BASIC ACTION

Overview

The Basic Action scenarios are designed to return simple
actions.  No injection takes place, and
by default, they utilize static filters.

All filters added sit in WFPSampler’s
sublayer (which is weighted just below IPsec’s sublayer), unless otherwise
specified using the –sl
<SUBLAYER> command line option.
All filters are associated with WFPSampler’s
provider.

When a callout is used, the following diagram shows how the
code flows:

Figure A. Code flow for Basic Action Scenario

When traffic matches a filter at the specified layer, and
the filter uses a callout, then the ClassifyBasicActionFn
is invoked by the Filtering Engine.
These functions make sure it can update the action and dictates which
action to return via PerformBasicAction().

The ClassifyBasicActionBlock() function will always return
FWP_ACTION_BLOCK, causing the traffic to be dropped.

The ClassifyBasicActionContinue() function will always return
FWP_ACTION_CONTINUE, causing the traffic to be allowed unless another filter in
a different sublayer returns FWP_ACTION_BLOCK.

The ClassifyBasicActionPermit() function will always return
FWP_ACTION_PERMIT, causing the traffic to be allowed unless another filter in a
different sublayer returns FWP_ACTION_BLOCK.

The ClassifyBasicActionRandom() function (which always uses a
callout) will randomly return an action of FWP_ACTION_BLOCK,
FWP_ACTION_CONTINUE, or FWP_ACTION_PERMIT.
This callout is meant to be for testing purposes only, and would never
dictate real world behavior of a callout.
The chance of each action return can be controlled by command-line
parameters.

Applicable Layers

v
FWPM_LAYER_INBOUND_IPPACKET_V4

v
FWPM_LAYER_INBOUND_IPPACKET_V6

v
FWPM_LAYER_OUTBOUND_IPPACKET_V4

v
FWPM_LAYER_OUTBOUND_IPPACKET_V6

v
FWPM_LAYER_IPFORWARD_V4

v
FWPM_LAYER_IPFORWARD_V6

v
FWPM_LAYER_INBOUND_TRANSPORT_V4

v
FWPM_LAYER_INBOUND_TRANSPORT_V6

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v
FWPM_LAYER_STREAM_V4

v
FWPM_LAYER_STREAM_V6

v
FWPM_LAYER_DATAGRAM_DATA_V4

v
FWPM_LAYER_DATAGRAM_DATA_V6

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT _V4

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

v
FWPM_LAYER_ALE_AUTH_LISTEN_V4

v
FWPM_LAYER_ALE_AUTH_LISTEN_V6

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v
FWPM_LAYER_ALE_AUTH_CONNECT_V4

v
FWPM_LAYER_ALE_AUTH_CONNECT_V6

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v
FWPM_LAYER_STREAM_PACKET_V4                                     (Win7+)

v
FWPM_LAYER_STREAM_PACKET_V6                                     (Win7+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET       (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET   (Win8+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE                            (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE        (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_ETHERNET                  (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_ETHERNET                    (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4      (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6      (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4        (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6        (Win8+)

Command Line Usage

Option

Argument

Meaning

-s

BASIC_ACTION_XXXX

Implement the BASIC_PACKET_INJECTION scenario

-l

Applicable layer

Layer at which this filter will apply

-rab

Integer (0-100)

Determines chance of returning FWP_ACTION_BLOCK for
BASIC_ACTION_RANDOM. [default is 50]*

-rac

Integer (0-100)

Determines chance of returning FWP_ACTION_CONTINUE for
BASIC_ACTION_RANDOM. [default is 25]*

-rap

Integer (0-100)

Determines chance of returning FWP_ACTION_PERMIT for
BASIC_ACTION_RANDOM. [default is 25]*

-c

Causes the action to be returned via a callout, rather than the
filter’s action.

-sl

Applicable subLayer

SubLayer to associate with the filter.  [default is WFPSAMPLER_SUBLAYER].

-v

Make the objects associated with this scenario’s instance dynamic

-b

Make the objects associated with this scenario’s instance available
during boot-time

-r

Remove objects associated with this scenario instance

-?

Display help

*   -rab, -rac, and -rap should total 100. If this is not the case
then the code will try to balance the values out (i.e. if you specify only -rab, then -rac, and -rap are calculated as best as possible).

“WFPSampler.Exe -s
BASIC_ACTION_BLOCK -?“
provides help output

“WFPSampler.Exe -s
BASIC_ACTION_BLOCK -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“
adds a dynamic filter (-v) at
FWPM_LAYER_INBOUND_IPPACKET_V4 (-l)
This filter will have no conditions, meaning it will block all traffic seen at
this layer.

“WFPSampler.Exe -s
BASIC_ACTION_PERMIT  -l
FWPM_LAYER_INBOUND_IPPACKET_V4 -v -c“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which invokes a callout (-c) This filter will have no
conditions, meaning it will allow all traffic seen at this layer (unless
another filter at a different sublayer blocks it).

“WFPSampler.Exe -s
BASIC_ACTION_PERMIT -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -c -r“ removes (-r)
the dynamic filter (-v) at
FWPM_LAYER_INBOUND_IPPACKET_V4 (-l)
which references the appropriate callout (-c).

“WFPSampler.Exe -s BASIC_ACTION_CONTINUE -l
FWPM_LAYER_INBOUND_TRANSPORT_V4  -ipla
1.0.0.1 -ipra 1.0.0.254 -ipp
TCP -c“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4  (-l)
which references the appropriate callout (-c).  This filter will have 3 conditions;
FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS
(-ipra)
equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL (-ipp) equals TCP.

“WFPSampler.Exe -s
BASIC_ACTION_RANDOM -l FWPM_LAYER_INBOUND_TRANSPORT_V4  -ipla 1.0.0.1 -ipra 1.0.0.254 -ipp TCP -rab 50 -rac 25 -rap 25“ adds
a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4  (-l)
which references the appropriate callout.
This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals
1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL
(-ipp)
equals TCP.  The callout will return
FWP_ACTION_BLOCK 50% of the time (-rab), FWP_ACTION_CONTINUE 25% of the time (-rac), and
FWP_ACTION_PERMIT 25% of the time (-rap).  In theory, the traffic should be allowed 50%
of the time, and blocked the 50% of the time.
Notice that we do not have to specify “-c” for this scenario, as it can
only be implemented via a callout.

For a list of conditions applicable to each layer, refer to Filtering
Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring each
condition, refer to Conditions
for Command Line.