Windows Filtering Platform

From Wikipedia, the free encyclopedia
Jump to: navigation, search

In Microsoft computer-systems, the Windows Filtering Platform (WFP) comprises a set of system services and an application programming interface first introduced with Windows Vista in 2006/2007. It allows applications to tie into the packet processing and filtering pipeline of the Next Generation TCP/IP network stack. It provides features such as integrated communication and administrators can configure it for invoking processing logic on a per-application basis. Microsoft intended WFP for use by firewalls and by other packet-processing or connection-monitoring components.

Components[edit]

The filtering platform consists of the following components:

  • Filter engine, which spans both kernel-mode and user-mode, providing basic filtering capabilities. It matches the data within a packet, as exposed by the shims, against filtering rules, and either blocks or permits the packet. A callout may implement any other action as required. The filters operate on a per-application basis.
  • Base filtering engine, the module that manages the filtering engine. It accepts filtering rules and enforces the security model of the application. It also maintains statistics for the WFP and logs its state.
  • Callout, a callback function exposed by a filtering driver. The filtering drivers provide filtering capabilities other than the default block/allow. Administrators specify a callout function during registration of a filter rule. When the filter is matched, the callout is invoked, which handles a specified action.

Memory leaks and race conditions[edit]

MS KB # 979223 documents a serious memory leak, affecting Vista through Windows 7. Because of this and of some other issues, all deployments of WFP should include MS hotfix rollup # 981889.[citation needed] Windows 7 SP1 or for Vista SP3 (when it comes out) or newer do not require fixes.

Note that other problems persist regarding use of multiple Network Buffer Lists.

See also[edit]

External links[edit]