windows-server-2003/net/rras/ip/fltrdrvr/foo.c

/*++

Copyright (c) 1995  Microsoft Corporation

Module Name:

    net\ip\fltrdrvr\driver.c

Abstract:


Revision History:



--*/

#include "globals.h"
#include <ipinfo.h>
#include <ntddtcp.h>
#include <tdiinfo.h>

#define DEFAULT_DIRECTORY       L"DosDevices"
#define DEFAULT_FLTRDRVR_NAME   L"IPFILTERDRIVER"

typedef enum
{
    NULL_INTERFACE = 0,
    OLD_INTERFACE,
    NEW_INTERFACE
} INTTYPE, *PINTTTYPE;

FILTER_DRIVER   g_filters;
DWORD           g_dwCacheSize;
DWORD           g_dwHashLists;
BOOL            g_bDriverRunning;
KSPIN_LOCK      g_lOutFilterLock;
KSPIN_LOCK      g_lInFilterLock;
KSPIN_LOCK      g_FcbSpin;
MRSW_LOCK       g_IpTableSpin;
LIST_ENTRY      g_freeOutFilters;
LIST_ENTRY      g_freeInFilters;
LIST_ENTRY      g_leFcbs;
DWORD           g_dwMakingNewTable;
DWORD           g_dwNumHitsDefaultIn;
DWORD           g_dwNumHitsDefaultOut;
DWORD           g_FragThresholdSize = MINIMUM_FRAGMENT_OFFSET;
ULONG           AddrModulus;
IPAddrEntry     *AddrTable;
PADDRESSARRAY * AddrHashTable;
PADDRESSARRAY * AddrSubnetHashTable;
NPAGED_LOOKASIDE_LIST filter_slist;
PAGED_LOOKASIDE_LIST  paged_slist;
ERESOURCE       FilterAddressLock;


#ifdef DRIVER_PERF
DWORD          g_dwNumPackets,g_dwFragments,g_dwCache1,g_dwCache2;
DWORD          g_dwWalk1,g_dwWalk2,g_dwForw,g_dwWalkCache;
KSPIN_LOCK     g_slPerfLock;
LARGE_INTEGER  g_liTotalTime;
#endif

//
// Forward references.
//
NTSTATUS
OpenNewHandle(PFILE_OBJECT FileObject);

NTSTATUS
CloseFcb(PPFFCB Fcb, PFILE_OBJECT FileObject);

PPAGED_FILTER_INTERFACE
FindInterfaceOnHandle(PFILE_OBJECT FileObject,
                      PVOID    pvValue);

DWORD
LocalIpLook(DWORD Addr);

BOOLEAN
PfFastIoDeviceControl (
    IN struct _FILE_OBJECT *FileObject,
    IN BOOLEAN Wait,
    IN PVOID InputBuffer OPTIONAL,
    IN ULONG InputBufferLength,
    OUT PVOID OutputBuffer OPTIONAL,
    IN ULONG OutputBufferLength,
    IN ULONG IoControlCode,
    OUT PIO_STATUS_BLOCK IoStatus,
    IN struct _DEVICE_OBJECT *DeviceObject
    );

NTSTATUS
LockFcb(
    IN struct _FILE_OBJECT *FileObject);

VOID
PFReadRegistryParameters(PUNICODE_STRING RegistryPath);

VOID
UnLockFcb(
    IN struct _FILE_OBJECT *FileObject);

NTSTATUS
GetSynCountTotal(PFILTER_DRIVER_GET_SYN_COUNT OutputBuffer);

NTSTATUS
DeleteByHandle(
           IN PPFFCB                      Fcb,
           IN PPAGED_FILTER_INTERFACE     pPage,
           IN PVOID *                     ppHandles,
           IN DWORD                       dwLength);


FAST_IO_DISPATCH PfFastIoDispatch =
{
    11,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    PfFastIoDeviceControl
};

#pragma alloc_text(PAGED, DoIpIoctl)
//#pragma alloc_text(PAGED, OpenNewHandle)
#pragma alloc_text(PAGED, FindInterfaceOnHandle)
#pragma alloc_text(PAGED, PfFastIoDeviceControl)
#pragma alloc_text(INIT, DriverEntry, PFReadRegistryParameters)


VOID
FcbLockDown(PPFFCB Fcb)
{
    KIRQL kirql;

    KeAcquireSpinLock(&g_FcbSpin, &kirql);
    if(!(Fcb->dwFlags & PF_FCB_CLOSED))
    {
        InterlockedDecrement(&Fcb->UseCount);
        Fcb->dwFlags |= PF_FCB_CLOSED;
    }
    KeReleaseSpinLock(&g_FcbSpin, kirql);
}

NTSTATUS
DriverEntry(
            IN PDRIVER_OBJECT  DriverObject,
            IN PUNICODE_STRING RegistryPath
            )
/*++
  Routine Description
       Called when the driver is loaded. It creates the device object and sets up the DOS name.
       Also does the initialization of standard entry points and its own global data
          
  Arguments
       DriverObject
       RegistryPath
          
  Return Value
       NTSTATUS

--*/
{
    INT		        i;
    PDEVICE_OBJECT  deviceObject = NULL;
    NTSTATUS        ntStatus;
    WCHAR	        deviceNameBuffer[] = DD_IPFLTRDRVR_DEVICE_NAME;
    UNICODE_STRING  deviceNameUnicodeString;
    
    TRACE0("Filter Driver: Entering DriverEntry\n") ;
    
     
    //
    // Initialize the lock and the list
    //
    
    InitializeMRSWLock(&g_filters.ifListLock);
    InitializeListHead(&g_filters.leIfListHead);
    InitializeListHead(&g_leFcbs);
    g_filters.ppInCache = NULL;
    g_filters.ppOutCache = NULL;
    g_bDriverRunning = FALSE;
    InitializeMRSWLock(&g_IpTableSpin);
    KeInitializeSpinLock(&g_lOutFilterLock);
    KeInitializeSpinLock(&g_lInFilterLock);
    KeInitializeSpinLock(&g_FcbSpin);
    InitializeListHead(&g_freeOutFilters);
    InitializeListHead(&g_freeInFilters);
    g_dwNumHitsDefaultIn = g_dwNumHitsDefaultOut = 0;
    
#ifdef DRIVER_PERF
    g_dwFragments = g_dwCache1 = g_dwCache2 = g_dwNumPackets = 0;
    g_dwWalk1 = g_dwWalk2 = g_dwForw = g_dwWalkCache = 0;
    g_liTotalTime.HighPart = g_liTotalTime.LowPart = 0; 
    KeInitializeSpinLock(&g_slPerfLock);
#endif

    //
    // Create a device object 
    //
     
    RtlInitUnicodeString (&deviceNameUnicodeString, deviceNameBuffer);
    
    __try
    {
        ntStatus = IoCreateDevice (DriverObject,
                                   0,
                                   &deviceNameUnicodeString,
                                   FILE_DEVICE_NETWORK,
                                   0,
                                   FALSE,               // Exclusive
                                   &deviceObject
                                   );
        
        if (NT_SUCCESS(ntStatus)) 
        {
            //
            // Initialize the driver object
            //

            DriverObject->DriverUnload   = FilterDriverUnload;
            DriverObject->FastIoDispatch = &PfFastIoDispatch;
            DriverObject->DriverStartIo  = NULL;
    
            for (i=0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
            {
                DriverObject->MajorFunction[i] = FilterDriverDispatch;
            }
        } 
        else 
        {
            DbgPrint("Filter Driver: IoCreateDevice failed\n") ;
            __leave;
        }
        
        SetupExternalNaming (&deviceNameUnicodeString) ;
    }
    __finally
    {
        if(!NT_SUCCESS(ntStatus))
        {
            DbgPrint("Filter Driver: Error in DriverEntry routine\n");
        }
        else
        {
            ExInitializeResource ( &FilterListResourceLock );
            ExInitializeResource ( &FilterAddressLock );
            TRACE0("Filter Driver: DriverEntry routine successful\n");
        }
        
        if(NT_SUCCESS(ntStatus))
        {
            PFReadRegistryParameters(RegistryPath);
        }
        return ntStatus;
    }
}


NTSTATUS
FilterDriverDispatch(
                     IN PDEVICE_OBJECT DeviceObject,
                     IN PIRP Irp
                     )
/*++
  Routine Description
        Dispatch Routine for the filter driver. Gets the current irp stack location, validates
        the parameters and calls the necessary routing (which is ioctl.c)
        
  Arguments
        DeviceObject
        Irp
          
  Return Value
        Status as returned by the worker functions
        
--*/
{
    PIO_STACK_LOCATION	irpStack;
    PVOID		        pvIoBuffer;
    ULONG		        inputBufferLength;
    ULONG		        outputBufferLength;
    ULONG		        ioControlCode;
    NTSTATUS		    ntStatus;
    DWORD               dwSize = 0;

    Irp->IoStatus.Status      = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    
    //
    // Get a pointer to the current location in the Irp. This is where
    // the function codes and parameters are located.
    //
    
    irpStack = IoGetCurrentIrpStackLocation(Irp);
    
    //
    // Get the pointer to the input/output buffer and it's length
    //
    
    pvIoBuffer         = Irp->AssociatedIrp.SystemBuffer;
    inputBufferLength  = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    outputBufferLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength;

    TRACE0("FilterDriver: Request received\n");

    switch (irpStack->MajorFunction) 
    {
        case IRP_MJ_CREATE:
        {
            TRACE0("FilterDriver: IRP_MJ_CREATE\n");
            
            //
            // Initialize the driver. The first time it gets a create IRP, it starts up the 
            // filtering.
            //
            
            ntStatus = STATUS_SUCCESS;
            
            if(!g_bDriverRunning)
            {
                ExAcquireResourceExclusive( &FilterListResourceLock, TRUE);
               
                if (g_bDriverRunning || InitFilterDriver())
                {
                    g_bDriverRunning = TRUE;
                }
                else
                {
                    ntStatus = STATUS_UNSUCCESSFUL ;
                }
                ExReleaseResourceLite( &FilterListResourceLock );
            }
            if(NT_SUCCESS(ntStatus))
            {
                ntStatus = OpenNewHandle(irpStack->FileObject);
            }
            
            break;
        }
        
        case IRP_MJ_CLEANUP:
            
        {
            TRACE0("FilterDriver: IRP_MJ_CLEANUP\n");
            
            //
            // Closing the file handle to the driver doesnt shut the driver down
            //
            
            ntStatus = STATUS_SUCCESS;
            
            break;
        }
              
        case IRP_MJ_CLOSE:

        {
            //
            // All done with this file object and this FCB. Run
            // down the interfaces getting rid of them
            //

            ntStatus = LockFcb(irpStack->FileObject);
            if(NT_SUCCESS(ntStatus))
            {
                PPFFCB Fcb = irpStack->FileObject->FsContext2;

                FcbLockDown(Fcb);
                UnLockFcb(irpStack->FileObject);
            }
            break;
        }

        case IRP_MJ_DEVICE_CONTROL:
        {
            TRACE0("FilterDriver: IRP_MJ_DEVICE_CONTROL\n");
            
            ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
            
            switch (ioControlCode) 
            {

#if FWPF
                case IOCTL_CLEAR_INTERFACE_BINDING:
                {
                    PINTERFACEBINDING pBind;
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: IOCTL_CLEAR_INTERFACE_BINDING called\n");

                    dwSize = sizeof(*pBind);

                    if(inputBufferLength < sizeof(*pBind))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    if(outputBufferLength < sizeof(*pBind))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    pBind = (PINTERFACEBINDING)pvIoBuffer;

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
          
                    pPage = FindInterfaceOnHandle(irpStack->FileObject,
                                                  pBind->pvDriverContext);

                    if(!pPage)
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    else
                    {                   
                        ntStatus = ClearInterfaceBinding(pPage, pBind);
                    }

                    UnLockFcb(irpStack->FileObject);

                    break;
                }

                case IOCTL_SET_INTERFACE_BINDING:
                {
                    PINTERFACEBINDING pBind;
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: IOCTL_SET_INTERFACE_BINDING called\n");

                    dwSize = sizeof(*pBind);

                    if(inputBufferLength < sizeof(*pBind))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    if(outputBufferLength < sizeof(*pBind))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    pBind = (PINTERFACEBINDING)pvIoBuffer;

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(irpStack->FileObject,
                                                  pBind->pvDriverContext);

                    if(!pPage)
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    else
                    {                   
                        ntStatus = SetInterfaceBinding(pBind, pPage);
                    }
                    UnLockFcb(irpStack->FileObject);
                    break;
                }

                case IOCTL_PF_GET_INTERFACE_PARAMETERS:
                {
                    PPFGETINTERFACEPARAMETERS pp;
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: GET_INTERFACE_PARAMETERS called\n");

                    dwSize = sizeof(*pp);


                    if(inputBufferLength < (sizeof(*pp) - sizeof(FILTER_STATS_EX)))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    if(outputBufferLength < (sizeof(*pp) - sizeof(FILTER_STATS_EX)))
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    pp = (PPFGETINTERFACEPARAMETERS)pvIoBuffer;
                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }

                    if(pp->dwFlags & GET_BY_INDEX)
                    {
                        pPage = 0;
                    }
                    else
                    {
                        pPage = FindInterfaceOnHandle(irpStack->FileObject,
                                                      pp->pvDriverContext);
                        if(!pPage)
                        {
                            ntStatus = STATUS_INVALID_PARAMETER;
                            UnLockFcb(irpStack->FileObject);
                            break;
                        }
                    }

                    dwSize = outputBufferLength;
                    ntStatus = GetInterfaceParameters(pPage,
                                                      pp,
                                                      &dwSize);
                    UnLockFcb(irpStack->FileObject);
                    break;
                }

                case IOCTL_PF_CREATE_AND_SET_INTERFACE_PARAMETERS:
                {
                    //
                    // create a new style interface.
                    //


                    PPFINTERFACEPARAMETERS pInfo;

                    TRACE0("FilterDriver: IOCTL_CREATE_AND_SET called\n");

                    dwSize = sizeof(PFINTERFACEPARAMETERS);

                    //
                    // Both input and output Buffer lengths should be the same a nd
                    //

                    if(inputBufferLength != dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    if(outputBufferLength != dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    pInfo = (PPFINTERFACEPARAMETERS)pvIoBuffer;

                    //
                    // now establish the interface
                    //

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    ntStatus = AddNewInterface(pInfo,
                                               irpStack->FileObject->FsContext2);
                    UnLockFcb(irpStack->FileObject);
                    break;
                }
                
                case IOCTL_PF_CREATE_LOG:

                {
                    PPFPAGEDLOG pPage;
                    PPFLOG ppfLog;

                    TRACE0("FilterDriver: IOCTL_PF_CREATE_LOG\n");

                    //
                    // Check the size
                    //
                    
                    dwSize = sizeof(PFLOG);
                    
                    if((inputBufferLength < dwSize)
                               ||
                       (outputBufferLength < dwSize))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    ppfLog = (PPFLOG)pvIoBuffer;

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    ntStatus = PfLogCreateLog(
                                 ppfLog,
                                 irpStack->FileObject->FsContext2,
                                 Irp);
                    UnLockFcb(irpStack->FileObject);

                    break;
                }

                case IOCTL_PF_DELETE_LOG:
                {
                    TRACE0("FilterDriver: IOCTL_PF_DELETE_LOG\n");

                    //
                    // Check the size
                    //
                    
                    dwSize = sizeof(PFDELETELOG);
                    
                    if(inputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    ntStatus = PfDeleteLog(
                                 (PPFDELETELOG)pvIoBuffer,
                                 irpStack->FileObject->FsContext2);
                    UnLockFcb(irpStack->FileObject);

                    break;
                }

                case IOCTL_SET_LOG_BUFFER:
                {
                    TRACE0("FilterDriver: IOCTL_SET_LOG_BUFFER\n");

                    //
                    // Check the size
                    //
                    
                    dwSize = sizeof(PFSETBUFFER);
                    
                    if((inputBufferLength < dwSize)
                               ||
                       (outputBufferLength < dwSize))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    ntStatus = PfLogSetBuffer(
                                 (PPFSETBUFFER)pvIoBuffer,
                                 irpStack->FileObject->FsContext2,
                                 Irp);
                                 
                    UnLockFcb(irpStack->FileObject);

                    break;
                }

                case IOCTL_PF_DELETE_BY_HANDLE:
                {
                    PPAGED_FILTER_INTERFACE pPage;

                    if(inputBufferLength < sizeof(PFDELETEBYHANDLE))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(
                            irpStack->FileObject,
                            ((PPFDELETEBYHANDLE)pvIoBuffer)->pvDriverContext);

                    if(!pPage)
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    else
                    {
                        ntStatus = DeleteByHandle(
                                     (PPFFCB)irpStack->FileObject->FsContext2,
                                     pPage,
                                     &((PPFDELETEBYHANDLE)pvIoBuffer)->pvHandles[0],
                                     inputBufferLength - sizeof(PVOID));
                    }

                    UnLockFcb(irpStack->FileObject);
                    break;
                }
                    
                case IOCTL_DELETE_INTERFACE_FILTERS_EX:
                {
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: IOCTL_UNSET_INTERFACE_FILTERSEX\n");

                    //
                    // The minimum size is without any TOCs
                    //
                    
                    dwSize = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY);
                    
                    if(inputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(
                     irpStack->FileObject,
                     ((PFILTER_DRIVER_SET_FILTERS)pvIoBuffer)->pvDriverContext);

                    if(!pPage)
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    else                    
                    {
                        ntStatus = UnSetFiltersEx(
                                     (PPFFCB)irpStack->FileObject->FsContext2,
                                     pPage,
                                     inputBufferLength,
                                     (PFILTER_DRIVER_SET_FILTERS)pvIoBuffer);
                    }
                    UnLockFcb(irpStack->FileObject);
                    
                    break;
                }

                case IOCTL_SET_INTERFACE_FILTERS_EX:
                {
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: IOCTL_SET_INTERFACE_FILTERSEX\n");

                    //
                    // The minimum size is without any TOCs
                    //
                    
                    dwSize = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY);
                    
                    if(inputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(
                     irpStack->FileObject,
                     ((PFILTER_DRIVER_SET_FILTERS)pvIoBuffer)->pvDriverContext);

                    if(!pPage)
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    else                    
                    {
                        ntStatus = SetFiltersEx(
                                     (PPFFCB)irpStack->FileObject->FsContext2,
                                     pPage,
                                     inputBufferLength,
                                     (PFILTER_DRIVER_SET_FILTERS)pvIoBuffer);
                    }
                    UnLockFcb(irpStack->FileObject);
                    
                    break;
                }

                case IOCTL_DELETE_INTERFACEEX:
                {
                    PFILTER_DRIVER_DELETE_INTERFACE pDel;
                    PPAGED_FILTER_INTERFACE pPage;
                    
                    TRACE0("FilterDriver: IOCTL_DELETE_INTERFACE\n");
                    
                    pDel = (PFILTER_DRIVER_DELETE_INTERFACE)pvIoBuffer;

                    dwSize = sizeof(FILTER_DRIVER_DELETE_INTERFACE);
                    
                    if(inputBufferLength != dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }


                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(irpStack->FileObject,
                                                  pDel->pvDriverContext);
                    if(pPage)
                    {
                        RemoveEntryList(&pPage->leIfLink);
                        ntStatus = DeletePagedInterface(
                                      (PPFFCB)irpStack->FileObject->FsContext2,
                                      pPage);
                    }
                    else
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    
                    UnLockFcb(irpStack->FileObject);
                    break;
                }
                
                case IOCTL_SET_LATE_BOUND_FILTERSEX:
                {
                    PFILTER_DRIVER_BINDING_INFO pBindInfo;
                    PPAGED_FILTER_INTERFACE pPage;

                    TRACE0("FilterDriver: IOCTL_SET_LATE_BOUND_FILTERS\n");

                    pBindInfo = (PFILTER_DRIVER_BINDING_INFO)pvIoBuffer;

                    dwSize = sizeof(FILTER_DRIVER_BINDING_INFO);

                    if(inputBufferLength isnot dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    ntStatus = LockFcb(irpStack->FileObject);
                    if(!NT_SUCCESS(ntStatus))
                    {
                        break;
                    }
                    pPage = FindInterfaceOnHandle(irpStack->FileObject,
                                                  pBindInfo->pvDriverContext);

                    if(pPage)
                    {
                        ntStatus = UpdateBindingInformationEx(pBindInfo,
                                                              pPage);
                    }
                    else
                    {
                        ntStatus = STATUS_INVALID_PARAMETER;
                    }
                    UnLockFcb(irpStack->FileObject);

                    break;
                }
                    
#endif                // FWPF

#if STEELHEAD
                case IOCTL_CREATE_INTERFACE:
                {
                    //
                    // the old style of creating an interface.
                    // just pass it through to the underlying code
                    //
                    PFILTER_DRIVER_CREATE_INTERFACE pInfo;
                    
                    TRACE0("FilterDriver: IOCTL_CREATE_INTERFACE\n");

                    dwSize = sizeof(FILTER_DRIVER_CREATE_INTERFACE);

                    
                    //
                    // Both input and output Buffer lengths should be the same and
                    //
                    
                    if(inputBufferLength != dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }
                    
                    if(outputBufferLength != dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }
                    
                    pInfo = (PFILTER_DRIVER_CREATE_INTERFACE)pvIoBuffer;
                    
                    ntStatus = AddInterface(
                                            pInfo->pvRtrMgrContext,
                                            pInfo->dwIfIndex,
                                            pInfo->dwAdapterId,
                                            irpStack->FileObject->FsContext2,
                                            &pInfo->pvDriverContext);
                    
                    if(NT_SUCCESS(ntStatus))
                    {
                        dwSize = sizeof(FILTER_DRIVER_CREATE_INTERFACE);
                    }

                    break;
                }
            
                case IOCTL_SET_INTERFACE_FILTERS:
                {
                    TRACE0("FilterDriver: IOCTL_SET_INTERFACE_FILTERS\n");

                    //
                    // The minimum size is without any TOCs
                    //
                    
                    dwSize = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY);
                    
                    if(inputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    ntStatus = SetFilters((PFILTER_DRIVER_SET_FILTERS)pvIoBuffer);
                    
                    break;
                }

                case IOCTL_SET_LATE_BOUND_FILTERS:
                {
                    PFILTER_DRIVER_BINDING_INFO pBindInfo;

                    TRACE0("FilterDriver: IOCTL_SET_LATE_BOUND_FILTERS\n");

                    pBindInfo = (PFILTER_DRIVER_BINDING_INFO)pvIoBuffer;

                    dwSize = sizeof(FILTER_DRIVER_BINDING_INFO);

                    if(inputBufferLength isnot dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    ntStatus = UpdateBindingInformation(pBindInfo,
                                                        pBindInfo->pvDriverContext);

                    break;
                }
                    
                case IOCTL_DELETE_INTERFACE:
                {
                    PFILTER_DRIVER_DELETE_INTERFACE pDel;
                    
                    TRACE0("FilterDriver: IOCTL_DELETE_INTERFACE\n");
                    
                    pDel = (PFILTER_DRIVER_DELETE_INTERFACE)pvIoBuffer;

                    dwSize = sizeof(FILTER_DRIVER_DELETE_INTERFACE);
                    
                    if(inputBufferLength isnot dwSize)
                    {
                        ntStatus = STATUS_INVALID_BUFFER_SIZE;
                        break;
                    }

                    ntStatus = DeleteInterface(pDel->pvDriverContext);
                    
                    break;
                }

#endif                 // STEELHEAD

                
                case IOCTL_TEST_PACKET:
                {
                    PFILTER_DRIVER_TEST_PACKET pPacketInfo;
                    FORWARD_ACTION  eaResult;
                    UNALIGNED IPHeader *pHeader;
                    DWORD    dwSizeOfHeader;
                    PBYTE    pbRest;
                    DWORD    dwSizeOfData;
                    
                    TRACE0("FilterDriver: IOCTL_TEST_PACKET\n");
                    
                    pPacketInfo = (PFILTER_DRIVER_TEST_PACKET)pvIoBuffer;
                    
                    dwSize = sizeof(FILTER_DRIVER_TEST_PACKET);
                    
                    if(inputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    if(outputBufferLength < dwSize)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    pHeader = (IPHeader*)(pPacketInfo->bIpPacket);
                    
                    dwSizeOfHeader = ((pHeader->iph_verlen)&0x0f)<<2;
                    
                    pbRest = (PBYTE)pHeader + dwSizeOfHeader;

                    //
                    // make sure the header fits
                    //
                    dwSizeOfData = inputBufferLength - sizeof(FILTER_DRIVER_TEST_PACKET) - 1;

                    if(dwSizeOfData < dwSizeOfHeader)
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    //
                    // it does. Make sure the data fits
                    //

                    dwSizeOfData -= dwSizeOfHeader;

                    if(dwSizeOfData < (UINT)pHeader->iph_length)                   
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }

                    eaResult = MatchFilter(pHeader,
                                           pbRest,
                                           (UINT)pHeader->iph_length,
                                           pPacketInfo->pvInInterfaceContext,
                                           pPacketInfo->pvOutInterfaceContext);

                    ntStatus = STATUS_SUCCESS;
                    
                    pPacketInfo->eaResult = eaResult;
                    
                    //
                    // We dont need to copy the full packet out
                    //
                    
                    dwSize = sizeof(FILTER_DRIVER_TEST_PACKET);
            
                    break;
                }
                
#if STEELHEAD
                case IOCTL_GET_FILTER_INFO:
                {
                    PFILTER_DRIVER_GET_FILTERS  pInfo;
                    PFILTER_INTERFACE           pIf;
                    KIRQL                       kIrql;

                    TRACE0("FilterDriver: IOCTL_GET_FILTER_INFO\n");
                    
                    
                    pInfo = (PFILTER_DRIVER_GET_FILTERS)pvIoBuffer;
                       
                    pIf = (PFILTER_INTERFACE)(pInfo->pvDriverContext);
                    
                    //
                    // If we cant even report the number of filters, lets get out
                    //
                    
                    if(inputBufferLength < (sizeof(FILTER_DRIVER_GET_FILTERS) - sizeof(FILTER_STATS)))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    if(outputBufferLength < (sizeof(FILTER_DRIVER_GET_FILTERS) - sizeof(FILTER_STATS)))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    //
                    // Ok we have enough space to plug in the number of filters
                    //
                    
                    AcquireReadLock(&g_filters.ifListLock,&kIrql);
                    
                    pInfo->interfaces.eaInAction  = pIf->eaInAction;
                    pInfo->interfaces.eaOutAction = pIf->eaOutAction;

                    pInfo->interfaces.dwNumInFilters  = pIf->dwNumInFilters;
                    pInfo->interfaces.dwNumOutFilters = pIf->dwNumOutFilters;
                    
                    dwSize = SIZEOF_FILTERS(pIf);

                    if(inputBufferLength < dwSize)
                    {
                        dwSize = sizeof(FILTER_DRIVER_GET_FILTERS) - sizeof(FILTER_STATS);

                        ntStatus = STATUS_SUCCESS;

                        ReleaseReadLock(&g_filters.ifListLock,kIrql);
                        
                        break;
                    }
                    
                    if(outputBufferLength < dwSize)
                    {
                        dwSize = sizeof(FILTER_DRIVER_GET_FILTERS) - sizeof(FILTER_STATS);
                        
                        ntStatus = STATUS_SUCCESS;

                        ReleaseReadLock(&g_filters.ifListLock,kIrql);
                        
                        break;
                    }
                    
                    ntStatus = GetFilters(pIf,
                                          FALSE,
                                          &(pInfo->interfaces));
                    
                    pInfo->dwDefaultHitsIn  = g_dwNumHitsDefaultIn;
                    pInfo->dwDefaultHitsOut = g_dwNumHitsDefaultOut;
                    
                    ReleaseReadLock(&g_filters.ifListLock,kIrql);
                    
                    break;
                }
#endif
                
                case IOCTL_GET_FILTER_TIMES:
                {
                    PFILTER_DRIVER_GET_TIMES    pInfo;
                    PFILTER_INTERFACE           pIf;
                    KIRQL                       kIrql;
                    
                    TRACE0("FilterDriver: IOCTL_GET_FILTER_TIMES\n");
                    
                    dwSize = sizeof(FILTER_DRIVER_GET_TIMES);
                    
                    if(outputBufferLength < sizeof(FILTER_DRIVER_GET_TIMES))
                    {
                        ntStatus = STATUS_BUFFER_TOO_SMALL;
                        break;
                    }
                    
                    pInfo = (PFILTER_DRIVER_GET_TIMES)pvIoBuffer;
                    
#ifdef DRIVER_PERF                  
                    pInfo->dwFragments  = g_dwFragments;
                    pInfo->dwCache1     = g_dwCache1;
                    pInfo->dwCache2     = g_dwCache2;
                    pInfo->dwNumPackets = g_dwNumPackets;
                    pInfo->dwWalk1      = g_dwWalk1;
                    pInfo->dwWalk2      = g_dwWalk2;
                    pInfo->dwForw       = g_dwForw;
                    pInfo->dwWalkCache  = g_dwWalkCache;
                    
                    pInfo->liTotalTime.HighPart = g_liTotalTime.HighPart;
                    pInfo->liTotalTime.LowPart  = g_liTotalTime.LowPart;
#else
                    pInfo->dwFragments  = 0;
                    pInfo->dwCache1     = 0;
                    pInfo->dwCache2     = 0;
                    pInfo->dwNumPackets = 0;
                    pInfo->dwWalk1      = 0;
                    pInfo->dwWalk2      = 0;
                    pInfo->dwForw       = 0;
                    pInfo->dwWalkCache  = 0;
                    
                    pInfo->liTotalTime.HighPart = 0;
                    pInfo->liTotalTime.LowPart  = 0;
#endif
                    ntStatus = STATUS_SUCCESS;
                    
                    break;
                }
                
                default:
                {
                    DbgPrint ("Filter Driver: unknown IOCTL\n");

                    ntStatus = STATUS_INVALID_PARAMETER;
                    
                    break;
                }
            }
            
            break ;
        }

        default:
        {
            DbgPrint ("Filter Driver: unknown IRP_MJ_XXX\n");
            ntStatus = STATUS_INVALID_PARAMETER;
            break;
        }
    }

    if(ntStatus != STATUS_PENDING)
    {
        Irp->IoStatus.Status = ntStatus;
    
        Irp->IoStatus.Information = dwSize;
      
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
    }
    
    return(ntStatus);
}

VOID
FilterDriverUnload(
                   IN PDRIVER_OBJECT DriverObject
                   )
/*++
  Routine Description
        Called when the driver is unloaded. This shuts down the filtering (if it hasnt been shut
        down already) and removes the DOS name
  
  Arguments
        DriverObject
          
  Return Value
        None
--*/
{
    TRACE0("Filter Driver: unloading\n");
    
    CloseFilterDriver();
    
    TearDownExternalNaming();
    
    IoDeleteDevice(DriverObject->DeviceObject);
}



VOID
SetupExternalNaming (
                     IN PUNICODE_STRING ntname
                     )
/*++
  Routine Description
        Inserts the input name as the DOS name       
        
  Arguments
        ntname - Name of driver
          
  Return Value
        None
--*/
{
    UNICODE_STRING  ObjectDirectory;
    UNICODE_STRING  SymbolicLinkName;
    UNICODE_STRING  fullLinkName;
    BYTE      	    buffer[100] ;

    //
    // Form the full symbolic link name we wish to create.
    //

    RtlInitUnicodeString (&fullLinkName, NULL);
    
    RtlInitUnicodeString (&ObjectDirectory, DEFAULT_DIRECTORY);
   
    RtlInitUnicodeString(&SymbolicLinkName, DEFAULT_FLTRDRVR_NAME);
    
    fullLinkName.MaximumLength = (sizeof(L"\\")*2) + ObjectDirectory.Length 
      + SymbolicLinkName.Length + sizeof(WCHAR);
    
    fullLinkName.Buffer = (WCHAR *)buffer ;
    
    RtlZeroMemory (fullLinkName.Buffer, fullLinkName.MaximumLength);
    
    RtlAppendUnicodeToString (&fullLinkName, L"\\");
    
    RtlAppendUnicodeStringToString (&fullLinkName, &ObjectDirectory);
    
    RtlAppendUnicodeToString (&fullLinkName, L"\\");
    
    RtlAppendUnicodeStringToString (&fullLinkName, &SymbolicLinkName);
    
    if (!NT_SUCCESS(IoCreateSymbolicLink (&fullLinkName, ntname)))
    {
        DbgPrint ("Filter Driver: ERROR win32 device name could not be created \n") ;
    }
   
}


VOID
TearDownExternalNaming()
/*++
  Routine Description
      Removes the DOS name from the registry
      Called when the driver is unloaded
      
  Arguments
      None
          
  Return Value
      None

--*/
{
    UNICODE_STRING  ObjectDirectory;
    UNICODE_STRING  SymbolicLinkName;
    UNICODE_STRING  fullLinkName;
    BYTE      	    buffer[100] ;
    
    RtlInitUnicodeString (&fullLinkName, NULL);
    
    RtlInitUnicodeString (&ObjectDirectory, DEFAULT_DIRECTORY);
    
    RtlInitUnicodeString(&SymbolicLinkName, DEFAULT_FLTRDRVR_NAME);
   
    fullLinkName.MaximumLength = (sizeof(L"\\")*2) + ObjectDirectory.Length 
      + SymbolicLinkName.Length + sizeof(WCHAR);
    
    fullLinkName.Buffer = (WCHAR *)buffer ;
    
    RtlZeroMemory (fullLinkName.Buffer, fullLinkName.MaximumLength);
    
    RtlAppendUnicodeToString (&fullLinkName, L"\\");
    
    RtlAppendUnicodeStringToString (&fullLinkName, &ObjectDirectory);
    
    RtlAppendUnicodeToString (&fullLinkName, L"\\");
    
    RtlAppendUnicodeStringToString (&fullLinkName, &SymbolicLinkName);
    
    if (!NT_SUCCESS(IoDeleteSymbolicLink (&fullLinkName)))
    {
        DbgPrint ("Filter Driver: ERROR win32 device name could not be deleted\n") ;
    }
}

BOOL
InitFilterDriver()
/*++
  Routine Description
       Starts the driver. Allocates memory for the cache and cache entries. Clears the entries
       Sends an IOCTL to the Forwarder to set up its entry point (which starts the filtering
       process in the forwarder)
          
  Arguments
       None
          
  Return Value
       TRUE if successful
       
--*/
{
    NTSTATUS status;
    BOOL bRet;
    SYSTEM_BASIC_INFORMATION PerfInfo;

    status = ZwQuerySystemInformation(
                SystemBasicInformation,
                &PerfInfo,
                sizeof(PerfInfo),
                NULL
                );

    //
    // adjust cache and hash sizes based on the memory
    //

    if(PerfInfo.NumberOfPhysicalPages <= 8000)
    {
        //
        // 32 MB or smaller. A very chincy server
        //

        g_dwCacheSize = 257;
        g_dwHashLists = 127;
    }
    else if(PerfInfo.NumberOfPhysicalPages < 16000)
    {
        //
        // 32-64 MB. Better.
        //

        g_dwCacheSize = 311;
        g_dwHashLists = 311;
    }
    else if(PerfInfo.NumberOfPhysicalPages < 32000)
    {
        //
        // 64 - 128 MB.
        //

        g_dwCacheSize = 511;
        g_dwHashLists = 511;
    }
    else
    {
        //
        //  big machine
        //

        g_dwCacheSize = 511;
        g_dwHashLists = 1023;
    }
    
    
    InitLogs();

    __try
    {
        
        bRet = TRUE;

        if(!AllocateCacheStructures())
        {
            DbgPrint("Couldnt allocate cache structures\n");

            bRet = FALSE;

            __leave;
        }
        
        //
        // Clean the cache
        //
        
        ClearCache();
        
        //
        // Now send and Irp to IP Forwarder and give him our entry point
        // Do it twice, once to make sure it is cleared and to
        // erase any previous filter contexts and once to do what
        // we want it to do.
        //
        
        status = SetForwarderEntryPoint(NULL);
        status = SetForwarderEntryPoint(MatchFilter);
        
        if(status isnot STATUS_SUCCESS)
        {
            DbgPrint("IOCTL to IP Forwarder failed - status \n",status);

            bRet = FALSE;

            __leave;
        }
        
    }
    __finally
    {
        if(!bRet)
        {
            FreeExistingCache();
        }
        else
        {
            ExInitializeNPagedLookasideList(
                       &filter_slist,
                       ExAllocatePoolWithTag,
                       ExFreePool,
                       0,
                       sizeof(FILTER),
                       (ULONG)'2liF',
                       100);
            ExInitializePagedLookasideList(
                       &paged_slist,
                       ExAllocatePoolWithTag,
                       ExFreePool,
                       0,
                       sizeof(PAGED_FILTER),
                       (ULONG)'2liF',
                       100);
        }
        return bRet;
    }
}

BOOL
CloseFilterDriver()
/*++
  Routine Description
       Shuts down the driver. 
          
  Arguments
         
          
  Return Value
--*/
{
    
    NTSTATUS    status;
    KIRQL       kIrql;
    PLIST_ENTRY pleHead;
    BOOL        bStopForw = TRUE;
    PFREEFILTER pFree, pFree1;
    PPFFCB Fcb;
    KIRQL kirql;

    //
    // The first thing to do is send an IOCTL to forwarder to tell him to stop sending
    // us anymore packets. 
    //
    
    status = SetForwarderEntryPoint(NULL);
       
    if(!NT_SUCCESS(status))
    {
        //
        // This means we could not tell IP Forwarder 
        // to stop filtering packets so we cant go away.
        //
        
        DbgPrint("Couldnt IOCTL IP Forwarder to stop filtering - cant unload\n");
        
        bStopForw = FALSE;
        
    }

    //
    // remove the FCBS
    //

    while(TRUE)
    {
        NTSTATUS ntStatus;
        FILE_OBJECT fo;
        KIRQL kirql;
        BOOL fDone = TRUE;

        KeAcquireSpinLock(&g_FcbSpin, &kirql);
        for(pleHead = g_leFcbs.Flink;
            pleHead != &g_leFcbs;
            pleHead = pleHead->Flink)
        {
            Fcb = CONTAINING_RECORD(pleHead, PFFCB, leList);
            //
            // This can happen if some other thread is closing the FCB.
            //
            if(Fcb->dwFlags & PF_FCB_CLOSED)
            {
                continue;
            }
            KeReleaseSpinLock(&g_FcbSpin, kirql);
            fDone = FALSE;
            fo.FsContext2 = (PVOID)Fcb;
            ntStatus = LockFcb(&fo);
            if(!NT_SUCCESS(ntStatus))
            {
                break;
            }
            FcbLockDown(Fcb);
            UnLockFcb(&fo);
            break;
        }
        if(fDone)
        {
            KeReleaseSpinLock(&g_FcbSpin, kirql);
            break;
        }
    }

    ExDeleteResource ( &FilterListResourceLock );
    ExDeleteResource ( &FilterAddressLock );

    AcquireWriteLock(&(g_filters.ifListLock),&kIrql);
    
    while(!IsListEmpty(&g_filters.leIfListHead))
    {
        PFILTER_INTERFACE pIf;
        
        pleHead = g_filters.leIfListHead.Flink;
        
        pIf = CONTAINING_RECORD(pleHead,FILTER_INTERFACE,leIfLink);
        
        DeleteFilters(pIf,
                      IN_FILTER_SET);
 
        DeleteFilters(pIf,
                      OUT_FILTER_SET);

        //
        // Set the number of filters to 0 and the default action to forward so 
        // that if we havent been able to stop the forwarder from calling us, 
        // atleast no packets get filtered
        // 
        
        pIf->dwNumInFilters = 0;
        pIf->dwNumOutFilters = 0;
        pIf->eaInAction = FORWARD;
        pIf->eaOutAction = FORWARD;
 
        if(bStopForw)
        {
            //
            // We could stop the forwarder so lets blow away the interface
            //
            
            RemoveHeadList(&g_filters.leIfListHead);
            
            ExFreePool(pIf);
        }
    }   
    
    ClearCache();
    
    if(bStopForw)
    {
        //
        // If we could stop the forwarder, blow away the cache
        //
        
        FreeExistingCache();
    }

    ReleaseWriteLock(&g_filters.ifListLock,kIrql);
    
    if(g_bDriverRunning)
    {
        ExDeleteNPagedLookasideList( &filter_slist );
        ExDeletePagedLookasideList( &paged_slist );
    }

    if(AddrTable)
    {
        ExFreePool(AddrTable);
        AddrTable = 0;
    }

    if(AddrHashTable)
    {
        ExFreePool(AddrHashTable);
        AddrHashTable = 0;
    }


    if(AddrSubnetHashTable)
    {
        ExFreePool(AddrSubnetHashTable);
        AddrSubnetHashTable = 0;
    }
   
    if(bStopForw)
    {
        return STATUS_SUCCESS;
    }
    else
    {
        return STATUS_UNSUCCESSFUL;
    }
}

NTSTATUS
SetForwarderEntryPoint(
                       IN   IPPacketFilterPtr pfnMatch
                       )
/*++
  Routine Description
       Sets the entry point to IP Forwarder. Used to start and stop the forwarding code in
       the forwarder
          
  Arguments
       pfnMatch  Pointer to the function that implements the filter matching code
                 NULL will stop forwarding, while any other value will cause the forwarder to
                 invoke the function pointed to. Thus if on stopping, the IOCTL to the
                 forwarder doesnt succeed, and the filter driver goes away, the system will
                 blue screen
                 
  Return Value
      NTSTATUS 
--*/
{
    NTSTATUS                status;
    IP_SET_FILTER_HOOK_INFO functionInfo;

    functionInfo.FilterPtr = pfnMatch;
    status = DoIpIoctl(
                       DD_IP_DEVICE_NAME,
                       IOCTL_IP_SET_FILTER_POINTER,
                       (PVOID)&functionInfo,
                       sizeof(functionInfo),
                       NULL,
                       0,
                       NULL);
    return(status);
}
                       
NTSTATUS
DoIpIoctl(
          IN  PWCHAR        DriverName,
          IN  DWORD         Ioctl,
          IN  PVOID         pvInArg,
          IN  DWORD         dwInSize,
          IN  PVOID         pvOutArg,
          IN  DWORD         dwOutSize,
          OUT PDWORD        pdwInfo OPTIONAL)
/*++
Routine Description:
    Do an IOCTL to the stack. Used for a varity of purposes
--*/
{
    NTSTATUS                status;
    UNICODE_STRING          nameString;
    OBJECT_ATTRIBUTES       Atts;
    IO_STATUS_BLOCK         ioStatusBlock;
    HANDLE                  Handle;
    
    PAGED_CODE();

    RtlInitUnicodeString(&nameString, DriverName);
        
    InitializeObjectAttributes(&Atts,
                               &nameString,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
             
   status = ZwCreateFile(&Handle,
                         SYNCHRONIZE | FILE_READ_DATA | FILE_WRITE_DATA,
                         &Atts,
                         &ioStatusBlock,
                         NULL,
                         FILE_ATTRIBUTE_NORMAL,
                         FILE_SHARE_READ | FILE_SHARE_WRITE,
                         FILE_OPEN_IF,
                         0,
                         NULL,
                         0);

    if (!NT_SUCCESS(status))
    {
        DbgPrint("Couldnt open IP Forwarder - status %d\n",status);
        return STATUS_UNSUCCESSFUL;
    }
    
    //
    // Submit the request to the forwarder
    //
        
    status = ZwDeviceIoControlFile(
                      Handle,
                      NULL,
                      NULL,
                      NULL,
                      &ioStatusBlock,
                      Ioctl,
                      pvInArg,
                      dwInSize,
                      pvOutArg,
                      dwOutSize);
                      
    if(!NT_SUCCESS(status))
    {
        DbgPrint("IOCTL request failed - status %x\n",status);
    }
    else
    {
        if(pdwInfo)
        {
            *pdwInfo = ioStatusBlock.Information;
        }
    }

    //
    // Close the device.
    //
    
    ZwClose(Handle);
    
    return status;
}

BOOL 
AllocateCacheStructures()
/*++
  Routine Description
        Allocates the necessary memory for cache (which is an array of pointers to 
            cache entries)
        Allocates necessary number of cache entries (but doesnt initialize them)
        Allocates a small number of entries and puts them on the free list (doesnt 
            initialize these either)
          
  Arguments
        None
          
  Return Value
        True if the function completely succeeds, else FALSE.  If FALSE, it is upto 
            the CALLER to do a rollback and clear any allocated memory
--*/
{
    DWORD i;
    
    TRACE0("Allocating cache\n");
    
    g_filters.ppInCache = ExAllocatePoolWithTag(NonPagedPool,
                                               g_dwCacheSize * sizeof(PFILTER_INCACHE),
                                               'hCnI');
    
    if(g_filters.ppInCache is NULL)
    {
        DbgPrint("Couldnt allocate memory for Input Cache\n");
        return FALSE;
    }
    
    g_filters.ppOutCache = ExAllocatePoolWithTag(NonPagedPool,
                                                g_dwCacheSize * sizeof(PFILTER_OUTCACHE),
                                                'CtuO');
    
    if(g_filters.ppOutCache is NULL)
    {
        DbgPrint("Couldnt allocate memory for Output Cache\n");
        return FALSE;
    }
        
    for(i = 0; i < g_dwCacheSize; i++)
    {
        g_filters.ppInCache[i] = NULL;
        g_filters.ppOutCache[i] = NULL;
    }
    
    for(i = 0; i < g_dwCacheSize; i++)
    {
        PFILTER_INCACHE  pTemp1;
        PFILTER_OUTCACHE pTemp2;
        
        pTemp1 = ExAllocatePoolWithTag(NonPagedPool,
                                       sizeof(FILTER_INCACHE),
                                       'NI');
        if(pTemp1 is NULL)
        {
            return FALSE;
        }
        
        g_filters.ppInCache[i] = pTemp1;
            
        pTemp2 = ExAllocatePoolWithTag(NonPagedPool,
                                       sizeof(FILTER_OUTCACHE),
                                       'TUO');
        if(pTemp2 is NULL)
        {
            return FALSE;
        }
        
        g_filters.ppOutCache[i] = pTemp2;
    }            
    
    TRACE0("Allocated cache structures\n");
    
    TRACE0("Creating in and out free list...");
    
    for(i = 0; i < FREE_LIST_SIZE; i++)
    {
        PFILTER_INCACHE  pTemp1;
        PFILTER_OUTCACHE pTemp2;
        
        pTemp1 = ExAllocatePoolWithTag(NonPagedPool,
                                       sizeof(FILTER_INCACHE),
                                       'FNI');
        if(pTemp1 is NULL)
        {
            return FALSE;
        }
        
        InitializeListHead(&pTemp1->leFreeLink);
        
        InsertHeadList(&g_freeInFilters,&pTemp1->leFreeLink);
        
        pTemp2 = ExAllocatePoolWithTag(NonPagedPool,
                                       sizeof(FILTER_OUTCACHE),
                                       'FTUO');
        if(pTemp2 is NULL)
        {
            return FALSE;
        }
        
        InitializeListHead(&pTemp2->leFreeLink);
        
        InsertHeadList(&g_freeOutFilters,&pTemp2->leFreeLink);
    }
    
    TRACE0("Done\n");
    return TRUE;
}
        
VOID
FreeExistingCache()
/*++
  Routine Description
       Frees all the cache entries, free entries and cache pointer array 
          
  Arguments
      None
          
  Return Value
      None
--*/
{
    DWORD i;
    
    TRACE0("Freeing existing in cache...");
    
    if(g_filters.ppInCache isnot NULL)
    {
        for(i = 0; i < g_dwCacheSize; i ++)
        {
            if(g_filters.ppInCache[i] isnot NULL)
            {
                ExFreePool(g_filters.ppInCache[i]);
            }
        }

        ExFreePool(g_filters.ppInCache);
        g_filters.ppInCache = NULL;
    }
    
    TRACE0("Done\n");

    TRACE0("Freeing existing out cache...");
 
    if(g_filters.ppOutCache isnot NULL)
    {
        for(i = 0; i < g_dwCacheSize; i ++)
        {
            if(g_filters.ppOutCache[i] isnot NULL)
            {
                ExFreePool(g_filters.ppOutCache[i]);
            }       
        }
        
        ExFreePool(g_filters.ppOutCache);
        g_filters.ppOutCache = NULL;
    }
   
    TRACE0("Done\n");
 
    TRACE0("Freeing existing in free list entries...");
    
    while(!IsListEmpty(&g_freeInFilters))
    {
        PFILTER_INCACHE pIn;
        PLIST_ENTRY     pleHead;
        
        pleHead = RemoveHeadList(&g_freeInFilters);
        
        pIn = CONTAINING_RECORD(pleHead,FILTER_INCACHE,leFreeLink);
        
        ExFreePool(pIn);
    }
   
    TRACE0("Done\n");
 
    TRACE0("Freeing existing out free list entries...");
    
    while(!IsListEmpty(&g_freeOutFilters))
    {
        PFILTER_OUTCACHE pOut;
        PLIST_ENTRY     pleHead;
        
        pleHead = RemoveHeadList(&g_freeOutFilters);
        
        pOut = CONTAINING_RECORD(pleHead,FILTER_OUTCACHE,leFreeLink);
                
        ExFreePool(pOut);
    }
    
    TRACE0("Done\n");
}


NTSTATUS
OpenNewHandle(PFILE_OBJECT FileObject)
/*++
Routine Description:
    Open a new handle to the driver. Allocate FCB from the paged pool
    and initialize it. If no memory available, fail. If success
    store the FCB pointer into the file object.
--*/
{
    PPFFCB Fcb;
    KIRQL kirql;

    //
    // Allocate an FCB for this handle.
    //

    Fcb = ExAllocatePoolWithTag(NonPagedPool,
                                sizeof(*Fcb),
                                'pfFC');
    if(Fcb)
    {
        FileObject->FsContext2 = (PVOID)Fcb;
        Fcb->dwFlags = 0;
        Fcb->UseCount = 1;
        InitializeListHead(&Fcb->leInterfaces);
        InitializeListHead(&Fcb->leLogs);
        ExInitializeResource ( &Fcb->Resource );
        ExAcquireSpinLock(&g_FcbSpin, &kirql);
        InsertTailList(&g_leFcbs, &Fcb->leList);
        ExReleaseSpinLock(&g_FcbSpin, kirql);
        return(STATUS_SUCCESS);
    }
    return(STATUS_NO_MEMORY);
}

PPAGED_FILTER_INTERFACE
FindInterfaceOnHandle(PFILE_OBJECT FileObject,
                      DWORD dwValue)
                     
/*++
   Routine Description:

   Find the paged interface for the call. If none found
   return a NULL. Uses the caller-supplied DriverContext to
   search the contexts on this handle. In general, there should
   not be many such handles.
--*/
{
    PPFFCB Fcb = FileObject->FsContext2;
    PPAGED_FILTER_INTERFACE pPage;

    PAGED_CODE();

    
    for(pPage = (PPAGED_FILTER_INTERFACE)Fcb->leInterfaces.Flink;
        (PLIST_ENTRY)pPage != &Fcb->leInterfaces;
        pPage = (PPAGED_FILTER_INTERFACE)pPage->leIfLink.Flink)
    {
        if(pPage->pvDriverContext == pvValue)
        {
            return(pPage);
        }
    }
    return(NULL);
}

NTSTATUS
CloseFcb(PPFFCB Fcb, PFILE_OBJECT FileObject)
/*++
   Routine Description:

      Called when an FCB has no more references. The caller must
      have removed the FCB from the master list. It is immaterial whether
      the CB resource is locked.
--*/
{
    PPAGED_FILTER_INTERFACE pPage;
    PFREEFILTER pList, pList1;
    NTSTATUS ntStatus;

    //
    // First clean up the logs
    //
    while(!IsListEmpty(&Fcb->leLogs))
    {
        PFDELETELOG DelLog;

        DelLog.pfLogId = (PFLOGGER)Fcb->leLogs.Flink;
        (VOID)PfDeleteLog(&DelLog, Fcb);
    }

    //
    // Next, clean up the interfaces
    //
    while(!IsListEmpty(&Fcb->leInterfaces))
    {
        pPage = (PPAGED_FILTER_INTERFACE)RemoveHeadList(&Fcb->leInterfaces);
        (VOID)DeletePagedInterface(Fcb, pPage);
    }

#if 0
    //
    // Can't do this because can't get the filter context from the stack.
    //

    if(Fcb->dwFlags & PF_FCB_OLD)
    {
        DeleteOldInterfaces(Fcb);
    }
#endif

    //
    // Free the Fcb
    //

    ExDeleteResource ( &Fcb->Resource );
    ExFreePool(Fcb);
    if(FileObject)
    {
        FileObject->FsContext2 = NULL;
    }
    return(STATUS_SUCCESS);   
}

DWORD
GetIpStackIndex(IPAddr Addr, BOOL fNew)
/*++
  Routine Description:
     Get the stack index for the corresponding address and mask
--*/
{
    DWORD                              dwResult;
    DWORD                              dwInBufLen;
    DWORD                              dwOutBufLen;
    TCP_REQUEST_QUERY_INFORMATION_EX   trqiInBuf;
    TDIObjectID                        *ID;
    BYTE                               *Context;
    NTSTATUS                           Status;
    IPSNMPInfo                         IPSnmpInfo;
    IPAddrEntry                        *AddrTable1;
    DWORD                              dwSpace, dwIpIndex;
    DWORD                              dwFinalAddrSize;
    DWORD                              dwFinalSize, dwX;
    PADDRESSARRAY                      pa;
    KIRQL                              kirql;


    ExAcquireResourceShared( &FilterAddressLock, TRUE);
    if(!AddrTable || fNew)
    {
        ExReleaseResource(&FilterAddressLock );
        ExAcquireResourceExclusive( &FilterAddressLock, TRUE);

        if(fNew && AddrTable)
        {
            //
            // acquire the spin lock to synchronize with Match
            // code running at DPC so we can "lock out"
            // the table while we do the rest of this. Note
            // we can't hold a spin lock while building the table
            // because the calls into the IP stack hit pageable
            // code
            //
            AcquireWriteLock(&g_IpTableSpin, &kirql);
            g_dwMakingNewTable = TRUE;
            ReleaseWriteLock(&g_IpTableSpin, kirql);
            ExFreePool( AddrTable );
            AddrTable = 0;
        }
    }

    if(!AddrTable)
    {
        dwInBufLen = sizeof(TCP_REQUEST_QUERY_INFORMATION_EX);

        dwOutBufLen = sizeof(IPSNMPInfo);

        ID = &(trqiInBuf.ID);
        ID->toi_entity.tei_entity = CL_NL_ENTITY;
        ID->toi_entity.tei_instance = 0;
        ID->toi_class = INFO_CLASS_PROTOCOL;
        ID->toi_type = INFO_TYPE_PROVIDER;
        ID->toi_id = IP_MIB_STATS_ID;

        Context = &(trqiInBuf.Context[0]);
        RtlZeroMemory(Context, CONTEXT_SIZE);

        Status = DoIpIoctl(
                       DD_TCP_DEVICE_NAME,
                       IOCTL_TCP_QUERY_INFORMATION_EX,
                       (PVOID)&trqiInBuf,
                       sizeof(TCP_REQUEST_QUERY_INFORMATION_EX),
                       (PVOID)&IPSnmpInfo,
                       dwOutBufLen,
                       NULL);  

       if(NT_SUCCESS(Status))
       {


            //
            // allocate some memory to fetch the address table.
            //

            dwSpace = IPSnmpInfo.ipsi_numaddr + 10;

            dwOutBufLen = dwSpace * sizeof(IPAddrEntry);

            if(!AddrHashTable)
            {
                //
                // the hash table size was not specified in the
                // registry. Compute it based on the number of
                // addresses. Try to keep the hash table less than
                // half full.
                //
                if(!AddrModulus)
                {
                    if(IPSnmpInfo.ipsi_numaddr < ADDRHASHLOWLEVEL)
                    {
                        AddrModulus = ADDRHASHLOW;
                    }
                    else if(IPSnmpInfo.ipsi_numaddr < ADDRHASHMEDLEVEL)
                    {
                        AddrModulus = ADDRHASHMED;
                    }
                    else
                    {
                        AddrModulus = ADDRHASHHIGH;
                    }
                }
                AddrHashTable = (PADDRESSARRAY *)ExAllocatePoolWithTag(
                                              NonPagedPool,
                                              AddrModulus *
                                               sizeof(PADDRESSARRAY),
                                              'pfAh');
                if(!AddrHashTable)
                {
                    DbgPrint("Could not allocate AddrHashTable");
                    g_dwMakingNewTable = FALSE;
                    ExReleaseResource(&FilterAddressLock );
                    return(UNKNOWN_IP_INDEX);
                }
            }

            if(!AddrSubnetHashTable)
            {
                AddrSubnetHashTable = (PADDRESSARRAY *)ExAllocatePoolWithTag(
                                              NonPagedPool,
                                              AddrModulus *
                                               sizeof(PADDRESSARRAY),
                                              'pfAh');
                if(!AddrSubnetHashTable)
                {
                    DbgPrint("Could not allocate AddrSubnetHashTable");
                    g_dwMakingNewTable = FALSE;
                    ExReleaseResource(&FilterAddressLock );
                    return(UNKNOWN_IP_INDEX);
                }
            }

            RtlZeroMemory(AddrHashTable, AddrModulus * sizeof(PADDRESSARRAY));
            RtlZeroMemory(AddrSubnetHashTable,
                          AddrModulus * sizeof(PADDRESSARRAY));

            AddrTable = (IPAddrEntry *)ExAllocatePoolWithTag(
                                              NonPagedPool,
                                              dwOutBufLen,
                                              'pfAt');

            if(!AddrTable)
            {
                DbgPrint("Could not allocate AddrTable of size %d\n",
                               dwSpace);
                g_dwMakingNewTable = FALSE;
                ExReleaseResource(&FilterAddressLock );
                return(UNKNOWN_IP_INDEX);
            }
        }

        ID->toi_type = INFO_TYPE_PROVIDER;
        ID->toi_id = IP_MIB_ADDRTABLE_ENTRY_ID;
        RtlZeroMemory( Context, CONTEXT_SIZE );

        Status = DoIpIoctl(
                              DD_TCP_DEVICE_NAME,
                              IOCTL_TCP_QUERY_INFORMATION_EX,
                              (PVOID)&trqiInBuf,
                              dwInBufLen,
                              (PVOID)AddrTable,
                              dwOutBufLen,
                              &dwFinalAddrSize); 

        if(!NT_SUCCESS(Status))
        {
            DbgPrint("Reading IP addr table failed %x\n", Status);
            ExFreePool(AddrTable);
            AddrTable = 0;
            g_dwMakingNewTable = FALSE;
            ExReleaseResource(&FilterAddressLock );
            return(UNKNOWN_IP_INDEX);
        }

        //
        // Now to get sleazy. Convert each IPAddrEntry into an ADDRESSARRAY
        // entry and hash it into the AddrHashTable. Note this depends
        // on the structures having common definitions and on
        // IPAddrEntry to be at least as large as ADDRESSARRAY. So be
        // careful.
        //

        dwFinalSize = dwFinalAddrSize / sizeof(IPAddrEntry);

        for(AddrTable1 = AddrTable;
            dwFinalSize;
            dwFinalSize--, AddrTable1++)
        {
            dwX = ADDRHASHX(AddrTable1->iae_addr);

            pa = (PADDRESSARRAY)AddrTable1;

            pa->ulSubnetBcastAddress = AddrTable1->iae_addr |
                                        ~AddrTable1->iae_mask;

            //
            // Now hash it into the hash table
            //

            pa->pNext = AddrHashTable[dwX];
            AddrHashTable[dwX] = pa;

            //
            // and do a hash on the subnet address as well
            //

            dwX = ADDRHASHX(pa->ulSubnetBcastAddress);
            pa->pNextSubnet = AddrSubnetHashTable[dwX];
            AddrSubnetHashTable[dwX] = pa;
        }

        //
        // allow the DPC match code to use the table. Note
        // this does not require interlocking since storing
        // memory is atomic.
        //
        g_dwMakingNewTable = FALSE;
    }

    //
    // search the table for the address.
    //

    dwIpIndex = LocalIpLook(Addr);

    ExReleaseResource(&FilterAddressLock );
    return(dwIpIndex);
}

BOOL
MatchLocalLook(DWORD Addr, DWORD dwIndex)
/*++
Routine Description:
  Called from the Match code, probably at DPC level, to
  check an address. If the address table is being rebuilt
  just return success. See inner comment for more on this
--*/
{
    BOOL fRet;
    KIRQL kirql;

    if(!BMAddress(Addr))
    {
        //
        // Look it up.  Note that if the table is being rebuilt,
        // this succeeds. This is a security hole but it is very
        // small and nearly impossible to exploit effectively and
        // the alternative, denying this, is even worse.
        //  ArnoldM 19-Sept-1997.
        //
        AcquireReadLock(&g_IpTableSpin, &kirql);
        if(AddrTable && !g_dwMakingNewTable)
        {
            DWORD dwLookupIndex = LocalIpLook(Addr);

            //
            // the address is acceptable if it belongs to
            // the arriving interface or if it belongs to
            // no interfaces. The latter is the route-through case.
            //
            if((dwIndex == dwLookupIndex)
                         ||
               (dwLookupIndex == UNKNOWN_IP_INDEX) )
            {
                fRet = TRUE;
            }
            else
            {
                fRet = FALSE;
            }
        }
        else
        {
            fRet = TRUE;
        }
        ReleaseReadLock(&g_IpTableSpin, kirql);
    }
    else
    {
        fRet = TRUE;
    }
    return(fRet);
}
        
DWORD
LocalIpLook(DWORD Addr)
/*++
Routine Description:
  Called to lookup an address in the address hash tables. The caller
  either must hold the g_IpTableSpin read sping lock or must hold
  the FilterAddressLock resource. This should never be called
  while the address table is being built and holding one of
  these locks insures this.
--*/
{
    DWORD dwIpIndex, dwX;
    PADDRESSARRAY  pa;

    dwX = ADDRHASHX(Addr);

    for(pa = AddrHashTable[dwX]; pa; pa = pa->pNext)
    {
        if(pa->ulAddress == Addr)
        {
            dwIpIndex = pa->ulIndex;
            goto alldone;   // ugly but faster than a break and another test.
        }
    }

    for(pa = AddrSubnetHashTable[dwX]; pa; pa = pa->pNextSubnet)
    {
        if(pa->ulSubnetBcastAddress == Addr)
        {
            dwIpIndex = pa->ulIndex;
            goto alldone;
        }
    }

    //
    // not found. Deliver the bad news.
    //
    dwIpIndex = UNKNOWN_IP_INDEX;

alldone:
    return(dwIpIndex);
}

BOOLEAN
PfFastIoDeviceControl (
    IN struct _FILE_OBJECT *FileObject,
    IN BOOLEAN Wait,
    IN PVOID InputBuffer OPTIONAL,
    IN ULONG InputBufferLength,
    OUT PVOID OutputBuffer OPTIONAL,
    IN ULONG OutputBufferLength,
    IN ULONG IoControlCode,
    OUT PIO_STATUS_BLOCK IoStatus,
    IN struct _DEVICE_OBJECT *DeviceObject
    )
{
    DWORD dwSize;
    PPAGED_FILTER_INTERFACE pPage;
    NTSTATUS ntStatus;

    switch(IoControlCode)
    {
        default:
            return(FALSE);

        case IOCTL_PF_IP_ADDRESS_LOOKUP:

            //
            // do a dummy fetch to make it recompute.
            //
            if((InputBufferLength < sizeof(DWORD))
                         ||
               (OutputBufferLength < sizeof(DWORD)) )
            {
                return(FALSE);
            }
 
            *(PDWORD)OutputBuffer = GetIpStackIndex(*(PDWORD)InputBuffer, TRUE);
            ntStatus = STATUS_SUCCESS;
            break;

        case IOCTL_PF_DELETE_BY_HANDLE:
            if(InputBufferLength < sizeof(PFDELETEBYHANDLE))
            {
                return(FALSE);
            }

            ntStatus = LockFcb(FileObject);
            if(!NT_SUCCESS(ntStatus))
            {
                return(FALSE);
            }
            pPage = FindInterfaceOnHandle(
                    FileObject,
                    ((PPFDELETEBYHANDLE)InputBuffer)->pvDriverContext);

            if(!pPage)
            {
                UnLockFcb(FileObject);
                return(FALSE);
            }
            ntStatus = DeleteByHandle(
                                 (PPFFCB)FileObject->FsContext2,
                                 pPage,
                                 &((PPFDELETEBYHANDLE)InputBuffer)->pvHandles[0],
                                 InputBufferLength - sizeof(PVOID));

            UnLockFcb(FileObject);
            break;

        case IOCTL_DELETE_INTERFACE_FILTERS_EX:
        {

            //
            // The minimum size is without any TOCs
            //

            dwSize = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY);

            if(InputBufferLength < dwSize)
            {
                return(FALSE);
            }

            ntStatus = LockFcb(FileObject);
            if(!NT_SUCCESS(ntStatus))
            {
                return(FALSE);
            }
            pPage = FindInterfaceOnHandle(
                    FileObject,
                    ((PFILTER_DRIVER_SET_FILTERS)InputBuffer)->pvDriverContext);

            if(!pPage)
            {
                UnLockFcb(FileObject);
                return(FALSE);
            }
            ntStatus = UnSetFiltersEx(
                                 (PPFFCB)FileObject->FsContext2,
                                 pPage,
                                 InputBufferLength,
                                 (PFILTER_DRIVER_SET_FILTERS)InputBuffer);
 
            UnLockFcb(FileObject);
            break;
        }

        case IOCTL_GET_SYN_COUNTS:
        {
            if(OutputBufferLength < sizeof(FILTER_DRIVER_GET_SYN_COUNT))
            {
                return(FALSE);
            }

            ntStatus = GetSynCountTotal(
                         (PFILTER_DRIVER_GET_SYN_COUNT)OutputBuffer);
            break;

        }

        case IOCTL_SET_INTERFACE_FILTERS_EX:
        {

            //
            // Make sure the caller is using symmetric buffers. If not
            // do it the slow way
            //
            if((InputBuffer != OutputBuffer)
                        ||
               (InputBufferLength != OutputBufferLength))
            {
                return(FALSE);
            }

            //
            // The minimum size is without any TOCs
            //

            dwSize = sizeof(FILTER_DRIVER_SET_FILTERS) - sizeof(RTR_TOC_ENTRY);

            if(InputBufferLength < dwSize)
            {
                return(FALSE);
            }

            ntStatus = LockFcb(FileObject);
            if(!NT_SUCCESS(ntStatus))
            {
                return(FALSE);
            }
            pPage = FindInterfaceOnHandle(
                    FileObject,
                    ((PFILTER_DRIVER_SET_FILTERS)InputBuffer)->pvDriverContext);

            if(!pPage)
            {
                UnLockFcb(FileObject);
                return(FALSE);
            }
            ntStatus = SetFiltersEx(
                                    (PPFFCB)FileObject->FsContext2,
                                    pPage,
                                    InputBufferLength,
                                    (PFILTER_DRIVER_SET_FILTERS)InputBuffer);
            UnLockFcb(FileObject);
            break;
        }
    }
    IoStatus->Status = ntStatus;
    IoStatus->Information = OutputBufferLength;
    return(TRUE);
}

NTSTATUS
LockFcb(
    IN struct _FILE_OBJECT *FileObject)
/*++
  Routine Description:
     Lock an FCB. Check if the FCB is on the master list and if
     it is still valid. On success, returns with the FCB resource locked
     and the FCB referenced.
--*/
{
    PPFFCB Fcb = (PPFFCB)FileObject->FsContext2;
    KIRQL kirql;
    PLIST_ENTRY List;
    PPFFCB Fcb1 = 0;

    KeAcquireSpinLock(&g_FcbSpin, &kirql);

    for(List = g_leFcbs.Flink;
        List != &g_leFcbs;
        List = List->Flink)
    {
        Fcb1 = CONTAINING_RECORD(List, PFFCB, leList);

        //
        // use it if it is not being closed
        //
        if(Fcb1 == Fcb)
        {
            if( !(Fcb->dwFlags & PF_FCB_CLOSED) )
            {
                InterlockedIncrement(&Fcb->UseCount);
            }
            else
            {
                Fcb1 = 0;
            }
            break;
        }
    }

    KeReleaseSpinLock(&g_FcbSpin, kirql);

    if(Fcb != Fcb1)
    {
        //
        // didn't find it.
        //

        return(STATUS_INVALID_PARAMETER);
    }

    //
    // found it. Lock it up. 
    //

    ExAcquireResourceExclusive( &Fcb->Resource, TRUE );

    //
    // must look one more time to see if it has been closed. This can
    // happen if the closer sneaked in. So we have to become the closer.
    //
    if(Fcb->dwFlags & PF_FCB_CLOSED)
    {
        //
        // it was. Unlock it and return an error
        //
        UnLockFcb(FileObject);
        return(STATUS_INVALID_PARAMETER);
    }
    return(STATUS_SUCCESS);
}

VOID
UnLockFcb(
    IN struct _FILE_OBJECT *FileObject)
/*++
  Routine Description:
    Unlock and derefence an FCB. If the reference count becomes zero,
    remove the FCB from the master list and close it.
--*/
{
    PPFFCB Fcb = (PPFFCB)FileObject->FsContext2;
    KIRQL kirql;

    KeAcquireSpinLock(&g_FcbSpin, &kirql);
    if(InterlockedDecrement(&Fcb->UseCount) <= 0)
    {
        ASSERT(Fcb->dwFlags & PF_FCB_CLOSED);
        RemoveEntryList(&Fcb->leList);
        KeReleaseSpinLock(&g_FcbSpin, kirql);
        CloseFcb(Fcb, FileObject);
    }
    else
    {
        KeReleaseSpinLock(&g_FcbSpin, kirql);
        ExReleaseResourceLite( &Fcb->Resource );
    }
}

VOID
PFReadRegistryParameters(PUNICODE_STRING RegistryPath)
/*++
  Routine Description:
    Called when the driver is loaded. Reads registry paramters
    for configuring the driver
--*/
{
    OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE PFHandle;
    HANDLE PFParHandle;
    NTSTATUS Status;
    UNICODE_STRING UnicodeString;
    ULONG Storage[8];
    PKEY_VALUE_PARTIAL_INFORMATION Value =
               (PKEY_VALUE_PARTIAL_INFORMATION)Storage;

    InitializeObjectAttributes(
        &ObjectAttributes,
        RegistryPath,               // name
        OBJ_CASE_INSENSITIVE,       // attributes
        NULL,                       // root
        NULL                        // security descriptor
        );

    Status = ZwOpenKey (&PFHandle, KEY_READ, &ObjectAttributes);

    RtlInitUnicodeString(&UnicodeString, L"Parameters");

    if(NT_SUCCESS(Status))
    {

        InitializeObjectAttributes(
            &ObjectAttributes,
            &UnicodeString,
            OBJ_CASE_INSENSITIVE,
            PFHandle,
            NULL
            );


        Status = ZwOpenKey (&PFParHandle, KEY_READ, &ObjectAttributes);

        ZwClose(PFHandle);

        if(NT_SUCCESS(Status))
        {
            ULONG BytesRead;

            RtlInitUnicodeString(&UnicodeString, L"AddressHashSize");

            Status = ZwQueryValueKey(
                            PFParHandle,
                            &UnicodeString,
                            KeyValuePartialInformation,
                            Value,
                            sizeof(Storage),
                            &BytesRead);

            if(NT_SUCCESS(Status)
                   &&
               (Value->Type == REG_DWORD) )
            {
                AddrModulus = *(PULONG)Value->Data;
            }

            RtlInitUnicodeString(&UnicodeString, L"FragmentThreshold");

            Status = ZwQueryValueKey(
                            PFParHandle,
                            &UnicodeString,
                            KeyValuePartialInformation,
                            Value,
                            sizeof(Storage),
                            &BytesRead);

            if(NT_SUCCESS(Status)
                   &&
               (Value->Type == REG_DWORD) )
            {
                g_FragThresholdSize = *(PULONG)Value->Data;
            }

            ZwClose(PFParHandle);
        }
    }
}