BASIC ACTION=

Overview

The Basic Action scenarios are designed to return simp= le actions. No injection takes place,= and by default, they utilize static filters.

All filters added sit in WFPSampl= er’s sublayer (which is weighted just below IPsec’s sublayer), unless otherwise specified using the –sl <SUBLAYER> command line option. All filters are associated with WFPSampler’s provider.

When a callout is used, the following diagram shows ho= w the code flows:

Figure A. Code flow for Basic Action Scenario

When traffic matches a filter at the specified layer, = and the filter uses a callout, then the ClassifyBasicActio= nFn is invoked by the Filtering Engine. These functions make sure it can update the action and dictates which action to return via PerformBasicAction().

The ClassifyBasicActionBlock() function will always return FWP_ACTION_BLOCK, causing the traffic to be dropped.

The ClassifyBasicActionContinue() function will always return FWP_ACTION_CONTINUE, causing the traffic to be allowed unless another filte= r in a different sublayer returns FWP_ACTION_BLOCK.

The ClassifyBasicActionPermit<= /span>() function will always return FWP_ACTION_PERMIT, causing the traffic to be allowed unless another filter = in a different sublayer returns FWP_ACTION_BLOCK.

The ClassifyBasicActionRandom<= /span>() function (which always uses a callout) will randomly return an action of FWP_ACTION_BLOCK, FWP_ACTION_CONTINUE, or FWP_ACTION_PERMIT. This callout is meant to be for testing purposes only, and would nev= er dictate real world behavior of a callout. The chance of each action return can be controlled by command-line parameters.

Applicable Layers

v FWPM_LAYER_INBOUND_IPPACKET_V4

v FWPM_LAYER_INBOUND_IPPACKET_V6

v FWPM_LAYER_OUTBOUND_IPPACKET_V4

v FWPM_LAYER_OUTBOUND_IPPACKET_V6

v FWPM_LAYER_IPFORWARD_V4

v FWPM_LAYER_IPFORWARD_V6

v FWPM_LAYER_INBOUND_TRANSPORT_V4

v FWPM_LAYER_INBOUND_TRANSPORT_V6

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v FWPM_LAYER_STREAM_V4

v FWPM_LAYER_STREAM_V6

v FWPM_LAYER_DATAGRAM_DATA_V4

v FWPM_LAYER_DATAGRAM_DATA_V6

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT _V4

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

v FWPM_LAYER_ALE_AUTH_LISTEN_V4

v FWPM_LAYER_ALE_AUTH_LISTEN_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v FWPM_LAYER_STREAM_PACKET_V4 (Win7+= )

v FWPM_LAYER_STREAM_PACKET_V6 (Win7+= )

v FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 (Win8+)

Command Line Usage

Option	Argument	Meaning
-s	BASIC_ACTION_XXXX	Implement the BASIC_PACKET_INJECTION scenario
-l	Applicable layer	Layer at which this filter will apply
-rab	Integer (0-100)	Determines chance of returning FWP_ACTION_BLOCK for BASIC_ACTION_RANDOM. [default is 50]*
-rac	Integer (0-100)	Determines chance of returning FWP_ACTION_CONTINUE for BASIC_ACTION_RANDOM. [default is 25]*
-rap	Integer (0-100)	Determines chance of returning FWP_ACTION_PERMIT for BASIC_ACTION_RANDOM. [default is 25]*
-c		Causes the action to be returned via a callout, rather than the filter’s action.
-sl	Applicable subLayer	SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER].
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-r		Remove objects associated with this scenario instance
-?		Display help

* -rab, -rac, and -rap should total 100. If this is not the ca= se then the code will try to balance the values out (i.e. if you specify only = -rab, then -rac, and -rap are calculated as best as possible).

“WFPSampler.E= xe -s BASIC_ACTION_BLOCK -?“ provides help output

“WFPSampler.E= xe -s BASIC_ACTION_BLOCK -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l= ) This filter will have no conditions, meaning it will block all traffic seen= at this layer.

“WFPSampler.E= xe -s BASIC_ACTION_PERMIT -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -c“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKE= T_V4 (-l) which invokes a callout (-c) This filter will have no conditions, meaning it will allow all traffic seen at this layer (unless another filter at a different sublayer blocks it).

“WFPSampler.E= xe -s BASIC_ACTION_PERMIT -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -c -r“ removes (-r= ) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l= ) which references the appropriate callout (-c).

“WFPSampler.Exe -s BASIC_ACTION_CONTINUE -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0.1 -ipra 1.0.0.254 -i= pp TCP -c“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout (-c). This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-= ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_AD= DRESS (-ipra= ) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL (-ipp) equals TCP.

“WFPSampler.E= xe -s BASIC_ACTION_RANDOM -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0= .1 -ipra 1.0.0.254 -ipp TCP -= rab 50 -rac 25 -rap 25“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS = (-ipla= ) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PRO= TOCOL (-ipp<= /b>) equals TCP. The callout will return FWP_ACTION_BLOCK 50% of the time (= -rab), FWP_ACTION_CONTINUE 25% of the time (-rac)= , and FWP_ACTION_PERMIT 25% of the time (-rap). In theory, the traffic should be allowe= d 50% of the time, and blocked the 50% of the time. Notice that we do not have to specify “-c” for this scenario, as it = can only be implemented via a callout.

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.