Skip to content

Commit

Permalink
Prevent OID Set requests for unusual media types
Browse files Browse the repository at this point in the history
  • Loading branch information
@bonsaiviking
bonsaiviking committed Aug 3, 2022
1 parent 3103eab commit b1fdc6a
Show file tree
Hide file tree
Showing 3 changed files with 91 additions and 81 deletions.
19 changes: 14 additions & 5 deletions packetWin7/npf/npf/Openclos.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2125,6 +2125,16 @@ NPF_AttachAdapter(
}
pFiltMod->AdapterID = AttachParameters->NetLuid;
pFiltMod->AdapterBindingStatus = FilterAttaching;
switch (AttachParameters->MiniportMediaType)
{
case NdisMedium802_3:
case NdisMediumNative802_11:
pFiltMod->Fragile = 0;
break;
default:
pFiltMod->Fragile = 1;
break;
}

#ifdef HAVE_RX_SUPPORT
// Determine whether this is our send-to-Rx adapter for the open_instance.
Expand Down Expand Up @@ -2559,7 +2569,7 @@ NOTE: Called at <= DISPATCH_LEVEL (unlike a miniport's MiniportOidRequest)
break;
}

if (Request->RequestType == NdisRequestSetInformation &&
if (!pFiltMod->Fragile && Request->RequestType == NdisRequestSetInformation &&
(Request->DATA.SET_INFORMATION.Oid == OID_GEN_CURRENT_PACKET_FILTER
|| Request->DATA.SET_INFORMATION.Oid == OID_GEN_CURRENT_LOOKAHEAD))
{
Expand Down Expand Up @@ -3166,7 +3176,7 @@ NPF_SetPacketFilter(

TRACE_DBG("pFiltMod=%p, PacketFilter=%#lx\n", pFiltMod, PacketFilter);

if (pFiltMod->Loopback)
if (pFiltMod->Fragile || pFiltMod->Loopback)
{
// Fake it
return NDIS_STATUS_SUCCESS;
Expand Down Expand Up @@ -3249,13 +3259,12 @@ NPF_SetLookaheadSize(
TRACE_ENTER();
pFiltMod->MyLookaheadSize = LookaheadSize;

#ifdef HAVE_WFP_LOOPBACK_SUPPORT
if (pFiltMod->Loopback)
if (pFiltMod->Fragile || pFiltMod->Loopback)
{
// Fake it
return NDIS_STATUS_SUCCESS;
}
#endif

// If neither the new or the old value is greater than the upper value,
if (LookaheadSize <= pFiltMod->HigherLookaheadSize
&& OldValue <= pFiltMod->HigherLookaheadSize)
Expand Down
152 changes: 76 additions & 76 deletions packetWin7/npf/npf/Packet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1536,95 +1536,95 @@ static NTSTATUS funcBIOC_OID(_In_ POPEN_INSTANCE pOpen,
: STATUS_CANCELLED);
}

#ifdef HAVE_WFP_LOOPBACK_SUPPORT
if (pOpen->pFiltMod->Loopback)
{
// We don't really support OID requests on our fake loopback
// adapter, but we can pretend.
if (bSetOid) {
switch (OidData->Oid) {
// Using a switch instead of if/else in case there are
// other OIDs we should accept
case OID_GEN_CURRENT_PACKET_FILTER:
Status = STATUS_SUCCESS;
break;
default:
INFO_DBG("BIOCSETOID not supported for Loopback\n");
Status = STATUS_INVALID_DEVICE_REQUEST;
break;
}
if (bSetOid && (pOpen->pFiltMod->Loopback || pOpen->pFiltMod->Fragile))
{
switch (OidData->Oid) {
// Backwards compatibility: libpcap can't handle adapters that do not support setting packet filter.
case OID_GEN_CURRENT_PACKET_FILTER:
Status = STATUS_SUCCESS;
break;
default:
INFO_DBG("pFiltMod(%p) BIOCSETOID not supported. Loopback: %u, Fragile: %u\n",
pOpen->pFiltMod, pOpen->pFiltMod->Loopback, pOpen->pFiltMod->Fragile);
Status = STATUS_INVALID_DEVICE_REQUEST;
break;
}
else
goto OID_REQUEST_DONE;
}
#ifdef HAVE_WFP_LOOPBACK_SUPPORT
if (!bSetOid && pOpen->pFiltMod->Loopback)
{
switch (OidData->Oid)
{
switch (OidData->Oid)
{
case OID_GEN_MAXIMUM_TOTAL_SIZE:
case OID_GEN_TRANSMIT_BUFFER_SPACE:
case OID_GEN_RECEIVE_BUFFER_SPACE:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = pOpen->pFiltMod->MaxFrameSize;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get MTU = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
case OID_GEN_MAXIMUM_TOTAL_SIZE:
case OID_GEN_TRANSMIT_BUFFER_SPACE:
case OID_GEN_RECEIVE_BUFFER_SPACE:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = pOpen->pFiltMod->MaxFrameSize;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get MTU = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
break;

case OID_GEN_TRANSMIT_BLOCK_SIZE:
case OID_GEN_RECEIVE_BLOCK_SIZE:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = 1;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get OID_GEN_*_BLOCK_SIZE = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
break;
case OID_GEN_MEDIA_IN_USE:
case OID_GEN_MEDIA_SUPPORTED:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = g_DltNullMode ? NdisMediumNull : NdisMedium802_3;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get OID_GEN_MEDIA_IN_USE = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
case OID_GEN_TRANSMIT_BLOCK_SIZE:
case OID_GEN_RECEIVE_BLOCK_SIZE:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
case OID_GEN_LINK_STATE:
if (OidData->Length < sizeof(NDIS_LINK_STATE))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(NDIS_LINK_STATE);
PNDIS_LINK_STATE pLinkState = (PNDIS_LINK_STATE) OidData->Data;
pLinkState->MediaConnectState = MediaConnectStateConnected;
pLinkState->MediaDuplexState = MediaDuplexStateFull;
pLinkState->XmitLinkSpeed = NDIS_LINK_SPEED_UNKNOWN;
pLinkState->RcvLinkSpeed = NDIS_LINK_SPEED_UNKNOWN;
pLinkState->PauseFunctions = NdisPauseFunctionsUnsupported;
OidData->Length = sizeof(NDIS_LINK_STATE);
Status = STATUS_SUCCESS;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = 1;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get OID_GEN_*_BLOCK_SIZE = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
break;
case OID_GEN_MEDIA_IN_USE:
case OID_GEN_MEDIA_SUPPORTED:
if (OidData->Length < sizeof(UINT))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
default:
WARNING_DBG("Unsupported BIOCQUERYOID for Loopback\n");
Status = STATUS_INVALID_DEVICE_REQUEST;
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(UINT);
*((PUINT)OidData->Data) = g_DltNullMode ? NdisMediumNull : NdisMedium802_3;
OidData->Length = sizeof(UINT);
INFO_DBG("Loopback: get OID_GEN_MEDIA_IN_USE = %u\n", *((PUINT)OidData->Data));
Status = STATUS_SUCCESS;
break;
case OID_GEN_LINK_STATE:
if (OidData->Length < sizeof(NDIS_LINK_STATE))
{
Status = STATUS_BUFFER_TOO_SMALL;
break;
}
}
*Info = FIELD_OFFSET(PACKET_OID_DATA, Data) + sizeof(NDIS_LINK_STATE);
PNDIS_LINK_STATE pLinkState = (PNDIS_LINK_STATE) OidData->Data;
pLinkState->MediaConnectState = MediaConnectStateConnected;
pLinkState->MediaDuplexState = MediaDuplexStateFull;
pLinkState->XmitLinkSpeed = NDIS_LINK_SPEED_UNKNOWN;
pLinkState->RcvLinkSpeed = NDIS_LINK_SPEED_UNKNOWN;
pLinkState->PauseFunctions = NdisPauseFunctionsUnsupported;
OidData->Length = sizeof(NDIS_LINK_STATE);
Status = STATUS_SUCCESS;
break;
default:
WARNING_DBG("Unsupported BIOCQUERYOID for Loopback\n");
Status = STATUS_INVALID_DEVICE_REQUEST;
break;
}

goto OID_REQUEST_DONE;
}
#endif
NT_ASSERT(!pOpen->pFiltMod->Loopback);
NT_ASSERT(!(pOpen->pFiltMod->Fragile && bSetOid));

#ifdef HAVE_DOT11_SUPPORT
if (pOpen->pFiltMod->Dot11 && (OidData->Oid == OID_GEN_MEDIA_IN_USE || OidData->Oid == OID_GEN_MEDIA_SUPPORTED))
Expand Down
1 change: 1 addition & 0 deletions packetWin7/npf/npf/Packet.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -339,6 +339,7 @@ typedef struct _NPCAP_FILTER_MODULE
UINT Dot11:1;
UINT HasDataRateMappingTable:1;
UINT PacketFilterOK:1; // Have we correctly set HigherPacketFilter yet?
UINT Fragile:1; // Avoid OID set operations on these adapters

ULONG SupportedPacketFilters;
ULONG MyPacketFilter;
Expand Down

0 comments on commit b1fdc6a

Please sign in to comment.