Forums

[Maggie]

The Filter I Use works fine before winpkfilter version 3.4.0.1,and it return false On version 3.4.0.1 or above.

[Maggie]

PSTATIC_FILTER_TABLE g_pFilters = NULL;
HANDLE g_hAdapter = NULL;
u_short g_uPort = 12345;

bool CreateFilter(HANDLE hAdapter)
{
DWORD dwRuleCount = 1;
DWORD dwTableSize = sizeof(STATIC_FILTER_TABLE) + sizeof(STATIC_FILTER) * (dwRuleCount + 1) * 2;
g_pFilters = (PSTATIC_FILTER_TABLE)malloc(dwTableSize);

if (NULL == g_pFilters)
{
return false;
}
memset(g_pFilters,0,dwTableSize);

bool Is64OS = Is64BitOS();

g_pFilters->m_TableSize = dwRuleCount * 2 + 1;
DWORD dwIndex = 0;
if (Is64OS)
{
g_pFilters->m_StaticFilters[dwIndex].m_Adapter.QuadPart = (ULONGLONG)hAdapter;
}
else
{
g_pFilters->m_StaticFilters[dwIndex].m_Adapter.LowPart = (ULONG)hAdapter;
}
g_pFilters->m_StaticFilters[dwIndex].m_ValidFields = NETWORK_LAYER_VALID | TRANSPORT_LAYER_VALID;
g_pFilters->m_StaticFilters[dwIndex].m_FilterAction = FILTER_PACKET_REDIRECT;
g_pFilters->m_StaticFilters[dwIndex].m_dwDirectionFlags = PACKET_FLAG_ON_RECEIVE;

// Network layer filter
g_pFilters->m_StaticFilters[dwIndex].m_NetworkFilter.m_dwUnionSelector = IPV4;
g_pFilters->m_StaticFilters[dwIndex].m_NetworkFilter.m_IPv4.m_ValidFields = IP_V4_FILTER_PROTOCOL;
g_pFilters->m_StaticFilters[dwIndex].m_NetworkFilter.m_IPv4.m_Protocol = IPPROTO_TCP;

if (g_uPort > 0)
{
g_pFilters->m_StaticFilters[dwIndex].m_TransportFilter.m_dwUnionSelector = TCPUDP;
g_pFilters->m_StaticFilters[dwIndex].m_TransportFilter.m_TcpUdp.m_ValidFields = TCPUDP_DEST_PORT;
g_pFilters->m_StaticFilters[dwIndex].m_TransportFilter.m_TcpUdp.m_DestPort.m_StartRange = g_uPort;
g_pFilters->m_StaticFilters[dwIndex].m_TransportFilter.m_TcpUdp.m_DestPort.m_EndRange = g_uPort;
}

dwIndex++;

g_pFilters->m_StaticFilters[dwIndex].m_Adapter.QuadPart = 0;
g_pFilters->m_StaticFilters[dwIndex].m_ValidFields = 0;
g_pFilters->m_StaticFilters[dwIndex].m_FilterAction = FILTER_PACKET_PASS;
g_pFilters->m_StaticFilters[dwIndex].m_dwDirectionFlags = PACKET_FLAG_ON_RECEIVE | PACKET_FLAG_ON_SEND;
return true;
}

void Start()
{
…………………………..
………………………..
if (!CreateFilter(g_hAdapter))
{
printf(“Fail To Create Filter\n”);
return false;
}

if (!SetPacketFilterTable(g_pFilters))
{
printf(“Fail To Set Packet Filter\n”);
return false;
}
}

filter table changed on latest version or SetPacketFilterTable changed?

[Maggie]

I try https://github.com/wiresock/ndisapi/blob/master/examples/cpp/udp2tcp/udp2tcp.cpp
bool load_filters(const CNdisApi& api, const bool is_server, const uint16_t port)
{….
}

it return false on version 3.4.0.1 as well

[Vadim Smirnov]

In the Windows Packet Filter v3.4.0, we’ve made a minor update to the structure layout for static filters in order to comply with ARM64 memory alignment requirements. To resolve any issues with your static filters, simply rebuild your code using the updated common.h file.

[Author]

Posts