enum
{
AnyAddr=0,
UniqueAddr,
RangeAddr,
UnknownAddr
};
enum
{
RulesDirectionAny=0,
RulesDirectionUp,
RulesDirectionDown,
RulesDirectionUnknown
};
enum
{
RulesProtocolAny = 0
};
union{
UINT32 u32;
struct
{
UINT32 RemoteAddrType :2; //取值为AnyAddr,UniqueAddr,RangeAddr
UINT32 LocalAddrType :2; //取值为AnyAddr,UniqueAddr,RangeAddr
UINT32 RemotePortType :2; //取值为AnyAddr,UniqueAddr,RangeAddr
UINT32 LocalPortType :2; //取值为AnyAddr,UniqueAddr,RangeAddr
UINT32 ProtocolType :8;//网络协议类型，和RFC文档的代码保持一致
UINT32 Direction :2;//00：任意方向01：上行 10:下行 11：未定义
UINT32 Access :1;//是否允许访问，1为允许
UINT32 IcmpType :5;
UINT32 IcmpCode :5;
UINT32 Reserved :3;
}Bits;
}rule;
void
NTAPI
WallALEConnectClassify(
IN const FWPS_INCOMING_VALUES* inFixedValues,
IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues,
IN OUT void* layerData,
IN const void* classifyContext,
IN const FWPS_FILTER* filter,
IN UINT64 flowContext,
OUT FWPS_CLASSIFY_OUT* classifyOut
)
void
NTAPI
WallALERecvAcceptClassify(
IN const FWPS_INCOMING_VALUES* inFixedValues,
IN const FWPS_INCOMING_METADATA_VALUES* inMetaValues,
IN OUT void* layerData,
IN const void* classifyContext,
IN const FWPS_FILTER* filter,
IN UINT64 flowContext,
OUT FWPS_CLASSIFY_OUT* classifyOut
);
packet = (PWALL_PENDED_PACKET)listEntry;
if( gbBlockAll )
packet->authConnectDecision = FWP_ACTION_BLOCK;
else if( gbEnableProcessMonitor && !WallIsProcessTrafficPermit(packet))
packet->authConnectDecision = FWP_ACTION_BLOCK;
else if ( gbEnableIpMonitor && !WallIsIpTrafficPermit(packet))
packet->authConnectDecision = FWP_ACTION_BLOCK;
else if( gbEnableDnsMonitor && !WallIsDnsTrafficPermit( packet ))
packet->authConnectDecision = FWP_ACTION_BLOCK;
else
packet->authConnectDecision = FWP_ACTION_PERMIT;
typedef struct _PROCESS_RULES_ELEM
{
UINT32 crcPath;
UINT32 rule; //32位值，各个位的功能参看下边的宏定义
}PROCESS_RULES_ELEM,*PPROCESS_RULES_ELEM;
typedef struct _PROCESS_RULES_TABLE
{
UINT8 count;
PROCESS_RULES_ELEM rules[ MAX_PROCESS_RULES_NUM ];
}PROCESS_RULES_TABLE,*PPROCESS_RULES_TABLE;
NTSTATUS
AddProcessRule( IN UINT32 crcPath,IN UINT32 rule )
{
UINT8 xorsum = 0;
UINT32 key,i;
LOG("into\n");
if( gProcessRulesTable.count >= MAX_PROCESS_RULES_NUM )
return STATUS_PROCESS_RULES_FULL;
if ( IsProcessRuleExist( crcPath ))
return STATUS_PROCESS_RULES_EXISTED;
if( crcPath == 0 )crcPath = ZERO_CRC_VALUE;
key = crcPath;
//哈希函数
for( i = 0;i < 32;i++)
{
xorsum ^= key & 0xff;
key >>= 1;
}
//处理哈希冲突
for( i = xorsum;;i = (i + 1 ) % MAX_PROCESS_RULES_NUM )
{
if( gProcessRulesTable.rules[i].crcPath == 0 )
break;
}
gProcessRulesTable.rules[i].crcPath = crcPath;
gProcessRulesTable.rules[i].rule = rule;
gProcessRulesTable.count++;
return STATUS_SUCCESS;
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
上传的附件：
