leviathan-driver 0.1.0

//! Windows Filtering Platform (WFP) Network Filter
//!
//! Implements network packet filtering using WFP callouts.
//!
//! # Capabilities
//! - Inspect/block network connections (TCP/UDP)
//! - Deep packet inspection (DPI)
//! - Application-aware firewall
//! - Network traffic monitoring
//! - Implement custom network policies
//!
//! # WFP Layers
//! WFP provides multiple layers for filtering at different points:
//! - INBOUND/OUTBOUND_IPPACKET: Raw IP packets
//! - INBOUND/OUTBOUND_TRANSPORT: TCP/UDP layer
//! - ALE_AUTH_CONNECT/RECV_ACCEPT: Connection authorization
//! - STREAM: TCP stream data
//!
//! # Use Cases
//! - Host-based firewall
//! - Network intrusion detection (NIDS)
//! - Application control (block specific apps)
//! - Data exfiltration prevention
//! - VPN/proxy implementation

use core::sync::atomic::{AtomicBool, Ordering};
use core::ptr;
use wdk::println;
use wdk_sys::{
    NTSTATUS, PVOID, STATUS_SUCCESS, HANDLE, GUID,
    FWP_ACTION_TYPE, FWP_CLASSIFY_OUT, FWP_INCOMING_VALUES,
    FWPS_CALLOUT, FWPS_FILTER, FWPM_CALLOUT, FWPM_FILTER,
    FWPM_SUBLAYER,
};

/// Flag indicating if WFP callouts are registered
static REGISTERED: AtomicBool = AtomicBool::new(false);

/// Engine handle for WFP operations
static mut ENGINE_HANDLE: HANDLE = ptr::null_mut();

/// Callout IDs for unregistration
static mut CALLOUT_IDS: [u32; 4] = [0; 4];

/// Our custom sublayer GUID
/// {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
pub const SUBLAYER_GUID: GUID = GUID {
    Data1: 0xA1B2C3D4,
    Data2: 0xE5F6,
    Data3: 0x7890,
    Data4: [0xAB, 0xCD, 0xEF, 0x12, 0x34, 0x56, 0x78, 0x90],
};

/// Outbound IPv4 callout GUID
pub const CALLOUT_OUTBOUND_IPV4_GUID: GUID = GUID {
    Data1: 0x11111111,
    Data2: 0x1111,
    Data3: 0x1111,
    Data4: [0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11],
};

/// Inbound IPv4 callout GUID
pub const CALLOUT_INBOUND_IPV4_GUID: GUID = GUID {
    Data1: 0x22222222,
    Data2: 0x2222,
    Data3: 0x2222,
    Data4: [0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22],
};

/// ALE Connect callout GUID (application layer)
pub const CALLOUT_ALE_CONNECT_GUID: GUID = GUID {
    Data1: 0x33333333,
    Data2: 0x3333,
    Data3: 0x3333,
    Data4: [0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33, 0x33],
};

/// ALE Recv Accept callout GUID
pub const CALLOUT_ALE_RECV_GUID: GUID = GUID {
    Data1: 0x44444444,
    Data2: 0x4444,
    Data3: 0x4444,
    Data4: [0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44],
};

/// Network action to take on traffic
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum NetworkAction {
    /// Allow the traffic
    Permit,
    /// Block the traffic
    Block,
    /// Continue to next filter
    Continue,
}

/// Connection information for logging/decisions
#[derive(Debug)]
pub struct ConnectionInfo {
    pub local_addr: [u8; 4],
    pub local_port: u16,
    pub remote_addr: [u8; 4],
    pub remote_port: u16,
    pub protocol: u8,
    pub process_id: u32,
    pub direction: Direction,
}

#[derive(Debug, Clone, Copy)]
pub enum Direction {
    Inbound,
    Outbound,
}

/// Blocked IP addresses/ranges
/// In production, use a proper data structure (hash set, trie)
const BLOCKED_IPS: &[[u8; 4]] = &[
    // Example: Block some IPs
    // [192, 168, 1, 100],
];

/// Blocked ports (common malware C2 ports)
const BLOCKED_PORTS: &[u16] = &[
    4444,  // Metasploit default
    5555,  // Common RAT
    6666,  // Common malware
    31337, // Elite/Back Orifice
];

/// Register WFP callouts and filters
///
/// # Safety
/// Must be called from DriverEntry at PASSIVE_LEVEL
pub unsafe fn register(_device_object: PVOID) -> Result<(), NTSTATUS> {
    if REGISTERED.load(Ordering::SeqCst) {
        return Ok(());
    }

    // Open a session to the filter engine
    let mut engine_handle: HANDLE = ptr::null_mut();
    let status = unsafe {
        wdk_sys::fwpkclnt::FwpmEngineOpen(
            ptr::null(),     // Local engine
            wdk_sys::RPC_C_AUTHN_WINNT,
            ptr::null_mut(), // No client identity
            ptr::null(),     // Default session
            &mut engine_handle,
        )
    };

    if status != STATUS_SUCCESS {
        println!("[Leviathan] Failed to open WFP engine: {:#x}", status);
        return Err(status);
    }

    unsafe { ENGINE_HANDLE = engine_handle };

    // Add our sublayer
    unsafe { add_sublayer(engine_handle)? };

    // Register callouts
    unsafe { register_callouts(_device_object)? };

    // Add filters that use our callouts
    unsafe { add_filters(engine_handle)? };

    REGISTERED.store(true, Ordering::SeqCst);
    println!("[Leviathan] WFP network filter registered");
    Ok(())
}

/// Unregister WFP callouts and filters
///
/// # Safety
/// Must be called from driver unload
pub unsafe fn unregister() {
    if !REGISTERED.load(Ordering::SeqCst) {
        return;
    }

    // Unregister callouts
    for i in 0..4 {
        let id = unsafe { CALLOUT_IDS[i] };
        if id != 0 {
            let _ = unsafe { wdk_sys::fwpkclnt::FwpsCalloutUnregisterById(id) };
        }
    }

    // Close engine handle
    let handle = unsafe { ENGINE_HANDLE };
    if !handle.is_null() {
        let _ = unsafe { wdk_sys::fwpkclnt::FwpmEngineClose(handle) };
        unsafe { ENGINE_HANDLE = ptr::null_mut() };
    }

    REGISTERED.store(false, Ordering::SeqCst);
    println!("[Leviathan] WFP network filter unregistered");
}

/// Add our custom sublayer to WFP
unsafe fn add_sublayer(engine_handle: HANDLE) -> Result<(), NTSTATUS> {
    let sublayer = FWPM_SUBLAYER {
        subLayerKey: SUBLAYER_GUID,
        displayData: wdk_sys::FWPM_DISPLAY_DATA0 {
            name: ptr::null_mut(),
            description: ptr::null_mut(),
        },
        flags: 0,
        providerKey: ptr::null_mut(),
        providerData: wdk_sys::FWP_BYTE_BLOB {
            size: 0,
            data: ptr::null_mut(),
        },
        weight: 0xFFFF, // High priority
    };

    let status = unsafe {
        wdk_sys::fwpkclnt::FwpmSubLayerAdd(engine_handle, &sublayer, ptr::null_mut())
    };

    if status != STATUS_SUCCESS && status != 0x80320009 { // Already exists
        println!("[Leviathan] Failed to add sublayer: {:#x}", status);
        return Err(status);
    }

    Ok(())
}

/// Register WFP callouts with the filter engine
unsafe fn register_callouts(device_object: PVOID) -> Result<(), NTSTATUS> {
    // Register outbound IPv4 callout
    let outbound_callout = FWPS_CALLOUT {
        calloutKey: CALLOUT_OUTBOUND_IPV4_GUID,
        flags: 0,
        classifyFn: Some(classify_outbound),
        notifyFn: Some(notify_callout),
        flowDeleteFn: None,
    };

    let mut callout_id: u32 = 0;
    let status = unsafe {
        wdk_sys::fwpkclnt::FwpsCalloutRegister(
            device_object,
            &outbound_callout,
            &mut callout_id,
        )
    };

    if status != STATUS_SUCCESS {
        return Err(status);
    }
    unsafe { CALLOUT_IDS[0] = callout_id };

    // Register inbound IPv4 callout
    let inbound_callout = FWPS_CALLOUT {
        calloutKey: CALLOUT_INBOUND_IPV4_GUID,
        flags: 0,
        classifyFn: Some(classify_inbound),
        notifyFn: Some(notify_callout),
        flowDeleteFn: None,
    };

    let status = unsafe {
        wdk_sys::fwpkclnt::FwpsCalloutRegister(
            device_object,
            &inbound_callout,
            &mut callout_id,
        )
    };

    if status != STATUS_SUCCESS {
        return Err(status);
    }
    unsafe { CALLOUT_IDS[1] = callout_id };

    // Register ALE (Application Layer Enforcement) connect callout
    let ale_connect_callout = FWPS_CALLOUT {
        calloutKey: CALLOUT_ALE_CONNECT_GUID,
        flags: 0,
        classifyFn: Some(classify_ale_connect),
        notifyFn: Some(notify_callout),
        flowDeleteFn: None,
    };

    let status = unsafe {
        wdk_sys::fwpkclnt::FwpsCalloutRegister(
            device_object,
            &ale_connect_callout,
            &mut callout_id,
        )
    };

    if status != STATUS_SUCCESS {
        return Err(status);
    }
    unsafe { CALLOUT_IDS[2] = callout_id };

    println!("[Leviathan] WFP callouts registered");
    Ok(())
}

/// Add filters that use our callouts
unsafe fn add_filters(_engine_handle: HANDLE) -> Result<(), NTSTATUS> {
    // In production, would add FWPM_FILTER entries for each layer
    // pointing to our callouts

    // Example filter for outbound connections:
    // - Layer: FWPM_LAYER_OUTBOUND_TRANSPORT_V4
    // - Callout: CALLOUT_OUTBOUND_IPV4_GUID
    // - Conditions: Match all traffic (or specific ports/apps)

    println!("[Leviathan] WFP filters added");
    Ok(())
}

/// Classify callback for outbound traffic
unsafe extern "C" fn classify_outbound(
    _fixed_values: *const FWP_INCOMING_VALUES,
    _meta_values: *const wdk_sys::FWPS_INCOMING_METADATA_VALUES,
    _layer_data: PVOID,
    _context: PVOID,
    _filter: *const FWPS_FILTER,
    _flow_context: u64,
    classify_out: *mut FWP_CLASSIFY_OUT,
) {
    if classify_out.is_null() {
        return;
    }

    // Extract connection information from fixed_values
    // - Local/Remote IP addresses
    // - Local/Remote ports
    // - Protocol (TCP/UDP)
    // - Process ID

    // Make filtering decision
    let action = check_outbound_policy();

    // Apply the action
    let out = unsafe { &mut *classify_out };
    match action {
        NetworkAction::Permit => {
            out.actionType = wdk_sys::FWP_ACTION_PERMIT;
        }
        NetworkAction::Block => {
            out.actionType = wdk_sys::FWP_ACTION_BLOCK;
            out.flags |= wdk_sys::FWPS_CLASSIFY_OUT_FLAG_ABSORB;
        }
        NetworkAction::Continue => {
            out.actionType = wdk_sys::FWP_ACTION_CONTINUE;
        }
    }
}

/// Classify callback for inbound traffic
unsafe extern "C" fn classify_inbound(
    _fixed_values: *const FWP_INCOMING_VALUES,
    _meta_values: *const wdk_sys::FWPS_INCOMING_METADATA_VALUES,
    _layer_data: PVOID,
    _context: PVOID,
    _filter: *const FWPS_FILTER,
    _flow_context: u64,
    classify_out: *mut FWP_CLASSIFY_OUT,
) {
    if classify_out.is_null() {
        return;
    }

    // Check inbound traffic against policy
    let action = check_inbound_policy();

    let out = unsafe { &mut *classify_out };
    match action {
        NetworkAction::Permit => {
            out.actionType = wdk_sys::FWP_ACTION_PERMIT;
        }
        NetworkAction::Block => {
            out.actionType = wdk_sys::FWP_ACTION_BLOCK;
            out.flags |= wdk_sys::FWPS_CLASSIFY_OUT_FLAG_ABSORB;
        }
        NetworkAction::Continue => {
            out.actionType = wdk_sys::FWP_ACTION_CONTINUE;
        }
    }
}

/// Classify callback for ALE connect (application-aware)
///
/// This is called when an application initiates a connection.
/// We can see which process is making the connection.
unsafe extern "C" fn classify_ale_connect(
    _fixed_values: *const FWP_INCOMING_VALUES,
    _meta_values: *const wdk_sys::FWPS_INCOMING_METADATA_VALUES,
    _layer_data: PVOID,
    _context: PVOID,
    _filter: *const FWPS_FILTER,
    _flow_context: u64,
    classify_out: *mut FWP_CLASSIFY_OUT,
) {
    if classify_out.is_null() {
        return;
    }

    // From meta_values, we can get:
    // - processId: Which process is making the connection
    // - processPath: Full path to the executable

    // Use cases:
    // - Block specific applications from network access
    // - Whitelist allowed applications
    // - Log all network connections by process

    let out = unsafe { &mut *classify_out };
    out.actionType = wdk_sys::FWP_ACTION_PERMIT;
}

/// Notify callback for filter events
unsafe extern "C" fn notify_callout(
    _notify_type: wdk_sys::FWPS_CALLOUT_NOTIFY_TYPE,
    _filter_key: *const GUID,
    _filter: *const FWPS_FILTER,
) -> NTSTATUS {
    // Called when filters are added/removed
    STATUS_SUCCESS
}

/// Check outbound traffic against policy
fn check_outbound_policy() -> NetworkAction {
    // In production:
    // 1. Extract destination IP and port
    // 2. Check against blocklists
    // 3. Check process against application policy
    // 4. Perform reputation lookup

    NetworkAction::Permit
}

/// Check inbound traffic against policy
fn check_inbound_policy() -> NetworkAction {
    // In production:
    // 1. Check source IP against known threats
    // 2. Verify port is expected to be open
    // 3. Rate limiting for DDoS protection

    NetworkAction::Permit
}

/// Check if an IP address is blocked
#[allow(dead_code)]
fn is_blocked_ip(ip: &[u8; 4]) -> bool {
    for blocked in BLOCKED_IPS {
        if ip == blocked {
            return true;
        }
    }
    false
}

/// Check if a port is blocked
#[allow(dead_code)]
fn is_blocked_port(port: u16) -> bool {
    BLOCKED_PORTS.contains(&port)
}

/// Log a connection for audit purposes
#[allow(dead_code)]
fn log_connection(info: &ConnectionInfo, action: NetworkAction) {
    println!(
        "[Leviathan] {:?} {}:{} -> {}:{} (PID: {}) = {:?}",
        info.direction,
        format_ip(&info.local_addr),
        info.local_port,
        format_ip(&info.remote_addr),
        info.remote_port,
        info.process_id,
        action
    );
}

/// Format an IP address as a string
fn format_ip(ip: &[u8; 4]) -> [u8; 15] {
    let mut buf = [b' '; 15];
    // Simplified - would format properly
    buf[0] = ip[0];
    buf
}