From fa4fccd426532426e0496348ab60438a6348081e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Tue, 26 Sep 2023 11:01:57 +0800
Subject: [PATCH] NetUsage (Windows): add detection support

---
 CMakeLists.txt                            |  1 +
 src/detection/localip/localip_windows.c   | 19 -------
 src/detection/netusage/netusage_windows.c | 62 +++++++++++++++++++++++
 3 files changed, 63 insertions(+), 19 deletions(-)
 create mode 100644 src/detection/netusage/netusage_windows.c

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 26208f710..ae7dd1e81 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -580,6 +580,7 @@ elseif(WIN32)
         src/detection/media/media_nosupport.c
         src/detection/memory/memory_windows.c
         src/detection/monitor/monitor_windows.c
+        src/detection/netusage/netusage_windows.c
         src/detection/opengl/opengl_windows.c
         src/detection/os/os_windows.cpp
         src/detection/packages/packages_windows.c
diff --git a/src/detection/localip/localip_windows.c b/src/detection/localip/localip_windows.c
index 09071d275..841a608e3 100644
--- a/src/detection/localip/localip_windows.c
+++ b/src/detection/localip/localip_windows.c
@@ -46,7 +46,6 @@ static void addNewIp(FFlist* list, const char* name, const char* value, int type
         ffStrbufInit(&ip->mac);
         ip->defaultRoute = false;
         ip->ifIndex = ifIndex;
-        ip->ioCounters = (FFLocalIpIoCounters) {};
     }
     else
     {
@@ -142,24 +141,6 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
                 newIp = false;
             }
         }
-
-        if (newIp)
-        {
-            MIB_IF_ROW2 ifRow = { .InterfaceIndex = adapter->IfIndex };
-            if (GetIfEntry2(&ifRow) == NO_ERROR)
-            {
-                ((FFLocalIpResult*) ffListGet(results, results->length - 1))->ioCounters = (FFLocalIpIoCounters) {
-                    .txBytes = ifRow.OutOctets,
-                    .rxBytes = ifRow.InOctets,
-                    .txPackets = (ifRow.OutUcastPkts + ifRow.OutNUcastPkts),
-                    .rxPackets = (ifRow.InUcastPkts + ifRow.InNUcastPkts),
-                    .rxErrors = ifRow.InErrors,
-                    .txErrors = ifRow.OutErrors,
-                    .rxDrops = ifRow.InDiscards,
-                    .txDrops = ifRow.OutDiscards,
-                };
-            }
-        }
     }
 
     setDefaultRoute(results);
diff --git a/src/detection/netusage/netusage_windows.c b/src/detection/netusage/netusage_windows.c
new file mode 100644
index 000000000..8facefcf5
--- /dev/null
+++ b/src/detection/netusage/netusage_windows.c
@@ -0,0 +1,62 @@
+#include "netusage.h"
+
+#include "common/io/io.h"
+#include "util/mallocHelper.h"
+#include "util/windows/unicode.h"
+
+#include <ws2tcpip.h>
+#include <iphlpapi.h>
+
+const char* ffGetNetIoCounter(FFlist* result)
+{
+    IP_ADAPTER_ADDRESSES* FF_AUTO_FREE adapter_addresses = NULL;
+
+    // Multiple attempts in case interfaces change while
+    // we are in the middle of querying them.
+    DWORD adapter_addresses_buffer_size = 0;
+    for (int attempts = 0;; ++attempts)
+    {
+        if (adapter_addresses_buffer_size)
+        {
+            adapter_addresses = (IP_ADAPTER_ADDRESSES*)realloc(adapter_addresses, adapter_addresses_buffer_size);
+            assert(adapter_addresses);
+        }
+
+        DWORD error = GetAdaptersAddresses(
+            AF_UNSPEC,
+            GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_DNS_SERVER,
+            NULL,
+            adapter_addresses,
+            &adapter_addresses_buffer_size);
+
+        if (error == ERROR_SUCCESS)
+            break;
+        else if (ERROR_BUFFER_OVERFLOW == error && attempts < 4)
+            continue;
+        else
+            return "GetAdaptersAddresses() failed";
+    }
+
+    // Iterate through all of the adapters
+    for (IP_ADAPTER_ADDRESSES* adapter = adapter_addresses; adapter; adapter = adapter->Next)
+    {
+        MIB_IF_ROW2 ifRow = { .InterfaceIndex = adapter->IfIndex };
+        if (GetIfEntry2(&ifRow) == NO_ERROR)
+        {
+            FFNetUsageIoCounters* counters = (FFNetUsageIoCounters*) ffListAdd(result);
+            *counters = (FFNetUsageIoCounters) {
+                .txBytes = ifRow.OutOctets,
+                .rxBytes = ifRow.InOctets,
+                .txPackets = (ifRow.OutUcastPkts + ifRow.OutNUcastPkts),
+                .rxPackets = (ifRow.InUcastPkts + ifRow.InNUcastPkts),
+                .rxErrors = ifRow.InErrors,
+                .txErrors = ifRow.OutErrors,
+                .rxDrops = ifRow.InDiscards,
+                .txDrops = ifRow.OutDiscards,
+            };
+            ffStrbufSetWS(&counters->name, adapter->FriendlyName);
+        }
+    }
+
+    return NULL;
+}