VOID
DriverUnload(
IN PDRIVER_OBJECT driverObject
)
{
NTSTATUS status;
PVOID threadObj;
KLOCK_QUEUE_HANDLE connListLockHandle;
KLOCK_QUEUE_HANDLE packetQueueLockHandle;
UNREFERENCED_PARAMETER(driverObject);
KeAcquireInStackQueuedSpinLock(
&gConnListLock,
&connListLockHandle
);
KeAcquireInStackQueuedSpinLock(
&gPacketQueueLock,
&packetQueueLockHandle
);
gDriverUnloading = TRUE;
KeReleaseInStackQueuedSpinLock(&packetQueueLockHandle);
KeReleaseInStackQueuedSpinLock(&connListLockHandle);
if (IsListEmpty(&gConnList) && IsListEmpty(&gPacketQueue))
{
KeSetEvent(
&gWorkerEvent,
IO_NO_INCREMENT,
FALSE
);
}
ASSERT(gThreadObj != NULL);
KeWaitForSingleObject(
gThreadObj,
Executive,
KernelMode,
FALSE,
NULL
);
ObDereferenceObject(gThreadObj);
TLInspectUnregisterCallouts();
FwpsInjectionHandleDestroy0(gInjectionHandle);
IoDeleteDevice(gDeviceObject);
ZwClose(gRegistryKey);
}
VOID DriverUnload(
IN PDRIVER_OBJECT driverObject)
{
UNICODE_STRING dosDeviceName;
UNREFERENCED_PARAMETER(driverObject);
// set the unloading marker
{
KLOCK_QUEUE_HANDLE packetQueueLockHandle;
KeAcquireInStackQueuedSpinLock(
&gPacketQueueLock,
&packetQueueLockHandle
);
gDriverUnloading = TRUE;
KeReleaseInStackQueuedSpinLock(&packetQueueLockHandle);
}
CleanupFlowContextList();
if (IsListEmpty(&gPacketQueue))
{
KeSetEvent(
&gWorkerEvent,
IO_NO_INCREMENT,
FALSE);
}
ASSERT(gThreadObj != NULL);
KeWaitForSingleObject(
gThreadObj,
Executive,
KernelMode,
FALSE,
NULL);
ObDereferenceObject(gThreadObj);
UnregisterCallouts();
NdisFreeNetBufferListPool(gNetBufferListPool);
NdisFreeGenericObject(gNdisGenericObj);
FwpsInjectionHandleDestroy0(gInjectionHandle);
RtlInitUnicodeString(&dosDeviceName, SYMBOLIC_LINK_NAME);
IoDeleteSymbolicLink(&dosDeviceName);
IoDeleteDevice(gDeviceObject);
}
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT driverObject,
IN PUNICODE_STRING registryPath
)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING deviceName;
HANDLE threadHandle;
DDProxyLoadConfig(registryPath);
//
// To proxy UDP traffic, a new destination port or a pair of inspect and
// proxy ip address need to be pre-configured. To proxy UDP traffic, a
// pair of inspect and proxy ip addresses must be pre-configured.
//
if (configInspectUdp)
{
if ((configInspectDestPort == configNewDestPort) &&
(((configInspectDestAddrV4 == NULL) ||
(configNewDestAddrV4 == NULL)) &&
((configInspectDestAddrV6 == NULL) ||
(configNewDestAddrV6 == NULL))))
{
status = STATUS_DEVICE_CONFIGURATION_ERROR;
goto Exit;
}
}
else
{
if (((configInspectDestAddrV4 == NULL) ||
(configNewDestAddrV4 == NULL)) &&
((configInspectDestAddrV6 == NULL) ||
(configNewDestAddrV6 == NULL)))
{
status = STATUS_DEVICE_CONFIGURATION_ERROR;
goto Exit;
}
}
RtlInitUnicodeString(
&deviceName,
L"\\Device\\StreamEitor"
);
status = IoCreateDevice(
driverObject,
0,
&deviceName,
FILE_DEVICE_NETWORK,
0,
FALSE,
&gDeviceObject
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = FwpsInjectionHandleCreate0(
AF_UNSPEC,
FWPS_INJECTION_TYPE_TRANSPORT,
&gInjectionHandle
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
InitializeListHead(&gFlowList);
KeInitializeSpinLock(&gFlowListLock);
InitializeListHead(&gPacketQueue);
KeInitializeSpinLock(&gPacketQueueLock);
KeInitializeEvent(
&gPacketQueueEvent,
NotificationEvent,
FALSE
);
status = DDProxyRegisterCallouts(
gDeviceObject
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = PsCreateSystemThread(
&threadHandle,
THREAD_ALL_ACCESS,
NULL,
NULL,
NULL,
DDProxyWorker,
NULL
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = ObReferenceObjectByHandle(
threadHandle,
0,
NULL,
KernelMode,
&gThreadObj,
NULL
);
ASSERT(NT_SUCCESS(status));
ZwClose(threadHandle);
driverObject->DriverUnload = DriverUnload;
Exit:
if (!NT_SUCCESS(status))
{
if (gEngineHandle != NULL)
{
DDProxyUnregisterCallouts();
}
if (gInjectionHandle != NULL)
{
FwpsInjectionHandleDestroy0(gInjectionHandle);
}
if (gDeviceObject)
{
IoDeleteDevice(gDeviceObject);
}
}
return status;
}
VOID
DriverUnload(
IN PDRIVER_OBJECT driverObject
)
{
NTSTATUS status;
PVOID threadObj;
KLOCK_QUEUE_HANDLE packetQueueLockHandle;
KLOCK_QUEUE_HANDLE flowListLockHandle;
UNREFERENCED_PARAMETER(driverObject);
UNREFERENCED_PARAMETER(status);
UNREFERENCED_PARAMETER(threadObj);
KeAcquireInStackQueuedSpinLock(
&gPacketQueueLock,
&packetQueueLockHandle
);
KeAcquireInStackQueuedSpinLock(
&gFlowListLock,
&flowListLockHandle
);
gDriverUnloading = TRUE;
KeReleaseInStackQueuedSpinLock(&flowListLockHandle);
//
// Any associated flow contexts must be removed before
// a callout can be successfully unregistered.
//
DDProxyRemoveFlows();
if (IsListEmpty(&gPacketQueue))
{
KeSetEvent(
&gPacketQueueEvent,
IO_NO_INCREMENT,
FALSE
);
}
KeReleaseInStackQueuedSpinLock(&packetQueueLockHandle);
ASSERT(gThreadObj != NULL);
KeWaitForSingleObject(
gThreadObj,
Executive,
KernelMode,
FALSE,
NULL
);
ObDereferenceObject(gThreadObj);
DDProxyUnregisterCallouts();
FwpsInjectionHandleDestroy0(gInjectionHandle);
IoDeleteDevice(gDeviceObject);
}
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT driverObject,
IN PUNICODE_STRING registryPath
)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING deviceName;
HANDLE threadHandle;
//TLInspectLoadConfig(registryPath);
/*
if ((configInspectRemoteAddrV4 == NULL) &&
(configInspectRemoteAddrV6 == NULL))
{
status = STATUS_DEVICE_CONFIGURATION_ERROR;
goto Exit;
}
*/
RtlInitUnicodeString(
&deviceName,
L"\\Device\\StreamEitor"
);
status = IoCreateDevice(
driverObject,
0,
&deviceName,
FILE_DEVICE_NETWORK,
0,
FALSE,
&gDeviceObject
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = FwpsInjectionHandleCreate0(
AF_UNSPEC,
FWPS_INJECTION_TYPE_TRANSPORT,
&gInjectionHandle
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
InitializeListHead(&gConnList);
KeInitializeSpinLock(&gConnListLock);
InitializeListHead(&gPacketQueue);
KeInitializeSpinLock(&gPacketQueueLock);
KeInitializeEvent(
&gWorkerEvent,
NotificationEvent,
FALSE
);
status = TLInspectRegisterCallouts(
gDeviceObject
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = PsCreateSystemThread(
&threadHandle,
THREAD_ALL_ACCESS,
NULL,
NULL,
NULL,
TLInspectWorker,
NULL
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = ObReferenceObjectByHandle(
threadHandle,
0,
NULL,
KernelMode,
&gThreadObj,
NULL
);
ASSERT(NT_SUCCESS(status));
ZwClose(threadHandle);
driverObject->DriverUnload = DriverUnload;
Exit:
if (!NT_SUCCESS(status))
{
if (gEngineHandle != NULL)
{
TLInspectUnregisterCallouts();
}
if (gInjectionHandle != NULL)
{
FwpsInjectionHandleDestroy0(gInjectionHandle);
}
if (gDeviceObject)
{
IoDeleteDevice(gDeviceObject);
}
ZwClose(gRegistryKey);
}
return status;
}
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT driverObject,
IN PUNICODE_STRING registryPath)
{
NTSTATUS status = STATUS_SUCCESS;
NTSTATUS symbolicLinkCreationStatus = STATUS_SUCCESS;
UNICODE_STRING deviceName;
UNICODE_STRING dosDeviceName;
HANDLE threadHandle;
NET_BUFFER_LIST_POOL_PARAMETERS nblPoolParams = {0};
UNICODE_STRING defaultSDDLString;
#ifdef DEBUG
DbgBreakPoint();
#endif
status = drvCtlInit(driverObject);
if (!NT_SUCCESS(status))
{
goto Exit;
}
gDriverUnloading = FALSE;
RtlInitUnicodeString(&defaultSDDLString, L"D:P(A;;GA;;;BU)");
RtlInitUnicodeString(&deviceName, DEVICE_NAME);
status = IoCreateDeviceSecure(
driverObject,
0,
&deviceName,
FILE_DEVICE_NETWORK,
0,
FALSE,
&defaultSDDLString,
NULL,
&gDeviceObject);
if (!NT_SUCCESS(status))
{
goto Exit;
}
RtlInitUnicodeString(&dosDeviceName, SYMBOLIC_LINK_NAME);
status = IoCreateSymbolicLink(&dosDeviceName, &deviceName);
symbolicLinkCreationStatus = status;
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = FwpsInjectionHandleCreate0(
AF_UNSPEC,
FWPS_INJECTION_TYPE_STREAM,
&gInjectionHandle);
if (!NT_SUCCESS(status))
{
goto Exit;
}
gNdisGenericObj = NdisAllocateGenericObject(
driverObject,
TAG_NDIS_OBJ,
0);
if (gNdisGenericObj == NULL)
{
status = STATUS_NO_MEMORY;
goto Exit;
}
nblPoolParams.Header.Type = NDIS_OBJECT_TYPE_DEFAULT;
nblPoolParams.Header.Revision =
NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
nblPoolParams.Header.Size =
NDIS_SIZEOF_NET_BUFFER_LIST_POOL_PARAMETERS_REVISION_1;
nblPoolParams.fAllocateNetBuffer = TRUE;
nblPoolParams.DataSize = 0;
nblPoolParams.PoolTag = TAG_NBL_POOL;
gNetBufferListPool = NdisAllocateNetBufferListPool(
gNdisGenericObj,
&nblPoolParams);
if(gNetBufferListPool == NULL)
{
status = STATUS_NO_MEMORY;
goto Exit;
}
InitializeListHead(&gPacketQueue);
KeInitializeSpinLock(&gPacketQueueLock);
InitializeListHead(&flowContextList);
KeInitializeSpinLock(&flowContextListLock);
KeInitializeEvent(
&gWorkerEvent,
NotificationEvent,
FALSE
);
status = RegisterCallouts(gDeviceObject);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = PsCreateSystemThread(
&threadHandle,
THREAD_ALL_ACCESS,
NULL,
NULL,
NULL,
thAnalyzer,
NULL);
if (!NT_SUCCESS(status))
{
goto Exit;
}
status = ObReferenceObjectByHandle(
threadHandle,
0,
NULL,
KernelMode,
(PVOID*) &gThreadObj,
NULL);
ASSERT(NT_SUCCESS(status));
KeSetBasePriorityThread(
(PKTHREAD) gThreadObj,
-2);
ZwClose(threadHandle);
driverObject->DriverUnload = DriverUnload;
Exit:
if (!NT_SUCCESS(status))
{
if (gFwpmEngineHandle != NULL)
{
UnregisterCallouts();
}
if (gInjectionHandle != NULL)
{
FwpsInjectionHandleDestroy0(gInjectionHandle);
}
if (gDeviceObject)
{
IoDeleteDevice(gDeviceObject);
}
if(NT_SUCCESS(symbolicLinkCreationStatus))
{
IoDeleteSymbolicLink(&dosDeviceName);
}
if (gNetBufferListPool != NULL)
{
NdisFreeNetBufferListPool(gNetBufferListPool);
}
if (gNdisGenericObj != NULL)
{
NdisFreeGenericObject(gNdisGenericObj);
}
}
return status;
}