- inbounds/outbound now work for SOCKET layer.
- passthru.exe now uses MTU_MAX to prevent 122
errors.
- Further header parsing code hardening.
- Fix bug where Reserved2 was not zeroed.
This flag only affects inbound packets at the
WINDIVERT_LAYER_NETWORK layer.
If set, the handle will capture IP fragments,
but not reassembled IP packets.
If unset (the default), the handle will capture
reassembled IP packets, but not IP fragments.
- Fix broken WinDivertCondExecFilter(). This
caused some callouts to be needlessly installed.
- Fix broken WinDivertByteSwap128().
- Rename "Ipv6" -> "IPv6" to keep API consistent.
- Samples now use correct MTU.
Currently the VS build system targets VS2015, but
may also work for later versions (not tested).
To use:
- Download & install VS2015.
- Install WDK.
- Open a Developer Command Prompt.
- Run the msvc-build.bat script.
- Add "length" for total packet length.
- Add "timestamp" for timestamp filtering.
- All filter language numbers are now signed.
- Add new macros: TRUE, FALSE, TCP, UDP, ICMP &
ICMPV6.
- Future-proof the WINDIVERT_FILTER struct.
- Socket (& flow) events are now associated with
a endpointId/parentEndpointId pair that allows
the tracking of socket operations.
- A single socket CLOSE event replaces the UNBIND
and DISCONNECT events.
- A new flag addr.Sniffed indicates if the event
was sniffed or not. Some events (CLOSE) are
always sniffed, regardless of the flags.
- All filter language numbers are now 128bit.
- socketdump.exe can now optionally block events.
- Make WinDivertRecv() and WinDivertSend() arg
ordering match the Ex versions.
- Put the WinDivertHelperParsePacket() protocol
arg after the IP headers.
- WinDivert service handling is now protected by
a mutex.
- Debug the "uninstall" command for windivertctl.
It can now uninstall the WinDivert driver &
not leave the WinDivert service in a "pending"
state.
- Document WinDivert performance tips.
(1) WinDivert will now reference the PROCESS that
opened the handle, and will not deref until the
handle is closed & all corresponding REFLECT
events have been completed. This means the OPEN
REFLECT event will always return a valid PID.
(2) The packet queue size now also accounts for
internal overheads.
- Add UNBIND/DISCONNECT events to the SOCKET
layer. These events can only be sniffed.
- Remove the RECV_PARTIAL flag. The user
application can just ignore the error code
instead.
- WINDIVERT_ADDRESS is now 64bytes. Some extra
padding added for future-proofing.
- Ignore SOCKET-layer REAUTHORIZE.
- The REFLECT layer returns the filter object
directly (no IPv4 "pseudo" packet).
The idea is to make future versions of the
WinDivert DLL compatible with older SYS and vice
versa.
The interface has also been streamlined so less
system calls are required when the handle is first
opened.
This function decrements the ip.TTL or
ipv6.HopLimit field. For ipv4, it also updates
the checksum.
Also:
- Make WinDivertHelperParsePacket() work on a
single packet unless the pNext parameters are
provided.
- Update documentation.
- Revert batching for
WinDivertHelperCalcChecksums().
All non-ParsePacket helper functions support a
single packet only. This is much simpler.
- WinDivertHelperCalcChecksums() now returns a
simple BOOL.
- More WinDivertHelper*() functions set the error
code.
basil00