庖丁解牛---winpcap源码彻底解密系列续集(10)

设置读超时：

     PacketSetReadTimeout(p->adapter, p->md.timeout);

BOOLEAN PacketSetReadTimeout(LPADAPTER AdapterObject,int timeout)

{

     BOOLEAN Result;

    

     TRACE_ENTER("PacketSetReadTimeout");

 

     AdapterObject->ReadTimeOut = timeout;

 

#ifdef HAVE_WANPACKET_API

     if (AdapterObject->Flags == INFO_FLAG_NDISWAN_ADAPTER)

     {

         Result = WanPacketSetReadTimeout(AdapterObject->pWanAdapter,timeout);

        

         TRACE_EXIT("PacketSetReadTimeout");

        

         return Result;

     }

#endif // HAVE_WANPACKET_API

 

#ifdef HAVE_NPFIM_API

     if (AdapterObject->Flags == INFO_FLAG_NPFIM_DEVICE)

     {

         //

         // convert the timestamps to Windows like format (0 = immediate, -1(INFINITE) = infinite)

         //

         if (timeout == -1) timeout = 0;

         else if (timeout == 0) timeout = INFINITE;

       

         Result = (BOOLEAN)g_NpfImHandlers.NpfImSetReadTimeout(AdapterObject->NpfImHandle, timeout);

         TRACE_EXIT("PacketSetReadTimeout");

         return Result;

     }

#endif // HAVE_NPFIM_API

 

#ifdef HAVE_AIRPCAP_API

     //

     // Timeout with AirPcap is handled at user level

     //

     if(AdapterObject->Flags == INFO_FLAG_AIRPCAP_CARD)

     {

         TRACE_EXIT("PacketSetReadTimeout");

         return TRUE;

     }

#endif // HAVE_AIRPCAP_API

 

#ifdef HAVE_DAG_API

     // Under DAG, we simply store the timeout value and then

     if(AdapterObject->Flags & INFO_FLAG_DAG_CARD)

     {

         if(timeout == -1)

         {

              // tell DAG card to return immediately

              AdapterObject->DagReadTimeout.tv_sec = 0;

              AdapterObject->DagReadTimeout.tv_usec = 0;

         }

         else

         {

              if(timeout == 0)

              {

                   // tell the DAG card to wait forvever

                   AdapterObject->DagReadTimeout.tv_sec = -1;

                   AdapterObject->DagReadTimeout.tv_usec = -1;

              }

              else

              {

                   // Set the timeout for the DAG card

                   AdapterObject->DagReadTimeout.tv_sec = timeout / 1000;

                   AdapterObject->DagReadTimeout.tv_usec = (timeout * 1000) % 1000000;

              }

         }            

        

         TRACE_EXIT("PacketSetReadTimeout");

         return TRUE;

     }

#endif // HAVE_DAG_API

 

     if(AdapterObject->Flags == INFO_FLAG_NDIS_ADAPTER)

     {

         Result = TRUE;

     }

     else

     {

         //

         // if we are here, it's an unsupported ADAPTER type!

         //

         TRACE_PRINT1("Request to set read timeout on an unknown device type (%u)", AdapterObject->Flags);

         Result = FALSE;

     }

 

     TRACE_EXIT("PacketSetReadTimeout");

     return Result;

    

}

 

从源码看，发现设置读超时，根本没有像设置内核缓冲一样，将它通过DeviceIoControl传递，就是说设置超时，就在应用程序就停止了，没有往下传递，但是我在npf中，又发现了与读超时有关的代码:

#define BIOCSRTIMEOUT 7416

 

    case BIOCSRTIMEOUT: //set the timeout on the read calls

        TRACE_MESSAGE(PACKET_DEBUG_LOUD, "BIOCSRTIMEOUT");

        if(IrpSp->Parameters.DeviceIoControl.InputBufferLength < sizeof(ULONG))

        {          

            SET_FAILURE_BUFFER_SMALL();

            break;

        }

 

        timeout = *((PULONG)Irp->AssociatedIrp.SystemBuffer);

        if(timeout == (ULONG)-1)

            Open->TimeOut.QuadPart=(LONGLONG)IMMEDIATE;

        else

        {

            Open->TimeOut.QuadPart = (LONGLONG)timeout;

            Open->TimeOut.QuadPart *= 10000;

            Open->TimeOut.QuadPart = -Open->TimeOut.QuadPart;

        }

 

        TRACE_MESSAGE1(PACKET_DEBUG_LOUD, "Read timeout set to %I64d",Open->TimeOut.QuadPart);

       

        SET_RESULT_SUCCESS(0);     

        break;

 

NPF_Read读函数中也有：

    Occupation=0;

 

    for(i=0;i<g_NCpu;i++)

        Occupation += (Open->Size - Open->CpuData[i].Free);

   

    //See if the buffer is full enough to be copied

    if( Occupation <= Open->MinToCopy*g_NCpu || Open->mode & MODE_DUMP )

    {

        if (Open->ReadEvent != NULL)

        {

            //wait until some packets arrive or the timeout expires    

            if(Open->TimeOut.QuadPart != (LONGLONG)IMMEDIATE)

                KeWaitForSingleObject(Open->ReadEvent,

                    UserRequest,

                    KernelMode,

                    TRUE,

                    (Open->TimeOut.QuadPart == (LONGLONG)0)? NULL: &(Open->TimeOut));

 

            KeClearEvent(Open->ReadEvent);

        }  

 

那么驱动中的这个超时是怎么传递进去的呢，诧异！我搜了BIOCSRTIMEOUT，在npf.sys中packetNtx\driver里面有，我在wpcap和packet两个库里面都没有！诧异！有谁知道的指点下，windows xp下面应该使用的是packetNtx下的驱动吧!