Fix tls-spoof

common/windivert/handle_windows.go

@@ -110,9 +110,13 @@ func validateOpenArgs(layer Layer, priority int16, flags Flag) error {
 	if priority < PriorityLowest || priority > PriorityHighest {
 		return E.New("windivert: priority out of range")
 	}
-	if flags&^FlagSendOnly != 0 {
+	const supportedFlags = FlagSniff | FlagSendOnly
+	if flags&^supportedFlags != 0 {
 		return E.New("windivert: unknown flag bits")
 	}
+	if flags&FlagSniff != 0 && flags&FlagSendOnly != 0 {
+		return E.New("windivert: FlagSniff and FlagSendOnly are mutually exclusive")
+	}
 	return nil
 }
 

common/windivert/handle_windows_test.go

@@ -100,6 +100,9 @@ func TestValidateOpenArgsFlags(t *testing.T) {
 	t.Parallel()
 	require.NoError(t, validateOpenArgs(LayerNetwork, 0, 0))
 	require.NoError(t, validateOpenArgs(LayerNetwork, 0, FlagSendOnly))
+	require.NoError(t, validateOpenArgs(LayerNetwork, 0, FlagSniff))
+	// Sniff and send-only describe contradictory handle roles.
+	require.Error(t, validateOpenArgs(LayerNetwork, 0, FlagSniff|FlagSendOnly))
 	// Unknown flag bits must be rejected to surface caller mistakes early.
 	require.Error(t, validateOpenArgs(LayerNetwork, 0, Flag(0x10)))
 	require.Error(t, validateOpenArgs(LayerNetwork, 0, FlagSendOnly|Flag(0x10)))

common/windivert/windivert.go

@@ -23,7 +23,14 @@ const LayerNetwork Layer = 0
 
 type Flag uint64
 
-const FlagSendOnly Flag = 0x0008
+const (
+	// FlagSniff opens a passive observer: the driver copies matching packets
+	// to userspace without removing them from the network stack. Send is not
+	// required (and not allowed) on a sniffing handle.
+	FlagSniff Flag = 0x0001
+	// FlagSendOnly opens a write-only injection handle; Recv is not allowed.
+	FlagSendOnly Flag = 0x0008
+)
 
 const (
 	PriorityHighest int16 = 30000