Sekhar Sengupta
Sekhar Sengupta

Reputation: 21

NDIS 6.0 Filter driver does not send ARP reply

I am developing a NDIS filter (NCF_LW_FILTER, FilterClass:Compression, FilterType: Modifying) driver. I am trying to send ARP reply (ethernet header + ARP header) packet to another PC in the same network within a method named 'SendARP()'. The signature of this method is...

    VOID SendARP(
    NDIS_HANDLE         FilterModuleContext,
    PQUEUE_ARP_NODE     pQARPData,
    NDIS_PORT_NUMBER    PortNumber,
    ULONG               SendFlags
    )

In FilterAttach(), I have allocated a NetBufferListPool using NdisAllocateNetBufferListPool().

Inside the SendARP() method, I am allocating a Data buffer of 42 bytes (ethernet header + ARP header) using NdisAllocateMemoryWithTagPriority.

   PVOID pDataBuffer = NdisAllocateMemoryWithTagPriority(pFilter->FilterHandle, 42, 
   FILTER_ALLOC_TAG, NormalPoolPriority).

In this data buffer (pDataBuffer), I am copying the required ethernet header (14 bytes) + ARP Header (28 bytes). After copying (in network byte order) the ethernet and ARP header in the allocated buffer, I am allocating an MDL specifying the pDataBuffer buffer.

    PMDL pmdl = NdisAllocateMdl(pFilter->FilterHandle, pDataBuffer, 42);

After allocating the MDL, I am allocating the NET_BUFFER and NET_BUFFER_LIST specifying the MDL.

    PNET_BUFFER_LIST pnbl = NdisAllocateNetBufferAndNetBufferList(pFilter->NetBufferListPool, 0, 0, pmdl, 0, 42);

Now, I assigned the filter handle to the sourceHandle of the NET_BUFFER_LIST

    pnbl->SourceHandle = pFilter->FilterHandle;

And finally send the packet NdisFSendNetBufferLists(pFilter->FilterHandle, pnbl, PortNumber, SendFlags);

The filter FilterSendNetBufferLists() method looks like below,

    VOID FilterSendNetBufferLists(
          NDIS_HANDLE         FilterModuleContext,
          PNET_BUFFER_LIST    NetBufferLists,
          NDIS_PORT_NUMBER    PortNumber,
          ULONG               SendFlags
        )
        {
            PMS_FILTER          pFilter       = (PMS_FILTER)FilterModuleContext;
            FILTER_STATE        fState        = FilterStateUnspecified;
            BOOLEAN             DispatchLevel = FALSE;
            BOOLEAN             bFalse        = FALSE;

            FILTER_ACQUIRE_LOCK(&pFilter->Lock, DispatchLevel);
            fState = pFilter->State;
            FILTER_RELEASE_LOCK(&pFilter->Lock, DispatchLevel);

            if (fState == FilterRunning)
            {
                SendARP(FilterModuleContext, pARPData, PortNumber, SendFlags);
                
                //Original NET_BUFFER_LIST
                NdisFSendNetBufferLists(pFilter->FilterHandle, NetBufferLists, 
                PortNumber, SendFlags);
            }
            else
            {
                NdisFSendNetBufferListsComplete(pFilter->FilterHandle, NetBufferLists, 
                SendFlags);
            }
         }

The driver is installed on a VM (Win 10) connected by a virtual switch.

The problem is that the ARP reply packet is not delivering. Looks like it is discarding for any reason. I installed Wireshark in the VM, where I did not see that the ARP packet is going out.

The FilterSendNetBufferListsComplete() is defined in the following way...

    FilterSendNetBufferListsComplete(
    NDIS_HANDLE         FilterModuleContext,
    PNET_BUFFER_LIST    NetBufferLists,
    ULONG               SendCompleteFlags
    )
    {
         if (pFilter->FilterHandle == NetBufferLists->SourceHandle)
         {
              NdisFreeNetBufferList(NetBufferLists);
         }
         else
         {
              NdisFSendNetBufferListsComplete(pFilter->FilterHandle, NetBufferLists, 
              SendCompleteFlags);
         }
     }

Can anyone please suggest what is the wrong with the above code?

Any help will be appreciated.

Thanks.

Upvotes: 0

Views: 36

Answers (0)

Related Questions