Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

Network filtering in the original thread context

0xrepnz0xrepnz Member Posts: 16
edited January 24 in NTDEV

Hey,
Is there any way to filter TCP connect requests at the context of the original thread that called WSAConnect()? As far as I know you cannot (from kernel mode, in a documented way) do it - are all the networking callbacks run asynchronously / at DISPATCH_LEVEL?
Moreover, How would you recommend to learn about network filtering? I can just read the MSDN documentation but are there any other sources you think may be useful?

Thank you in advance!:)

Comments

  • anton_bassovanton_bassov Member Posts: 5,106

    Is there any way to filter TCP connect requests at the context of the original thread that called WSAConnect()?

    What about the WFP? After all, this is what packet filtering is all about

    As far as I know you cannot (from kernel mode, in a documented way) do it - are all the networking callbacks run
    asynchronously / at DISPATCH_LEVEL?

    At the lower (i.e.NDIS) level there is, indeed, already no way to relate a network packet to a process or a thread, other than
    using a protocol -specific info (i.e IP address/TCP or UDP port combination) in a packet header. This is why one needs to split the filtering functionality in 2 parts if they want to do the filtering at NDIS level. The upper part operates at WFP level, relating the protocol -specific info to the particular threads and processes, and the lower part that operates at NDIS level uses the information obtained by the upper one to make the filtering decisions.

    My last Windows-based project (in fact,it was more than12 years ago, but anyway) was dealing specifically with the task you describe.
    I was porting my pre-Vista filtering solution (i.e. the one based upon NDIS5 and TDI) to NDIS6 and WFP, and the whole thing was
    really easy, compared to pre-Vista NDIS5/ TDI -based filter. To make it even more interesting, unlike its pre-Vista "ancestor", the filter in question did not require any hackery of any description. WFP defines NUMEROUS filtering levels, so that you have a chance to choose the particular level that suits your needs best, and NDIS6+ LWF is really easy, compared to NDIS<6 IM filter

    However, I believe that in your particular case WFP-based filter alone may, probably, suffice.

    Moreover, How would you recommend to learn about network filtering?

    IIRC, MSDN documentation that covers WFP is extensive.......

    Anton Bassov

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 20 Apr 2020 LIVE ONLINE
Writing WDF Drivers 11 May 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA