]> git.ipfire.org Git - thirdparty/suricata.git/commit
Adds WinDivert support to Windows builds 3402/head
authorJacob Masen-Smith <smith.jacob@gmail.com>
Wed, 20 Jun 2018 20:44:26 +0000 (13:44 -0700)
committerJacob Masen-Smith <smith.jacob@gmail.com>
Wed, 20 Jun 2018 20:44:26 +0000 (13:44 -0700)
commitec77632e84a106ddbcd0baef4e4368b4fe5c5f9e
tree0aac36fc8bf008915246b650c4fb5c133bf30677
parent55ad4e4ecef6a3160c978a53bcada66458e17bff
Adds WinDivert support to Windows builds

Enables IPS functionality on Windows using the open-source
(LGPLv3/GPLv2) WinDivert driver and API.

From https://www.reqrypt.org/windivert-doc.html : "WinDivert is a
user-mode capture/sniffing/modification/blocking/re-injection package
for Windows Vista, Windows Server 2008, Windows 7, and Windows 8.
WinDivert can be used to implement user-mode packet filters, packet
sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without
the need to write kernel-mode code."

- adds `--windivert [filter string]` and `--windivert-forward [filter
    string]` command-line options to enable WinDivert IPS mode.
    `--windivert[-forward] true` will open a filter for all traffic. See
    https://www.reqrypt.org/windivert-doc.html#filter_language for more
    information.

Limitation: currently limited to `autofp` runmode.

Additionally:
- `tmm_modules` now zeroed during `RegisterAllModules`
- fixed Windows Vista+ `inet_ntop` call in `PrintInet`
- fixed `GetRandom` bug (nonexistent keys) on fresh Windows installs
- fixed `RandomGetClock` building on Windows builds
- Added WMI queries for MTU
26 files changed:
configure.ac
doc/userguide/setting-up-ipsinline-for-windows.rst [new file with mode: 0644]
src/Makefile.am
src/decode.h
src/runmode-unittests.c
src/runmode-windivert.c [new file with mode: 0644]
src/runmode-windivert.h [new file with mode: 0644]
src/runmodes.c
src/runmodes.h
src/source-windivert-prototypes.h [new file with mode: 0644]
src/source-windivert.c [new file with mode: 0644]
src/source-windivert.h [new file with mode: 0644]
src/suricata.c
src/tm-modules.c
src/tm-threads-common.h
src/util-error.c
src/util-error.h
src/util-ioctl.c
src/util-ioctl.h
src/util-print.c
src/util-random.c
src/util-strptime.c
src/win32-misc.c
src/win32-misc.h
src/win32-syscall.c [new file with mode: 0644]
src/win32-syscall.h [new file with mode: 0644]