hackmaster/gatuna
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: filter out own outgoing frames on Windows client

Browse Source 
Npcap in promiscuous mode loops back our own sent frames to the
capture callback. Without filtering, every DATA frame the client
sent was also processed as an incoming frame, duplicating the data
stream. This corrupted SSH sessions (Bad packet length 0x5353482D
= 'SSH-' — the version banner received twice).

Fix: compare source MAC in captured frames against our own MAC and
skip matches. Mirrors the PACKET_OUTGOING check on the Rust side.
This commit is contained in:
Mute
2026-08-13 08:02:28 +00:00
parent d730028af9
commit 27e15452ee
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
win/gatuna-client/TunnelLink.cs
+5
View File
@@ -50,6 +50,11 @@ sealed class TunnelLink : IDisposable
var et = (ushort)(data[12] << 8 | data[13]); var et = (ushort)(data[12] << 8 | data[13]);
if (et != Proto.EtherType) if (et != Proto.EtherType)
return; return;
// Skip our own outgoing frames (Npcap loops them back in promiscuous mode).
if (data[6] == _ourMac[0] && data[7] == _ourMac[1]
&& data[8] == _ourMac[2] && data[9] == _ourMac[3]
&& data[10] == _ourMac[4] && data[11] == _ourMac[5])
return;
var srcMac = new byte[6]; var srcMac = new byte[6];
Buffer.BlockCopy(data, 6, srcMac, 0, 6); Buffer.BlockCopy(data, 6, srcMac, 0, 6);
var payload = data.AsSpan(Proto.EthHeaderLen); var payload = data.AsSpan(Proto.EthHeaderLen);