- inbounds/outbound now work for SOCKET layer.
- passthru.exe now uses MTU_MAX to prevent 122
errors.
- Further header parsing code hardening.
- Fix bug where Reserved2 was not zeroed.
This flag only affects inbound packets at the
WINDIVERT_LAYER_NETWORK layer.
If set, the handle will capture IP fragments,
but not reassembled IP packets.
If unset (the default), the handle will capture
reassembled IP packets, but not IP fragments.
- Fix broken WinDivertCondExecFilter(). This
caused some callouts to be needlessly installed.
- Fix broken WinDivertByteSwap128().
- Rename "Ipv6" -> "IPv6" to keep API consistent.
- Samples now use correct MTU.
Currently the VS build system targets VS2015, but
may also work for later versions (not tested).
To use:
- Download & install VS2015.
- Install WDK.
- Open a Developer Command Prompt.
- Run the msvc-build.bat script.
- Add "length" for total packet length.
- Add "timestamp" for timestamp filtering.
- All filter language numbers are now signed.
- Add new macros: TRUE, FALSE, TCP, UDP, ICMP &
ICMPV6.
- Future-proof the WINDIVERT_FILTER struct.
- Socket (& flow) events are now associated with
a endpointId/parentEndpointId pair that allows
the tracking of socket operations.
- A single socket CLOSE event replaces the UNBIND
and DISCONNECT events.
- A new flag addr.Sniffed indicates if the event
was sniffed or not. Some events (CLOSE) are
always sniffed, regardless of the flags.
- All filter language numbers are now 128bit.
- socketdump.exe can now optionally block events.
- Make WinDivertRecv() and WinDivertSend() arg
ordering match the Ex versions.
- Put the WinDivertHelperParsePacket() protocol
arg after the IP headers.
- WinDivert service handling is now protected by
a mutex.
- Debug the "uninstall" command for windivertctl.
It can now uninstall the WinDivert driver &
not leave the WinDivert service in a "pending"
state.
- Document WinDivert performance tips.
(1) WinDivert will now reference the PROCESS that
opened the handle, and will not deref until the
handle is closed & all corresponding REFLECT
events have been completed. This means the OPEN
REFLECT event will always return a valid PID.
(2) The packet queue size now also accounts for
internal overheads.
- Add UNBIND/DISCONNECT events to the SOCKET
layer. These events can only be sniffed.
- Remove the RECV_PARTIAL flag. The user
application can just ignore the error code
instead.
- WINDIVERT_ADDRESS is now 64bytes. Some extra
padding added for future-proofing.
- Ignore SOCKET-layer REAUTHORIZE.
- The REFLECT layer returns the filter object
directly (no IPv4 "pseudo" packet).
The idea is to make future versions of the
WinDivert DLL compatible with older SYS and vice
versa.
The interface has also been streamlined so less
system calls are required when the handle is first
opened.
- addr.Pseudo*Checksum flags replaced by simpler
addr.*Checksum flags.
- WinDivertHelperParsePacket() can now handle
batched packets.
- WinDivertHelperParsePacket() can now return the
transport protocol.
- WinDivertHelperCalcChecksums() can now handle
batched packets.
- WinDivertHelperCalcChecksums() now sets address
checksum flags that were calculated.
- A bunch of WINDIVERT_* macros have been moved
to windivert.h for windivert_device.h.
- Adds 3 new "pseudo-random" filter expressions:
* random8 (8bit)
* random16 (16bit)
* random32 (32bit)
Not really "random", but these values are based
on a hash of the packet headers & timestamp.
These are useful for traffic sampling, e.g.:
"random8 < 100" matches ~39% of all packets.
- Add new WinDivertHelperHashPacket() helper
function. The algorithm is an xxHash variant.
This function allows the user application to
"shutdown" a handle in anticipation of a
call to WinDivertClose(). When a handle has
been shutdown, new packets will no longer be
queued. However, existing queued packets can
still be read by WinDivertRecv(). When the
queue is emptied, WinDivertRecv() will fail
with ERROR_NO_DATA.
The WinDivertShutdown() function is analogous
to the shutdown() socket function.
This change also simplifies events.
This change allows multiple packets to be
received/sent at once, reducing overheads. To
exploit this feature, applications need to use
the WinDivertRecvEx()/WinDivertSendEx()
functions with the new addrLen parameter. The
passthru example has been modified to use
batching.
The DEBUG flag has been retired since it
conflicts with batching, and was not very
useful anyway.
Adds a new SOCKET layer for monitoring socket
events, such as BIND, LISTEN, CONNECT,
and ACCEPT. These events occur before the
flow is established (and unlike the FLOW layer)
it is possible to block/drop SOCKET events.
Otherwise, this layer is very similar to the
FLOW layer, so the PID is available and injection
is not possible. This commit should be
considered to be a WIP.
Other changes:
- New socketdump.exe sample. Prints socket
events.
- Improve IPv6 address parsing.
- New helper functions:
* WinDivertHelperFormatIPv4Address
* WinDivertHelperFormatIPv6Address
- Fix REFLECT bugs.
- The network 5-tuple can now be accessed at
the NETWORK layer.
- Various cleanups.
Adds a new REFLECT layer for monitoring WinDivert
handles. This includes:
- three new REFLECT events: ESTABLISHED, OPEN and
CLOSE;
- modifying the ADDRESS for REFLECT data:
open time, process-id, layer, flags, and
priority of the opened handle; and
- allowing WinDivertRecv() to read a
representation of the opened filter.
This change also includes a new "object"
representation for WinDivert filter strings.
The API has been updated as follows:
- WinDivertHelperCompileFilter (replaces
CheckFilter) compiles filter strings into the
object form; and
- WinDivertHelperFormatFilter can "decompile" an
object back into a human-readable filter
string.
Other:
- New NO_INSTALL flag.
- New windivertctl.exe sample program.
This allows projects that are strictly "GPLv2
only" to use WinDivert without licensing issues.
See the FSF's compatibility matrix here:
https://www.gnu.org/licenses/gpl-faq.en.html
This change does not affect existing projects
that can continue to use the LGPLv3 as before.
Also, bump the WinDivert version to 1.4.1.
Most NIC cards support checksum offloading,
meaning that it is not necessary to calculate the
full IP/TCP/UDP checksums for injected packets.
WINDIVERT_ADDRESS has been extended to include 3
extra flags that indicate if the packet has full
or pseudo checksums. This is a WIP.
The WINDIVERT_HELPER_NO_REPLACE flag tells WinDivertHelperCalcChecksums not to
recalculate and replace non-zero checksum fields. This is useful for
reconstructing the checksums for packets returned by WinDivertRecv(), where
all non-zero checksum fields are already valid. This allows WinDivert1.2
to achieve similar efficiency as WinDivert1.1, where checksums were calculated
by the driver.
Note that for modified packets, the WINDIVERT_HELPER_NO_REPLACE flag should
not be used, as all checksums need to be recalculated from scratch anyway.
* WinDivert sublayers are created and inserted when the driver is loaded.
* All WinDivert callouts are installed at the same sublayer.
- Clean-up the implementation of priorities.
- Re-introduce deep copying for SNIFF mode. This avoids referencing the
sniffed packets.
- Fix-up the netfilter example:
* Don't send RSTs to RST/FINs, this can start a RST war.
* Don't inject ICMP outbound - this may not be a problem despite 1233 errors.
basil00