locked
WFP modify packet and reinject problem RRS feed

  • Question

  •    

        Recently We develop an project to modify the ip packet with WFP and encounter bluescreen problem,any help will be appreciate.First,for the income packet we get the netbuffer in the classify callback function and call FwpsReferenceNetBufferList0 to add the reference of the netbuffer then we deliver the packet to some kernel queue for other cpu kernel thread to do the modify later and reinject the modified packet into the tcp/ip stack and call FwpsDereferenceNetBufferList0 to reduce the reference of the netbuffer.We find the driver will cause the bluescreen after some days' running,and the kernel dump indict the call of FwpsDereferenceNetBufferList0 may be the reason.We are confused by this dump ,is the api self may have some bug or the method we use is incorrect(we reference the ndisprot project),please help us!

    Wednesday, October 30, 2013 4:16 AM