- 浏览: 856310 次
- 性别:
- 来自: 济南
文章分类
- 全部博客 (280)
- java相关 (29)
- linux系统 (55)
- ipsec (0)
- ssl (3)
- 信息安全 (13)
- web相关 (35)
- windows (9)
- c,c++ (14)
- log4j (3)
- hibernate (8)
- sqlite (1)
- 程序人生 (2)
- js (2)
- 生活点滴 (3)
- 网络相关 (14)
- 问题积累 (15)
- 数据库相关 (27)
- 软件测试 (2)
- PKI相关 (2)
- 程序设计 (7)
- 犄角旮旯 (0)
- 杂七杂八 (0)
- 硬件相关 (14)
- 防火墙 (2)
- 电子商务 (2)
- 多媒体相关 (1)
- 内存管理 (4)
- 面向对象 (1)
- csp (1)
- 驱动开发 (3)
- 移动开发 (2)
- openssl多线程实例 (1)
最新评论
-
xiaoyao3857:
博主很有探索精神嘛,学习了
Linux主机名Hostname详解 -
hiskyrisa:
言简意赅,好文章。
Flex是什么 -
layznet:
犯了类似错误。使用的是derby数据库。driverClass ...
java.sql.SQLException: No suitable driver -
idision:
你好,文章有一句createSubjectKeyId(keyT ...
bouncycastle 产生证书 -
zheng12tian:
代码有全的不?只贴一部分,,,,
在LOG4J中把日志写入远程数据库
Windows Vista(简称Vista),是微软公司推出的最新的客户端操作系统,内部名称Windows NT 6.0。相对于Windows NT 5.x,其网络结构变化非常大,原有的TDI,NDIS系统挂接方法不再适用。(修改自nrworld.com 作者匿名)
Windows Filtering Platform (WFP) is a set of API and system services that provide a platform for creating firewalls. WFP API allows developers to create code that interacts with the filtering that takes place at several layers in the networking stack and throughout the operating system.
WFP integrates with and provides support for firewall features such as authenticated communication and dynamic firewall configuration based on applications' use of sockets API (application-based policy). Windows Filtering Platform is a development platform and not a firewall itself.
(IN const FWPS_INCOMING_VALUES0* inFixedValues,//WFP传进来的本层特有的数据
IN const FWPS_INCOMING_METADATA_VALUES0* inMetaValues,//本层相关的扩展数据
IN VOID* packet,
IN const FWPS_FILTER0* filter,
IN UINT64 flowContext,
OUT FWPS_CLASSIFY_OUT0* classifyOut//用这个结构里的字段告知WFP对数据包做出处理
)
{
NTSTATUS status = STATUS_SUCCESS;
UINT64 flowHandle;
UINT64 flowContextLocal;
UINT32 index;
UINT32 LocalIPADDRv4,remoteIPADDRv4;
USHORT LocalPort,remotePort;
UNREFERENCED_PARAMETER(packet);
UNREFERENCED_PARAMETER(filter);
UNREFERENCED_PARAMETER(flowContext);
index = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS;
index = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_PORT;
LocalPort = inFixedValues->incomingValue[index].value.uint16;
index = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_ADDRESS;
index = FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_PORT;
remotePort = inFixedValues->incomingValue[index].value.uint16;
DbgPrint("BaseTDI: LocalIP %lx LocalPort %d \n remoteIP %lx remotePort %d",LocalIPADDRv4,LocalPort, remoteIPADDRv4,remotePort);
DbgPrint("BaseTDI: PID %d ,PID's PATH %s",inMetaValues->processId,inMetaValues->processPath->data); DbgPrint("\n");
if (monitoringEnabled)
{ //访问规则代码,在这里通知用户态程序
AskUser(LocalIP, LocalPort, remoteIP, remotePort, PID);
If classifyOut->actionType = FWP_ACTION_PERMIT;//允许发送或接收
else classifyOut->actionType = FWP_ACTION_BLOCK; //不允许发送或接收
}
return status;
}
WFPAppAddCallouts()//向WFP系统添加callout DWORD
{
FWPM_CALLOUT0 callout;
DWORD result;
FWPM_DISPLAY_DATA0 displayData;
HANDLE engineHandle = NULL;
FWPM_SESSION0 session; //初始化一次会话
RtlZeroMemory(&session, sizeof(FWPM_SESSION0));
session.displayData.name= L"TEMP WFP Session";
session.displayData.description = L"For Adding callouts";//创建WFP引擎句柄
result = FwpmEngineOpen0( NULL, RPC_C_AUTHN_WINNT, NULL, &session, &engineHandle );
if (NO_ERROR != result) {goto cleanup;} //开始与引擎交互
result = FwpmTransactionBegin0(engineHandle, 0);
if (NO_ERROR != result) {goto abort; } //ADD CALLOUT
RtlZeroMemory(&callout, sizeof(FWPM_CALLOUT0));
displayData.description = MONITOR_FLOW_ESTABLISHED_CALLOUT_DESCRIPTION;
displayData.name = MONITOR_FLOW_ESTABLISHED_CALLOUT_NAME;
callout.calloutKey = TEMP_MONITOR_FLOW_ESTABLISHED_CALLOUT_V4;
callout.displayData = displayData;
callout.applicableLayer = FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4;
callout.flags = FWPM_CALLOUT_FLAG_PERSISTENT; //flags置这个标志表示callout始终被WFP加载
result = FwpmCalloutAdd0(engineHandle, &callout, NULL, NULL);
if (NO_ERROR != result) {goto abort; } //结束本次会话
result = FwpmTransactionCommit0(engineHandle);
if (NO_ERROR == result) {;} goto cleanup; abort: //说明本次会话失败
result = FwpmTransactionAbort0(engineHandle);
if (NO_ERROR == result) {;} cleanup: //关闭引擎
if (engineHandle) { FwpmEngineClose0(engineHandle); }
return result;
}
WFPAppAddFilters(IN HANDLE engineHandle/*,IN FWP_BYTE_BLOB* applicationPath*/) //向WFP系统添加filter DWORD
{
DWORD result = NO_ERROR;
FWPM_SUBLAYER0 monitorSubLayer;
FWPM_FILTER0 filter;
FWPM_FILTER_CONDITION0 filterConditions[1]; //需要几条规则就定义几条 //初始化过滤条件
RtlZeroMemory(filterConditions, sizeof(filterConditions));
filterConditions[0].fieldKey = FWPM_CONDITION_IP_PROTOCOL;//所有IP协议数据
filterConditions[0].matchType = FWP_MATCH_GREATER_OR_EQUAL;//匹配度,大于,小于,大于等于…
filterConditions[0].conditionValue.type = FWP_UINT8;
filterConditions[0].conditionValue.uint8 = IPPROTO_IP;
RtlZeroMemory(&monitorSubLayer, sizeof(FWPM_SUBLAYER0));//初始化子层
monitorSubLayer.subLayerKey = TEMP_MONITOR_SUBLAYER;
monitorSubLayer.displayData.name = L"TEMP Monitor Sub layer";
monitorSubLayer.displayData.description = L"TEMP Monitor Sub layer";
monitorSubLayer.flags = 0;//FWMP_SUBLAYER_FLAG_PERSISTENT; // We don't really mind what the order of invocation is.
monitorSubLayer.weight = 0; //与WFP引擎开始一次会话
result = FwpmTransactionBegin0(engineHandle, 0);
if (NO_ERROR != result) {goto abort;} //增加一个子层
result = FwpmSubLayerAdd0(engineHandle, &monitorSubLayer, NULL);
if (NO_ERROR != result) {goto abort;} //FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4
RtlZeroMemory(&filter, sizeof(FWPM_FILTER0));
filter.layerKey = FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4;
filter.displayData.name = L"Flow established filter.";
filter.displayData.description = L"Sets up flow for traffic that we are interested in.";
filter.action.type = FWP_ACTION_CALLOUT_INSPECTION; //表示把符合条件数据包交给callout处理
filter.action.calloutKey = TEMP_MONITOR_FLOW_ESTABLISHED_CALLOUT_V4;
filter.filterCondition = filterConditions;
filter.subLayerKey = monitorSubLayer.subLayerKey;
filter.weight.type = FWP_EMPTY; //系统自动设置weight。weight值越大加载越靠前
filter.numFilterConditions = 1;//过滤条件数
result = FwpmFilterAdd0(engineHandle, &filter, NULL, &(filterID[0]));
if (NO_ERROR != result) {goto abort;} //结束本次会话
result = FwpmTransactionCommit0(engineHandle);
if (NO_ERROR == result) {;} goto cleanup; abort: //说明本次会话失败
result = FwpmTransactionAbort0(engineHandle);
if (NO_ERROR == result) {;} cleanup: return result;
}
二、NDISfilter NDISfilter是利用系统提供的NDIS过滤引擎,获得MAC级别的网络数据包(这里可以看出WFP,NDISfilter,还有本文未提到的 FileSystemMiniFilter,他们都是利用了微软提供的过滤引擎,向其注册回调函数,得到数据后处理)。关键代码说明,其中的详细数据结构请参阅微软文档NDISfilter一节,
NDIS_FILTER_DRIVER_CHARACTERISTICS FChars;
NdisZeroMemory(&FChars, sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS));
FChars.Header.Type = NDIS_OBJECT_TYPE_FILTER_DRIVER_CHARACTERISTICS;
FChars.Header.Size = sizeof(NDIS_FILTER_DRIVER_CHARACTERISTICS);
FChars.Header.Revision = NDIS_FILTER_CHARACTERISTICS_REVISION_1;
FChars.MajorNdisVersion = FILTER_MAJOR_NDIS_VERSION;
FChars.MinorNdisVersion = FILTER_MINOR_NDIS_VERSION;
FChars.MajorDriverVersion = 1;
FChars.MinorDriverVersion = 0;
FChars.Flags = 0;
FChars.FriendlyName = FriendlyName;
FChars.UniqueName = UniqueName;
FChars.ServiceName = ServiceName;
FChars.SetOptionsHandler = FilterRegisterOptions;
FChars.AttachHandler = FilterAttach;//如果是我们想挂接的网络介质,就在这里通知系统挂接
FChars.DetachHandler = FilterDetach;
FChars.RestartHandler = FilterRestart;
FChars.PauseHandler = FilterPause;
FChars.SetFilterModuleOptionsHandler = FilterSetModuleOptions;
FChars.OidRequestHandler = FilterOidRequest;
FChars.OidRequestCompleteHandler = FilterOidRequestComplete;
FChars.CancelOidRequestHandler = FilterCancelOidRequest;
FChars.SendNetBufferListsHandler = FilterSendNetBufferLists;//发送回调函数
FChars.ReturnNetBufferListsHandler = FilterReturnNetBufferLists;
FChars.SendNetBufferListsCompleteHandler = FilterSendNetBufferListsComplete;
FChars.ReceiveNetBufferListsHandler = FilterReceiveNetBufferLists;//接收回调函数
FChars.DevicePnPEventNotifyHandler = FilterDevicePnPEventNotify;
FChars.NetPnPEventHandler = FilterNetPnPEvent;
FChars.StatusHandler = FilterStatus;
FChars.CancelSendNetBufferListsHandler = FilterCancelSendNetBufferLists;
NDIS_FILTER_DRIVER_CHARACTERISTICS这个结构用来组织NDISfilter功能函数供NDIS系统回调,例如 FilterSendNetBufferLists,发送数据回调函数,NDIS发送MAC帧时回调这个函数,相应数据可以在这个函数里得到处理,之后还给NDIS系统继续处理。
VOID FilterSendNetBufferLists( IN NDIS_HANDLE FilterModuleContext, IN PNET_BUFFER_LIST NetBufferLists, IN NDIS_PORT_NUMBER PortNumber, IN ULONG SendFlags )
{
PMS_FILTER pFilter = (PMS_FILTER)FilterModuleContext;
NDIS_STATUS Status = NDIS_STATUS_SUCCESS;
PNET_BUFFER_LIST CurrNbl;
BOOLEAN DispatchLevel; //这里开始分析PNET_BUFFER_LIST指向的网络数据,并显示如何获得MAC地址
PNET_BUFFER_LIST pNetBufList,pNextNetBufList;
PMDL pMdl;
PNDISPROT_ETH_HEADER pEthHeader = NULL;
ULONG TotalLength,Offset,BufferLength; pNetBufList = NetBufferLists;
while (pNetBufList != NULL)
{
pNextNetBufList = NET_BUFFER_LIST_NEXT_NBL (pNetBufList); //得到当前和包相关的MDL,MDL里即MAC帧,详细的NET_BUFFER_LIST结构请参阅微软相关文档
pMdl = NET_BUFFER_CURRENT_MDL(NET_BUFFER_LIST_FIRST_NB(pNetBufList));
TotalLength = NET_BUFFER_DATA_LENGTH(NET_BUFFER_LIST_FIRST_NB(pNetBufList));
Offset = NET_BUFFER_CURRENT_MDL_OFFSET(NET_BUFFER_LIST_FIRST_NB(pNetBufList));
BufferLength = 0;
do
{
ASSERT(pMdl != NULL);
if (pMdl)
{
NdisQueryMdl( pMdl, &pEthHeader, &BufferLength, NormalPagePriority);
}
if (pEthHeader == NULL)
{
BufferLength = 0; break;
}
if (BufferLength == 0){ break;}
ASSERT(BufferLength > Offset);
BufferLength -= Offset;
pEthHeader = (PNDISPROT_ETH_HEADER)((PUCHAR)pEthHeader + Offset);
DbgPrint("DstMAC %x-%x-%x-%x-%x-%x",pEthHeader->DstAddr[0], pEthHeader->DstAddr[1],pEthHeader->DstAddr[2], pEthHeader->DstAddr[3],pEthHeader->DstAddr[4], pEthHeader->DstAddr[5]);
DbgPrint("srcMAC %x-%x-%x-%x-%x-%x",pEthHeader->SrcAddr[0], pEthHeader->SrcAddr[1],pEthHeader->SrcAddr[2], pEthHeader->SrcAddr[3],pEthHeader->SrcAddr[4], pEthHeader->SrcAddr[5]);
DbgPrint("\n");
if (BufferLength < sizeof(NDISPROT_ETH_HEADER)) { break;}
}
while (FALSE);
pNetBufList = pNextNetBufList;
}
}
发表评论
-
windows启动方式总结
2010-05-26 14:04 1603首先先说说最简单的查 ... -
网管必须掌握几点!
2010-04-25 20:02 1147网管员在维护和使用电脑时,经常会遇到各种密码丢失的问题,这里, ... -
加快硬盘读写速度
2009-08-10 20:43 3584一、软件篇 1、设定虚 ... -
VC++动态链接库编程之基础慨念
2009-07-18 21:50 14181.概论 先来阐述一下DLL(Dynamic ... -
动态链接库dll 静态链接库lib 动态导入库lib
2009-07-18 21:31 3736目前以lib后缀的库有两种,一种为静态链接库(Static L ... -
lib和dll文件的区别和联系
2009-06-23 19:42 2094lib和dll lib和dll文件的区别和联系 .dl ... -
internet explorer已阻止此站点用不安全方式使用ActiveX控件,怎么办?
2009-06-22 19:02 10751所谓的阻止是因为IE禁止了activex控制在页面的执行.IE ... -
远程桌面(3389)连接至指定会话(session)的方法.
2009-05-15 15:16 2024不知道有没有人遇到过这样的变态问题,在管理服务器的时候,用远程 ...
相关推荐
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
全面系统地介绍了串口、键盘、磁盘、文件系统、网络等相关的Windows内核模块的编程技术,以及基于这些技术实现的密码保护、防毒引擎、文件加密、网络嗅探、网络防火墙等信息安全软件的核心组件的具体编程。...
2.Radmin支持被控端以服务的方式运行、支持多个连接和IP 过滤(即允许特定的IP控制远程机器)、个性化的档互传、远程关机、支持高分辨率模式、基于Windows NT的安全支持及密码保护以及提供日志文件支持等。...
对 Windows 安全中心(包括 Vista)进行优化 个人防火墙 个人防火墙监视受保护的计算机和网络中其它计算机之间的所有通信。ESET 个人防火墙包含下列高级功能。 功能 说明 低层网络通信扫描 能够扫描数据...
2.Radmin支持被控端以服务的方式运行、支持多个连接和IP 过滤(即允许特定的IP控制远程机器)、个性化的档互传、远程关机、支持高分辨率模式、基于Windows NT的安全支持及密码保护以及提供日志文件支持等。...
如果您习惯使用 RSS 来阅读新闻,那说明您一定是相当关注新闻的及时性或阅读的效率。QuiteRSS 是一个功能丰富、易于使用,并且开源免费的...支持 Windows XP、Vista、Win7、Win8、Win8.1、Win10 等平台,支持简体中文。
1,在两个面板的文件夹绝对路径上右击任何一级目录可以快速跳转,当你访问一个具有大量文件夹的文件夹时(如system32),可以用来列出目录,这和windows vista和7的功能是一样的,不过这个更加好用。 2,扩展名过滤...
同Windows XP一样,在Windows Vista的默认设置下,IIS (Internet 信息服务) 7.0未予安装,要想使用它,必须首先安装IIS。下面简单介绍IIS的安装过程: 依次点击“开始” => “控制面板” => “程序”,选择“打开或...
1、默认核心是 Ghost 11.0.2,可自定义 Ghost 版本 2、程序默认对当前系统所在分区进行备份、还原操作,可选择其他分区 3、本程序纯绿色,不会给系统留下任何临时文件 4、备份时可选压缩方式、默认为快速压缩 5、可...