庖丁解牛-----winpcap源码彻底解密

旧城等待， 2022-08-19 05:57 604阅读 0赞

### [庖丁解牛-----winpcap源码彻底解密(一)][-----winpcap] ###

**本文系转载:原文出处为:[http://blog.csdn.net/smilestone322/article/details/6084620][-----winpcap]**

最近忙一个项目，需要使用winpcap抓取网络数据包，调用winpcap提供的api进行抓包后，发现丢包情况比较严重，而且cpu占用率比较大。所以下定决心，对winpcap源码进行分析，因为对驱动和对Ndis网络驱动比较熟悉，所以分析源码还不是很费劲，其实winpcap底层的npf不过是一个Ndis协议驱动，所以它能做的工作就是捕获数据包，而不能做防火墙等使用， 要做防火墙，一般使用的都是Ndis中间层过滤驱动，呵呵，不多说了，超出了本文的范围。下面分析源代码的一点经验，供大家分享，共同进步。

总的来说，winpcap主要有3个文件需要关注，wpcap.dll, parket.dll, npf.sys。其中wpcap和packet属于应用层的程序，npf属于内核层的程序，即npf就是一个Ndis的协议驱动。在本文中主要分析这几个文件和他们之间是怎么通信的，对于驱动的基础知识和Ndis驱动程序不在进行重点讲解，如果对本文的内容看不明白，大家可以在回过头学习驱动的知识，也可以和我交流。

首先我们从上往下层层分析，即先分析winpcap的wpcap.dll，然后分析parket.dll，最后分析底层的npf。对于大多数应用开发的人来说，使用wpcap.dll就足够了，因为它提供的api函数足够你捕获网络数据包，从而分析网络数据包，解析网络数据包。下面讲解下数据包的捕获流程。

数据包的捕获流程一般都分为以下几步：

**1） 查找设备，也就是说查找网卡设备，调用的函数是pcap\_findalldevs**

**2） 打开对应的网卡设备，调用的函数为pcap\_open\_live**

**3） 过滤数据包，在解析之前过滤数据包，可以减少解析的数据包数，增强数据包解析的能力，主要调用2个函数，pcap\_compile编译过滤器，采用pcap\_setfiter；**

**4） 获取数据包，主要的函数有pcap\_loop，pcap\_dispatch,pcap\_next,pcap\_next\_ex这4个函数，这四个函数的区别可以参考winpcap的手册。**

**5） 关闭设备，pcap\_freealldevs;**

这是基本的数据包捕获流程，对一般的应用层的开发者来说，知道这些已经足够了。

但是当网络数据很大的时候，比如大块的文件传输，等，就需要考虑丢包情况了。下面介绍改善性能的api。怎样设置内核缓冲，怎样设置用户缓冲区，如何设置内核缓冲区到用户缓冲区的拷贝数据的最小值，即当内核缓冲区的数据达到这个值时，才能被上层的应用程序读走。在分析这些之前，必先知道数据包是怎么从网卡到达应用程序的。对于linux和windows系统，稍有不同，linux下采用libcap抓取网络数据包，windows采用winpcap抓取网络数据包。数据包从网卡到应用程序的过程如下：

![0_12926834943LSK.gif][]

**图1：linux下数据包捕获流程**

**![0_1292683250mtDb.gif][]**

**图2：winpcap数据包捕获流程**

从linux和windows抓包过程可以看出，libcap和winpcap的不同之处如下：

（1）Libcap在BPF中采用2个缓冲区，即store buffer和hold buffer，从网卡拷贝的数据首先放入到store buffer ，然后再复制到hold buffer，就是一个乒乓操作 经过hold buffer拷贝到应用程序的user buffer 中，这两个缓冲区的大小一般为32k。而winpcap采用的是一个循环缓冲区，即内核缓冲区，kernel buffer，内核缓冲区的默认大小为1M，可以采用pcap\_setbuff对内核缓冲区进行修改。

（2）libcap的内核缓冲区和用户缓冲区大小在应用层是不可以更改的，如果需要更改，必须修改内核代码，然后重新编译，而winpcap提供了修改内核缓冲区和用户缓冲区的api函数，用户可以方便的设置缓冲区的大小，用户缓冲区的默认大小为256k，可以使用pcap\_setuserbuffer进行设置。

（3）从图中可以看出，libcap只有2层，内核层和用户层，而winpcap有3层，在用户层又分为packet.dll和wpcap.dll，这样层次更加清晰，方便用户的理解，当然用户可以直接调用wpcap.dll的api进行数据包操作，也可以调用packet.dll进行数据包操作。

（4）对数据包的捕获一般要经过3个内存的拷贝，首先是网卡拷贝到内核缓冲区，然后内核缓冲区拷贝到用户缓冲区，然后通过api将用户缓冲区的数据包读走，进行协议分析，然后把数据保存起来，放入应用程序开辟的内存中。这一点它们都是类似的。

(5) winpcap提供了直接从内核缓冲区将数据写入文件的方法，这样减少了数据包的拷贝次数，提高了收包的速度。

（6）如何将数据包从内核缓冲区直接提供给应用程序，这是提高数据包捕获性能的好方法？

读者可以尝试这样去做，可以降低cpu占用率和丢包率。

(7)libcap老的版本没有发送数据包的函数，winpcap有pcap\_sendpacket发送数据包；

（8）winpcap采用pcap\_setmintocopy设置每次从内核缓冲区拷贝到用户缓冲区的最小值，当内核缓冲区的数据小于这个值时，读操作不返回，直到超时为止；

下面由上到下对各个函数进行解析：

（1） pcap\_findalldevs

int pcap\_findalldevs(pcap\_if\_t \*\*alldevsp, char \*errbuf)

pcap\_if\_t \*devlist = NULL;

int ret = 0;

const char \*desc;

char \*AdaptersName;

ULONG NameLength;

char \*name;

if (!PacketGetAdapterNames(NULL, &NameLength))

DWORD last\_error = GetLastError();

if (last\_error != ERROR\_INSUFFICIENT\_BUFFER)

snprintf(errbuf, PCAP\_ERRBUF\_SIZE,

"PacketGetAdapterNames: %s",

pcap\_win32strerror());

return (-1);

if (NameLength > 0)

AdaptersName = (char\*) malloc(NameLength);

else

\*alldevsp = NULL;

return 0;

if (AdaptersName == NULL)

snprintf(errbuf, PCAP\_ERRBUF\_SIZE, "Cannot allocate enough memory to list the adapters.");

return (-1);

if (!PacketGetAdapterNames(AdaptersName, &NameLength)) \{

snprintf(errbuf, PCAP\_ERRBUF\_SIZE,

"PacketGetAdapterNames: %s",

pcap\_win32strerror());

free(AdaptersName);

return (-1);

/\*

\* "PacketGetAdapterNames()" returned a list of

\* null-terminated ASCII interface name strings,

\* terminated by a null string, followed by a list

\* of null-terminated ASCII interface description

\* strings, terminated by a null string.

\* This means there are two ASCII nulls at the end

\* of the first list.

\* Find the end of the first list; that's the

\* beginning of the second list.

\*/

desc = &AdaptersName\[0\];

while (\*desc != '/0' || \*(desc + 1) != '/0')

desc++;

/\*

\* Found it - "desc" points to the first of the two

\* nulls at the end of the list of names, so the

\* first byte of the list of descriptions is two bytes

\* after it.

\*/

desc += 2;

/\*

\* Loop over the elements in the first list.

\*/

name = &AdaptersName\[0\];

while (\*name != '/0') \{

/\*

\* Add an entry for this interface.

\*/

if (pcap\_add\_if\_win32(&devlist, name, desc, errbuf) == -1) \{

/\*

\* Failure.

\*/

ret = -1;

break;

name += strlen(name) + 1;

desc += strlen(desc) + 1;

if (ret != -1) \{

/\*

\* We haven't had any errors yet; do any platform-specific

\* operations to add devices.

\*/

if (pcap\_platform\_finddevs(&devlist, errbuf) < 0)

ret = -1;

if (ret == -1) \{

/\*

\* We had an error; free the list we've been constructing.

\*/

if (devlist != NULL) \{

pcap\_freealldevs(devlist);

devlist = NULL;

\*alldevsp = devlist;

free(AdaptersName);

return (ret);

/获取可用网络适配器的一个列表与它们的描述

BOOLEAN PacketGetAdapterNames(PTSTR pStr,PULONG BufferSize)

PADAPTER\_INFO TAdInfo;

ULONG SizeNeeded = 0;

ULONG SizeNames = 0;

ULONG SizeDesc;

ULONG OffDescriptions;

TRACE\_ENTER("PacketGetAdapterNames");

TRACE\_PRINT\_OS\_INFO();

TRACE\_PRINT2("Packet DLL version %s, Driver version %s", PacketLibraryVersion, PacketDriverVersion);

TRACE\_PRINT1("PacketGetAdapterNames: BufferSize=%u", \*BufferSize);

// Check the presence on some libraries we rely on, and load them if we found them

//f

PacketLoadLibrariesDynamically();

//d

// Create the adapter information list

TRACE\_PRINT("Populating the adapter list...");

PacketPopulateAdaptersInfoList();

WaitForSingleObject(g\_AdaptersInfoMutex, INFINITE);

if(!g\_AdaptersInfoList)

ReleaseMutex(g\_AdaptersInfoMutex);

\*BufferSize = 0;

TRACE\_PRINT("No adapters found in the system. Failing.");

SetLastError(ERROR\_INSUFFICIENT\_BUFFER);

TRACE\_EXIT("PacketGetAdapterNames");

return FALSE; // No adapters to return

// First scan of the list to calculate the offsets and check the sizes

for(TAdInfo = g\_AdaptersInfoList; TAdInfo != NULL; TAdInfo = TAdInfo->Next)

if(TAdInfo->Flags != INFO\_FLAG\_DONT\_EXPORT)

// Update the size variables

SizeNeeded += (ULONG)strlen(TAdInfo->Name) + (ULONG)strlen(TAdInfo->Description) + 2;

SizeNames += (ULONG)strlen(TAdInfo->Name) + 1;

// Check that we don't overflow the buffer.

// Note: 2 is the number of additional separators needed inside the list

if(SizeNeeded + 2 > \*BufferSize || pStr == NULL)

ReleaseMutex(g\_AdaptersInfoMutex);

TRACE\_PRINT1("PacketGetAdapterNames: input buffer too small, we need %u bytes", \*BufferSize);

\*BufferSize = SizeNeeded + 2; // Report the required size

TRACE\_EXIT("PacketGetAdapterNames");

SetLastError(ERROR\_INSUFFICIENT\_BUFFER);

return FALSE;

OffDescriptions = SizeNames + 1;

// Second scan of the list to copy the information

for(TAdInfo = g\_AdaptersInfoList, SizeNames = 0, SizeDesc = 0; TAdInfo != NULL; TAdInfo = TAdInfo->Next)

if(TAdInfo->Flags != INFO\_FLAG\_DONT\_EXPORT)

// Copy the data

StringCchCopyA(

((PCHAR)pStr) + SizeNames,

\*BufferSize - SizeNames,

TAdInfo->Name);

StringCchCopyA(

((PCHAR)pStr) + OffDescriptions + SizeDesc,

\*BufferSize - OffDescriptions - SizeDesc,

TAdInfo->Description);

// Update the size variables

SizeNames += (ULONG)strlen(TAdInfo->Name) + 1;

SizeDesc += (ULONG)strlen(TAdInfo->Description) + 1;

// Separate the two lists

((PCHAR)pStr)\[SizeNames\] = 0;

// End the list with a further /0

((PCHAR)pStr)\[SizeNeeded + 1\] = 0;

ReleaseMutex(g\_AdaptersInfoMutex);

TRACE\_EXIT("PacketGetAdapterNames");

return TRUE;

pcap\_findalldevs为wpcap.dll中查找设备列表的函数，里面调用Packet.dll中的PacketGetAdapterNames获取设备列表。它调用PacketPopulateAdaptersInfoList函数，函数PacketPopulateAdaptersInfoList() 创建适配器的链表g\_AdaptersInfoList。该函数先释放掉g\_AdaptersInfoList中旧的内容，然后调用PacketGetAdaptersNPF()函数用新的信息填充该链表。而PacketGetAdaptersNPF调用PacketAddAdapterNPF，从注册表中获取设备信息。PacketAddAdapterNPF又调用PacketRequest，将请求发送到NPF，

Result=(BOOLEAN)DeviceIoControl(AdapterObject->hFile,(DWORD) Set ? (DWORD)BIOCSETOID : (DWORD)BIOCQUERYOID,OidData,sizeof(PACKET\_OID\_DATA)-1+OidData->Length,OidData,

sizeof(PACKET\_OID\_DATA)-1+OidData->Length,&BytesReturned,NULL);

所有的应用程序和驱动之间通信，最终都是调用DeviceIoControl，WriteFile和ReadFile，Npf中和DeviceIoControl对应的就是NPF\_IoControl。

（2） pcap\_open\_live

pcap\_t \*

pcap\_open\_live(const char \*source, int snaplen, int promisc, int to\_ms, char \*errbuf)

pcap\_t \*p;

int status;

p = pcap\_create(source, errbuf);

if (p == NULL)

return (NULL);

status = pcap\_set\_snaplen(p, snaplen); //设置最大包长

if (status < 0)

goto fail;

status = pcap\_set\_promisc(p, promisc); //是否混杂模式

if (status < 0)

goto fail;

status = pcap\_set\_timeout(p, to\_ms); //设置超时

if (status < 0)

goto fail;

/\*

\* Mark this as opened with pcap\_open\_live(), so that, for

\* example, we show the full list of DLT\_ values, rather

\* than just the ones that are compatible with capturing

\* when not in monitor mode. That allows existing applications

\* to work the way they used to work, but allows new applications

\* that know about the new open API to, for example, find out the

\* DLT\_ values that they can select without changing whether

\* the adapter is in monitor mode or not.

\*/

p->oldstyle = 1;

status = pcap\_activate(p);

if (status < 0)

goto fail;

return (p);

fail:

if (status == PCAP\_ERROR || status == PCAP\_ERROR\_NO\_SUCH\_DEVICE ||

status == PCAP\_ERROR\_PERM\_DENIED)

strlcpy(errbuf, p->errbuf, PCAP\_ERRBUF\_SIZE);

else

snprintf(errbuf, PCAP\_ERRBUF\_SIZE, "%s: %s", source,

pcap\_statustostr(status));

pcap\_close(p);

return (NULL);

该函数设置最大的包长，设置超时时间，设置混杂模式等。Pcap\_open\_live调用pcap\_activate，pcap\_activate定义如下：

Int pcap\_activate(pcap\_t \*p)

int status;

status = p->activate\_op(p);

if (status >= 0)

p->activated = 1;

return (status);

Pcap\_activate调用activate\_op，该函数是回调函数， p->activate\_op = pcap\_activate\_win32;即pcap\_activate调用pcap\_activate\_win32函数，pcap\_activate\_win32函数调用PacketOpenAdapter，同时函数设置PacketSetBuff和if(PacketSetMinToCopy(p->adapter,16000)==FALSE)，设置设置最小copysize=16k。PacketOpenAdapter中调用使用NPF device driver打开网卡(adapter)，同样调用PacketRequest，调用DeviceIoControl，即对应驱动中的NPF\_IoControl。

(3) pcap\_setfilter

Int pcap\_setfilter(pcap\_t \*p, struct bpf\_program \*fp)

return p->setfilter\_op(p, fp);

p->setfilter\_op = pcap\_setfilter\_win32\_npf;

pcap\_setfilter调用pcap\_setfilter\_win32\_npf设置过滤器；

static int

pcap\_setfilter\_win32\_npf(pcap\_t \*p, struct bpf\_program \*fp)

if(PacketSetBpf(p->adapter,fp)==FALSE)\{

/\*

\* Kernel filter not installed.

\* XXX - fall back on userland filtering, as is done

\* on other platforms?

\*/

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "Driver error: cannot set bpf filter: %s", pcap\_win32strerror());

return (-1);

/\*

\* Discard any previously-received packets, as they might have

\* passed whatever filter was formerly in effect, but might

\* not pass this filter (BIOCSETF discards packets buffered

\* in the kernel, so you can lose packets in any case).

\*/

p->cc = 0;

return (0);

BOOLEAN PacketSetBpf(LPADAPTER AdapterObject, struct bpf\_program \*fp)

DWORD BytesReturned;

BOOLEAN Result;

TRACE\_ENTER("PacketSetBpf");

\#ifdef HAVE\_WANPACKET\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDISWAN\_ADAPTER)

Result = WanPacketSetBpfFilter(AdapterObject->pWanAdapter, (PUCHAR)fp->bf\_insns, fp->bf\_len \* sizeof(structbpf\_insn));

TRACE\_EXIT("PacketSetBpf");

return Result;

\#endif

\#ifdef HAVE\_AIRPCAP\_API

if(AdapterObject->Flags == INFO\_FLAG\_AIRPCAP\_CARD)

Result = (BOOLEAN)g\_PAirpcapSetFilter(AdapterObject->AirpcapAd,

(char\*)fp->bf\_insns,

fp->bf\_len \* sizeof(struct bpf\_insn));

TRACE\_EXIT("PacketSetBpf");

return Result;

\#endif // HAVE\_AIRPCAP\_API

\#ifdef HAVE\_NPFIM\_API

if(AdapterObject->Flags == INFO\_FLAG\_NPFIM\_DEVICE)

Result = (BOOLEAN)g\_NpfImHandlers.NpfImSetBpfFilter(AdapterObject->NpfImHandle,

fp->bf\_insns,

fp->bf\_len \* sizeof(struct bpf\_insn));

TRACE\_EXIT("PacketSetBpf");

return TRUE;

\#endif // HAVE\_NPFIM\_API

\#ifdef HAVE\_DAG\_API

if(AdapterObject->Flags & INFO\_FLAG\_DAG\_CARD)

// Delegate the filtering to higher layers since it's too expensive here

TRACE\_EXIT("PacketSetBpf");

return TRUE;

\#endif // HAVE\_DAG\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDIS\_ADAPTER)

//调用DeviceIoControl 设置过滤器

Result = (BOOLEAN)DeviceIoControl(AdapterObject->hFile,BIOCSETF,(char\*)fp->bf\_insns,fp->bf\_len\*sizeof(structbpf\_insn),NULL,0,&BytesReturned,NULL);

else

TRACE\_PRINT1("Request to set BPF filter on an unknown device type (%u)", AdapterObject->Flags);

Result = FALSE;

TRACE\_EXIT("PacketSetBpf");

return Result;

对应驱动的NPF\_IoControl。

### [庖丁解牛-----winpcap源码彻底解密（二）][-----winpcap 1] ###

查找到网卡后，open网卡，设置过滤器，然后就该读写数据包了，下面就讲讲怎么发送和接收数据包了。

(4) [pcap\_sendpacket][pcap_sendpacket]

[pcap\_sendpacket][pcap_sendpacket]用来发送数据包，该函数只能发送单个的数据包，

int　pcap\_sendpacket(pcap\_t \*p, const u\_char \*buf, int size)

if (p->inject\_op(p, buf, size) == -1)

return (-1);

return (0);

p->inject\_op = pcap\_inject\_win32;

/\* Send a packet to the network \*/

static int pcap\_inject\_win32(pcap\_t \*p, const void \*buf, size\_t size)\{

LPPACKET PacketToSend;

PacketToSend=PacketAllocatePacket();

if (PacketToSend == NULL)

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "send error: PacketAllocatePacket failed");

return -1;

PacketInitPacket(PacketToSend,(PVOID)buf,size);

if(PacketSendPacket(p->adapter,PacketToSend,TRUE) == FALSE)\{

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "send error: PacketSendPacket failed");

PacketFreePacket(PacketToSend);

return -1;

PacketFreePacket(PacketToSend);

/\*

\* We assume it all got sent if "PacketSendPacket()" succeeded.

\* "pcap\_inject()" is expected to return the number of bytes

\* sent.

\*/

return size;

Pcap\_inject\_win32函数调用ParketSendPacket将数据包转发到Parket.dll，下面就看看ParketSendPacket的源码：

// 发送单个包

BOOLEAN PacketSendPacket(LPADAPTER AdapterObject,LPPACKET lpPacket,BOOLEAN Sync)

DWORD BytesTransfered;

BOOLEAN Result;

TRACE\_ENTER("PacketSendPacket");

UNUSED(Sync);

\#ifdef HAVE\_AIRPCAP\_API

if(AdapterObject->Flags == INFO\_FLAG\_AIRPCAP\_CARD)

if(g\_PAirpcapWrite)

Result = (BOOLEAN)g\_PAirpcapWrite(AdapterObject->AirpcapAd, lpPacket->Buffer, lpPacket->Length);

TRACE\_EXIT("PacketSetMinToCopy");

return Result;

else

TRACE\_EXIT("PacketSetMinToCopy");

TRACE\_PRINT("Transmission not supported with this version of AirPcap");

return FALSE;

\#endif // HAVE\_AIRPCAP\_API

\#ifdef HAVE\_WANPACKET\_API

if(AdapterObject->Flags == INFO\_FLAG\_NDISWAN\_ADAPTER)

TRACE\_PRINT("PacketSendPacket: packet sending not allowed on wan adapters");

TRACE\_EXIT("PacketSendPacket");

return FALSE;

\#endif // HAVE\_WANPACKET\_API

\#ifdef HAVE\_NPFIM\_API

if(AdapterObject->Flags == INFO\_FLAG\_NPFIM\_DEVICE)

TRACE\_PRINT("PacketSendPacket: packet sending not allowed on NPFIM adapters");

TRACE\_EXIT("PacketSendPacket");

return FALSE;

\#endif //HAVE\_NPFIM\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDIS\_ADAPTER)

Result = (BOOLEAN)WriteFile(AdapterObject->hFile,lpPacket->Buffer,lpPacket->Length,&BytesTransfered,NULL);

else

TRACE\_PRINT1("Request to write on an unknown device type (%u)", AdapterObject->Flags);

Result = FALSE;

TRACE\_EXIT("PacketSendPacket");

return Result;

PacketSendPacket通过 WriteFile将数据包转发出去。PacketSendPacket是parket.dll，WriteFile对应驱动中

NTSTATUS

NPF\_Write(

IN PDEVICE\_OBJECT DeviceObject,

IN PIRP Irp

)

POPEN\_INSTANCE Open;

PIO\_STACK\_LOCATION IrpSp;

PNDIS\_PACKET pPacket;

NDIS\_STATUS Status;

ULONG NumSends;

ULONG numSentPackets;

TRACE\_ENTER();

IrpSp = IoGetCurrentIrpStackLocation(Irp);

Open=IrpSp->FileObject->FsContext;

if (NPF\_StartUsingOpenInstance(Open) == FALSE)

// an IRP\_MJ\_CLEANUP was received, just fail the request

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_CANCELLED;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_CANCELLED;

NumSends = Open->Nwrites;

// validate the send parameters set by the IOCTL

if (NumSends == 0)

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_SUCCESS;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_SUCCESS;

// Validate input parameters:

// 1. The packet size should be greater than 0,

// 2. less-equal than max frame size for the link layer and

// 3. the maximum frame size of the link layer should not be zero.

if(IrpSp->Parameters.Write.Length == 0 || // Check that the buffer provided by the user is not empty

Open->MaxFrameSize == 0 || // Check that the MaxFrameSize is correctly initialized

Irp->MdlAddress == NULL ||

IrpSp->Parameters.Write.Length > Open->MaxFrameSize) // Check that the fame size is smaller that the MTU

TRACE\_MESSAGE(PACKET\_DEBUG\_LOUD,"Frame size out of range, or maxFrameSize = 0. Send aborted");

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_UNSUCCESSFUL;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_UNSUCCESSFUL;

// Increment the ref counter of the binding handle, if possible

if(NPF\_StartUsingBinding(Open) == FALSE)

TRACE\_MESSAGE(PACKET\_DEBUG\_LOUD,"Adapter is probably unbinding, cannot send packets");

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_INVALID\_DEVICE\_REQUEST;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_INVALID\_DEVICE\_REQUEST;

NdisAcquireSpinLock(&Open->WriteLock);

if(Open->WriteInProgress)

// Another write operation is currently in progress

NdisReleaseSpinLock(&Open->WriteLock);

NPF\_StopUsingBinding(Open);

TRACE\_MESSAGE(PACKET\_DEBUG\_LOUD,"Another Send operation is in progress, aborting.");

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_UNSUCCESSFUL;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_UNSUCCESSFUL;

else

Open->WriteInProgress = TRUE;

NdisResetEvent(&Open->NdisWriteCompleteEvent);

NdisReleaseSpinLock(&Open->WriteLock);

TRACE\_MESSAGE2(PACKET\_DEBUG\_LOUD,"Max frame size = %u, packet size = %u", Open->MaxFrameSize, IrpSp->Parameters.Write.Length);

// reset the number of packets pending the SendComplete

Open->TransmitPendingPackets = 0;

NdisResetEvent(&Open->WriteEvent);

numSentPackets = 0;

while( numSentPackets < NumSends )

NdisAllocatePacket(

&Status,

&pPacket,

Open->PacketPool

);

if (Status == NDIS\_STATUS\_SUCCESS)

// packet is available, prepare it and send it with NdisSend.

// If asked, set the flags for this packet.

// Currently, the only situation in which we set the flags is to disable the reception of loopback

// packets, i.e. of the packets sent by us.

if(Open->SkipSentPackets)

NdisSetPacketFlags(

pPacket,

g\_SendPacketFlags);

// The packet hasn't a buffer that needs not to be freed after every single write

RESERVED(pPacket)->FreeBufAfterWrite = FALSE;

// // Save the IRP associated with the packet

// RESERVED(pPacket)->Irp=Irp;

// Attach the writes buffer to the packet

NdisChainBufferAtFront(pPacket,Irp->MdlAddress);

InterlockedIncrement(&Open->TransmitPendingPackets);

NdisResetEvent(&Open->NdisWriteCompleteEvent);

// Call the MAC 调用NdisSend发送包

NdisSend(

&Status,

Open->AdapterHandle,

pPacket);

if (Status != NDIS\_STATUS\_PENDING)

// The send didn't pend so call the completion handler now

NPF\_SendComplete(

Open,

pPacket,

Status

);

numSentPackets ++;

else

// no packets are available in the Transmit pool, wait some time. The

// event gets signalled when at least half of the TX packet pool packets

// are available

NdisWaitEvent(&Open->WriteEvent,1);

// when we reach this point, all the packets have been enqueued to NdisSend,

// we just need to wait for all the packets to be completed by the SendComplete

// (if any of the NdisSend requests returned STATUS\_PENDING)

NdisWaitEvent(&Open->NdisWriteCompleteEvent, 0);

// all the packets have been transmitted, release the use of the adapter binding

NPF\_StopUsingBinding(Open);

// no more writes are in progress

NdisAcquireSpinLock(&Open->WriteLock);

Open->WriteInProgress = FALSE;

NdisReleaseSpinLock(&Open->WriteLock);

NPF\_StopUsingOpenInstance(Open);

// Complete the Irp and return success

Irp->IoStatus.Status = STATUS\_SUCCESS;

Irp->IoStatus.Information = IrpSp->Parameters.Write.Length;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

TRACE\_EXIT();

return STATUS\_SUCCESS;

### [庖丁解牛-----winpcap源码彻底解密（三）][-----winpcap 2] ###

上一篇讲了怎么发送数据包，这次接着讲怎么接收数据包，数据包过滤后，就被复制到内核缓冲区(kernel buffer)，接收数据包的方式有2种，使用回调函数接收数据包，比如pcap\_loop，pcap\_dispatch，二是非回调函数的方式来接收数据包，如pcap\_ next, pcap\_next\_ex。这一篇讲讲怎么发送数据包。

（1） pcap\_loop函数调用read\_op(p,cnt,callback,user)；

int pcap\_loop(pcap\_t \*p,int cnt, pcap\_handler callback,u\_char\* user) 调用read\_op(p,cnt,callback,user),该函数是一个回调函数，在pcap\_win32.c中有p->read\_op=pcap\_read\_win32\_npf；

//pcap\_loop,pcap\_dispatch,pcap\_next,pcap\_next\_ex中调用的函数

static int pcap\_read\_win32\_npf(pcap\_t \*p, int cnt, pcap\_handler callback, u\_char \*user)

int cc;

int n = 0;

\#ifdef HAVE\_REMOTE

static int samp\_npkt; // parameter needed for sampling, with '1 out of N' method has been requested

static struct timeval samp\_time; // parameter needed for sampling, with '1 every N ms' method has been requested

\#endif /\* HAVE\_REMOTE \*/

cc = p->cc;

if (p->cc == 0) \{

/\*

\* Has "pcap\_breakloop()" been called?

\*/

if (p->break\_loop) \{

/\*

\* Yes - clear the flag that indicates that it

\* has, and return -2 to indicate that we were

\* told to break out of the loop.

\*/

p->break\_loop = 0;

return (-2);

/\* capture the packets 接收包\*/

if(PacketReceivePacket(p->adapter,p->Packet,TRUE)==FALSE)\{

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "read error: PacketReceivePacket failed");

return (-1);

cc = p->Packet->ulBytesReceived;

bp = p->Packet->Buffer;

else

bp = p->bp;

/\*

\* Loop through each packet.

\*/

\#define bhp ((struct bpf\_hdr \*)bp)

ep = bp + cc;

while (1) \{

/\*

\* Has "pcap\_breakloop()" been called?

\* If so, return immediately - if we haven't read any

\* packets, clear the flag and return -2 to indicate

\* that we were told to break out of the loop, otherwise

\* leave the flag set, so that the \*next\* call will break

\* out of the loop without having read any packets, and

\* return the number of packets we've processed so far.

\*/

if (p->break\_loop) \{

if (n == 0) \{

p->break\_loop = 0;

return (-2);

\} else \{

p->bp = bp;

p->cc = ep - bp;

return (n);

if (bp >= ep)

break;

caplen = bhp->bh\_caplen;

hdrlen = bhp->bh\_hdrlen;

\#ifdef HAVE\_REMOTE

if (p->rmt\_samp.method == PCAP\_SAMP\_1\_EVERY\_N)

samp\_npkt= (samp\_npkt + 1) % p->rmt\_samp.value;

// Discard all packets that are not '1 out of N'

if (samp\_npkt != 0)

bp += BPF\_WORDALIGN(caplen + hdrlen);

continue;

if (p->rmt\_samp.method == PCAP\_SAMP\_FIRST\_AFTER\_N\_MS)

struct pcap\_pkthdr \*pkt\_header= (struct pcap\_pkthdr\*) bp;

// Check if the timestamp of the arrived packet is smaller than our target time

if ( (pkt\_header->ts.tv\_sec < samp\_time.tv\_sec) ||

( (pkt\_header->ts.tv\_sec == samp\_time.tv\_sec) && (pkt\_header->ts.tv\_usec < samp\_time.tv\_usec) ) )

bp += BPF\_WORDALIGN(caplen + hdrlen);

continue;

// The arrived packet is suitable for being sent to the remote host

// So, let's update the target time

samp\_time.tv\_usec= pkt\_header->ts.tv\_usec + p->rmt\_samp.value \* 1000;

if (samp\_time.tv\_usec > 1000000)

samp\_time.tv\_sec= pkt\_header->ts.tv\_sec + samp\_time.tv\_usec / 1000000;

samp\_time.tv\_usec= samp\_time.tv\_usec % 1000000;

\#endif /\* HAVE\_REMOTE \*/

/\*

\* XXX A bpf\_hdr matches a pcap\_pkthdr.

\*/

(\*callback)(user, (struct pcap\_pkthdr\*)bp, bp + hdrlen);

bp += BPF\_WORDALIGN(caplen + hdrlen);

if (++n >= cnt && cnt > 0) \{

p->bp = bp;

p->cc = ep - bp;

return (n);

\#undef bhp

p->cc = 0;

return (n);

Pcap\_loop函数和pcap\_dispatch函数类似，都是调用pcap\_read\_win32\_npf函数pcap\_loop 函数和pcap\_dispatch函数的区别是，pcap\_dispatch 当超时时，函数就返回，pcap\_loop函数只有读到cnt个数据包才返回。Pcap\_next函数和pcap\_next\_ex函数都是调用pcap\_read\_win32\_npf函数，pcap\_next函数和pcap\_next\_ex函数的区别是pcap\_next调用pcap\_dispatch函数后才调用pcap\_read\_win32\_npf函数，而pcap\_next\_ex直接调用pcap\_read\_win32\_npf函数，增加了远程模式和读文件模式。pcap\_read\_win32\_npf函数调用parket 中PacketRecivePacket函数。

BOOLEAN PacketReceivePacket(LPADAPTER AdapterObject,LPPACKET lpPacket,BOOLEAN Sync) //Sync=TRUE

BOOLEAN res;

UNUSED(Sync);

TRACE\_ENTER("PacketReceivePacket");

\#ifdef HAVE\_WANPACKET\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDISWAN\_ADAPTER)

lpPacket->ulBytesReceived = WanPacketReceivePacket(AdapterObject->pWanAdapter, lpPacket->Buffer, lpPacket->Length);

TRACE\_EXIT("PacketReceivePacket");

return TRUE;

\#endif //HAVE\_WANPACKET\_API

\#ifdef HAVE\_AIRPCAP\_API

if(AdapterObject->Flags == INFO\_FLAG\_AIRPCAP\_CARD)

// Wait for data, only if the user requested us to do that

if((int)AdapterObject->ReadTimeOut != -1)

WaitForSingleObject(AdapterObject->ReadEvent, (AdapterObject->ReadTimeOut==0)? INFINITE: AdapterObject->ReadTimeOut);

// Read the data.

// g\_PAirpcapRead always returns immediately.

res = (BOOLEAN)g\_PAirpcapRead(AdapterObject->AirpcapAd,

lpPacket->Buffer,

lpPacket->Length,

&lpPacket->ulBytesReceived);

TRACE\_EXIT("PacketReceivePacket");

return res;

\#endif // HAVE\_AIRPCAP\_API

\#ifdef HAVE\_NPFIM\_API

if(AdapterObject->Flags == INFO\_FLAG\_NPFIM\_DEVICE)

// Read the data.

// NpfImReceivePacket performs its own wait internally.

res = (BOOLEAN)g\_NpfImHandlers.NpfImReceivePackets(AdapterObject->NpfImHandle,

lpPacket->Buffer,

lpPacket->Length,

&lpPacket->ulBytesReceived);

TRACE\_EXIT("PacketReceivePacket");

return res;

\#endif // HAVE\_NPFIM\_API

\#ifdef HAVE\_DAG\_API

if((AdapterObject->Flags & INFO\_FLAG\_DAG\_CARD) || (AdapterObject->Flags & INFO\_FLAG\_DAG\_FILE))

g\_p\_dagc\_wait(AdapterObject->pDagCard, &AdapterObject->DagReadTimeout);

res = (BOOLEAN)(g\_p\_dagc\_receive(AdapterObject->pDagCard, (u\_char\*\*)&AdapterObject->DagBuffer, (u\_int\*)&lpPacket->ulBytesReceived) == 0);

TRACE\_EXIT("PacketReceivePacket");

return res;

\#endif // HAVE\_DAG\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDIS\_ADAPTER)

if((int)AdapterObject->ReadTimeOut != -1)

WaitForSingleObject(AdapterObject->ReadEvent, (AdapterObject->ReadTimeOut==0)?INFINITE:AdapterObject->ReadTimeOut);

//从驱动中读取数据包

res = (BOOLEAN)ReadFile(AdapterObject->hFile, lpPacket->Buffer, lpPacket->Length, &lpPacket->ulBytesReceived,NULL);

else

TRACE\_PRINT1("Request to read on an unknown device type (%u)", AdapterObject->Flags);

res = FALSE;

TRACE\_EXIT("PacketReceivePacket");

return res;

PacketReceivePacket函数ReadFile从驱动中读取数据包，应用程序和驱动进行通信到最下一层都是通过DeviceIoControl，ReadFile，WriteFile函数。这些函数在上面都已经介绍了。ReadFile对应驱动程序中

NTSTATUS NPF\_Read(IN PDEVICE\_OBJECT DeviceObject,IN PIRP Irp)

POPEN\_INSTANCE Open;

PIO\_STACK\_LOCATION IrpSp;

PUCHAR packp;

ULONG Input\_Buffer\_Length;

UINT Thead;

UINT Ttail;

UINT TLastByte;

PUCHAR CurrBuff;

LARGE\_INTEGER CapTime;

LARGE\_INTEGER TimeFreq;

struct bpf\_hdr \*header;

KIRQL Irql;

PUCHAR UserPointer;

ULONG bytecopy;

UINT SizeToCopy;

UINT PktLen;

ULONG copied,count,current\_cpu,av,plen,increment,ToCopy,available;

CpuPrivateData \*LocalData;

ULONG i;

ULONG Occupation;

IF\_LOUD(DbgPrint("NPF: Read/n");)

IrpSp = IoGetCurrentIrpStackLocation(Irp); //获取Irp当前堆栈

Open=IrpSp->FileObject->FsContext; //得到打开上下文

if (NPF\_StartUsingOpenInstance(Open) == FALSE)

// an IRP\_MJ\_CLEANUP was received, just fail the request

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = STATUS\_CANCELLED;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT); //完成irp请求

TRACE\_EXIT();

return STATUS\_CANCELLED;

// we need to test if the device is still bound(绑定) to the Network adapter,

// so we perform a start/stop using binding.

// This is not critical, since we just want to have a quick way to have the

// dispatch read fail in case the adapter has been unbound

if(NPF\_StartUsingBinding(Open) == FALSE)

NPF\_StopUsingOpenInstance(Open);

// The Network adapter has been removed or diasabled

EXIT\_FAILURE(0);

NPF\_StopUsingBinding(Open);

if (Open->Size == 0)

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

if( Open->mode & MODE\_DUMP && Open->DumpFileHandle == NULL )\{

// this instance is in dump mode, but the dump file has still not been opened

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

Occupation=0;

for(i=0;i<g\_NCpu;i++)

Occupation += (Open->Size - Open->CpuData\[i\].Free); //计算出已经占用的内核缓冲区

//See if the buffer is full enough to be copied 判断缓冲区是否enough

if( Occupation <= Open->MinToCopy\*g\_NCpu || Open->mode & MODE\_DUMP )

if (Open->ReadEvent != NULL)

//wait until some packets arrive or the timeout expires

if(Open->TimeOut.QuadPart != (LONGLONG)IMMEDIATE)

KeWaitForSingleObject(Open->ReadEvent,

UserRequest,

KernelMode,

TRUE,

(Open->TimeOut.QuadPart == (LONGLONG)0)? NULL: &(Open->TimeOut));

KeClearEvent(Open->ReadEvent);

//统计模式

if(Open->mode & MODE\_STAT)

\{ //this capture instance is in statistics mode

\#ifdef NDIS50

CurrBuff=(PUCHAR)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);

\#else

CurrBuff=(PUCHAR)MmGetSystemAddressForMdl(Irp->MdlAddress);

\#endif

if (CurrBuff == NULL)

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

if (Open->mode & MODE\_DUMP)

if (IrpSp->Parameters.Read.Length < sizeof(struct bpf\_hdr) + 24)

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Status = STATUS\_BUFFER\_TOO\_SMALL;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

return STATUS\_BUFFER\_TOO\_SMALL;

else

if (IrpSp->Parameters.Read.Length < sizeof(struct bpf\_hdr) + 16)

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Status = STATUS\_BUFFER\_TOO\_SMALL;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

return STATUS\_BUFFER\_TOO\_SMALL;

//fill the bpf header for this packet

header=(struct bpf\_hdr\*)CurrBuff;

GET\_TIME(&header->bh\_tstamp,&G\_Start\_Time);

if(Open->mode & MODE\_DUMP)\{

\*(LONGLONG\*)(CurrBuff+sizeof(struct bpf\_hdr)+16)=Open->DumpOffset.QuadPart;

header->bh\_caplen=24;

header->bh\_datalen=24;

Irp->IoStatus.Information = 24 + sizeof(struct bpf\_hdr);

else\{

header->bh\_caplen=16;

header->bh\_datalen=16;

header->bh\_hdrlen=sizeof(struct bpf\_hdr);

Irp->IoStatus.Information = 16 + sizeof(struct bpf\_hdr);

\*(LONGLONG\*)(CurrBuff+sizeof(struct bpf\_hdr))=Open->Npackets.QuadPart;

\*(LONGLONG\*)(CurrBuff+sizeof(struct bpf\_hdr)+8)=Open->Nbytes.QuadPart;

//reset the countetrs

NdisAcquireSpinLock( &Open->CountersLock );

Open->Npackets.QuadPart=0;

Open->Nbytes.QuadPart=0;

NdisReleaseSpinLock( &Open->CountersLock );

NPF\_StopUsingOpenInstance(Open);

Irp->IoStatus.Status = STATUS\_SUCCESS;

IoCompleteRequest(Irp, IO\_NO\_INCREMENT);

return STATUS\_SUCCESS;

// 监控模式

// The MONITOR\_MODE (aka TME extensions) is not supported on

// 64 bit architectures

\#ifdef HAVE\_BUGGY\_TME\_SUPPORT

if(Open->mode==MODE\_MON) //this capture instance is in monitor mode

PTME\_DATA data;

ULONG cnt;

ULONG block\_size;

PUCHAR tmp;

\#ifdef NDIS50

UserPointer=MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);

\#else

UserPointer=MmGetSystemAddressForMdl(Irp->MdlAddress);

\#endif

if (UserPointer == NULL)

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

if ((!IS\_VALIDATED(Open->tme.validated\_blocks,Open->tme.active\_read))||(IrpSp->Parameters.Read.Length<sizeof(struct bpf\_hdr)))

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

header=(struct bpf\_hdr\*)UserPointer;

GET\_TIME(&header->bh\_tstamp,&G\_Start\_Time);

header->bh\_hdrlen=sizeof(struct bpf\_hdr);

//moves user memory pointer

UserPointer+=sizeof(struct bpf\_hdr);

//calculus of data to be copied

//if the user buffer is smaller than data to be copied,

//only some data will be copied

data=&Open->tme.block\_data\[Open->tme.active\_read\];

if (data->last\_read.tv\_sec!=0)

data->last\_read=header->bh\_tstamp;

bytecopy=data->block\_size\*data->filled\_blocks;

if ((IrpSp->Parameters.Read.Length-sizeof(struct bpf\_hdr))<bytecopy)

bytecopy=(IrpSp->Parameters.Read.Length-sizeof(struct bpf\_hdr))/ data->block\_size;

else

bytecopy=data->filled\_blocks;

tmp=data->shared\_memory\_base\_address;

block\_size=data->block\_size;

for (cnt=0;cnt<bytecopy;cnt++)

NdisAcquireSpinLock(&Open->MachineLock);

RtlCopyMemory(UserPointer,tmp,block\_size);

NdisReleaseSpinLock(&Open->MachineLock);

tmp+=block\_size;

UserPointer+=block\_size;

bytecopy\*=block\_size;

header->bh\_caplen=bytecopy;

header->bh\_datalen=header->bh\_caplen;

NPF\_StopUsingOpenInstance(Open);

EXIT\_SUCCESS(bytecopy+sizeof(struct bpf\_hdr));

//end of //this capture instance is in monitor mode

Occupation=0;

//重新计算内核缓冲区的占用；

for(i=0;i<g\_NCpu;i++)

Occupation += (Open->Size - Open->CpuData\[i\].Free);

if ( Occupation == 0 || Open->mode & MODE\_DUMP)

// The timeout has expired, but the buffer is still empty (or the packets must be written to file).

// We must awake the application, returning an empty buffer.

NPF\_StopUsingOpenInstance(Open);

EXIT\_SUCCESS(0);

\#else // not HAVE\_BUGGY\_TME\_SUPPORT

if(Open->mode==MODE\_MON) //this capture instance is in monitor mode

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

\#endif // HAVE\_BUGGY\_TME\_SUPPORT

//------------------------------------------------------------------------------

copied=0;

count=0;

current\_cpu=0;

available = IrpSp->Parameters.Read.Length;

\#ifdef NDIS50

packp=(PUCHAR)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);

\#else

packp=(PUCHAR)MmGetSystemAddressForMdl(Irp->MdlAddress);

\#endif

if (packp == NULL)

NPF\_StopUsingOpenInstance(Open);

EXIT\_FAILURE(0);

if (Open->ReadEvent != NULL)

KeClearEvent(Open->ReadEvent);

while (count < g\_NCpu) //round robin on the CPUs, if count = NCpu there are no packets left to be copied

if (available == copied)

NPF\_StopUsingOpenInstance(Open);

EXIT\_SUCCESS(copied);

LocalData = &Open->CpuData\[current\_cpu\];

if (LocalData->Free < Open->Size)

\{ //there are some packets in the selected (aka LocalData) buffer

struct PacketHeader \*Header = (struct PacketHeader\*)(LocalData->Buffer + LocalData->C);

if ( Header->SN == Open->ReaderSN)

\{ //check if it the next one to be copied

plen = Header->header.bh\_caplen;

if (plen + sizeof (struct bpf\_hdr) > available - copied)

\{ //if the packet does not fit into the user buffer, we've ended copying packets

//如果包没有拷贝到用户缓冲区,结束拷贝数据包

NPF\_StopUsingOpenInstance(Open);

EXIT\_SUCCESS(copied);

// FIX\_TIMESTAMPS(&Header->header.bh\_tstamp);

\*((struct bpf\_hdr\*)(&packp\[copied\]))=Header->header;

copied += sizeof(struct bpf\_hdr);

LocalData->C += sizeof(struct PacketHeader);

if (LocalData->C == Open->Size)

LocalData->C = 0;

if (Open->Size - LocalData->C < plen)

//the packet is fragmented in the buffer (i.e. it skips the buffer boundary)

ToCopy = Open->Size - LocalData->C;

RtlCopyMemory(packp + copied,LocalData->Buffer + LocalData->C,ToCopy);

RtlCopyMemory(packp + copied + ToCopy,LocalData->Buffer,plen-ToCopy);

LocalData->C = plen-ToCopy;

else

//the packet is not fragmented

RtlCopyMemory(packp + copied ,LocalData->Buffer + LocalData->C ,plen);

LocalData->C += plen;

// if (c==size) inutile, contemplato nell "header atomico"

// c=0;

Open->ReaderSN++;

copied+=Packet\_WORDALIGN(plen);

increment = plen + sizeof(struct PacketHeader);

if ( Open->Size - LocalData->C < sizeof(struct PacketHeader))

\{ //the next packet would be saved at the end of the buffer, but the NewHeader struct would be fragmented

//so the producer (--> the consumer) skips to the beginning of the buffer

increment += Open->Size-LocalData->C;

LocalData->C=0;

InterlockedExchangeAdd(&Open->CpuData\[current\_cpu\].Free,increment);

count=0;

else

current\_cpu=(current\_cpu+1)%g\_NCpu;

count++;

else

current\_cpu=(current\_cpu+1)%g\_NCpu;

count++;

NPF\_StopUsingOpenInstance(Open);

EXIT\_SUCCESS(copied);

讲到这里，大家都知道，应用程序怎么从驱动中读取数据了，但是数据怎么到达内核缓冲区呢，下面介绍一个回调函数，NPF\_tap()

NDIS\_STATUS NPF\_tap (IN NDIS\_HANDLE ProtocolBindingContext,IN NDIS\_HANDLE MacReceiveContext,

IN PVOID HeaderBuffer,IN UINT HeaderBufferSize,IN PVOID LookaheadBuffer,

IN UINT LookaheadBufferSize,IN UINT PacketSize)

POPEN\_INSTANCE Open;

PNDIS\_PACKET pPacket;

ULONG SizeToTransfer;

NDIS\_STATUS Status;

UINT BytesTransfered;

ULONG BufferLength;

PMDL pMdl1,pMdl2;

LARGE\_INTEGER CapTime;

LARGE\_INTEGER TimeFreq;

UINT fres;

USHORT NPFHdrSize;

CpuPrivateData \*LocalData;

ULONG Cpu;

struct PacketHeader \*Header;

ULONG ToCopy;

ULONG increment;

ULONG i;

BOOLEAN ShouldReleaseBufferLock;

IF\_VERY\_LOUD(DbgPrint("NPF: tap/n");)

IF\_VERY\_LOUD(DbgPrint("HeaderBufferSize=%u, LookAheadBuffer=%p, LookaheadBufferSize=%u, PacketSize=%u/n",

HeaderBufferSize,

LookaheadBuffer,

LookaheadBufferSize,

PacketSize);)

Open= (POPEN\_INSTANCE)ProtocolBindingContext;

Cpu = KeGetCurrentProcessorNumber();

LocalData = &Open->CpuData\[Cpu\];

LocalData->Received++;

IF\_LOUD(DbgPrint("Received on CPU %d /t%d/n",Cpu,LocalData->Received);)

// Open->Received++; // Number of packets received by filter ++

NdisAcquireSpinLock(&Open->MachineLock);

//Check if the lookahead buffer follows the mac header.

//If the data follow the header (i.e. there is only a buffer) a normal bpf\_filter() is

//executed on the packet.

//Otherwise if there are 2 separate buffers (this could be the case of LAN emulation or

//things like this) bpf\_filter\_with\_2\_buffers() is executed.

if((UINT)((PUCHAR)LookaheadBuffer-(PUCHAR)HeaderBuffer) != HeaderBufferSize)

\#ifdef HAVE\_BUGGY\_TME\_SUPPORT

fres=bpf\_filter\_with\_2\_buffers((struct bpf\_insn\*)(Open->bpfprogram),

HeaderBuffer,

LookaheadBuffer,

HeaderBufferSize,

PacketSize+HeaderBufferSize,

LookaheadBufferSize+HeaderBufferSize,

&Open->mem\_ex,

&Open->tme,

&G\_Start\_Time);

\#else // HAVE\_BUGGY\_TME\_SUPPORT

fres=bpf\_filter\_with\_2\_buffers((struct bpf\_insn\*)(Open->bpfprogram),

HeaderBuffer,

LookaheadBuffer,

HeaderBufferSize,

PacketSize+HeaderBufferSize,

LookaheadBufferSize+HeaderBufferSize);

\#endif // HAVE\_BUGGY\_TME\_SUPPORT

else

// the jit filter is available on x86 (32 bit) only

\#ifdef \_X86\_

if(Open->Filter != NULL)

if (Open->bpfprogram != NULL)

fres=Open->Filter->Function(HeaderBuffer,

PacketSize+HeaderBufferSize,

LookaheadBufferSize+HeaderBufferSize);

else

fres = -1;

else

\#endif //\_X86\_

\#ifdef HAVE\_BUGGY\_TME\_SUPPORT

fres=bpf\_filter((struct bpf\_insn\*)(Open->bpfprogram),

HeaderBuffer,

PacketSize+HeaderBufferSize,

LookaheadBufferSize+HeaderBufferSize,

&Open->mem\_ex,

&Open->tme,

&G\_Start\_Time);

\#else //HAVE\_BUGGY\_TME\_SUPPORT

fres=bpf\_filter((struct bpf\_insn\*)(Open->bpfprogram),

HeaderBuffer,

PacketSize+HeaderBufferSize,

LookaheadBufferSize+HeaderBufferSize);

\#endif //HAVE\_BUGGY\_TME\_SUPPORT

NdisReleaseSpinLock(&Open->MachineLock);

// The MONITOR\_MODE (aka TME extensions) is not supported on

// 64 bit architectures

\#ifdef HAVE\_BUGGY\_TME\_SUPPORT

if(Open->mode==MODE\_MON)

// we are in monitor mode

if (fres==1)

if (Open->ReadEvent != NULL)

KeSetEvent(Open->ReadEvent,0,FALSE);

return NDIS\_STATUS\_NOT\_ACCEPTED;

\#endif //HAVE\_BUGGY\_TME\_SUPPORT

if(fres==0)

// Packet not accepted by the filter, ignore it.

return NDIS\_STATUS\_NOT\_ACCEPTED;

//if the filter returns -1 the whole packet must be accepted

if(fres == -1 || fres > PacketSize+HeaderBufferSize)

fres = PacketSize+HeaderBufferSize;

if(Open->mode & MODE\_STAT)

// we are in statistics mode

NdisAcquireSpinLock( &Open->CountersLock );

Open->Npackets.QuadPart++;

if(PacketSize+HeaderBufferSize<60)

Open->Nbytes.QuadPart+=60;

else

Open->Nbytes.QuadPart+=PacketSize+HeaderBufferSize;

// add preamble+SFD+FCS to the packet

// these values must be considered because are not part of the packet received from NDIS

Open->Nbytes.QuadPart+=12;

NdisReleaseSpinLock( &Open->CountersLock );

if(!(Open->mode & MODE\_DUMP))

return NDIS\_STATUS\_NOT\_ACCEPTED;

if(Open->Size == 0)

LocalData->Dropped++;

return NDIS\_STATUS\_NOT\_ACCEPTED;

if(Open->mode & MODE\_DUMP && Open->MaxDumpPacks)

ULONG Accepted=0;

for(i=0;i<g\_NCpu;i++)

Accepted+=Open->CpuData\[i\].Accepted;

if( Accepted > Open->MaxDumpPacks)

// Reached the max number of packets to save in the dump file. Discard the packet and stop the dump thread.

Open->DumpLimitReached = TRUE; // This stops the thread

// Awake the dump thread

NdisSetEvent(&Open->DumpEvent);

// Awake the application

if (Open->ReadEvent != NULL)

KeSetEvent(Open->ReadEvent,0,FALSE);

return NDIS\_STATUS\_NOT\_ACCEPTED;

//COPIA.C//77

ShouldReleaseBufferLock = TRUE;

NdisDprAcquireSpinLock(&LocalData->BufferLock);

if (fres + sizeof(struct PacketHeader) > LocalData->Free)

LocalData->Dropped++;

break;

if (LocalData->TransferMdl1 != NULL)

//if TransferMdl is not NULL, there is some TransferData pending (i.e. not having called TransferDataComplete, yet)

//in order to avoid buffer corruption, we drop the packet

LocalData->Dropped++;

break;

if (LookaheadBufferSize + HeaderBufferSize >= fres)

// we do not need to call NdisTransferData, either because we need only the HeaderBuffer, or because the LookaheadBuffer

// contains what we need

Header = (struct PacketHeader\*)(LocalData->Buffer + LocalData->P);

LocalData->Accepted++;

GET\_TIME(&Header->header.bh\_tstamp,&G\_Start\_Time);

Header->SN = InterlockedIncrement(&Open->WriterSN) - 1;

Header->header.bh\_caplen = fres;

Header->header.bh\_datalen = PacketSize + HeaderBufferSize;

Header->header.bh\_hdrlen=sizeof(struct bpf\_hdr);

LocalData->P +=sizeof(struct PacketHeader);

if (LocalData->P == Open->Size)

LocalData->P = 0;

if ( fres <= HeaderBufferSize || (UINT)( (PUCHAR)LookaheadBuffer - (PUCHAR)HeaderBuffer ) ==HeaderBufferSize )

//we can consider the buffer contiguous, either because we use only the data

//present in the HeaderBuffer, or because HeaderBuffer and LookaheadBuffer are contiguous

// ;-))))))

if (Open->Size - LocalData->P < fres)

//the packet will be fragmented in the buffer (aka, it will skip the buffer boundary)

//two copies!!

ToCopy = Open->Size - LocalData->P;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P,HeaderBuffer, ToCopy);

NdisMoveMappedMemory(LocalData->Buffer + 0 , (PUCHAR)HeaderBuffer + ToCopy, fres - ToCopy);

LocalData->P = fres-ToCopy;

else

//the packet does not need to be fragmented in the buffer (aka, it doesn't skip the buffer boundary)

// ;-)))))) only ONE copy

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, fres);

LocalData->P += fres;

else

//HeaderBuffer and LookAhead buffer are NOT contiguous,

//AND, we need some bytes from the LookaheadBuffer, too

if (Open->Size - LocalData->P < fres)

//the packet will be fragmented in the buffer (aka, it will skip the buffer boundary)

if (Open->Size - LocalData->P >= HeaderBufferSize)

//HeaderBuffer is NOT fragmented

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, HeaderBufferSize);

LocalData->P += HeaderBufferSize;

if (LocalData->P == Open->Size)

//the fragmentation of the packet in the buffer is the same fragmentation

//in HeaderBuffer+LookaheadBuffer

LocalData->P=0;

NdisMoveMappedMemory(LocalData->Buffer + 0, LookaheadBuffer, fres -HeaderBufferSize);

LocalData->P += (fres - HeaderBufferSize);

else

//LookAheadBuffer is fragmented, two copies

ToCopy = Open->Size - LocalData->P;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, ToCopy);

LocalData->P=0;

NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)LookaheadBuffer+ ToCopy, fres -HeaderBufferSize - ToCopy);

LocalData->P = fres - HeaderBufferSize - ToCopy;

else

//HeaderBuffer is fragmented in the buffer (aka, it will skip the buffer boundary)

//two copies to copy the HeaderBuffer

ToCopy = Open->Size - LocalData->P;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, ToCopy);

LocalData->P = 0;

NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)HeaderBuffer + ToCopy,HeaderBufferSize - ToCopy);

LocalData->P = HeaderBufferSize - ToCopy;

//only one copy to copy the LookaheadBuffer

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, fres-HeaderBufferSize);

LocalData->P += (fres - HeaderBufferSize);

else

//the packet won't be fragmented in the destination buffer (aka, it won't skip the buffer boundary)

//two copies, the former to copy the HeaderBuffer, the latter to copy the LookaheadBuffer

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, HeaderBuffer, HeaderBufferSize);

LocalData->P += HeaderBufferSize;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->P, LookaheadBuffer, fres -HeaderBufferSize);

LocalData->P += (fres - HeaderBufferSize);

increment = fres + sizeof(struct PacketHeader);

if (Open->Size - LocalData->P < sizeof(struct PacketHeader)) //we check that the available, AND contiguous, space in the buffer will fit

\{ //the NewHeader structure, at least, otherwise we skip the producer

increment += Open->Size-LocalData->P; //at the beginning of the buffer (p = 0), and decrement the free bytes appropriately

LocalData->P = 0;

InterlockedExchangeAdd(&LocalData->Free, (ULONG)(-(LONG)increment));

if(Open->Size - LocalData->Free >= Open->MinToCopy)

if(Open->mode & MODE\_DUMP)

NdisSetEvent(&Open->DumpEvent);

else

if (Open->ReadEvent != NULL)

KeSetEvent(Open->ReadEvent,0,FALSE);

break;

else

IF\_LOUD(DbgPrint("TransferData!!/n");)

//ndisTransferData required

LocalData->NewP = LocalData->P;

LocalData->NewP +=sizeof(struct PacketHeader);

if (LocalData->NewP == Open->Size)

LocalData->NewP = 0;

//first of all, surely the header must be copied

if (Open->Size-LocalData->NewP >= HeaderBufferSize)

//1 copy!

NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, HeaderBuffer, HeaderBufferSize);

LocalData->NewP += HeaderBufferSize;

if (LocalData->NewP == Open->Size)

LocalData->NewP = 0;

else

ToCopy = Open->Size - LocalData->NewP;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, HeaderBuffer, ToCopy);

NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)HeaderBuffer + ToCopy, HeaderBufferSize -ToCopy);

LocalData->NewP = HeaderBufferSize - ToCopy;

//then we copy the Lookahead buffer

if (Open->Size-LocalData->NewP >= LookaheadBufferSize)

//1 copy!

NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, LookaheadBuffer, LookaheadBufferSize);

LocalData->NewP += LookaheadBufferSize;

if (LocalData->NewP == Open->Size)

LocalData->NewP = 0;

else

ToCopy = Open->Size - LocalData->NewP;

NdisMoveMappedMemory(LocalData->Buffer + LocalData->NewP, LookaheadBuffer, ToCopy);

NdisMoveMappedMemory(LocalData->Buffer + 0, (PUCHAR)LookaheadBuffer + ToCopy, LookaheadBufferSize -ToCopy);

LocalData->NewP = LookaheadBufferSize - ToCopy;

//Now we must prepare the buffer(s) for the NdisTransferData

if ((Open->Size - LocalData->NewP) >= (fres - HeaderBufferSize - LookaheadBufferSize))

//only 1 buffer

pMdl1 = IoAllocateMdl(

LocalData->Buffer + LocalData->NewP,

fres - HeaderBufferSize - LookaheadBufferSize,

FALSE,

NULL);

if (pMdl1 == NULL)

IF\_LOUD(DbgPrint("Error allocating Mdl1/n");)

LocalData->Dropped++;

break;

MmBuildMdlForNonPagedPool(pMdl1);

pMdl2=NULL;

LocalData->NewP += fres - HeaderBufferSize - LookaheadBufferSize;

else

//2 buffers

pMdl1 = IoAllocateMdl(

LocalData->Buffer + LocalData->NewP,

Open->Size - LocalData->NewP,

FALSE,

NULL);

if (pMdl1 == NULL)

IF\_LOUD(DbgPrint("Error allocating Mdl1/n");)

LocalData->Dropped++;

break;

pMdl2 = IoAllocateMdl(

LocalData->Buffer + 0,

fres - HeaderBufferSize - LookaheadBufferSize - (Open->Size - LocalData->NewP),

FALSE,

NULL);

if (pMdl2 == NULL)

IF\_LOUD(DbgPrint("Error allocating Mdl2/n");)

IoFreeMdl(pMdl1);

LocalData->Dropped++;

break;

LocalData->NewP = fres - HeaderBufferSize - LookaheadBufferSize - (Open->Size - LocalData->NewP);

MmBuildMdlForNonPagedPool(pMdl1);

MmBuildMdlForNonPagedPool(pMdl2);

NdisAllocatePacket(&Status, &pPacket, Open->PacketPool);

if (Status != NDIS\_STATUS\_SUCCESS)

IF\_LOUD(DbgPrint("NPF: Tap - No free packets/n");)

IoFreeMdl(pMdl1);

if (pMdl2 != NULL)

IoFreeMdl(pMdl2);

LocalData->Dropped++;

break;

if (pMdl2 != NULL)

NdisChainBufferAtFront(pPacket,pMdl2);

NdisChainBufferAtFront(pPacket,pMdl1);

RESERVED(pPacket)->Cpu = Cpu;

LocalData->TransferMdl1 = pMdl1;

LocalData->TransferMdl2 = pMdl2;

Header = (struct PacketHeader\*)(LocalData->Buffer + LocalData->P);

Header->header.bh\_caplen = fres;

Header->header.bh\_datalen = PacketSize + HeaderBufferSize;

Header->header.bh\_hdrlen=sizeof(struct bpf\_hdr);

/\*调用NdisTransferData重新获取剩余的所需数据包,从网卡的Nic memory copy to kernel buffer。\*/

NdisTransferData(

&Status,

Open->AdapterHandle,

MacReceiveContext,

LookaheadBufferSize,

fres - HeaderBufferSize - LookaheadBufferSize,

pPacket,

&BytesTransfered);

if (Status != NDIS\_STATUS\_PENDING)

IF\_LOUD(DbgPrint("NdisTransferData, not pending!/n");)

LocalData->TransferMdl1 = NULL;

LocalData->TransferMdl2 = NULL;

IoFreeMdl(pMdl1);

if ( pMdl2 != NULL )

IoFreeMdl(pMdl2);

NdisReinitializePacket(pPacket);

// Put the packet on the free queue

NdisFreePacket(pPacket);

LocalData->P = LocalData->NewP;

LocalData->Accepted++;

GET\_TIME(&Header->header.bh\_tstamp,&G\_Start\_Time);

Header->SN = InterlockedIncrement(&Open->WriterSN) - 1;

increment = fres + sizeof(struct PacketHeader);

if (Open->Size - LocalData->P < sizeof(struct PacketHeader))

increment += Open->Size-LocalData->P;

LocalData->P = 0;

InterlockedExchangeAdd(&LocalData->Free, (ULONG)(-(LONG)increment));

if(Open->Size - LocalData->Free >= Open->MinToCopy)

if(Open->mode & MODE\_DUMP)

NdisSetEvent(&Open->DumpEvent);

else

if (Open->ReadEvent != NULL)

KeSetEvent(Open->ReadEvent,0,FALSE);

break;

else

IF\_LOUD(DbgPrint("NdisTransferData, pending!/n");)

ShouldReleaseBufferLock = FALSE;

while(FALSE);

if (ShouldReleaseBufferLock)

NdisDprReleaseSpinLock(&LocalData->BufferLock);

return NDIS\_STATUS\_NOT\_ACCEPTED;

**庖丁解牛-----winpcap源码彻底解密（四）**

（1） 如何设置内核缓冲区的大小，前面已经谈过设置内核缓冲区的函数是pcap\_setbuff，查看winpcap的开发文档，pcap\_setbuff的定义如下：

int pcap\_setbuff(pcap\_t \*p,int dim)；

Set the size of the kernel buffer associated with an adapter. *dim* specifies the size of the buffer in bytes. The return value is 0 when the call succeeds, -1 otherwise. If an old buffer was already created with a previous call to[**pcap\_setbuff()**][pcap_setbuff], it is deleted and its content is discarded. [**pcap\_open\_live()**][pcap_open_live] creates a 1 MByte buffer by default.

下面主要讲解pcap\_setbuff是怎样设置内核缓冲区的，在wpcap.dll中的pcap.c文件中定义了pcap\_setbuff函数，定义如下：

int pcap\_setbuff(pcap\_t \*p, int dim)

return p->setbuff\_op(p, dim);

其中setbuff\_op是一个回调函数,其实调用的是pcap\_setbuff\_win32，在pcap-win32.c中定义

p->setbuff\_op = pcap\_setbuff\_win32;下面看看这个函数是怎么设置内核缓冲区的。

static int pcap\_setbuff\_win32(pcap\_t \*p, int dim)

\#ifdef HAVE\_REMOTE

if (p->rmt\_clientside)

/\* Currently, this is a bug: the capture buffer cannot be set with remote capture \*/

return 0;

\#endif /\* HAVE\_REMOTE \*/

if(PacketSetBuff(p->adapter,dim)==FALSE)

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "driver error: not enough memory to allocate the kernel buffer");

return -1;

return 0;

从pcap\_setbuff\_win32的源码可以出，它是调用PacketSetBuff将应用程序对应的网卡的内核缓冲区的大小dim传递到了parket.dll 下一层。如果要相知道PacketSetBuff怎么讲内核缓冲区的大小传递到驱动程序npf.sys中，就要取跟踪PacketSetBuff的源码了。PacketSetBuff在parket32.c文件中。

//设置内核缓冲区大小

BOOLEAN PacketSetBuff(LPADAPTER AdapterObject,int dim)

DWORD BytesReturned;

BOOLEAN Result;

TRACE\_ENTER("PacketSetBuff");

\#ifdef HAVE\_WANPACKET\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDISWAN\_ADAPTER)

Result = WanPacketSetBufferSize(AdapterObject->pWanAdapter, dim);

TRACE\_EXIT("PacketSetBuff");

return Result;

\#endif

\#ifdef HAVE\_AIRPCAP\_API

if(AdapterObject->Flags == INFO\_FLAG\_AIRPCAP\_CARD)

Result = (BOOLEAN)g\_PAirpcapSetKernelBuffer(AdapterObject->AirpcapAd, dim);

TRACE\_EXIT("PacketSetBuff");

return Result;

\#endif // HAVE\_AIRPCAP\_API

\#ifdef HAVE\_NPFIM\_API

if(AdapterObject->Flags == INFO\_FLAG\_NPFIM\_DEVICE)

Result = (BOOLEAN)g\_NpfImHandlers.NpfImSetCaptureBufferSize(AdapterObject->NpfImHandle, dim);

TRACE\_EXIT("PacketSetBuff");

return Result;

\#endif // HAVE\_NPFIM\_API

\#ifdef HAVE\_DAG\_API

if(AdapterObject->Flags == INFO\_FLAG\_DAG\_CARD)

// We can't change DAG buffers

TRACE\_EXIT("PacketSetBuff");

return TRUE;

\#endif // HAVE\_DAG\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDIS\_ADAPTER)

Result = (BOOLEAN)DeviceIoControl(AdapterObject->hFile,BIOCSETBUFFERSIZE,&dim,sizeof(dim),NULL,0,&BytesReturned,NULL);

else

TRACE\_PRINT1("Request to set buf size on an unknown device type (%u)", AdapterObject->Flags);

Result = FALSE;

TRACE\_EXIT("PacketSetBuff");

return Result;

通过PacketSetBuff 的源码可以看到它是调用DeviceIoControl将设置内核缓冲区的大小的命令发送到npf.sys，上面我们已经多次提到，应用程序和驱动的通信，无论你怎么封装，到了底层都是调用DeviceIoControl,WriteFile，ReadFile函数，一般设置命令使用DeviceIoControl，发送数据包使用WriteFile，但是你要使用DeviceIoControl发送数据包也是可以的，读取驱动中的数据包就使用ReadFile了。设置内核缓冲区的控制码为：BIOCSETBUFFERSIZE，在NTSTATUS NPF\_IoControl(IN PDEVICE\_OBJECT DeviceObject,IN PIRP Irp)函数可以看到不同的控制码的处理方式。NPF\_IoControl的源码在前面已经说了，这里主要看看内核缓冲区在驱动是怎么设置的。设置内核缓冲区的源码主要如下：

for (i = 0 ; i < g\_NCpu ; i++)

if (dim > 0)

Open->CpuData\[i\].Buffer=(PUCHAR)tpointer + (dim/g\_NCpu)\*i;

else

Open->CpuData\[i\].Buffer = NULL;

Open->CpuData\[i\].Free = dim/g\_NCpu;

Open->CpuData\[i\].P = 0; //生产者

Open->CpuData\[i\].C = 0; //消费者

Open->CpuData\[i\].Accepted = 0;

Open->CpuData\[i\].Dropped = 0;

Open->CpuData\[i\].Received = 0;

Open->ReaderSN=0;

Open->WriterSN=0;

Open->Size = dim/g\_NCpu;

从上面的源码可以看出，winpcap的高明之处在于，它充分的使用了每个cpu，这样的话，你的cpu有几个核，性能就可以明显的体现出来。每个cpu的缓冲区设置为dim/g\_NCpu，其中Open是一个全局变量，保存的是一些和绑定网卡相关的信息。CpuData\[i\].P和CpuData\[i\].C在读取数据包是非常有用的，他可以用来判断内核缓冲区的数据是否大于pcap\_setmintocopy的最小copy的size。这个函数我会在后面的讲道。讲道这里，我们知道pcap\_setbuff是怎么设置内核缓冲区的了,主要是调用DeviceIoControl将用户要设置的size传递到内核，而在内核中将它保存一个全局变量中，这样就设置好了内核缓冲区。

(2)如何设置用户缓冲区的大小？下面讲解怎样设置用户缓冲区的大小，linux下面的libcap是没有提供设置用户缓冲区大小(user buffer)的api的,要设置用户缓冲区，必须修改libcap的源码，但是winpcap的高版本是提供了设置用户缓冲区的函数，在wpcap.dll的win32-Extensions.c文件中有一个pcap\_setuserbuffer函数，在用户使用时必须添加win32-Extensions.h头文件。pcap\_setuserbuffer函数源码如下：

Int pcap\_setuserbuffer(pcap\_t \*p, int size)

unsigned char \*new\_buff;

if (!p->adapter) \{

sprintf(p->errbuf,"Impossible to set user buffer while reading from a file or on a TurboCap port");

return -1;

if (size<=0) \{

/\* Bogus parameter \*/

sprintf(p->errbuf,"Error: invalid size %d",size);

return -1;

/\* Allocate the buffer \*/

new\_buff=(unsigned char\*)malloc(sizeof(char)\*size);

if (!new\_buff) \{

sprintf(p->errbuf,"Error: not enough memory");

return -1;

free(p->buffer);

p->buffer=new\_buff;

p->bufsize=size;

/\* Associate the buffer with the capture packet \*/

PacketInitPacket(p->Packet,(BYTE\*)p->buffer,p->bufsize);

return 0;

从上面的源码可以看出，pcap\_setuserbuffer调用的是PacketInitPacket函数

VOID PacketInitPacket(LPPACKET lpPacket,PVOID Buffer,UINT Length)

TRACE\_ENTER("PacketInitPacket");

lpPacket->Buffer = Buffer;

lpPacket->Length = Length;

lpPacket->ulBytesReceived = 0;

lpPacket->bIoComplete = FALSE;

TRACE\_EXIT("PacketInitPacket");

从PacketInitPacket源码和pcap\_setuserbuffer的源码可以看出，设置用户缓冲区相对容易，因为它不涉及到内核,就是对应用程序对应的网卡，pcap\_t \*p，设置它的用户缓冲区的大小，在设置前清空原来的缓冲区，然后再分配一个size，完成用户缓冲区的设置。

(3)设置内核缓冲区到用户缓冲区最小的copy数据的size，采用pcap\_setmintocopy函数进行设置。

Int pcap\_setmintocopy(pcap\_t \*p, int size)

return p->setmintocopy\_op(p, size);

从pcap\_setmintocopy的源码可以看出，它和设置内核缓冲区大小有点相似，调用的是setmintocopy\_op回调函数。在pcap\_win32.c中有：

p->setmintocopy\_op = pcap\_setmintocopy\_win32;

/\*set the minimum amount of data that will release a read call\*/

static int pcap\_setmintocopy\_win32(pcap\_t \*p, int size)

if(PacketSetMinToCopy(p->adapter, size)==FALSE)

snprintf(p->errbuf, PCAP\_ERRBUF\_SIZE, "driver error: unable to set the requested mintocopy size");

return -1;

return 0;

Pcap\_setmintocopy\_win32调用PacketSetMinToCopy函数设置最小的copy缓冲区：

BOOLEAN PacketSetMinToCopy(LPADAPTER AdapterObject,int nbytes)

DWORD BytesReturned;

BOOLEAN Result;

TRACE\_ENTER("PacketSetMinToCopy");

\#ifdef HAVE\_WANPACKET\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDISWAN\_ADAPTER)

Result = WanPacketSetMinToCopy(AdapterObject->pWanAdapter, nbytes);

TRACE\_EXIT("PacketSetMinToCopy");

return Result;

\#endif //HAVE\_WANPACKET\_API

\#ifdef HAVE\_NPFIM\_API

if(AdapterObject->Flags == INFO\_FLAG\_NPFIM\_DEVICE)

Result = (BOOLEAN)g\_NpfImHandlers.NpfImSetMinToCopy(AdapterObject->NpfImHandle, nbytes);

TRACE\_EXIT("PacketSetMinToCopy");

return Result;

\#endif // HAVE\_NPFIM\_API

\#ifdef HAVE\_AIRPCAP\_API

if(AdapterObject->Flags == INFO\_FLAG\_AIRPCAP\_CARD)

Result = (BOOLEAN)g\_PAirpcapSetMinToCopy(AdapterObject->AirpcapAd, nbytes);

TRACE\_EXIT("PacketSetMinToCopy");

return Result;

\#endif // HAVE\_AIRPCAP\_API

\#ifdef HAVE\_DAG\_API

if(AdapterObject->Flags & INFO\_FLAG\_DAG\_CARD)

TRACE\_EXIT("PacketSetMinToCopy");

// No mintocopy with DAGs

return TRUE;

\#endif // HAVE\_DAG\_API

if (AdapterObject->Flags == INFO\_FLAG\_NDIS\_ADAPTER)

Result = (BOOLEAN)DeviceIoControl(AdapterObject->hFile,BIOCSMINTOCOPY,&nbytes,4,NULL,0,&BytesReturned,NULL);

else

TRACE\_PRINT1("Request to set mintocopy on an unknown device type (%u)", AdapterObject->Flags);

Result = FALSE;

TRACE\_EXIT("PacketSetMinToCopy");

return Result;

和设置内核缓冲区类似，该函数又是调用的DeviceIoControl函数将nbytes传递到内核npf.sys中，传递码为：BIOCSMINTOCOPY,对应驱动中的源码如下，每个cpu的MintoCopy为(\*((PULONG)Irp->AssociatedIrp.SystemBuffer))/g\_NCpu; 其中SystemBuffer的大小为应用程序传递过来的缓冲区size。

case BIOCSMINTOCOPY: //set the minimum buffer's size to copy to the application

TRACE\_MESSAGE(PACKET\_DEBUG\_LOUD, "BIOCSMINTOCOPY");

if(IrpSp->Parameters.DeviceIoControl.InputBufferLength < sizeof(ULONG))

SET\_FAILURE\_BUFFER\_SMALL();

break;

//An hack to make the NCPU-buffers behave like a larger one

Open->MinToCopy = (\*((PULONG)Irp->AssociatedIrp.SystemBuffer))/g\_NCpu;

SET\_RESULT\_SUCCESS(0);

break;

其中Open->MinToCopy为打开上下文的全局变量，该变量在读数据包的时候会使用，用来判断内核缓冲区的大小是不是已经满足最小的copy size。如果是就将数据copy到用户缓冲区中，对应的部分源码如下：

for(i=0;i<g\_NCpu;i++)

Occupation += (Open->Size - Open->CpuData\[i\].Free); //计算出已经占用的内核缓冲区

if( Occupation <= Open->MinToCopy\*g\_NCpu || Open->mode & MODE\_DUMP )

### [庖丁解牛-----winpcap源码彻底解密（五）][-----winpcap 3] ###

有人问我，wpcap.dll，packet.dll和npf.sys是怎么关联起来的，即通过调用wpcap.dll的api，怎么调用到驱动中的函数的呢？

今天我就在这里讲讲应用程序和驱动之间的通信，windows提供以下win32 api函数和驱动通信的。

<table> 
 <tbody> 
 <tr> 
 <td> Win32 API </td> 
 <td> 对文件操作 </td> 
 <td> 对设备操作 </td> 
 </tr> 
 <tr> 
 <td> CreateFile </td> 
 <td> 打开或创建文件操作 </td> 
 <td> 打开或创建设备 </td> 
 </tr> 
 <tr> 
 <td> CloseHandle </td> 
 <td> 关闭文件 </td> 
 <td> 关闭设备 </td> 
 </tr> 
 <tr> 
 <td> ReadFile </td> 
 <td> 读文件 </td> 
 <td> 读设备 </td> 
 </tr> 
 <tr> 
 <td> WriteFile </td> 
 <td> 写文件 </td> 
 <td> 写设备 </td> 
 </tr> 
 <tr> 
 <td> CancelIo </td> 
 <td> 取消读写文件操作 </td> 
 <td> 取消读写设备操作 </td> 
 </tr> 
 <tr> 
 <td> DeviceIoControl </td> 
 <td> 无 </td> 
 <td> 对设备进行特殊操作 </td> 
 </tr> 
 </tbody> 
</table>

以 CreateFile api为例子进行讲解，应用程序调用CreateFile Api --->win 32 子系统(kernel32.dll)调用NtCreateFile Native Api(ntdll.dll)----->调用NtCreateFile系统服务进入内核模式---->通过I/O管理器创建并发送IRP-->设备驱动--->硬件

NtCreateFile函数的作用是穿越用户模式的边界，进入到内核模式，这是通过软中断实现的，进入到内核模式后，会调用系统的服务函数，调用同名的系统服务NtCreateFile，NtCreateFile系统函数通过调用I/O管理器，创建IRP并传输到设备驱动程序中。

驱动程序根据IRP，进行相应的操作。

好,将到这里，就可以回到winpcap源码了，通过前面的几节的学习，大家应该对winpcap源码有一定的了解了，对于wpcap.dll和packet.dll ，就不讲解了。这里主要针对这个问题，稍微讲解下：

在npf的packet.c文件中有以下IRP

/\*设置IRP派遣函数和卸载例程\*/  
DriverObject->MajorFunction\[IRP\_MJ\_CREATE\] = NPF\_Open;  
DriverObject->MajorFunction\[IRP\_MJ\_CLOSE\] = NPF\_Close;  
DriverObject->MajorFunction\[IRP\_MJ\_CLEANUP\]= NPF\_Cleanup;  
DriverObject->MajorFunction\[IRP\_MJ\_READ\] = NPF\_Read;  
DriverObject->MajorFunction\[IRP\_MJ\_WRITE\] = NPF\_Write;  
DriverObject->MajorFunction\[IRP\_MJ\_DEVICE\_CONTROL\] = NPF\_IoControl;  
DriverObject->DriverUnload = NPF\_Unload;

在上面的章节中已经讲到对于应用程序都是通过ReadFile，WriteFile，DeviceIoControl与驱动通信的，比如设置内核缓冲区，用户缓冲区最终都是调用的DeviceIoControl，而DeviceIoControl对应的IRP就是IRP\_MJ\_DEVICE\_CONTROL，这样就调用到了NPF\_IoControl,这条路就通了，同样对于发包函数pcap\_sendpacket最终也是调用的WriteFile将包发送出去，这里就可以看到和NPF\_Write联系起来了，同理对于读函数，大家肯定都知道是怎么回事了，嘻嘻，好了，讲解完毕，希望对你有用。

[-----winpcap]: http://blog.csdn.net/smilestone322/article/details/6084620
[0_12926834943LSK.gif]: /images/20220731/1fc7bc7e4298495bb9e915f329f3da41.png
[0_1292683250mtDb.gif]: /images/20220731/0b75a77d3b324c48887b446651192c6f.png
[-----winpcap 1]: http://blog.csdn.net/smilestone322/article/details/6085323
[pcap_sendpacket]: http://writeblog.csdn.net/winpcap%E5%BC%80%E5%8F%91%E5%8C%85/WinPcap%E4%B8%AD%E6%96%87%E7%89%88%20V4.01/docs_cn/html/group__wpcapfunc.html#g51dbda0f1ab9da2cfe49d657486d50b2
[-----winpcap 2]: http://blog.csdn.net/smilestone322/article/details/6085745
[pcap_setbuff]: http://writeblog.csdn.net/WinPcap%E4%B8%AD%E6%96%87%E7%89%88%20V4.01/docs_cn/html/group__wpcapfunc.html#g124bde25ccd9e39017ff2abec2dda623
[pcap_open_live]: http://writeblog.csdn.net/WinPcap%E4%B8%AD%E6%96%87%E7%89%88%20V4.01/docs_cn/html/group__wpcapfunc.html#gae6abe06e15c87b803f69773822beca8
[-----winpcap 3]: http://blog.csdn.net/smilestone322/article/details/6085807