- Make WinDivertRecv() and WinDivertSend() arg
ordering match the Ex versions.
- Put the WinDivertHelperParsePacket() protocol
arg after the IP headers.
- WinDivert service handling is now protected by
a mutex.
- Debug the "uninstall" command for windivertctl.
It can now uninstall the WinDivert driver &
not leave the WinDivert service in a "pending"
state.
- Document WinDivert performance tips.
(1) WinDivert will now reference the PROCESS that
opened the handle, and will not deref until the
handle is closed & all corresponding REFLECT
events have been completed. This means the OPEN
REFLECT event will always return a valid PID.
(2) The packet queue size now also accounts for
internal overheads.
- Add UNBIND/DISCONNECT events to the SOCKET
layer. These events can only be sniffed.
- Remove the RECV_PARTIAL flag. The user
application can just ignore the error code
instead.
- WINDIVERT_ADDRESS is now 64bytes. Some extra
padding added for future-proofing.
- Ignore SOCKET-layer REAUTHORIZE.
- The REFLECT layer returns the filter object
directly (no IPv4 "pseudo" packet).
The idea is to make future versions of the
WinDivert DLL compatible with older SYS and vice
versa.
The interface has also been streamlined so less
system calls are required when the handle is first
opened.
This function decrements the ip.TTL or
ipv6.HopLimit field. For ipv4, it also updates
the checksum.
Also:
- Make WinDivertHelperParsePacket() work on a
single packet unless the pNext parameters are
provided.
- Update documentation.
- Revert batching for
WinDivertHelperCalcChecksums().
All non-ParsePacket helper functions support a
single packet only. This is much simpler.
- WinDivertHelperCalcChecksums() now returns a
simple BOOL.
- More WinDivertHelper*() functions set the error
code.
- addr.Pseudo*Checksum flags replaced by simpler
addr.*Checksum flags.
- WinDivertHelperParsePacket() can now handle
batched packets.
- WinDivertHelperParsePacket() can now return the
transport protocol.
- WinDivertHelperCalcChecksums() can now handle
batched packets.
- WinDivertHelperCalcChecksums() now sets address
checksum flags that were calculated.
- A bunch of WINDIVERT_* macros have been moved
to windivert.h for windivert_device.h.
WinDivert will now process some packets in-band
if the queue is empty and there is a read
request. When activated, this saves 1xcopy,
1x(de)allocation, and 1xcontext-switch, and
reduces latency from ~60usec to ~20usec on my
test system.
- Adds 3 new "pseudo-random" filter expressions:
* random8 (8bit)
* random16 (16bit)
* random32 (32bit)
Not really "random", but these values are based
on a hash of the packet headers & timestamp.
These are useful for traffic sampling, e.g.:
"random8 < 100" matches ~39% of all packets.
- Add new WinDivertHelperHashPacket() helper
function. The algorithm is an xxHash variant.
This function allows the user application to
"shutdown" a handle in anticipation of a
call to WinDivertClose(). When a handle has
been shutdown, new packets will no longer be
queued. However, existing queued packets can
still be read by WinDivertRecv(). When the
queue is emptied, WinDivertRecv() will fail
with ERROR_NO_DATA.
The WinDivertShutdown() function is analogous
to the shutdown() socket function.
This change also simplifies events.
Adds the follow terms to the filter language:
- packet[idx]: 8bit packet value at idx.
- packet16[idx]: 16bit packet value at idx.
- packet32[idx]: 32bit packet value at idx.
- PROTO.Payload[idx]: 8bit payload value at idx.
- PROTO.Payload16[idx]: 16bit payload value at
idx.
- PROTO.Payload32[idx]: 32bit payload value at
idx.
where PROTO is {tcp,udp}.
16 and 32bit values assume network byte ordering.
The index may be:
- An undecorated integer, in which case the
packet or payload is treated as a 8/16/32bit
value array, similar to C arrays.
- A 'b' decorated integer, (e.g, packet32[17b]),
in which case the integer is interpreted as a
byte offset.
- A negative (un)decorated integer, in which
case indexing begins at the *end* of the
packet or payload. E.g., packet32[-1] is the
last 32bits of the packet.
If the index is out-of-bounds, then the test
is deemed to be equivalent to "false".
basil00