divert

type Address ¶

type Address struct {
	Timestamp int64

	Flags uint8
	// contains filtered or unexported fields
}

Address is ...

func (a *Address) Ethernet() *Ethernet

func (a *Address) Event() Event

func (a *Address) Flow() *Flow

func (a *Address) Layer() Layer

func (a *Address) Length() uint32

func (a *Address) Network() *Network

func (a *Address) Reflect() *Reflect

func (a *Address) SetEvent(event Event)

func (a *Address) SetLayer(layer Layer)

func (a *Address) SetLength(n uint32)

func (a *Address) Socket() *Socket

type CtlCode ¶

type CtlCode uint32

func (c CtlCode) String() string

type Error ¶

type Error windows.Errno

Error is ...

func (e Error) Error() string

type Ethernet ¶

type Ethernet struct {
	InterfaceIndex    uint32
	SubInterfaceIndex uint32
	// contains filtered or unexported fields
}

Ethernet is ...

type Event ¶

type Event int

const (
	EventNetworkPacket   Event = 0
	EventFlowEstablished Event = 1
	EventFlowDeleted     Event = 2
	EventSocketBind      Event = 3
	EventSocketConnect   Event = 4
	EventSocketListen    Event = 5
	EventSocketAccept    Event = 6
	EventSocketClose     Event = 7
	EventReflectOpen     Event = 8
	EventReflectClose    Event = 9
)

func (e Event) String() string

type Flow ¶

type Flow struct {
	EndpointID       uint64
	ParentEndpointID uint64
	ProcessID        uint32
	LocalAddress     [16]uint8
	RemoteAddress    [16]uint8
	LocalPort        uint16
	RemotePort       uint16
	Protocol         uint8
	// contains filtered or unexported fields
}

Flow is ... The WINDIVERT_LAYER_FLOW layer captures information about network flow establishment/deletion events. Here, a flow represents either (1) a TCP connection, or (2) an implicit "flow" created by the first sent/received packet for non-TCP traffic, e.g., UDP. Old flows are deleted when the corresponding connection is closed (for TCP), or based on an activity timeout (non-TCP). Flow-related events can be captured, but not blocked nor injected. Process ID information is also available at this layer. Due to technical limitations, the WINDIVERT_LAYER_FLOW layer cannot capture flow events that occurred before the handle was opened.

type Handle ¶

type Handle struct {
	sync.Mutex
	windows.Handle

	Status uint16
	// contains filtered or unexported fields
}

Handle is ...

func Open(filter string, layer Layer, priority int16, flags uint64) (h *Handle, err error)

func (h *Handle) Close() error

func (h *Handle) GetParam(p Param) (uint64, error)

func (h *Handle) Packets() (chan *Packet, error)

func (h *Handle) Recv(buffer []byte, address *Address) (uint, error)

func (h *Handle) RecvEx(buffer []byte, address []Address) (uint, uint, error)

func (h *Handle) Send(buffer []byte, address *Address) (uint, error)

func (h *Handle) SendEx(buffer []byte, address []Address) (uint, error)

func (h *Handle) SetParam(p Param, v uint64) error

func (h *Handle) Shutdown(how Shutdown) error

func (h *Handle) StopService() (err error)

type IoCtl ¶

type IoCtl struct {
	B1, B2, B3, B4 uint32
}

type Layer ¶

type Layer int

const (
	LayerNetwork        Layer = 0
	LayerNetworkForward Layer = 1
	LayerFlow           Layer = 2
	LayerSocket         Layer = 3
	LayerReflect        Layer = 4
)

func (l Layer) String() string

type Network ¶

type Network struct {
	InterfaceIndex    uint32
	SubInterfaceIndex uint32
	// contains filtered or unexported fields
}

Network is ... The WINDIVERT_LAYER_NETWORK and WINDIVERT_LAYER_NETWORK_FORWARD layers allow the user application to capture/block/inject network packets passing to/from (and through) the local machine. Due to technical limitations, process ID information is not available at these layers.

type Packet ¶

type Packet struct {
	Raw   []byte
	Addr  *Address
	IpHdr header.IPHeader
}

func NewPacket(buff []byte, addr *Address) *Packet

func (p *Packet) DstIP() net.IP

func (p *Packet) SetDstIP(ip net.IP)

func (p *Packet) SetSrcIP(ip net.IP)

func (p *Packet) SrcIP() net.IP

func (p *Packet) String() string

type Param ¶

type Param int

const (
	QueueLength  Param = 0
	QueueTime    Param = 1
	QueueSize    Param = 2
	VersionMajor Param = 3
	VersionMinor Param = 4
)

func (p Param) String() string

type Reflect ¶

type Reflect struct {
	TimeStamp int64
	ProcessID uint32

	Flags    uint64
	Priority int16
	// contains filtered or unexported fields
}

Reflect is ... Finally, the WINDIVERT_LAYER_REFLECT layer can capture events relating to WinDivert itself, such as when another process opens a new WinDivert handle, or closes an old WinDivert handle. WinDivert events can be captured but not injected nor blocked. Process ID information (of the process responsible for opening the WinDivert handle) is available at this layer. This layer also returns data in the form of an "object" representation of the filter string used to open the handle. The object representation can be converted back into a human-readable filter string using the WinDivertHelperFormatFilter() function. This layer can also capture events that occurred before the handle was opened. This layer cannot capture events related to other WINDIVERT_LAYER_REFLECT-layer handles.

func (r *Reflect) Layer() Layer

type Shutdown ¶

type Shutdown int

const (
	ShutdownRecv Shutdown = 0
	ShutdownSend Shutdown = 1
	ShutdownBoth Shutdown = 2
)

func (s Shutdown) String() string

type Socket ¶

type Socket struct {
	EndpointID       uint64
	ParentEndpointID uint64
	ProcessID        uint32
	LocalAddress     [16]uint8
	RemoteAddress    [16]uint8
	LocalPort        uint16
	RemotePort       uint16
	Protocol         uint8
	// contains filtered or unexported fields
}

Socket is ... The WINDIVERT_LAYER_SOCKET layer can capture or block events corresponding to socket operations, such as bind(), connect(), listen(), etc., or the termination of socket operations, such as a TCP socket disconnection. Unlike the flow layer, most socket-related events can be blocked. However, it is not possible to inject new or modified socket events. Process ID information (of the process responsible for the socket operation) is available at this layer. Due to technical limitations, this layer cannot capture events that occurred before the handle was opened.