- Adds 3 new "pseudo-random" filter expressions:
* random8 (8bit)
* random16 (16bit)
* random32 (32bit)
Not really "random", but these values are based
on a hash of the packet headers & timestamp.
These are useful for traffic sampling, e.g.:
"random8 < 100" matches ~39% of all packets.
- Add new WinDivertHelperHashPacket() helper
function. The algorithm is an xxHash variant.
This function allows the user application to
"shutdown" a handle in anticipation of a
call to WinDivertClose(). When a handle has
been shutdown, new packets will no longer be
queued. However, existing queued packets can
still be read by WinDivertRecv(). When the
queue is emptied, WinDivertRecv() will fail
with ERROR_NO_DATA.
The WinDivertShutdown() function is analogous
to the shutdown() socket function.
This change also simplifies events.
Adds the follow terms to the filter language:
- packet[idx]: 8bit packet value at idx.
- packet16[idx]: 16bit packet value at idx.
- packet32[idx]: 32bit packet value at idx.
- PROTO.Payload[idx]: 8bit payload value at idx.
- PROTO.Payload16[idx]: 16bit payload value at
idx.
- PROTO.Payload32[idx]: 32bit payload value at
idx.
where PROTO is {tcp,udp}.
16 and 32bit values assume network byte ordering.
The index may be:
- An undecorated integer, in which case the
packet or payload is treated as a 8/16/32bit
value array, similar to C arrays.
- A 'b' decorated integer, (e.g, packet32[17b]),
in which case the integer is interpreted as a
byte offset.
- A negative (un)decorated integer, in which
case indexing begins at the *end* of the
packet or payload. E.g., packet32[-1] is the
last 32bits of the packet.
If the index is out-of-bounds, then the test
is deemed to be equivalent to "false".
This change allows multiple packets to be
received/sent at once, reducing overheads. To
exploit this feature, applications need to use
the WinDivertRecvEx()/WinDivertSendEx()
functions with the new addrLen parameter. The
passthru example has been modified to use
batching.
The DEBUG flag has been retired since it
conflicts with batching, and was not very
useful anyway.
Adds a new REFLECT layer for monitoring WinDivert
handles. This includes:
- three new REFLECT events: ESTABLISHED, OPEN and
CLOSE;
- modifying the ADDRESS for REFLECT data:
open time, process-id, layer, flags, and
priority of the opened handle; and
- allowing WinDivertRecv() to read a
representation of the opened filter.
This change also includes a new "object"
representation for WinDivert filter strings.
The API has been updated as follows:
- WinDivertHelperCompileFilter (replaces
CheckFilter) compiles filter strings into the
object form; and
- WinDivertHelperFormatFilter can "decompile" an
object back into a human-readable filter
string.
Other:
- New NO_INSTALL flag.
- New windivertctl.exe sample program.
This allows projects that are strictly "GPLv2
only" to use WinDivert without licensing issues.
See the FSF's compatibility matrix here:
https://www.gnu.org/licenses/gpl-faq.en.html
This change does not affect existing projects
that can continue to use the LGPLv3 as before.
Also, bump the WinDivert version to 1.4.1.
WinDivert will now mark any packet injected by
another driver as an "impostor", meaning that it
did not originate from the network. Changes are:
- User programs may filter impostor packets.
- WinDivertSend() automatically decrements the TTL
for imposter packets, see #41.
Bump version and change magic numbers to make the driver incompatible with
older versions. Also cleanup some driver checksum code missed by previous
commit.
- As discussed in #37, the WINDIVERT_FLAG_NO_CHECKSUM behavior has become the
default. This means that outbound packets returned by WinDivertRecv() are
no longer guaranteed to have valid checksums, thanks to TCP checksum
offloading by the Windows TCP/IP stack. The checksums can still be
recovered by calling WinDivertHelperCalcChecksums() manually.
- Remove the old WinDivert1.0 legacy API, as nobody should still be using it.
* WinDivert sublayers are created and inserted when the driver is loaded.
* All WinDivert callouts are installed at the same sublayer.
- Clean-up the implementation of priorities.
- Re-introduce deep copying for SNIFF mode. This avoids referencing the
sniffed packets.
- Fix-up the netfilter example:
* Don't send RSTs to RST/FINs, this can start a RST war.
* Don't inject ICMP outbound - this may not be a problem despite 1233 errors.
* Re-brand "DIVERT" to "WINDIVERT" throughout the code-base.
* New flags:
> WINDIVERT_FLAG_PASSTHRU: Do not drop nor capture packets. Useful
for injection-only handles.
> WINDIVERT_FLAG_NO_CHECKSUM: Do not guarantee that diverted packets
have a correct checksum.
NOTE: Not yet tested!
* New default values and limits for various WinDivert parameters,
including WINDIVERT_PARAM_QUEUE_LEN, WINDIVERT_PARAM_QUEUE_TIME, and
the maximum filter length.
* New extended WinDivert functions that support asynchronous I/O:
> WinDivertRecvEx(..)
> WinDivertSendEx(..)
NOTE: Not yet tested!
* The WinDivert driver now services reads (receives) out-of-band.
The motivation is because WFP callouts are run at DISPATCH_LEVEL, so
we should not be doing expensive work in the ClassifyFn. This is also
the same reason why the filter length has been restricted.
basil00