WSK combined with a non-network filter driver?

OSR_Community_User · January 31, 2011, 10:09pm

I’m looking at combining an existing KDMF kernel mode filter driver with an WSK (Windows Socket Kernel) driver on Win2008 R2/Win7 to intercept and process network packets. Ideally I’d like to make the filter driver make some initial calls to WSK (via a kernel thread) that would make tcp/ip connections and later, accept network messages.

I’m guessing this all works, but wanted a second opinion, as I’ve only minimally dealt with TDI in the past:

(1) Is it typical to combine another style of driver with WSK?
For instance, in this list, I’ve only seen perhaps NDIS miniports with a WSK layer.
What if one combined a video, storage or other style of device driver with WSK?

(2) Is it possible to encapsulate the WSK portion as a kernel library?

(3) Is there any limitations with using KDMF style drivers with WSK?

(4) Does Microsoft set any limitations on use of the WSK, especially in the above manner?

Sorry for being a little vague about the exact target filter driver, but I am wondering about the limitations of WSK in general. I think this question might be of use to the rest of NTDEV audience as well.

Thanks in advance for your time and help,

Mjd

Thomas_Divine-2 · January 31, 2011, 10:53pm

See the EchoSrv sample in the WDK. …\src\network\wsk\echosrv.

Just an ordinary legacy driver…

Thomas F. Divine
http://www.pcausa.com

From:
Sent: Monday, January 31, 2011 10:07 PM
To: “Windows System Software Devs Interest List”
Subject: [ntdev] WSK combined with a non-network filter driver?

> I’m looking at combining an existing KDMF kernel mode filter driver with
> an WSK (Windows Socket Kernel) driver on Win2008 R2/Win7 to intercept and
> process network packets. Ideally I’d like to make the filter driver make
> some initial calls to WSK (via a kernel thread) that would make tcp/ip
> connections and later, accept network messages.
>
> I’m guessing this all works, but wanted a second opinion, as I’ve only
> minimally dealt with TDI in the past:
>
> (1) Is it typical to combine another style of driver with WSK?
> For instance, in this list, I’ve only seen perhaps NDIS miniports with a
> WSK layer.
> What if one combined a video, storage or other style of device driver with
> WSK?
>
> (2) Is it possible to encapsulate the WSK portion as a kernel library?
>
> (3) Is there any limitations with using KDMF style drivers with WSK?
>
> (4) Does Microsoft set any limitations on use of the WSK, especially in
> the above manner?
>
> Sorry for being a little vague about the exact target filter driver, but I
> am wondering about the limitations of WSK in general. I think this
> question might be of use to the rest of NTDEV audience as well.
>
> Thanks in advance for your time and help,
>
> Mjd
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

David_R_Cattley · January 31, 2011, 10:56pm

Do you really mean WSK or do you mean WFP (or perhaps you mean both at
once)? Since you mention “intercept and process” it seems you might mean
WFP.

No matter though, the answer is pretty much the same. You can build WFP
(callout) and/or WSK (client) drivers in a KMDF shell. Neither WSK nor WFP
really constrain the driver model.

(1) No restrictions imposed by WSK or WFP. Some restrictions possibly from
certain driver miniport models might prevent linking to anything other than
the port driver for that stack, however (video?)

(2) Probably. Not sure what that buys you.

(3) Nope.

(4) Don’t know for sure, but I really doubt it.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, January 31, 2011 10:08 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] WSK combined with a non-network filter driver?

I’m looking at combining an existing KDMF kernel mode filter driver with an
WSK (Windows Socket Kernel) driver on Win2008 R2/Win7 to intercept and
process network packets. Ideally I’d like to make the filter driver make
some initial calls to WSK (via a kernel thread) that would make tcp/ip
connections and later, accept network messages.

I’m guessing this all works, but wanted a second opinion, as I’ve only
minimally dealt with TDI in the past:

(1) Is it typical to combine another style of driver with WSK?
For instance, in this list, I’ve only seen perhaps NDIS miniports with a
WSK layer.
What if one combined a video, storage or other style of device driver with
WSK?

(2) Is it possible to encapsulate the WSK portion as a kernel library?

(3) Is there any limitations with using KDMF style drivers with WSK?

(4) Does Microsoft set any limitations on use of the WSK, especially in the
above manner?

Sorry for being a little vague about the exact target filter driver, but I
am wondering about the limitations of WSK in general. I think this question
might be of use to the rest of NTDEV audience as well.

Thanks in advance for your time and help,

Mjd

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

OSR_Community_User · February 1, 2011, 9:44am

Thank you, Thomas.

Sorry that I did not make a clear statement about which driver I meant. I my filter driver is based upon KDMF -and- yes, I’ve read the echosrv sample and realized it was based upon the older model.
Thanks again.

Mjd

Re:
Yesterday 22:53
Thomas Divine
xxxxx@pcausa.com

Join Date: 05 Aug 2010
Posts To This List: 602
Re: WSK combined with a non-network filter driver?
See the EchoSrv sample in the WDK. …\src\network\wsk\echosrv. Just an ordinary legacy driver… Thomas F. Divine http://www.pcausa.com

OSR_Community_User · February 1, 2011, 9:55am

Thank you, David.

I really meant WSK. I had seriously looked at the WFP and unfortunately I don’t think that will work the way I want it to, but I appreciate your insight on both.

(1) Admittedly, a Video driver was a poor choice for an example.

(2) Point taken. Probably not much of an advantage except some project encapsulation/division.
I’m not going to share the WSK portion with any other driver, except one filter driver.

Thanks to all who replied.
I hope I can return the favor in the future.

Best regards,

Mjd

PS Also, forgive any unintentional cut-n-paste spacing errors in my replies. I’m using a webbrowser i/f rather than RSS or newsgroup feed to reply. For some reason my linefeed’s and spaces disappeared. I’ll go back to a newsgroup reader soon.

Yesterday 22:56
David R. Cattley
xxxxx@msn.com

Join Date: 09 Jul 2002
Posts To This List: 1491
RE: WSK combined with a non-network filter driver?

Do you really mean WSK or do you mean WFP (or perhaps you mean both at once)? Since you mention “intercept and process” it seems you might mean WFP. No matter though, the answer is pretty much the same. You can build WFP (callout) and/or WSK (client) drivers in a KMDF shell. Neither WSK nor WFP really constrain the driver model.

(1) No restrictions imposed by WSK or WFP. Some restrictions possibly from certain driver miniport models might prevent linking to anything other than the port driver for that stack, however (video?)

(2) Probably. Not sure what that buys you.

(3) Nope.

(4) Don’t know for sure, but I really doubt it.

Good Luck,
Dave Cattley

Jeffrey_Tippet_MSFT · February 1, 2011, 4:57pm

(4) Nope. We have no requirements specifically for WSK clients. (I mean, there are the super-generic ones that apply do every driver, e.g., “don’t compromise system security”, but you knew that already.)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, January 31, 2011 7:56 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] WSK combined with a non-network filter driver?

Do you really mean WSK or do you mean WFP (or perhaps you mean both at
once)? Since you mention “intercept and process” it seems you might mean
WFP.

No matter though, the answer is pretty much the same. You can build WFP
(callout) and/or WSK (client) drivers in a KMDF shell. Neither WSK nor WFP really constrain the driver model.