Layered Service Provider

A Layered Service Provider (LSP) is a feature of the Microsoft Windows Winsock 2 Service Provider Interface (SPI). A Layered Service Provider is a DLL that uses Winsock APIs to insert itself into the TCP/IP stack. Once in the stack, a Layered Service Provider can intercept and modify inbound and outbound Internet traffic. It allows processing all the TCP/IP traffic taking place between the Internet and the applications that are accessing the Internet (such as a web browser, the email client, etc). For example, it could be used by a computer security program, which analyzes the traffic in search for viruses or other threats before transferring it to the final application of the traffic. The Winsock "Service Provider Interface (SPI)" API provides a mechanism for layering providers on top of each other. Winsock LSPs are available for a range of useful purposes, including parental controls and Web content filtering. The layering order of all providers is kept in the Winsock Catalog.

Details

Unlike the well-known Winsock 2 API, which is covered by numerous books, documentation, and samples, the Winsock 2 SPI is relatively unexplored. The Winsock 2 SPI is implemented by network transport service providers and namespace resolution service providers. The Winsock 2 SPI can be used to extend an existing transport service provider by implementing a Layered Service Provider. For example, Quality of Service (QoS) on Windows 98 and Windows 2000 is implemented as an LSP over the TCP/IP protocol stack. Another use for LSPs would be to develop specialized URL filtering software to prevent Web browsers from accessing certain sites, regardless of the browser installed on a desktop. The Winsock 2 SPI allows you to develop two different types of service providers — transport and namespace. Transport providers (commonly referred to as protocol stacks) are services, which supply functions that set up connections, transfer data, exercise flow control, error control, and so on. Namespace providers are services that associate the addressing attributes of a network protocol with one or more human-friendly names and enable protocol-independent name resolution. The SPI also allows you to develop two types of transport service providers—base and layered service providers.

Base service providers implement the actual details of a transport protocol: setting up connections, transferring data, and exercising flow control and error control. Layered service providers implement only higher-level custom communication functions and rely on an existing underlying base provider for the actual data exchange with a remote endpoint.

Winsock 2 LSPs are implemented as standard Windows DLLs with a single exported entry function, "WSPStartup". All other transport SPI functions are made accessible to ws2_32.dll or an upper chain layered provider via the LSP's dispatch table. LSPs and base providers are strung together to form a protocol chain. The LSP DLL has to be registered using a special LSP registrant which instructs Winsock 2, the loading order of the LSPs (there can be more than one LSP installed) and which protocols to intercept.

LSPs work by intercepting Winsock 2 commands before they are processed by ws2_32.dll, they can modify the commands, drop a command, or just log the data which makes them a powerful tool for: Network filters, Network intercepters, and stream based sniffers.

There are two kinds of LSP: IFS and non IFS LSP. Currently most LSPs on the market are non IFS. The difference between the two LSPs is that non IFS LSPs modify the socket handle to a non valid Windows IFS handle and therefore the LSP must implement all Winsock 2 methods. IFS LSPs, on the other hand, preserve the socket handle, which allows the LSP to implement only the functions it wants to intercept.

Corruption issues

One major common issue with LSPs was that if they were to be removed or unregistered improperly or if the LSP was buggy, it would result in corruption of the Winsock catalog in the registry, and the entire TCP/IP stack would break and the computer could no longer access the internet.

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network stack and forward all of the user's traffic to an unauthorized external site, where it can be data-mined to find the user's interests to bombard him/her with targeted advertisements, as well as spam e-mail. If such malware is removed, the computer may be left without a working network connection, should the LSP fail to unregister properly.

Such potential loss of all network connectivity is prevented in Windows XP Service Pack 2, Windows Server 2003 Service Pack 1 and all later Windows operating systems, in which Winsock has the ability to self-heal after a user uninstalls such an LSP. [ [http://support.microsoft.com/kb/811259 How to determine and recover from Winsock2 corruption] ] There are also a number of third-party programs that can fix broken LSP configurations (such as Winsock Fix [http://www.snapfiles.com/get/winsockxpfix.html] ).

References

* [http://www.microsoft.com/msj/0599/LayeredService/LayeredService.aspx Unraveling the Mysteries of Writing a Winsock 2 Layered Service Provider - Microsoft Systems Journal]
* [http://blogs.msdn.com/wndp/archive/2006/02/09/529031.aspx Categorizing LSPs and Applications]

External links

* [http://www.securityfocus.com/archive/1/archive/1/440532/100/0/threaded New PowerPoint Trojan installs itself as LSP]
* [http://www.komodia.com/index.php?page=lsp.html Komodia's Inc. free LSP resources and repacked version of Microsoft's LSP sample]
* [http://hisown.com/Talks/spi.pdf The "Dark Side of Winsock": PDF of a DefCon presentation dealing with the creation and exploitation of Winsock Layered Service Providers ]
* [http://www.findinternettv.com/Video,item,2351599995.aspx the "Dark Side of Winsock": Video of same presentation]