|
|
|
TDIREDIR - TDI TCP Redirector Filter Driver SampleCopyright © 2005 Printing Communications Assoc., Inc. (PCAUSA). All rights reserved. New: V2.02.06.15 - March, 2005.
OverviewThe goal of this TDI filter driver sample is to illustrate how to use TDI to redirect outbound TCP connections to a local proxy. To do this effectively two basic functions must be provided:
This sample consists of these components:
TDIREDIR - The TDI TCP Redirector Filter DriverThis driver is fairly simple and illustrates the basics of redirecting outbound TCP connection requests. The proxy application passes a buffer containing TCP redirection rules to the driver. The driver TDIH_TdiConnect routine is modified to search the rule buffer and apply the redirection if a match is found. Connections can be redirected to a local proxy on 127.0.0.1 or to a different remote IP address and port. The redirection rule design includes the ability to apply a filter on a specific process by name or to ignore the rule if the connection attempt is being made by a specific process name or process ID. The latter capability allows a proxy to make an outbound connection without being redirected. The design includes a very basic mechanism that allows a proxy to determine the original remote address and port after it has accepted a redirected connection. The driver filters only on \Device\Tcp. The driver does not currently filter on \Device\RawIp, so it is possible for traffic to bypass this filter if the raw sockets interface or RawIp device is used. In addition, the driver does not currently redirect IPv6 TCP connections at all. The TDI TCP Redirector sample driver (TDIREDIR) driver is derived from the base TDI Layered Filter sample driver (TDIPASSL).
TTCPProxy - The TTCP Proxy ApplicationPCAUSA uses the TTCP TCP/UDP Winsock application (described below) as a test traffic generator when testing TDI filters. In this case we have (partially) developed a proxy version of TTCP. The TTCPProxy application is a modified version of the stock PCATTCP application. It is modified to load and start the TDIREDIR driver and then to build and pass a buffer containing TCP redirection rules to the driver. In addition, if TTCPProxy is running as a TCP receiver then it includes code to fetch and display the original destination after a redirected connection has been accepted. TTCPProxy is not a complete TTCP proxy implementation. It does accept and handle the redirected connection and does know the original destination; however, it does not include the logic to establish the additional connection between the proxy and the original destination. Testing the TCP redirector is done by running various combinations of TTCP and TTCPProxy applications to see if the specified redirection rules are followed.
PCATTCP - The TCP/UDP Traffic GeneratorThe primary application used for initial testing PCAUSA TDI filters is TTCP. TTCP is a flexible Winsock utility that includes the capability to exercise the most common Internet protocols:
TTCP tests can be configured using a command-line interface:
PCATTCP is included in both executable and source form with the PCAUSA TDI samples.
Getting Familiar with the RulesOutbound TCP Connection Redirection Rule for a Single PortThe TCP redirection rules are fairly simple. Each TCP redirection is specified by a TCP_REDIR_RULE structure, defined in common.h. rule contains this information:
In addition, each rule can contain Process Name matching information:
Only one of the two possible Process Name matching parameters is permitted in any given rule. If a Process ID to ignore is specified, then the Process Name to Ignore is not used. The controlling application builds a buffer containing multiple TCP redirection rules. The current implementation supports only one rule per remote port.
Building the TCP Connection Redirection Rules BufferA user-mode application passes TCP redirection rules to the driver by filling a buffer with an array of TCP_REDIR_RULE structures that have been sorted by qsort so the array elements are in ascending port number order. This is done so the driver can search the rule array using the bsearch facility. The buffer containing the rules includes the TCP_REDIR_RULE_BUFFER header that provides a sanity-checking prolog before the port blocking rule array. The user-mode IpApi.c module provides a number of helper functions for building a TCP_REDIR_RULE_BUFFER and the TCP_REDIR_RULE array. These include:
The AddPortRule function automatically performs the necessary qsort after adding a new rule to the buffer. Here is an example of adding a TCP redirection rule to a TCP_REDIR_RULE_BUFFER: // 192.168.1.20 - 192.168.1.100:5001 -> 127.0.0.1:5002
// Redirect Any Process Except "TTCPPROXY.EXE"
pRuleBuffer = TcpRedirector_AddPortRule(
pRuleBuffer,
inet_addr( "192.168.1.20" ), // RemoteAddressRangeStart
inet_addr( "192.168.1.100" ),// RemoteAddressRangeEnd
inet_addr( "255.255.255.0" ),// RemoteNetMask
5001, // RemotePort
NULL,
"ttcpproxy.exe",
NULL, // ProcessIdToIgnore
inet_addr( "127.0.0.1" ), // RedirectToAddress
5002 // RedirectToPort
);
This rule would redirect outbound TCP connections on port 5001 in the address range 192.168.1.20 through 192.168.1.100 to a local proxy on 127.0.0.1:5002 for all processes except TTCPPROXY.exe. TTCPPROXY.exe would be allowed to make an outbound connection on port 5001 without interference.
Passing TCP Connection Redirection Rules to the DriverThe user-mode IoApi.c module provides functions that open a control handle to the TDIREDIR driver and allow the application to manage TCP redirection rules:
Each call to TdiRedirector_SetRedirectRules will completely replace any existing rules that the driver may been given previously. It is not necessary to clear existing rules before passing new ones to the driver. The TTCPProxy and TcpConnMan sample applications provides illustrations of the use of these user-mode API helper functions.
Fetching Original Destination in the ProxyIn order for a proxy to operate correctly it is necessary for the proxy to be able to determine the original destination of the redirected connection. This sample provides the TcpRedirector_GetOriginalDestination function for this purpose. TcpRedirector_GetOriginalDestination is called immediately after the proxy accepts a redirected connection and provides the following information:
Use of this function is illustrated in the TTCPProxy application. I would have preferred a mechanism that provides an indication to the proxy before it accepts a connection. This is certainly possible by extending the features already illustrated in this sample. The approach would be to pend the TDI_CONNECT IRP in the TDIH_TdiConnect handler and pass the same information to the proxy before the accept. Having this information before accept would allow the proxy to dynamically provide redirection ports and would provide additional flexibility in managing connections. Unfortunately, that capability is left to a future more expensive product...
Other Driver Control Support RoutinesThe user-mode IoApi.c module provides additional support routines that allow the application to control the driver:
More Sophisticated Rule EnhancementsOne can certainly envision the need for more sophisticated TCP redirection rules beyond the simple rules illustrated in this sample. Ideas for rule enhancements include:
If more sophisticated rules are required, then hopefully this sample will provide a foundation for their creation.
Example TCP Redirection to Proxy TestThis topic describes a representative TCP redirection test using the PCATTCP and TTCPProxy applications that are provided with the TDIREDIR driver. In the table below the left column represents the Command Prompt window for PCATTCP and the right for TTCPProxy. Rows provide a relative indication of the steps in the test. Output of specific interest to the TCP connection redirection is marked in RED.
Driver Implementation OverviewUser-Mode InterfaceThe driver ioctl.c module provides handlers for the user-mode DeviceIoControl API described in previous paragraphs. These handlers actually work on two variables that are declared in tcpredir.c:
Redirecting Outbound TCP ConnectionsThe TDIH_TdiConnect filter routine in TcpConn.c is called when the local host makes a TCP connection attempt. This routine includes the logic to search the TCP redirection rule buffer to find a rule that matches the connection attempt. If a match is found, then the original destination information is saved (to be fetched later by the proxy application) and the remote address and port are changed to values specified in the rule.
Filter Order ComplicationsIt is important to understand that a TDI filter can only filter TDI address and connection objects (or "sockets") that it observes when they are created or opened. For example, if you start an application that listens on port 5001 and then start a TDI filter, then that filter cannot filter the listen request (because it has already occurred...). This presents a special problem if it is necessary to redirect or block ports that are opened by the system very early in the startup process. Examples are ports 137, 138 and 139 opened by NetBIOS over TCP/IP (NetBT) or "NetBIOS-less" direct hosting of SMB over TCP/IP on port 445. If it is essential to redirect or block these ports then some fairly messy modifications to the driver load order registry settings must be made to insure that the TDI filter driver is loaded 1.) after TCP/IP is loaded but 2.) before NetBT opens ports. See the "Load Order Issues" topic in the TDI Samples Help File.
|
|
PCAUSA Home ·
Privacy Statement ·
Products ·
Ordering ·
Support ·
Utilities ·
Resources
|
