libwfp is a C++ library for interacting with the Windows Filtering Platform (WFP). Notably, libwfp provides builders for defining providers, filters and sets of conditions.
The code is dependent on one other repository:
-
mullvad/windows-libraries
Specifically, the
libcommonlibrary contained herein, for general functionality not provided by the standard library.
For reasons of flexibility, this repository is not included as a submodule. It is instead required to be checked out at the same level as libwfp:
mkdir libwfp && cd libwfp
git clone https://github.com/mullvad/windows-libraries.git
git clone https://github.com/mullvad/libwfp.git
libwfp requires Visual Studio 2017. Any edition will work, e.g. Visual Studio Community 2017 is a perfectly fine choice.
For dependencies required during development, see above, section Checking out the code.
For deployment there are no external dependencies beyond what is already provided by Windows itself.
libwfp is targeted at Windows 7, 8 and 10.
#include "libwfp/filterengine.h"
#include "libwfp/sublayerbuilder.h"
#include "libwfp/objectinstaller.h"
#include "libwfp/conditionbuilder.h"
#include "libwfp/conditions/conditionapplication.h"
#include "libwfp/conditions/conditionportrange.h"
#include "libwfp/conditions/comparison.h"
#include "libwfp/filterbuilder.h"
#include <memory>
int main()
{
auto engine = wfp::FilterEngine::DynamicSession();
wfp::SublayerBuilder sublayer;
sublayer
.name(L"libwfp example layer")
.weight(MAXUINT16);
GUID sublayerGuid;
wfp::ObjectInstaller::AddSublayer(*engine, sublayer, &sublayerGuid);
// Conditions are checked against the specified layer
// To verify that they're compatible
wfp::ConditionBuilder conditions(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
// Match on application
conditions.add_condition(std::make_unique<wfp::conditions::ConditionApplication>( \
L"c:\\windows\\system32\\svchost.exe"));
// Match remote ports outside given range
conditions.add_condition(wfp::conditions::ConditionPortRange::Remote( \
0, 1023, wfp::conditions::CompareNeq()));
wfp::FilterBuilder filter;
filter
.name(L"Svchost peer filter")
.description(L"Block comms with remote services outside the well-known port range")
.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
.sublayer(sublayerGuid)
.weight(wfp::FilterBuilder::WeightClass::Max)
.block();
wfp::ObjectInstaller::AddFilter(*engine, filter, conditions);
//
// <More code here>
//
return 0;
}Copyright (C) 2021 Mullvad VPN AB
Permission to use the code, documentation and contents is granted under the conditions of the MIT license.
For the full license agreement, see the LICENSE.md file.