FLOW ASSOCIATION

Overview

The Flow Association scenario will cause the classification
to associate context to the flow at the specified layers.  This context will then be available as the flowContext parameter of those classifyFns.

All filters added sit in WFPSampler’s
sublayer (which is weighted just below IPsec’s sublayer), unless otherwise
specified using the –sl
<SUBLAYER> command line option.
All filters are associated with WFPSampler’s
provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Flow Association Scenario

When traffic matches a filter at the specified layer, ClassifyFlowAssociation() is invoked by the Filtering
Engine.  This function verify we have
write access, and invoke PerformFlowAssociation().

PerformFlowAssociation() will create the FLOW_CONTEXT and call FwpsFlowAssociateContext()
for the layer(s) that were indicatedfor the context
to be associated with (-awl).

This context will be valid until the flow is terminated or
until FwpsFlowRemoveContext() is called, after which
NotifyFlowDeleteNotification() will be invoked and will clean up
the FLOW_CONTEXT.

Applicable Layers

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v
FWPM_LAYER_ALE_ FLOW_ESTABLISHED_V6

Command Line Usage

Option

Argument

Meaning

-s

FLOW_ASSOCIATION

Implement the FLOW_ASSOCIATION scenario

-l

Applicable Layer

Layer at which this filter will apply

-aws

Scenario

Applicable scenario

-awl

Applicable Layer …

Layer(s) at which to associate Flow

-sl

Applicable sublayer

SubLayer to associate with the filter.  [default is
WFPSAMPLER_SUBLAYER].

-v

Make the objects associated with this scenario’s instance dynamic

-b

Make the objects associated with this scenario’s instance available
during boot-time

-r

Remove objects associated with this scenario instance

-?

Display help

“WFPSampler.Exe -s FLOW_ASSOCIATION
-?“
provides help output

“WFPSampler.Exe -s FLOW_ASSOCIATION
-l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aws BASIC_STREAM_INJECTION
-awl FWPM_LAYER_STREAM_V4 -v“  adds a dynamic filter (-v) at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4
(-l) which references the
appropriate callout.  This filter will
have no conditions, meaning it will act on all flows seen at this layer.  The context will then be visible to all
classifies at FWPM_LAYER_STREAM_V4 (-awl)
using the BASIC_STREAM_INJECTION callout (-aws).  Note that
the scenario for BASIC_STREAM_INJECTION must already have been configured
before implementing this scenario.

“WFPSampler.Exe -s FLOW_ASSOCIATION
-l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4  -aws
BASIC_STREAM_INJECTION -awl FWPM_LAYER_STREAM_V4 -v -r“  removes (-r)
the dynamic filter (-v) at
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 (-l)
which references the appropriate callout.

“WFPSampler.Exe -s FLOW_ASSOCIATION
-l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -ipla 1.0.0.1 -ipra 1.0.0.254 –aws BASIC_STREAM_INJECTION
–awl FWPM_LAYER_STREAM_V4“ adds a persistent
filter at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 (-l) which references the appropriate callout.  This filter will have 2 conditions;
FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, and
FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254.
The context will then be visible to all classifies at
FWPM_LAYER_STREAM_V4 (-awl) using
the BASIC_STREAM_INJECTION callout (-aws).  Note that
the scenario for BASIC_STREAM_INJECTION must already have been configured
before implementing this scenario.

“WFPSampler.Exe -s FLOW_ASSOCIATION
-l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4  -aaid C:\Traffic.exe -ipla 1.0.0.1
-ipra 1.0.0.254 -ipp TCP –iprp 6000 –aws BASIC_STREAM_INJECTION
–awl FWPM_LAYER_STEAM_V4 FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4“ adds a
persistent filter at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4  (-l)
which references the appropriate callout.
This filter will have 5 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid) equals
C:\Traffic.exe, FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1,
FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, FWPM_CONDITION_IP_PROTOCOL  (-ipp) equals
TCP, and FWPM_CONDITION_IP_REMOTE_PORT equals 6000.    The
context will then be visible to all classifies at FWPM_LAYER_STREAM_V4 and
FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 (-awl)
using the BASIC_STREAM_INJECTION (and PEND_ENDPOINT_CLOSURE) callout (-aws).  Note that the scenario for
BASIC_STREAM_INJECTION and PEND_ENDPOINT_CLOSURE must already have been
configured before implementing this scenario.

For a list of conditions applicable to each layer, refer to Filtering
Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring each
condition, refer to Conditions
for Command Line.

Notes

FlowDelete

The FlowDeleteNotificationFn is
only invoked when the flow terminates or FwpsFlowRemoveContext
is called.

Mixing Scenarios

FLOW_ASSOCIATION is only useful when mixed with other
scenarios.  For example:

WFPSampler.exe
-s BASIC_STREAM_INJECTION -l FWPM_LAYER_STREAM_V4 -ipra
1.0.0.254 -iprp 6000 -v

WFPSampler.exe
-s PEND_ENDPOINT_CLOSURE -l FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 -aaid C:\Traffic.exe -ipra
1.0.0.254 -ipp TCP -iprp
6000 -pcd 5000 -v

WFPSampler.exe
-s FLOW_ASSOCIATION -l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aaid
C:\Traffic.exe -ipra 1.0.0.254 -ippTCP
-iprp 6000 -aws
BASIC_STREAM_INJECTION -awl FWPM_LAYER_STREAM_V4
FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 -v

This will associate flows with both the BASIC_STREAM_INJECTION
and PEND_ENDPOINT_CLOSURE scenarios. The endpoint associated with the specified
flow will remain open for the duration of the injection being performed at
STREAM.  Once everything has been
injected, the endpoint is allowed to close, and the flow contexts are cleaned
up.