aboutsummaryrefslogtreecommitdiffstats
path: root/driver (follow)
Commit message (Collapse)AuthorAgeFilesLines
* driver: allowedips: expand maximum node depthJason A. Donenfeld2023-12-112-12/+14
| | | | | | | | | | | | In the allowedips self-test, nodes are inserted into the tree, but it generated an even amount of nodes, but for checking maximum node depth, there is of course the root node, which makes the total number necessarily odd. With two few nodes added, it never triggered the maximum depth check like it should have. So, add 129 nodes instead of 128 nodes, and do so with a more straightforward scheme, starting with all the bits set, and shifting over one each time. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: PEER_UPDATE is supposed to be UPDATE_ONLYJason A. Donenfeld2021-10-192-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: adapter: replace INF Include/Needs hack with stub deviceJason A. Donenfeld2021-10-111-2/+0
| | | | | | | | | | | | Apparently breaking the guarantee of "Universal INF"s receives the big tsk tsk, so this commit is yet another way to set SuggestedInstanceId. We create an SwDevice, with DEVPKEY_Device_ClassGuid set to GUID_DEVCLASS_NET and an empty HWID, and then create the software regkey and add the keys we need. We then destroy the SwDevice, and recreate a new one with the same instance ID, this time with the proper parameters. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: add icon to device managerJason A. Donenfeld2021-10-113-0/+8
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: adapter: set suggested instance ID using INF instead of ourselvesJason A. Donenfeld2021-10-061-0/+2
| | | | | | This might allow us to more successfully move to using SwDevice. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: inf: remove Windows 9x regkeyJason A. Donenfeld2021-10-061-1/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: memory: help SDV with annotationJason A. Donenfeld2021-10-061-1/+3
| | | | | | | Presumably it's fighting with the _Post_nonnull_, so add an assumption statement. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: ioctl: remove force closing of handlesJason A. Donenfeld2021-10-063-123/+0
| | | | | | | | | | | | | | | | This driver has never actually made successful use of it, because we've been wrongly matching against the FunctionalDeviceObject instead of Stack->FileObject->DeviceObject. Yet, things seem to have worked fine enough because of smart notification to the logger thread. Furthermore, SwDevice calls halt immediately, because it constitutes a surprise removal, which means we don't really even have time for the fuse to go off. And finally, dereferencing Table[i]->Object can race with the destruction of that object, which is a UaF. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: ioctl: remove old pid checkJason A. Donenfeld2021-09-291-5/+1
| | | | | | | Since this is now a kernel thread, it doesn't make sense to compare to the current PID. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: fix IRQL annotationsSimon Rozman2021-09-282-2/+2
| | | | | | | | By calling WskInit in SocketInit, the later must be run at passive IRQL. Actually, it is. This commit only updates the IRQL annotations accordingly. Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: socket: defer WskInit until sockets are actually createdJason A. Donenfeld2021-09-243-80/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It turns out that MINIPORT_INITIALIZE can actually delay system load, and we currently have reports of people's systems hanging indefinitely. WskCaptureNPI is known to deadlock if called too early in boot (say, from DriverEntry of a PnP driver), but it was thought that MINIPORT_INITIALIZE was sufficiently late that it was okay. Perhaps that assumption is incorrect. In case it is, this patch moves WSK initialization to when sockets are created, which always happens in the context of a user thread, which naturally happens late in boot and can block. We know empirically that MINIPORT_INITIALIZE can block system boot, by adding a `KeDelayExecutionThread(KernelMode, FALSE, &(LARGE_INTEGER){ .QuadPart = -SEC_TO_SYS_TIME_UNITS(300) });` to the top and noting that boot takes 5 minutes longer. So the theory that the assumption is incorrect is at least plausible. All this commit does is move the call to WskInit() from InitializeEx in device.c to SocketInit() in socket.c. The diff looks more verbose than it is because making WskInit static and removing its forward declaration required shuffling some functions around in socket.c, but no code changed during that shuffle. Reported-by: Oliver Freyermuth <freyermuth@physik.uni-bonn.de> Reported-by: Joshua Sjoding <joshua.sjoding@scjalliance.com> Reported-by: John-Paul Andreini <jandreini@geonerco.com> Reported-by: Arlo Clauser <Arlo@starcubedesign.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: inf: remove useless LoadOrderGroupJason A. Donenfeld2021-09-241-1/+0
| | | | | | It's ignored for PnP drivers. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: queueing: don't wait on more than 64 cores at onceJason A. Donenfeld2021-09-231-34/+19
| | | | | | | | | | It turns out we can't wait on more than 64 handles at once, which happens on monster systems with 128 cores. So, split this into chunks. While we're at it, make both the normal and low-mem path use the same logic, with the low-mem path simply doing 3 threads at once. Reported-by: Joe Mulvihill <Joe.Mulvihill@Hardsuitlabs.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: do not use zero UDPv4 checksumsJason A. Donenfeld2021-09-201-7/+0
| | | | | | | | | | Some routers using hardware NAT can't handle this. A packet goes through initially, but then once the flow is established and it's offloaded to the NAT hardware, the zero checksum causes most packets to be dropped. So, unfortunately, we have to remove this optimization. Reported-by: Christian Årebrand <myspysgaddan@hotmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: remove _NO_CRT_STDIO_INLINE workaroundJason A. Donenfeld2021-09-161-1/+1
| | | | | | This was only present in 16.10. EWDK is at 16.9 and VS is now at 16.11. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: bypass TDI entirelyJason A. Donenfeld2021-09-131-0/+12
| | | | | | | Not only will this improve performance, but it will eliminate a big issue with IP_PKTINFO. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: use IP_OPTIONS for cmsg hackJason A. Donenfeld2021-09-101-14/+10
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: remember to copy cmsghack when copying endpointJason A. Donenfeld2021-09-092-26/+26
| | | | | | | Otherwise, we can't reply to incoming endpoints. Reported-by: Peter Whisker <peter.whisker@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: receive: drop handshakes if queue lock is contendedJason A. Donenfeld2021-09-092-1/+24
| | | | | | | | | | | | If we're being delivered packets from multiple CPUs so quickly that the ring lock is contended for CPU tries, then it's safe to assume that the queue is near capacity anyway, so just drop the packet rather than spinning. This helps deal with multicore DoS that can interfere with data path performance. It _still_ does not completely fix the issue, but it again chips away at it. Reported-by: Streun Fabio <fstreun@student.ethz.ch> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: work around tcpip cmsg stripping bugJason A. Donenfeld2021-09-072-6/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the cmsg only contains an IP_PKTINFO or IP_PKTINFO_EX, then on some systems, the entire control message will be stripped out early before passing it to WFP. Presumably this is an optimization gone bad. The lack of a valid controlMessage member in FWPS_INCOMING_METADATA_VALUES0 when callouts are triggered results in big problems. Specifically, problems occur with drivers like NFSDK or McAfee or various other applications users install that install callouts that capture an outgoing packet, and then later reinject it (with, say, FwpsInjectTransportSendAsync0). McAfee does this for their DPI. NFSDK does this for their userspace parser library. Various things seem to use this technique. The problem is that when IN_PKTINFO is stripped from FWPS_INCOMING_METADATA_VALUES0, then it's not subsequently passed to FwpsInjectTransportSendAsync0, so it's as if the packet was sent without IP_PKTINFO in the first place. This causes routing loops, and users have a dysfunctional tunnel with high CPU usage, as packets route round and round. These issues go away when the callout and FwpsInjectTransportSendAsync0 dance is removed, indicating that IN_PKTINFO is working as intended in the rest of the networking stack. It turns out that the faulty optimization only triggers if IP_PKTINFO is the only control message used. So, we tag on a second control message that (hopefully) does nothing; IP_WFP_REDIRECT_RECORDS seems like a reasonable candidate. It happens to be Windows 8+, so we disable it on Windows 7, which doesn't need the hack anyway. Adding an extra control message and potentially adding additional overhead to the egress path is pretty awful, but currently, I'm not aware of a better workaround. Reported-by: Keshav Kejriwal <kesh.kejriwal@gmail.com> Reported-by: Kai Haberzettl <khaberz@gmail.com> Reported-by: Seyed Mohammad Hossein Amirkhalili <hosami@gmail.com> Reported-by: Francky Meyer <francky.meyer@hotmail.fr> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: allocate IRPs on stackJason A. Donenfeld2021-08-121-59/+45
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: group v4 and v6 sockoptsJason A. Donenfeld2021-08-121-9/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: initialize device removed event before registrationJason A. Donenfeld2021-08-111-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: relax cmsg alignment, but assert macros matchJason A. Donenfeld2021-08-112-5/+20
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: receive: update SALSimon Rozman2021-08-101-1/+1
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: ioctl: do not return zero psksJason A. Donenfeld2021-08-104-21/+25
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: receive: use ring buffer for incoming handshakesJason A. Donenfeld2021-08-094-20/+22
| | | | | | | | | | | | | | Apparently the spinlock on incoming_handshake's skb_queue is highly contended, and a torrent of handshake or cookie packets can bring the data plane to its knees, simply by virtue of enqueueing the handshake packets to be processed asynchronously. So, we try switching this to a ring buffer to hopefully have less lock contention. If this is still a problem, we can resurrect the MPMC ring buffer, but for now let's see if good old ptr_ring does the trick. Reported-by: Streun Fabio <fstreun@student.ethz.ch> Reported-by: Joel Wanner <joel.wanner@inf.ethz.ch> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: give up on doing ICMP on NDISJason A. Donenfeld2021-08-091-5/+1
| | | | | | | With the way NAT and such is designed, this is never going to happen. Give up on it. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: rework loop routing, endpoint resolution, and reduce ctxJason A. Donenfeld2021-08-093-188/+230
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: devicelist is now privateJason A. Donenfeld2021-08-082-5/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: allow loop routingJason A. Donenfeld2021-08-082-20/+2
| | | | | | | | You can still create loops, but ever since we started making copies on both RX and TX, and freeing TX buffers really early (after encryption), we no longer have a stack chaining issue on free. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: logging: pass timestamp back to userspaceJason A. Donenfeld2021-08-084-12/+21
| | | | | | It turns out the precision is very useful for diagnosing weird errors. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: logging: add more ring buffer log entriesJason A. Donenfeld2021-08-081-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: undocumented: use better SAL for ZwQuerySystemInformationJason A. Donenfeld2021-08-081-12/+9
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: mark as network driver rather than system driverJason A. Donenfeld2021-08-081-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: receive: simplify endpoint settingJason A. Donenfeld2021-08-081-7/+3
| | | | | | | This is a holdover from Linux, where we reset the packet before consuming. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: chicken out on NSI hijack, and revert to pollingJason A. Donenfeld2021-08-052-137/+45
| | | | | | | | | | | This reverts commit 217922afde75df527cada3224df8930264375fa1. The NSI hijack works so well! But video game anti-cheat stuff make this annoying. At least GetIpInterfaceEntry only takes 70,000 cycles... Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: hack around broken IP notifier by hijacking \Device\NsiJason A. Donenfeld2021-08-052-45/+137
| | | | | | | This is very dirty and reverse engineered, but it seems to work, and it's a stop-gap solution until Windows patches ship. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: hack around broken IP notifier by pollingJason A. Donenfeld2021-08-051-1/+75
| | | | | | Not pretty, but functional. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: device: implement MTU notifications properly, even if brokenJason A. Donenfeld2021-08-054-109/+57
| | | | | | | Let's assume that Windows is operating as described, and then later we can hack around the limitations. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: use implicit CMSG_SPACE for total length, for v6Jason A. Donenfeld2021-08-041-2/+2
| | | | | | | | | It expects to receive the total space, with padding, for the cmsg length argument, so pad out cmsg_len to the data padding multiple, which amounts to the same thing. This will fix IPv6 endpoints. Reported-by: Darren VanBuren <onekopaka@theoks.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: allocate large rows on heapJason A. Donenfeld2021-08-041-6/+14
| | | | | | | | The most ridiculous function gets even more ridiculous: we need a heap allocation. We should probably find a new strategy here, as this is growing unwieldy. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: memory: allocate NBL, NB, and MDL all at once when possible for TXJason A. Donenfeld2021-08-041-0/+14
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: memory: allocate NB and MDL all at once for TXJason A. Donenfeld2021-08-041-55/+46
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: memory: allocate NBL, NB, and MDL all at once for RXJason A. Donenfeld2021-08-041-31/+77
| | | | | | This increases performance considerably. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: memory: move NBL pools to global scopeJason A. Donenfeld2021-08-049-88/+64
| | | | | | | This is preparation for the next commit, which will attempt to allocate everything at once for the RX path. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: ioctl: don't set endpoint get flag if no endpointJason A. Donenfeld2021-08-031-1/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: ignore interfaces with down oper statusJason A. Donenfeld2021-08-031-4/+7
| | | | | | This should allow better transition between wifi and wired. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: ioctl: remove device update generationJason A. Donenfeld2021-08-033-4/+1
| | | | | | We're not (yet?) doing cursored gets, so this isn't in use. Remove it. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: socket: increment local endpoint update generationJason A. Donenfeld2021-08-031-1/+1
| | | | | | | Otherwise we wind up retrying and doing the routing generation comparison at the top needlessly. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.