question

UrfinDgus-4166 avatar image
0 Votes"
UrfinDgus-4166 asked XiaopoYang-MSFT edited

How to obtain network sub-inteface index via user mode WinAPI?

There is network interface index which can be obtained by IP Helper API. Also there is such thing as network sub-interface index which I am struggling to find a way to access.

I am using a third party library which comes with a driver that eventually calls FwpsInjectNetworkReceiveAsync0 function of the Windows Filtering Platform. My user mode code is supposed to deliver this sub-interface index for that function to use, but I do not know where to get it from.

I have looked through the IP Helper API, but all I could find were the functions that return the interface index, not the sub-interface one. Not much information in documentation either it would seem: some enumerations, a few kernel mode functions that require it as argument, but none that would actually deliver it.

windows-apiwindows-10-networkwindows-7windows-platform-networkwindows-8
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

XiaopoYang-MSFT avatar image
0 Votes"
XiaopoYang-MSFT answered XiaopoYang-MSFT edited

The FwpsInjectNetworkReceiveAsync0 cooperate with FwpsCalloutRegister0. The classifyFn0 callout function of FWPS_CALLOUT0 structure will receive the information. There is a GitHub sample.
Edit: I also find the PPP_PROJECTION_INFO structure has the SubInterfaceIndex information.

· 4
5 |1600 characters needed characters left characters exceeded
Toggle Comment visibility. Current Visibility: Visible to all users

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

UrfinDgus-4166 avatar image UrfinDgus-4166 ·

This classifyFn0 function is a kernel mode function as far as I understand, and in the sample you linked to it is said that this is for driver. I need to do this from the user mode.

As for the PPP_PROJECTION_INFO structure, I am not sure about this either. Seems like it is used for some specific case involving some specific protocols. I followed the documentation and this is where it got me:

1) PPP_PROJECTION_INFO is part of PROJECTION_INFO
2) PROJECTION_INFO is part of RAS_CONNECTION_EX
3) RAS_CONNECTION_EX is used in MPRAPI_ADMIN_DLL_CALLBACKS as argument for some callback functions which seem to just listen to certain specific events. I do not need to listen to any events, I just need to get all available sub-interface indexes immediately. Something like what is done by IP Helper API where knowing the local IP address I can easily get the “regular” interface index

0 Votes 0 ·
XiaopoYang-MSFT avatar image XiaopoYang-MSFT UrfinDgus-4166 ·

I know the command netsh interface ipv4/ipv6 show subinterfaces can display information about all subinterfaces, or about all subinterfaces on a given interface if one is specified.

0 Votes 0 ·
UrfinDgus-4166 avatar image UrfinDgus-4166 XiaopoYang-MSFT ·

It seems Netsh does not really give any sub-interface index number in its output. Or at least its idea of what sub-interface actually is is vastly different from what Windows Filtering Platform expects.

The information that it provides is exactly identical to what IP Helper API gives me when I query for “regular” interface indexes. For instance netsh interface ipv4 show subinterface shows “Loopback Pseudo-Interface 1”, “Ethernet” on my machine along with a few others. So does the IP Helper API, telling me that “Loopback Pseudo-Interface 1” has an interface index of 1, “Ethernet” is 8 and so on. These numbers are interface indexes, I am certain about that.

Unless the order in which items are displayed is somehow important and could count as this sub-interface index, but I doubt it.

At this point I am really confused about what this “sub-interface index” actually represents.


0 Votes 0 ·
Show more comments