CHANGELOG

WinDivert 1.0.0
    - First release of WinDivert 1.0
WinDivert 1.0.1
    - Fixed stack overflow bug in 32bit versions of the driver.
WinDivert 1.0.2
    - WinDivert now requires Administrator privileges in order to access
      (as opposed to just install) the WinDivert device.
WinDivert 1.0.3
    - Fix bug(s) relating to the parsing of IPv6 addresses.
    - DivertOpen() now returns more meaningful error codes on failure.
    - Two new helper API functions: DivertHelperParseIPvXAddress(..), X=4,6.
    - Renamed DivertHelperParse(..) to DivertHelperParsePacket(..).
WinDivert 1.0.4
    - Same as WinDivert 1.0.3 except:
      * Released with signed drivers.
      * MinGW compiled gcc-4.6
      * Minor documentation changes.
WinDivert 1.0.5
    - Fix the DIVERT_NETWORK_FORWARD_LAYER implementation.
    - Upgrade Visual Studio support to 2012.
WinDivert 1.1.0-rc
    - Re-brand "DIVERT" to "WINDIVERT" throughout the code-base.
    - New flag:
      * WINDIVERT_FLAG_NO_CHECKSUM: Do not guarantee that diverted packets
        have a correct checksum.
    - New default values and limits for various WinDivert parameters,
      including WINDIVERT_PARAM_QUEUE_LEN, WINDIVERT_PARAM_QUEUE_TIME, and
      the maximum filter length.
    - New extended WinDivert functions that support asynchronous I/O:
      * WinDivertRecvEx(..)
      * WinDivertSendEx(..)
    - The WinDivert driver now services reads (WinDivertRecv()) out-of-band.
    - The WinDivert driver now protects packet data from modification by
      other callout drivers and the user program.
    - The WinDivert service is no longer created when the driver fails to
      load.
WinDivert 1.1.1
    - Fixed a BSOD that sometimes occurs when the driver is unloaded.
WinDivert 1.1.2-rc
    - Renamed drivers to "WinDivert32.sys" and "WinDivert64.sys".  Both can
      exist in the same directory, and WinDivert.dll automatically loads the
      correct version.
    - Deprecate both the WinDivert.inf and WdfCoInstaller*.dll files.
WinDivert 1.1.3
    - Fixed a bug that causes some outbound TCP packets to be lost.
WinDivert 1.1.4
    - Fixed a BSOD that occurs when NULL is passed as the address parameter to
      WinDivertRecv(..) or WinDivertSend(..).
WinDivert 1.1.5
    - Insert WinDivert as the highest priority WFP sublayer.
WinDivert 1.1.6
    - WinDivert now searches for the driver files in the application's
      directory (as opposed to the current directory).
WinDivert 1.1.7
    - Improved IPv6 support:
     * Fixed incorrect IPV6 TCP/UDP checksum calculation in
       WinDivertHelperCalcChecksums().
     * WinDivert driver now calculates checksums for IPV6 packets.
     * WinDivert can now handle IPV6 extension headers.
     * Fixed WinDivertHelperParseIPv6Address().
WinDivert 1.1.8
    - Fix ip.TOS handling bug.
    - Fix IPv6 comparison bug.
WinDivert 1.2.0-rc
    - The WinDivert filter language now supports C-style "(F1? F2: F3)"
      expressions, where {F1,F2,F3} are themselves filter expressions.
    - New WinDivert helper functions:
      * WinDivertHelperCheckFilter() checks if a filter string is valid.
      * WinDivertHelperEvalFilter() evaluates a filter on a packet.
    - Some packets (specifically outbound or loopback packets) returned by
      WinDivertRecv() or WinDivertRecvEx() are no longer required to have
      correct checksums.  Absent checksum fields will be set to zero.  If need
      be the checksums can be recovered by WinDivertHelperCalcChecksums().
    - The WINDIVERT_FLAG_NO_CHECKSUM flag has been deprecated.
    - The WinDivertHelperCalcChecksums() function now accepts a new
      WINDIVERT_HELPER_NO_REPLACE flag, which indicates that non-zero checksum
      fields should not be replaced.
    - Support for the old WinDivert1.0 API has been removed.
WinDivert 1.2.1
    - Identical to WinDivert 1.2.0-rc.
WinDivert 1.3.0
    - Fix BSOD that sometimes occurs after abnormal user application exit.
    - Fix BSOD that sometimes occurs when WinDivert is combined with other
      callout drivers.
    - WinDivertSend() has been optimized.  However, it may not detect as
      many packet injection errors as it could before.
WinDivert 1.4.0-rc
    - Add a new WINDIVERT_PARAM_QUEUE_SIZE parameter that can be used to
      control the maximum number of bytes used by the packet queue.
    - Add a new WINDIVERT_FLAG_DEBUG flag that causes WinDivertSend() to
      block until the packet exits the Windows TCP/IP stack.  This is slower
      but provides better error messages, so is useful for debugging.
    - Internally queued packets are now reinjected when WinDivertClose() is
      called instead of being dropped.
    - WINDIVERT_ADDRESS now includes a Timestamp field that indicates when
      the packet was first captured by WinDivert.  The timestamp uses the
      same clock as QueryPerformanceCounter().
    - WINDIVERT_ADDRESS now includes a Loopback field that indicates whether
      the packet is a loopback packet or not.
    - The filter language has been extended to include a loopback field that
      matches loopback packets.
    - Loopback packets are now considered to be outbound-only.
    - WINDIVERT_ADDRESS now includes an Impostor field which indicates that the
      packet originated from another driver rather than from the network or
      TCP/IP stack.
    - WinDivertRecv() will eventually fail with ERROR_HOST_UNREACHABLE if
      an impostor packet enters an infinite loop (see #41).
    - The filter language has been extended to include an impostor field that 
      matches impostor packets.
    - WINDIVERT_ADDRESS now includes three new flags relating to checksums:
      * PseudoIPChecksum
      * PseudoTCPChecksum
      * PseudoUDPChecksum
      When set, these flags indicate that the corresponding packet uses
      "pseudo" IP/TCP/UDP checksums instead of the default full checksums.
      Pseudo checksums are cheaper to calculate, and can be used when the
      network hardware supports checksum offloading.
    - WinDivertHelperCalcChecksums() now takes an optional pointer to a
      WINDIVERT_ADDRESS structure, and calculates pseudo checksums if the
      corresponding Pseudo*Checksum flag is set.
    - The WINDIVERT_HELPER_NO_REPLACE flag for WinDivertHelperCalcChecksums()
      has been deprecated.  It is no longer necessary to calculate checksums
      for unmodified packets.
WinDivert 1.4.1
    - Dual license WinDivert under LGPLv3 and GPLv2.
WinDivert 1.4.2
    - Add workaround for pseudo checksum issue (see #134).
WinDivert 1.4.3
    - WinDivert.dll no longer depends on MSVCRT*.dll.
WinDivert 2.0.0-rc
    - Add 3 new layers:
      * WINDIVERT_LAYER_FLOW for tracking network "flow" events.
      * WINDIVERT_LAYER_SOCKET for tracking "socket" events.
      * WINDIVERT_LAYER_REFLECT for tracking WinDivert events.
    - WINDIVERT_ADDRESS has been re-factored as follows:
      * addr.Layer: The WINDIVERT_LAYER_* value for the handle.
      * addr.Event: A WINDIVERT_EVENT_* value representing the event (see
        below).
      * addr.Sniffed: Indicates that the event was sniffed.
      * addr.Outbound: Replaces addr.Direction.
      * addr.IPv6: Indicates an IPv6 packet.
      * addr.Network.IfIdx: Replaces addr.IfIdx.
      * addr.Network.SubIfIdx: Replaces addr.SubIfIdx.
      * addr.Flow.EndpointId: The endpoint ID of the flow.
      * addr.Flow.ParentEndpointId: The parent endpoint ID of the flow.
      * addr.Flow.ProcessId: The ID of process that created the flow.
      * addr.Flow.LocalAddr: The flow's local address.
      * addr.Flow.RemoteAddr: The flow's remote address.
      * addr.Flow.LocalPort: The flow's local port.
      * addr.Flow.RemotePort: The flow's remote port.
      * addr.Flow.Protocol: The flow's protocol.
      * addr.Socket.EndpointId: The endpoint ID of the operation.
      * addr.Socket.ParentEndpointId: The parent endpoint ID of the operation.
      * addr.Socket.ProcessId: The ID of process that created the socket.
      * addr.Socket.LocalAddr: The socket's local address.
      * addr.Socket.RemoteAddr: The socket's remote address.
      * addr.Socket.LocalPort: The socket's local port.
      * addr.Socket.RemotePort: The socket's remote port.
      * addr.Socket.Protocol: The socket's protocol.
      * addr.Reflect.ProcessId: The ID of process that created opened the
        handle.
      * addr.Reflect.Timestamp: The timestamp of the handle.
      * addr.Reflect.Layer: The layer of the handle.
      * addr.Reflect.Flags: The flags of the handle.
      * addr.Reflect.Priority: The priority of the handle.
    - The addr.Event field can take the following values:
      * WINDIVERT_EVENT_NETWORK_PACKET: (NETWORK/NETWORK_FORWARD layers) a new
        packet was diverted.
      * WINDIVERT_EVENT_FLOW_ESTABLISHED: (FLOW layer) a new flow is
        established.
      * WINDIVERT_EVENT_FLOW_DELETED: (FLOW layer) an existing flow is
        deleted.
      * WINDIVERT_EVENT_SOCKET_BIND: (SOCKET layer) a socket bind()
        operation occurred.
      * WINDIVERT_EVENT_SOCKET_CONNECT: (SOCKET layer) a socket connect()
        operation occurred.
      * WINDIVERT_EVENT_SOCKET_LISTEN: (SOCKET layer) a socket listen()
        operation occurred.
      * WINDIVERT_EVENT_SOCKET_ACCEPT: (SOCKET layer) a socket accept()
        operation occurred.
      * WINDIVERT_EVENT_SOCKET_CLOSE: (SOCKET layer) a socket endpoint is
        closed.
      * WINDIVERT_EVENT_REFLECT_OPEN: (REFLECT layer) a WinDivertOpen()
        operation occurred.
      * WINDIVERT_EVENT_REFLECT_CLOSE: (REFLECT layer) a WinDivertClose()
        operation occurred.
    - The WinDivert filter language has been expanded with new fields:
      * event: The event value.
      * timestamp: The event timestamp.
      * endpointId: (FLOW/SOCKET layers) the endpoint ID.
      * parentEndpointId: (FLOW/SOCKET layers) the parent endpoint ID.
      * processId: (FLOW/SOCKET/REFLECT layers) the process ID.
      * localAddr: (NETWORK/NETWORK_FORWARD/FLOW/SOCKET layers) the local
        address.
      * localPort: (NETWORK/NETWORK_FORWARD/FLOW/SOCKET layers) the local
        port.
      * remoteAddr: (NETWORK/NETWORK_FORWARD/FLOW/SOCKET layers) the remote
        address.
      * remotePort: (NETWORK/NETWORK_FORWARD/FLOW/SOCKET layers) the remote
        port.
      * protocol: (NETWORK/NETWORK_FORWARD/FLOW/SOCKET layers) the protocol.
      * priority: (REFLECT layer) the handle's priority.
      * layer: (REFLECT layer) the handle's layer.
      * random8: (NETWORK/NETWORK_FORWARD layers) an 8-bit pseudo random
        number.
      * random16: (NETWORK/NETWORK_FORWARD layers) a 16-bit pseudo random
        number.
      * random32: (NETWORK/NETWORK_FORWARD layers) a 32-bit pseudo random
        number.
      * length: (NETWORK/NETWORK_FORWARD layers) the packet length.
      * zero: The value "0".
    - The WinDivert filter language can now address packet/payload data for
      the NETWORK/NETWORK_FORWARD layers:
      * packet[i]: the ith packet byte.
      * packet16[i]: the ith packet 16bit word.
      * packet32[i]: the ith packet 32bit word.
      * tcp.payload[i]: the ith TCP payload byte.
      * tcp.payload16[i]: the ith TCP 16bit word.
      * tcp.payload32[i]: the ith TCP 32bit word.
      * udp.payload[i]: the ith UDP payload byte.
      * udp.payload16[i]: the ith UDP 16bit word.
      * udp.payload32[i]: the ith UDP 32bit word.
      The index (i) can be:
      * An ordinary integer representing word addressing.
      * A 'b' decorated integer representing byte-level addressing.
      Furthermore, the index can be:
      * Positive, representing addressing from the start of the
        packet/payload.
      * Negative, representing addressing from the end of the packet/payload.
    - The WinDivert filter language now supports several symbolic values:
      * PACKET: (NETWORK/NETWORK_FORWARD layers) equal to
        WINDIVERT_EVENT_NETWORK_PACKET
      * ESTABLISHED: (FLOW layer) equal to WINDIVERT_EVENT_FLOW_ESTABLISHED.
      * DELETED: (FLOW LAYER) equal to WINDIVERT_EVENT_FLOW_DELETED.
      * BIND: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_BIND.
      * CONNECT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_CONNECT.
      * LISTEN: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_LISTEN.
      * ACCEPT: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_ACCEPT.
        WINDIVERT_LAYER_NETWORK_FORWARD.
      * CLOSE: (SOCKET layer) equal to WINDIVERT_EVENT_SOCKET_CLOSE.
      * OPEN: (REFLECT layer) equal to WINDIVERT_EVENT_REFLECT_OPEN.
      * CLOSE: (REFLECT layer) equal to WINDIVERT_EVENT_REFLECT_CLOSE.
      * NETWORK: (REFLECT layer) equal to WINDIVERT_LAYER_NETWORK.
      * NETWORK_FORWARD: (REFLECT layer) equal to
      * FLOW: (REFLECT layer) equal to WINDIVERT_LAYER_FLOW.
      * SOCKET: (REFLECT layer) equal to WINDIVERT_LAYER_SOCKET.
      * REFLECT: (REFLECT layer) equal to WINDIVERT_LAYER_REFLECT.
      * TRUE: equal to 1.
      * FALSE: equal to 0.
      * TCP: equal to IPPROTO_TCP (6).
      * UDP: equal to IPPROTO_UDP (17).
      * ICMP: equal to IPPROTO_ICMP (1).
      * ICMPV6: equal to IPPROTO_ICMPV6 (58).
    - WinDivertOpen() now supports several new flags:
      * WINDIVERT_FLAG_RECV_ONLY/WINDIVERT_FLAG_READ_ONLY: The handle cannot
        be used for send operations.
      * WINDIVERT_FLAG_SEND_ONLY/WINDIVERT_FLAG_WRITE_ONLY: The handle cannot
        be used for receive operations.
      * WINDIVERT_FLAG_NO_INSTALL: If the WinDivert driver is not already
        installed/loaded, then WinDivertOpen() will fail with an error.
    - WinDivertRecvEx()/WinDivertSendEx() now support a "batch" mode that
      allows more than one packet to be received/sent at once.  The number
      of packets is determined by a new pAddrLen/addrLen parameter.
    - Add a new WinDivertShutdown() function that supports the following
      modes:
      * WINDIVERT_SHUTDOWN_RECV: Disable the queuing new packets.
      * WINDIVERT_SHUTDOWN_SEND: Disable the sending of new packets.
      * WINDIVERT_SHUTDOWN_BOTH: Equivalent to
        (WINDIVERT_SHUTDOWN_RECV | WINDIVERT_SHUTDOWN_SEND).
    - Add new "read-only" WinDivert parameters:
      * WINDIVERT_PARAM_VERSION_MAJOR: Driver version (major).
      * WINDIVERT_PARAM_VERSION_MINOR: Driver version (minor).
    - Add a new WinDivertHelperHashPacket() helper function that calculates
      a 64bit hash value of a packet.
    - Add new WinDivertHelperFormatIPv4Address() and
      WinDivertHelperFormatIPv6Address() helper functions that format
      IPv4 and IPv6 addresses respectively.
    - Replace WinDivertHelperCheckFilter() with a new
      WinDivertHelperCompileFilter() helper function.  The latter can also be
      used to compile a human-readable filter string into a more compact
      "object" format.  The object format can be used in place of the
      human readable format for all WinDivert operations.
    - Add a new WinDivertHelperFormatFilter() helper function that formats a
      filter string into a normalized form.  It also can be used to
      "de-compile" the object format into a human readable form.
    - Add a new WinDivertHelperDecrementTTL() function that decrements the
      ip.TTL/ipv6.HopLimit field of a packet.
    - Add new WinDivertHelperNto*()/WinDivertHelperHton*() helper functions
      for swapping from network to host byte ordering, and vice versa.
    - WinDivertOpen() priorities now are ascending, meaning that higher
      values correspond to higher priorities.
    - The last two arguments for WinDivertRecv() and WinDivertSend() have been
      swapped.
WinDivert 2.0.1-rc
    - Fix WFP callout install optimization bug.
    - Fix WinDivertHelperNtohIpv6Address/WinDivertHelperHtonIpv6Address bug.
    - Rename the following functions for consistency:
      * WinDivertHelperNtohIpv6Address -> WinDivertHelperNtohIPv6Address
      * WinDivertHelperHtonIpv6Address -> WinDivertHelperHtonIPv6Address
WinDivert 2.1.0
    - WinDivertOpen() now supports a new flag:
      * WINDIVERT_FLAG_FRAGMENTS: If set, the handle will capture inbound IP
        fragments, but not inbound reassembled IP packets.  Otherwise, if not
        set (the default), the handle will capture inbound reassembled IP
        packets, but not inbound IP fragments.  This flag only affects
        inbound packets at the NETWORK layer.
    - Filter fields inbound/outbound are now supported at the SOCKET layer.
    - Fix BSOD caused by packets with missing or incomplete transport
      headers (introduced in 2.0.0).
    - Fix missing Flow.EndpointId and Flow.ParentEndpointId for IPv6 flows.
WinDivert 2.2.0
    - Implement new packet parser that correctly handles IP fragments.
    - Add a new "fragment" filter field that matches IP fragments.
    - (Un)Loading the WinDivert driver will cause a system event to be logged.