|
|
|
@ -12,6 +12,94 @@ extern "C"
|
|
|
|
|
#include <windivert.h>
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
namespace
|
|
|
|
|
{
|
|
|
|
|
using namespace oxen::log::literals;
|
|
|
|
|
|
|
|
|
|
std::string
|
|
|
|
|
windivert_addr_to_string(const WINDIVERT_ADDRESS& addr)
|
|
|
|
|
{
|
|
|
|
|
std::string layer_str{};
|
|
|
|
|
std::string ifidx_str{};
|
|
|
|
|
switch (addr.Layer)
|
|
|
|
|
{
|
|
|
|
|
case WINDIVERT_LAYER_NETWORK:
|
|
|
|
|
layer_str = "WINDIVERT_LAYER_NETWORK";
|
|
|
|
|
ifidx_str =
|
|
|
|
|
"Network: [IfIdx: {}, SubIfIdx: {}]"_format(addr.Network.IfIdx, addr.Network.SubIfIdx);
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_LAYER_NETWORK_FORWARD:
|
|
|
|
|
layer_str = "WINDIVERT_LAYER_NETWORK_FORWARD";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_LAYER_FLOW:
|
|
|
|
|
layer_str = "WINDIVERT_LAYER_FLOW";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_LAYER_SOCKET:
|
|
|
|
|
layer_str = "WINDIVERT_LAYER_SOCKET";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_LAYER_REFLECT:
|
|
|
|
|
layer_str = "WINDIVERT_LAYER_REFLECT";
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
layer_str = "unknown";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string event_str{};
|
|
|
|
|
switch (addr.Event)
|
|
|
|
|
{
|
|
|
|
|
case WINDIVERT_EVENT_NETWORK_PACKET:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_NETWORK_PACKET";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_FLOW_ESTABLISHED:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_FLOW_ESTABLISHED";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_FLOW_DELETED:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_FLOW_DELETED";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_SOCKET_BIND:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_SOCKET_BIND";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_SOCKET_CONNECT:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_SOCKET_CONNECT";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_SOCKET_LISTEN:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_SOCKET_LISTEN";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_SOCKET_ACCEPT:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_SOCKET_ACCEPT";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_SOCKET_CLOSE:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_SOCKET_CLOSE";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_REFLECT_OPEN:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_REFLECT_OPEN";
|
|
|
|
|
break;
|
|
|
|
|
case WINDIVERT_EVENT_REFLECT_CLOSE:
|
|
|
|
|
event_str = "WINDIVERT_EVENT_REFLECT_CLOSE";
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
event_str = "unknown";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return fmt::format(
|
|
|
|
|
"Windivert WINDIVERT_ADDRESS -- Timestamp: {}, Layer: {}, Event: {}, Sniffed: {}, "
|
|
|
|
|
"Outbound: {}, Loopback: {}, Imposter: {}, IPv6: {}, IPChecksum: {}, TCPChecksum: {}, "
|
|
|
|
|
"UDPChecksum: {}, {}",
|
|
|
|
|
addr.Timestamp,
|
|
|
|
|
layer_str,
|
|
|
|
|
event_str,
|
|
|
|
|
addr.Sniffed ? "true" : "false",
|
|
|
|
|
addr.Outbound ? "true" : "false",
|
|
|
|
|
addr.Loopback ? "true" : "false",
|
|
|
|
|
addr.Impostor ? "true" : "false",
|
|
|
|
|
addr.IPv6 ? "true" : "false",
|
|
|
|
|
addr.IPChecksum ? "true" : "false",
|
|
|
|
|
addr.TCPChecksum ? "true" : "false",
|
|
|
|
|
addr.UDPChecksum ? "true" : "false",
|
|
|
|
|
ifidx_str);
|
|
|
|
|
}
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
namespace llarp::win32
|
|
|
|
|
{
|
|
|
|
|
static auto logcat = log::Cat("windivert");
|
|
|
|
@ -23,6 +111,7 @@ namespace llarp::win32
|
|
|
|
|
decltype(::WinDivertOpen)* open = nullptr;
|
|
|
|
|
decltype(::WinDivertClose)* close = nullptr;
|
|
|
|
|
decltype(::WinDivertShutdown)* shutdown = nullptr;
|
|
|
|
|
decltype(::WinDivertHelperCalcChecksums)* calc_checksum = nullptr;
|
|
|
|
|
decltype(::WinDivertSend)* send = nullptr;
|
|
|
|
|
decltype(::WinDivertRecv)* recv = nullptr;
|
|
|
|
|
decltype(::WinDivertHelperFormatIPv4Address)* format_ip4 = nullptr;
|
|
|
|
@ -41,6 +130,7 @@ namespace llarp::win32
|
|
|
|
|
"WinDivertOpen", open,
|
|
|
|
|
"WinDivertClose", close,
|
|
|
|
|
"WinDivertShutdown", shutdown,
|
|
|
|
|
"WinDivertHelperCalcChecksums", calc_checksum,
|
|
|
|
|
"WinDivertSend", send,
|
|
|
|
|
"WinDivertRecv", recv,
|
|
|
|
|
"WinDivertHelperFormatIPv4Address", format_ip4,
|
|
|
|
@ -106,18 +196,28 @@ namespace llarp::win32
|
|
|
|
|
throw win32::error{
|
|
|
|
|
err, fmt::format("failed to receive packet from windivert (code={})", err)};
|
|
|
|
|
}
|
|
|
|
|
log::trace(logcat, "got packet of size {}B", sz);
|
|
|
|
|
pkt.resize(sz);
|
|
|
|
|
|
|
|
|
|
log::trace(logcat, "got packet of size {}B", sz);
|
|
|
|
|
log::trace(logcat, "{}", windivert_addr_to_string(addr));
|
|
|
|
|
return Packet{std::move(pkt), std::move(addr)};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
send_packet(const Packet& w_pkt) const
|
|
|
|
|
send_packet(Packet w_pkt) const
|
|
|
|
|
{
|
|
|
|
|
const auto& pkt = w_pkt.pkt;
|
|
|
|
|
const auto* addr = &w_pkt.addr;
|
|
|
|
|
auto& pkt = w_pkt.pkt;
|
|
|
|
|
auto* addr = &w_pkt.addr;
|
|
|
|
|
|
|
|
|
|
addr->Outbound = !addr->Outbound; // re-used from recv, so invert direction
|
|
|
|
|
|
|
|
|
|
log::trace(logcat, "send dns packet of size {}B", pkt.size());
|
|
|
|
|
log::trace(logcat, "{}", windivert_addr_to_string(w_pkt.addr));
|
|
|
|
|
|
|
|
|
|
UINT sz{};
|
|
|
|
|
// recalc IP packet checksum in case it needs it
|
|
|
|
|
wd::calc_checksum(pkt.data(), pkt.size(), addr, 0);
|
|
|
|
|
|
|
|
|
|
if (!wd::send(m_Handle, pkt.data(), pkt.size(), &sz, addr))
|
|
|
|
|
throw win32::error{"windivert send failed"};
|
|
|
|
|
}
|
|
|
|
|