Add packet/payload matching to WinDivert (#156).

Adds the follow terms to the filter language:
- packet[idx]: 8bit packet value at idx.
- packet16[idx]: 16bit packet value at idx.
- packet32[idx]: 32bit packet value at idx.
- PROTO.Payload[idx]: 8bit payload value at idx.
- PROTO.Payload16[idx]: 16bit payload value at
  idx.
- PROTO.Payload32[idx]: 32bit payload value at
  idx.
where PROTO is {tcp,udp}.

16 and 32bit values assume network byte ordering.

The index may be:
- An undecorated integer, in which case the
  packet or payload is treated as a 8/16/32bit
  value array, similar to C arrays.
- A 'b' decorated integer, (e.g, packet32[17b]),
  in which case the integer is interpreted as a
  byte offset.
- A negative (un)decorated integer, in which
  case indexing begins at the *end* of the
  packet or payload.  E.g., packet32[-1] is the
  last 32bits of the packet.

If the index is out-of-bounds, then the test
is deemed to be equivalent to "false".
This commit is contained in:
basil00
2018-11-07 07:54:32 +08:00
parent 3e40705178
commit 33a461eef6
5 changed files with 724 additions and 145 deletions
+10 -1
View File
@@ -127,8 +127,17 @@
#define WINDIVERT_FILTER_FIELD_PROTOCOL 65
#define WINDIVERT_FILTER_FIELD_LAYER 66
#define WINDIVERT_FILTER_FIELD_EVENT 67
#define WINDIVERT_FILTER_FIELD_PACKET 68
#define WINDIVERT_FILTER_FIELD_PACKET16 69
#define WINDIVERT_FILTER_FIELD_PACKET32 70
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD 71
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD16 72
#define WINDIVERT_FILTER_FIELD_TCP_PAYLOAD32 73
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD 74
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD16 75
#define WINDIVERT_FILTER_FIELD_UDP_PAYLOAD32 76
#define WINDIVERT_FILTER_FIELD_MAX \
WINDIVERT_FILTER_FIELD_EVENT
WINDIVERT_FILTER_FIELD_UDP_PAYLOAD32
#define WINDIVERT_FILTER_TEST_EQ 0
#define WINDIVERT_FILTER_TEST_NEQ 1