/*
* --------------------------------------------------------------------------
* OvsCompleteNBL --
*
* This function tries to free the NBL allocated by OVS buffer
* management module. If it trigger the completion of the parent
* NBL, it will recursively call itself. If it trigger the completion
* of external NBL, it will be returned to the caller. The caller
* is responsible to call API to return to upper layer.
* --------------------------------------------------------------------------
*/
PNET_BUFFER_LIST
OvsCompleteNBL(POVS_SWITCH_CONTEXT context,
PNET_BUFFER_LIST nbl,
BOOLEAN updateRef)
{
POVS_BUFFER_CONTEXT ctx;
UINT16 flags;
PNET_BUFFER_LIST parent;
NDIS_STATUS status;
NDIS_HANDLE poolHandle;
LONG value;
POVS_NBL_POOL ovsPool = &context->ovsPool;
PNET_BUFFER nb;
ctx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl);
ASSERT(ctx && ctx->magic == OVS_CTX_MAGIC);
OVS_LOG_TRACE("Enter: nbl: %p, ctx: %p, refCount: %d, updateRef:%d",
nbl, ctx, ctx->refCount, updateRef);
if (updateRef) {
value = InterlockedDecrement((LONG volatile *)&ctx->refCount);
if (value != 0) {
return NULL;
}
} else {
/*
* This is a special case, the refCount must be zero
*/
ASSERT(ctx->refCount == 0);
}
nb = NET_BUFFER_LIST_FIRST_NB(nbl);
flags = ctx->flags;
if (!(flags & OVS_BUFFER_FRAGMENT) &&
NET_BUFFER_DATA_LENGTH(nb) != ctx->origDataLength) {
UINT32 diff;
if (NET_BUFFER_DATA_LENGTH(nb) < ctx->origDataLength) {
diff = ctx->origDataLength -NET_BUFFER_DATA_LENGTH(nb);
status = NdisRetreatNetBufferListDataStart(nbl, diff, 0,
NULL, NULL);
ASSERT(status == NDIS_STATUS_SUCCESS);
} else {
diff = NET_BUFFER_DATA_LENGTH(nb) - ctx->origDataLength;
NdisAdvanceNetBufferListDataStart(nbl, diff, TRUE, NULL);
}
}
if (ctx->flags & OVS_BUFFER_PRIVATE_CONTEXT) {
NdisFreeNetBufferListContext(nbl, sizeof (OVS_BUFFER_CONTEXT));
}
if (flags & OVS_BUFFER_NEED_COMPLETE) {
/*
* return to caller for completion
*/
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->sysNBLCount);
#endif
return nbl;
}
if (flags & OVS_BUFFER_PRIVATE_FORWARD_CONTEXT) {
context->NdisSwitchHandlers.
FreeNetBufferListForwardingContext(ovsPool->ndisContext, nbl);
}
if (flags & (OVS_BUFFER_PRIVATE_MDL | OVS_BUFFER_PRIVATE_DATA)) {
PNET_BUFFER nb = NET_BUFFER_LIST_FIRST_NB(nbl);
while (nb) {
PMDL mdl = NET_BUFFER_FIRST_MDL(nb);
NET_BUFFER_FIRST_MDL(nb) = NULL;
ASSERT(mdl->Next == NULL);
OvsFreeMDLAndData(mdl);
nb = NET_BUFFER_NEXT_NB(nb);
}
}
if (flags & OVS_BUFFER_PRIVATE_NET_BUFFER) {
PNET_BUFFER nb, nextNb;
nb = NET_BUFFER_LIST_FIRST_NB(nbl);
while (nb) {
nextNb = NET_BUFFER_NEXT_NB(nb);
NdisFreeNetBuffer(nb);
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->nbCount);
#endif
nb = nextNb;
}
NET_BUFFER_LIST_FIRST_NB(nbl) = NULL;
}
parent = nbl->ParentNetBufferList;
poolHandle = NdisGetPoolFromNetBufferList(nbl);
if (flags & OVS_BUFFER_FROM_FIX_SIZE_POOL) {
ASSERT(poolHandle == ovsPool->fixSizePool);
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->fixNBLCount);
#endif
NdisFreeNetBufferList(nbl);
} else if (flags & OVS_BUFFER_FROM_ZERO_SIZE_POOL) {
ASSERT(poolHandle == ovsPool->zeroSizePool);
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->zeroNBLCount);
#endif
NdisFreeNetBufferList(nbl);
} else if (flags & OVS_BUFFER_FROM_NBL_ONLY_POOL) {
ASSERT(poolHandle == ovsPool->nblOnlyPool);
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->nblOnlyCount);
#endif
NdisFreeCloneNetBufferList(nbl, 0);
} else if (flags & OVS_BUFFER_FRAGMENT) {
OVS_LOG_TRACE("Free fragment %p parent %p", nbl, parent);
#ifdef DBG
InterlockedDecrement((LONG volatile *)&ovsPool->fragNBLCount);
#endif
NdisFreeFragmentNetBufferList(nbl, ctx->dataOffsetDelta, 0);
}
if (parent != NULL) {
ctx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(parent);
ASSERT(ctx && ctx->magic == OVS_CTX_MAGIC);
value = InterlockedDecrement((LONG volatile *)&ctx->refCount);
if (value == 0) {
return OvsCompleteNBL(context, parent, FALSE);
}
}
return NULL;
}
/*
* --------------------------------------------------------------------------
* OvsPartialCopyNBL --
*
* Partial copy NBL, if there is multiple NB in NBL, each one will be
* copied. We also reserve headroom for the new NBL.
*
* Please note,
* NBL should have OVS_BUFFER_CONTEXT setup before calling
* this function.
* The NBL should already have ref to itself so that during copy
* it will not be freed.
* --------------------------------------------------------------------------
*/
PNET_BUFFER_LIST
OvsPartialCopyNBL(PVOID ovsContext,
PNET_BUFFER_LIST nbl,
UINT32 copySize,
UINT32 headRoom,
BOOLEAN copyNblInfo)
{
PNET_BUFFER_LIST newNbl;
POVS_SWITCH_CONTEXT context = (POVS_SWITCH_CONTEXT)ovsContext;
NDIS_STATUS status;
PNET_BUFFER srcNb, dstNb;
ULONG byteCopied;
POVS_NBL_POOL ovsPool = &context->ovsPool;
POVS_BUFFER_CONTEXT srcCtx, dstCtx;
UINT16 flags;
srcCtx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(nbl);
if (srcCtx == NULL || srcCtx->magic != OVS_CTX_MAGIC) {
OVS_LOG_INFO("src nbl must have ctx initialized");
ASSERT(srcCtx && srcCtx->magic == OVS_CTX_MAGIC);
return NULL;
}
if (copySize) {
NdisAdvanceNetBufferListDataStart(nbl, copySize, FALSE, NULL);
}
newNbl = NdisAllocateCloneNetBufferList(nbl, ovsPool->nblOnlyPool,
NULL, 0);
if (copySize) {
status = NdisRetreatNetBufferListDataStart(nbl, copySize, 0,
NULL, NULL);
ASSERT(status == NDIS_STATUS_SUCCESS);
}
if (newNbl == NULL) {
return NULL;
}
/*
* Allocate private memory for copy
*/
if (copySize + headRoom) {
status = NdisRetreatNetBufferListDataStart(newNbl, copySize + headRoom,
0, NULL, NULL);
if (status != NDIS_STATUS_SUCCESS) {
goto retreat_error;
}
if (headRoom) {
NdisAdvanceNetBufferListDataStart(newNbl, headRoom, FALSE, NULL);
}
if (copySize) {
srcNb = NET_BUFFER_LIST_FIRST_NB(nbl);
dstNb = NET_BUFFER_LIST_FIRST_NB(newNbl);
while (srcNb) {
status = NdisCopyFromNetBufferToNetBuffer(dstNb, 0, copySize,
srcNb, 0,
&byteCopied);
if (status != NDIS_STATUS_SUCCESS || copySize != byteCopied) {
goto nbl_context_error;
}
srcNb = NET_BUFFER_NEXT_NB(srcNb);
dstNb = NET_BUFFER_NEXT_NB(dstNb);
}
}
}
status = OvsAllocateNBLContext(context, newNbl);
if (status != NDIS_STATUS_SUCCESS) {
goto nbl_context_error;
}
status = OvsCopyNBLInfo(nbl, newNbl, srcCtx, copySize, copyNblInfo);
if (status != NDIS_STATUS_SUCCESS) {
goto copy_list_info_error;
}
#ifdef DBG
InterlockedIncrement((LONG volatile *)&ovsPool->nblOnlyCount);
#endif
newNbl->ParentNetBufferList = nbl;
dstCtx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(newNbl);
ASSERT(dstCtx != NULL);
flags = srcCtx->flags & (OVS_BUFFER_RECV_BUFFER | OVS_BUFFER_SEND_BUFFER);
flags |= OVS_BUFFER_FROM_NBL_ONLY_POOL | OVS_BUFFER_PRIVATE_CONTEXT |
OVS_BUFFER_PRIVATE_FORWARD_CONTEXT;
srcNb = NET_BUFFER_LIST_FIRST_NB(nbl);
OvsInitNBLContext(dstCtx, flags, NET_BUFFER_DATA_LENGTH(srcNb) - copySize,
OVS_DEFAULT_PORT_NO);
InterlockedIncrement((LONG volatile *)&srcCtx->refCount);
#ifdef DBG
OvsDumpNetBufferList(nbl);
OvsDumpForwardingDetails(nbl);
OvsDumpNetBufferList(newNbl);
OvsDumpForwardingDetails(newNbl);
#endif
OVS_LOG_LOUD("Partial Copy new NBL: %p", newNbl);
return newNbl;
copy_list_info_error:
OvsFreeNBLContext(context, newNbl);
nbl_context_error:
if (copySize) {
NdisAdvanceNetBufferListDataStart(newNbl, copySize, TRUE, NULL);
}
retreat_error:
NdisFreeCloneNetBufferList(newNbl, 0);
return NULL;
}
void
NPF_NetworkClassify(
_In_ const FWPS_INCOMING_VALUES* inFixedValues,
_In_ const FWPS_INCOMING_METADATA_VALUES* inMetaValues,
_Inout_opt_ void* layerData,
_In_ const FWPS_FILTER* filter,
_In_ UINT64 flowContext,
_Inout_ FWPS_CLASSIFY_OUT* classifyOut
)
#endif
{
POPEN_INSTANCE GroupOpen;
POPEN_INSTANCE TempOpen;
NTSTATUS status = STATUS_SUCCESS;
UINT32 ipHeaderSize = 0;
UINT32 bytesRetreated = 0;
UINT32 bytesRetreatedEthernet = 0;
INT32 iIPv4 = -1;
INT32 iDrection = -1;
BOOLEAN bSelfSent = FALSE;
PVOID pContiguousData = NULL;
NET_BUFFER* pNetBuffer = 0;
UCHAR pPacketData[ETHER_HDR_LEN];
PNET_BUFFER_LIST pNetBufferList = (NET_BUFFER_LIST*) layerData;
COMPARTMENT_ID compartmentID = UNSPECIFIED_COMPARTMENT_ID;
FWPS_PACKET_INJECTION_STATE injectionState = FWPS_PACKET_INJECTION_STATE_MAX;
#if(NTDDI_VERSION >= NTDDI_WIN7)
UNREFERENCED_PARAMETER(classifyContext);
#endif
UNREFERENCED_PARAMETER(filter);
UNREFERENCED_PARAMETER(flowContext);
// Make the default action.
if (classifyOut->rights & FWPS_RIGHT_ACTION_WRITE)
classifyOut->actionType = FWP_ACTION_CONTINUE;
#if(NTDDI_VERSION >= NTDDI_WIN7)
// Filter out fragment packets and reassembled packets.
if (inMetaValues->currentMetadataValues & FWPS_METADATA_FIELD_FRAGMENT_DATA)
{
return;
}
if (inMetaValues->currentMetadataValues & FWP_CONDITION_FLAG_IS_REASSEMBLED)
{
return;
}
#endif
TRACE_ENTER();
// Get the packet protocol (IPv4 or IPv6) and the direction (Inbound or Outbound).
if (inFixedValues->layerId == FWPS_LAYER_OUTBOUND_IPPACKET_V4 || inFixedValues->layerId == FWPS_LAYER_INBOUND_IPPACKET_V4)
{
iIPv4 = 1;
}
else // if (inFixedValues->layerId == FWPS_LAYER_OUTBOUND_IPPACKET_V6 || inFixedValues->layerId == FWPS_LAYER_INBOUND_IPPACKET_V6)
{
iIPv4 = 0;
}
if (inFixedValues->layerId == FWPS_LAYER_OUTBOUND_IPPACKET_V4 || inFixedValues->layerId == FWPS_LAYER_OUTBOUND_IPPACKET_V6)
{
iDrection = 0;
}
else // if (inFixedValues->layerId == FWPS_LAYER_INBOUND_IPPACKET_V4 || inFixedValues->layerId == FWPS_LAYER_INBOUND_IPPACKET_V6)
{
iDrection = 1;
}
if (inMetaValues->currentMetadataValues & FWPS_METADATA_FIELD_IP_HEADER_SIZE)
{
ipHeaderSize = inMetaValues->ipHeaderSize;
}
injectionState = FwpsQueryPacketInjectionState(iIPv4 ? g_InjectionHandle_IPv4 : g_InjectionHandle_IPv6,
pNetBufferList,
NULL);
if (injectionState == FWPS_PACKET_INJECTED_BY_SELF ||
injectionState == FWPS_PACKET_PREVIOUSLY_INJECTED_BY_SELF)
{
TRACE_MESSAGE(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: this packet is injected by ourself, let it go\n");
TRACE_EXIT();
return;
}
// Inbound: Initial offset is at the Transport Header, so retreat the size of the Ethernet Header and IP Header.
// Outbound: Initial offset is at the IP Header, so just retreat the size of the Ethernet Header.
// We retreated the packet in two phases: 1) retreat the IP Header (if has), 2) clone the packet and retreat the Ethernet Header.
// We must NOT retreat the Ethernet Header on the original packet, or this will lead to BAD_POOL_CALLER Bluescreen.
bytesRetreated = iDrection ? ipHeaderSize : 0;
status = NdisRetreatNetBufferListDataStart(pNetBufferList,
bytesRetreated,
0,
NULL,
NULL);
if (status != STATUS_SUCCESS)
{
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: NdisRetreatNetBufferListDataStart(bytesRetreated) [status: %#x]\n",
status);
TRACE_EXIT();
return;
}
//bSelfSent = NPF_IsPacketSelfSent(pNetBufferList, (BOOLEAN)iIPv4);
bSelfSent = (iDrection == 0) ? FALSE : NPF_IsPacketSelfSent(pNetBufferList, (BOOLEAN) iIPv4);
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: %#x]\n",
bSelfSent);
if (bSelfSent)
{
NdisAdvanceNetBufferListDataStart(pNetBufferList,
iIPv4 ? IP_HDR_LEN : IPV6_HDR_LEN,
FALSE,
0);
}
// Here if this NBL is sent by ourself, we will clone it starting from IP header and inject it into Network Layer send path.
if (bSelfSent)
{
PNET_BUFFER_LIST pClonedNetBufferList_Injection;
status = FwpsAllocateCloneNetBufferList(pNetBufferList, NULL, NULL, 0, &pClonedNetBufferList_Injection);
if (status != STATUS_SUCCESS)
{
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: FwpsAllocateCloneNetBufferList(pClonedNetBufferList_Injection) [status: %#x]\n",
status);
goto Exit_WSK_IP_Retreated;
}
if (FWPS_IS_METADATA_FIELD_PRESENT(inMetaValues,
FWPS_METADATA_FIELD_COMPARTMENT_ID))
compartmentID = (COMPARTMENT_ID)inMetaValues->compartmentId;
// This cloned NBL will be freed in NPF_NetworkInjectionComplete function.
status = FwpsInjectNetworkSendAsync(iIPv4 ? g_InjectionHandle_IPv4 : g_InjectionHandle_IPv6,
NULL,
0,
compartmentID,
pClonedNetBufferList_Injection,
NPF_NetworkInjectionComplete,
NULL);
if (status != STATUS_SUCCESS)
{
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: FwpsInjectNetworkSendAsync() [status: %#x]\n",
status);
FwpsFreeCloneNetBufferList(pClonedNetBufferList_Injection, 0);
goto Exit_WSK_IP_Retreated;
}
// We have successfully re-inject the cloned NBL, so remove this one.
classifyOut->actionType = FWP_ACTION_BLOCK;
classifyOut->flags |= FWPS_CLASSIFY_OUT_FLAG_ABSORB;
classifyOut->rights ^= FWPS_RIGHT_ACTION_WRITE;
}
// We clone this NBL again, for packet reading operation.
PNET_BUFFER_LIST pClonedNetBufferList;
status = FwpsAllocateCloneNetBufferList(pNetBufferList, NULL, NULL, 0, &pClonedNetBufferList);
if (status != STATUS_SUCCESS)
{
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: FwpsAllocateCloneNetBufferList() [status: %#x]\n",
status);
goto Exit_WSK_IP_Retreated;
}
bytesRetreatedEthernet = g_DltNullMode ? DLT_NULL_HDR_LEN : ETHER_HDR_LEN;
status = NdisRetreatNetBufferListDataStart(pClonedNetBufferList,
bytesRetreatedEthernet,
0,
0,
0);
if (status != STATUS_SUCCESS)
{
bytesRetreatedEthernet = 0;
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: NdisRetreatNetBufferListDataStart(bytesRetreatedEthernet) [status: %#x]\n",
status);
goto Exit_Packet_Cloned;
}
pNetBuffer = NET_BUFFER_LIST_FIRST_NB(pClonedNetBufferList);
while (pNetBuffer)
{
pContiguousData = NdisGetDataBuffer(pNetBuffer,
bytesRetreatedEthernet,
pPacketData,
1,
0);
if (!pContiguousData)
{
status = STATUS_UNSUCCESSFUL;
TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
"NPF_NetworkClassify: NdisGetDataBuffer() [status: %#x]\n",
status);
goto Exit_Ethernet_Retreated;
}
else
{
if (g_DltNullMode)
{
((PDLT_NULL_HEADER) pContiguousData)->null_type = iIPv4 ? DLTNULLTYPE_IP : DLTNULLTYPE_IPV6;
}
else
{
RtlZeroMemory(pContiguousData, ETHER_ADDR_LEN * 2);
((PETHER_HEADER) pContiguousData)->ether_type = iIPv4 ? RtlUshortByteSwap(ETHERTYPE_IP) : RtlUshortByteSwap(ETHERTYPE_IPV6);
}
}
pNetBuffer = pNetBuffer->Next;
}
// Send the loopback packets data to the user-mode code.
if (g_LoopbackOpenGroupHead)
{
//get the 1st group adapter child
GroupOpen = g_LoopbackOpenGroupHead->GroupNext;
}
else
{
// Should not come here
GroupOpen = NULL;
}
while (GroupOpen != NULL)
{
TempOpen = GroupOpen;
if (TempOpen->AdapterBindingStatus == ADAPTER_BOUND)
{
//let every group adapter receive the packets
NPF_TapExForEachOpen(TempOpen, pClonedNetBufferList);
}
GroupOpen = TempOpen->GroupNext;
}
Exit_Ethernet_Retreated:
// Advance the offset back to the original position.
NdisAdvanceNetBufferListDataStart(pClonedNetBufferList,
bytesRetreatedEthernet,
FALSE,
0);
Exit_Packet_Cloned:
FwpsFreeCloneNetBufferList(pClonedNetBufferList, 0);
Exit_WSK_IP_Retreated:
if (bSelfSent)
{
status = NdisRetreatNetBufferListDataStart(pNetBufferList,
iIPv4 ? IP_HDR_LEN : IPV6_HDR_LEN,
0,
NULL,
NULL);
// if (status != STATUS_SUCCESS)
// {
// TRACE_MESSAGE1(PACKET_DEBUG_LOUD,
// "NPF_NetworkClassify: NdisRetreatNetBufferListDataStart(IP_HDR_LEN) [status: %#x]\n",
// status);
//
// goto Exit_IP_Retreated;
// }
}
/*Exit_IP_Retreated:*/
NdisAdvanceNetBufferListDataStart(pNetBufferList,
bytesRetreated,
FALSE,
0);
// // print "protocol, direction, fragment, reassembled" info for the current packet.
//
// int iFragment = -1;
// if (inMetaValues->currentMetadataValues & FWPS_METADATA_FIELD_FRAGMENT_DATA)
// {
// iFragment = 1;
// }
// else
// {
// iFragment = 0;
// }
//
// int iReassembled = -1;
// if (inMetaValues->currentMetadataValues & FWP_CONDITION_FLAG_IS_REASSEMBLED)
// {
// iReassembled = 1;
// }
// else
// {
// iReassembled = 0;
// }
// IF_LOUD(DbgPrint("\n\nNPF_NetworkClassify: Loopback packet found !!! protocol=[%d] (ipv4=0, ipv6=1), direction=[%d] (out=0, in=1), fragment=[%d], reassembled=[%d]\n", iProtocol, iDrection, iFragment, iReassembled);)
TRACE_EXIT();
return;
}