private static WinDivertAddress GetAddress(ReadOnlySpan <byte> p)
{
var version = p[0] >> 4;
ReadOnlySpan <byte> srcBytes;
ReadOnlySpan <byte> dstytes;
if (version == 4)
{
srcBytes = p.Slice(IPv4Fields.SourcePosition, IPv4Fields.AddressLength);
dstytes = p.Slice(IPv4Fields.DestinationPosition, IPv4Fields.AddressLength);
}
else
{
srcBytes = p.Slice(IPv6Fields.SourceAddressPosition, IPv6Fields.AddressLength);
dstytes = p.Slice(IPv6Fields.DestinationAddressPosition, IPv6Fields.AddressLength);
}
var src = new IPAddress(srcBytes.ToArray());
var dst = new IPAddress(dstytes.ToArray());
WinDivertAddress addr = default;
addr.IfIdx = (uint)IpHelper.GetBestInterfaceIndex(dst);
if (IpHelper.IsOutbound((int)addr.IfIdx, src, dst))
{
addr.Flags |= WinDivertPacketFlags.Outbound;
}
return(addr);
}
/// <summary>
/// </summary>
/// <param name="p"></param>
/// <param name="header"></param>
public void SendPacket(ReadOnlySpan <byte> p, ICaptureHeader captureHeader)
{
ThrowIfNotOpen();
bool res;
WinDivertAddress addr = default;
if (!(captureHeader is WinDivertHeader))
{
addr = GetAddress(p);
}
else
{
var header = captureHeader as WinDivertHeader;
addr.IfIdx = header.InterfaceIndex;
addr.SubIfIdx = header.SubInterfaceIndex;
addr.Flags = header.Flags;
}
unsafe
{
fixed(byte *p_packet = p)
{
res = WinDivertNative.WinDivertSend(Handle, new IntPtr(p_packet), (uint)p.Length, out var pSendLen, ref addr);
}
}
if (!res)
{
ThrowLastWin32Error("Can't send packet");
}
}
public void SendPacket(RawCapture p)
{
if (p is WinDivertCapture packet)
{
WinDivertAddress address = default;
address.IfIdx = packet.InterfaceIndex;
address.SubIfIdx = packet.SubInterfaceIndex;
address.Flags = packet.Flags;
SendPacket(new ReadOnlySpan <byte>(p.Data), address);
return;
}
SendPacket(new ReadOnlySpan <byte>(p.Data));
}
public PacketRecord(WinDivertAddress addr, ReadOnlyMemory <byte> data)
{
var timestamp = new PosixTimeval(BootTime + TimeSpan.FromTicks(addr.Timestamp));
Header = new WinDivertHeader(timestamp)
{
InterfaceIndex = addr.IfIdx,
SubInterfaceIndex = addr.SubIfIdx,
Flags = addr.Flags
};
;
Data = data;
}
public void SendPacket(Packet p, int size)
{
if (p is WinDivertPacket packet)
{
WinDivertAddress address = default;
address.IfIdx = packet.InterfaceIndex;
address.SubIfIdx = packet.SubInterfaceIndex;
address.Flags = packet.Flags;
SendPacket(new ReadOnlySpan <byte>(p.Bytes, 0, size), address);
return;
}
SendPacket(new ReadOnlySpan <byte>(p.Bytes, 0, size));
}
private void SendPacket(ReadOnlySpan <byte> p, WinDivertAddress addr)
{
ThrowIfNotOpen();
bool res;
unsafe
{
fixed(byte *p_packet = p)
{
res = WinDivertNative.WinDivertSend(Handle, new IntPtr(p_packet), (uint)p.Length, out var pSendLen, ref addr);
}
}
if (!res)
{
ThrowLastWin32Error("Can't send packet");
}
}
internal static extern bool WinDivertRecv(IntPtr handle, IntPtr pPacket, uint packetLen, out uint readLen, out WinDivertAddress pAddr);
/// <summary>
/// Packet data is only valid until the next call
/// </summary>
/// <param name="packets"></param>
/// <returns>Status of the operation</returns>
private GetPacketStatus GetNextPackets(List <PacketRecord> packets, int maxBatchSize)
{
ThrowIfNotOpen();
while (true)
{
bool ret;
var addressSize = Marshal.SizeOf <WinDivertAddress>();
var addressesByteSize = maxBatchSize * addressSize;
var addresses = new WinDivertAddress[maxBatchSize];
var packetsData = new Memory <byte>(Buffer);
ret = WinDivertNative.WinDivertRecvEx(
Handle,
ref MemoryMarshal.GetReference(packetsData.Span),
packetsData.Length,
out int readLen,
0,
addresses,
ref addressesByteSize,
IntPtr.Zero
);
if (!ret)
{
var err = Marshal.GetLastWin32Error();
if (err == ERROR_INSUFFICIENT_BUFFER)
{
// Increase buffer size
Buffer = new byte[Buffer.Length * 2];
continue;
}
if (err == ERROR_NO_DATA)
{
return((GetPacketStatus)(-err));
}
ThrowWin32Error("Recv failed", err);
}
// Take only as many bytes as were written by the driver
packetsData = packetsData.Slice(0, readLen);
var addressesCount = addressesByteSize / addressSize;
for (int i = 0; i < addressesCount - 1; i++)
{
// We know how many packets we have, but not where they start/end in the buffer
// Helper function that's originally used for parsing,
// but we only need it to know the size of the current packet
var retval = WinDivertNative.WinDivertHelperParsePacket(
ref MemoryMarshal.GetReference(packetsData.Span),
packetsData.Length,
IntPtr.Zero, IntPtr.Zero,
IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero,
IntPtr.Zero, IntPtr.Zero,
IntPtr.Zero, out var pNextLen
);
if (!retval)
{
return(GetPacketStatus.Error);
}
var packetLength = packetsData.Length - pNextLen;
packets.Add(new PacketRecord(addresses[i], packetsData.Slice(0, packetLength)));
// Move packetsData to the next packet
packetsData = packetsData.Slice(packetLength);
}
// Avoid parsing the packet if it's the last packet or the only packet
packets.Add(new PacketRecord(addresses[addressesCount - 1], packetsData));
return(GetPacketStatus.PacketRead);
}
}
internal static extern bool WinDivertSend(IntPtr handle, IntPtr pPacket, uint packetLen, out uint pSendLen, ref WinDivertAddress pAddr);
