Max/basil00_WinDivert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity
291 Commits 5 Branches 21 Tags
eth_layer
Commit Graph
291 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
basil00 f7421f0671 Fix TEST simplification logic (again). 
"ip.DstAddr >= 0.0.0.0" ---> "ip"
"ip.DstAddr <  0.0.0.0" ---> "false"

Previously, the latter simplified to "not ip".
 2023-03-16 07:04:24 +08:00
basil00 a255d6776e Add support for the remaining ARP fields 
- SrcHardAddr
- SrcProtAddr
- DstHardAddr
- DstProtAddr
 2023-03-15 06:29:26 +08:00
basil00 c3182f8010 Sync doc with library 2023-02-22 09:44:03 +08:00
basil00 54153c425b Add WinDivert support for matching ARP packets. 2023-02-19 07:39:58 +08:00
basil00 4b7716edb0 Fix filter object serialization bug. 2023-02-06 07:21:33 +08:00
basil00 2c7727e179 Update hash function + bug fixes 2023-02-05 07:28:21 +08:00
basil00 87e792b528 Merge branch origin/release-v2.2.1 into eth_layer 2023-01-26 06:51:19 +08:00
basil00 9f835d9ffa Fix #294 for ethernet layer branch 
Seems to solve the network-stop problem, see #326
 2023-01-25 06:50:08 +08:00
basil00 1789526ecf Bump version to 2.2.2 & other fixups v2.2.2 2022-09-17 10:32:57 +08:00
basil00 3402f8b2f1 Fix #315 2022-09-12 08:08:42 +08:00
basil00 65bb889c79 Bump version and copyright years v2.2.1 2022-07-30 11:34:25 +08:00
basil00 c983d554c9 Fix previous commit 8bda0af 
Fix #294

Previous commit was incomplete.
 2022-07-30 11:27:57 +08:00
basil00 0b164b6ba3 Fix handling of FwpmTransaction*() errors. 
Fixes #294
 2022-07-30 11:24:46 +08:00
basil00 7f35b0c8f8 Merge pull request #296 from StalkR/patch-1 
windivert.html: fix 6.11 title: format not parse
 2022-07-30 11:24:46 +08:00
StalkR ea25bab7c5 windivert.html: fix 6.11 title: format not parse 2022-07-30 11:24:46 +08:00
basil00 c26ec39465 Fix filter compiler test simplification logic 
Fix #285
 2021-09-25 07:23:08 +08:00
basil00 227a6b1e78 Fix #283 2021-09-11 07:09:51 +08:00
basil00 134dd37bd0 Insert all WinDivert sublayers at the max weight. 2020-09-03 08:12:39 +08:00
basil00 97056af256 Cleanup the provider code. 2020-06-26 08:53:18 +08:00
basil00 db674a6696 Merge pull request #241 from ruilisi/add_provider 
Install provider to pass HLK test
 2020-06-24 08:35:31 +08:00
Zhou Yicheng 32af280add Install provider to pass HLK test 2020-06-22 11:08:51 +08:00
basil00 b83e7413be Add an ETHERNET layer to WinDivert. 
Adds a new ETHERNET layer to WinDivert.  This
layer is similar to the NETWORK layers in that
packets can be blocked/modified/injected.  This
change requires Windows 8 or newer.
 2019-12-20 09:09:57 +08:00
basil00 091ffb3d49 Reformatting v2.2.0 2019-10-06 08:19:23 +08:00
basil00 aff111e44d Merge pull request #211 from zzzjim/fix-mcafee 
Inject on different handles for inbound/outbound
 2019-10-06 08:12:36 +08:00
zzzjim 160d983960 Inject on different handles for inbound/outbound 2019-10-04 19:11:25 -07:00
basil00 69b4620277 Log a system event on driver (un)load. 
This allows WinDivert to be detected without
using the REFLECT API.
 2019-10-04 08:57:30 +08:00
basil00 bcba321048 Fix another packet batch parsing bug. 
Extended/truncated logic was reversed.
 2019-10-03 05:02:37 +08:00
basil00 0c773bc08f Fix batch parsing bug. 2019-09-29 07:27:04 +08:00
basil00 eba2e59e3b Ensure RC file included in MSVC build. 2019-09-29 07:15:41 +08:00
basil00 951560d403 Modify WINDIVERTEXPORT so it can be static. 
For better static linking support.
 2019-08-31 08:49:56 +08:00
basil00 7dc1c5d54a Fix some compiler warnings. 2019-08-27 09:45:45 +08:00
basil00 a1173fe08f Coalesce filter interpreter implementations. 
Replace the dual kernel/user-mode filter
interpreters with a single shared implementation.
 2019-08-17 09:31:46 +08:00
basil00 a240329323 Add "fragment" to filter language. 
True if the packet is an IPv4/IPv6 fragment.
 2019-08-15 09:08:46 +08:00
basil00 317e6f1099 Implement new packet parser(s) for WinDivert. 
The new parser should better handle fragments
as well as be consistent with the kernel-mode
parser.  The new parser can also handle truncated
packets.
 2019-08-12 07:50:49 +08:00
basil00 6501bec357 Make release script use MSVC build. v2.1.0 2019-08-05 07:47:53 +08:00
basil00 194d9afa1e Towards WinDivert version 2.1 release. 
- inbounds/outbound now work for SOCKET layer.
- passthru.exe now uses MTU_MAX to prevent 122
  errors.
- Further header parsing code hardening.
- Fix bug where Reserved2 was not zeroed.
 2019-08-04 08:11:43 +08:00
basil00 69e4edade7 Add new WINDIVERT_FLAG_FRAGMENTS flag (fix #191). 
This flag only affects inbound packets at the
WINDIVERT_LAYER_NETWORK layer.

If set, the handle will capture IP fragments,
but not reassembled IP packets.

If unset (the default), the handle will capture
reassembled IP packets, but not IP fragments.
 2019-08-02 08:32:50 +08:00
basil00 6eb82d08e0 Fix WinDivert 2.0 driver bugs. 
- BSOD for incomplete transport headers (#202).
- Fix enforcement of wrong MTU.
- Fix missing endpoint handles for IPV6 flow
  layer.
 2019-07-31 08:46:01 +08:00
basil00 02541ce1da WinDivert 2.0.1-rc bugfix release. v2.0.1-rc 2019-07-06 08:23:06 +08:00
basil00 db7f80d26d PACKET macro is also valid for the FORWARD layer. 2019-06-18 09:11:16 +08:00
basil00 cedb929873 Bug fixes. 
- Fix broken WinDivertCondExecFilter().  This
  caused some callouts to be needlessly installed.
- Fix broken WinDivertByteSwap128().
- Rename "Ipv6" -> "IPv6" to keep API consistent.
- Samples now use correct MTU.
 2019-06-15 07:31:56 +08:00
basil00 5d62e2a938 Add a Visual Studio build system (fix #118). 
Currently the VS build system targets VS2015, but
may also work for later versions (not tested).
To use:
- Download & install VS2015.
- Install WDK.
- Open a Developer Command Prompt.
- Run the msvc-build.bat script.
 2019-04-19 09:52:36 +08:00
basil00 8c4bbf31c6 Fix #175 2019-04-10 07:37:45 +08:00
basil00 cb6d09f094 Update WinDivert release build script. v2.0.0-rc 2019-03-26 22:05:54 +08:00
basil00 40a22f0cf5 Fix #168 2019-03-21 19:25:46 +08:00
basil00 e306d0058b WinDivert filter language improvements. 
- Add "length" for total packet length.
- Add "timestamp" for timestamp filtering.
- All filter language numbers are now signed.
- Add new macros: TRUE, FALSE, TCP, UDP, ICMP &
  ICMPV6.
- Future-proof the WINDIVERT_FILTER struct.
 2019-03-15 08:01:10 +08:00
basil00 d29688ea83 Redesign the WinDivert SOCKET layer. 
- Socket (& flow) events are now associated with
  a endpointId/parentEndpointId pair that allows
  the tracking of socket operations.
- A single socket CLOSE event replaces the UNBIND
  and DISCONNECT events.
- A new flag addr.Sniffed indicates if the event
  was sniffed or not.  Some events (CLOSE) are
  always sniffed, regardless of the flags.
- All filter language numbers are now 128bit.
- socketdump.exe can now optionally block events.
 2019-03-13 08:33:12 +08:00
basil00 4289e7ec2b Fix 64/32 driver & DLL compatibility. 2019-03-11 07:27:00 +08:00
basil00 36b118b2b0 Fix WinDivert service management. 
DeleteService() must be called else the WinDivert
service will survive reboot.
 2019-03-09 07:04:34 +08:00
basil00 2307347070 Use C-string-friendly chars for filter objects. 2019-03-08 09:24:31 +08:00