ndis6.0 NetBufferSend

FilterSendNetBufferListsComplete：

NDIS calls the FilterSendNetBufferListsComplete function to complete a send request that a filter driver started by calling the NdisFSendNetBufferLists function.

FilterSendNetBufferLists：

NDIS calls the FilterSendNetBufferLists function to allow a filter driver to filter a linked list of NET_BUFFER_LISTstructures.

 

调用关系如下:

ndis6.0中NET_BUFFER_LIST和NET_BUFFER是两个很重要的数据结构。

如何在FilterSendNetBufferLists函数中读取数据包的内容呢,步骤如下:

1.pCurrentNetBuffer = NET_BUFFER_LIST_FIRST_NB(CurrNbl)

2.pMdl = NET_BUFFER_CURRENT_MDL(pCurrentNetBuffer)

3.NdisQueryMdl(
        pMdl,
        &pEthHeader,
        &ulBufferLength,
        NormalPagePriority);可以获得Mdl的地址指针保存在pEthHeader中，同时返回MDL内存块的大小ulBufferLength。

4.pEthHeader = (struct ether_header *)((PUCHAR)pEthHeader + NET_BUFFER_CURRENT_MDL_OFFSET(pCurrentNetBuffer))，这样pEthHeader 即指向我们熟悉的数据帧了(包含以太头+TCP/IP层头部)。

 

在获取数据包的过程中需要注意的是:

1).一个NET_BUFFER_LIST结构指向的是一连串的NET_BUFFER,这些NET_BUFFER中保存的数据包内容属于同一个stream(the same src-ip,dst-ip,src-port,dst-port and protocol)。通过NET_BUFFER_NEXT_NB(pCurrentNetBuffer)可以获取下一个NET_BUFFER。

2).在NET_BUFFER中包含NET_BUFFER_DATA结构

typedef struct _NET_BUFFER_DATA {
  PNET_BUFFER   Next;
  PMDL   MdlChain;
  ULONG   DataLength;
  ULONG   DataOffset;
  PMDL   CurrentMdl;
  ULONG   CurrentMdlOffset;
} NET_BUFFER_DATA, *PNET_BUFFER_DATA;

数据包的内容保存在MDL中，在上面的步骤2和3中，可通过NET_BUFFER信息获取到保存数据包内容的地址。因为MDL指示的那一块内存会有一个MDL头部信息（我并不确定），所以需要用pEthHeader + NET_BUFFER_CURRENT_MDL_OFFSET(pCurrentNetBuffer)，这时才指向真正意义上的数据包内容。

3).一个NET_BUFFER因为MDL指向的内存大小有限制（我的观察是100个字节左右），所以一个NET_BUFFER会含有多个MDL(如一个1000字节的数据包，可能就会分为10个MDL进行保存)，用MdlChain表示（即一个Mdl链表）。

4).通常情况下，NET_BUFFER中MdlChain与NET_BUFFER_CURRENT_MDL(pCurrentNetBuffer)获取到的CurrentMdl相同，同样的NET_BUFFER_CURRENT_MDL_OFFSET(pCurrentNetBuffer)与NET_BUFFER中DataOffset相同。

5).NET_BUFFER中DataLength代表数据包的总长度。在上面的步骤3中，获取到的ulBufferLength - NET_BUFFER_CURRENT_MDL(pCurrentNetBuffer)，若所得值小于DataLength，则说明NET_BUFFER中含有多个MDL，若想获取完整包的信息则通过pMdl.next获取下一个MDL指针，在进行相关操作。

 

下面是我改写filter中FilterSendNetBufferLists函数的 代码：

 

VOID
FilterSendNetBufferLists(
        IN  NDIS_HANDLE         FilterModuleContext,
        IN  PNET_BUFFER_LIST    NetBufferLists,
        IN  NDIS_PORT_NUMBER    PortNumber,
        IN  ULONG               SendFlags
        )
/*++
 
Routine Description:

    Send Net Buffer List handler
    This function is an optional function for filter drivers. If provided, NDIS
    will call this function to transmit a linked list of NetBuffers, described by a 
    NetBuferList, over the network. If this handler is NULL, NDIS will skip calling
    this fitler when sending a NetBufferList and will call the next lower fitler 
    in the stack with a non_NULL FilterSendNetBufferList handleror the miniport driver.
    A filter that doesn't provide a FilerSendNetBufferList handler can not initiate a 
    send o its own.

Arguments:

    FilterModuleContext: Pointer to our filter context area.
    NetBufferLists: Pointer to a List of NetBufferLists.
    PortNumber - Port Number to which this send is targetted
    SendFlags-  Specifies if the call is at DISPATCH_LEVEL                     
  

Return Value:
 
    NDIS_STATUS_SUCCESS: 
    NDIS_STATUS_PENDING:
    NDIS_STATUS_INVALID_PACKET:
    NDIS_STATUS_RESOURCES:
    NDIS_STATUS_FAILURE:


NOTE: The filter will act like a passthru filter.       
 
--*/
{
	PMS_FILTER          pFilter = (PMS_FILTER)FilterModuleContext;
	BOOLEAN             DispatchLevel;
	BOOLEAN             bFalse = FALSE;
	PNET_BUFFER_LIST    CurrNbl, NextNbl;
	PNET_BUFFER         pCurrentNetBuffer;
	PMDL				pMdl;
	ULONG				ulOffset;
	struct ether_header *pEthHeader = NULL;
	ULONG				ulBufferLength = 0;
	ULONG				NBDO;
	ULONG 				NBDL;

	//DEBUGP(DL_TRACE, ("===>SendNetBufferList: NBL = %p.\n", NetBufferLists));

	do
	{
		DispatchLevel = NDIS_TEST_SEND_AT_DISPATCH_LEVEL(SendFlags);
#if DBG
		//
		// we should never get packets to send if we are not in running state
		//

		FILTER_ACQUIRE_LOCK(&pFilter->Lock, DispatchLevel);
		//
		// If the filter is not in running state, fail the send
		// 
		if (pFilter->State != FilterRunning)
		{
			DEBUGP(4, ("NOT SURE WHETHER IN THIS PATH.\n"));
			FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);

			CurrNbl = NetBufferLists;
			while (CurrNbl)
			{
				NET_BUFFER_LIST_STATUS(CurrNbl) = NDIS_STATUS_PAUSED;
				CurrNbl = NET_BUFFER_LIST_NEXT_NBL(CurrNbl);
			}
			NdisFSendNetBufferListsComplete(pFilter->FilterHandle, 
				NetBufferLists, 
				DispatchLevel ? NDIS_SEND_COMPLETE_FLAGS_DISPATCH_LEVEL : 0);
			break;
		}
		FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);
#endif
		if (pFilter->TrackSends)
		{
			FILTER_ACQUIRE_LOCK(&pFilter->Lock, DispatchLevel);
			CurrNbl = NetBufferLists;
			while (CurrNbl)
			{
				pFilter->OutstandingSends++;
				FILTER_LOG_SEND_REF(1, pFilter, CurrNbl, pFilter->OutstandingSends);

				NextNbl = NET_BUFFER_LIST_NEXT_NBL(CurrNbl);
				DEBUGP(4, ("===>BufferList: NBL = %p, begin the NB process.\n", NetBufferLists));
				for(pCurrentNetBuffer =  NET_BUFFER_LIST_FIRST_NB(CurrNbl);
					pCurrentNetBuffer != NULL;
					pCurrentNetBuffer =  NET_BUFFER_NEXT_NB(pCurrentNetBuffer)) 
				{
					pMdl = NET_BUFFER_CURRENT_MDL(pCurrentNetBuffer);
					ulOffset = NET_BUFFER_CURRENT_MDL_OFFSET(pCurrentNetBuffer);
					NBDL = NET_BUFFER_DATA_LENGTH(pCurrentNetBuffer);
					NBDO = NET_BUFFER_DATA_OFFSET(pCurrentNetBuffer);
					
					do 
					{
						ASSERT(pMdl != NULL);
						if (pMdl)
						{
							NdisQueryMdl(
								pMdl,
								&pEthHeader,
								&ulBufferLength,
								NormalPagePriority);
						}
						if (NULL == pEthHeader)
						{
							//
							//  The system is low on resources. Set up to handle failure
							//  below.
							//
							ulBufferLength = 0;
							break;
						}

						if (0 == ulBufferLength)
						{
							break;
						}

						ASSERT(ulBufferLength > ulOffset);
						//if the ulBufferLength < NBDL, then there are some more MDLs.
						DbgPrint("NBDL IS %d, NBD0 IS %d, MDL_OFFSET IS %d, MDL NET BUFFER LENGTH IS %d\n", NBDL, NBDO, ulOffset, ulBufferLength);

						ulBufferLength -= ulOffset;
						pEthHeader = (struct ether_header *)((PUCHAR)pEthHeader + ulOffset);

						if (ulBufferLength < sizeof(struct ether_header))
						{
							DEBUGP(DL_WARN,
								("ReceiveNetBufferList: runt nbl %p, first buffer length %d\n",
								CurrNbl, ulBufferLength));
							break;
						}
						DbgPrint("DstMAC: %.2x-%.2x-%.2x-%.2x-%.2x-%.2x\n",pEthHeader->ether_dhost[0],pEthHeader->ether_dhost[1],pEthHeader->ether_dhost[2],pEthHeader->ether_dhost[3],pEthHeader->ether_dhost[4],pEthHeader->ether_dhost[5]);
						DbgPrint("srcMAC: %.2x-%.2x-%.2x-%.2x-%.2x-%.2x\n",pEthHeader->ether_shost[0],pEthHeader->ether_shost[1],pEthHeader->ether_shost[2],pEthHeader->ether_shost[3],pEthHeader->ether_shost[4],pEthHeader->ether_shost[5]);				
					}while (bFalse);
					DbgPrint("End one NB process!\n");
				}
				//DbgPrint("IF NOT SHOW THIE, MAYBE SOME PROBLEM.\n");
				CurrNbl= NextNbl;
			}
			FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);
		}
		//
		// If necessary, queue the NetBufferList in a local structure for later processing
		//		
		NdisFSendNetBufferLists(pFilter->FilterHandle, NetBufferLists, PortNumber, SendFlags);

	}
	while (bFalse);

	DEBUGP(4, ("<===SendNetBufferList. \n"));
}

其中用到了一个新的数据类型，可以添加到filter.h头文件中：

#define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
struct	ether_header {
	UCHAR	ether_dhost[ETHER_ADDR_LEN];
	UCHAR	ether_shost[ETHER_ADDR_LEN];
	USHORT	ether_type;
};