Mullvad libwfp

libwfp is a C++ library for interacting with the Windows Filtering Platform (WFP). Notably, libwfp provides builders for defining providers, filters and sets of conditions.

Checking out the code

The code is dependent on two other repositories:

mullvad/googletest

Forked Google Test that only updates a few project settings.
mullvad/windows-libraries

Specifically, the libcommon library contained herein, for general functionality not provided by the standard library.

For reasons of flexibility, these repositories are not included as submodules. They are instead required to be checked out at the same level as libwfp:

mkdir libwfp && cd libwfp
git clone https://github.com/mullvad/googletest.git
git clone https://github.com/mullvad/windows-libraries.git
git clone https://github.com/mullvad/libwfp.git

Development environment

libwfp requires Visual Studio 2017. Any edition will work, e.g. Visual Studio Community 2017 is a perfectly fine choice.

Dependencies

For dependencies required during development, see above, section Checking out the code.

For deployment there are no external dependencies beyond what is already provided by Windows itself.

libwfp is targeted at Windows 7, 8 and 10.

Example usage

Fine-grained blocking of outgoing connections

#include "libwfp/filterengine.h"
#include "libwfp/sublayerbuilder.h"
#include "libwfp/objectinstaller.h"
#include "libwfp/conditionbuilder.h"
#include "libwfp/conditions/conditionapplication.h"
#include "libwfp/conditions/conditionportrange.h"
#include "libwfp/conditions/comparison.h"
#include "libwfp/filterbuilder.h"
#include <memory>

int main()
{
    auto engine = wfp::FilterEngine::DynamicSession();

    wfp::SublayerBuilder sublayer;

    sublayer
        .name(L"libwfp example layer")
        .weight(MAXUINT16);

    GUID sublayerGuid;

    wfp::ObjectInstaller::AddSublayer(*engine, sublayer, &sublayerGuid);

    // Conditions are checked against the specified layer
    // To verify that they're compatible
    wfp::ConditionBuilder conditions(FWPM_LAYER_ALE_AUTH_CONNECT_V4);

    // Match on application
    conditions.add_condition(std::make_unique<wfp::conditions::ConditionApplication>( \
        L"c:\\windows\\system32\\svchost.exe"));

    // Match remote ports outside given range
    conditions.add_condition(wfp::conditions::ConditionPortRange::Remote( \
        0, 1023, wfp::conditions::CompareNeq()));

    wfp::FilterBuilder filter;

    filter
        .name(L"Svchost peer filter")
        .description(L"Block comms with remote services outside the well-known port range")
        .layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
        .sublayer(sublayerGuid)
        .weight(wfp::FilterBuilder::WeightClass::Max)
        .block();

    wfp::ObjectInstaller::AddFilter(*engine, filter, conditions);

    //
    // <More code here>
    //

    return 0;
}

License

Permission to use the code, documentation and contents is granted under the conditions of the MIT license.

For the full license agreement, see the LICENSE.md file.

chris1201 / libwfp