使用WFP在ALE_CONNECT_Redirect_V4层重定向每个应用程序的DNS请求

Question

我正试图使用WFP(Windows筛选平台(在每个应用程序的基础上重定向DNS请求。我想重定向到公共DNS服务器，而不是本地代理。我在ALE_CONNECT_REDIRECT_V4层有一个callout驱动程序。当我在这一层跟踪DNS请求时，我可以看到它们运行得很好。

然而，当我将DNS服务器ip(使用INETADDR_SET_ADDRESS(重写到另一个公共服务器(如1.1.1.1(时(我只是重写到公共服务器，而不是本地代理(，我看到重写的DNS请求留在wireshark上，它们的响应也成功地进来了——但我正在重写的DNS应用程序没有收到这些DNS响应——它无法解析主机名。

我已禁用DNS缓存，以便DNS请求直接来自应用程序，而不是svchost.exe进程。

为什么会这样？我是否也必须以某种方式挂接传入的数据包，并将DNS服务器恢复到应用程序所期望的服务器？我不知所措。

Answer 1

在我自己尝试过之后，是的，对于UDP上的DNS流量，你必须拦截入站数据报，并使用clone drop-reject方法修改源地址。TCP上的DNS流量不受影响，因为它是基于连接的协议，而UDP是无连接的。

完整的最低工作驱动程序代码：https://pastebin.com/tCHqNnJH

相关摘录：

void UpdateIpv4HeaderChecksum(PIPV4_HEADER IpHeader, UINT32 IpHeaderSize)
{
UINT32 Checksum = 0;
UINT32 WordCount = IpHeaderSize / sizeof(UINT16);
UINT16* Header = (UINT16*)IpHeader;
IpHeader->Checksum = 0;
for (UINT8 WordIndex = 0; WordIndex < WordCount; WordIndex++)
{
Checksum += Header[WordIndex];
}
Checksum = (Checksum & 0x0000ffff) + (Checksum >> 16);
Checksum += (Checksum >> 16);
IpHeader->Checksum = (UINT16)~Checksum;
}
void NTAPI DriverDatagramDataInjectComplete(
_In_ void* context,
_Inout_ NET_BUFFER_LIST* netBufferList,
_In_ BOOLEAN dispatchLevel
)
{
UNREFERENCED_PARAMETER(context);
UNREFERENCED_PARAMETER(dispatchLevel);
if (!NT_SUCCESS(netBufferList->Status))
{
DoTraceMessage(Default, "DriverDatagramDataInjectComplete() Status=%!STATUS!", netBufferList->Status);
}
FwpsFreeCloneNetBufferList(netBufferList, 0);
}
void NTAPI DriverDatagramDataClassify(
_In_ const FWPS_INCOMING_VALUES* inFixedValues,
_In_ const FWPS_INCOMING_METADATA_VALUES* inMetaValues,
_Inout_opt_ void* layerData,
_In_opt_ const void* classifyContext,
_In_ const FWPS_FILTER* filter,
_In_ UINT64 flowContext,
_Inout_ FWPS_CLASSIFY_OUT* classifyOut
)
{
UNREFERENCED_PARAMETER(layerData);
UNREFERENCED_PARAMETER(classifyContext);
UNREFERENCED_PARAMETER(filter);
UNREFERENCED_PARAMETER(flowContext);
UINT32 RemoteAddress = inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_ADDRESS].value.uint32;
UINT16 RemotePort = inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_PORT].value.uint16;
IF_INDEX InterfaceIndex = inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_INDEX].value.uint32;
IF_INDEX SubInterfaceIndex = inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_SUB_INTERFACE_INDEX].value.uint32;
FWP_DIRECTION Direction = inFixedValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_DIRECTION].value.uint32;
FWPS_PACKET_INJECTION_STATE PacketInjectionState = FwpsQueryPacketInjectionState(g_InjectionHandle, layerData, NULL);
classifyOut->actionType = FWP_ACTION_PERMIT;
classifyOut->rights |= FWPS_RIGHT_ACTION_WRITE;
if ((Direction == FWP_DIRECTION_INBOUND) && (PacketInjectionState == FWPS_PACKET_NOT_INJECTED) && (RemotePort == DNS_PORT) && (RemoteAddress == DNS_HOST_REDIRECT))
{
UINT32 IpHeaderSize = inMetaValues->ipHeaderSize;
UINT32 TransportHeaderSize = inMetaValues->transportHeaderSize;
PNET_BUFFER NetBuffer = NET_BUFFER_LIST_FIRST_NB((PNET_BUFFER_LIST)layerData);
NdisRetreatNetBufferDataStart(NetBuffer, IpHeaderSize + TransportHeaderSize, 0, NULL);
PNET_BUFFER_LIST NetBufferList = NULL;
NTSTATUS Status = FwpsAllocateCloneNetBufferList(layerData, NULL, NULL, 0, &NetBufferList);
if (!NT_SUCCESS(Status))
{
DoTraceMessage(Default, "FwpsAllocateCloneNetBufferList() Status=%!STATUS!", Status);
}
NdisAdvanceNetBufferDataStart(NetBuffer, IpHeaderSize + TransportHeaderSize, FALSE, NULL);
if (!NetBufferList)
{
return;
}
DoTraceMessage(Default, "Modify DNS response");
NetBuffer = NET_BUFFER_LIST_FIRST_NB(NetBufferList);
PIPV4_HEADER IpHeader = NdisGetDataBuffer(NetBuffer, sizeof(IPV4_HEADER), NULL, 1, 0);
IpHeader->SourceAddress = DNS_HOST_ORIGINAL;
UpdateIpv4HeaderChecksum(IpHeader, sizeof(IPV4_HEADER));
Status = FwpsInjectTransportReceiveAsync(g_InjectionHandle, NULL, NULL, 0, AF_INET, inMetaValues->compartmentId, InterfaceIndex, SubInterfaceIndex, NetBufferList, DriverDatagramDataInjectComplete, NULL);
if (!NT_SUCCESS(Status))
{
DoTraceMessage(Default, "FwpsInjectTransportReceiveAsync() Status=%!STATUS!", Status);
FwpsFreeCloneNetBufferList(NetBufferList, 0);
}
classifyOut->actionType = FWP_ACTION_BLOCK;
classifyOut->rights &= ~FWPS_RIGHT_ACTION_WRITE;
classifyOut->flags |= FWPS_CLASSIFY_OUT_FLAG_ABSORB;
}
}