BASIC PACKET MODIFICATION

Overview

The Basic Packet Modification scenario will clone the = packet and inject it back to the same layer. Any requested modifications will be performed prior to the injection=

All filters added sit in WFPSampl= er's sublayer (which is weighted just below IPsec's sublayer), unless otherwise specified using the -sl <SUBLAYER> command line option. All filters are associated with WFPSampler's provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Basic Packet Modification Scenario=

When traffic matches a filter at the specified layer, = ClassifyBasicPacketModification() is invoked by the Filtering Engine. This function validates th= at we can perform the injection by looking at the pClassifyO= ut rights. It will then create the INJECTION_DATA which consists of the injectionHandle and the injectionState. If the injectionSt= ate indicates that we haven’t injected this packet before, then the injection method is determined (default is asynchronous), and the appropriate triggerFn is called.= At this point, the original packet will be blocked.

If the injection method is synchronous (inline), TriggerBasicPacketModificationInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. Depending on which layer the injection = is happening, the appropriate performFn is called.=

If the injection method is asynchronous (out of band),= TriggerBasicPacketModificationOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method (default is DPC), the appropriate q= ueueFn is invoked.

Regardless of which queueFn is used, each will call the appropriate performFn = based on the layer the injection is happening.

Each of the performFns are tailored to inject for their respective layers. Each will get the required data for its specific injectionFn. Depending on the layer, the offsets are adjusted on the original so = the whole packet is available. Once the offsets are adjusted, the original is cloned, and the offsets of the origin= al are returned to the original place. Any modification requested will be done to the clone. Finally, the injec= tionFn is invoked.

Upon successful injection, CompleteBasicPacketM= odification() will be called by the TCPIP stack. This function will show the status of the injected packet. Additionally, any memory that was allocated from the functions above, will be freed and any references released.

Applicable Layers

v FWPM_LAYER_INBOUND_IPPACKET_V4

v FWPM_LAYER_INBOUND_IPPACKET_V6

v FWPM_LAYER_OUTBOUND_IPPACKET_V4

v FWPM_LAYER_OUTBOUND_IPPACKET_V6

v FWPM_LAYER_IPFORWARD_V4

v FWPM_LAYER_IPFORWARD_V6

v FWPM_LAYER_INBOUND_TRANSPORT_V4

v FWPM_LAYER_INBOUND_TRANSPORT_V6

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v FWPM_LAYER_DATAGRAM_DATA_V4

v FWPM_LAYER_DATAGRAM_DATA_V6

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v FWPM_LAYER_STREAM_PACKET_V4 (Win7+= )

v FWPM_LAYER_STREAM_PACKET_V6 (Win7+= )

v FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_ETHERNET (Win8+)

Command Line Usage

Option	Argument	Meaning
-s	BASIC_PACKET_MODIFICATION	Implement the BASIC_PACKET_MODIFICATION scenario
-l	Applicable Layer	Layer at which this filter will apply
-mmsa	MAC Address	Modify the source MAC address to the specified MAC address (Ether= net layers only)
-mmda	MAC address	Modify the destination MAC address to the specified MAC address (Ethernet layers only)
-misa	IP address	Modify the source IP address to the specified IP address
-mida	IP address	Modify the destination IP address to the specified IP address
-mtsp	Port	Modify the source port to the specified port (UDP / TCP) or ICMP = Type
-mtdp	Port	Modify the destination port to the specified port (UDP / TCP) or = ICMP Type
-sl	Applicable subLayer	SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER].
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-in		Perform the injection synchronously (inline)
-tdpc		Use threaded DPCs for asynchronous (out of band) queuing method
-wi		Use work items for asynchronous (out of band) queuing method
-r		Remove objects associated with this scenario instance
-?		Display help

“WFPSampler.E= xe -s BASIC_PACKET_MODIFICATION -?“ provides help output

“WFPSampler.E= xe -s BASIC_PACKET_MODIFICATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -mida 1.0.0.1“ adds a d= ynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l= ) which references the appropriate callout. This filter will have no conditions, mea= ning it will act on all traffic seen at this layer. The destination IP address for all packets will be modified to 1.0.0= .1.

“WFPSampler.E= xe -s BASIC_PACKET_MODIFICATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -mida 1.0.0.1 -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKE= T_V4 (-l) which references the appropri= ate callout.

“WFPSampler.E= xe -s BASIC_PACKET_MODIFICATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -ipla 1.0.0.1 -ipra 1.0.0.254 -m= ida 2.0.0.1“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropri= ate callout. This filter will have 2 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, and FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254. Packets matching this filter will have their destination IP address changed to 2.0.0.1.

“WFPSampler.E= xe -s BASIC_PACKET_MODIFICATION -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0.1 -ipra 1.0.0.254 -i= pp TCP -mida 2.0.0.1 -mtdp 35000 -in“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS = (-ipla= ) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL (-ipp)= equals TCP. All packets matching this fil= ter will have their destination IP address changed to 2.0.0.1 and their TCP destination port changed to 35000. The injection will be performed synchronously (-in).

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Conditions for Command Line.