hsluoyz
commented
7 years ago Hi, about the first 4 questions, because that part of code is originally from WinPcap and not modified by me. I don't understand them quite well. So I will only answer 5. and 6 here.
For 5, it's about LWF v.s. NDIS protocol. Here's a Stackoverflow post answered by Jeffrey, the owner of NDIS from MS: http://stackoverflow.com/questions/18073119/can-a-ndis-protocol-driver-npf-sys-of-winpcap-be-ported-to-lwf-or-wfp. Simply speaking, LWF wins over NDIS protocol in simplicity, performance and 802.11 support.
For 6, I am also frustrated about the current design that we have to install 4 LWFs at the worst condition. But I don't see another way out.
NPF v.s. NPCAP: to support the WinPcap compatible mode and Npcap native mode together, we must support two service names at the same time. Then we have to have two running LWFs at the same time. Earilier, we only install NPF driver when installing with WinPcap compatible mode, but now to better support Npcap native mode, NPCAP driver is also installed.
NP- v.s. NP-_WIFI: the _WIFI driver is for 802.11 raw packet capture. It binds below the Ethernet emulator. The other is the normal Ethernet capture and binds above the emulator. The binding is specified in INF, and I don't see a way to bind a single driver to both above and below the emulator.
dmiller-nmap
mccoysc
1，mdl用法错误：case BIOCGSTATS分支里，原代码试图lock一下mdl，然后就认为此时的user buf被lock了……这是错误的，正确的用法该是lock mdl，然后map出一个新地址，这个新地址才真的是保证一定可访问的。 2，在case biocsendpacketsnosync分支里，加锁然后判断一个变量然后解锁，这个做法虽然不会导致严重故障，但是并不能保证判断结果准确，建议用kewait系列保证临界操作，而不是直接返回失败。 3，npf_bufferedwrite一样是如何在内核使用应用层进城的内存问题，正确做法应该是：先mdl，然后lock，然后map，然后读写新地址。 4，set_bpf_filter那里，基本从头锁到尾，建议使用指针保存过滤器相关数据，每次使用过滤器时用读写锁的读锁加锁，用完解读锁。设置时，先用一块新的内存保存新的过滤器，准备好数据时，获取过滤器的写锁，然后替换保存过滤器的指针值，然后解锁写锁。最后释放旧的过滤器的内存。
5，不要使用lwf，lwf是过滤器，它是串行模式，理论上说会影响系统性能，作为sniffer来说，只要旁听模式就够了，也就是winpcap原本的ndis协议驱动那种方式，那种方式是旁听式的，无论你的程序质量怎样，都不会影响系统的网络性能。
6，从表现来看，处于winpcap兼容模式时，你是在每个网卡上attach了四个过滤器（Npf,npcap,npf_wifi,npcap_wifi），这是完全不必要的逻辑，有叠床架屋之嫌，即使是兼容npf原有接口，也是完全可以在一个过滤器里实现的。
================================================ 1,misused "mdl",at case BIOCGSTATS,orginal code try to lock mdl and then think that the memory in user space would be locked and the pointer from user can be used safely. the right use of mdl should be like this: alloc mdl,lock mdl,mapmdl,use the new mapped address. 2,at case biocsendpacketsnosync,the orginal code try to get a lock and then go to see if the now other pkt-send is in progress,but in the logic,the code can't be sure that.I suggest use KeWait series APIs to protect the critical resource. 3,npf_bufferedwrite....the issue is just like the above 1. 4，at "set_bpf_filter",the lock is locked from the begin to the end. that seems to be not so reasonable.my suggest is that: use a global pointer type var to save all bpf-filter info and use a read-write lock to protect the pointer. get/release the read lock befor/after using the pointer. and if bpf-filter modify is needed:first alloc a new memory to save the new bpf-filter.and then get/release the write lock before/after exchange the bpf-filter pointer value via Interlocked series APIs. 5,don't use the LWF driver as LWF is a filter model."FILTER" may get a side effect on network performance. our need is sniffer,not filter. so a NDIS 6.x protocol is enough. protocol driver is always work in sniffer mode at any time,no any side effect on performance. 6,i found that all NIC is attached by 4 filters:npf,npf-wifi;npcap,npcap-wifi.this is a redundant design.in fact,all need can be done by one filter instance.