mirrors/fort
1
0
Fork 0
mirror of https://github.com/tnodir/fort synced 2024-11-15 10:05:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Driver: Shaper: Check inbound IPSec state

Browse Source
This commit is contained in:
Nodir Temirkhodjaev 2023-01-08 18:01:47 +03:00
parent d824f06901
commit 0015fbcf48
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/driver/fortcout.c
View File

@ -408,6 +408,26 @@ static void NTAPI fort_callout_flow_delete(UINT16 layerId, UINT32 calloutId, UIN
fort_flow_delete(&fort_device()->stat, flowContext); fort_flow_delete(&fort_device()->stat, flowContext);
} }
static BOOL fort_callout_transport_is_ipsec_detunneled(
const PNET_BUFFER_LIST netBufList, BOOL inbound)
{
/* To be compatible with Vista's IpSec implementation, we must not
* intercept not-yet-detunneled IpSec traffic. */
if (!inbound)
return TRUE;
FWPS_PACKET_LIST_INFORMATION0 packet_info;
RtlZeroMemory(&packet_info, sizeof(FWPS_PACKET_LIST_INFORMATION0));
FwpsGetPacketListSecurityInformation0(netBufList,
FWPS_PACKET_LIST_INFORMATION_QUERY_IPSEC | FWPS_PACKET_LIST_INFORMATION_QUERY_INBOUND,
&packet_info);
return !packet_info.ipsecInformation.inbound.isTunnelMode
|| packet_info.ipsecInformation.inbound.isDeTunneled;
}
static void fort_callout_transport_classify(const FWPS_INCOMING_VALUES0 *inFixedValues, static void fort_callout_transport_classify(const FWPS_INCOMING_VALUES0 *inFixedValues,
const FWPS_INCOMING_METADATA_VALUES0 *inMetaValues, const PNET_BUFFER_LIST netBufList, const FWPS_INCOMING_METADATA_VALUES0 *inMetaValues, const PNET_BUFFER_LIST netBufList,
const FWPS_FILTER0 *filter, UINT64 flowContext, FWPS_CLASSIFY_OUT0 *classifyOut, const FWPS_FILTER0 *filter, UINT64 flowContext, FWPS_CLASSIFY_OUT0 *classifyOut,
@ -419,6 +439,7 @@ static void fort_callout_transport_classify(const FWPS_INCOMING_VALUES0 *inFixed
if (!FWPS_IS_METADATA_FIELD_PRESENT(inMetaValues, FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED) if (!FWPS_IS_METADATA_FIELD_PRESENT(inMetaValues, FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED)
&& netBufList != NULL && netBufList != NULL
&& fort_callout_transport_is_ipsec_detunneled(netBufList, inbound)
/* Process the Packet by Shaper */ /* Process the Packet by Shaper */
&& fort_shaper_packet_process(&fort_device()->shaper, inFixedValues, inMetaValues, && fort_shaper_packet_process(&fort_device()->shaper, inFixedValues, inMetaValues,
netBufList, flowContext, inbound)) { netBufList, flowContext, inbound)) {