https://github.com/mullvad/libwfp

C++ library for interacting with the Windows Filtering Platform (WFP)
https://github.com/mullvad/libwfp

Last synced: 6 days ago
JSON representation

C++ library for interacting with the Windows Filtering Platform (WFP)

• Host: GitHub
• URL: https://github.com/mullvad/libwfp
• Owner: mullvad
• License: mit
• Created: 2017-11-30T13:12:38.000Z (about 7 years ago)
• Default Branch: master
• Last Pushed: 2024-09-09T13:28:09.000Z (3 months ago)
• Last Synced: 2024-12-07T16:51:28.178Z (15 days ago)
• Language: C++
• Homepage:
• Size: 1000 KB
• Stars: 85
• Watchers: 16
• Forks: 34
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.md

Awesome Lists containing this project

README

        
# Mullvad libwfp

libwfp is a C++ library for interacting with the Windows Filtering Platform (WFP). Notably, libwfp

provides builders for defining providers, filters and sets of conditions.

## Checking out the code

The code is dependent on one other repository:

* mullvad/windows-libraries

   Specifically, the `libcommon` library contained herein, for general functionality not provided by

   the standard library.

For reasons of flexibility, this repository is not included as a submodule. It is instead

required to be checked out at the same level as libwfp:

```

mkdir libwfp && cd libwfp

git clone https://github.com/mullvad/windows-libraries.git

git clone https://github.com/mullvad/libwfp.git

```

## Development environment

libwfp requires Visual Studio 2022. Any edition will work, e.g. Visual Studio Community 2022 is a

perfectly fine choice.

## Dependencies

For dependencies required during development, see above, section *Checking out the code*.

For deployment there are no external dependencies beyond what is already provided by Windows itself.

libwfp is targeted at Windows 7, 8 and 10.

## Example usage

### Fine-grained blocking of outgoing connections

``` cpp

#include 

#include 

#include 

#include 

#include 

#include 

#include 

#include 

#include 

#include 

int main()

{

    auto engine = wfp::FilterEngine::DynamicSession();

    wfp::SublayerBuilder sublayer(wfp::BuilderValidation::OnlyCritical);

    sublayer

        .name(L"libwfp example layer")

        .weight(MAXUINT16);

    GUID sublayerGuid;

    wfp::ObjectInstaller::AddSublayer(*engine, sublayer, &sublayerGuid);

    // Conditions are checked against the specified layer

    // To verify that they're compatible

    wfp::ConditionBuilder conditions(FWPM_LAYER_ALE_AUTH_CONNECT_V4);

    // Match on application

    conditions.add_condition(std::make_unique( \

        L"c:\\windows\\system32\\svchost.exe"));

    // Match remote ports outside given range

    conditions.add_condition(wfp::conditions::ConditionPortRange::Remote( \

        0, 1023, wfp::conditions::CompareNeq()));

    wfp::FilterBuilder filter(wfp::BuilderValidation::OnlyCritical);

    filter

        .name(L"Svchost peer filter")

        .description(L"Block comms with remote services outside the well-known port range")

        .layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)

        .sublayer(sublayerGuid)

        .weight(wfp::FilterBuilder::WeightClass::Max)

        .block();

    wfp::ObjectInstaller::AddFilter(*engine, filter, conditions);

    //

    // 

    //

    return 0;

}

```

# License

Copyright (C) 2022 Mullvad VPN AB

Permission to use the code, documentation and contents is granted under the conditions of the MIT

license.

For the full license agreement, see the LICENSE.md file.