* Strips the Frame Check Sequence if we manage to capture it. * * On Windows, (some?) Intel NICs can be configured to capture FCS. * * Linux can be configure to capture FCS, using `ethtool -K rx-fcs on` on supported devices. * Support for capturing FCS can be checked with `ethtool -k | grep rx-fcs`. * if it's `off [Fixed]`, then the interface/driver dosn't support c
| 409 | * Packets sent by another application via packet injection also won't have FCS and may not match the adapter MAC. |
| 410 | */ |
| 411 | void PCAPAdapter::HandleFrameCheckSequence(NetPacket* pkt) |
| 412 | { |
| 413 | EthernetFrameEditor frame(pkt); |
| 414 | if (frame.GetSourceMAC() == hostMAC) |
| 415 | return; |
| 416 | |
| 417 | // There is a (very) low chance of the last 4 bytes of payload somehow acting as a valid checksum for the whole Ethernet frame. |
| 418 | // For EtherTypes we already can parse, trim the Ethernet frame based on the payload length. |
| 419 | |
| 420 | int payloadSize = -1; |
| 421 | if (frame.GetProtocol() == static_cast<u16>(EtherType::IPv4)) // IP |
| 422 | { |
| 423 | PayloadPtrEditor* payload = frame.GetPayload(); |
| 424 | IP_Packet ippkt(payload->data, payload->GetLength()); |
| 425 | payloadSize = ippkt.GetLength(); |
| 426 | } |
| 427 | if (frame.GetProtocol() == static_cast<u16>(EtherType::ARP)) // ARP |
| 428 | { |
| 429 | ARP_PacketEditor arpPkt(frame.GetPayload()); |
| 430 | payloadSize = arpPkt.GetLength(); |
| 431 | } |
| 432 | |
| 433 | if (payloadSize != -1) |
| 434 | { |
| 435 | // Minumum frame size is 60 + 4 byte FCS. |
| 436 | // Virtual NICs may omit this padding, so check we arn't increasing pkt size. |
| 437 | payloadSize = std::min(std::max(payloadSize, 60 - frame.headerLength), pkt->size); |
| 438 | |
| 439 | pkt->size = payloadSize + frame.headerLength; |
| 440 | return; |
| 441 | } |
| 442 | |
| 443 | // Ethertype unknown, rely on checking for a FCS. |
| 444 | if (ValidateEtherFrame(pkt)) |
| 445 | pkt->size -= 4; |
| 446 | } |
| 447 | |
| 448 | bool PCAPAdapter::ValidateEtherFrame(NetPacket* pkt) |
| 449 | { |
nothing calls this directly
no test coverage detected