basil00/Divert — pull request #22 by rafael-santiago (2014-07-25 10:07:30+00:00)
Title: Adding some layer7 content data searching

Hi!

I'm using the WinDivert in a solution from my company and in this application is needed sniff packets that only could be better filtrated on Layer7, otherwise the filter would be more generic and with it we would get a lack of performance and a noise addition under the hood in this application.

So I decided modify the WinDivert filter language adding to two more fields ("tcp.Payload" and "udp.Payload") and also I created two more operators which are the "contains operator" (and the not version of it ["not contains"]). The contains operator is denoted by symbol "?". This operator uses a
wildcard/glob to match patterns against the "udp.Payload" or "tcp.Payload" fields (and only operates with these fields).

See, with these new features is possible, for example, sniff only HTTP get requests that are version 1.0, in this following way:

"outbound and tcp.Payload ? \"GET*HTTP/1.0\""

or 1.1

"outbound and tcp.Payload ? \"GET*HTTP/1.1\""

not contains

"outbound and not tcp.Payload ? \"GET*HTTP/1.1\""

My wildcard search implementation covers: *, ?, [] (not intervals) and [^] (not intervals).

To indicate metachars literally we have to escape it: \*, \?, \[\] and \[\^\].

If is needed pass a non-printable data in a string we must use the c-like hexadecimal notation, something like this:

"\\xDE\\xAD\\xBE\\xEF" or a hexadecimal stream "\\xDEADBEEF\\abcd"

Common formatters like "\\n", "\\t" and "\\r" are allowed too.

In my particular case I needed to sniff not only GETs from direct connections but also proxied connections and it's harder to predict the user proxy port if you want a general solution.

I think these changes are handy, if you consider it too, you can feel free to review and improve my code if needed. The most of my changes are commented with "INFO(Santiago):" in order to help in code review. You can strip my name from comments if you want, feel free about it.

I created some limitation constants that you can analyze if is better to decrease or increase... things like max user string length (255) and max star-recursion (*) on a wildcard matching.

Initially I implemented only a simple contains like [strstr() c-lib function] but I guess that wildcards can covers it too and even more.

Sorry, my english is terrible!

Thanks!
Rafael Santiago
--