Packet injection and verdict setting fixes.

[vlabo]

61c3443: Makes the block and drop verdict immutable. This will make windows apply the verdict immediately and not let other layers in the chain override the verdict. Also makes the applying of the verdict immediate in the ALE layer. So applications will get permission denied when trying to create a connection instead of timeout after few seconds.

04f8708: Fixes the packet injection in the packet callout. From what I remember this is only used in packet dns monitoring. Without recalculating the checksums the packet will just get dropped after injection by the network system.

Summary by CodeRabbit

• Bug Fixes
  • Fixed incorrect checksum calculations for network packets in outbound traffic, ensuring proper packet validation for both IPv4 and IPv6 protocols.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: b9b80d5a-73bc-43b6-9ccd-c1d05206a653

📥 Commits

Reviewing files that changed from the base of the PR and between 04f8708 and 8786aac.

📒 Files selected for processing (1)

• windows_kext/driver/src/packet_callouts.rs

---

📝 Walkthrough

Walkthrough

The changes add header checksum recalculation functionality to the Windows kernel extension driver. A new public function recalc_header_checksums is introduced to compute transport-layer checksums for both IPv4 and IPv6 packets. The packet callouts module is updated to invoke this function on outbound packets after cloning, ensuring checksums are properly recalculated before packet injection.

Changes

Cohort / File(s)	Summary
Checksum Utility Function windows_kext/driver/src/packet_util.rs	New public function recalc_header_checksums that recomputes transport-layer (UDP/TCP) checksums for both IPv4 and IPv6 packets by parsing IP headers, extracting addresses, and updating checksum fields as needed.
Packet Callout Integration windows_kext/driver/src/packet_callouts.rs	Imports the new checksum function and integrates it into clone_packet to recalculate checksums on outbound packets after cloning and when data is available, before packet injection.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers

• dhaavi

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Packet injection and verdict setting fixes' partially aligns with the changeset. The PR addresses packet injection checksum fixes (verified in the raw summary), but the 'verdict setting fixes' part references commits that were reverted per reviewer feedback. The title remains technically accurate for the final state but is partially obsolete.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[stenya]

Hello @vlabo

I’m sorry for the long delay in reviewing this - I only just noticed your pull request.
Many thanks for your efforts.

I only have a few comments:

• 61c3443 :
  This commit will conflict with commit 35ecee8, which is doing the same thing.
  Could you please revert it so that PR fix(windows-kext): fix potential BSODs and block verdict bypass in WFP callouts #2136 does not conflict with yours?

• Regarding 04f8708:
  Could you please add a comment explaining the change and why it is needed?
  Something like this (if I understood everything correctly):

// Checksums may be zero/garbage due to NIC hardware offload. When injecting
// via software those flags are absent, so we must write valid checksum bytes
// before storing the clone — even if the packet is otherwise unmodified.

---

By the way, I would really appreciate any feedback you might have on these commits: 674ff3f, 2d6fd0a,
or on the whole PR #2136 in general.

[stenya]

Thank you!

[vlabo]

Sorry for the long delay. For some reason I did not get a notification.
I just reviewed the changes and they look good.

[stenya]

Thank you @vlabo !