memory.
Definition: Packet.h:252
_OPEN_INSTANCE::AdapterHandleLock
NDIS_SPIN_LOCK AdapterHandleLock
Definition: Packet.h:314
g_NCpu
ULONG g_NCpu
NPF_StartUsingOpenInstance
BOOLEAN NPF_StartUsingOpenInstance(IN POPEN_INSTANCE pOpen)
_PACKET_OID_DATA::Length
ULONG Length
Length of the data field.
Definition: Packet.h:146
_OPEN_INSTANCE::MaxFrameSize
UINT MaxFrameSize
Definition: Packet.h:302
__CPU_Private_Data::Received
ULONG Received
Definition: Packet.h:217
_OPEN_INSTANCE::bpfprogram
PUCHAR bpfprogram
Definition: Packet.h:254
_OPEN_INSTANCE::CountersLock
NDIS_SPIN_LOCK CountersLock
SpinLock that protects the statistical mode counters.
Definition: Packet.h:271
NPF_OpenDumpFile
NTSTATUS NPF_OpenDumpFile(POPEN_INSTANCE Open, PUNICODE_STRING fileName, BOOLEAN append)
Creates the file that will receive the packets when the driver is in dump mode.
_OPEN_INSTANCE::Nwrites
UINT Nwrites
Definition: Packet.h:272
_OPEN_INSTANCE::Npackets
LARGE_INTEGER Npackets
Number of packets accepted by the filter when this instance is in statistical mode.
Definition: Packet.h:270
_OPEN_INSTANCE::WriterSN
ULONG WriterSN
Definition: Packet.h:310
packet_file_header::snaplen
UINT snaplen
Length of the max saved portion of each packet.
Definition: Packet.h:113
_DEVICE_EXTENSION
Port device extension.
Definition: Packet.h:196
NPF_Close
NTSTATUS NPF_Close(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
NPF_IoControl
NTSTATUS NPF_IoControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
Handles the IOCTL calls.
NPF_WaitEndOfBufferedWrite
VOID NPF_WaitEndOfBufferedWrite(POPEN_INSTANCE Open)
Waits the completion of all the sends performed by NPF_BufferedWrite.
_OPEN_INSTANCE::DumpFileObject
PFILE_OBJECT DumpFileObject
Pointer to the object of the file used in dump mode.
Definition: Packet.h:283
_OPEN_INSTANCE::NdisRequestEvent
NDIS_EVENT NdisRequestEvent
Event used to synchronize I/O requests with the callback structure of NDIS.
Definition: Packet.h:279
NPF_CloseAdapterComplete
VOID NPF_CloseAdapterComplete(IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status)
Ends the closing of an adapter.
POPEN_INSTANCE
struct _OPEN_INSTANCE * POPEN_INSTANCE
_INTERNAL_REQUEST::Request
NDIS_REQUEST Request
The structure with the actual request, that will be passed to NdisRequest().
Definition: Packet.h:168
getTcpBindings
PKEY_VALUE_PARTIAL_INFORMATION getTcpBindings(VOID)
Returns the MACs that bind to TCP/IP.
INTERNAL_REQUEST
struct _INTERNAL_REQUEST INTERNAL_REQUEST
Stores an OID request.
sf_pkthdr::caplen
UINT caplen
Definition: Packet.h:123
__CPU_Private_Data::C
ULONG C
Zero-based index of the consumer in the buffer. It indicates the first free byte to be read.
Definition: Packet.h:210
_OPEN_INSTANCE::Multiple_Write_Counter
ULONG Multiple_Write_Counter
Counts the number of times a single write has already physically repeated.
Definition: Packet.h:274
NPF_UnbindAdapter
VOID NPF_UnbindAdapter(OUT PNDIS_STATUS Status, IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE UnbindContext)
Callback for NDIS UnbindAdapterHandler.
_OPEN_INSTANCE::DumpEvent
NDIS_EVENT DumpEvent
Event used to synchronize the dump thread with the tap when the instance is in dump mode.
Definition: Packet.h:286
_OPEN_INSTANCE::DumpOffset
LARGE_INTEGER DumpOffset
Current offset in the dump file.
Definition: Packet.h:287
_OPEN_INSTANCE::PacketPool
NDIS_HANDLE PacketPool
Pool of NDIS_PACKET structures used to transfer the packets from and to the NIC driver.
Definition: Packet.h:247
NPF_CloseDumpFile
NTSTATUS NPF_CloseDumpFile(POPEN_INSTANCE Open)
Closes the dump file associated with an instance of the driver.
_OPEN_INSTANCE::ReadEvent
PKEVENT ReadEvent
Pointer to the event on which the read calls on this instance must wait.
Definition: Packet.h:253
_OPEN_INSTANCE::DumpThreadObject
PKTHREAD DumpThreadObject
Pointer to the object of the thread used in dump mode.
Definition: Packet.h:284
packet_file_header::magic
UINT magic
Libpcap magic number.
Definition: Packet.h:108
_PACKET_OID_DATA::Data
UCHAR Data[1]
Definition: Packet.h:147
NPF_Open
NTSTATUS NPF_Open(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
Opens a new instance of the driver.
_OPEN_INSTANCE::DumpFileName
UNICODE_STRING DumpFileName
String containing the name of the dump file.
Definition: Packet.h:288
g_SendPacketFlags
UINT g_SendPacketFlags
NPF_Read
NTSTATUS NPF_Read(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
Function that serves the user's reads.
packet_file_header::sigfigs
UINT sigfigs
Accuracy of timestamps.
Definition: Packet.h:112
NPF_StatusComplete
VOID NPF_StatusComplete(IN NDIS_HANDLE ProtocolBindingContext)
Callback for NDIS StatusCompleteHandler. Not used by NPF.
_OPEN_INSTANCE::ClosePending
BOOLEAN ClosePending
Definition: Packet.h:322
_OPEN_INSTANCE::Medium
UINT Medium
Definition: Packet.h:245
_PACKET_RESERVED::ListElement
LIST_ENTRY ListElement
Used to handle lists of packets.
Definition: Packet.h:181
_DEVICE_EXTENSION::AdapterName
NDIS_STRING AdapterName
Name of the adapter.
Definition: Packet.h:197
_PACKET_RESERVED::FreeBufAfterWrite
BOOLEAN FreeBufAfterWrite
Definition: Packet.h:184
_OPEN_INSTANCE::SkipSentPackets
BOOLEAN SkipSentPackets
True if this instance should not capture back the packets that it transmits.
Definition: Packet.h:280
_OPEN_INSTANCE::RequestSpinLock
KSPIN_LOCK RequestSpinLock
SpinLock used to synchronize the OID requests.
Definition: Packet.h:248
_OPEN_INSTANCE::WriteLock
NDIS_SPIN_LOCK WriteLock
SpinLock that protects the WriteInProgress variable.
Definition: Packet.h:278
_OPEN_INSTANCE::NumPendingIrps
ULONG NumPendingIrps
Definition: Packet.h:321
_OPEN_INSTANCE::ReaderSN
ULONG ReaderSN
Sequence number of the next packet to be read from the pool of kernel buffers.
Definition: Packet.h:309
CpuPrivateData
struct __CPU_Private_Data CpuPrivateData
Kernel buffer of each CPU.
_OPEN_INSTANCE::DumpThreadHandle
HANDLE DumpThreadHandle
Handle of the thread created by dump mode to asynchronously move the buffer to disk.
Definition: Packet.h:285
ADAPTER_UNBINDING
@ ADAPTER_UNBINDING
Definition: Packet.h:331
G_Start_Time
struct time_conv G_Start_Time
GetBuffOccupation
UINT GetBuffOccupation(POPEN_INSTANCE Open)
Returns the amount of bytes present in the packet buffer.
NPF_BindAdapter
VOID NPF_BindAdapter(OUT PNDIS_STATUS Status, IN NDIS_HANDLE BindContext, IN PNDIS_STRING DeviceName, IN PVOID SystemSpecific1, IN PVOID SystemSpecific2)
Callback for NDIS BindAdapterHandler. Not used by NPF.
NPF_Cleanup
NTSTATUS NPF_Cleanup(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
Closes an instance of the driver.
NPF_QueryRegistryRoutine
NTSTATUS NPF_QueryRegistryRoutine(IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext)
Function used by NPF_ReadRegistry() to quesry the registry keys associated woth NPF if the driver is ...
__CPU_Private_Data::Buffer
PUCHAR Buffer
Pointer to the kernel buffer used to capture packets.
Definition: Packet.h:212
PINTERNAL_REQUEST
struct _INTERNAL_REQUEST * PINTERNAL_REQUEST
_OPEN_INSTANCE::DumpFileHandle
HANDLE DumpFileHandle
Handle of the file used in dump mode.
Definition: Packet.h:282
PACKET_RESERVED
struct _PACKET_RESERVED PACKET_RESERVED
Contains a NDIS packet.
_INTERNAL_REQUEST::ListElement
LIST_ENTRY ListElement
Used to handle lists of requests.
Definition: Packet.h:164
NPF_ResetComplete
VOID NPF_ResetComplete(IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status)
Ends a reset of the adapter.
NPF_StartUsingBinding
BOOLEAN NPF_StartUsingBinding(IN POPEN_INSTANCE pOpen)
_INTERNAL_REQUEST::RequestStatus
NDIS_STATUS RequestStatus
Definition: Packet.h:169
ADAPTER_UNBOUND
@ ADAPTER_UNBOUND
Definition: Packet.h:329
_INTERNAL_REQUEST::InternalRequestCompletedEvent
NDIS_EVENT InternalRequestCompletedEvent
Definition: Packet.h:167
_OPEN_INSTANCE::NdisWriteCompleteEvent
NDIS_EVENT NdisWriteCompleteEvent
Event that is signalled when all the packets have been successfully sent by NdisSend (and corresponfi...
Definition: Packet.h:318
NPF_CloseBinding
VOID NPF_CloseBinding(IN POPEN_INSTANCE pOpen)
NPF_RequestComplete
VOID NPF_RequestComplete(IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_REQUEST pRequest, IN NDIS_STATUS Status)
Ends an OID request.
NPF_Status
VOID NPF_Status(IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_STATUS Status, IN PVOID StatusBuffer, IN UINT StatusBufferSize)
Callback for NDIS StatusHandler. Not used by NPF.
_OPEN_INSTANCE::WriteEvent
NDIS_EVENT WriteEvent
Event used to synchronize the multiple write process.
Definition: Packet.h:275
PacketHeader
Structure prepended to each packet in the kernel buffer pool.
Definition: Packet.h:341
NPF_Write
NTSTATUS NPF_Write(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
Writes a raw packet to the network.
_OPEN_INSTANCE::MachineLock
NDIS_SPIN_LOCK MachineLock
SpinLock that protects the BPF filter and the TME engine, if in use.
Definition: Packet.h:301
__CPU_Private_Data::Free
ULONG Free
Number of the free bytes in the buffer.
Definition: Packet.h:211
__CPU_Private_Data
Kernel buffer of each CPU.
Definition: Packet.h:207
_OPEN_INSTANCE::AdapterBindingStatus
ULONG AdapterBindingStatus
Specifies if NPF is still bound to the adapter used by this instance, it's unbinding or it's not boun...
Definition: Packet.h:315
NPF_SaveCurrentBuffer
NTSTATUS NPF_SaveCurrentBuffer(POPEN_INSTANCE Open)
Saves the content of the packet buffer to the file associated with current instance.
NPF_ReadRegistry
NTSTATUS NPF_ReadRegistry(IN PWSTR *MacDriverName, IN PWSTR *PacketDriverName, IN PUNICODE_STRING RegistryPath)
Reads the registry keys associated woth NPF if the driver is manually installed via the control panel...
PPACKET_OID_DATA
struct _PACKET_OID_DATA * PPACKET_OID_DATA
__CPU_Private_Data::P
ULONG P
Zero-based index of the producer in the buffer. It indicates the first free byte to be written.
Definition: Packet.h:209
_PACKET_RESERVED
Contains a NDIS packet.
Definition: Packet.h:180
_OPEN_INSTANCE::CpuData
CpuPrivateData CpuData[sizeof(KAFFINITY) *8]
Pool of kernel buffer structures, one for each CPU.
Definition: Packet.h:308
NPF_StopUsingOpenInstance
VOID NPF_StopUsingOpenInstance(IN POPEN_INSTANCE pOpen)
NPF_CreateDevice
BOOLEAN NPF_CreateDevice(IN OUT PDRIVER_OBJECT adriverObjectP, IN PUNICODE_STRING amacNameP)
Creates a device for a given MAC.
_OPEN_INSTANCE::IOStatus
NDIS_STATUS IOStatus
Maintains the status of and OID request call, that will be passed to the application.
Definition: Packet.h:281
_OPEN_INSTANCE::OpenCloseStatus
NTSTATUS OpenCloseStatus
Definition: Packet.h:319
OPEN_INSTANCE
struct _OPEN_INSTANCE OPEN_INSTANCE
Contains the state of a running instance of the NPF driver.
_OPEN_INSTANCE::ResetIrpList
LIST_ENTRY ResetIrpList
List of pending adapter reset requests.
Definition: Packet.h:250
sf_pkthdr
Header associated to a packet in the driver's buffer when the driver is in dump mode....
Definition: Packet.h:121
_OPEN_INSTANCE
Contains the state of a running instance of the NPF driver.
Definition: Packet.h:240
DEVICE_EXTENSION
struct _DEVICE_EXTENSION DEVICE_EXTENSION
Port device extension.
_OPEN_INSTANCE::Nbytes
LARGE_INTEGER Nbytes
Amount of bytes accepted by the filter when this instance is in statistical mode.
Definition: Packet.h:269
sf_pkthdr::len
UINT len
Length of the original packet (off wire).
Definition: Packet.h:126
NPF_StartDump
NTSTATUS NPF_StartDump(POPEN_INSTANCE Open)
Starts dump to file.
ADAPTER_BINDING_STATUS
ADAPTER_BINDING_STATUS
Definition: Packet.h:327
_OPEN_INSTANCE::mode
int mode
Working mode of the driver. See PacketSetMode() for details.
Definition: Packet.h:268
__CPU_Private_Data::TransferMdl1
PMDL TransferMdl1
MDL used to map the portion of the buffer that will contain an incoming packet.
Definition: Packet.h:226
packet_file_header::version_major
USHORT version_major
Libpcap major version.
Definition: Packet.h:109
_OPEN_INSTANCE::DumpLimitReached
BOOLEAN DumpLimitReached
Definition: Packet.h:294
__CPU_Private_Data::Accepted
ULONG Accepted
Definition: Packet.h:213
DriverEntry
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
The initialization routine of the driver.
_OPEN_INSTANCE::MinToCopy
UINT MinToCopy
Definition: Packet.h:263
PacketHeader::SN
ULONG SN
Sequence number of the packet.
Definition: Packet.h:343
__CPU_Private_Data::Dropped
ULONG Dropped
Definition: Packet.h:221
JIT_BPF_Filter
Structure describing a x86 filtering program created by the jitter.
Definition: jitter.h:95
__CPU_Private_Data::TransferMdl2
PMDL TransferMdl2
Second MDL used to map the portion of the buffer that will contain an incoming packet.
Definition: Packet.h:227
__CPU_Private_Data::BufferLock
NDIS_SPIN_LOCK BufferLock
It protects the buffer associated with this CPU.
Definition: Packet.h:225
_OPEN_INSTANCE::MaxDumpBytes
UINT MaxDumpBytes
Definition: Packet.h:289

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2010 CACE Technologies. Copyright (c) 2010-2013 Riverbed Technology. All rights reserved.