- Add "length" for total packet length.
- Add "timestamp" for timestamp filtering.
- All filter language numbers are now signed.
- Add new macros: TRUE, FALSE, TCP, UDP, ICMP &
ICMPV6.
- Future-proof the WINDIVERT_FILTER struct.
- Socket (& flow) events are now associated with
a endpointId/parentEndpointId pair that allows
the tracking of socket operations.
- A single socket CLOSE event replaces the UNBIND
and DISCONNECT events.
- A new flag addr.Sniffed indicates if the event
was sniffed or not. Some events (CLOSE) are
always sniffed, regardless of the flags.
- All filter language numbers are now 128bit.
- socketdump.exe can now optionally block events.
- Make WinDivertRecv() and WinDivertSend() arg
ordering match the Ex versions.
- Put the WinDivertHelperParsePacket() protocol
arg after the IP headers.
- WinDivert service handling is now protected by
a mutex.
- Debug the "uninstall" command for windivertctl.
It can now uninstall the WinDivert driver &
not leave the WinDivert service in a "pending"
state.
- Document WinDivert performance tips.
- Add UNBIND/DISCONNECT events to the SOCKET
layer. These events can only be sniffed.
- Remove the RECV_PARTIAL flag. The user
application can just ignore the error code
instead.
- WINDIVERT_ADDRESS is now 64bytes. Some extra
padding added for future-proofing.
- Ignore SOCKET-layer REAUTHORIZE.
- The REFLECT layer returns the filter object
directly (no IPv4 "pseudo" packet).
Adds a new SOCKET layer for monitoring socket
events, such as BIND, LISTEN, CONNECT,
and ACCEPT. These events occur before the
flow is established (and unlike the FLOW layer)
it is possible to block/drop SOCKET events.
Otherwise, this layer is very similar to the
FLOW layer, so the PID is available and injection
is not possible. This commit should be
considered to be a WIP.
Other changes:
- New socketdump.exe sample. Prints socket
events.
- Improve IPv6 address parsing.
- New helper functions:
* WinDivertHelperFormatIPv4Address
* WinDivertHelperFormatIPv6Address
- Fix REFLECT bugs.
- The network 5-tuple can now be accessed at
the NETWORK layer.
- Various cleanups.
basil00