ADVANCED PAC= KET INJECTION

Overview

The Advanced Packet Injection scenario will create a n= ew packet based off of the original packet and inject it back to the same layer. No modification is performe= d on the packet, with the following exceptions:

· The packet is loopback and only one of eithe= r the source or destination address is that of the software loopback. In this case, the IP header is modified= by changing the software loopback address to that of an address on the local machine. This is required due to T= CPIP’s stack validation logic.

· The packet is received at an inbound transpo= rt layer, and had been IPsec secured. In this case, it is necessary to reconst= ruct the IP header as IPsec processing does not remove the original ESP or AH information from it.

All filters added sit in WFPSampl= er's sublayer (which is weighted just below IPsec's sublayer), unless otherwise specified using the -sl <SUBLAYER> command line option. All filters are associated with WFPSampler's provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Advanced Packet Injection Scenario=

When traffic matches a filter at the specified layer, = ClassifyAdvancedPacketInjection() is invoked by the Filtering Engine. This function validates th= at we can perform the injection by looking at the pClassifyO= ut rights. It will then create the INJECTION_DATA which consists of the injectionHandle and the injectionState. If the injectionSt= ate indicates that we haven’t injected this packet before, then the injection method is determined (default is asynchronous), and the appropriate triggerFn is called.= At this point, the original packet will be blocked.

If the injection method is synchronous (inline), TriggerAdvancedPacketInjectionInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. Depending on which layer the injection = is happening, the appropriate performFn is called.=

If the injection method is asynchronous (out of band),= TriggerAdvancedPacketInjectionOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn (de= fault is DeferredProcedureCalls) is invoked.

Regardless of which queueFn is used, each will call the appropriate performFn = based on the layer the injection is happening.

Each of the performFns are tailored to inject for their respective layers. Each will get the required data for its specific injectionFn. Depending on the layer, the offsets are adjusted on the original so = the whole packet is available. Once the offsets are adjusted, a new NBL is created, the original data is copied ove= r, and the offsets of the original are returned to the original place. If any of the exceptions noted above are required, then modification of the IP header occurs. Finally, the appropria= te injectionFn is invoked.

Upon successful injection, CompleteAdvancedPack= etInjection() will be called by the TCPIP stack. This function will show the status of the injected packet. Additionally, any memory that was allocated from the functions above, will be freed and any references released.

Applicable Layers

v FWPM_LAYER_INBOUND_IPPACKET_V4

v FWPM_LAYER_INBOUND_IPPACKET_V6

v FWPM_LAYER_OUTBOUND_IPPACKET_V4

v FWPM_LAYER_OUTBOUND_IPPACKET_V6

v FWPM_LAYER_IPFORWARD_V4

v FWPM_LAYER_IPFORWARD_V6

v FWPM_LAYER_INBOUND_TRANSPORT_V4

v FWPM_LAYER_INBOUND_TRANSPORT_V6

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v FWPM_LAYER_DATAGRAM_DATA_V4

v FWPM_LAYER_DATAGRAM_DATA_V6

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v FWPM_LAYER_STREAM_PACKET_V4 (Win7+= )

v FWPM_LAYER_STREAM_PACKET_V6 (Win7+= )

v FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_ETHERNET (Win8+)

Command Line Usage

Option	Argument	Meaning
-s	ADVANCED_PACKET_INJECTION	Implement the ADVANCED_PACKET_INJECTION scenario
-l	Applicable Layer	Layer at which this filter will apply
-sl	Applicable subLayer	SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER].
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-in		Perform the injection synchronously (inline)
-tdpc		Use threaded DPCs for asynchronous (out of band) queuing method
-wi		Use work items for asynchronous (out of band) queuing method
-r		Remove objects associated with this scenario instance
-ab	Additional Bytes to allocate	Create a new packet the size of the original + these additional b= ytes
-?		Display help

“WFPSampler.E= xe -s ADVANCED_PACKET_INJECTION -?“ provides help output

“WFPSampler.E= xe -s ADVANCED_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l= ) which references the appropriate callout. This filter will have no conditions, meaning it will act on all traf= fic seen at this layer.

“WFPSampler.E= xe -s ADVANCED_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 –v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKE= T_V4 (-l) which references the appropri= ate callout.

“WFPSampler.E= xe -s ADVANCED_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -ipla 1.0.0.1= –ipra 1.0.0.254“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have 2 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-= ipla) equals 1.0.0.1, and FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254.

“WFPSampler.E= xe -s ADVANCED_PACKET_INJECTION -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0.= 1 –ipra 1.0.0.254 –ipp TCP -= in“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropri= ate callout. This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PRO= TOCOL (-ipp<= /b>) equals TCP. The injection will be performed synchronously (-in).=

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.