Adds a new ETHERNET layer to WinDivert. This
layer is similar to the NETWORK layers in that
packets can be blocked/modified/injected. This
change requires Windows 8 or newer.
Currently the VS build system targets VS2015, but
may also work for later versions (not tested).
To use:
- Download & install VS2015.
- Install WDK.
- Open a Developer Command Prompt.
- Run the msvc-build.bat script.
- Add "length" for total packet length.
- Add "timestamp" for timestamp filtering.
- All filter language numbers are now signed.
- Add new macros: TRUE, FALSE, TCP, UDP, ICMP &
ICMPV6.
- Future-proof the WINDIVERT_FILTER struct.
- Socket (& flow) events are now associated with
a endpointId/parentEndpointId pair that allows
the tracking of socket operations.
- A single socket CLOSE event replaces the UNBIND
and DISCONNECT events.
- A new flag addr.Sniffed indicates if the event
was sniffed or not. Some events (CLOSE) are
always sniffed, regardless of the flags.
- All filter language numbers are now 128bit.
- socketdump.exe can now optionally block events.
- Make WinDivertRecv() and WinDivertSend() arg
ordering match the Ex versions.
- Put the WinDivertHelperParsePacket() protocol
arg after the IP headers.
- WinDivert service handling is now protected by
a mutex.
- Debug the "uninstall" command for windivertctl.
It can now uninstall the WinDivert driver &
not leave the WinDivert service in a "pending"
state.
- Document WinDivert performance tips.
- Add UNBIND/DISCONNECT events to the SOCKET
layer. These events can only be sniffed.
- Remove the RECV_PARTIAL flag. The user
application can just ignore the error code
instead.
- WINDIVERT_ADDRESS is now 64bytes. Some extra
padding added for future-proofing.
- Ignore SOCKET-layer REAUTHORIZE.
- The REFLECT layer returns the filter object
directly (no IPv4 "pseudo" packet).
The idea is to make future versions of the
WinDivert DLL compatible with older SYS and vice
versa.
The interface has also been streamlined so less
system calls are required when the handle is first
opened.
This function allows the user application to
"shutdown" a handle in anticipation of a
call to WinDivertClose(). When a handle has
been shutdown, new packets will no longer be
queued. However, existing queued packets can
still be read by WinDivertRecv(). When the
queue is emptied, WinDivertRecv() will fail
with ERROR_NO_DATA.
The WinDivertShutdown() function is analogous
to the shutdown() socket function.
This change also simplifies events.
This change allows multiple packets to be
received/sent at once, reducing overheads. To
exploit this feature, applications need to use
the WinDivertRecvEx()/WinDivertSendEx()
functions with the new addrLen parameter. The
passthru example has been modified to use
batching.
The DEBUG flag has been retired since it
conflicts with batching, and was not very
useful anyway.
Adds a new SOCKET layer for monitoring socket
events, such as BIND, LISTEN, CONNECT,
and ACCEPT. These events occur before the
flow is established (and unlike the FLOW layer)
it is possible to block/drop SOCKET events.
Otherwise, this layer is very similar to the
FLOW layer, so the PID is available and injection
is not possible. This commit should be
considered to be a WIP.
Other changes:
- New socketdump.exe sample. Prints socket
events.
- Improve IPv6 address parsing.
- New helper functions:
* WinDivertHelperFormatIPv4Address
* WinDivertHelperFormatIPv6Address
- Fix REFLECT bugs.
- The network 5-tuple can now be accessed at
the NETWORK layer.
- Various cleanups.
Adds a new REFLECT layer for monitoring WinDivert
handles. This includes:
- three new REFLECT events: ESTABLISHED, OPEN and
CLOSE;
- modifying the ADDRESS for REFLECT data:
open time, process-id, layer, flags, and
priority of the opened handle; and
- allowing WinDivertRecv() to read a
representation of the opened filter.
This change also includes a new "object"
representation for WinDivert filter strings.
The API has been updated as follows:
- WinDivertHelperCompileFilter (replaces
CheckFilter) compiles filter strings into the
object form; and
- WinDivertHelperFormatFilter can "decompile" an
object back into a human-readable filter
string.
Other:
- New NO_INSTALL flag.
- New windivertctl.exe sample program.
The MSVCRT*.dll dependency has been removed by:
(1) using Win32 API equivalents where possible,
and (2) re-implementing some basic C runtime
functions. This prevents multiple MSVCRTs from
being loaded at runtime (if the application uses
a different version than the DLL). The new
WinDivert.dll only depends on KERNEL32.dll and
ADVAPI32.dll.
Furthermore, the MINGW build has been extended
to generate a WinDivert.lib import library file.
This means that the MINGW DLL can now be used
directly by Visual Studio (any version).
For some reason pseudo checksums do not work on
some systems. The workaround is to modify
WinDivertSend() so that it calculates the full
checksums before forwarding the packet to the
driver.
This allows projects that are strictly "GPLv2
only" to use WinDivert without licensing issues.
See the FSF's compatibility matrix here:
https://www.gnu.org/licenses/gpl-faq.en.html
This change does not affect existing projects
that can continue to use the LGPLv3 as before.
Also, bump the WinDivert version to 1.4.1.
- As discussed in #37, the WINDIVERT_FLAG_NO_CHECKSUM behavior has become the
default. This means that outbound packets returned by WinDivertRecv() are
no longer guaranteed to have valid checksums, thanks to TCP checksum
offloading by the Windows TCP/IP stack. The checksums can still be
recovered by calling WinDivertHelperCalcChecksums() manually.
- Remove the old WinDivert1.0 legacy API, as nobody should still be using it.
Replaces the old filter compiler with a new version that:
- Is a cleaner, more extensible, implementation.
- Can report specific error messages (e.g. bad token vs parse error).
- Supports the new C-style if-then-else expression "(A? B: C)" syntax.
Two new WinDivert helper API functions have been implemented:
- WinDivertHelperCheckFilter() can be used to check a filter string for
errors.
- WinDivertHelperEvalFilter() evaluates a filter on a given packet. Will be
useful for testing.
* WinDivert sublayers are created and inserted when the driver is loaded.
* All WinDivert callouts are installed at the same sublayer.
- Clean-up the implementation of priorities.
- Re-introduce deep copying for SNIFF mode. This avoids referencing the
sniffed packets.
- Fix-up the netfilter example:
* Don't send RSTs to RST/FINs, this can start a RST war.
* Don't inject ICMP outbound - this may not be a problem despite 1233 errors.
1) Remove the dependency on the WdfCoInstaller*.dll file. This file appears
to be unnecessary for Windows 7 and up, and for patched Vista+2008.
2) Remove the WinDivert.inf file (only used by the co-installer).
3) 32/64-bit versions of the driver are now explicitly named, meaning that
the two can co-exist in the same directory.
4) The 32-bit WinDivert.dll can now automatically load the 64-bit driver on
64-bit Windows. This means it is possible to write 32-bit WinDivert
applications that automatically work on 64-bit windows.
5) WinDivert.dll now schedules the WinDivert service to be deleted right
away. This should fix some cases where the service is never deleted,
even during reboot.
6) Updated build scripts to reflect the changes.
* Re-brand "DIVERT" to "WINDIVERT" throughout the code-base.
* New flags:
> WINDIVERT_FLAG_PASSTHRU: Do not drop nor capture packets. Useful
for injection-only handles.
> WINDIVERT_FLAG_NO_CHECKSUM: Do not guarantee that diverted packets
have a correct checksum.
NOTE: Not yet tested!
* New default values and limits for various WinDivert parameters,
including WINDIVERT_PARAM_QUEUE_LEN, WINDIVERT_PARAM_QUEUE_TIME, and
the maximum filter length.
* New extended WinDivert functions that support asynchronous I/O:
> WinDivertRecvEx(..)
> WinDivertSendEx(..)
NOTE: Not yet tested!
* The WinDivert driver now services reads (receives) out-of-band.
The motivation is because WFP callouts are run at DISPATCH_LEVEL, so
we should not be doing expensive work in the ClassifyFn. This is also
the same reason why the filter length has been restricted.
basil00