86 "Error creating thread %s: you do not have support for WinDivert "
87 "enabled; please recompile with --enable-windivert",
94 typedef struct WinDivertThreadVars_ {
95 WinDivertHandle filter_handle;
99 int64_t qpc_start_time;
100 int64_t qpc_start_count;
101 int64_t qpc_freq_usec;
105 bool offload_enabled;
108 } WinDivertThreadVars;
110 #define WINDIVERT_MAX_QUEUE 16
111 static WinDivertThreadVars g_wd_tv[WINDIVERT_MAX_QUEUE];
112 static WinDivertQueueVars g_wd_qv[WINDIVERT_MAX_QUEUE];
113 static uint16_t g_wd_num = 0;
116 void *WinDivertGetThread(
int n)
121 return (
void *)&g_wd_tv[n];
124 void *WinDivertGetQueue(
int n)
129 return (
void *)&g_wd_qv[n];
133 #define ERROR_INVALID_IMAGE_HASH 577L
134 #define ERROR_DATA_NOT_ACCEPTED 592L
140 static const char *WinDivertGetErrorString(DWORD error_code)
142 switch (error_code) {
144 case ERROR_FILE_NOT_FOUND:
145 return "The driver files WinDivert32.sys or WinDivert64.sys were "
147 case ERROR_ACCESS_DENIED:
148 return "Suricata must be run with Administrator privileges.";
149 case ERROR_INVALID_PARAMETER:
150 return "The WinDivert packet filter string is invalid.";
151 case ERROR_INVALID_IMAGE_HASH:
152 return "The WinDivert32.sys or WinDivert64.sys driver does not "
153 "have a valid digital signature, or your copy of Windows is "
154 "not up-to-date. Windows 7 and Server 2008 users need to "
155 "run Windows Update or install the following patch from "
156 "Microsoft: http://support.microsoft.com/kb/2949927";
157 case ERROR_DRIVER_BLOCKED:
158 return "This error occurs for various reasons, including: "
159 "attempting to load the 32-bit WinDivert.sys driver on a "
160 "64-bit system (or vice versa); the WinDivert.sys driver is "
161 "blocked by security software; or you are using a "
162 "virtualization environment that does not support "
164 case EPT_S_NOT_REGISTERED:
165 return "This error occurs when the Base Filtering Engine service "
166 "has been disabled.";
167 case ERROR_PROC_NOT_FOUND:
168 return "The error may occur for Windows Vista users. The "
169 "solution is to install the following patch from Microsoft: "
170 "http://support.microsoft.com/kb/2761494.";
173 case ERROR_HOST_UNREACHABLE:
174 return "This error occurs when an impostor packet (with "
175 "pAddr->Impostor set to 1) is injected and the ip.TTL or "
176 "ipv6.HopLimit field goes to zero. This is a defense of "
177 "last resort against infinite loops caused by impostor "
179 case ERROR_DATA_NOT_ACCEPTED:
180 return "This error is returned when the user application attempts "
181 "to inject a malformed packet. It may also be returned for "
182 "valid inbound packets, and the Windows TCP/IP stack "
183 "rejects the packet for some reason.";
185 return "The underlying cause of this error is unknown. However, "
186 "this error usually occurs when certain kinds of "
187 "anti-virus/firewall/security software is installed, and "
188 "the error message usually resolves once the offending "
189 "program is uninstalled. This suggests a software "
190 "compatibility problem.";
199 #define WinDivertLogError(err_code) \
201 const char *win_err_str = Win32GetErrorString((err_code), NULL); \
202 SCLogError(SC_ERR_WINDIVERT_GENERIC, \
203 "WinDivertOpen failed, error %" PRId32 " (0x%08" PRIx32 \
205 (uint32_t)(err_code), (uint32_t)(err_code), win_err_str, \
206 WinDivertGetErrorString(err_code)); \
207 LocalFree((LPVOID)win_err_str); \
214 static void WinDivertInitQPCValues(WinDivertThreadVars *wd_tv)
219 (void)QueryPerformanceCounter((LARGE_INTEGER *)&wd_tv->qpc_start_count);
221 wd_tv->qpc_start_time =
222 (uint64_t)now.tv_sec * (1000 * 1000) + (uint64_t)now.tv_usec;
224 (
void)QueryPerformanceFrequency((LARGE_INTEGER *)&wd_tv->qpc_freq_usec);
226 wd_tv->qpc_freq_usec /= 1000 * 1000;
232 static struct timeval WinDivertTimestampToTimeval(WinDivertThreadVars *wd_tv,
233 INT64 timestamp_count)
237 int64_t qpc_delta = (int64_t)timestamp_count - wd_tv->qpc_start_count;
239 wd_tv->qpc_start_time + (qpc_delta / wd_tv->qpc_freq_usec);
241 ts.tv_sec = (long)(unix_usec / (1000 * 1000));
242 ts.tv_usec = (long)(unix_usec - (int64_t)
ts.tv_sec * (1000 * 1000));
256 int WinDivertRegisterQueue(
bool forward,
char *filter_str)
261 WINDIVERT_LAYER layer =
262 forward ? WINDIVERT_LAYER_NETWORK_FORWARD : WINDIVERT_LAYER_NETWORK;
265 const char *error_str;
267 bool valid = WinDivertHelperCheckFilter(filter_str, layer, &error_str,
272 "Invalid filter \"%s\" supplied to WinDivert: %s at position "
274 filter_str, error_str, error_pos);
281 if (g_wd_num >= WINDIVERT_MAX_QUEUE) {
283 "Too many WinDivert queues specified %" PRId32
"", g_wd_num);
289 memset(&g_wd_tv, 0,
sizeof(g_wd_tv));
290 memset(&g_wd_qv, 0,
sizeof(g_wd_qv));
294 WinDivertThreadVars *wd_tv = &g_wd_tv[g_wd_num];
295 wd_tv->thread_num = g_wd_num;
298 WinDivertQueueVars *wd_qv = &g_wd_qv[g_wd_num];
299 wd_qv->queue_num = g_wd_num;
301 WinDivertInitQPCValues(wd_tv);
304 size_t filter_len = strlen(filter_str);
306 strlcpy(wd_qv->filter_str, filter_str,
sizeof(wd_qv->filter_str));
307 if (filter_len > copy_len) {
309 "Queue length exceeds storage by %" PRId32
" bytes",
310 (int32_t)(filter_len - copy_len));
315 wd_qv->layer = layer;
331 wd_num_str[
sizeof(wd_num_str) - 1] = 0;
332 snprintf(wd_num_str,
sizeof(wd_num_str),
"%" PRId16
"", g_wd_num);
336 SCLogDebug(
"Queue %" PRId16
" registered", wd_qv->queue_num);
347 void ReceiveWinDivertThreadExitStats(
ThreadVars *,
void *);
362 static TmEcode WinDivertCloseHelper(WinDivertThreadVars *);
364 static TmEcode WinDivertCollectFilterDevices(WinDivertThreadVars *,
365 WinDivertQueueVars *);
366 static bool WinDivertIfaceMatchFilter(
const char *filter_string,
int if_index);
367 static void WinDivertDisableOffloading(WinDivertThreadVars *);
368 static void WinDivertRestoreOffloading(WinDivertThreadVars *);
374 tm_ptr->
name =
"ReceiveWinDivert";
375 tm_ptr->
ThreadInit = ReceiveWinDivertThreadInit;
386 tm_ptr->
name =
"VerdictWinDivert";
387 tm_ptr->
ThreadInit = VerdictWinDivertThreadInit;
388 tm_ptr->
Func = VerdictWinDivert;
396 tm_ptr->
name =
"DecodeWinDivert";
397 tm_ptr->
ThreadInit = DecodeWinDivertThreadInit;
398 tm_ptr->
Func = DecodeWinDivert;
410 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)data;
411 wd_tv->slot = ((
TmSlot *)slot)->slot_next;
433 WinDivertQueueVars *wd_qv = WinDivertGetQueue(wd_tv->thread_num);
445 "PacketGetFromQueueOrAlloc() - failed to obtain Packet buffer");
453 bool success =
false;
455 if (wd_tv->offload_enabled) {
460 WinDivertRecv(wd_tv->filter_handle, p->
ext_pkt,
465 &p->windivert_v.addr, &pktlen);
480 SCLogInfo(
"WinDivertRecv failed: error %" PRIu32
"",
481 (uint32_t)(GetLastError()));
486 p->
ts = WinDivertTimestampToTimeval(wd_tv, p->windivert_v.addr.Timestamp);
487 p->windivert_v.thread_num = wd_tv->thread_num;
500 if (TmThreadsSlotProcessPkt(
tv, wd_tv->slot, p) !=
TM_ECODE_OK) {
522 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)initdata;
529 WinDivertQueueVars *wd_qv = WinDivertGetQueue(wd_tv->thread_num);
538 if (wd_qv->filter_handle != NULL &&
539 wd_qv->filter_handle != INVALID_HANDLE_VALUE) {
545 if (WinDivertCollectFilterDevices(wd_tv, wd_qv) ==
TM_ECODE_OK) {
546 WinDivertDisableOffloading(wd_tv);
549 "Failed to obtain network devices for WinDivert filter");
555 wd_qv->filter_handle = WinDivertOpen(wd_qv->filter_str, wd_qv->layer,
556 wd_qv->priority, wd_qv->flags);
557 if (wd_qv->filter_handle == INVALID_HANDLE_VALUE) {
558 WinDivertLogError(GetLastError());
565 wd_tv->filter_handle = wd_qv->filter_handle;
582 static TmEcode WinDivertCollectFilterDevices(WinDivertThreadVars *wd_tv,
583 WinDivertQueueVars *wd_qv)
588 IP_ADAPTER_ADDRESSES *if_info_list;
589 DWORD err = (DWORD)Win32GetAdaptersAddresses(&if_info_list);
590 if (err != NO_ERROR) {
595 for (IP_ADAPTER_ADDRESSES *if_info = if_info_list; if_info != NULL;
596 if_info = if_info->Next) {
598 if (WinDivertIfaceMatchFilter(wd_qv->filter_str, if_info->IfIndex)) {
599 SCLogConfig(
"Found adapter %s matching WinDivert filter %s",
600 if_info->AdapterName, wd_qv->filter_str);
603 if (new_ldev == NULL) {
608 if (new_ldev->
dev == NULL) {
614 SCLogDebug(
"Adapter %s does not match WinDivert filter %s",
615 if_info->AdapterName, wd_qv->filter_str);
628 static bool WinDivertIfaceMatchFilter(
const char *filter_string,
int if_index)
632 WINDIVERT_ADDRESS if_addr = {};
633 if_addr.IfIdx = if_index;
635 uint8_t dummy[4] = {4, 4, 4, 4};
637 match = WinDivertHelperEvalFilter(filter_string, WINDIVERT_LAYER_NETWORK,
638 dummy,
sizeof(dummy), &if_addr);
640 int err = GetLastError();
643 "Failed to evaluate filter: 0x%" PRIx32, err);
655 static void WinDivertDisableOffloading(WinDivertThreadVars *wd_tv)
662 wd_tv->offload_enabled =
true;
666 wd_tv->offload_enabled =
true;
677 static void WinDivertRestoreOffloading(WinDivertThreadVars *wd_tv)
696 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)data;
698 SCReturnCT(WinDivertCloseHelper(wd_tv),
"TmEcode");
708 void ReceiveWinDivertThreadExitStats(
ThreadVars *
tv,
void *data)
712 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)data;
713 WinDivertQueueVars *wd_qv = WinDivertGetQueue(wd_tv->thread_num);
721 SCLogInfo(
"(%s) Packets %" PRIu32
", Bytes %" PRIu64
", Errors %" PRIu32
"",
722 tv->
name, wd_qv->pkts, wd_qv->bytes, wd_qv->errs);
723 SCLogInfo(
"(%s) Verdict: Accepted %" PRIu32
", Dropped %" PRIu32
724 ", Replaced %" PRIu32
"",
725 tv->
name, wd_qv->accepted, wd_qv->dropped, wd_qv->replaced);
740 ret = WinDivertVerdictHelper(
tv, p);
754 WinDivertThreadVars *wd_tv = WinDivertGetThread(p->windivert_v.thread_num);
760 WinDivertQueueVars *wd_qv = WinDivertGetQueue(wd_tv->thread_num);
763 p->windivert_v.verdicted =
true;
771 if (wd_tv->filter_handle == INVALID_HANDLE_VALUE ||
772 wd_tv->filter_handle == NULL) {
779 bool finalVerdict = VerdictTunnelPacket(p);
785 if (p->
root != NULL) {
802 bool success = WinDivertSend(wd_tv->filter_handle,
GET_PKT_DATA(p),
806 WinDivertLogError(GetLastError());
828 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)initdata;
845 WinDivertThreadVars *wd_tv = (WinDivertThreadVars *)data;
847 SCReturnCT(WinDivertCloseHelper(wd_tv),
"TmEcode");
877 SCLogDebug(
"packet unsupported by WinDivert, first byte: %02x",
917 static TmEcode WinDivertCloseHelper(WinDivertThreadVars *wd_tv)
922 WinDivertQueueVars *wd_qv = WinDivertGetQueue(wd_tv->thread_num);
924 SCLogDebug(
"No queue could be found for thread num %" PRId32
"",
932 if (wd_qv->filter_handle == INVALID_HANDLE_VALUE ||
933 wd_qv->filter_handle == NULL) {
937 if (!WinDivertClose(wd_qv->filter_handle)) {
939 (uint32_t)(GetLastError()));
944 (void)WinDivertRestoreOffloading(wd_tv);
946 wd_qv->filter_handle = NULL;
960 static int SourceWinDivertTestIfaceMatchFilter(
void)
968 struct testdata tests[] = {
970 {
"ifIdx=11", 11,
true},
971 {
"ifIdx==11", 11,
true},
972 {
"ifIdx!=11", 1,
true},
973 {
"ifIdx!=11", 11,
false},
974 {
"ifIdx=3", 4,
false},
975 {
"ifIdx=11 || ifIdx=5", 5,
true},
976 {
"ifIdx=11 || ifIdx=4", 5,
false},
977 {
"ifIdx<3 || ifIdx>7", 8,
true},
978 {
"ifIdx<3 || ifIdx>7", 5,
false},
979 {
"ifIdx>3 or ifIdx<7", 5,
true},
980 {
"ifIdx>3 && ifIdx<7", 5,
true},
981 {
"ifIdx>3 && ifIdx<7", 1,
false},
982 {
"(ifIdx > 3 && ifIdx < 7) or ifIdx == 11", 11,
true}};
984 size_t count = (
sizeof(tests) /
sizeof(tests[0]));
986 for (
size_t i = 0; i < count; i++) {
987 struct testdata test = tests[i];
989 bool actual = WinDivertIfaceMatchFilter(test.filter, test.if_index);
990 if (actual != test.expected) {
991 printf(
"WinDivertIfaceMatchFilter(\"%s\", %d) == %d, expected %d\n",
992 test.filter, test.if_index, actual, test.expected);
1003 void SourceWinDivertRegisterTests()
1007 SourceWinDivertTestIfaceMatchFilter);