Windwos 驱动WFP

WFP (Windows Filtering Platform) 是 Windows 操作系统中的一种网络包过滤框架，它提供了一种通用的方式来处理网络流量。Windows 驱动程序可以使用 WFP API 来实现网络包过滤和处理功能。WFP 驱动程序可以通过注册自己的过滤器和层来实现不同的网络包处理功能，比如防火墙、流量监测、VPN 等。需要注意的是，开发 WFP 驱动程序需要一定的驱动程序开发经验和专业知识，因为它需要处理底层的网络协议和数据包结构。

相关问题

Windwos 驱动WFP基本流程代码

WFP 驱动程序的基本流程代码如下：

#include <ntddk.h>
#include <wdf.h>
#include <fwpmk.h>
#include <fwpvi.h>

#define WFP_DRIVER_TAG 'wfpd'

DRIVER_INITIALIZE DriverEntry;
EVT_WDF_DRIVER_DEVICE_ADD WfpEvtDeviceAdd;
EVT_WDF_OBJECT_CONTEXT_CLEANUP WfpEvtDriverContextCleanup;

typedef struct _WFP_DRIVER_CONTEXT {
    HANDLE engineHandle;
    UINT32 calloutId;
} WFP_DRIVER_CONTEXT, *PWFP_DRIVER_CONTEXT;

WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(WFP_DRIVER_CONTEXT, WfpGetDriverContext)

NTSTATUS
DriverEntry(
    _In_ PDRIVER_OBJECT DriverObject,
    _In_ PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS status;
    WDF_DRIVER_CONFIG config;

    WDF_DRIVER_CONFIG_INIT(&config, WdfEvtDriverDeviceAdd);
    config.DriverPoolTag = WFP_DRIVER_TAG;

    status = WdfDriverCreate(DriverObject, RegistryPath, WDF_NO_OBJECT_ATTRIBUTES, &config, WDF_NO_HANDLE);
    if (!NT_SUCCESS(status)) {
        KdPrint(("WdfDriverCreate failed with status 0x%x\n", status));
    }

    return status;
}

NTSTATUS
WfpEvtDeviceAdd(
    _In_ WDFDRIVER Driver,
    _Inout_ PWDFDEVICE_INIT DeviceInit
    )
{
    NTSTATUS status;
    WDFDEVICE device;
    PWFP_DRIVER_CONTEXT driverContext;
    HANDLE engineHandle;
    FWP_BYTE_BLOB providerBlob;
    FWPM_SESSION session;
    FWPM_CALLOUT callout;
    FWPM_DISPLAY_DATA displayData;
    UINT32 calloutId;
    FWPM_FILTER filter;
    FWPM_FILTER_CONDITION filterConditions[1];
    UNICODE_STRING filterName;

    UNREFERENCED_PARAMETER(Driver);

    KdPrint(("WfpEvtDeviceAdd called\n"));

    status = WdfDeviceCreate(&DeviceInit, WDF_NO_OBJECT_ATTRIBUTES, &device);
    if (!NT_SUCCESS(status)) {
        KdPrint(("WdfDeviceCreate failed with status 0x%x\n", status));
        return status;
    }

    driverContext = WfpGetDriverContext(WdfObjectGetDriver(device));

    status = FwpmEngineOpen0(NULL, RPC_C_AUTHN_WINNT, NULL, NULL, &engineHandle);
    if (!NT_SUCCESS(status)) {
        KdPrint(("FwpmEngineOpen0 failed with status 0x%x\n", status));
        return status;
    }

    providerBlob.size = sizeof(GUID);
    providerBlob.data = (BYTE*)&GUID_WFP_DRIVER;

    RtlZeroMemory(&session, sizeof(FWPM_SESSION));
    session.flags = FWPM_SESSION_FLAG_DYNAMIC;

    RtlZeroMemory(&callout, sizeof(FWPM_CALLOUT));
    callout.displayData.name = L"WFP Callout";
    callout.displayData.description = L"Callout for WFP driver";
    callout.providerKey = providerBlob;
    callout.applicableLayer = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
    callout.flags = FWPM_CALLOUT_FLAG_ALLOW_MID_STREAM_INSPECTION;
    callout.calloutKey = GUID_WFP_CALLOUT;

    status = FwpmCalloutAdd0(engineHandle, &callout, &session, &calloutId);
    if (!NT_SUCCESS(status)) {
        KdPrint(("FwpmCalloutAdd0 failed with status 0x%x\n", status));
        FwpmEngineClose0(engineHandle);
        return status;
    }

    RtlZeroMemory(&filter, sizeof(FWPM_FILTER));
    RtlInitUnicodeString(&filterName, L"WFP Filter");
    filter.displayData.name = filterName;
    filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
    filter.action.type = FWP_ACTION_CALLOUT_TERMINATING;
    filter.action.calloutKey = GUID_WFP_CALLOUT;
    filter.filterCondition = filterConditions;
    filter.numFilterConditions = 1;

    filterConditions[0].fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS;
    filterConditions[0].matchType = FWP_MATCH_EQUAL;
    filterConditions[0].conditionValue.type = FWP_BYTE_ARRAY16_TYPE;
    filterConditions[0].conditionValue.byteArray16[0] = 192;
    filterConditions[0].conditionValue.byteArray16[1] = 168;
    filterConditions[0].conditionValue.byteArray16[2] = 0;
    filterConditions[0].conditionValue.byteArray16[3] = 1;

    status = FwpmFilterAdd0(engineHandle, &filter, &session, &filter.filterId);
    if (!NT_SUCCESS(status)) {
        KdPrint(("FwpmFilterAdd0 failed with status 0x%x\n", status));
        FwpmCalloutDeleteByKey0(engineHandle, &GUID_WFP_CALLOUT);
        FwpmEngineClose0(engineHandle);
        return status;
    }

    driverContext->engineHandle = engineHandle;
    driverContext->calloutId = calloutId;

    return status;
}

VOID
WfpEvtDriverContextCleanup(
    _In_ WDFOBJECT DriverObject
    )
{
    PWFP_DRIVER_CONTEXT driverContext;

    KdPrint(("WfpEvtDriverContextCleanup called\n"));

    driverContext = WfpGetDriverContext(DriverObject);

    FwpmFilterDeleteById0(driverContext->engineHandle, driverContext->calloutId);
    FwpmCalloutDeleteByKey0(driverContext->engineHandle, &GUID_WFP_CALLOUT);
    FwpmEngineClose0(driverContext->engineHandle);
}

以上代码是一个简单的 WFP 驱动程序，它实现了一个基于 IP 地址的过滤器，只允许指定的 IP 地址进行连接。在 `DriverEntry` 函数中创建了 WDF 驱动程序对象，并指定了设备添加回调函数 `WfpEvtDeviceAdd`。在 `WfpEvtDeviceAdd` 函数中创建了 WDF 设备对象，并初始化了 WFP 引擎、WFP 回调函数、WFP 过滤器等。在 `WfpEvtDriverContextCleanup` 函数中清理 WFP 引擎和 WFP 对象。需要注意的是，以上代码仅供参考，具体实现需要根据实际需求进行修改。

TDI和WFP驱动区别

TDI和WFP是Windows操作系统中的两种不同的驱动技术。TDI是Transport Driver Interface的缩写，它在Windows 2000到Windows Vista期间被支持。TDI是一套接口的集合，用于连接用户态的socket和NDIS协议驱动，实现socket的创建、发送和接收数据。\[1\]

WFP是Windows Filtering Platform的缩写，它是取代TDI的新技术。WFP是一种网络过滤平台，用于在网络数据包传输过程中进行过滤和处理。WFP提供了一种灵活的方式来管理和控制网络流量，可以实现防火墙、入侵检测和网络安全等功能。与TDI相比，WFP提供了更高级的网络过滤和处理功能，并且支持更多的Windows操作系统版本。\[1\]

总结来说，TDI是一种用于连接用户态的socket和NDIS协议驱动的接口集合，而WFP是一种网络过滤平台，用于在网络数据包传输过程中进行过滤和处理。WFP相比于TDI提供了更高级的网络过滤和处理功能，并且支持更多的Windows操作系统版本。
#### 引用[.reference_title]
- *1* *2* *3* [Windows网络驱动、NDIS驱动(微端口驱动、中间层驱动、协议驱动)、TDI驱动(网络传输层过滤)、WFP（Windows ...](https://blog.csdn.net/zhangge3663/article/details/100918732)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v91^insertT0,239^v3^insert_chatgpt"}} ] [.reference_item]
[ .reference_list ]