[siddappa]

I don’t know if this makes any sense, this is the code we have added to Internet Gateway,so that we can allow users based on their MAC address.

if(::SendARP(pIpHeader->ip_src.S_un.S_addr, INADDR_ANY, MACSource, &dwMacSize) != NO_ERROR)
continue;

pNatClient = pDlg->GetClientByMAC(MACSource);
if(pNatClient == NULL)
if(!hAdapters[dwIndex]->IsLocalAddress(&pIpHeader->ip_dst))
{
if(pIpHeader->ip_p == IPPROTO_TCP)
{
pTcpHeader = (tcphdr*)(((PUCHAR)pIpHeader) + sizeof(DWORD)*pIpHeader->ip_hl);
if(ntohs(pTcpHeader->th_dport) != 80)
{
if(ntohs(pTcpHeader->th_dport) != 443)
{

continue;

}

}

if(pTcpHeader->th_flags == TH_SYN)
bTrack = TRUE;
}
}
}

if((bForceRouting) &&(hAdapters[dwIndex]->m_NATState == CLIENT) && (PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_RECEIVE))
{
bNeedToBeRouted = pDlg->IsNeedToForceRouting(pEthHeader->h_dest, pIpHeader->ip_dst.S_un.S_addr, pProviderCard->m_Index);
}

// TCP packet processing
if (pIpHeader->ip_p == IPPROTO_TCP)
{
// This is TCP packet, get TCP header pointer
pTcpHeader = (tcphdr*)(((PUCHAR)pIpHeader) + sizeof(DWORD)*pIpHeader->ip_hl);

// Outgoing TCP packets processing
if(((bForceRouting) && (bNeedToBeRouted) &&(hAdapters[dwIndex]->m_NATState == CLIENT)&&(PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_RECEIVE))
||
((!bForceRouting) &&(hAdapters[dwIndex]->m_NATState == PROVIDER)&&(PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_SEND)))
{
CPortNATEntry* pTcpNE = NULL;

if (pTcpHeader->th_flags == TH_SYN)
{
// New TCP connnection established, allocate dynamic NAT entry

if((!bForceRouting) && bTrack)
pTcpNE = pDlg->m_TcpNatTable.Allocate(pIpHeader->ip_src, pTcpHeader->th_sport, pIpHeader->ip_dst, pTcpHeader->th_dport, bTrack, MACSource);
else if(bForceRouting && bTrack)
pTcpNE = pDlg->m_TcpNatTable.Allocate(pIpHeader->ip_src, pTcpHeader->th_sport, pIpHeader->ip_dst, pTcpHeader->th_dport, bTrack, pEthHeader->h_source);
else
pTcpNE = pDlg->m_TcpNatTable.Allocate(pIpHeader->ip_src, pTcpHeader->th_sport, pIpHeader->ip_dst, pTcpHeader->th_dport, bTrack);

if(pTcpNE)
{
pTcpNE->m_IpNAT = bForceRouting?pProviderCard->m_NATIp:hAdapters[dwIndex]->m_NATIp;
}

pDlg->CheckMTUCorrelation(&PacketBuffer, pIpHeader, pTcpHeader);
}
else
{
// Try to locate existing NAT entry
pTcpNE = pDlg->m_TcpNatTable.Find(pIpHeader->ip_src, pTcpHeader->th_sport, pIpHeader->ip_dst, pTcpHeader->th_dport);

if(pTcpNE && pTcpNE->m_bTracked && pTcpHeader->th_flags == (TH_ACK | TH_PSH))
{
// Add filtering URL here
CHAR * pHttpMsg = (CHAR*)(((PUCHAR)pTcpHeader) + sizeof(DWORD)*pTcpHeader->th_off);
INT maxLength = PacketBuffer.m_Length – ::abs((LONG)((DWORD)pHttpMsg – (DWORD)pEthHeader));
CHAR* szHost = NULL;
CHAR *pHttpHeaderLine = new char[1024];
int i = 0, j;

::ZeroMemory(pHttpHeaderLine, 1024);

do{
j = 0;
while( i < maxLength && pHttpMsg != ‘n’ && j < 1022)
{
pHttpHeaderLine[j] = pHttpMsg;
i++;
j++;
}
pHttpHeaderLine[j++] = ‘n’;
pHttpHeaderLine[j] = ‘’;
i++;

if(::_strnicmp(pHttpHeaderLine, “Host: “, 6) == 0)
{
pHttpHeaderLine[j-2] = ‘’;
szHost = new CHAR[8 + strlen((char*)&pHttpHeaderLine[6])];
::sprintf(szHost, “http://%s&#8221;, (char*)&pHttpHeaderLine[6]);
}

}while( i < maxLength && !( pHttpHeaderLine[0] == 'r' && pHttpHeaderLine[1] == 'n')); delete pHttpHeaderLine; if(szHost != NULL && pDlg->GetAllowedURL(szHost, strlen(szHost)) == -1)
pTcpNE->m_ack = pTcpHeader->th_ack;

if(szHost != NULL)
delete szHost;
}
}

[siddappa]

Please note that all the problems are seen only in costumer place. Please point out the possible causes for this kind of issues. It’s quite urgent as we are not able to trace the root cause yet.

[siddappa]

Thanks serpentFly, but the problem doesn’t seem to be on Win Xp, but only occurs in Win 7 and beyond. Does it got to do anything with driver? i’m using 3.0.8.1 version ndisapi driver.

Also what i noticed in Win7 was the SendARP() call in tunnel mode having client IP as parameter would actually fail when called from StarNat(). To resolve this problem i added a filter to exclude In/Out of ARP packets and that seemed to solve the problem. But now we face the issue of packets getting dropped. Let me know is anything wrong in our apporach?

Also it would help us to point out at better ways to optimize it further.

Regards,
Siddappa

[siddappa]

To add up into the issue, adding multiple clients further slows down the ping response, to the point that i do not get any ping response from the server at all, it times out causing problems to other applications running on server.

[siddappa]

is there any limit for setting number of filters?? Also would it hit the performance if more and more filters gets added?

[Author]

Posts