Filter “outbound and !loopback” not effective at WINDIVERT_LAYER_SOCKET

[BruceMok]

Base on socketdump.c, i set filter like "outbound and !loopback". It seems like filter not effective because i still receive loopback event.

CLOSE pid=17796 program=msedge.exe endpoint=1208670 parent=1208662 protocol=TCP local=[127.0.0.1]:51128 remote=[127.0.0.1]:5021

[basil00]

I can confirm this problem. It seems to only occur for "close" events.

Looking at the code, it is not obvious what the cause is. The WinDivert driver considers the event to be loopback if the FWP_CONDITION_FLAG_IS_LOOPBACK flag is set for FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_FLAGS. So it seems the flag is not set.