Packet Filtering API (PfSetLogBuffer)

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

I have a question about logging (PfSetLogBuffer) with the MS Packet
Filtering API.
http://msdn.microsoft.com/en-us/library/aa376636.aspx

I know that this API is no longer supported, but it is the only option
for programmatic packet filtering on legacy (pre-Vista) Windows (i.e.
before the Windows Filtering Platform). I only need to filter by IP
(I don't even care about port) so I would prefer not to have to write
a kernel component (an NDIS driver or filter hook driver) -- I'd
prefer to use user-mode APIs for simplicity and stability.

To my question:

I am using the Packet Filtering APIs to drop packets matching certain
IPs I want to filter. The APIs work correctly in this regard -- they
drop the correct packets.

Now I am trying to set up logging, through the use of the PfMakeLog,
PfSetLogBuffer functions. This does not work correctly. In fact, it
appears to smash the stack on my Windows XP SP2 test system.

Consider the following sample function:

<code>

extern PBYTE LogBuffer;

DWORD ThreadProc( LPVOID pArg )
{
DWORD RetVal, EntriesLogged, EntriesLost, BytesWritten;
CHAR buffer[ MAX_PATH ];

for( ; ; ) {

if( WaitForSingleObject( hEvent, INFINITE ) == WAIT_FAILED )
break;

PBYTE NewBuffer = new BYTE[ LOG_BUFFER_SIZE ];
RetVal = PfSetLogBuffer( NewBuffer, LOG_BUFFER_SIZE, 64, 1,
&EntriesLogged, &EntriesLost, &BytesWritten );

PFLOGFRAME* pLogFrame = (PFLOGFRAME*) LogBuffer;

printf( "Caught packet (rule %d)\r\n", pLogFrame-
dwFilterRule );

delete [] LogBuffer;
LogBuffer = NewBuffer;

ResetEvent( hEvent );

}

return 0;
}

</code>

This function is spawned via CreateThread and should just wait for log
data (signaled by the hEvent I pass to PfMakeLog when I call it
earlier).

And it does print correctly the first time the function is called.

However, the second time the function is called the stack gets
smashed. Before this call:

RetVal = PfSetLogBuffer( NewBuffer, LOG_BUFFER_SIZE, 64, 1,
&EntriesLogged, &EntriesLost, &BytesWritten );

The buffer (CHAR buffer[ MAX_PATH ] ) contains some junk data. After
that call, the first 8 bytes of the buffer have been overwritten with
the addresses of EntriesLost and BytesWritten. I did not pass the
address of the char buffer to the PfSetLogBuffer function at all.
Therefore, it is somehow overwriting the stack.

In addition, after the second call to this function, the program
segfaults and dies. Given that the char buffer is being overwritten,
I assume there is more massive memory/stack corruption somewhere, and
indeed if I try to unwind the stack with a debugger afterwards the
frame has been totally corrupted.

I do not understand what is going on here. I must be doing something
wrong, but I can't see what. Or are the APIs just buggy?

Thank you very much for any light anyone can shed.
.

Relevant Pages

  • 6.x, 4.x ipfw/dummynet pf/altq - network performance issues
    ... Without a specific pf or ipfw rule to deal with a packet the box would fall over, with specific block rules it would manage an extra 30-40mbps and then fall over. ... When routing & filtering on the same system some of the problems found in 6.x are still apparent, ... UDP floods are much better handled - an ipfw block rule for the packet type and the machine responds as if there were no flood at all (until total bandwidth saturation or PPS limits of the hardware, which in this case was around 950Mbps). ...
    (freebsd-performance)
  • Re: newb: netfilter/iptables ?? extension?
    ... Explain further what you expect to gain by filtering on IP ... I think it would take a rack of Cisco high speed packet filtering ... perform a lookup -- just like iptables. ... provide a clue to solve it -- except that _no_ packet filtering router ...
    (comp.os.linux.networking)
  • Re: Cracking a server without services
    ... filtering firewall. ... It is in my estimation that this program can get past 2/3 IDS and Packet ... Machines that are used as a packet filtering firewall fall into this ... What is more likely to happen than cracking the machine itself is ...
    (Security-Basics)
  • an IP class set feature idea
    ... what IP addresses are filtered in some IP filtering logic without having ... the matching against the IP class. ... the packet being passed to it, and see if any of the configured ranges ... are only designed for binding a single IP address, ...
    (comp.os.linux.development.system)
  • Re: Windows 2008 UDP?
    ... Check following APIs: ... CreateIoCompletionPort() ... thread pool process each packet. ... process each port and somehow sync the binding of the port to the ...
    (microsoft.public.win32.programmer.kernel)