Ebpfdivert

.circleci/config.yml

@@ -6,7 +6,7 @@ version: 2.1
 jobs:
   disabled:
     docker:
-      - image: cimg/base:stable
+      - image: cimg/base@sha256:35e5e29930ab565475a4f2aa9b4124998ed67dbc7b0e2dd5f420a4189d08d0d2 # stable
     steps:
       - run:
           name: "CircleCI is disabled"

.github/workflows/ci.yml

@@ -8,13 +8,21 @@
   workflow_dispatch: {}
 
 jobs:
+  verify-pinning:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Verify Pinning
+        uses: ffalcinelli/pinner/action@dff77e1d17140dc88eb827aa7d833f995796b92b # v0.0.11
+
   lint:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python
@@ -37,8 +45,8 @@
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python ${{ matrix.python-version }}
@@ -50,7 +58,7 @@
     - name: Run tests
       run: uv run pytest pydivert --capture=no -v --cov pydivert --cov-report=xml
     - name: Upload coverage
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: ./coverage.xml
         token: ${{ secrets.CODECOV_TOKEN }}
@@ -67,14 +75,14 @@
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Install system dependencies
       run: |
         sudo apt-get update
         sudo apt-get install -y libbpf-dev
 
-    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+    - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python ${{ matrix.python-version }}
@@ -100,7 +108,7 @@
         fi
 
     - name: Upload coverage
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: ./coverage.xml
         token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pages.yml

@@ -17,11 +17,11 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
       - name: Set up Python
@@ -31,7 +31,7 @@ jobs:
       - name: Build Docs
         run: uv run python docs/build.py
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./site
 

.github/workflows/release.yml

@@ -12,7 +12,7 @@ jobs:
       statuses: read
     steps:
       - name: Wait for CircleCI to pass
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const maxAttempts = 30;
@@ -48,9 +48,9 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python
@@ -70,9 +70,9 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python ${{ matrix.python-version }}
@@ -91,9 +91,9 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Set up Python
@@ -102,7 +102,7 @@ jobs:
       run: uv build
     - name: Upload artifact
       # uses: actions/upload-artifact@bbbca2d65b6e75b540449e92b4886f43607fa02 # v6
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: dist
         path: dist/
@@ -118,15 +118,14 @@ jobs:
       id-token: write
       contents: read
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Download dist artifact
-      # uses: actions/download-artifact@fa0b91be5b6e75b540449e92b4886f43607fa02 # v6
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: dist
         path: dist/
     - name: Install uv
-      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
     - name: Publish to PyPI
@@ -139,9 +138,8 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
     - name: Download dist artifact
-      # uses: actions/download-artifact@fa0b91be5b6e75b540449e92b4886f43607fa02 # v6
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: dist

.github/workflows/snyk.yml

@@ -15,10 +15,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install uv
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 

.gitignore

@@ -58,3 +58,7 @@ gha-creds-*.json
 .antigravitycli/
 debug_windivert.py
 test_from_linux
+*.pcap
+*.so
+*.o
+ebpfdivert/

.pinner.toml

@@ -0,0 +1,91 @@
+yes = false
+upgrade_strategy = "latest"
+concurrency = 10
+ignore = []
+compromised = []
+no_security_feedback = false
+
+[[vetted]]
+ref = "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
+tag = "v6.0.2"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"
+tag = "v6.0.3"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57"
+tag = "v8.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39"
+tag = "v8.2.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b"
+tag = "v4.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9"
+tag = "v5.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128"
+tag = "v5.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04"
+tag = "v1.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"
+tag = "v6.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f"
+tag = "v7.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea"
+tag = "v7.0.1"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3"
+tag = "v9.0.0"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"
+tag = "v7"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+tag = "v7.0.1"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+tag = "v8.0.1"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "cimg/base@sha256:35e5e29930ab565475a4f2aa9b4124998ed67dbc7b0e2dd5f420a4189d08d0d2"
+tag = "stable"
+timestamp = "2026-06-18T15:43:23Z"
+
+[[vetted]]
+ref = "ffalcinelli/pinner/action@dff77e1d17140dc88eb827aa7d833f995796b92b"
+tag = "v0.0.11"
+timestamp = "2026-06-22T04:39:36Z"

README.md

@@ -11,6 +11,9 @@
 
 **PyDivert** is a high-performance, cross-platform Python binding for capturing, modifying, and dropping network packets. It supports **Windows** via [WinDivert](https://reqrypt.org/windivert.html) and **Linux** via **eBPF (CO-RE)**.
 
+> [!WARNING]
+> Linux support via eBPF is experimental and should not be used in production environments.
+
 ## Features
 
 - **Cross-Platform**: Unified API for Windows (WinDivert) and Linux (eBPF).
@@ -178,7 +181,7 @@ Detailed protocol headers are available through `packet.ipv4`, `packet.ipv6`, `p
 - `Layer.SOCKET`: Socket-level events.
 - `Layer.REFLECT`: Reflected events.
 
-See the [Linux Backend Guide](docs/LINUX_BACKEND.md) for details on how these are implemented on Linux.
+See the [Linux Backend Guide](file:///home/fabio/Workspace/divert/pydivert/docs/LINUX_BACKEND.md) for details on how these are implemented on Linux.
 
 ### Flags
 
@@ -189,7 +192,7 @@ See the [Linux Backend Guide](docs/LINUX_BACKEND.md) for details on how these ar
 
 ## Filter Language
 
-Divert uses the WinDivert filter language to select which packets to capture. For a detailed reference on the syntax and available fields, see the [Filter Language Guide](#windivert-filter-language).
+Divert uses the WinDivert filter language to select which packets to capture. For a detailed reference on the syntax and available fields, see the [Filter Language Guide](file:///home/fabio/Workspace/divert/pydivert/docs/FILTER_LANGUAGE.md).
 
 For the original technical reference, please visit the [official WinDivert documentation](https://reqrypt.org/windivert-doc.html#filter_language).
 

Vagrantfile

@@ -18,6 +18,14 @@ Vagrant.configure("2") do |config|
       curl -LsSf https://astral.sh/uv/install.sh | UV_INSTALL_DIR=/usr/local/bin sh
       cd /pydivert
       uv sync --extra test --extra linux
+
+      # Configure sysctls for loopback packet injection
+      sysctl -w net.ipv4.conf.all.rp_filter=0
+      sysctl -w net.ipv4.conf.lo.rp_filter=0
+      sysctl -w net.ipv4.conf.all.route_localnet=1
+      sysctl -w net.ipv4.conf.lo.route_localnet=1
+      sysctl -w net.ipv4.conf.all.accept_local=1
+      sysctl -w net.ipv4.conf.lo.accept_local=1
     SHELL
 
     linux.vm.provision "test-linux", type: "shell", path: "scripts/run-tests-linux.sh", run: "never"