Use correct flags to determine fragmented or reassembled packets.#22
Closed
JasonStephenson wants to merge 1 commit intonmap:masterfrom
Closed
Use correct flags to determine fragmented or reassembled packets.#22JasonStephenson wants to merge 1 commit intonmap:masterfrom
JasonStephenson wants to merge 1 commit intonmap:masterfrom
Conversation
Contributor
|
Thanks for pointing this out! I'm in the middle of a rather extensive rewrite of our classify function, so your patch won't apply directly, but I see the change that needs to be made and will get it merged correctly with full credit to you. Thanks! |
Author
|
Do you have any idea which release this work would be done in? I'd like to have it stated in our document which version we're compatible with |
Contributor
|
This change will be released in Npcap 0.9988 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I've encountered a compatibility issue between my (the company I work for) network driver and wireshark/npcap. When capturing Loopback packets with Wireshark
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters\LoopbackSupport=dword:00000001my packets fail to inject withNDIS_STATUS_DATA_NOT_ACCEPTED.I believe this is caused by npcap incorrectly identifying my packets as having been fragmented.
The logic npcap uses to identify this is based on the currentMetadataValues bitset
inMetaValues->currentMetadataValues & FWP_CONDITION_FLAG_IS_REASSEMBLEDHowever as per these docs the currentMetadataValues bitset only identifies which values have been set in the metadata.
When npcap executes
inMetaValues->currentMetadataValues & FWP_CONDITION_FLAG_IS_REASSEMBLEDwhat it is actually checking is whether theinMetaValues->transportHeaderSizehas been set, becauseFWP_CONDITION_FLAG_IS_REASSEMBLEDandFWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZEare both0x400.What npcap should really be doing is using the
FWP_CONDITION_FLAG_IS_REASSEMBLEDon the layer dependent flags bitset as per this docA question which you may be asking is why would this break packet injection, surely if npcap bails early from it's ClassifyFn then no harm done. Sadly it's not as simple as that, after some digging it looks like
Windows indicates my packets twice to npcaps callout function. The first time with a transport header present (which npcap incorrectly identifies as a fragment) and a second time without a transport header which is processed fully by npcaps callout function. Below is a printout I have performed which demonstrates this. I've also spat out the packet buffer for completeness.
FIRST INDICATION
SECOND INDICATION
I have done quite a bit of testing with this fix and as far as I can tell I am have no adverse affects on my system. My callout driver does not complain about dropped packets and Wireshark continues to see traffic over the loopback adapter.
Some other variable which may or may not be relevant:
I am connected to a company network using DirectAccess (an IPSEC VPN) to do some IPSEC compatibility testing.
Our driver correctly obeys https://docs.microsoft.com/en-us/windows-hardware/drivers/network/developing-ipsec-compatible-callout-drivers