Skip to main content

 none
[WFPSampler] PEND_AUTHORIZATION and work items RRS feed

  • Question

  • Command:
    WFPSampler -s PEND_AUTHORIZATION -l FWPM_ALE_AUTH_CONNECT_V4 -wi -fap -v

    Result:
    ping some_address -t
    Lost ~50%

    HCK WinSock Core Functional Test: FAIL
    Winsock API:[PASS:18]:[FAIL:1]
    IP Multicast:[FAIL:1]

    During ping and HCK test I see:
    Assertion c:\source\wfpsample\sys\completionfunctions_pendauthorizationcallouts.cpp(165): NT_SUCCESS(pNetBufferList->Status)

    Command:
    WFPSampler -s PEND_AUTHORIZATION -l FWPM_ALE_AUTH_CONNECT_V4 -wi -fap -v -d 10

    Result:
    ping some_address -t
    Lost 0%

    HCK WinSock Core Functional Test: PASS

    It is very important for me as my driver uses work items for pending authorization. And I have the same troubles: ping losses and the Multicast test fail.  The explicit delay for pend operation also solves  problems with my driver.

    OS: all platforms including Win8 9200

    Sunday, August 5, 2012 2:22 PM

All replies

  • Also:

    If I remove FwpsPendOperation call, errors is not reproduced. But sometimes FWPM_ALE_AUTH_CONNECT_V4_DISCARD classify occures. I'm affraid without FwpsPendOperation  I can block some network activites.
    Sunday, August 5, 2012 2:32 PM
  • I've made one trick:
    I insert KeFlushQueuedDpcs() in the work item before FwpsCompleteOperation and FwpsInjectTransportSendAsync. Error is gone. But I'm affraid it is not good for system performance. 
    Monday, August 6, 2012 7:11 AM
  • Hi.

    Sorry for replying to a so old topic, but we encounter the same issue. In the completion routine of FwpsInjectTransportSendAcync, the  nbl->status is STATUS_DATA_NOT_ACCEPTED. We are not in the case where a nbl is chained, or where a nbl contains multiple nb.

    Calling KeFlushQueuedDpcs seems to be a workaround, but it is not satisfying (for performance issues, and for understanding).

    Is it a known WFP bug ? Can you explain why the call to KeFlushQueuedDpcs fixes the issue ? Are you aware of another workaround which would less impact the performances ?


    The bug is easily reproducible with WFPSampler, with a PEND_AUTHORIZATION at layer FWPM_ALE_AUTH_CONNECT_V4, by sending ping continuously. When you set a delay of 100ms, the assertion occurs much more often than when you set a delay of 10ms.

    Some information about this bug would be much appreciated.

    Thanks for your help

    Friday, December 14, 2018 10:02 AM
  • Is there any update about this issue ?

    It is easily reproducible, with the WFPSampler (last version), so I guess it is a bug (either in the WFPSampler, either in the WFP framework !?).

    Any information about this issue would be highly appreciated.

    Best regards

    Tuesday, September 3, 2019 2:54 PM