Open-Source & Third-Party Notices

Related: Acceptable use · Security · Export & sanctions · Data Processing Addendum

Ferrite is closed-source, but it stands on open-source software. We are grateful to those projects and comply with their licenses. This page summarizes the notable components and how to obtain required source and license texts.

1. WinDivert — the bundled deep-inspection driver

Ferrite bundles and distributes WinDivert (© Basil, reqrypt.org/windivert.html), used under the GNU Lesser General Public License, version 3 (LGPL-3.0-only). WinDivert is dynamically loaded, not statically combined with Ferrite. As LGPL-3.0 requires:

• The full text of the LGPL-3.0 (and the GPL-3.0 it incorporates) is distributed with the Software and reproduced in THIRD_PARTY_LICENSES.txt.
• You may obtain the corresponding source for the version of WinDivert we distribute — from the upstream project, our mirror at ferritesec.com/legal/source (also mirroring the full official release package, source + the exact signed binaries we vendor), or the written offer in §4 — and you may replace it with a compatible build of your own.
• Replacing the DLL: as a supply-chain protection, Ferrite by default verifies WinDivert.dll against the official release hashes before loading it. To run your own modified build, an administrator creates the consent marker %ProgramData%\Ferrite\allow-unofficial-windivert and restarts the Ferrite engine service; your build then loads, with a provenance warning in the service log.
• Replacing the kernel driver: loading a modified WinDivert64.sys is additionally subject to Windows kernel-mode code-signing policy — a Microsoft platform requirement (your own attested signature, or test-signing mode), not a restriction Ferrite imposes. Ferrite adds no technical or contractual barrier of its own to driver replacement.

Who signs the driver — and why we are telling you

If you inspect WinDivert64.sys (right-click → Properties → Digital Signatures), the Authenticode signature reads Chengdu Mi Si Ting Technology Co., Ltd. — a company registered in Sichuan, China — issued by Sectigo under an EV code-signing certificate. The driver's own version resource lists Company="Basil", matching the upstream author.

We would rather you hear that from us than discover it yourself, so here is our position. The signing entity is the commercial vehicle the WinDivert author used to obtain EV code-signing and Microsoft attestation — an ordinary arrangement for an independent developer, and it is the official signature on the official release, not a re-signed copy. Concretely:

• We pin the exact bytes. Every copy of WinDivert we ship is verified against a SHA-256 hash allowlist at build time; anything unrecognized fails our release gate. A re-signed or modified driver could not ship in our installer even by accident.
• The driver's reach is narrow. WinDivert is loaded for packet capture and reinjection only. It holds no Ferrite credentials, receives no configuration from our servers, and is never an update channel.
• You can replace it — see the two bullets above — or remove it.
• Deep inspection is optional to the product. Ferrite's enforcement (Windows Filtering Platform), secure DNS, connection tracking and the entire rule engine work without the driver. If your policy does not permit it, run Ferrite without deep inspection: rules that would need it are honestly marked as not enforced rather than silently ignored.

What we do not claim: we have not audited WinDivert's source code, and we do not control its release schedule.

2. Rust and JavaScript components

Ferrite's engine and interface use many components under permissive licenses (MIT, Apache-2.0, BSD, ISC). Some are under the Mozilla Public License 2.0 (MPL-2.0) — for example cssparser, selectors, option-ext, and dompurify (MPL-2.0 or Apache-2.0). MPL-2.0 is a file-level copyleft license; we distribute those files unmodified, and their source is available from the upstream projects and via §4.

3. Data and fonts

[If distributed in the build:] IP-geolocation data may be provided by MaxMind GeoLite2 under its end-user license, with attribution. The interface uses the Geist typeface (© Vercel) under its font license. [Confirm the exact data and font components shipped in the build being published; Ferrite falls back to a small built-in table when no GeoLite2 database is present.]

4. Written offer for source (LGPL / MPL components)

For at least three years from your download, you may request the corresponding source code for the LGPL- and MPL-licensed components we distribute by writing to admin@ferritesec.com (subject: "Open-source source request"). We will provide it, or a download link, for no more than the cost of distribution.

5. Getting the full notices

The complete list of components and their full license texts for your build ships with the installer as THIRD_PARTY_LICENSES.txt in the Ferrite installation directory (by default C:\Program Files\Ferrite\). The app's Settings → About screen lists the major components and their licenses; builds newer than v0.1.0-beta.2 also include an "Open full notices" button there that opens the bundled THIRD_PARTY_LICENSES.txt directly.

← Back to home · Questions: admin@ferritesec.com