Hello,
I based my filter driver on minispy. Because I need to send additional info
from user space to kernel space, I decided to use the existing
FilterSendMessageCall. Now I am trying to figure out how the ClientPort
relates to the ConnectionContext and the ConnectionCookie. I have attached
at the bottom the relevant calls I made to establish the ports and how I
connect. What I am not sure is how I can use the ConnectionContext in order
to establish multiple connections and how I close them. I have put the
questions as comments inside the code segments at the bottom.
Thanks a lot, bjorn
//Include: this is my connectionCookie Struct:
typedef struct _COMMUNICATION_CONTEXT {
ULONG communicationType;
} COMMUNICATION_CONTEXT, *PCOMMUNICATION_CONTEXT;
//Filter: Create the Server port:
status = FltCreateCommunicationPort( MiniSpyData.Filter,
&MiniSpyData.ServerPort,
&oa,
NULL,
SpyConnect,
SpyDisconnect,
SpyMessage,
2 ); // this will allow two
connections on that server port and I do not need to use the serverport
cookie, is that correct???
//Filter: The connect routine:
NTSTATUS
SpyConnect(
IN PFLT_PORT ClientPort,
IN PVOID ServerPortCookie,
IN PVOID ConnectionContext,
IN ULONG SizeOfContext,
OUT PVOID *ConnectionCookie
)
{
PCOMMUNICATION_CONTEXT commCtx;
commCtx = (PCOMMUNICATION_CONTEXT) ConnectionContext;
*ConnectionCookie = commCtx;
// the next no longer seems correct as it would hit when the 2nd
connection is established. How can I use the ConnectionCookie here?
ASSERT( MiniSpyData.ClientPort == NULL );
MiniSpyData.ClientPort = ClientPort;
return STATUS_SUCCESS;
}
// User Space: How the first connection is established:
// Note: I do see the 77 in SpyConnect in kernel.
commCtx.communicationType = 77;
hResult = FilterConnectCommunicationPort( MINISPY_PORT_NAME,
0,
&commCtx,
sizeof(COMMUNICATION_CONTEXT),
NULL,
&port );
// Kernel: The disconnect routine
SpyDisconnect(
IN PVOID ConnectionCookie
)
{
//this prints out the address of the Communication Struct as I set it in
the first call to spyconnect. I haven’t called the second one yet, as I know
the assert will trigger…
KdPrint((“ConnectionCookie:‘%d’\n”, ConnectionCookie));
// So do I need to use the ConnectionCookie here rather than the Client
Port? Does this mean I need to have the ConnectionCookie defiend as a
PFLT_PORT??? I am just not quite clear on how the ClientPort relates to the
ConnectionCookie…
FltCloseClientPort( MiniSpyData.Filter, &MiniSpyData.ClientPort );
}