Storing filter rules for NDIS Intermediate Driver

Hello,

I want to filter outgoing packets with some simple filter rules. Do I
really need to implement an IOCTL Interface or is there a way to
implement a simple dynamic data structure in kernel space where I can
store the filter rules?

I thought about sending the rules by an application via a
configuration packet filtered by the driver, so the problem only
relates to the data structure.

Stephan
Tue Oct 12 15:43:39 CDT 2004

What's wrong with IOCTL? It's actually very simple to implement, and
IOCTL is, btw, just there to allow data exchange between an app. and a
driver, which you want to do.

Take a look at the NDIS samples in the DDK. Some of them implement
IOCTL. Do a search for "NdisMRegisterDevice".

Stephan
http://www.microsoft.com/whdc/resources/mvp/SW-MVP.mspx
---
On 12 Oct 2004 04:09:48 -0700, christian.beckel@gmx.de (Christian
Beckel) wrote:

>Hello,
>
>I want to filter outgoing packets with some simple filter rules. Do I
>really need to implement an IOCTL Interface or is there a way to
>implement a simple dynamic data structure in kernel space where I can
>store the filter rules?
>
>I thought about sending the rules by an application via a
>configuration packet filtered by the driver, so the problem only
>relates to the data structure.

christian
Wed Oct 13 16:27:56 CDT 2004

It should be possible to configure the filter rules from another
computer, so that there isn't any application running on the computer
where the driver is installed. Maybe the driver will be configured by
a packet sent from a web interface or something like that.

As far as I understood the IOCTL interface, there is an extra
application running in userspace from which you can control the driver
(loading / unloading, data exchange, ...). Am I right in this point?
We want to avoid any extra application and want to keep the driver as
simple as possible.



"Stephan Wolf [MVP]" <stewo68@hotmail.com> wrote in message news:<79gom05d73jh2cp9ai0fbh6qob49umm77l@4ax.com>...
> What's wrong with IOCTL? It's actually very simple to implement, and
> IOCTL is, btw, just there to allow data exchange between an app. and a
> driver, which you want to do.
>
> Take a look at the NDIS samples in the DDK. Some of them implement
> IOCTL. Do a search for "NdisMRegisterDevice".
>
> Stephan
> http://www.microsoft.com/whdc/resources/mvp/SW-MVP.mspx

Stephan
Thu Oct 14 11:07:48 CDT 2004

So what's the actual problem here? Sure you can inspect all packets in
your IM to find those that contain your "configuration data" (or
whatever fits your needs). All you need to do is use some proprietary
packet format that does not interfere with any standard formats out
there. For instance, you could use a SNAP header and set the SNAP.OUI
to that owned by your company (if your comapny has one, see e.g.
http://standards.ieee.org/regauth/oui/oui.txt) and then set the
SNAP.Type to some "experimental" value (although you are free to
choose anything here (due to the proprietary OUI), I suggest you
choose one between 0x0101..0x01ff, see
http://standards.ieee.org/regauth/ethertype/eth.txt).

HTH, Stephan
---
On 13 Oct 2004 14:27:56 -0700, christian.beckel@gmx.de (Christian
Beckel) wrote:

>It should be possible to configure the filter rules from another
>computer, so that there isn't any application running on the computer
>where the driver is installed. Maybe the driver will be configured by
>a packet sent from a web interface or something like that.
>
>As far as I understood the IOCTL interface, there is an extra
>application running in userspace from which you can control the driver
>(loading / unloading, data exchange, ...). Am I right in this point?
>We want to avoid any extra application and want to keep the driver as
>simple as possible.
>
>
>
>"Stephan Wolf [MVP]" <stewo68@hotmail.com> wrote in message news:<79gom05d73jh2cp9ai0fbh6qob49umm77l@4ax.com>...
>> What's wrong with IOCTL? It's actually very simple to implement, and
>> IOCTL is, btw, just there to allow data exchange between an app. and a
>> driver, which you want to do.
>>
>> Take a look at the NDIS samples in the DDK. Some of them implement
>> IOCTL. Do a search for "NdisMRegisterDevice".
>>
>> Stephan
>> http://www.microsoft.com/whdc/resources/mvp/SW-MVP.mspx