basil00
2e1bfa8ca5
This is a major update designed to modernize the WinDivert driver, including optimizations, design improvements and bug fixes. The new version has not been fully tested and should be considered **UNSTABLE**. - Most of the packet processing is now (almost) fully out-of-band. This is a good since the classify function runs at DISPATCH_LEVEL. The driver will still try to match at least one packet before moving the work out-of-band. - Re-injected non-matching packets are now clones rather than copies. - Queued packets are still copied. This is because the driver should avoid keeping a reference to the original packet for very long. Since we do not trust the user application to handle the packet in a timely fashion, it is better to copy rather than keep a reference. That said, the driver now implements an optimization where it will service a read request immediately if possible (saving 1 packet copy). - SNIFF mode also now works differently. Previously, SNIFF mode would not block the original packet. However, this is problematic under the new design since WinDivert cannot permit the packet and retain a reference to it at the same time. The new version will block & absorb the original packet and re-inject a clone out-of-band. - Packet time management has been replaced. Previously, a timer was used to periodically wake up a function that would sweep away expired packets. The new version explicitly timestamps every packet, and expired packets are cleaned up by the read service routine. - The context->filter is now deallocated in the destroy callback to avoid possible a race condition with the callout function. It is unclear if this is really necessary, however.
WinDivert 1.2: Windows Packet Divert
====================================
1. Introduction
---------------
Windows Packet Divert (WinDivert) is a user-mode packet capture-and-divert
package for Windows Vista, Windows 2008, Windows 7, Windows 8 and Windows 10.
WinDivert allows user-mode programs to capture/modify/drop network packets
sent to/from the Windows network stack.
In summary, WinDivert can
- capture network packets
- filter/drop network packets
- sniff network packets
- (re)inject network packets
- modify network packets
WinDivert can be used to implement user-mode packet filters, packet sniffers,
firewalls, NAT, VPNs, tunneling applications, etc., etc..
The features of WinDivert include:
- packet interception, sniffing, or dropping modes
- support for loopback (localhost) traffic
- full IPv6 support
- network layer
- simple yet powerful API
- high-level filtering language
- filter priorities
- freely available under the terms of the GNU Lesser General Public
License (LGPL)
For more information about WinDivert, see doc/windivert.html
2. Similar Packages
-------------------
WinDivert is similar to divert sockets in FreeBSD/MacOS, NETLINK sockets in
Linux, and some commercial packet capturing packages such as WinPkFilter for
Windows. The design of WinDivert is largely influenced by FreeBSD's divert
sockets.
WinDivert in packet-sniffing mode is similar to Winpcap. Unlike Winpcap,
WinDivert fully supports capturing loopback traffic. Furthermore, WinDivert
supports packet interception, which is not supported in Winpcap.
3. Architecture
---------------
The basic architecture of WinDivert is as follows:
+-----------------+
| |
+------->| PROGRAM |--------+
| | (WinDivert.dll) | |
| +-----------------+ |
| | (3) re-injected
| (2a) matching packet | packet
| |
| |
[user mode] | |
....................|...................................|...................
[kernel mode] | |
| |
| |
+---------------+ +----------------->
(1) packet | | (2b) non-matching packet
------------>| WinDivert.sys |-------------------------------------------->
| |
+---------------+
The WinDivert.sys driver is inserted below the Windows network stack. The
following then happens
(1) a new packet enters the network stack and is intercepted by WinDivert.sys
(2a) if the packet matches a PROGRAM-defined filter, it is diverted. The
PROGRAM reads the packet with a call to the WinDivertRecv() function.
(2b) if the packet does not match the filter, the packet is permitted to
continue as normal.
(3) PROGRAM either drops, modifies, or re-injects the packet. If the
(modified) packet is re-injected, via a call to WinDivertSend(), it is
inserted back into the Windows network stack.
4. Building
-----------
(1) In a WinDDK build environment, run the command:
wddk-build.bat
(2) [OPTIONAL Visual Studio 2012 support] In a VS2012 command prompt, run the
command:
msvc-build.bat
(3) [OPTIONAL MinGW support] In Linux with MinGW a cross-compiler, run the
command:
sh mingw-build.sh
For more detailed build instructions, see doc\windivert.html
5. License
----------
This package is distributed under the GNU Lesser General Public License
(LGPL) Version 3. See LICENSE for more information.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>
6. About
--------
WinDivert was written by basil.
For further information, or bug reports, please contact
basil AT reqrypt DOT org
The homepage for WinDivert is
https://reqrypt.org/windivert.html
The source code for WinDivert is hosted by GitHub at
https://github.com/basil00/Divert