IP Header in FWPM_LAYER_INBOUND_IPPACKET_V4

Question

Sign in to vote

2 Sign in to vote Hi, this problem I have seems to be closely related to another mine here: http://social.msdn.microsoft.com/Forums/en-US/wfp/thread/65c34860-6d8d-4475-9b9b-b06541158875 Anyway, I have a callout registered in the INBOUND_IPPACKET layer and I'd like to access to the IP Header. I'm able to access to the TCP Header just reading from the current pointer: ---------------------------- tcp_header = (TCP_HEADER*)NdisGetDataBuffer( nb, sizeof(TCP_HEADER), NULL, sizeof(UINT16), 0); ---------------------------- but trying to read the ip header with this code: ---------------------------- status2 = NdisRetreatNetBufferDataStart( nb, inMetaValues->ipHeaderSize, 0, NULL); if (status2 != NDIS_STATUS_SUCCESS) { ...; goto Exit; } ip_header = (IP_HEADER*)NdisGetDataBuffer( nb, sizeof(IP_HEADER), NULL, sizeof(UINT16), 0); if (ip_header == NULL) { ...; goto Exit; } ---------------------------- I found dirty data in the IP_HEADER structure... I'm sure there is something wrong but I totally don't understand or imagine where!! Anyone have an idea? Thanks, Marco Wednesday, August 4, 2010 7:09 PM

Marco Mura 2,280 Points

Answers

Question

Sign in to vote

1 Sign in to vote Found it! My mistake was retreating the cloned buffer... and the buffer was cloned from the pointer after the IP header. So I was reading dirty stuff because I was already at the beginning of the cloned buffer. So, for the records, the correct way is to call NdisRetreatNetBufferListDataStart to (NET_BUFFER_LIST*)layerData and not to nb ! For the records: ---------------------------- status2 = NdisRetreatNetBufferListDataStart( (NET_BUFFER_LIST*)layerData, inMetaValues->ipHeaderSize, 0, NULL, NULL); if (status2 != NDIS_STATUS_SUCCESS) { ...; goto Exit; } status = FwpsAllocateCloneNetBufferList0( (NET_BUFFER_LIST*)layerData, NULL, NULL, 0, &nbl); if (!NT_SUCCESS(status)) { ...; goto Exit; } nb = NET_BUFFER_LIST_FIRST_NB(nbl); ip_header = (IP_HEADER*)NdisGetDataBuffer( nb, sizeof(IP_HEADER), NULL, sizeof(UINT16), 0); if (ip_header == NULL) { ...; goto Exit; } protocol = ip_header->Protocol; ...; NdisAdvanceNetBufferListDataStart( (NET_BUFFER_LIST*)layerData, inMetaValues->ipHeaderSize, FALSE, NULL); ---------------------------- Thanks, Marco