Add packet/payload matching to WinDivert (#156).
Adds the follow terms to the filter language:
- packet[idx]: 8bit packet value at idx.
- packet16[idx]: 16bit packet value at idx.
- packet32[idx]: 32bit packet value at idx.
- PROTO.Payload[idx]: 8bit payload value at idx.
- PROTO.Payload16[idx]: 16bit payload value at
idx.
- PROTO.Payload32[idx]: 32bit payload value at
idx.
where PROTO is {tcp,udp}.
16 and 32bit values assume network byte ordering.
The index may be:
- An undecorated integer, in which case the
packet or payload is treated as a 8/16/32bit
value array, similar to C arrays.
- A 'b' decorated integer, (e.g, packet32[17b]),
in which case the integer is interpreted as a
byte offset.
- A negative (un)decorated integer, in which
case indexing begins at the *end* of the
packet or payload. E.g., packet32[-1] is the
last 32bits of the packet.
If the index is out-of-bounds, then the test
is deemed to be equivalent to "false".
This commit is contained in:
@@ -127,8 +127,17 @@
|
||||
#define WINDIVERT_FILTER_FIELD_PROTOCOL 65
|
||||
#define WINDIVERT_FILTER_FIELD_LAYER 66
|
||||
#define WINDIVERT_FILTER_FIELD_EVENT 67
|
||||
#define WINDIVERT_FILTER_FIELD_PACKET 68
|
||||
#define WINDIVERT_FILTER_FIELD_PACKET16 69
|
||||
#define WINDIVERT_FILTER_FIELD_PACKET32 70
|
||||
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD 71
|
||||
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD16 72
|
||||
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD32 73
|
||||
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD 74
|
||||
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD16 75
|
||||
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD32 76
|
||||
#define WINDIVERT_FILTER_FIELD_MAX \
|
||||
WINDIVERT_FILTER_FIELD_EVENT
|
||||
WINDIVERT_FILTER_FIELD_UDP_PAYLOAD32
|
||||
|
||||
#define WINDIVERT_FILTER_TEST_EQ 0
|
||||
#define WINDIVERT_FILTER_TEST_NEQ 1
|
||||
|
||||
Reference in New Issue
Block a user