<commit_before>//////////////////////////////////////////////////////////////////////
// Project: pcap-ndis6
// Description: WinPCAP fork with NDIS6.x support 
// License: MIT License, read LICENSE file in project root for details
//
// Copyright (c) 2017 ChangeDynamix, LLC
// All Rights Reserved.
// 
// https://changedynamix.io/
// 
// Author: <NAME>
//////////////////////////////////////////////////////////////////////

#include <fwpsk.h>
#include <fwpmk.h>

#include "WfpFlt.h"
#include "KmMemoryManager.h"
#include "BfeStateWatcher.h"
#include "WfpUtils.h"
#include "KmList.h"
#include "..\shared\CommonDefs.h"

/*
    ----------------------------------------------------------------------
    Types
    ----------------------------------------------------------------------
*/

typedef struct _WFP_CALLOUT_DEFINITION
{
    GUID    const   *CalloutLayer;
    UINT16          LayerId;

    struct Callbacks
    {
        FWPS_CALLOUT_CLASSIFY_FN            Classify;

        FWPS_CALLOUT_NOTIFY_FN              Notify;

        FWPS_CALLOUT_FLOW_DELETE_NOTIFY_FN  FlowDeleteNotify;

    } Callbacks;

} WFP_CALLOUT_DEFINITION, *PWFP_CALLOUT_DEFINITION;

typedef struct _WFP_CALLOUT_REG_ITEM
{
    ULONG32		CalloutRegId;
    GUID		LayerGUID;
    UINT16		LayerId;
    UINT64      FilterId;
} WFP_CALLOUT_REG_ITEM, *PWFP_CALLOUT_REG_ITEM;

typedef struct _WFP_CALLOUT_REG_INFO
{
    ULONG					MaxCount;
    ULONG					Count;
    PWFP_CALLOUT_REG_ITEM   Items;
} WFP_CALLOUT_REG_INFO, *PWFP_CALLOUT_REG_INFO;

typedef struct _WFP_DATA
{
    //  Memory manager
    PKM_MEMORY_MANAGER  MemoryManager;

    //  Driver object received in DriverEntry routine
    PDRIVER_OBJECT      DriverObject;

    //  Device object (used for callouts registration)
    PDEVICE_OBJECT      DeviceObject;

    //  Device object

    struct BFEInfo
    {
        //  Transport level injection handle
        //  Note: wfp requires separate injection
        //        handles for ipv6/ipv4 packet inspection
        HANDLE  TransportInjectionHandle;

        //  Handle to BFE engine
        HANDLE  EngineHandle;

        struct SubLayer
        {
            //  Boolean flag that identifies whether the sublayer was added
            BOOLEAN Added;

            //  Sublayer key
            GUID    Guid;

        } SubLayer;

        //  Handle to BFE state watcher instance
        HANDLE  BFEStateWatcher;

    } BFEInfo;

    //  Callouts registration information
    WFP_CALLOUT_REG_INFO        CalloutRegInfo;

    KM_LIST                     FlowContexts;

    //  Boolean value representing the current state
    ULONG                       FilteringActive;

    //  Event callback routine
    PWFP_NETWORK_EVENT_CALLBACK EventCallback;

    PVOID                       EventCallbackContext;

} WFP_DATA, *PWFP_DATA;

typedef struct _WFP_FLOW_CONTEXT
{
    //  List link
    LIST_ENTRY          Link;

    //  Layer id
    UINT16              LayerId;

    //  Callout id
    ULONG               CalloutId;

    //  Flow id (flow handle)
    UINT64              FlowId;

    //  Network event info
    PNETWORK_EVENT_INFO Info;

    //  Wfp data
    PWFP_DATA           WfpData;

    //  Removal flag
    BOOLEAN             RemoveInProgress;

} WFP_FLOW_CONTEXT, *PWFP_FLOW_CONTEXT;

/*
    ----------------------------------------------------------------------
    Various macros
    ----------------------------------------------------------------------
*/

#define WFP_SUBLAYER_NAME_W         L"ChangeDynamix Inspection sublayer"
#define WFP_SUBLAYER_DESC_W         L"ChangeDynamix sublayer for inspection callouts"

#define WFP_DEVICE_NAME_W           L"4FA9893C-A44A-4474-A9B9-ACDE01F32AFB"

#define WFP_GENERIC_CALLOUT_NAME_W  L"ChangeDynamix inspection callout"
#define WFP_GENERIC_CALLOUT_DESC_W  L"ChangeDynamix inspection callout"

#define WFP_DECLARE_CALLOUT_CALLBACK1(CallbackName) \
    void CallbackName( \
        __in        const FWPS_INCOMING_VALUES          *InFixedValues, \
        __in        const FWPS_INCOMING_METADATA_VALUES *InMetaValues, \
        __inout     PVOID                               LayerData, \
        __in_opt    const void                          *ClassifyContext, \
        __in        const FWPS_FILTER1                  *Filter, \
        __in        UINT64                              FlowContext, \
        __out       FWPS_CLASSIFY_OUT                   *ClassifyOut)

#define __WFP_DECLARE_CALLOUT_DEFINITION(Layer, LayerId, ClassifyCallback) \
{ \
    Layer, \
    LayerId, \
    { \
        ClassifyCallback, \
        Wfp_Generic_NotifyCallback, \
        Wfp_Generic_FlowDeleteNotifyCallback \
    } \
}

#define WFP_ALE_AUTH_CONNECT_V4_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
        &FWPM_LAYER_ALE_AUTH_CONNECT_V4, \
        FWPS_LAYER_ALE_AUTH_CONNECT_V4, \
        Wfp_ALE_Connect_Callback)

#define WFP_ALE_AUTH_CONNECT_V6_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
        &FWPM_LAYER_ALE_AUTH_CONNECT_V6, \
        FWPS_LAYER_ALE_AUTH_CONNECT_V6, \
        Wfp_ALE_Connect_Callback)

/*
    ----------------------------------------------------------------------
    Forward declarations
    ----------------------------------------------------------------------
*/

void __stdcall Wfp_BFEStateChangeCallback(
    __inout PVOID               Context,
    __in    FWPM_SERVICE_STATE  NewState);

WFP_DECLARE_CALLOUT_CALLBACK1(Wfp_ALE_Connect_Callback);

NTSTATUS __stdcall Wfp_Generic_NotifyCallback(
    __in            FWPS_CALLOUT_NOTIFY_TYPE    NotifyType,
    __in    const   GUID                        *FilterKey,
    __in    const   FWPS_FILTER                 *Filter);

void __stdcall Wfp_Generic_FlowDeleteNotifyCallback(<commit_msg>Added incoming connections callouts stubs<commit_after>//////////////////////////////////////////////////////////////////////
// Project: pcap-ndis6
// Description: WinPCAP fork with NDIS6.x support 
// License: MIT License, read LICENSE file in project root for details
//
// Copyright (c) 2017 ChangeDynamix, LLC
// All Rights Reserved.
// 
// https://changedynamix.io/
// 
// Author: <NAME>
//////////////////////////////////////////////////////////////////////

#include <fwpsk.h>
#include <fwpmk.h>

#include "WfpFlt.h"
#include "KmMemoryManager.h"
#include "BfeStateWatcher.h"
#include "WfpUtils.h"
#include "KmList.h"
#include "..\shared\CommonDefs.h"

/*
    ----------------------------------------------------------------------
    Types
    ----------------------------------------------------------------------
*/

typedef struct _WFP_CALLOUT_DEFINITION
{
    GUID    const   *CalloutLayer;
    UINT16          LayerId;

    struct Callbacks
    {
        FWPS_CALLOUT_CLASSIFY_FN            Classify;

        FWPS_CALLOUT_NOTIFY_FN              Notify;

        FWPS_CALLOUT_FLOW_DELETE_NOTIFY_FN  FlowDeleteNotify;

    } Callbacks;

} WFP_CALLOUT_DEFINITION, *PWFP_CALLOUT_DEFINITION;

typedef struct _WFP_CALLOUT_REG_ITEM
{
    ULONG32		CalloutRegId;
    GUID		LayerGUID;
    UINT16		LayerId;
    UINT64      FilterId;
} WFP_CALLOUT_REG_ITEM, *PWFP_CALLOUT_REG_ITEM;

typedef struct _WFP_CALLOUT_REG_INFO
{
    ULONG					MaxCount;
    ULONG					Count;
    PWFP_CALLOUT_REG_ITEM   Items;
} WFP_CALLOUT_REG_INFO, *PWFP_CALLOUT_REG_INFO;

typedef struct _WFP_DATA
{
    //  Memory manager
    PKM_MEMORY_MANAGER  MemoryManager;

    //  Driver object received in DriverEntry routine
    PDRIVER_OBJECT      DriverObject;

    //  Device object (used for callouts registration)
    PDEVICE_OBJECT      DeviceObject;

    //  Device object

    struct BFEInfo
    {
        //  Transport level injection handle
        //  Note: wfp requires separate injection
        //        handles for ipv6/ipv4 packet inspection
        HANDLE  TransportInjectionHandle;

        //  Handle to BFE engine
        HANDLE  EngineHandle;

        struct SubLayer
        {
            //  Boolean flag that identifies whether the sublayer was added
            BOOLEAN Added;

            //  Sublayer key
            GUID    Guid;

        } SubLayer;

        //  Handle to BFE state watcher instance
        HANDLE  BFEStateWatcher;

    } BFEInfo;

    //  Callouts registration information
    WFP_CALLOUT_REG_INFO        CalloutRegInfo;

    KM_LIST                     FlowContexts;

    //  Boolean value representing the current state
    ULONG                       FilteringActive;

    //  Event callback routine
    PWFP_NETWORK_EVENT_CALLBACK EventCallback;

    PVOID                       EventCallbackContext;

} WFP_DATA, *PWFP_DATA;

typedef struct _WFP_FLOW_CONTEXT
{
    //  List link
    LIST_ENTRY          Link;

    //  Layer id
    UINT16              LayerId;

    //  Callout id
    ULONG               CalloutId;

    //  Flow id (flow handle)
    UINT64              FlowId;

    //  Network event info
    PNETWORK_EVENT_INFO Info;

    //  Wfp data
    PWFP_DATA           WfpData;

    //  Removal flag
    BOOLEAN             RemoveInProgress;

} WFP_FLOW_CONTEXT, *PWFP_FLOW_CONTEXT;

/*
    ----------------------------------------------------------------------
    Various macros
    ----------------------------------------------------------------------
*/

#define WFP_SUBLAYER_NAME_W         L"ChangeDynamix Inspection sublayer"
#define WFP_SUBLAYER_DESC_W         L"ChangeDynamix sublayer for inspection callouts"

#define WFP_DEVICE_NAME_W           L"4FA9893C-A44A-4474-A9B9-ACDE01F32AFB"

#define WFP_GENERIC_CALLOUT_NAME_W  L"ChangeDynamix inspection callout"
#define WFP_GENERIC_CALLOUT_DESC_W  L"ChangeDynamix inspection callout"

#define WFP_DECLARE_CALLOUT_CALLBACK1(CallbackName) \
    void CallbackName( \
        __in        const FWPS_INCOMING_VALUES          *InFixedValues, \
        __in        const FWPS_INCOMING_METADATA_VALUES *InMetaValues, \
        __inout     PVOID                               LayerData, \
        __in_opt    const void                          *ClassifyContext, \
        __in        const FWPS_FILTER1                  *Filter, \
        __in        UINT64                              FlowContext, \
        __out       FWPS_CLASSIFY_OUT                   *ClassifyOut)

#define __WFP_DECLARE_CALLOUT_DEFINITION(Layer, LayerId, ClassifyCallback) \
{ \
    Layer, \
    LayerId, \
    { \
        ClassifyCallback, \
        Wfp_Generic_NotifyCallback, \
        Wfp_Generic_FlowDeleteNotifyCallback \
    } \
}

#define WFP_ALE_AUTH_CONNECT_V4_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
        &FWPM_LAYER_ALE_AUTH_CONNECT_V4, \
        FWPS_LAYER_ALE_AUTH_CONNECT_V4, \
        Wfp_ALE_Connect_Callback)

#define WFP_ALE_AUTH_CONNECT_V6_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
        &FWPM_LAYER_ALE_AUTH_CONNECT_V6, \
        FWPS_LAYER_ALE_AUTH_CONNECT_V6, \
        Wfp_ALE_Connect_Callback)

#define WFP_ALE_AUTH_RECV_ACCEPT_V4_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
        &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, \
        FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4, \
        Wfp_ALE_RecvAccept_Callback)

#define WFP_ALE_AUTH_RECV_ACCEPT_V6_CALLOUT_DEFINITION \
    __WFP_DECLARE_CALLOUT_DEFINITION( \
    &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, \
    FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6, \
    Wfp_ALE_RecvAccept_Callback)

/*
    ----------------------------------------------------------------------
    Forward declarations
    ----------------------------------------------------------------------
*/

void __stdcall Wfp_BFEStateChangeCallback(
    __inout PVOID               Context,
    __in    FWPM_SERVICE_STATE  NewState);

WFP_DECLARE_CALLOUT_CALLBACK1(Wfp_ALE_Connect_Callback);

NTSTATUS __stdcall Wfp_Generic_NotifyCallback(
    __in            FWPS_CALLOUT_NOTIFY_TYPE    NotifyType,
    __in    const   GUID                        *FilterKey,
    __in    const   FWPS_FILTER                 *Filter);

void __stdcall Wfp_Generic_FlowDeleteNotifyCallback(
{'fraction_non_alphanumeric': 0.14620274339243894, 'fraction_numerical': 0.00853128136500502, 'mean_word_length': 1.6471109143236662, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4771229', 'n_tokens_mistral': 3859, 'n_tokens_neox': 3569, 'n_words': 681}