Hard 'C' Question

[suityou01]

I have written a Kernel mode filter driver, and need to return a instance of a struct back to user mode.

The struct contains linked lists defined in ntddk.h

Is is ok to have a user mode app using ntddk.h and LIST_ENTRY linked lists?

I thought Kernel mode and user mode code should not mix.

As I say in the thread title, this is a hard question so .Netters need not apply.

[DimPrawn]

Yes.

HTH

[suityou01]

Yes.

HTH

Very good, have a lie down now.

[AtW]

Someone is still using C? That's a blast from the past - installing C++ compiler just now as VS C++ is total tulipe when it comes to inlined assembly in 64 bit mode

[VectraMan]

That's not a C question. That's a Unix'y question for the sandaled.

[suityou01]

That's not a C question. That's a Windows Vista question for the sandaled.

FTFY

struct in Kernel mode looks like

typedef struct TL_INSPECT_PENDED_PACKET_
{
LIST_ENTRY listEntry;

ADDRESS_FAMILY addressFamily;
TL_INSPECT_PACKET_TYPE type;
FWP_DIRECTION direction;

UINT32 authConnectDecision;
HANDLE completionContext;

//
// Common fields for inbound and outbound traffic.
//
UINT8 protocol;
NET_BUFFER_LIST* netBufferList;
COMPARTMENT_ID compartmentId;
union
{
FWP_BYTE_ARRAY16 localAddr;
UINT32 ipv4LocalAddr;
};
union
{
UINT16 localPort;
UINT16 icmpType;
};
union
{
UINT16 remotePort;
UINT16 icmpCode;
};

//
// Data fields for outbound packet re-injection.
//
UINT64 endpointHandle;
union
{
FWP_BYTE_ARRAY16 remoteAddr;
UINT32 ipv4RemoteAddr;
};

SCOPE_ID remoteScopeId;
WSACMSGHDR* controlData;
ULONG controlDataLength;

//
// Data fields for inbound packet re-injection.
//
BOOLEAN ipSecProtected;
ULONG nblOffset;
UINT32 ipHeaderSize;
UINT32 transportHeaderSize;
IF_INDEX interfaceIndex;
IF_INDEX subInterfaceIndex;
} TL_INSPECT_PENDED_PACKET;

the problem is the user mode app will not have a clue what LIST_ENTRY is, etc etc

I think I have a hunch that I need to declare them as PVOIDs or something.

Just need to loosten my sandals I reckon.

[VectraMan]

Note to self: read the question properly.

Just define the same thing in your user mode app? It's just a chunk of memory; the struct is only there to interpret the chunk of memory as something you can use in a more convenient way. Anything you don't need define as something with an equivalent number of bytes.

[HairyArsedBloke]

I have written a Kernel mode filter driver....

'king 'ell! I was lost after 'Kernel'

I am soooooooo out of this game.

[minestrone]

Ten years since I did a bit of C and you have brought the fears right back posting that bit of code.

*shivers*

[d000hg]

Someone is still using C? That's a blast from the past - installing C++ compiler just now as VS C++ is total tulipe when it comes to inlined assembly in 64 bit mode

Assembly is a little more past it than C. What are you doing that can't be achieved using intrinsics BTW? The only time ASM seems needed these days is in SIMD, where you can get massive improvements.