diff --git a/dll/windivert_helper.c b/dll/windivert_helper.c index 9abab7d..833f79a 100644 --- a/dll/windivert_helper.c +++ b/dll/windivert_helper.c @@ -424,6 +424,11 @@ extern UINT WinDivertHelperCalcChecksums(PVOID pPacket, UINT packetLen, UINT payload_len, checksum_len; UINT count = 0; + if ((flags & 0x1F) == 0x1F) + { + return 0; + } + WinDivertHelperParsePacket(pPacket, packetLen, &ip_header, &ipv6_header, &icmp_header, &icmpv6_header, &tcp_header, &udp_header, NULL, &payload_len); diff --git a/examples/netdump/netdump.c b/examples/netdump/netdump.c index 8447602..39ac27d 100644 --- a/examples/netdump/netdump.c +++ b/examples/netdump/netdump.c @@ -52,6 +52,7 @@ int __cdecl main(int argc, char **argv) PWINDIVERT_ICMPV6HDR icmpv6_header; PWINDIVERT_TCPHDR tcp_header; PWINDIVERT_UDPHDR udp_header; + const char *err_str; // Check arguments. switch (argc) @@ -68,7 +69,7 @@ int __cdecl main(int argc, char **argv) fprintf(stderr, "\t%s true\n", argv[0]); fprintf(stderr, "\t%s \"outbound and tcp.DstPort == 80\" 1000\n", argv[0]); - fprintf(stderr, "\t%s \"inbound and tcp.Syn\" -4000\n", argv[0]); + fprintf(stderr, "\t%s \"inbound and tcp.Syn\" -400\n", argv[0]); exit(EXIT_FAILURE); } @@ -80,9 +81,11 @@ int __cdecl main(int argc, char **argv) WINDIVERT_FLAG_SNIFF); if (handle == INVALID_HANDLE_VALUE) { - if (GetLastError() == ERROR_INVALID_PARAMETER) + if (GetLastError() == ERROR_INVALID_PARAMETER && + !WinDivertHelperCheckFilter(argv[1], WINDIVERT_LAYER_NETWORK, + &err_str, NULL)) { - fprintf(stderr, "error: filter syntax error\n"); + fprintf(stderr, "error: invalid filter \"%s\"\n", err_str); exit(EXIT_FAILURE); } fprintf(stderr, "error: failed to open the WinDivert device (%d)\n", @@ -114,6 +117,12 @@ int __cdecl main(int argc, char **argv) GetLastError()); continue; } + + // Calculate checksums for outbound packets. + if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND) + { + WinDivertHelperCalcChecksums(packet, packet_len, 0); + } // Print info about the matching packet. WinDivertHelperParsePacket(packet, packet_len, &ip_header, diff --git a/examples/netfilter/netfilter.c b/examples/netfilter/netfilter.c index a355afd..6b968db 100644 --- a/examples/netfilter/netfilter.c +++ b/examples/netfilter/netfilter.c @@ -98,6 +98,7 @@ int __cdecl main(int argc, char **argv) PWINDIVERT_TCPHDR tcp_header; PWINDIVERT_UDPHDR udp_header; UINT payload_len; + const char *err_str; TCPPACKET reset0; PTCPPACKET reset = &reset0; @@ -125,7 +126,7 @@ int __cdecl main(int argc, char **argv) fprintf(stderr, "\t%s true\n", argv[0]); fprintf(stderr, "\t%s \"outbound and tcp.DstPort == 80\" 1000\n", argv[0]); - fprintf(stderr, "\t%s \"inbound and tcp.Syn\" -4000\n", argv[0]); + fprintf(stderr, "\t%s \"inbound and tcp.Syn\" -400\n", argv[0]); exit(EXIT_FAILURE); } @@ -152,9 +153,11 @@ int __cdecl main(int argc, char **argv) handle = WinDivertOpen(argv[1], WINDIVERT_LAYER_NETWORK, priority, 0); if (handle == INVALID_HANDLE_VALUE) { - if (GetLastError() == ERROR_INVALID_PARAMETER) + if (GetLastError() == ERROR_INVALID_PARAMETER && + !WinDivertHelperCheckFilter(argv[1], WINDIVERT_LAYER_NETWORK, + &err_str, NULL)) { - fprintf(stderr, "error: filter syntax error\n"); + fprintf(stderr, "error: invalid filter \"%s\"\n", err_str); exit(EXIT_FAILURE); } fprintf(stderr, "error: failed to open the WinDivert device (%d)\n", diff --git a/examples/passthru/passthru.c b/examples/passthru/passthru.c index 2b16be6..fe52562 100644 --- a/examples/passthru/passthru.c +++ b/examples/passthru/passthru.c @@ -106,7 +106,14 @@ static DWORD passthru(LPVOID arg) GetLastError()); continue; } - + + // NOTE: Since WinDivert1.2 outbound packets are not guaranteed + // to have correct checksums. + if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND) + { + WinDivertHelperCalcChecksums(packet, packet_len, 0); + } + // Re-inject the matching packet. if (!WinDivertSend(handle, packet, packet_len, &addr, NULL)) { diff --git a/examples/webfilter/webfilter.c b/examples/webfilter/webfilter.c index 3d2b9d1..d162ef1 100644 --- a/examples/webfilter/webfilter.c +++ b/examples/webfilter/webfilter.c @@ -188,6 +188,7 @@ int __cdecl main(int argc, char **argv) !BlackListPayloadMatch(blacklist, payload, (UINT16)payload_len)) { // Packet does not match the blacklist; simply reinject it. + WinDivertHelperCalcChecksums(packet, packet_len, 0); if (!WinDivertSend(handle, packet, packet_len, &addr, NULL)) { fprintf(stderr, "warning: failed to reinject packet (%d)\n", diff --git a/test/test.c b/test/test.c index cc1ca13..500b1aa 100644 --- a/test/test.c +++ b/test/test.c @@ -321,6 +321,10 @@ read_failed: } buf_len = (UINT)iolen; } + if (addr.Direction == WINDIVERT_DIRECTION_OUTBOUND) + { + WinDivertHelperCalcChecksums(buf, buf_len, 0); + } // (4) Verify that the packet is the same. if (buf_len != packet_len)