Windows Packet Filter

using System;
using System.Diagnostics;
using System.Linq;
using System.Threading;
using NdisApiDotNet;
using NativeApi = NdisApiDotNet.Native.NdisApi;

// .NET 8, C# 12, AllowUnsafeBlocks=true; deploy a matching Unicode ndisapi.dll.
// Run on a test adapter: tunnel mode temporarily diverts its traffic.
using var filter = NdisApi.Open();
if (!filter.IsDriverLoaded())
    throw new InvalidOperationException("WinpkFilter driver is not loaded.");

var adapter = filter.GetNetworkAdapters().FirstOrDefault(a => a.IsValid)
    ?? throw new InvalidOperationException("No valid network adapter found.");
if (!filter.GetAdapterMode(adapter, out var previousMode))
    throw new InvalidOperationException("Could not query adapter mode.");
if (previousMode.dwFlags != NativeApi.MSTCP_FLAGS.MSTCP_FLAG_NONE)
    throw new InvalidOperationException("Choose a test adapter with no existing filtering mode.");
Console.WriteLine($"Adapter: {adapter.FriendlyName}");

using var waitEvent = new AutoResetEvent(false);
unsafe
{
    // Allocate before changing driver state.
    NativeApi.ETH_REQUEST* request = filter.CreateEthRequest();
    request->hAdapterHandle = adapter.Handle;
    bool eventSet = false, modeSet = false;
    int sent = 0, received = 0;
    Exception primaryFailure = null;

    try
    {
        eventSet = filter.SetPacketEvent(adapter, waitEvent);
        if (!eventSet)
            throw new InvalidOperationException("Could not register packet event.");

        modeSet = filter.SetAdapterMode(adapter,
            NativeApi.MSTCP_FLAGS.MSTCP_FLAG_SENT_TUNNEL |
            NativeApi.MSTCP_FLAGS.MSTCP_FLAG_RECV_TUNNEL);
        if (!modeSet)
            throw new InvalidOperationException("Could not enable tunnel mode.");

        var timer = Stopwatch.StartNew();
        // Stop after 100 notifications, 5 idle seconds, or 10 seconds in total.
        // Process a bounded number of notification cycles for this minimal example
        const int DemoWakeups = 100;
        for (int i = 0; i < DemoWakeups; i++)
        {
            int remaining = (int)Math.Min(5000, 10000 - timer.ElapsedMilliseconds);
            if (remaining <= 0 || !waitEvent.WaitOne(remaining))
                break;

            // Check the deadline while draining a busy queue, too.
            while (timer.ElapsedMilliseconds < 10000 && filter.ReadPacket(ref *request))
            {
                var buffer = (NativeApi.INTERMEDIATE_BUFFER*)request->EthPacket.Buffer;
                bool onSend = (buffer->m_dwDeviceFlags & NativeApi.PACKET_FLAG.PACKET_FLAG_ON_SEND) != 0;
                bool forwarded = onSend
                    ? filter.SendPacketToAdapter(ref *request)
                    : filter.SendPacketToMstcp(ref *request);
                if (!forwarded)
                    throw new InvalidOperationException("Could not reinject packet.");
                if (onSend) sent++; else received++;
            }
        }
        Console.WriteLine($"Forwarded: sent={sent}, received={received}");
    }
    catch (Exception ex)
    {
        primaryFailure = ex;
        throw;
    }
    finally
    {
        // Restore mode before removing the notification event.
        bool modeReset = !modeSet || filter.ResetAdapterMode(adapter);
        bool eventReset = !eventSet || filter.ResetPacketEvent(adapter);
        filter.DisposeObject(request);
        if (!modeReset)
            Console.Error.WriteLine("Could not reset adapter mode.");
        if (!eventReset)
            Console.Error.WriteLine("Could not unregister packet event.");
        if ((!modeReset || !eventReset) && primaryFailure == null)
            throw new InvalidOperationException("Packet capture cleanup failed.");
    }
}

use ndisapi::{
    DirectionFlags, EthRequest, EthRequestMut, FilterFlags, IntermediateBuffer, Ndisapi,
};
use windows::Win32::Foundation::{
    CloseHandle, HANDLE, WAIT_FAILED, WAIT_OBJECT_0, WAIT_TIMEOUT,
};
use windows::Win32::System::Threading::{CreateEventW, ResetEvent, WaitForSingleObject};

// Own the notification event and restore the adapter on every return path.
struct PacketSession<'a> {
    driver: &'a Ndisapi,
    adapter: HANDLE,
    event: HANDLE,
    attached: bool,
}

impl<'a> PacketSession<'a> {
    fn new(driver: &'a Ndisapi, adapter: HANDLE) -> windows::core::Result<Self> {
        let event = unsafe { CreateEventW(None, true, false, None)? };
        let mut session = Self { driver, adapter, event, attached: false };
        driver.set_packet_event(adapter, event)?;
        session.attached = true;
        Ok(session)
    }

    fn stop(&mut self) -> windows::core::Result<()> {
        if !self.attached {
            return Ok(());
        }
        let mode = self.driver.set_adapter_mode(self.adapter, FilterFlags::default());
        let event = self.driver.set_packet_event(self.adapter, HANDLE::default());
        if mode.is_ok() && event.is_ok() {
            self.attached = false;
        }
        mode.and(event)
    }
}

impl Drop for PacketSession<'_> {
    fn drop(&mut self) {
        // Explicit stop below reports errors; Drop retries cleanup after errors.
        let _ = self.stop();
        let _ = unsafe { CloseHandle(self.event) };
    }
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let driver = Ndisapi::new("NDISRD")
        .map_err(|e| format!("Failed to connect to driver: {e:?}"))?;
    let adapters = driver.get_tcpip_bound_adapters_info()?;
    let adapter = adapters.first().ok_or("No TCP/IP bound adapters found")?;
    let handle = adapter.get_handle();
    if !driver.get_adapter_mode(handle)?.is_empty() {
        return Err("Adapter is already being filtered".into());
    }

    let mut session = PacketSession::new(&driver, handle)?;
    driver.set_adapter_mode(
        handle,
        FilterFlags::MSTCP_FLAG_SENT_TUNNEL | FilterFlags::MSTCP_FLAG_RECV_TUNNEL,
    )?;
    println!("Passing packets on the first adapter; stopping after 5 seconds idle or 100 wakeups.");

    let mut packet = IntermediateBuffer::default();
    const DEMO_WAKEUPS: usize = 100;
    const IDLE_TIMEOUT_MS: u32 = 5_000;
    for _ in 0..DEMO_WAKEUPS {
        match unsafe { WaitForSingleObject(session.event, IDLE_TIMEOUT_MS) } {
            WAIT_OBJECT_0 => (),
            WAIT_TIMEOUT => {
                println!("No packets for 5 seconds; stopping.");
                break;
            }
            WAIT_FAILED => return Err(std::io::Error::last_os_error().into()),
            _ => return Err("Unexpected packet event wait result".into()),
        }
        // Reset before draining: arrivals after an empty read keep the event set.
        unsafe { ResetEvent(session.event)?; }

        loop {
            let mut read_request = EthRequestMut::new(handle);
            read_request.set_packet(&mut packet);
            if driver.read_packet(&mut read_request).is_err() {
                break;
            }

            let mut write_request = EthRequest::new(handle);
            write_request.set_packet(&packet);
            if packet.get_device_flags().contains(DirectionFlags::PACKET_FLAG_ON_SEND) {
                driver.send_packet_to_adapter(&write_request)?;
            } else {
                driver.send_packet_to_mstcp(&write_request)?;
            }
        }
    }

    session.stop()?;
    println!("Filtering disabled; packet event detached.");
    Ok(())
}

package main

// Go 1.20+, native 64-bit Windows (amd64 or arm64).
// Select a test adapter: tunnel mode temporarily diverts its traffic.
// This demo waits for 100 packet notifications and can block on an idle adapter.

import (
    "errors"
    "fmt"
    "log"
    "unsafe"

    "github.com/wiresock/ndisapi-go"
    "golang.org/x/sys/windows"
)

func main() {
    if err := run(); err != nil {
        log.Fatal(err)
    }
}

func run() (result error) {
    // These bindings use 64-bit driver handles; reject incompatible layouts.
    if unsafe.Sizeof(uintptr(0)) != 8 {
        return fmt.Errorf("this example requires 64-bit Windows (amd64 or arm64)")
    }

    // Open WinpkFilter driver instance
    api, err := ndisapi.NewNdisApi()
    if err != nil {
        return fmt.Errorf("open NDIS API: %w", err)
    }
    defer api.Close()

    if !api.IsDriverLoaded() {
        return fmt.Errorf("WinpkFilter driver is not loaded")
    }

    // Query TCP/IP bound network adapters
    adapters, err := api.GetTcpipBoundAdaptersInfo()
    if err != nil {
        return fmt.Errorf("enumerate adapters: %w", err)
    }
    if adapters.AdapterCount == 0 {
        return fmt.Errorf("no TCP/IP bound adapters found")
    }

    adapter := adapters.AdapterHandle[0]

    event, err := windows.CreateEvent(nil, 1, 0, nil)
    if err != nil {
        return fmt.Errorf("create packet event: %w", err)
    }
    defer func() { result = errors.Join(result, windows.CloseHandle(event)) }()

    if err := api.SetPacketEvent(adapter, event); err != nil {
        return fmt.Errorf("set packet event: %w", err)
    }
    defer func() { result = errors.Join(result, api.SetPacketEvent(adapter, 0)) }()

    // Enter bidirectional tunnel mode
    mode := &ndisapi.AdapterMode{
        AdapterHandle: adapter,
        Flags:         ndisapi.MSTCP_FLAG_SENT_TUNNEL | ndisapi.MSTCP_FLAG_RECV_TUNNEL,
    }
    if err := api.SetAdapterMode(mode); err != nil {
        return fmt.Errorf("set adapter mode: %w", err)
    }
    defer func() {
        mode.Flags = 0
        result = errors.Join(result, api.SetAdapterMode(mode))
    }()

    var buffer ndisapi.IntermediateBuffer
    request := &ndisapi.EtherRequest{
        AdapterHandle: adapter,
        EthernetPacket: ndisapi.EthernetPacket{
            Buffer: &buffer,
        },
    }

    // Process a bounded number of notification cycles for this minimal example
    const demoWakeups = 100
    for i := 0; i < demoWakeups; i++ {
        status, err := windows.WaitForSingleObject(event, windows.INFINITE)
        if err != nil {
            return fmt.Errorf("wait for packet event: %w", err)
        }
        if status != windows.WAIT_OBJECT_0 {
            return fmt.Errorf("unexpected wait result: %d", status)
        }
        if err := windows.ResetEvent(event); err != nil {
            return fmt.Errorf("reset packet event: %w", err)
        }

        // Use the IOCTL result directly: nil means a packet was read.
        for {
            requestSize := uint32(unsafe.Sizeof(*request))
            if err := api.DeviceIoControl(
                ndisapi.IOCTL_NDISRD_READ_PACKET,
                unsafe.Pointer(request), requestSize,
                unsafe.Pointer(request), requestSize,
                nil, nil,
            ); err != nil {
                break
            }
            if buffer.DeviceFlags == ndisapi.PACKET_FLAG_ON_SEND {
                // Outgoing from TCP/IP: reinject downward to network adapter
                err = api.SendPacketToAdapter(request)
            } else {
                // Incoming from network: reinject upward to TCP/IP stack
                err = api.SendPacketToMstcp(request)
            }
            if err != nil {
                return fmt.Errorf("reinject packet: %w", err)
            }
        }
    }

    // Deferred cleanup restores normal mode, unregisters the event, and closes handles.
    return nil
}