代码.rar_WFP流量转发_wfp_流量监控_流量监控系统_网络监控系统

/*++ Copyright (c) Microsoft Corporation. All rights reserved Abstract: MSN monitor sample driver callout routines Environment: Kernel mode --*/ #include "ntddk.h" #include "ntstrsafe.h" #include "fwpmk.h" #pragma warning(push) #pragma warning(disable:4201) // unnamed struct/union #include "fwpsk.h" #pragma warning(pop) #include "ioctl.h" #include "datamntr.h" #include "ctl.h" #include "notify.h" #include "process.h" #define INITGUID #define TAG_NAME_NOTIFY 'oNnM' #include <guiddef.h> #include "mntrguid.h" PKEVENT g_eDataEven = NULL;//事件--绑定数据 HANDLE g_hBindProcessHandle;//句柄 PKEVENT g_eProcessEven = NULL;//事件--进程数据 HANDLE g_hProcessHandle;//句柄 #define NO_ERROR STATUS_SUCCESS #define MONITOR_FLOW_ESTABLISHED_CALLOUT_DESCRIPTION L"Data Monitor Flow Established Callout" #define MONITOR_FLOW_ESTABLISHED_CALLOUT_NAME L"Flow Established Callout" #define MONITOR_STREAM_CALLOUT_DESCRIPTION L"Data Monitor Stream Callout" #define MONITOR_STREAM_CALLOUT_NAME L"Stream Callout" // // Software Tracing Definitions // #define WPP_CONTROL_GUIDS \ WPP_DEFINE_CONTROL_GUID(MsnMntrMonitor,(dd65554d, 9925, 49d1, 83b6, 46125feb4207), \ WPP_DEFINE_BIT(TRACE_FLOW_ESTABLISHED) \ WPP_DEFINE_BIT(TRACE_STATE_CHANGE) \ WPP_DEFINE_BIT(TRACE_LAYER_NOTIFY) ) #include "datamntr.tmh" #define TAG_NAME_CALLOUT 'CnoM' #define TAG_NAME_BINDDATA 'BinM' UINT32 g_uFlowEstablishedId = 0; UINT32 g_uStreamId = 0; LIST_ENTRY g_lFlowContextList; //数据流链表，用于存放数据在层直接传播 KSPIN_LOCK g_kFlowContextListLock;//线程锁 LIST_ENTRY g_lBindDataToProcessList; //存放数据，将进程，端口，流量等绑定在一起 KSPIN_LOCK g_kBindDataListLock;//绑定数据线程锁 UINT64 g_uEstablishedFilter = 0; //Filer层的 ID UINT64 g_uStreamFilter = 0; // Filer 层Stream ID HANDLE g_hEngineHandle = NULL; //WFP句柄 //UINT32 g_uAleRecvAcceptCalloutId = 0; //UINT64 g_uAleConnectFilterId = 0; NTSTATUS MonitorCoFlowEstablishedNotifyV4( IN FWPS_CALLOUT_NOTIFY_TYPE notifyType, IN const GUID* filterKey, IN const FWPS_FILTER* filter); NTSTATUS MonitorCoStreamNotifyV4( IN FWPS_CALLOUT_NOTIFY_TYPE notifyType, IN const GUID* filterKey, IN const FWPS_FILTER* filter); VOID MonitorCoStreamFlowDeletion( IN UINT16 layerId, IN UINT32 calloutId, IN UINT64 flowContext); #if(NTDDI_VERSION >= NTDDI_WIN7) NTSTATUS MonitorCoFlowEstablishedCalloutV4( IN const FWPS_INCOMING_VALUES* inFixedValues, IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues, IN VOID* packet, IN const void* classifyContext, IN const FWPS_FILTER* filter, IN UINT64 flowContext, OUT FWPS_CLASSIFY_OUT* classifyOut); #else if(NTDDI_VERSION < NTDDI_WIN7) NTSTATUS MonitorCoFlowEstablishedCalloutV4( IN const FWPS_INCOMING_VALUES* inFixedValues, IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues, IN VOID* packet, IN const FWPS_FILTER* filter, IN UINT64 flowContext, OUT FWPS_CLASSIFY_OUT* classifyOut); #endif #if(NTDDI_VERSION >= NTDDI_WIN7) NTSTATUS MonitorCoStreamCalloutV4( IN const FWPS_INCOMING_VALUES* inFixedValues, IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues, IN VOID* packet, IN const void* classifyContext, IN const FWPS_FILTER* filter, IN UINT64 flowContext, OUT FWPS_CLASSIFY_OUT* classifyOut); #else if(NTDDI_VERSION < NTDDI_WIN7) NTSTATUS MonitorCoStreamCalloutV4( IN const FWPS_INCOMING_VALUES* inFixedValues, IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues, IN VOID* packet, IN const FWPS_FILTER* filter, IN UINT64 flowContext, OUT FWPS_CLASSIFY_OUT* classifyOut); #endif DWORD MonitorAppRemoveCallouts() /*++ Routine Description: Sets the kernel callout ID's through the MSN monitor device Arguments: [in] HANDLE monitorDevice - MSN Monitor device [in] CALLOUTS* callouts - Callout structure with ID's set [in] DWORD size - Size of the callout structure. Return Value: NO_ERROR or a specific DeviceIoControl result. --*/ { DWORD result = 0; DbgPrint("Starting Transaction for Removing callouts\n"); // result = FwpmTransactionBegin(g_hEngineHandle, 0); // if (NO_ERROR != result) // { // goto abort; // } //DbgPrint("Successfully started the Transaction\n"); if (0 == g_hEngineHandle)//句柄为空，退出 goto cleanup; result = FwpmFilterDeleteById(g_hEngineHandle, g_uEstablishedFilter); //result = FwpmFilterDeleteByKey(g_hEngineHandle, &FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4); if (NO_ERROR != result) { goto abort;//DATA_MONITOR_SUBLAYER } g_uEstablishedFilter = 0; DbgPrint("Deleting Stream Filter\n"); result = FwpmFilterDeleteById(g_hEngineHandle, g_uStreamFilter); if (NO_ERROR != result) { goto abort; } g_uStreamFilter = 0; DbgPrint("Deleting Stream SubLayer\n"); result = FwpmSubLayerDeleteByKey(g_hEngineHandle, &DATA_MONITOR_SUBLAYER); if (NO_ERROR != result) { goto abort; } DbgPrint("Deleting Flow Established callout\n"); result = FwpmCalloutDeleteByKey(g_hEngineHandle, &DATA_MONITOR_FLOW_ESTABLISHED_CALLOUT_V4); if (NO_ERROR != result) { goto abort; } DbgPrint("Successfully Deleted Flow Established callout\n"); DbgPrint("Deleting Stream callout\n"); result = FwpmCalloutDeleteByKey(g_hEngineHandle, &DATA_MONITOR_STREAM_CALLOUT_V4); if (NO_ERROR != result) { goto abort; } DbgPrint("Successfully Deleted Stream callout\n"); DbgPrint("FwpsCalloutUnregisterById FlowEstablishedId\n"); result = FwpsCalloutUnregisterById(g_uFlowEstablishedId); if (NO_ERROR != result) { goto abort; } g_uFlowEstablishedId = 0; DbgPrint("FwpsCalloutUnregisterById StreamId\n"); result = FwpsCalloutUnregisterById(g_uStreamId); if (NO_ERROR != result) { goto abort; } g_uStreamId = 0; goto cleanup; abort: //DbgPrint("Aborting Transaction\n"); //result = FwpmTransactionAbort(engineHandle); //if (NO_ERROR == result) { // DbgPrint("Successfully Aborted Transaction.\n"); } cleanup: if (g_hEngineHandle) { FwpmEngineClose(g_hEngineHandle); } return result; } DWORD MonitorAppAddCallouts() /*++ Routine Description: Adds the callouts during installation Arguments: [in] HANDLE engineHandle - Engine handle. Return Value: NO_ERROR or a specific FWP result. --*/ { FWPM_CALLOUT callout; DWORD result; FWPM_DISPLAY_DATA displayData; DbgPrint("Successfully started the Transaction\n"); RtlZeroMemory(&callout, sizeof(FWPM_CALLOUT)); displayData.description = MONITOR_FLOW_ESTABLISHED_CALLOUT_DESCRIPTION; displayData.name = MONITOR_FLOW_ESTABLISHED_CALLOUT_NAME; callout.calloutKey = DATA_MONITOR_FLOW_ESTABLISHED_CALLOUT_V4; callout.displayData = displayData; callout.applicableLayer = FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4; //callout.flags = FWPM_CALLOUT_FLAG_PERSISTENT; // Make this a persistent callout. DbgPrint("Adding Persistent Flow Established callout through the Filtering Engine\n"); result = FwpmCalloutAdd(g_hEngineHandle, &callout, NULL, NULL); if (NO_ERROR != result) { DbgPrint("Aborting Transaction %x\n", result); goto abort; } DbgPrint("Successfully Added Persistent Flow Established callout.\n"); RtlZeroMemory(&callout, sizeof(FWPM_CALLOUT)); displayData.description = MONITOR_STREAM_CALLOUT_DESCRIPTION; displayData.name = MONITOR_STREAM_CALLOUT_DESCRIPTION; callout.calloutKey = DATA_MONITOR_STREAM_CALLOUT_V4; callout.displayData = displayData; callout.applicableLayer = FWPM_LAYER_STREAM_V4; //callout.flags = FWPM_CALLOUT_FLAG_PERSISTENT; // Make this a persistent callout. DbgPrint("Adding Persistent Stream callout through the Filtering Engine\n"); result = FwpmCalloutAdd(g_hEng