How to reconstruct an ImmediateBuffer from an IP packet?

[cavivie]

I'm currently working on a project where I need to reconstruct the original immediate buffer from pure IP data packets. However, I'm encountering difficulties in understanding the correct procedure or methodology to achieve this.

[wiresock]

Assuming that packet is a pointer to a raw IPv4 packet and length represents its size, the following code snippet accomplishes the task:

memset(buffer.get(), 0, offsetof(INTERMEDIATE_BUFFER, m_IBuffer));  
memmove(&buffer->m_IBuffer[ETHER_HEADER_LENGTH], packet, length);  
auto* const eth_header = reinterpret_cast<ether_header_ptr>(buffer->m_IBuffer);  
memmove(eth_header->h_source, source_mac, ETH_ALEN);  
memmove(eth_header->h_dest, dest_mac, ETH_ALEN);  
eth_header->h_proto = ETH_P_IP_NET;

buffer->m_Length = gsl::narrow_cast<uint32_t>(length) + ETHER_HEADER_LENGTH;

[cavivie]

Thank you very much for your detailed answer. I am very sorry, but I still have some questions about the above code: If I want to send this data packet back to the adapter of ndisapi, does it mean that I need to get the MAC address from the previously created adapter driver and set it as the source MAC in the code you mentioned above. This is because since I got this original IP packet, even if the original data packet is received from ndisapi, I have lost the information of the dest MAC address, for example, it has lost the information of the dest MAC address after passing through some black box. Does it mean that I have to use some protocol such as ARP to query the MAC address and fill in the dest MAC address. If this original IP packet is received from ndisapi, then I may need to store the MAC address associated with the dest IP in some form such as hashmap so that I can fill in this dest MAC information when I want to send it back to the adapter later?

[wiresock]

There are several methods to obtain a MAC address. You can use ARP to retrieve it, extract and store it from the original network packet, or send a similar packet through Winsock, intercept it on NDIS level, and extract the destination MAC address.